Applicant Privacy Notice

Last updated: August 19, 2026

1. Scope and Who Is Responsible

This Applicant Privacy Notice explains how Normal Computing Corporation ("Normal," "we," "our," or "us") collects, uses, discloses, and protects personal information in connection with recruiting and potential employment.

It applies when you:

• Apply for a position at Normal, including through our careers site at careers.normalcomputing.com, which is hosted by a recruiting platform acting on our behalf;
• Join our talent community;
• Participate in an interview, assessment, event, or other recruiting activity;
• Are referred to us or introduced by a recruiter; or
• Are identified by Normal as a potential candidate through professional or publicly available sources.

Normal Computing Corporation is the controller or business responsible for applicant information unless a job posting or supplemental notice identifies another Normal entity. Recruiting and applicant-tracking providers process information on our behalf as service providers or processors, subject to their own responsibilities under applicable law.

This Notice does not form part of an employment contract or offer of employment.

"Personal information" includes "personal data" and similar terms under applicable privacy laws.

2. Personal Information We Collect

The information we collect depends on the role, location, and stage of the recruiting process.

Information you provide

We may collect:

• Identity and contact information, such as your name, email address, telephone number, location, and professional profile links;
• Application materials, such as your résumé or curriculum vitae, cover letter, portfolio, publications, work samples, and application responses;
• Professional and educational information, such as employment history, education, qualifications, certifications, skills, and experience;
• Recruiting preferences, such as roles and locations of interest, availability, compensation expectations, relocation preferences, and willingness or authorization to work in a particular country;
• Interview and assessment information, such as scheduling information, interview responses, technical or written exercises, assessment results, and correspondence with Normal;
• Reference information, including the names and contact details of references you provide;
• Accommodation information, where you request an adjustment or accommodation during recruiting; and
• Voluntary equal-opportunity information, such as demographic, disability, or veteran-status information where collection is permitted or required by law.

If we record or transcribe an interview, we will provide a separate notice and obtain any consent required by applicable law.

Information marked as required is necessary for us to process your application or consider you for a role. If you do not provide it, we may be unable to consider your application. Voluntary equal-opportunity information is optional and, where required, is separated from ordinary recruiting records and not used to make routine hiring decisions.

Please do not provide sensitive information that we have not requested.

Information from other sources

We may receive personal information from:

• Recruiters, staffing agencies, and executive-search firms;
• Normal employees or others who refer you;
• Professional networking sites, personal websites, publications, conference materials, and other publicly available professional sources;
• References and former employers, where permitted by law;
• Assessment, credential-verification, and background-check providers; and
• Recruiting, scheduling, communications, and applicant-tracking providers acting on our behalf.

If we obtain your information from another source and applicable law requires notice, we will provide this Notice within the required period, generally by our first communication with you.

Information collected automatically

When you use a careers page, application form, or scheduling tool, the platform and providers supporting the recruiting process may collect:

• IP address and approximate location derived from it;
• Browser, operating system, device, and language information;
• Pages viewed, links selected, referring pages, and timestamps;
• Cookie identifiers and similar technical identifiers; and
• Information used to maintain security, prevent fraud, and diagnose technical problems.

Separate cookie controls and provider privacy notices may apply to a platform's independent processing.

3. How and Why We Use Applicant Information

We may use applicant information to:

• Receive, review, and evaluate applications;
• Assess qualifications, skills, experience, and suitability for a role;
• Communicate with you about your application and schedule interviews;
• Conduct interviews, exercises, assessments, reference checks, and, where permitted, background checks;
• Compare candidates and support recruiting decisions;
• Consider you for other roles, where permitted or with your consent;
• Manage our talent community and recruiting events;
• Provide requested accommodations;
• Verify work authorization and administer immigration or sponsorship processes;
• Maintain recruiting records and improve the consistency and effectiveness of our recruiting process;
• Monitor equal-opportunity practices and comply with employment, immigration, reporting, and recordkeeping obligations;
• Detect, investigate, and prevent fraud, misuse, and security incidents;
• Establish, exercise, or defend legal claims; and
• Evaluate or complete a corporate transaction, such as a financing, merger, reorganization, or sale of assets.

Normal does not use applicant information for unrelated advertising, and we do not sell it.

Automated tools and artificial intelligence

We may use software tools, including tools that incorporate artificial intelligence, to organize applications, identify duplicate records, schedule communications, and assist our personnel in reviewing, summarizing, or checking the consistency of application materials. These tools support our recruiting personnel. We do not make hiring decisions, or other decisions that produce legal or similarly significant effects, based solely on automated processing. People remain responsible for hiring decisions.

Normal does not use applicant information to train machine learning or artificial intelligence models.

EEA and UK lawful bases

Where the European Union General Data Protection Regulation or UK General Data Protection Regulation applies, we rely on one or more of the following lawful bases:

• Steps requested before entering an employment contract, including receiving and evaluating an application;
• Legitimate interests, including identifying and evaluating candidates, administering recruiting, securing our systems, and maintaining appropriate recruiting records;
• Consent, where appropriate, such as for certain talent-community retention, interview recordings, or optional activities;
• Compliance with legal obligations, including employment, immigration, equal-opportunity, and recordkeeping requirements; and
• Establishing, exercising, or defending legal claims.

When we rely on legitimate interests, we consider the nature of the information, our purpose, and the potential effect on you. We do not rely on those interests where they are overridden by your rights and interests.

Where we process special-category information, we rely on an applicable condition such as employment-law obligations and rights, substantial public interest, explicit consent where appropriate, or the establishment, exercise, or defense of legal claims.

Background checks are conducted only where permitted by law and after providing any separately required notice and obtaining any required authorization.

4. How We Disclose Applicant Information

We may disclose applicant information to the following categories of recipients:

• Normal personnel and affiliates, including recruiting, interview, hiring, legal, IT, security, finance, and leadership personnel with a need to access the information;
• Recruiting service providers, including applicant-tracking, recruiting, scheduling, communications, cloud-storage, assessment, and interview-support providers;
• Recruiters, references, and verification providers, where necessary to administer the recruiting process;
• Background-check and screening providers, where permitted and authorized;
• Professional advisers, including lawyers, accountants, auditors, insurers, and consultants;
• Government bodies, regulators, courts, or other parties when disclosure is required by law or reasonably necessary to protect rights, safety, or security;
• Transaction participants, such as potential investors, purchasers, lenders, and advisers involved in a financing, merger, acquisition, reorganization, or sale of assets; and
• Other recipients at your direction or with your authorization.

Where a provider processes applicant information on our behalf, we use contractual protections appropriate to its role and the information involved. A recipient acting as an independent controller is responsible for its own processing under its privacy notice.

We do not disclose applicant information to unrelated third parties for their own marketing.

5. Sale, Sharing, and Targeted Advertising

Normal does not sell applicant information for money or other valuable consideration. Normal also does not share applicant information for cross-context behavioral advertising or process it for targeted advertising as those terms are defined under applicable US state privacy laws.

During the preceding 12 months, Normal has not sold or shared applicant information as those terms are defined by the California Consumer Privacy Act.

6. International Transfers

Normal is headquartered in the United States and recruits internationally. Applicant information may be transferred to and processed in the United States and other countries where Normal, its affiliates, or its providers operate. Those countries may have privacy laws that differ from the laws where you live.

Where required for transfers from the European Economic Area, United Kingdom, or Switzerland, we use an applicable safeguard such as:

• An adequacy decision;
• The European Commission's Standard Contractual Clauses;
• The UK International Data Transfer Agreement;
• The UK Addendum to the European Commission's Standard Contractual Clauses; or
• Another transfer mechanism permitted by applicable law.

You may contact us for more information about the safeguard used for a particular transfer and, where available, to request a copy subject to appropriate redactions.

7. Retention

We retain applicant information for the duration of the recruiting process and for a limited period afterward. This allows us to meet legal and recordkeeping obligations, respond to disputes, maintain the integrity of recruiting decisions, and consider candidates for other roles where permitted.

Our standard retention approach is:

RecordStandard retention period or criterionUnsuccessful applications for US rolesTwo years after the final recruiting decisionUnsuccessful applications for UK, EEA, or Swiss rolesSix months after the final recruiting decision, unless a longer period is required or justified under local lawUnsuccessful applications in other locationsNormally 12 months after the final recruiting decision, subject to local lawTalent-community recordsTwelve months after your consent or last meaningful recruiting interaction, after which we may ask whether you want to remain in the talent communityRecruiting security and technical logsNormally up to 12 months, unless needed to investigate an incident or comply with lawSuccessful applicationsRelevant records are transferred to the personnel file and retained under applicable workforce practices

We may retain information longer when reasonably necessary for a legal hold, investigation, dispute, statutory requirement, or other documented legal need. We may delete information earlier when it is no longer needed.

When a retention period ends, we delete, anonymize, or securely isolate the information as appropriate. Anonymized information that can no longer identify you may be retained for reporting and process analysis.

You can withdraw from future-role consideration at any time by contacting legal@normalcomputing.com.

8. Security

We use administrative, technical, and organizational safeguards designed to protect applicant information against unauthorized access, loss, misuse, alteration, or disclosure.

No transmission or storage system is completely secure. We therefore cannot guarantee absolute security.

9. Your Privacy Rights

Your rights depend on your location and are subject to applicable exceptions.

EEA and UK rights

If the European Union or UK data protection regimes apply, you may have the right to:

• Obtain confirmation of whether we process your personal data and access a copy;
• Correct inaccurate or incomplete personal data;
• Request deletion of personal data;
• Restrict processing;
• Object to processing based on legitimate interests;
• Receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another organization;
• Receive information about, and exercise rights relating to, qualifying automated decision-making; and
• Withdraw consent at any time, without affecting earlier lawful processing.

US state privacy rights

Depending on your state of residence and whether the relevant law applies to Normal, you may have the right to:

• Confirm whether we process your personal information;
• Access or obtain a portable copy of personal information;
• Correct inaccuracies;
• Request deletion;
• Limit certain uses of sensitive personal information;
• Use an authorized agent; and
• Appeal a decision concerning your request.

We will not unlawfully discriminate or retaliate against you for exercising a privacy right. Exercising a privacy right will not, by itself, affect your candidacy.

Exercising your rights

To submit a request, email legal@normalcomputing.com and describe your request and the role or recruiting interaction involved.

We may need to verify your identity before completing the request. We will use verification information only for that purpose. An authorized agent may submit a request where permitted by law, although we may request evidence of the agent's authority and ask you to verify your identity directly.

We respond within the period required by applicable law. This is ordinarily one month under the EEA and UK regimes and 45 days under many US state laws, subject to permitted extensions.

If we deny a request and your state provides an appeal right, you may appeal by replying to our decision or emailing us with "Privacy Request Appeal" in the subject line.

10. California Applicant Disclosures

The following table describes the categories of applicant information Normal may have collected during the preceding 12 months:

CategoryExamples and sourcesPurposesRecipient categoriesIdentifiers and contact informationName, email address, telephone number, address or location, IP address, and professional profile links, obtained from you, referrals, recruiters, professional sources, or devicesCommunications, recruiting administration, security, and legal complianceRecruiting personnel, affiliates, recruiting and communications providers, advisers, and authorities where requiredProfessional, employment, and education informationRésumé, employment history, education, qualifications, publications, work samples, references, and skills, obtained from you, recruiters, referrals, references, and public professional sourcesEvaluating qualifications, conducting recruiting, and maintaining recordsRecruiting personnel, affiliates, recruiting, assessment, and verification providers, and advisersApplication and communications informationApplication responses, correspondence, interview information, exercises, assessments, and scheduling records, primarily provided by you or generated during recruitingAdministering and evaluating applications, communicating with candidates, and legal complianceRecruiting personnel, interviewers, relevant affiliates, recruiting and communications providers, and advisersInternet and electronic activityBrowser, device, pages viewed, interactions, timestamps, cookie identifiers, and security signals, collected automaticallyOperating and securing recruiting services, fraud prevention, analytics, and troubleshootingRecruiting-platform, hosting, analytics, and security providersApproximate geolocationGeneral location inferred from an IP addressSecurity, localization, and recruiting administrationRecruiting-platform, hosting, and security providersSensitive and protected informationWork authorization or immigration information, voluntary demographic information, disability or accommodation information, and other information collected where permittedEmployment-law compliance, accommodations, equal-opportunity monitoring, and recruiting administrationAuthorized recruiting or compliance personnel, relevant providers, advisers, and authorities where requiredAudio, visual, and transcription informationInterview recordings, transcripts, and related summaries where recording or transcription was enabled after notice and any required consentInterview administration, note-taking, evaluation, and maintaining recruiting recordsRecruiting personnel, interviewers, relevant affiliates, and interview-support or recruiting providersInferences and evaluationsInterview feedback, scorecards, assessment results, and conclusions derived from application materialsEvaluating qualifications and making recruiting decisionsRecruiting personnel, interviewers, relevant affiliates, and recruiting providers

The sources, purposes, and recipient categories are described further in Sections 2 through 4. Retention periods and criteria are described in Section 7.

We use sensitive personal information only for recruiting, employment-law compliance, security, accommodation, and other permitted purposes. We do not use it to infer unrelated characteristics.

We do not provide financial incentives in exchange for applicant information.

11. If You Are Hired

If you accept employment with Normal, information collected during recruiting may become part of your personnel record. Further processing will be governed by applicable workforce privacy notices and employment policies.

12. Changes to this Notice

We may update this Notice to reflect changes in our recruiting practices, technology, or legal obligations. We will post the updated version and revise the "Last updated" date.

If a change materially affects how we use previously collected applicant information, we will provide any additional notice or obtain any consent required by law.

13. Contact and Complaints

For privacy questions, requests, or complaints, contact:

Normal Computing Corporation
Attn: Legal and Privacy
27 W 20th Street, Suite 900
New York, NY 10011
United States
legal@normalcomputing.com

If you submit a UK data-protection complaint, we will acknowledge it within 30 days. We will take appropriate steps to investigate it, keep you informed where appropriate, and communicate the outcome without undue delay.

If you are in the EEA or UK, you may also complain to the data-protection authority where you live, work, or believe an infringement occurred. In the UK, this is the Information Commissioner's Office. Contacting Normal first is not a condition of making a complaint to an authority.

‍