Epidemic Sound – privacy notice for job applicants

1. Introduction

This privacy notice describes how Epidemic Sound AB ("Controller", “we”, “our”, “us”) processes personal data when you take part in our recruitment process or otherwise connect with us within such process or via our career site.

As a Controller, Epidemic Sound is responsible for ensuring we use your personal data in compliance with applicable privacy and data protection laws (primarily the General Data

Protection Regulation (EU) 2016/679, the “GDPR”) and protecting your personal data accordingly. We have appointed a Data Protection Officer to help us ensure that we comply with these laws.

It is important that you are informed about how we process your personal data. In this privacy notice, we tell you what you can expect us to do with your personal data. We may update this privacy notice from time to time. At the top of the page, you can see the last date when this was made.

2. Collection of personal data

We primarily collect personal data directly from you, typically when you:

• submit your application, providing us your personal data either as uploaded directly by you or by using a third-party source such as Facebook or LinkedIn;
• connect with our staff, adding your personal data either as uploaded directly by you or by using a third-party source such as Facebook or LinkedIn; or
• communicate with us and provide information of relevance to our recruitment process.

In some cases, a candidate may be someone initially discovered by our talent acquisition team or recommended to us by our other existing employees. Personal data about such discovered, or recommended, potential candidates is also collected via our talent acquisition team.

We process your personal data if you are selected as a work reference by a candidate, in which case the candidate has submitted your contact information during the recruitment process.

3. The types of personal data collected and processed

The categories of personal data we collect is limited to what is relevant for our recruitment process, such as name, contact details, curriculum vitae (CV) and our initial correspondence with each candidate. If you are accepted and agree to further steps in our recruitment process, interview notes, comments and dialogue between people involved in the process will be added as well. We also collect and process information by use of social media, public searches and own or third-party cookies. In some cases, we will ask you to perform an ability test. We will then process your name, email address and test input and results.

4. Why we process your personal data and the legal bases we rely on

The overall reason we collect and process personal data is to manage the steps of our recruitment process, such as to:

• screen applications and the professional profiles of potential candidates;
• interview and evaluate potential candidates for the role or job they have applied or been suggested to apply to; and to contact and check references.

The activities carried out are based on our legitimate interests to reach out to and ensure we match with the right candidates as well as to simplify and facilitate recruitment.

Provided that we have obtained your consent as legal basis, we retain your personal data in our candidate database for the purposes of future recruitments. You consent to this such processing when you submit your application. Read more about this type of storage in Section 5 below.

5. For how long do we store your personal data?

We review our storage of personal data on a regular basis in order to delete or anonymize data when it is no longer necessary to keep for the purposes it was collected.

We will keep personal data relating to a candidate in our candidate database for future job openings provided we have obtained consent for such processing. You may at any time withdraw your consent for processing of personal data for such purpose and choose to delete all information related to your application by contacting us via [email protected]. As soon as we no longer have your consent, the data will be removed for the given purpose.

Furthermore, we will store personal data for two (2) years following the end of a specific recruitment process to be able to respond to potential discrimination claims related to the recruitment.

6. With whom do we share your personal data?

For you to apply to our job openings and in order for us to carry out parts of our recruitment process, the personal data of candidates might need to be shared with third parties such as:

• our contractors and subcontractors, acting as our processors and sub-processors in accordance with our instructions;

• public authorities, e.g. if required by us according to mandatory law; and
• other Epidemic Sound group companies.

Any transfers of your personal data to third parties will be done in accordance with applicable data protection laws. We carefully choose partners that we work with - e.g. Jobylon that provides our recruitment platform, server and hosting companies, or businesses providing other services - to ensure that the candidate’s personal data is processed and protected accordingly.

7. International transfers

The activities described in this privacy notice involve transfers of personal data outside the EU/EEA, for example when we share information between our group companies. When such transfers occur we are responsible for applying mechanisms to keep the data protected
according to the GDPR. This most commonly means relying on an adequacy decision adopted by the European Commission (information about such decisions are available here) or applying standard contractual clauses adopted by the European Commission (available here).

8. Your rights and how to exercise them

There are a number of rights that you may be entitled to exercise in relation to us when we process your personal data. Below, you find a summary of what these rights involve and when they may apply. If you want to make a request to exercise your rights, please contact us using this webform. You can also reach out to our Data Protection Officer using the contact details listed in Section 9 if you have any additional questions or need further help with exercising your rights.

We kindly ask you to note that there may be limitations to your rights and that we may have to take steps to be able to fulfil them correctly, e.g. to confirm your identity and to ensure we continue to respect the rights of others

Your rights and when they may apply:

• Right of access. You have the right to know whether we process personal data relating to you and to obtain a copy of the personal data we process about you. You also have the right to supplementary information similar to the information in this privacy notice to understand how we are using your data, e.g. why we are processing it, what categories of personal data it concerns and for how long we store it.
• Right to rectification. You have the right to have inaccurate personal data about you corrected and, in some cases, you may even supplement it.
• Right to erasure. You have the right to have personal data relating to you erased when we no longer have a relevant or valid reason to process or store it.
• Right to data portability. You may ask to obtain the personal data you have submitted to us, in a machine-readable format, so that you can reuse it or have it forwarded to a third party.
• Right to object. You have the right to object to our continued processing of your personal data which may result in an obligation for us to cease the processing.
• Right to restriction. You may have the right to require that we restrict the processing of your personal data. This may for example be the case if we have incorrect information about you and you do not want the processing to continue until we have rectified it.
• Right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint to a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten). Before you lodge a complaint with the supervisory authority, you are of course always welcome to contact us with any concerns or complaints. The easiest way to do so is to reach out via email at [email protected].

9. How to contact us

If you want to exercise any of your data subject rights, please utilize this webform to submit a request.

If you have any questions or concerns regarding our processing of your personal data, you are more than welcome to contact our Data Protection Officer via [email protected] or via regular mail at the address below.

• Epidemic Sound AB (Attn: DPO)
• Västgötagatan 2, 118 27 Stockholm, Sweden