Recruiting Privacy Notice of For Good AI Inc. dba Zencoder Inc.

This Recruiting Privacy Notice ("Notice") explains Vendor's handling of your personal data.

When we say "Vendor", "we" or "us" in this document, we mean For Good AI Inc. dba Zencoder Inc. and our subsidiary For Good AI Cyprus Sub Ltd (collectively, the "Vendor Group"). As with many other Vendor policies, this Notice does not guarantee that you will be hired and, if you are hired, this document will not be part of your contract of employment, and we may update it from time to time.

This Policy applies regardless of the nature of the potential working relationship (full-time employment, part-time internship, independent contractor relationship, etc.). Many of our workforce members will be employed directly by a third-party service provider acting as an employer of record, rather than being employed by the Vendor Group. References to "employment," "employee," and similar terms in this Notice refer generally to any kind of such working relationship (regardless of whether such relationship could be categorized as an employer/employee relationship under applicable law, and regardless of whether the actual prospective employer is within the Vendor Group or is instead a third-party employer of record or similar entity).

A. What categories of personal data does Vendor collect about me and why does Vendor use it?

Vendor will collect, process and use the following categories of personal data about you ("Candidate Data"):

• contact details, such as your name, home address, telephone number and email address;
• identification data, such as your citizenship, photo, applicant ID, passport data, date and place of birth, national identification number, signature, as well as other government-issued identification information;
• professional social media profile information (e.g., LinkedIn), if you choose to apply online by using your profile;
• information about your job record, education, and additional application-relevant data, such as CV or resume, as position, business title, employee type, management level, time type (full or part time and percentage), job history (including position history, title history, effective dates and past pay groups), education history, qualification or aptitude testing results, skills, certifications, background check results (where permitted by local law).

We collect Candidate Data from you and from other sources, which include companies within the Vendor Group, external recruiters and other referral sources, references you provide, background check providers (if you participate in a background check process in compliance with local law), other service providers that assist us with recruiting efforts (such as a travel agency), and publicly available sources such as your professional LinkedIn profile, your professional profile on your current employer's website, speaker bios on the websites of professional conferences where you have spoken, articles you have published, and press releases or other company announcements.

We collect and use this Candidate Data for a variety of reasons linked to your candidacy. To help clarify these we have set out below a list of reasons why we collect and use this data (the "Processing Purposes") along with examples of some of the Candidate Data used for each of the Processing Purposes:

• considering you for working with us, including reviewing your education and job history, facilitating interviews, checking references and conducting background checks, and notifying you of relevant additional vacancies with us that may interest you, which involves the processing of identification data, contact details, and information about your job record and, where appropriate and permitted by law, other personal history;
• setting up your employment and compensation, including to secure travel or employment visas, and establish payroll and other compensation and benefits, which involves the processing of identification data, contact details, information about your job record;
• complying with applicable laws and employment-related and pre-employment-related requirements along with the administration of those requirements, such as income tax, social security deductions, and employment and immigration laws, which involves the processing of identification data, contact details, information about your job record;
• monitoring and ensuring compliance with applicable policies and procedures and laws, including conducting internal investigations, which involves the processing of identification data, contact details, information about your job record and potential job;
• communicating with you, Vendor employees and third parties, which involves the processing of identification data, contact details, information about your job record and potential job; and other data relevant to your application; and
• responding to and complying with requests and legal demands from regulators or other authorities in or outside of your home country, which involves the processing of identification data, contact details, information about your job record, and could include processing of any other categories of Candidate Data depending on the nature of the demand.

Certain types of Candidate Data that Vendor collects, processes and uses fall into the following special categories of personal data, which we describe as Sensitive Candidate Data. "Sensitive Candidate Data" includes:

• health and medical data, such as information on disability for purposes of accommodating the workplace and compliance with legal obligations;
• criminal records data, in the event you have go through a criminal records background check, where relevant and appropriate to your role;
• trade union membership where required to address labour law; and
• race or ethnicity data such as information contained in your passport or other citizenship and right to work documentation, and information which you have voluntarily provided to Vendor for the purposes of our equal opportunities and diversity monitoring and initiatives (there is no consequence for refusing to provide this information).

The California Consumer Privacy Act classifies such Sensitive Candidate Data and Candidate Data as identification and contact information and related identifiers; professional or employment-related information; education information; Internet, electronic network, and device activity and device information and related identifiers; geolocation information; audio or visual information; characteristics of potentially protected classification information; and health information.

B. What are the GDPR grounds for processing my Candidate Data and Sensitive Candidate Data?

Where applicable, the GDPR requires Vendor to explain to you the legal bases for our collecting, using, and otherwise processing your Candidate Data and Sensitive Candidate Data.

For Candidate Data, our legal bases under EU law are:

• taking steps at your request prior to entering into a contract of employment or other contract with you;
• compliance with legal obligations, in particular in the area of labour and employment law, social security and social protection law, data protection law, tax law and corporate compliance laws;
• legitimate interest of Vendor or its affiliates (see further below for more explanation of this concept);
• your consent, where that is appropriate and allowed by local data protection law.

For Sensitive Candidate Data, our legal bases under EU law are, where permitted by law:

• explicit consent as allowed by local data protection law;
• to carry out the obligations and to exercise the specific rights of Vendor or you in the field of employment and social security and social protection law as permitted by local data protection law and/or a qualifying collective agreement;
• to establish, exercise or defend legal claims or whenever courts are acting in their judicial capacity;
• for substantial public interest as permitted by local data protection law; and
• for assessment of your potential working capacity as permitted by local data protection law.

Where we talk about legitimate interests of Vendor or third parties, this can include:

• sharing information within the Vendor Group;
• human resources management;
• vetting your employment history and qualifications during the recruitment process, if consent is not an appropriate legal basis under the applicable local law;
• workplace safety;
• prevention of fraud, misuse of company IT systems, or money laundering;
• physical security, IT and network security;
• addressing certain domestic or foreign legal requirements;
• internal investigations;
• dispute resolution;
• responding to due diligence requests, and
• preparation for and participation in mergers, acquisitions, asset sales or transfers, or other similar transaction.

C. With whom might Vendor share my personal data?

Vendor may transfer personal data for the Processing Purposes to the following:

• Other members of the Vendor Group. Vendor companies process the data for the Processing Purposes and handle it pursuant to this Notice. Within the Vendor Group, the prospective employer for a particular position is normally the Vendor company that exercises primary responsibility for the Vendor Group's processing of personal data.
• Service providers. As necessary for the Processing Purposes described above, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to process personal data under appropriate instructions ("Service Providers"). For example, the Service Providers may carry out instructions related to recruiting administration, background checks, IT system support, training, compliance, and other activities relevant to the Processing Purposes, and will be subject to appropriate contractual obligations. Workforce members in many countries outside the United States may be employed by a Service Provider acting as our employer of record (EOR).
• Regulators, authorities and other third parties. For the Processing Purposes described above, personal data may be transferred to regulators, courts and other authorities (e.g., tax and law enforcement authorities), external advisors (e.g., auditors and legal advisors), directors of Vendor companies, insurance carriers, benefits providers, internal compliance and investigation teams (including external advisers appointed to conduct internal investigations), and key investors who assist in the recruitment process.
• Acquiring entities. If a Vendor entity may be sold or transferred in whole or in part (or such a sale or transfer is being contemplated), your personal data may be transferred to the new employer or potential new employer as part of the transfer itself or as part of an initial review for such transfer (e.g., due diligence), subject to any rights provided by applicable law, including jurisdictions where the new employer or potential new employer are located.

Some of the recipients we may share Candidate Data and Sensitive Candidate Data with may be located outside your home jurisdiction, including in jurisdictions with laws that the European Union or your country has not recognized as providing an adequate level of protection. In such cases, we make the transfers in compliance with applicable law, such as in reliance on Standard Contractual Clauses approved by the European Commission for such purposes, other relevant contract language, and technical safeguards. You may request a copy of the Standard Contractual Clauses by contacting us as described below.

D. How long will Vendor keep my personal data?

It is our policy not to delete personal data after we determine that its retention no longer is necessary for the Processing Purposes. Where personal data is kept beyond the time that we normally would need to keep it, that period will be determined based on the applicable local law.

E. What rights do I have in respect of my personal data?

Candidates have a number of rights in relation to their Candidate Data and Sensitive Candidate Data. These vary by location and can be subject to important exceptions.

Where they apply, they can be summarized in broad terms as follows:

(i) Right of access

You have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients, and other information about the processing. We do have to take into account the interests of others though, so this is not an absolute right, and in some cases permitted by law we may charge a fee.

(ii) Right to rectification

You have the right to rectify inaccurate or incomplete personal data concerning you.

(iii) Right to erasure

You have the right to ask us to erase certain personal data concerning you.

(iv) Right to restriction of processing

In limited circumstances, you may have the right to request that we restrict processing of your personal data.

(v) Right to data portability

You may have the right to receive certain personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to have the data transmitted to another entity.

(vi) Right to object and rights relating to automated decision-making

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data. This may include requesting human intervention in relation to an automated decision so that you can express your view and to contest the decision.

(vii) Right to withdraw consent

In the cases in which we may process your personal data on the basis of your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us as described below.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

F. Who can I contact about this?

If you have concerns or questions regarding this Notice or if you would like to exercise your rights as a data subject, you may contact Vendor's Legal & Compliance Team: