Employee and Prospective Employee Privacy Notice

In this notice, “we”, “us” and “our” means the SandboxAQ entity employing or proposing to employ you on the date that you receive this notice (“Sandbox”). Sandbox and its affiliates (including Cryptosense SA) are collectively referred to herein as the “Firm”.

About this Privacy Notice

For the purposes of any applicable data protection legislation (including the General Data Protection Regulation (EU) 2016/679 (the "EUGDPR"), the EU GDPR as transposed into UK law by the European Union (Withdrawal) Act 2018 (the "UK GDPR") , the UK Data Protection Act 2018 (the "DPA") , Sandbox is the data controller in respect of your personal data. We are responsible for ensuring that we use your personal data in compliance with applicable laws. Terms such as data controller, personal data and processing shall have the same meaning as defined in the EU General Data Protection Regulations.

This privacy notice applies to employees, prospective employees, former employees, interns, consultants, temporary workers and secondees of our organization (collectively referred to herein for convenience as “Employees”) and sets out the basis on which any personal data about you will be processed by us. Please take the time to read and understand this privacy notice.

Where we refer to 'employee personal data,' 'employment' or‘ contract of employment’ in this notice, we do so for convenience only, and this should not be interpreted as purporting to confer employment status on non-employees to whom this notice also applies. This notice does not form part of any contract of employment and does not confer any contractual right on you or place any contractual obligation on us.

This privacy notice applies with respect to all personal data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that personal data is stored¹⁵. We may update this notice at any time and will notify you in writing of any changes.

Personal Data that We Collect About You

We may collect and process the following personal data about you:

Information that you provide to us (such as through the application process or during interviews) or which is shared via a referral agency or other third-party sources (i.e. LinkedIn).This includes information that you give to us by filling in forms or communicating with us, whether face-to-face, by phone, email or which is otherwise gathered through the recruitment process and during your employment with us. This information may include:
Identity data – including full name, title, date of birth, gender, marital status, nationality and citizenship status, identity card and passport details, social security numbers or local equivalents, and next of kin;
Contact data – including email address, telephone numbers, emergency contacts, and location data (including current home address);
Employment data – including career and personal background information, including education and qualification details, academic transcripts, curriculum vitae, and previous employment background;
Financial data – including salary and benefit information, bank account details, and tax details;
Health data – including medical history and disability; and
Other data – including where allowed under applicable law, information such as equal opportunities/diversity and inclusion monitoring information including information about your race, national or ethnic origin, sexual orientation, sex, gender identity and religion or beliefs, and military veteran status. Where any such information is special category data, we will ensure it is collected and processed in accordance with applicable law.
Information we collect or generate about you. This includes:
Employment data – including your job position, dates of employment, work performance, data relating to training and development needs, records of training, termination arrangements and payments, information relating to grievance and/or disciplinary processes, misconduct or performance issues, data arising in connection with litigation and complaints, and involvement in incident reporting and disclosures;
Health data – including sick leave, maternity/paternity leave and disability status;
Financial data – including compensation history at the Firm;
Information that we collect through your use of our information technology resources, in accordance with applicable law. This includes: usage of your work-issued computer, including the internet, intranet, communications through instant messaging applications, video-conferencing and other third party applications and approved systems ; mobile phone activity; Firm-issued devices (Company Owned Mobile Devices) or Personally Owned Mobile Devices or other removeable media using mobile device management software under the "Bring Your Own Device" Policy, including when wiping those devices ; system login, passwords and access records; data sharing and printing records; information obtained through call recording, telephone calls or video-conferencing ; closed-circuit TV images captured through the legitimate use of CCTV in the office; and premises access and attempted access records;
Information we obtain from other sources. This includes:
information we collect in conducting a background checks, such as criminal and civil litigation history, personal credit history based on reports from any credit reference agencies, identity verification, employment history confirmation, media statements and mentions (including social media), outside business activities, academic qualification verification, bankruptcy filings, evidence of financial probity, driving history (including road traffic offences), drug test results and medical fitness to work results ; information from references in connection with your hiring ; information from third party benefits and health care providers (for example, in relation to fitness to work or potential workplace adjustments).

Uses of Your Personal Data

Your personal data may be stored and processed by us for the following purposes, in accordance with applicable law:

to meet our legal obligations as an employer and perform our obligations and exercise our rights under your contract of employment with us47. For example, we use your personal data to pay you, to evaluate your individual performance, and to provide benefits in connection with your employment;
to discharge our legal, regulatory and health and safety obligations;
to establish, exercise or defend our legal rights or for the purpose of legal proceedings;
for the purposes of occupational health, health and safety assessments, and to make decisions regarding your initial and ongoing fitness for work and workplace adjustments and to maintain systems in connection with these, including third party supplier systems; and
for our legitimate business interests (or the legitimate interests of one or more of our affiliates), such as:
allowing us to effectively, efficiently and consistently administer and manage our Employees and the operation of our business on a global basis;
ensuring a consistent approach to (i) the collection, use, disclosure, transfer and processing of personal data of the Firm’s Employees, and (ii) the Firm’s recruitment of Employees;
monitoring and promotion of equal opportunities/diversity and inclusion;
maintaining compliance with internal policies and procedures;
allowing us to effectively assess your skills and qualifications and your suitability for the role for which you have applied, and otherwise considering you for employment at Sandbox (which may include verifying your qualifications and references with third parties you name);
investigating and responding to complaints from personnel, clients, counterparties or regulators;
preventing personal use of the Firm’s property to the extent permitted under applicable law;
being able to contact you or your family in connection with the recruitment process or in the event of an emergency; and
to maintain contact with you in the future and to notify you of relevant job vacancies with the Firm that you might be interested in. If you do not want us to retain your contact information for this purpose or if you would like us to update it at any stage, please send such request in writing to the contact listed at the end of this notice.
We may be required by law to retain your personal data (for example, for regulatory referencing purposes).
Please note that if you are a prospective employee and you accept an offer of employment at Sandbox, the information we collect during the application and recruitment process will become part of your employment record.

Disclosure of Your Information to Others

We may disclose your personal data to our affiliates for the purposes of:

the management and administration of the Firm's Business, including the maintenance of one or more centralised databases storing personal data;
carrying out the functions that each of them may perform relating to HR decisions;
assessing compliance with applicable laws, rules, regulations and internal policies and procedures across the Firm's business;
where your personal data is held as part of an internal directory, enabling adequate communication with you for the performance of employment duties or for emergency reasons; and
the administration and maintenance of the databases storing personal data relating to our Employees.
We will take steps to ensure that your personal data is accessed only by Employees that have a need to do so for the purposes described in this notice.

We may also share your personal data with third parties outside of the Firm for the following purposes:

to third party agents and contractors for the purposes of providing services to us, including IT and communications service providers, payroll service providers, benefits providers, reference providers, and background check and healthcare providers. These third parties will be subject to confidentiality obligations and they will only use your personal data as described in this privacy notice (or as otherwise notified to you);
to the extent required by law, regulation or court order (for example, if we are under a duty to disclose your personal data in order to comply with any legal obligation or to establish, exercise or defend our legal rights);
to regulators where the Firm or regulator may deem appropriate in the context of the regulatory regimes in which it operates;
in connection with the sale of our business or assets or an acquisition of our business by a third party; and
to provide relevant information to public health authorities and any others that may be explicitly designated to receive and process this data in the future.

Necessity of Personal Data for Employment

The provision of certain personal data is necessary for the Firm to effectively assess your skills and qualifications and your suitability for the role for which you have applied or are employed, as well as for compliance by the Firm with its legal, tax and regulatory obligations. Accordingly, if certain personal data is not provided when requested, Sandbox may not be able to offer you employment or may not able to continue to employ you.

Automated Processing and AI Tools

We currently do not use any processing systems which make decisions and produce legal effects for you, or which may otherwise significantly affect you, based solely on automated processing of your personal data.

EU Position Exception: We will not use AI tooling for the recruitment purposes described below for any position advertised for any position based in the European Union (EU) in order to comply with the EU AI Act.

For positions outside the EU, as part of the recruitment and application process, we may utilize third-party recruitment platforms or tools that incorporate artificial intelligence (AI) or automated functionality. These tools are used exclusively to support SandboxAQ personnel and hiring managers in assessing and processing applications more efficiently and consistently.

Examples of how these tools may be used include but are not limited to:

AI-Assisted Application Review: Analyzing information you provide in your CV and application documents to help understand how that information aligns with the stated requirements of the role.
‍AI-Assisted note takers: Using automated tools during interviews to transcribe and summarize discussion points.

Important Note: These tools do not make any automated decisions regarding your application. All final decisions regarding your application, including suitability for a role, are exclusively made by the relevant SandboxAQ personnel and hiring managers. We have implemented appropriate safeguards, including need to know access, data minimization, human oversight of all AI outputs, manual review and internal guidelines about how these tools are used.

Opt-Out: As part of the application process, you may be given the option to indicate whether you wish to opt out of the use of certain AI-assisted features. If you choose to opt out, your application will be reviewed manually without the involvement of AI tools, and this choice will not negatively affect your consideration for the role.

Retention of Personal Data

How long we hold your personal data will vary. The retention period will be determined by various criteria, including the purpose for which we are using your personal data (we will need to keep the data for as long as is necessary for that purpose) and legal obligations (laws or regulation may set a minimum period for which we have to keep your personal data).

A. Retention of Personal Data for Prospective Employees (Job Candidates)

Effective 25 January 2026: For individuals who apply for a role with us but are not hired (prospective employees), we will retain your personal data for a period determined by the location where the job was advertised or in which you applied, unless otherwise required by law:

United States (US): 3 years
United Kingdom (UK), Canada, United Arab Emirates (UAE), and Switzerland: 3 years
European Union (EU): 12 months

Opt-In for Extended Retention:

For prospective employees in all countries, you will be given an option to opt in to extend the retention of your personal data by a further two (2) years beyond the periods listed above, allowing us to contact you with relevant future job vacancies within the Firm. If you do not wish to be contacted or you do not opt in for the extension, your data will be retained only for the standard period and for any legally required minimum period.

B. Retention of Personal Data for Employees

If you accept an offer of employment at Sandbox, the information we collected during the application and recruitment process will become part of your employment record. We will retain the personal data of current and former Employees (including interns, consultants, temporary workers and secondees) for as long as is necessary to fulfil the purposes for which it is processed, and in line with our internal retention schedule and any applicable legal or regulatory requirements.

Transfers of Personal Data Outside the United Kingdom or European Economic Area (where applicable).

Sandbox is headquartered in the United States and works with customers and partners globally. Your personal information may be transferred to our affiliates or service providers in other countries that may not have a similar level of data protection or privacy laws as the country where you live. We take measures to protect your data in transit and wherever it is stored.

Where we transfer your personal data outside your home country, we will take steps to ensure that your personal data is protected as required under applicable data protection law

Your Rights

You have a number of legal rights in relation to the personal data that we hold about you⁹¹. These rights include:

The right to obtain information regarding the processing of your personal data and access to the personal data which we hold about you;
In some circumstances, the right to receive some personal data in a structured, commonly used and machine-readable format and/or to request that we transmit that data to a third party where this is technically feasible. Please note that this right only applies to personal data which you have provided to us;
The right to withdraw your consent to our processing of your personal data at any time. Please note, however, that we may still be entitled to process your personal data if we have another legitimate basis (other than consent) for doing so;
The right to request that we rectify your personal data if it is inaccurate or incomplete;
The right to request that we erase your personal data in certain circumstances. Please note however that there may be circumstances where you ask us to erase your personal data but we are legally entitled to retain it or such erasure is prohibited by law;
The right to object to, and the right to request that we restrict, our processing of your personal data in certain circumstances. Please note that there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally entitled to continue processing your personal data and/or to refuse that request; and
The right not to be subject to solely automated decisions, including profiling, which have a legal or similarly significant effect on you.

You can exercise your rights by contacting us by using the details set out under "Contacting Us" below. We may ask you to verify your identity to help us respond efficiently to your request.

You also have the right, at any time, to lodge a complaint about our processing of your personal data with the relevant body regulating data protection in your country. In the UK, the data protection authority is the UK Information Commissioner's Office. A list of the EU data protection authorities and contact details is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080¹⁰⁸.

Changes to this privacy notice

Any changes we make to this privacy notice in the future will be notified to relevant Employees.

Contacting Us

If you would like further information on our privacy policy, or practices, please contact us at privacy@SandboxAQ.com.

Last updated November 2025