Employee and Prospective Employee Privacy Notice

In this notice, “we”, “us” and “our” means the SandboxAQ entity employing or proposing to employ you on the date that you receive this notice (“Sandbox”). Sandbox and its affiliates (including Cryptosense SA) are collectively referred to herein as the “Firm.”

About this Privacy Notice

For the purposes of any applicable data protection legislation (including the General Data Protection Regulation

(EU) 2016/679 (the "EU GDPR"), the EU GDPR as transposed into UK law by the European Union

(Withdrawal) Act 2018 (the "UK GDPR"), the UK Data Protection Act 2018 (the "DPA")), Sandbox is the data controller in respect of your personal data. We are responsible for ensuring that we use your personal data in compliance with applicable laws. Terms such as data controller, personal data and processing shall have the same meaning as defined in the EU General Data Protection Regulations.

This privacy notice applies to employees, prospective employees, former employees, interns, consultants, temporary workers and secondees of our organisation (collectively referred to herein for convenience as “Employees”) and sets out the basis on which any personal data about you will be processed by us. Please take the time to read and understand this privacy notice.

Where we refer to 'employee personal data,' 'employment' or ‘contract of employment’ in this notice, we do so for convenience only, and this should not be interpreted as purporting to confer employment status on non-employees to whom this notice also applies. This notice does not form part of any contract of employment and does not confer any contractual right on you, or place any contractual obligation on us.

This privacy notice applies with respect to all personal data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that personal data is stored. We may update this notice at any time and will notify you in writing of any changes.

Personal Data that We Collect About You

We may collect and process the following personal data about you:

Uses of Your Personal Data

Your personal data may be stored and processed by us for the following purposes, in accordance with applicable law:

Please note that if you are a prospective employee and you accept an offer of employment at Sandbox, the information we collect during the application and recruitment process will become part of your employment record.

Disclosure of Your Information to Others

We may disclose your personal data to our affiliates for the purposes of:

We will take steps to ensure that your personal data is accessed only by Employees that have a need to do so for the purposes described in this notice.

We may also share your personal data with third parties outside of the Firm for the following purposes:

Necessity of Personal Data for Employment

The provision of certain personal data is necessary for the Firm to effectively assess your skills and qualifications and your suitability for the role for which you have applied or are employed, as well as for compliance by the Firm with its legal, tax and regulatory obligations.  Accordingly, if certain personal data is not provided when requested, Sandbox may not be able to offer you employment or may not able to continue to employ you.

Automated decisions-making techniques

We do not currently use any processing systems which make decisions and produce legal effects for you, or which may otherwise significantly affect you, based solely on automated processing of your personal data.

Transfers of Personal Data Outside the United Kingdom or European Economic Area (where applicable)

Sandbox is headquartered in the United States and works with customers and partners globally. Your personal information may be transferred to our affiliates or service providers in other countries that may not have a similar level of data protection or privacy laws as the country where you live. We take measures to protect your data in transit and wherever it is stored.

Where we transfer your personal data outside your home country,  we will take steps to ensure that your personal data is protected as required under applicable data protection law (including, where appropriate, under an agreement on terms approved for this purpose by the European Commission or the relevant government or supervisory authority, as the case may be).

You can obtain more details of the protection given to your personal data when it is transferred outside of your home country by contacting us using the details set out under "Contacting Us" below.

Retention of Personal Data

How long we hold your personal data will vary. The retention period will be determined by various criteria, including the purpose for which we are using your personal data (we will need to keep the data for as long as is necessary for that purpose) and legal obligations (laws or regulation may set a minimum period for which we have to keep your personal data).

Your Rights

You have a number of legal rights in relation to the personal data that we hold about you. These rights include:

You can exercise your rights by contacting us by using the details set out under "Contacting Us" below. We may ask you to verify your identity to help us respond efficiently to your request.

You also have the right, at any time, to lodge a complaint about our processing of your personal data with the relevant body regulating data protection in your country. In the UK, the data protection authority is the UK Information Commissioner's Office. A list of the EU data protection authorities and contact details is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

Changes to this privacy notice

Any changes we make to this privacy notice in the future will be notified to relevant Employees.

Contacting Us

If you would like further information on our privacy policy, or practices, please contact us at privacy@SandboxAQ.com.

Last updated February 2023