Privacy policy for the Atomic HR employer branding and recruitment

Date of publication: 19 August 2026 (replaces the version published 7 June 2024)

We at Atomic HR manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system. Atomic HR is a recruitment agency: in addition to recruiting for our own vacancies, we introduce candidates to vacancies at our client companies, who are the prospective employer or contracting party.

In this privacy policy, we explain how we process your personal data if:

1. You visit our Career Site (you being a “Visitor”)

2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us or our client companies (you being a “Connecting Candidate”)

3. You apply for a position with us or with one of our client companies, via our Career Site or a third party service (you being an ”Applying Candidate”)

4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies, or those of our client companies (you being a “Sourced Candidate”)

5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies, or those of our client companies (you being a “Referred Candidate”)

6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.

When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise. When we use the term “client company”, we are referring to a company we recruit on behalf of.

1. About processing of personal data

Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.

There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. We are established in British Columbia, Canada, so the Personal Information Protection and Electronic Documents Act (“PIPEDA”), British Columbia’s Personal Information Protection Act (“PIPA”), and Canada’s Anti-Spam Legislation (“CASL”) apply to us. Depending on where you are located, other data protection laws may also apply to our processing of your personal data - such as the EU Data Protection Regulation (2016/679, “GDPR”), Brazil’s Lei Geral de Proteção de Dados (“LGPD”), or Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares. Where these laws set different standards, we apply the one that gives you the greater protection.

Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.

We are the data controller when we process your personal data as described in this Privacy policy. When we share your personal data with one of our client companies, that client company is a separate data controller for its own use of your personal data, and its own privacy policy applies from that point on.

1. What personal data do we process?

All individuals

• Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.

• Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.

• Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.

• Contact details - Such as your name, email address, telephone number and physical address.

Candidates

• Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.

• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.

• Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.

• Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.

1. Where do we receive your personal data from?

All individuals

• From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.

• Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.

References

• From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.

• From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.

• From your references. If you provide us with references, we may collect information about you from them.

• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.

1. For what purposes do we process your personal data?

Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims. Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above. Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Share your personal data with other recipients, for the purposes mentioned in Section 5 below. Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below. Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy. Affected individuals: Visitors. Categories of personal data used: Device information.

Maintain, develop, test, and otherwise ensure the security of the Career Site. Affected individuals: Visitors. Categories of personal data used: Device information; Technical and statistical data.

Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance. Affected individuals: Visitors. Categories of personal data used: Device information; Technical and statistical data.

Provide you with updates about vacancies with us and with our client companies. Affected individuals: Connecting Candidates. Categories of personal data used: Contact details; Communications data.

Review profiles and applications sent to us. This also includes communicating with you about your application and profile. Affected individuals: Connecting Candidates; Applying Candidates. Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Match your profile against the vacancies we are recruiting for, and present your profile to the relevant client company so that it can consider you for the position. We will tell you which client company we intend to share your profile with before we do so, and you can ask us not to. Affected individuals: Candidates. Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile. Affected individuals: Sourced Candidates; Referred Candidates. Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Contact you directly - by email, telephone, SMS, or messaging applications such as WhatsApp where you have given us those details for that purpose - about specific, current or future vacancies with us or with our client companies. See Section 6 below for the basis on which we send you these messages, and how to stop them. Affected individuals: Candidates. Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Record the interview(s) with you, and produce a written transcript or summary of it, including by using automated transcription tools. Affected individuals: Candidates. Categories of personal data used: Communications data.

Contact you to ask for your participation in surveys Affected individuals: Candidates. Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Contact you to ask you to provide information about a Candidate, and evaluate the information you provide. Affected individuals: References. Categories of personal data used: Contact details; Communications data.

Administer your engagement, if you are placed with one of our client companies - including the contract, invoicing, payment, and the record-keeping obligations that come with it. Affected individuals: Candidates who are placed. Categories of personal data used: Contact details; Communications data; Information in your application.

1. Whom do we share your personal data with?

Our client companies. This is the main purpose of our processing. We share your profile, application and our assessment of you with the client company we are recruiting for, so that it can decide whether to consider and interview you. We will tell you which client company we intend to share your profile with before we do so, and you can ask us not to. From the point of sharing, that client company decides for itself how it uses your personal data, under its own privacy policy and its own retention periods.

Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers, the supplier of our Career Site and related applicant tracking system, our email and messaging providers, interview transcription tools, and - if you are placed - contracting and payment providers.

Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.

To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.

To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.

Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.

We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.

1. On what legal bases do we process your personal data?

To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under the applicable data protection law.

Under Canadian law, the basis we normally rely on is your consent - given expressly when you connect with us, apply for a position, or agree to something specific, or implied from the circumstances where the purpose would be obvious to you and you would reasonably expect it.

Under the GDPR, the LGPD and similar laws, the legal basis we rely on is normally that the processing is necessary for our legitimate interest in operating a recruitment agency - that is, in being able to identify talent with the relevant competence for our own vacancies and for those of our client companies, and to introduce that talent to them. We have concluded that we have a legitimate interest in being able to perform the personal data processing for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose. If you are placed with one of our client companies, we also process your personal data because it is necessary for the performance of a contract, and to comply with our legal obligations.

You can contact us for more information about how this assessment was made. See Section 9 and 10 below for our contact information.

There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we propose to record an interview with you. Please see Section 9 below for more information about your right to withdraw your consent.

Sending you messages about vacancies. When we send you an electronic message about a vacancy - by email, SMS, or a messaging application - we do so on one of the following bases permitted by CASL: your express consent, given when you connected with us, applied, or otherwise told us you wanted to hear from us; the fact that you applied to us or made an inquiry, which permits us to contact you for six months afterwards; an existing relationship with you, such as a placement or a contract, which permits us to contact you for two years after it ends; or the fact that you published your professional contact details publicly, without indicating that you do not wish to receive unsolicited messages, and the vacancy is relevant to your professional role. We will not contact you on WhatsApp or by SMS unless you have given us that number for that purpose. Every message we send identifies us, gives our postal address, and contains a working way to opt out at no cost to you. We act on every opt-out within 10 business days, and you can opt out of one channel without opting out of the others.

1. When do we transfer your personal data outside of your country, and how do we protect it then?

We are established in Canada, and your personal data will normally be stored and processed in Canada. Some of our service providers, and the client companies we introduce you to, are located in other countries - including in the European Union, the United States, and the countries where our client companies operate. This means your personal data may be transferred internationally.

The European Commission has decided that Canada offers an adequate level of protection for personal data processed by commercial organisations under PIPEDA.

When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:

• A decision by the EU Commission that the country outside of the EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. In particular, we rely on the EU Commission’s adequacy decision for Canada, the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.

• Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.

For transfers governed by the LGPD or other Latin American data protection laws, we rely on contractual safeguards with the recipient that require an equivalent standard of protection, and on your consent where the law requires it.

When your personal data is transferred internationally, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.

If you want more information about the cases in which your personal data is transferred internationally you can contact us using the contact details in Section 9 and 10 below.

1. For how long do we keep your personal data?

All individuals

If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.

Visitors

We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.

Candidates

If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.

For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us or with our client companies.

If you don’t succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings - and in any event no longer than twenty-four (24) months from our last contact with you, after which we will delete it or ask you whether you would like to remain in our database.

If you are a Sourced Candidate and you do not respond to us, we keep your personal data for six (6) months from our first contact with you, and then delete it.

If you are placed with one of our client companies, we will keep your personal data for the duration of that engagement, and afterwards for as long as we are required to keep contract, tax and accounting records.

If you are hired by us, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.

We keep a minimal record of your contact details and your messaging preferences after your data is otherwise deleted, so that we can demonstrate that we have respected your choices.

References

We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.

1. What rights do you have, and how can you exercise them?

In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.

If you want to exercise any of the rights listed here, we suggest that you:

• Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;

• Log in to your account with us, where you can use the settings in the account to exercise your rights; or

• Contact us directly at privacy@hireatomic.com.

We will respond to your request within 30 days, at no cost to you.

Right to be informed

You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.

We provide you with such information through this privacy policy, through updates on our Career Site (see also Section 11 below), and by answering any questions you may have for us.

Right to access your personal data.

You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data, including which client companies we have shared it with.

Right to access and to request a transfer of your personal data to another recipient (“data portability”).

You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.

Right to have your personal data deleted (“right to be forgotten”).

In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)

Right to object against our processing of your personal data.

You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances. This includes the right to tell us to stop contacting you about vacancies, and to tell us not to share your profile with a particular client company. If you object to us contacting you, we will stop.

Right to restrict processing.

If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.

When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.

Right to rectification.

You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.

Right to withdraw your consent.

When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.

Right to raise a complaint.

If you have complaints about our processing of your personal data, please contact us first at privacy@hireatomic.com, so that we have the opportunity to put things right.

You can also raise a complaint with a data protection authority. In Canada, you can complain to the Office of the Privacy Commissioner of Canada or, in British Columbia, to the Office of the Information and Privacy Commissioner for British Columbia. Unwanted commercial messages can be reported to the Spam Reporting Centre.

You can also lodge a complaint with your national data protection authority. If you are based in the EU, you can find them listed here. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here. If you are based in Brazil, you can lodge a complaint with the Autoridade Nacional de Proteção de Dados.

1. Where can you turn with comments or questions?

If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to privacy@hireatomic.com, or by post to:

[Full legal entity name] [Street address] [City], British Columbia, [Postal code] Canada

1. Updates to this Privacy policy

We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.

We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.