Applicant Data Privacy Notice

1. Identity of the Data Controller and Contact Details

1. Hive is the data controller responsible for processing the applicant’s personal data in connection with a  job application.
2. For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the BDSG, the following definitions apply throughout this Notice:
   • “Data Controller” means Hive, being the entity that determines the purposes and means of processing of personal data in connection with the recruitment process.
   • “Data Subject” means the individual applicant or candidate to whom this Notice is addressed and whose personal data is collected and processed in connection with a job application submitted to Hive.
   • “Data Processor” means any third party engaged by Hive to process personal data on its behalf and under its documented instructions, including the service providers identified in Section 7.
   • “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR.

For any questions or requests regarding your personal data, please contact: people@hive.app.

2. Categories of Personal Data Processed

1. Hive collects and processes the following categories of Personal Data in connection with the Data Subject's application:
   (a) Identity and contact information: name, email address, phone number, address;
   (b) Application materials: CV/résumé, cover letter, employment history, educational background, qualifications, and skills;
   (c) Recruitment process data: notes and assessments generated during interviews, references, and correspondence relating to the Data Subject's application;
   (d) AI-assisted screening data: structured summaries and fit assessments generated in connection with the automated screening process described in Section 6.

2. Hive does not require any other special categories of Personal Data (as defined under Art. 9 GDPR, including health data, ethnic origin, or religious belief) as part of its standard recruitment process. Where such information is nevertheless voluntarily included in the Data Subject's application materials, the Data Subject should be aware that Hive’s AI-assisted screening tool is not designed to process special category data, and Hive will take steps to ensure such information is handled separately and with the additional safeguards required under Art. 9 GDPR.

3. Legal Basis for Processing

Hive processes the Data Subject's Personal Data on the following legal bases under Art. 6 GDPR:

4. Purposes of Processing

Hive uses the Data Subject's Personal Data exclusively for the purpose of assessing the Data Subject's suitability for the role applied for, and, where the Data Subject has given separate explicit consent, for consideration for future roles that may be relevant to the Data Subject's profile. Personal Data is not used for any purpose unrelated to recruitment, nor is it sold or shared with third parties for marketing or any other commercial purposes.

5. Retention Periods and Erasure

1. Successful applicants: The Data Subject's applicant Personal Data will be transferred to their personnel file upon commencement of employment and processed thereafter under a separate employee privacy notice.
2. Unsuccessful applicants (no retention consent given): The Data Subject's Personal Data will be deleted within six (6) months of the conclusion of the recruitment process for the role applied for. This period enables Hive to respond to any legal claims that may arise in connection with the recruitment process.
3. Unsuccessful applicants (retention consent given): Where the Data Subject has given explicit consent, Hive will retain the Data Subject's Personal Data for up to two (2) years from the date of consent, for the purpose of considering the Data Subject for future relevant roles. The Data Subject may withdraw this consent at any time in accordance with Section 9.

6. Retention Periods and Erasure

1. Hive uses an internal AI-backed tool to assist its HR team in the review of applications. Hive is committed to full transparency regarding the operation of this tool and its implications for the processing of the Data Subject's Personal Data.
2. Scope of processing by the tool:
   (a) Analysis of the content of the Data Subject's application materials (CV, cover letter, stated qualifications and experience);
   (b) Generation of a structured summary of the Data Subject's profile, including an assessment of skills and potential fit for the role;
   (c) Production of an indicative rating to support the structure of the HR team's review.
3. Limitations of the tool:
   (a) The tool does not make any final or binding decisions in respect of the Data Subject's application;
   (b) The tool does not automatically reject or approve any candidate;
   (c) All outputs are reviewed and independently evaluated by a qualified member of Hive’s HR team before any decision is made in respect of the Data Subject's application.
4. Human oversight: Every application is assessed by a human reviewer who exercises independent judgment. The AI-generated output serves as a structured aide to support and not replace that evaluation. The Data Subject will not be subject to a decision based solely on automated processing within the meaning of Art. 22 GDPR. The Data Subject has the right to object to the use of this tool in the assessment of their application in accordance with Section 8.
5. Data Processor: The AI screening tool is built and hosted using infrastructure provided by Lovable Labs Incorporated (“Lovable”), a company registered in Delaware, USA, acting as a Data Processor under a signed Data Processing Agreement (“DPA”) in accordance with Art. 28 GDPR. Lovable processes the Data Subject's Personal Data solely on the Hive’s documented instructions and does not use Personal Data to train any artificial intelligence or machine learning models.
6. AI model providers: To generate profile summaries and fit assessments, the screening tool passes application content to third-party AI foundation model providers. Based on Lovable's current sub-processor list, these include Anthropic, Inc. (Claude) and OpenAI, Inc., both incorporated in the United States. Accordingly, the content of the Data Subject's CV and cover letter may be processed by these providers as part of generating the screening output. These providers act as sub-processors of Lovable and process Personal Data solely for the purpose of generating the AI output.
7. International transfers: As Lovable and its AI model sub-processors (Anthropic, OpenAI) are entities incorporated in the United States, the processing of the Data Subject's Personal Data through this tool involves transfers of Personal Data outside the European Economic Area (“EEA”). Such transfers are governed by the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two: Controller to Processor), incorporated into Hive’s DPA with Lovable. Lovable is contractually required to ensure that any onward transfers of Personal Data to its sub-processors are subject to equivalent appropriate safeguards in accordance with Chapter V GDPR.
8. Sub-processors: A full and up-to-date list of Lovable's sub-processors is available at https://enterprise.lovable.dev/subprocessors. Lovable is required to notify Hive of any changes to this list, and Hive will assess the privacy impact of any such changes.
9. Legal basis: Hive relies on its legitimate interest under Art. 6(1)(f) GDPR in conducting efficient and consistent recruitment as the legal basis for use of this tool. Hive has assessed that this interest is not overridden by the rights and freedoms of the Data Subject, having regard to the mandatory human oversight, the limited and role-specific nature of the processing, and the contractual safeguards in place with Lovable.

7. AI-Assisted Interview Note-Taking

1. Where interviews form part of the recruitment process, Hive may utilise AI-assisted tools to support the taking, transcription, or summarisation of interview notes (hereinafter “Note-Taking Tool”). Hive is committed to transparency regarding any such use and to ensuring the Data Subject's ability to make an informed decision prior to their interview.
2. Consent and opt-out mechanism: The use of any Note-Taking Tool during an interview is subject to the Data Subject's prior consent. Prior to each interview, the Data Subject will receive written notification specifying the Note-Taking Tool to be used in their particular interview, together with relevant information regarding the tool's data processing activities. The Data Subject will be given the opportunity to decline the use of the Note-Taking Tool before the interview takes place. Where the Data Subject declines, the tool will not be activated and interview notes will be taken manually. Such declination will have no bearing on the assessment of the Data Subject's application.
3. Data Processors: The Note-Taking Tool used in any given interview will be operated by a third-party provider acting as a Data Processor under a Data Processing Agreement in accordance with Art. 28 GDPR. The identity of the specific provider will be communicated to the Data Subject in the pre-interview notification referred to above. All such providers are required to process Personal Data solely on Hive’s documented instructions.
4. International transfers: Where the Note-Taking Tool provider is established outside the EEA, any transfer of Personal Data will be subject to appropriate safeguards in accordance with Chapter V GDPR, including where applicable the EU Standard Contractual Clauses. Details of the applicable transfer mechanism will be included in the pre-interview notification.
5. Legal basis: Where the Data Subject has consented to the use of the Note-Taking Tool, Hive relies on Art. 6(1)(a) GDPR as the legal basis for that processing. The Data Subject may withdraw consent at any time prior to or during the interview by notifying the interviewer or by contacting people@hive.app.
6. Retention: Notes and summaries generated through the Note-Taking Tool will be retained as part of the Data Subject's recruitment file and deleted in accordance with the retention periods set out in Section 5.
7. The Data Subject's Personal Data is processed internally by members of the Hive’'s HR and hiring teams on a strictly need-to-know basis. Hive shares Personal Data with the following categories of Data Processors:
   • Greenhouse (Greenhouse Software, Inc.): Hive’s applicant tracking system, acting as a Data Processor under a DPA.
   • Lovable Labs Incorporated: Hive’s AI screening tool provider, acting as a Data Processor under a DPA. Personal Data is transferred to the United States under EU Standard Contractual Clauses (see Section 6).
   Hive does not transfer the Data Subject's Personal Data outside the EEA except where appropriate safeguards are in place as described in this Notice. Hive does not disclose Personal Data to any other third parties without the prior knowledge of the Data Subject, unless required to do so by applicable law or by order of a competent authority.

8. Disclosure of Personal Data and International Transfers

1. The Data Subject's Personal Data is processed internally by members of Hive’s HR and hiring teams on a strictly need-to-know basis. Hive shares Personal Data with the following categories of Data Processors:
   (a) Greenhouse (Greenhouse Software, Inc.): Hive’s applicant tracking system, acting as a Data Processor under a DPA;
   (b) Lovable Labs Incorporated: Hive’s AI screening tool provider, acting as a Data Processor under a DPA. Personal Data is transferred to the United States under EU Standard Contractual Clauses (see Section 6).
2. Hive does not transfer the Data Subject's Personal Data outside the EEA except where appropriate safeguards are in place as described in this Notice. Hive does not disclose Personal Data to any other third parties without the prior knowledge of the Data Subject, unless required to do so by applicable law or by order of a competent authority.

9. AI-Assisted Interview Note-Taking

1. As a Data Subject under the GDPR and BDSG, the Data Subject holds the following rights, which may be exercised free of charge:
   (a) Right of access (Art. 15 GDPR): The Data Subject may request a copy of the Personal Data held by Hive and information regarding the purposes and means of its processing;
   (b) Right to rectification (Art. 16 GDPR): The Data Subject may request the correction of any inaccurate or incomplete Personal Data held by Hive;
   (c) Right to erasure (Art. 17 GDPR): The Data Subject may request the deletion of their Personal Data, subject to applicable retention obligations under law;
   (d) Right to restriction of processing (Art. 18 GDPR): The Data Subject may request that Hive restricts the processing of their Personal Data in certain circumstances prescribed by the GDPR;
   (e) Right to object (Art. 21 GDPR): The Data Subject has the right to object at any time to processing of their Personal Data based on the Hive’'s legitimate interests, including the use of the AI-assisted screening tool described in Section 6. Where the Data Subject objects, Hive shall cease such processing unless it can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the Data Subject;
   (f) Right to data portability (Art. 20 GDPR): Where processing is based on consent or contractual necessity, the Data Subject may request their Personal Data in a structured, commonly used, machine-readable format;
   (g) Right not to be subject to solely automated decisions (Art. 22 GDPR): As described in Section 6, no decision in respect of the Data Subject's application is made solely on the basis of automated processing.
2. To exercise any of the above rights, the Data Subject should submit a request to people@hive.app. Hive will respond within one calendar month of receipt of the request, in accordance with Art. 12 GDPR. In cases of complexity or volume, this period may be extended by a further two months, in which case the Data Subject will be notified accordingly.
3. The Data Subject further retains the right to lodge a complaint with the competent data protection supervisory authority in accordance with Art. 77 GDPR.

10. AI-Assisted Interview Note-Taking

Where Hive processes the Data Subject's Personal Data on the basis of consent, specifically, the optional (two) 2-year retention for future role consideration described in Section 5, the Data Subject has the right to withdraw that consent at any time without prejudice to the lawfulness of processing carried out prior to withdrawal, and without adverse consequence for any current or future application made by the Data Subject. Requests for withdrawal of consent should be submitted to: people@hive.app. Upon receipt of a valid withdrawal request, Hive will delete the Data Subject's Personal Data within thirty (30) calendar days, unless retention is required under a separate legal obligation applicable to Hive.

11. Amendments to This Notice

Hive reserves the right to amend this Notice from time to time to reflect changes in its data processing practices or in applicable law. The current version of this Notice is accessible via the link provided in Hive's application process on its recruitment platform and is dated at the top of this document. Where amendments are material in nature, the updated Notice will be made available via the same link and the date at the top of this document will be revised accordingly. Hive will take reasonable steps to bring material changes to the attention of Data Subjects whose Personal Data is being actively processed at the time of such amendment.