Applicant Privacy Notice

Last updated: September 9, 2026

1. Scope and Who Is Responsible

This Applicant Privacy Notice explains how Normal Computing Corporation ("Normal Computing," "we," "our," or "us") collects, uses, discloses, and protects personal information in connection with recruiting and potential employment.

It applies when you:

• Apply for a position at Normal Computing, including through our careers site at careers.normalcomputing.com, which is hosted by a recruiting platform acting on our behalf;
• Join our talent community;
• Participate in an interview, assessment, event, or other recruiting activity;
• Are referred to us or introduced by a recruiter; or
• Are identified by Normal Computing as a potential candidate through professional or publicly available sources.

Normal Computing Corporation is the controller or business responsible for applicant information unless a job posting or supplemental notice identifies another Normal Computing entity. Recruiting and applicant-tracking providers process information on our behalf as service providers or processors, subject to their own responsibilities under applicable law.

This Notice does not form part of an employment contract or offer of employment.

"Personal information" includes "personal data" and similar terms under applicable privacy laws.

2. Personal Information We Collect

The information we collect depends on the role, location, and stage of the recruiting process.

Information you provide

We may collect:

• Identity and contact information, such as your name, email address, telephone number, location, and professional profile links;
• Application materials, such as your résumé or curriculum vitae, cover letter, portfolio, publications, work samples, and application responses;
• Professional and educational information, such as employment history, education, qualifications, certifications, skills, and experience;
• Recruiting preferences, such as roles and locations of interest, availability, compensation expectations, relocation preferences, and willingness or authorization to work in a particular country;
• Interview and assessment information, such as scheduling information, interview responses, technical or written exercises, assessment results, and correspondence with Normal Computing;
• Reference information, including the names and contact details of references you provide;
• Accommodation information, where you request an adjustment or accommodation during recruiting; and
• Voluntary equal-opportunity information, such as demographic, disability, or veteran-status information where collection is permitted or required by law.

We use meeting transcription tools to support interview notes. Before recording or transcription begins, we provide notice and ask for your agreement. You may decline and continue the interview without recording or transcription. We provide any additional notice and obtain any consent required by applicable law.

Information marked as required is necessary for us to process your application or consider you for a role. If you do not provide it, we may be unable to consider your application. Voluntary equal-opportunity information is optional and, where required, is separated from ordinary recruiting records and not used to make routine hiring decisions.

Please do not provide sensitive information that we have not requested.

Information from other sources

We may receive personal information from:

• Recruiters, staffing agencies, and executive-search firms;
• Normal Computing employees or others who refer you;
• Professional networking sites, personal websites, publications, conference materials, and other publicly available professional sources;
• References and former employers, where permitted by law;
• Assessment, credential-verification, and background-check providers; and
• Recruiting, scheduling, communications, and applicant-tracking providers acting on our behalf.

Where EEA or UK data protection law applies and we obtain your information from another source, we provide this Notice within a reasonable period and no later than one month after obtaining the information. If we communicate with you or disclose the information to another recipient before then, we provide the Notice no later than that first communication or disclosure, unless an applicable legal exception permits otherwise.

Information collected automatically

When you use a careers page, application form, or scheduling tool, the platform and providers supporting the recruiting process may collect:

• IP address and approximate location derived from it;
• Browser, operating system, device, and language information;
• Pages viewed, links selected, referring pages, and timestamps;
• Cookie identifiers and similar technical identifiers; and
• Information used to maintain security, prevent fraud, and diagnose technical problems.

Separate cookie controls and provider privacy notices may apply to a platform's independent processing.

3. How and Why We Use Applicant Information

We may use applicant information to:

• Receive, review, and evaluate applications;
• Assess qualifications, skills, experience, and suitability for a role;
• Communicate with you about your application and schedule interviews;
• Conduct interviews, exercises, assessments, reference checks, and, where permitted, background checks;
• Compare candidates and support recruiting decisions;
• Consider you for other roles, where permitted or with your consent;
• Manage our talent community and recruiting events;
• Provide requested accommodations;
• Verify work authorization and administer immigration or sponsorship processes;
• Maintain recruiting records and improve the consistency and effectiveness of our recruiting process;
• Monitor equal-opportunity practices and comply with employment, immigration, reporting, and recordkeeping obligations;
• Detect, investigate, and prevent fraud, misuse, and security incidents;
• Establish, exercise, or defend legal claims; and
• Evaluate or complete a corporate transaction, such as a financing, merger, reorganization, or sale of assets.

Normal Computing does not use applicant information for unrelated advertising, and we do not sell it.

Automated tools and artificial intelligence

We may use software tools, including tools that incorporate artificial intelligence, to organize applications, identify duplicate records, schedule communications, and assist our personnel in reviewing, summarizing, or checking the consistency of application materials. These tools support our recruiting personnel. We do not make hiring decisions, or other decisions that produce legal or similarly significant effects, based solely on automated processing. People remain responsible for hiring decisions.

Normal Computing does not use applicant information to train machine learning or artificial intelligence models.

EEA and UK lawful bases

Where the European Union General Data Protection Regulation or UK General Data Protection Regulation applies, we rely on one or more of the following lawful bases:

• Steps at your request before entering an employment contract, where processing is necessary to consider your application for a role;
• Our legitimate interests in identifying and assessing candidates, administering recruiting, maintaining appropriate recruiting records, protecting our systems, establishing, exercising, or defending legal claims, and conducting corporate transactions, where those interests are not overridden by your rights and interests;
• Your consent where required or appropriate for an optional activity, such as certain talent-community participation or interview recording. You may withdraw that consent at any time; and
• Compliance with applicable legal obligations, including relevant employment, immigration, equal-opportunity, and recordkeeping requirements.

When we rely on legitimate interests, we consider the nature of the information, our purpose, and the potential effect on you. We do not rely on those interests where they are overridden by your rights and interests.

For special-category personal data covered by EEA or UK law, we require both a lawful basis and an additional condition permitting that processing. Depending on the purpose and applicable law, that condition may concern employment-law rights or obligations, substantial public interest, legal claims, or your explicit consent where appropriate. We apply the safeguards required for the relevant condition.

For criminal-conviction or offence information covered by EEA or UK law, we also require authorization under applicable law and the associated safeguards. We provide any additional information, notices, or authorization requests required for the particular check before it takes place.

Background checks are conducted only where permitted by law and after providing any separately required notice and obtaining any required authorization.

4. How We Disclose Applicant Information

We may disclose applicant information to the following categories of recipients:

• Normal Computing personnel and affiliates, including recruiting, interview, hiring, legal, IT, security, finance, and leadership personnel with a need to access the information;
• Recruiting service providers, including applicant-tracking, recruiting, scheduling, communications, cloud-storage, assessment, and interview-support providers;
• Recruiters, references, and verification providers, where necessary to administer the recruiting process;
• Background-check and screening providers, where permitted and authorized;
• Professional advisers, including lawyers, accountants, auditors, insurers, and consultants;
• Government bodies, regulators, courts, or other parties when disclosure is required by law or reasonably necessary to protect rights, safety, or security;
• Transaction participants, such as potential investors, purchasers, lenders, and advisers involved in a financing, merger, acquisition, reorganization, or sale of assets; and
• Other recipients at your direction or with your authorization.

Where a provider processes applicant information on our behalf, we use contractual protections appropriate to its role and the information involved. A recipient acting as an independent controller is responsible for its own processing under its privacy notice.

We do not disclose applicant information to unrelated third parties for their own marketing.

5. Sale, Sharing, and Targeted Advertising

Normal Computing does not sell applicant information for money or other valuable consideration. Normal Computing also does not share applicant information for cross-context behavioral advertising or process it for targeted advertising as those terms are defined under applicable US state privacy laws.

During the preceding 12 months, Normal Computing has not sold or shared applicant information as those terms are defined by the California Consumer Privacy Act.

6. International Transfers

Normal Computing is headquartered in the United States and recruits internationally. Applicant information may be transferred to and processed in the United States and other countries where Normal Computing, its affiliates, or its providers operate. Those countries may have privacy laws that differ from the laws where you live.

Where required for transfers from the European Economic Area, United Kingdom, or Switzerland, we use an applicable safeguard such as:

• An adequacy decision;
• The European Commission's Standard Contractual Clauses;
• The UK International Data Transfer Agreement;
• The UK Addendum to the European Commission's Standard Contractual Clauses; or
• Another transfer mechanism permitted by applicable law.

You may contact us for more information about the safeguard used for a particular transfer and, where available, to request a copy subject to appropriate redactions.

7. Retention

We retain applicant information for the duration of the recruiting process and for a limited period afterward. This allows us to meet legal and recordkeeping obligations, respond to disputes, maintain the integrity of recruiting decisions, and consider candidates for other roles where permitted.

Our standard retention approach is:

We may retain information longer when reasonably necessary for a legal hold, investigation, dispute, statutory requirement, or other documented legal need. We may delete information earlier when it is no longer needed.

When the applicable retention period ends, we delete or anonymize the information, unless continued retention is necessary for one of the documented legal reasons described above. Information retained for such a reason is restricted to that purpose. We may retain information that has been anonymized so that it can no longer identify you for reporting and recruiting-process analysis.

You can withdraw from future-role consideration at any time by contacting legal@normalcomputing.com. Withdrawing from future-role consideration stops that use of your information. It does not require deletion of limited recruiting records that we must retain to meet legal obligations or preserve legal claims.

8. Security

We use administrative, technical, and organizational safeguards designed to protect applicant information against unauthorized access, loss, misuse, alteration, or disclosure.

No transmission or storage system is completely secure. We therefore cannot guarantee absolute security.

9. Your Privacy Rights

Your rights depend on your location and are subject to applicable exceptions.

EEA and UK rights

If the European Union or UK data protection regimes apply, you may have the right to:

• Obtain confirmation of whether we process your personal data and access a copy;
• Correct inaccurate or incomplete personal data;
• Request deletion of personal data;
• Restrict processing;
• Object to processing based on legitimate interests;
• Receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another organization;
• Receive information about, and exercise rights relating to, qualifying automated decision-making; and
• Withdraw consent at any time, without affecting earlier lawful processing.

Swiss rights

Where Swiss data protection law applies, you may request information about and access to your personal data, request correction, object to processing, and request deletion or the transfer of certain personal data, subject to applicable conditions and exceptions. You may contact the Swiss Federal Data Protection and Information Commissioner about suspected breaches of data protection law.

US state privacy rights

Depending on your state of residence and whether the relevant law applies to Normal Computing, you may have the right to:

• Confirm whether we process your personal information;
• Access or obtain a portable copy of personal information;
• Correct inaccuracies;
• Request deletion;
• Limit certain uses of sensitive personal information;
• Use an authorized agent; and
• Appeal a decision concerning your request.

We will not unlawfully discriminate or retaliate against you for exercising a privacy right. Exercising a privacy right will not, by itself, affect your candidacy.

Exercising your rights

To submit a request, email legal@normalcomputing.com and describe your request and the role or recruiting interaction involved.

We may need to verify your identity before completing the request. We will use verification information only for that purpose. An authorized agent may submit a request where permitted by law, although we may request evidence of the agent's authority and ask you to verify your identity directly.

We respond within the period required by applicable law. This is ordinarily one month under the EEA and UK regimes and 45 days under many US state laws, subject to permitted extensions.

If we deny a request and your state provides an appeal right, you may appeal by replying to our decision or emailing us with "Privacy Request Appeal" in the subject line.

10. California Applicant Disclosures

The following table describes the categories of applicant information Normal Computing may have collected during the preceding 12 months:

The sources, purposes, and recipient categories are described further in Sections 2 through 4. Retention periods and criteria are described in Section 7.

We use sensitive personal information only for recruiting, employment-law compliance, security, accommodation, and other permitted purposes. We do not use it to infer unrelated characteristics.

We do not provide financial incentives in exchange for applicant information.

11. If You Are Hired

If you accept employment with Normal Computing, information collected during recruiting may become part of your personnel record. Further processing will be governed by applicable workforce privacy notices and employment policies.

12. Changes to this Notice

We may update this Notice to reflect changes in our recruiting practices, technology, or legal obligations. We will post the updated version and revise the "Last updated" date.

If a change materially affects how we use previously collected applicant information, we will provide any additional notice or obtain any consent required by law.

13. Contact and Complaints

For privacy questions, requests, or complaints, contact:

Normal Computing Corporation
Attn: Legal and Privacy
27 W 20th Street, Suite 900
New York, NY 10011
United States
legal@normalcomputing.com

If you submit a UK data-protection complaint, we will acknowledge it within 30 days. We will take appropriate steps to investigate it, keep you informed where appropriate, and communicate the outcome without undue delay.

If you are in the EEA or UK, you may also complain to the data-protection authority where you live, work, or believe an infringement occurred. In the UK, this is the Information Commissioner's Office. Contacting Normal Computing first is not a condition of making a complaint to an authority.

‍