Privacy Hub

1. Privacy Notice

Directed to Recruitment Candidates

2. Our contact details

3. Introduction

This privacy notice applies to persons applying for work with us (whether as an employee, worker or contractor).It describes how Enara Bio collects and uses personal information about you during and after your relationship with us,in accordance with the UK General Data Protection Regulation (UK GDPR).

Enara Bio is a "controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under the data protection legislation.

4. The type of personal information we collect

We currently collect and process the following information:

• Personal identifiers, contacts and characteristics (name, contact details)
• The information you have provided to us in your curriculum vitae and covering letter
• Any information you provide to us during an interview

We may also collect, store and use the following types of more sensitive personal information

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Information about your health, including any medical condition, health and sickness records

5. How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for the following reason:

• In connection with your application to work with us.

Please note that if you fail to provide information when requested, which is necessary for us to consider your application(such as evidence of qualifications or work history), we will not be able to process your application successfully.

We may create personal data in connection with the assessment of your application. For example, we may record the views of those considering your application about your suitability for the role for which you have applied and retain interview notes.

We also receive personal information indirectly, from the following sources in the following scenarios:

• Recruitment agencies presenting you as a candidate for a role with us
• Companies who do pre-employment screening for us
• Your colleagues and/or managers when they give us your reference
• CCTV/security cameras installed within the Enara Bio site, or photographic images for other security or compliance purposes when visiting our facility e.g. for interview.

We use the information that you have given us in order to:

• Assess your skills, qualifications, and suitability for the role
• Carry out background checks (for example, obtaining evidence of employment from previous employers, verifying academic records and, if relevant, requesting a copy of your P45), and reference checks, where applicable
• Communicate with you about the recruitment process
• Keep records related to our hiring processes
• Comply with legal or regulatory requirements

We may also use the following types of more sensitive personal information as follows:

• We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process
• We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting

We may share this information with our affliate company Enara Bio Inc and with third-party service providers:

• Our selected recruitment agencies.
• Personio GmbH: Data transmitted as part of your application for a role at Enara Bio will be transferred using TLS encryption and stored in a database. This database is operated by Personio GmbH, which offers a human resource and applicant management software solution.

All our third-party service providers are required to take appropriate security measures to protect your personalinformation in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance withour instructions. Any international transfers of your personal data shall be undertaken in compliance with relevant data protection legislation.

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information are:

• Entering into or performing a contract with you: Processing your personal information is necessary to decidewhether to enter into a contract of employment (or services) with you.
• We have a legitimate interest: It is in our legitimate interests to decide whether to appoint you as it would bebenefcial to our business to appoint someone to that role who meets the requirements for the role and as amember of our workforce.

6. How we store your personal information

Your information is securely stored. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, welimit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to- know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected data security breach and will notifyyou and any applicable regulator of a suspected breach where we are legally required to do so.

We keep your personal information related to our recruitment process/your application for a period of 12 months from the date of your application. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair andtransparent way. However:

• If we wish to retain your personal information on file for a longer period, on the basis that a further opportunitymay arise in future and we may wish to consider you for, we will write to you separately, seeking your explicitconsent to retain your personal information for a fixed period on that basis.
• If you are successful in your application, we will retain the majority of the categories of personal data set outabove for the duration of your working relationship with us and for a reasonable period of time after its termination as described in our Employee Privacy Notice which will be made available to you once you become an employee.

Once we no longer require your personal data for the purposes for which it was collected, we will securely dispose ofyour personal data in accordance with applicable laws and regulations.

If we anonymise your personal information so that you can no longer be identified from it, it is no longer consideredpersonal information and we may use such information without providing any further notice to you.

7. Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at the contact details set out at the beginning of this notice if you wish to make a request.

8. How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at the contact details set out at the beginning of this notice.

You can also complain to the ICO if you are unhappy with how we have used your data.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

v1.0, 23-June-2023