CANDIDATE PRIVACY POLICY

This Candidate Privacy Policy (the “Policy”) describes what personal data we, Automizely Pte. Ltd., and any and its subsidiary and affiliate companies (collectively, “AfterShip”, “We”, “Our” or “Us”), collect and process in connection with Our job candidates and applicants (“Candidate(s)”, or “You”, “Your”), with respect to Your application and Our recruitment processes (the “Application(s)”), as well as why We collect it, how We use it, and how Candidates may exercise their rights thereto.

By submitting Your Application and related Data, You consent to the collection and use of Your Data as described in this Policy. Without such consent, We are unable to process Your Application. Please read this Policy and make sure that You understand and agree to it. If you are hired by AfterShip, your Data may be processed in accordance with Our Employee Privacy Policy.

1. WHAT DATA WE COLLECT, HOW WE COLLECT IT, AND HOW WE USE IT

Throughout the Application, You may provide Us, or We may otherwise have access to, Your personal data, including from recruitment agencies.

AfterShip may collect and process the following categories of Personal Data:

• Recruitment Data: Name, email, CV (including any attachments), social media (e.g., LinkedIn), telephone number, employment status (employed, unemployed, etc.);

• Interview Data: the notes prepared by Your interviewer, an audio or audio-visual recording of Your interview and a transcript of that recording; and

• Background Check Data (subject to applicable law, where and to the extent permitted);

(collectively, “Your Data” or “Data”).

We may collect Data directly from You, as You provide it voluntarily through Your Application, or from other sources such as recruitment agencies, background check services (subject to applicable law), publicly available information, or Your references.

We may use Your Data to assess Your skills, qualifications and overall to verify, consider and process Your Application for any of Our positions, and to communicate with You regarding such processes. We may also use it to manage risk and enhance Our security and anti-fraud measures, and to create aggregated statistical data regarding Our Candidates, which do not identify You, for further development and improvement of Our recruitment processes. We use artificial intelligence tools to assist Our recruitment team. Section 3 explains what those tools do, what they do not do, and the choices You have. We do not use Your Data to train artificial intelligence models, and We do not permit Our Service Providers to do so.

In addition, We may use it to act as permitted by, and to comply with, any applicable legal or regulatory requirements.

In some regions, We may also require You to submit sensitive data relating to Your ethnicity, gender, and whether You have a disability, to ensure Our compliance with Our legal obligations under applicable law. We may also collect sensitive data about Your prior criminal convictions and offences as part of Our background checks for specific roles if permitted or required by law.

In order to conduct any other additional purposes that may require the use of Your Data and which AfterShip determines is not covered by this Policy, We will request Your specific consent in advance.

2. THE PURPOSES FOR OUR USE OF YOUR DATA

We will use and process Your Data as part of the Application process at AfterShip for the following purposes and in reliance on the following lawful bases:

If You reside in a territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for the processing of personal data as described herein, Your acceptance of this Policy will be deemed as Your consent to the processing of Your Data for all purposes detailed in this Policy. To revoke such consent, please contact Us at any time at [email protected].

3. HOW WE USE ARTIFICIAL INTELLIGENCE

We use artificial intelligence tools to assist Our recruitment team.

What We Use These Tools For. We use artificial intelligence tools for three purposes: (i) to produce summaries of Our recruitment activity, such as how many candidates are at each stage of a hiring process; (ii) to answer factual questions from Our recruiters about the status of a hiring process; and (iii) where You have agreed to Your interview being recorded, to prepare a written record of what was said during that interview, which Your interviewer then reviews, corrects, and adopts as their own.

What These Tools Do Not Do. We do not use artificial intelligence to make decisions about You. These tools do not score, rate, rank, or compare Candidates against one another; do not shortlist Candidates or recommend who should progress; do not reject any Application; do not draw conclusions about Your emotions, mood, confidence, sincerity, or state of mind; and do not infer or estimate Your race, ethnicity, age, health, disability, pregnancy, religion, or any similar characteristic.

Every decision about Your Application, is taken by a member of Our recruitment or hiring team who has read Your Application.

Interview Recordings. If You refuse the recording of Your interview(s), the interview(s) will go ahead and Your interviewer will take notes by hand. Declining has no effect on Your Application, is not recorded as a negative factor, and will not be raised again during the interview.

Your Choices. You may ask Us how artificial intelligence tools were used in relation to Your Application, ask for a decision to be reviewed by a person, express Your point of view, and contest a decision. To do so, please contact Us at [email protected].

4. WHERE WE STORE OUR CANDIDATES’ DATA

Your Data will be maintained, processed, and stored by AfterShip and Our Service Providers (as defined in Section 7 below) in AfterShip’s different offices worldwide; this may be in the location(s) where the position was based or elsewhere, as We may deem necessary for the proper handling of Your Application.

AfterShip and the Service Providers processing Data on Our behalf are each committed to protect Your Data in accordance with this Policy and all applicable privacy laws.

To the extent We transfer Candidates’ Data originating in the European Economic Area (EEA), or the United Kingdom (UK) to countries that have not been recognized as offering an adequate level of data protection by the relevant competent authorities, We rely on appropriate contractual undertakings and data transfer mechanism as established under applicable law, such as the Standard Contractual Clauses (SCCs) adopted by the European Commission applicable to the EEA and the UK. If We transfer Candidates’ Data originating from the EEA to the UK or any other jurisdiction covered by an adequacy decision by the appropriate authority, which may include the United States (US), each an “Adequacy Jurisdiction”, and if We transfer such data originating from the UK to EEA or another Adequacy Jurisdiction, We rely on the respective adequacy findings by the appropriate authorities of the originating jurisdiction with respect to the level of data protection offered by the Adequacy Jurisdiction. In the case of the US, adequacy applies only to recipients certified under the EU-US Data Privacy Framework or the UK Extension to it; where a recipient is not so certified, We rely on SCCs.

5. HOW LONG WE MAY KEEP YOUR DATA

We may retain Candidates’ Data even after the applied position has been filled or closed. This is done so that: (i) We could reconsider Candidates for other positions and opportunities at AfterShip; (ii) We may use their Data as reference for future applications submitted by them; (iii) in case the Candidate is hired, for additional employment and business purposes related to their work; and (iv) as reasonably necessary to comply with Our legal obligations, to resolve disputes, prevent fraud and abuse, enforce Our agreements or otherwise protect Our legitimate interests.

By agreeing to this Policy, You expressly consent that AfterShip will retain Your Data in accordance with the following table:

*For purposes hereof, “East Asia” refers to the east Asia-Pacific region, which includes Japan, the Republic of Korea, China, Hong Kong, Macau, Taiwan, but excludes jurisdictions in South Asia, Southeast Asia and Oceania.

6. HOW WE SECURE YOUR DATA

AfterShip has implemented security measures designed to protect the Data of Our candidates, including physical, procedural and electronic measures. These measures provide sound industry standard security, confirmed also by AfterShip’s SOC 2 certification. We also regularly seek new ways and tools for further enhancing the security of Our system and the integrity of the Data that We hold. PLEASE BE AWARE THAT REGARDLESS OF THE MEASURES WE TAKE AND THE EFFORTS WE MAKE, WE CANNOT AND DO NOT GUARANTEE THE ABSOLUTE PROTECTION AND SECURITY OF ANY PERSONAL DATA STORED WITH US.

7. WHO WILL HAVE ACCESS TO YOUR DATA

AfterShip will share Your Data with several selected Service Providers, whose services and solutions complement, facilitate and enhance Our own. These include any recruitment firms, candidate evaluation centers, recruitment software providers, artificial intelligence tool providers, background checks providers, data and cybersecurity services, web analytics, other vendors, and Our business, legal, compliance and financial advisors (collectively, “Service Providers”). Such Service Providers may receive or otherwise have limited access to Our Candidates’ Data, depending on each of their particular roles and purposes in facilitating and enhancing Our Applications processes, and may only use it for such purposes. At the Effective Date of the Policy, AfterShip may share your Data with the following Service Providers:

Additionally, We may disclose or otherwise allow access to any Candidates’ Data pursuant to a legal request, such as a subpoena, search warrant or court order, or in compliance with applicable laws, with or without notice to You, acting upon a good faith belief that We are legally required to, or that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud or other wrongdoing. We may also share Your Data with others, with or without notice to You, acting upon a good faith belief that this will help protect the rights, property or personal safety of AfterShip, any of Our customers or employees, or any member of the general public.

Finally, We may share Data internally within Our group of companies, for the purposes described above. In addition, should AfterShip undergo any change in control, including by means of merger, acquisition or purchase of all or part of its assets, Your Data may be shared with the parties involved therein.

Pursuant to this Section and the other terms herein, Your Data may be transferred to recipients outside the EEA, the UK or any other Adequacy Jurisdiction (including the US). For more information on such measures contact [email protected].

8. THE COOKIES AND TRACKING TECHNOLOGIES THAT WE USE

AfterShip uses certain monitoring and tracking technologies, such as “cookies”, and other downloaded data files, including ones offered by Our Service Providers. These technologies are used to maintain, provide and improve Our processes and operations on an ongoing basis, and in order to provide a better experience to Our website visitors and Candidates.

For example, these technologies enable Us to better secure Our website and services and detect abnormal behaviours, to identify technical issues, and to monitor and improve the overall performance of Our services and processes. Please visit Our Cookie Policy for any additional information on Our cookies practices.

9. HOW CAN YOU ACCESS YOUR DATA OR REQUEST TO DELETE IT

You may exercise Your rights under applicable AI and data protection laws and request: (i) to access to Your Data; (ii) to rectify Your Data; (iii) to erase Your Data; (iv) to port Your Data; (v) to object or to restrict to its processing; (vi) to limit use and disclosure of sensitive personal information; (vii) to not be subject to discrimination in exercising Your rights; (viii) not to be subject to a decision based solely on automated processing that produces legal effects concerning You or similarly significantly affects You, and to obtain human intervention, express Your point of view, and contest such a decision; or (ix) to exercise any similar rights afforded to data subjects under any applicable laws.

In order to exercise Your rights as mentioned in this Section, please contact Us at [email protected], and We will respond within a reasonable timeframe and in accordance with applicable laws.

Please note that We may require additional information, including certain personal data, in order to authenticate and process Your request. Such additional information may be then retained by Us for legal purposes (e.g., as proof of the identity of the person submitting the request), in accordance with this Policy. We may redact from the data that We will make available to You any personal data related to others.

Please also note that such rights are not absolute. Applicable laws or regulatory requirements may allow or require Us to refuse to provide some or all of Your Data. In the event that We cannot accommodate Your request, We will inform You of the reasons why, subject to any legal or regulatory restrictions.

Additionally, You have a right to lodge a complaint with any competent data protection authorities, including if You reside in: (i) the European Union (EU), the supervisory authority of Belgium, or with the supervisory authority in the EU/EEA country where you usually live or work., (ii) the UK, the Information Commissioner’s Office, (iii) the US, Your State’s Attorney General (as relevant), (iv) Singapore, the Personal Data Protection Commission (PDPC), or (v) the competent data protection authority in Your place of residence.

10. WHO IS RESPONSIBLE FOR YOUR DATA

Most data protection laws and regulations, such as the EU and UK GDPR, typically distinguish between two main roles for parties involved in processing personal data: the Data Controller, who determines the purposes and means for the processing activities, and the Data Processor, who processes the data on behalf of the Data Controller.

AfterShip is typically the Data Controller of its Candidates’ Data, and with respect to such Data it assumes the responsibilities of a Data Controller, to the extent required under applicable law and as set forth in this Policy. In such instances, Our Service Providers processing such Data will assume the role of Data Processors.

11. CALIFORNIA REQUIREMENTS

This Policy describes the categories of personal information We may collect in relation to Your Application, Our deletion and retention practices, as well as information about how We may process Your Data, which includes references for “business purposes” under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). WE DO NOT SELL YOUR PERSONAL INFORMATION, OR SHARE IT WITH THIRD PARTIES FOR CROSS-CONTEXTUAL BEHAVIOURAL ADVERTISING PURPOSES, FOR THE INTENTS AND PURPOSES OF CCPA/CPRA. We may disclose personal information to third parties or allow them to collect personal data as described above, if those third parties are Service Providers or partners who have agreed to Our contractual limitations as to their retention, use, and disclosure of such personal information, or if You integrate the services of third parties with Our Services, or direct Us to disclose Your Data to third parties, or as otherwise described above. We do not use automated decision-making technology to make decisions about You, including decisions about Your Application.

12. LIMITATION OF LIABILITY

EXCEPT WHERE PROHIBITED BY LAW, AFTERSHIP’S TOTAL LIABILITY FOR ANY CLAIMS ARISING OUT OF OR RELATING TO THE PROCESSING OF YOUR PERSONAL DATA SHALL NOT EXCEED 500 USD. EXCEPT WHERE PROHIBITED BY LAW, UNDER NO CIRCUMSTANCES SHALL AFTERSHIP BE LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES (EVEN IF AFTERSHIP HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES), RESULTING FROM ANY ASPECT OF AFTERSHIP’S USE OF THE PERSONAL DATA OF ANY THIRD PARTY PROVIDED BY YOU. THESE LIMITATIONS SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW. In some jurisdictions, some of the foregoing limitations may not apply.

13. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in Our privacy practices. The updated Policy will always be made available on Our careers site, and by continuing with Your Application or engaging with Us in the recruitment process after such update, You consent to the updated Policy. If You do not agree, You may withdraw Your Application or request deletion of Your Data at any time.

14. CONTACT US

If You have any questions about this Policy, please contact Us at [email protected] with copy to [email protected].

Pursuant to Article 27 of the General Data Protection Regulation (GDPR), AfterShip has appointed the European Data Protection Office (EDPO) as its GDPR Representative in the European Union. You may contact EDPO regarding matters pertaining to the GDPR: (i) by using EDPO’s online request form: https://edpo.com/gdpr-data-request/; or (ii) by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium. You may also contact AfterShip’s Data Protection Officer by email or mail, respectively, at [email protected] or at AfterShip, 120 Robinson Road #13-01, Singapore 068913.