Cohere Applicant Privacy Notice

This Job Applicant Privacy Notice (“Notice”) describes how Cohere and its affiliates (“Cohere”, “we”, “us”) collect, use and otherwise process personal information when you apply for a job or other engagement with us. This includes information collected through our recruitment platforms (like Ashby), third-party recruiters, and talent sourcing platforms. This Notice includes additional information for specific jurisdictions, available in the Addenda for the EU/UK and for California.

It also describes your data protection rights, including, depending on where you reside, the right to object to some of the processing which we carry out. More information about your rights, and how to exercise them, is set out below.

This Notice does not form part of any contract of employment or engagement with Cohere. We may process personal information that is subject to additional or separate privacy notices. For example, if you access our website or interact with our marketing emails, our Privacy Notice applies.

We also may provide you with additional information when we collect personal information, where we feel it would be helpful to provide relevant and timely information.

The following is an overview of the contents of this notice, which you can also use to jump to the most relevant sections for you.

Who Will Handle Your Job Application

Personal Information We Collect & How We Collect It

How We Use Job Applicant Information

Disclosure of Personal Information

Safeguards, Retention, and Privacy Governance Policies

Rights and Choices

Contact Us

Updates to this Notice

Jurisdiction Specific Addenda

Notice to Job Applicants located in the European Union or United Kingdom:

Notice to Residents of California (CCPA)

Who Will Handle Your Job Application

Cohere hires talent globally. Generally, Cohere Inc. (headquartered in Toronto, Canada) will be the controller of your applicant personal information. If a local Cohere affiliate is identified on the application form, they will be operating as a service provider or processor to Cohere Inc. to receive and process your application.

Personal Information We Collect & How We Collect It

Cohere collects personal information for the purposes described in this Notice. Personal information is any information that identifies you or can be used to identify you. Most personal information is collected directly from you. We also collect personal information from third parties as indicated below.

Categories of personal information we collect (where permitted under local law) and the sources from which we collect it may include:

Category	Examples of Data	Primary Sources
Identifiers & Contact Details	Name, email address, phone number, home address, LinkedIn profile URL	You; Recruiters; LinkedIn; Public Data Sources or Talent Sourcing Platforms
Application, Assessment and Hiring Data	CV/Resume, cover letter, transcripts, answers to application questions, video recordings and transcripts of job interviews (with your consent), correspondence with you, outcome of your application, details of any offer made to you.	You; Recruiters; Cohere
Professional History	Previous employers, titles, dates of employment, skills, qualifications, and references	You; LinkedIn; Third-party background check providers
Background Check Data	After you consent, required verifications for your role, e.g., education, employment history, credit history, criminal history (where permitted by local law)	Third-party background check providers and relevant databases
Equity and Diversity Data (Voluntary)	Voluntary disclosure of gender, race, or ethnicity for the purpose of any required reporting (with your consent).	You

How we use job applicant information

We use the information we collect from job applicants to:

• process your application, evaluate your qualifications, experience, background and suitability for the desired position, make informed decisions on recruitment, communicate with you about your application, respond to your inquiries and schedule interviews;
• contact you about future career opportunities;
• improve our recruitment process;
• verify the details you have supplied and, where applicable, conduct pre-employment background checks;
• to protect our business and legal rights in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes and ethics and compliance reporting requirements; and
• comply with legal, regulatory and other requirements under applicable laws, including equal opportunity employment reporting obligations.

In accordance with our retention policies, and subject to your consent, we may also keep this information on file to consider you for future job opportunities.

Use of Artificial Intelligence (AI) in Recruitment

Cohere may use artificial intelligence (AI) and machine learning (ML) technologies, including natural language processing, to assist in the initial screening of employment applications. These AI/ML tools assess applications, including resumes, cover letters, and other information you voluntarily provide as part of your application, against the characteristics and qualifications relevant to the job posting. These tools are designed to help our recruiters identify potentially qualified candidates, but they do not limit the applications that recruiters may review or consider. The AI/ML-generated assessments are one of several factors considered in the hiring process and human recruiters thoroughly evaluate your skills and qualifications to determine your suitability for the role prior to any final employment decision.

If you have any questions about our use of these tools, please contact us at privacy@cohere.com.

Disclosure of Personal Information

We may disclose your personal information to:

• Affiliates: Other companies within the Cohere group for global workforce planning and decision-making.
• Vendors & Service Providers: Third parties who provide services to us, including hosting the job applicant portal, streamlining and managing the recruitment and hiring process, assisting with interview scheduling, and providing AI-assisted resume screening, selection and assessment. Our vendors and service providers are required to safeguard your personal information and are not authorized to use personal information other than to provide services to us (or comply with legal requirements).
• Employers of Record (EORs): If we hire you via a third-party EOR, we disclose necessary data to them to facilitate your employment contract and onboarding.
• Legal & Regulatory Authorities: When we or our vendors and service providers (including affiliates) are required or permitted by law, subpoena, or to protect our legal rights (which may include lawful access by U.S. or foreign courts, law enforcement or other government authorities).
• Business Transactions: In connection with a proposed or completed business transaction, such as a transfer or sale of all or a portion of our business or assets to a third party, merger, acquisition, sale or other corporate restructuring or change in corporate control (including as part of insolvency or bankruptcy proceedings).

Safeguards, Retention, and Privacy Governance Policies

We have implemented policies and practices that govern our treatment of personal information. This includes, among other things:

• Policies and procedures, and administrative, technical, and physical measures to help protect personal information in our custody and control from unauthorized access, use or disclosure. Our policies authorize access to personal information on a need-to-know basis to employees and authorized service providers who require access to fulfil their job requirements. However, no method of transmission over the internet and no means of electronic or physical storage is absolutely secure.
• Defined roles and responsibilities of personnel with respect to the treatment of personal information.
• Processes to respond to data subject requests and complaints in a timely and effective manner. See the Rights and Choices section, below.
• A framework for the retention and destruction of personal information consistent with applicable laws.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to meet business or legal requirements, and as otherwise permitted or required by applicable law, including litigation holds. If you are hired, your application data will be transferred to your personnel file and retained in accordance with our internal employee privacy policies and retention schedules.

International Data Transfers

Cohere is headquartered in Canada. Regardless of where you apply from, your information will be transferred outside of your jurisdiction and processed in Canada and the United States, where our central recruitment systems are hosted. In addition, our vendors/service providers (including affiliates) may access, store and otherwise process personal information in other jurisdictions, including in the European Union, United Kingdom or other foreign jurisdictions.

Canada is recognized by the European Commission and the UK Government as providing an “adequate” level of data protections. For transfers to other jurisdictions, including the United States, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs) where required.

Rights and Choices

Depending on your location, and subject to certain limitations, you may have the right to request access to, or correction or deletion of, your personal information in our custody and control. Before processing your request, we may need to verify your identity to ensure your information is not disclosed to an unauthorized person. Depending on your jurisdiction, you may also have other rights such as the right to obtain a copy of your personal information or to provide you with certain information in a structured, commonly-used technological format.

In particular, it is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the application process.

If we have obtained your consent to collect, use or disclose your personal information, you have the right to withdraw your consent subject to legal or contractual restrictions and reasonable notice. Note that if you withdraw consent to our collection, use or disclosure of personal information that is necessary for us to assess your suitability for a job or other engagement, we may not be able to complete your application process or reach out to you about future opportunities and we may retain your personal information in accordance with our record retention schedules.

You may make any request for exercise of your privacy rights using the contact information provided under the Contact Us section below.

Right to Opt-Out of Third-Party Sources

If you wish to remove your profile from third-party talent sourcing tools that identify potential candidates based on publicly available information, you must register your opt-out directly with the specific vendor, as we do not control their master databases.

• Juicebox: You can exercise your privacy rights and opt-out of their database by visiting: https://juicebox.ai/privacy-center.

Jurisdiction-Specific Rights and Choices

For details about the privacy rights applicable to residents of certain specific jurisdictions, see:

• “Notice to Job Applicants located in the European Union or United Kingdom” for residents of the European Union or United Kingdom, and
• “Additional Information for Residents of California” for residents of California below.

Contact Us

Please contact Cohere’s Privacy Office with any questions or comments about this Applicant Notice by:

• email at privacy@cohere.com; or
• by mail to the Cohere Inc., 171 John Street, Suite 200, Toronto, ON M5T 1X3 ℅ Privacy Office.

Updates to this Notice

From time to time, we may make changes to this Notice to reflect changes to our personal information handling practices or to otherwise address our legal or regulatory obligations. We encourage you to review this Notice on a regular basis. We will update the date at the top of this Notice when it is updated, and the most up to date version of this Notice will be linked on any public job posting.

Jurisdiction Specific Addenda

Notice to Job Applicants located in the European Union or United Kingdom

Legal Bases for Processing

We process your personal information under the following legal bases:

Purpose of Processing	Categories of personal information	Legal Bases (For EU/UK Residents)
Process your application, evaluate your qualifications, experience, background and suitability for the desired position, make informed decisions on recruitment, communicate with you about your application, respond to your inquiries and schedule interviews	Identifiers & Contact Details Application, Assessment and Hiring Data Professional History Background Check Data	We have a legitimate interest in managing the recruitment of our staff to meet our business needs.
Contact you about future career opportunities	Identifiers & Contact Details Application, Assessment and Hiring Data	Your consent.
Improve our recruitment process	Identifiers & Contact Details Application, Assessment and Hiring Data Professional History	We have a legitimate interest in improving our recruitment processes to ensure we hire the right candidates for our business
Verify the details you have supplied and, where applicable, conduct pre-employment background checks	Identifiers & Contact Details Application, Assessment and Hiring Data Professional History Background Check Data	We have a legitimate interest in carrying out appropriate checks to verify the information provided by candidates.
Protect our business and legal rights in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes and ethics and compliance reporting requirements	Identifiers & Contact Details Application, Assessment and Hiring Data Professional History Background Check Data Equity and Diversity Data (Voluntary)	We have a legitimate interest in protecting our business interests and legal rights, including, use in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes and ethics and compliance reporting requirements. We also have an interest in analyzing and monitoring the diversity of the workforce in accordance with applicable laws including, for example, compliance with equal opportunity employment laws. In the UK, this is a recognized legitimate interest when we do this to prevent, detect, or investigate a crime.
Comply with legal, regulatory and other requirements under applicable laws, including equal opportunity employment reporting obligations.	Identifiers & Contact Details Application, Assessment and Hiring Data Professional History Background Check Data Equity and Diversity Data (Voluntary)	When we have a legal obligation under EU/UK laws, we process the personal information in order to comply with applicable law and regulations. When we have a legal obligation under laws outside the EU/UK or our processing is not pursuant to a legal obligation, we have a legitimate interest in protecting our business interests and legal rights, and the interests and legal rights of our applicants.

There are instances where we have a legitimate interest in using your personal information. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process personal information on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. In the UK, we do not need to conduct a balancing test if we process personal information for a “recognised legitimate interest.” You can obtain more information about this balancing test by using the contact details above.

Where we process sensitive information and information about criminal record checks as permitted by local law, we must have an additional legal basis under EEA/UK data protection law.

Cohere collects certain sensitive information from you in reliance on the following conditions:

• where the processing is necessary for the purposes of carrying out the obligations and exercising specific rights in the field of employment and social security and social protection law in so far as it is authorised by domestic law - this applies to your health data needed to make appropriate adjustments to our offices/workspaces;
• where the processing is necessary for the purposes of complying with, or assisting other persons to comply with, regulatory requirements relating to unlawful acts and dishonesty;
• the processing is necessary for the purposes of establishing, exercising and defending legal claims to the extent this involves processing any sensitive information;
• the processing is necessary for reasons of substantial public interest, including equal opportunities monitoring purposes;
• the processing relates to personal information which you have manifestly made public; or
• solely to the extent that the processing is not otherwise justified under one of the above conditions, your explicit consent.

Controller Relationship

As mentioned in the “Who Will Handle Your Job Application” section above, Cohere Inc. acts as the controller of your personal information. If a local Cohere affiliate is identified on the application form, they will be operating as a service provider or processor to Cohere Inc. to receive and process your application.

Additional EU/UK Rights

In addition to the right to request access to, correction of, and deletion of your personal information described in the main body of this Notice, you may have the right to:

• Request that we delete your personal information (the "right to erasure");
• Request that we restrict or suspend the processing of your personal information in certain circumstances listed in Art. 18(1) of the European General Data Protection Regulation (GDPR);
• Object to our processing of your personal information where we are relying on a legitimate interest as our legal basis;
• Request that we transmit your personal information to a third party, or provide you with a copy so you can transmit it, where technically feasible (the "right to data portability"); and
• If you reside in the UK: to make a complaint to us by using the contact information provided under the Contact Us section above.
• If you reside in France: to instruct us on the processing (retention, deletion, and disclosure) of your personal information after your death. You can change or revoke such instructions at any time.

Withdrawal of Consent

When Cohere has obtained your consent to process your personal information, you may withdraw your consent at any time with future effect. If you withdraw your consent, it will not invalidate the lawfulness of any processing Cohere conducted prior to the withdrawal, or Cohere’s continued processing of some or all of your personal information under other legal bases, where applicable.

In some cases, you may also submit personal information requests through an authorized agent, in which case, we may request further information to verify the authenticity of the request and the agent’s authorization to act on your behalf. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Retention

We will retain your personal information only for as long as we need it for our legitimate interest in accordance with applicable law, for the purposes of the recruitment process and, once this process is finished, for an appropriate period so as to be able to deal with any legal claims linked to the application process.

If you are successful: Recruitment records not incorporated into your employee file are generally kept for 1 year. After this period, we will take steps to delete your personal information or hold it in a form that no longer identifies you. If you become a Cohere employee, relevant personal information you provide will become a part of your employee file and may be used later for the management of the employment relationship, subject to our employee privacy notice.

If you are not successful: Recruitment records for unsuccessful applicants are generally kept for 1 year. After this period, we will take steps to delete your personal information or hold it in a form that no longer identifies you.

International Transfers

Due to the global nature of our business, your personal information will be disclosed to recipients outside of the UK and the EEA including, in particular, to Canada and the United States. Where these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal information to these countries as detailed in this notice.

Additional Information for Residents of California (CCPA)

The details in this section apply only to personal information we handle about job applicants who are residents of California. It does not cover personal information or practices that are exempt from the CCPA, and it does not cover personal information about individuals who reside outside California.

Under the California Consumer Privacy Act (“CCPA”), the types of personal information we collect (and collected in the preceding 12 months) about job applicants are categorized as:

• Identifiers;
• Characteristics of protected classifications under California or federal law (such as if you voluntarily include your race/ethnicity in a cover letter or resume);
• internet or other electronic network activity (such as information about how you interact with Cohere application systems);
• audio, electronic, visual, or similar information (such as recordings of meetings or interviews);
• professional or employment-related information;
• education information; and
• sensitive personal information (such as when you provide information related to your health condition that requires an accommodation).

Limiting Use of Sensitive Personal Information

We do not use California “sensitive personal information” (as defined by the CCPA) in a manner that would require us to comply with the CCPA obligation to offer individuals a special right to limit our handling of that data due to its sensitive nature.

CCPA Right to Access, Correct, or Delete Personal Information

If you are a California resident, CCPA also may permit you to request that we:

• Provide access to and/or a copy of certain information we hold about you;
• Delete certain information we have about you;
• Correct certain personal information we have about you; and
• Inform you about the categories of personal information we have collected about you in the preceding 12 months; the categories of sources of such information; the business or commercial purpose for collecting or selling your personal information; and the categories of third parties with whom we have disclosed certain personal information, and more specific detail about what categories of information were "sold" or "shared" (as defined in the CCPA) or disclosed to particular categories of third parties, similar to the detail provided above in the Job Applicant Privacy Notice.

How to Submit a Request

To request to exercise any of these rights and receive the fastest response, reach out to our Privacy Officer at privacy@cohere.com (please put in the subject line, “Attention: Applicant DSAR”).

We reserve the right to require verification of your identity before we fulfill a request, which may include requiring you to login to an existing Cohere account, providing us with information that matches our records for you, responding to an email we send, or taking other steps relevant to your relationship with us and the nature of your request.

If you are an agent making a request on behalf of a consumer, we reserve the right to take steps to verify that you are authorized to make that request, which may include requiring you to provide us with written proof such as a notarized authentication letter or a legally sufficient power of attorney signed by the data subject pursuant to California Probate Code sections 4121 to 4130, or other written authorization acceptable to us. We also may require the consumer to verify their identity directly with us where permitted. We are not responsible for the security risks of this or any other arrangements that a consumer may have with an agent. For clarity, this is not permission for any user to disclose their login credentials to an agent or any third party. Such disclosure is prohibited and is not required for an agent to make requests under this Notice.

For security and legal reasons, however, Cohere reserves the right not to accept requests that require us to access third-party websites or services.

You have a right not to receive “discriminatory treatment” (within the meaning of the CCPA) or be subject to retaliation for the exercise of the privacy rights conferred by the CCPA.

Opt Out of the “Sale” or “Share” of Personal Information

Under the CCPA, California residents have certain rights to opt out of most disclosures of personal information that qualify as a “sale” or “sharing” of personal information as those terms are narrowly defined in the CCPA. Although we make various disclosures of personal information (as detailed in this section), in the preceding 12 months, we did not “sell” or “share” job applicant personal information as defined in the CCPA, and we have no plans to do so, regardless of the age of the individual.

Retention

We retain personal information no longer than necessary for the purposes set out in this Notice or as otherwise required to meet legal or business requirements. We may collect and use the same category of personal data for different purposes and in different contexts, and because rules differ by jurisdiction, there is not typically a fixed retention period that always will apply to a particular category of personal data. Retention will depend on the context and purpose for which the information was collected. For example, for California candidates we choose not to hire, we normally plan to retain their job application, which may contain data such as identifiers, professional or employment-related information, and education information, for at least 4 years for compliance purposes.