Oura Recruitment Privacy Notice

We collect and process the below types of personal information from you. This includes information you provide through online job sites, via email, in person or remotely at interviews and/or by any other method.

• We collect personal details such as name, email address, address, telephone number, date of birth, gender, qualifications, experience, information relating to your employment history, skills and experience, as well as your video and audio in case you conduct your interview by video.
• We may receive sensitive information about you such as government identifiers like social security number, passport number, or driver's license number; race or ethnic origin, citizenship or immigration status; religious affiliation; and health information.
• We may keep a record of communications with you.
• Information collected as you progress through any recruitment or hiring process that we may conduct. This may include information collected during interviews and assessments.
• Internet or other similar network activity, such as browsing history, search history, and information about your interaction with our website or any recruiting or hiring platforms that we may use.
• Your recorded interview or transcript in case your interview was performed through a video interview feature.

We may also receive your personal data from third parties:

• Who recommend you as a candidate for a specific job opening or for our business more generally;
• Who act as a reference for you; and
• Who act as recruiters

We have collected and processed the above categories of personal information during the 12 months preceding the date this Recruitment Privacy Notice was last updated for the purposes set forth below.

Data protection law in certain countries requires a "lawful basis" for collecting and retaining personal information. Depending on the processing activity, we rely on one or more of the following lawful bases: taking steps at your request before entering into an employment or other work-related agreement; our legitimate interests in recruiting and evaluating candidates, managing our talent pipeline, and protecting our legal rights; compliance with legal obligations; and, where required, your consent. Where we rely on legitimate interests, we balance those interests against your rights and freedoms. If we process special category personal data, we rely on an additional condition permitted by applicable law, such as carrying out employment-law obligations or, where appropriate, your explicit consent.

We collect and process your personal information for the following purposes, where permitted by applicable law:

• To find and evaluate appropriate candidates to fill our job openings;
• To determine your eligibility and suitability for employment, including verification of references, experience, and qualifications;
• To communicate with you during the recruitment process;
• To conduct background checks and identity verification;
• To send you notifications about positions that may match your profile; and
• To comply with applicable laws and regulations and to protect our legal rights.

We may disclose your personal information to other parties as described below:

• To service providers who are obligated to process your personal information only for the purposes;
• To our professional advisers;
• In relation to a business transition, such as a merger, divestiture, acquisition, liquidation, or sale;
• To our affiliates and related companies when necessary for the purposes defined in this Recruitment Privacy Notice;
• To comply with applicable law, enforce our rights, or protect property, security, or safety; and
• As requested or directed by you or otherwise with your consent.

Please also note that there are certain situations when you will be asked to share personal information directly with third parties, such as where you have applied to a job opening through another service provider. In those situations, those third parties control how your personal information is processed and they will provide you with their own privacy statements. Please ensure you read and understand the privacy policies and practices of those third parties.

We have security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorized way. However, the security of information transmitted through the internet or via a device can never be guaranteed. Oura is not responsible for any interception or interruption of any communications through the internet or for changes to or losses of data. You are responsible for maintaining the security of any password, user ID, or other form of authentication involved in your application process.

Your personal data may be processed within the jurisdiction where you're an applicant and where the Oura entity that you're applying to resides, in addition to the EU, United Kingdom, Singapore, and United States. These countries may not have the same data protection laws as your country of residence. When we transfer or permit access to your information outside your home country, we use safeguards required by applicable law. For transfers from the European Economic Area or the United Kingdom, these safeguards may include an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, or another valid transfer mechanism. For transfers from Singapore, we take reasonable steps to ensure that recipients are subject to legally enforceable obligations that provide a standard of protection comparable to the Singapore Personal Data Protection Act. You may contact us using the details below for further information about applicable transfer safeguards.

If you would like further information about international transfers or the safeguards we use, please contact us (see "Contact" below).

Except as otherwise permitted or required by applicable law or regulation, we retain your personal information for the duration of the recruitment process and thereafter only for as long as necessary for the purposes described in this Privacy Notice, including to consider you for future opportunities where permitted by applicable law; comply with legal, accounting, reporting, or recordkeeping obligations; establish, exercise, or defend legal claims; or comply with our document retention policies. We apply retention periods and deletion criteria that take account of the category of personal information, whether you are selected for a role, any applicable legal requirements or limitations periods, the sensitivity of the information, and the potential risk of harm from unauthorized use or disclosure. We delete or anonymize personal information when it is no longer needed, subject to applicable law.

Subject to local data protection laws and in particular under the GDPR and the UK GDPR, residents of the European Union and similar jurisdictions have certain rights that enable you to control how your personal information is processed. In summary, those include:

• Right to access data. You have the right to know what personal information is processed about you. You may contact us to request access to the personal information we have collected about you, and we will confirm whether we are processing your information, and provide you with information about the personal information we have collected and processed.
• Right to rectification (of inaccurate data). You have the right to request correction of any incorrect or incomplete personal information we have stored about you.
• Right to erasure. You have the right to request the deletion of your personal information in certain circumstances. We will comply with such requests unless we have a valid legal basis not to do so, or a legal obligation to preserve the information.
• Right to data portability. You have the right to receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit that information to a third party in certain situations.
• Right to object to processing. You have the right to object to or opt out of the processing of your personal information under certain circumstances. In the event that we do not have legitimate grounds to continue processing such personal information, we will no longer process your personal information after we have received and verified your objection.
• Right to restrict processing. You have the right to request that we restrict processing some types of personal information under certain circumstances.

If you reside in the United States, depending on the state in which you reside, you may have certain privacy rights regarding your personal information. Your privacy rights may include (if applicable in your state of residence):

• The right to confirm whether or not we are processing your personal information and to access such personal information;
• The right to obtain a copy of your personal information that we collected from and/or about you;
• The right to delete personal information that we collected from and/or about you, subject to certain exceptions;
• The right to correct inaccurate personal information that we maintain about you, subject to certain exceptions;
• The right, if applicable, to opt out of the processing of your personal information for purposes of (1) targeted advertising; (2) the "sale" of your personal information (as that term is defined by applicable law); and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
• If we are required by applicable law to obtain your consent to process sensitive personal information, the right to withdraw your consent; and
• The right not to be discriminated against for exercising your privacy rights.

Please note that Oura does not sell personal information or share it with third parties for cross-context behavioral advertising. Oura may disclose personal information as set forth above. Oura may collect sensitive personal information, including government identifiers, citizenship or immigration status, race or ethnic origin, religious affiliation, and health information, when you provide it or when permitted by applicable law. Oura does not use or disclose sensitive personal information for the purpose of inferring characteristics about individuals or for purposes other than those permitted by applicable privacy laws and regulations.

If you would like to exercise any of those rights, please contact dataprotection@ouraring.com. Please provide your name, contact information, your relationship to us, and the details of your request. Oura may require additional information from you to help us confirm your identity before processing your request. Please note that your data request may be subject to certain conditions, restrictions, or exceptions. Applicable law may allow or require us to deny your request in whole or in part. If we deny your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

We strive to address your privacy concerns. If you have contacted us about your issue and are still unhappy with our response, subject to applicable law, you may contact your local supervisory authority regarding your issue. However, we urge you to first contact us at dataprotection@ouraring.com so that we can more quickly resolve your issue before escalating the issue.