Last modified: May 2018

Notice of Privacy and Processing of Candidate Personal Data

Palantir Technologies Inc. and our subsidiaries worldwide (“Palantir” or “we”) are committed to complying with data protection legislation, including the data protection regime introduced by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”). This Notice of Privacy and Processing of Candidate Personal Data (the “Candidate Privacy Notice”) describes the “personal data” (as defined in the GDPR) that we collect about our Candidates (the “Candidate Data”) when they apply for a job at Palantir, what we do with that information, and what rights apply to candidates who are covered by the GDPR (the “Candidate(s)”).

1. Who is responsible for the processing of Candidate Data?

Palantir is the so-called “Data Controller,” which decides why and how Candidate Data is collected and processed when Candidates apply for a job at Palantir.

2. What type of Candidate Data do we collect, and how is it collected?

For prospective, current, and former Candidates, at the start of the application process, we typically collect:

• Basic identification and contact information (e.g. full name, phone number, email).
• Education (e.g. university attended) and current employer.
• CV / resume, which typically describes professional experiences, qualifications, education, and other information that the Candidate voluntarily includes.
• Information regarding how the Candidate heard of the position.
• Country the Candidate is applying from, a representation that they are legally authorized to work in the country where the position is based, and whether the Candidate needs sponsorship for employment visa status.
• Optional links to the Candidate’s professional profile / page (e.g. LinkedIn URL, GitHub URL, Portfolio URL).
• Responses to application questions, such as: What has been your favorite project or proudest accomplishment? Why? Why do you want to work at Palantir?
• Optional additional information that the Candidate voluntarily provides.
• Depending on the role, we may request information on language skills, a cover letter, sample of work, or engagement in various testing activities prior to interview.
• In some cases, usually where Candidates volunteer it, the personal data that we process will also include special categories of data, such as diversity-related information (including data about racial and ethnic origin, religious beliefs and other beliefs of a similar nature) and health related data (including data about any disabilities).

If a Candidate is selected for an interview and requests an accommodation during the interview process, we may also collect health related data as provided by the Candidate (including data about any disabilities) in connection with the accommodation request.

If a Candidate advances in the application process, we will usually collect additional information about the Candidate during the interview process, such as:

• Additional education and employment information (e.g. employment dates with a Candidate’s current / prior employers, positions held, etc.).
• Interview performance evaluation and scores / assessments from testing conducted as part of the interview process.
• Language skills or areas of expertise and interest.
• Information relevant to arranging Candidate travel to Palantir offices, if needed for interview purposes.
• Other information that Candidates choose to disclose during the interview process.

Information submitted as part of the application process, which includes any assessments and interviews, must be true, accurate, complete, and not misleading. Any false or misleading statements or omissions made by Candidates during the application process may be sufficient cause to justify the rejection of a Candidate’s application or, if the Candidate has already become an employee, the immediate termination of employment, in accordance with applicable law.

If a Candidate successfully completes the interview process and accepts an offer of employment from Palantir, then, prior to the start of their employment, we will collect additional Candidate Data (e.g., data to verify work eligibility, data regarding alleged or proven criminal offenses, to the extent permitted by applicable law). Additional information about this process will be provided to individuals who receive and accept an offer of employment from Palantir.

In some cases, the personal data we collect from Candidates is needed to meet our legal or regulatory obligations. If so, we will indicate that the provision of this information is mandatory.

Additionally, as part of the recruitment and application process, Palantir may also collect Candidate Data indirectly from third parties, such as:

• Recruitment agencies that Candidates use to apply to Palantir.
• Personal referrals submitted by Candidates.
• Publicly available sources such as business- and employment-oriented social networking services and job boards where Candidates may post their information.
• Paid and unpaid recruiting services used to obtain Candidate contact information in connection with recruiting efforts.
• Background check providers (if Candidates receive and accept an offer of employment from Palantir).

3. What do we use Candidate Data for?

We process Candidate Data in order to:

• undertake recruitment activities, such as determining the suitability of a Candidate’s qualifications, checking for existing or potential conflicts of interest or any other restrictions which may otherwise restrict or prevent a Candidate’s employment with Palantir;
• undertake business management/security and employment planning activities, where permitted;
• reply to official requests from a public or judicial authority with the necessary authorization;
• plan, prepare for and implement any future merger, acquisition, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Palantir’s assets, in which Candidate Data is among the assets transferred; and
• comply with any legal obligations imposed on Palantir in relation to its recruitment practices and record retention obligations.

4. What’s the legal basis for why we use Candidate Data?

We are not allowed to process Candidate Data if we do not have a valid legal basis. Therefore, we will only process Candidate Data if:

• the processing is necessary for Palantir’s legitimate interests, and does not unduly affect a Candidate’s interests or fundamental rights and freedoms (see below);
• the processing is necessary to perform our contractual obligations towards a Candidate, or to take agreed upon pre-contractual steps, such as preparing documentation for a Candidate following a decision to make an offer of employment;
• the processing is necessary to comply with our legal or regulatory obligations;
• the processing is necessary to protect the vital interests of the relevant individual or of another natural person, such as providing disability access to Palantir premises for interviews where applicable;
• the processing is necessary for the performance of a task carried out in the public interest; or
• in some cases, and if requested from Candidates from time to time, we have obtained Candidate prior consent.

Examples of the “legitimate interests” referred to above are:

• to benefit from cost-effective services (e.g. we may opt to use certain IT platforms offered by suppliers);
• to determine whether a Candidate or potential Candidate’s skills and experience are suitable for a role within Palantir, and determine whether or not to (i) make an offer of employment with Palantir; or (ii) approach a Candidate with a view to making an offer of employment with Palantir, on this basis;
• at the appropriate stage in the recruitment process (i.e. as part of making an offer of employment), to verify the accuracy of information provided to us as part of an application, including through background screening if and when an offer of employment is made and accepted;
• to prevent fraud or criminal activity, misuse of our products or services, as well as to ensure the security of Palantir IT systems, architecture, networks and premises;
• to otherwise exercise our fundamental rights to property and to operate a business under articles 16 and 17 of the EU’s Charter of Fundamental Rights; and
• to meet our corporate and social responsibility objectives.

To the extent that we process any special categories of personal data relating to Candidates, we will do so because:

• the processing is necessary to carry out our obligations under employment, social security, or social protection law;
• the processing is necessary for the establishment, exercise, or defense of a legal claim;
• the processing is necessary for reasons of substantial public interest; or
• the Candidate has given explicit consent to us to process that information (where legally permissible).

5. How do we protect Candidate Data?

All Palantir personnel accessing Candidate Data must comply with our internal rules and processes in relation to the processing of that data, to protect it and ensure its confidentiality. Palantir Personnel are also required to follow the technical and organizational security measures put in place to protect Candidate Data.

We have also implemented technical and organizational measures to protect Candidate Data against unauthorized, accidental, or unlawful destruction, loss, alteration, misuse, disclosure, or access and against all other unlawful forms of processing. These security measures have been implemented taking into account the state of the art of the technology, their cost of implementation, the risks presented by the processing, and the nature of the Candidate Data, with particular care for sensitive personal data.

6. Who has access to Candidate Data and with whom is it shared?

6.1 Within Palantir

We make Candidate Data available to appropriate Palantir personnel to complete the purposes indicated in section 3 above.

6.2 Outside Palantir

We usually also transfer relevant Candidate Data to third parties outside Palantir to complete the purposes listed in section 3 above, including:

• third party service providers, such as our recruiting platform provider, our hosting providers, cloud service providers, database providers, vendors who manage online testing as part of the interview process, and if a Candidate receives and accepts an offer of employment, then also to a third party who carries out pre-employment checks on prospective employees. Palantir works to ensure that these service providers are contractually obligated to protect Candidate Data;
• any national and/or international regulatory, enforcement or exchange, body or court where we are required to do so by applicable laws or regulations or at their request;
• any central or local government department and other statutory or public bodies, where required by applicable laws or regulations;
• to a buyer or other successor in the event of a merger, acquisition, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Palantir’s assets, in which Candidate Data is among the assets transferred; and
• any other legitimate recipient of communications required by applicable laws or regulations.

6.3 Transfers outside the European Economic Area

The Candidate Data transferred within or outside Palantir as set out in sections 6.1 and 6.2 above, is in some cases also processed in a country outside the EEA, which covers the EU member states, Iceland, Liechtenstein and Norway. A list of the countries in which Palantir operates (inside and outside the EEA) can be found at: https://www.palantir.com/contact/. Non-EEA countries may not offer the same level of personal data protection as EEA countries.

If Candidate Data is transferred outside the EEA, we will put in place suitable safeguards to ensure that such transfer is carried out in compliance with applicable data protection laws and regulations. To ensure this level of protection for Candidate Data, Palantir may use a data transfer agreement with the third-party recipient based on standard contractual clauses approved by the European Commission or ensure that the transfer is to a jurisdiction that is the subject of an adequacy decision by the European Commission or to the US under the EU-US Privacy Shield framework. Where Palantir transfers Candidate Data to other group companies, we rely on the standard contractual clauses approved by the European Commission. Candidates may request additional information about the relevant safeguards by exercising their rights as set out below.

7. How long do we store Candidate Data?

When applying for a job at Palantir, Candidates are asked whether they would like to be contacted about future job opportunities with Palantir, for up to three (3) years. This is voluntary, and Candidates are not required to agree to this. Further, a Candidate’s response to this question will not impact Palantir’s consideration of the Candidate for the position to which he/she is currently applying.

If a Candidate voluntarily indicates that Palantir may contact him/her about future job opportunities, then Palantir will retain the Candidate Data in order to contact the Candidate about potentially suitable job opportunities for up to three (3) years. The Candidate may revoke his/her consent at any time.

If a Candidate does not indicate that Palantir may contact him/her about future job opportunities, or if a Candidate revokes his/her consent, then Palantir will retain the Candidate Data for only as long as necessary to fulfill the purpose for which it was collected or to comply with applicable legal, regulatory or internal policy requirements. In general, although there may be limited exceptions, Palantir will keep Candidate Data for unsuccessful Candidates who do not request to be contacted for future job opportunities for 6 months to 1 year, following communication of the decision that the Candidate’s most recent application is unsuccessful. The exact length of time will vary by jurisdiction and individual circumstances. If Candidates wish to have their personal data, including contact information, removed from our databases, they can inform their Recruiter and/or make a request as described in section 8 below, which we will review as set out therein.

Data relating to successful Candidates who accept employment with Palantir, is dealt with by the employee privacy notice that will be provided upon joining Palantir.

8. What are Candidates’ rights and how can they exercise them?

8.1 Candidates’ rights

Candidates have a number of rights in respect of Candidate Data. Details of those rights can be found in Palantir’s Privacy and Security Statement here: https://www.palantir.com/privacy-and-security/

8.2 Candidates who wish to exercise their rights

To exercise the above rights, Candidates may send an email to data-subject-request@palantir.com.

If a Candidate makes the above request and is not satisfied with Palantir’s response, he or she has the right to make a complaint to the data protection authority in the jurisdiction where the Candidate lives or works, or in the place where the Candidate thinks an issue in relation to his or her personal data has arisen.

9. Updates to this Privacy Notice

This Candidate Privacy Notice was last updated in May 2018. It may be subject to amendments. Any future changes or additions to the processing of Candidate Data as described in this Candidate Privacy Notice will be communicated to Candidates through an appropriate channel.

10. Data Protection Officer

To communicate with our Data Protection Officer, please email privacy@palantir.com.