Privacy Policy.
What we collect, and why.

When you navigate our Website, we are likely to collect the following information:

• information relating to the identification of your terminal when navigating the Site through cookies (please refer to Article 7 below);
• when you request a demo from Marvin: your name and surname, your company name, your business email address, your telephone number and the number of people who will use the Marvin solution. Marvin collects this information to contact you regarding a demo of our products.
• Your name, surname, electronic coordinates, proof of identity (if applicable, in case of doubt about your identity and for security questions) when you exercise your rights (under the conditions indicated in Article 6 of the Privacy Policy), to respond to your exercise requests.
• When you request a demo, we may offer you session recording, only if you accept. In this situation, we collect information about your voice, image and our exchanges. These recordings are intended only for Marvin, as indicated below, to improve our marketing performance.
• All fields of the demo request form are mandatory. If you do not wish to communicate them, you are duly informed that your request may not be relayed to Marvin.

The information mentioned above is collected on the following legal bases:

• Validation of the "cookies" banner present on the Site allows collection of your consent (please refer to Article 7 of the Privacy Policy);
• Your consent for communication of your data, when you request a demo, by submitting the demo request form (the corresponding notice is displayed above the submit button);
• Your consent to data collection and responses to your requests when you communicate your data to Marvin to exercise your rights (as defined in Article 6 of the Privacy Policy) and Marvin's performance of legal obligations to respond to your request;
• Your consent to record our conversations during our demos, by clicking the button when the recording proposal is made.

If after giving us your consent, you change your mind and no longer consent to us contacting you, collecting your information or disclosing it, you can notify us by contacting Marvin:

• at the email address: support@marvinrecruiter.com,
• by mail to: Marvin, 126 rue Saint Maur, 75011 Paris.

Your data recipients are:

Marvin, its internal teams (commercial, operational and legal).

Marvin's subprocessors:

• Hosting: Scaleway (Paris region (fr-par), France) — https://www.scaleway.com
• Cookies: please refer to Article 7
• Demos: Google Meet (https://policies.google.com/privacy), Loom (3338 17TH St 100 San Francisco, CA, 94110-7213 United States) — https://www.loom.com/privacy-policy
• Demo request notifications (name, company, email, telephone, number of users): SendGrid (Twilio Inc., United States) for the email sent to our sales team — https://www.twilio.com/legal/privacy ; Slack (Slack Technologies, United States) for the internal notification — https://slack.com/trust/privacy/privacy-policy
• Multi-posting: XTRAMILE — 11 remparts Saint Thiebault, 57000 Metz — https://xtramile.io/privacy-statement ; HELLOWORK — 2 rue de la Mabilais, 35000 Rennes — https://www.hellowork.com/fr-fr/page/pdc.html

Demo videos are intended for Marvin's internal use to improve our marketing performance.

Marvin informs you that, in the context of demo requests and demo recording, if applicable, your data may be transferred outside the European Economic Area ("EEA") to the United States via Google (for demos and, if you accept it, audience measurement), via SendGrid (Twilio) and Slack (to notify our team of your demo request) and via LinkedIn (if you accept advertising cookies). Marvin informs you that it has conducted prior checks on transfers outside the EEA and on guarantees provided by these providers. These transfers are made based on the standard contractual clauses of these providers, available on their websites.

Marvin's use and transfer of information received from Google APIs to any other application will respect the Google API Services User Data Policy, including limited use requirements.

When you connect your Google account to Marvin (an optional integration, enabled at your initiative from within the Marvin application, accessible notably at marvins.ai), Marvin accesses certain data from your Google account through Google APIs, under the conditions described below. This access is subject to your explicit consent via the Google authorization (OAuth) screen and can be revoked at any time.

Data accessed (authorization scopes). Marvin requests only the permissions necessary for the features you enable:

• openid, .../auth/userinfo.email, .../auth/userinfo.profile — your identifier, email address and basic profile information, to authenticate you and create/link your account;
• .../auth/calendar and .../auth/calendar.events — reading and creating events in your Google Calendar, to schedule and synchronize interviews and appointments from Marvin;
• .../auth/gmail.send — sending emails on your behalf, to let you send your recruitment and outreach emails from Marvin;
• .../auth/gmail.readonly — reading your emails, strictly to detect and attach candidate replies to ongoing exchanges and populate the relevant candidate's timeline.

Data usage. Google data is used exclusively to provide the features described above, at your request. Marvin does not use your Google data for advertising purposes. Marvin does not use Google Workspace data (Gmail, Google Calendar) to train, improve or develop artificial intelligence or machine learning models, whether generalized or specific to Marvin.

Data sharing. Marvin does not sell or transfer your Google data to third parties. It is accessible only to you and, on a strictly technical basis, to our hosting provider Scaleway (subprocessor). Marvin does not share this data with any other third party, except where required by law.

Data storage and protection. The access tokens (OAuth tokens) issued by Google are encrypted at rest and communications are encrypted in transit (TLS). Data is hosted within the European Union (Scaleway, France) and access is partitioned per customer organization (tenant isolation). Access by Marvin teams is restricted to authorized personnel.

Data retention and deletion. You can disconnect your Google account at any time from within the application: the associated access tokens and authorizations are then revoked and deleted. You can also request deletion of your data by writing to support@marvinrecruiter.com; deletion occurs within the timeframes indicated in Article 4.

Limited Use. Marvin's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Learn more: https://developers.google.com/terms/api-services-user-data-policy

Data collected by Marvin in the context of the present policy is retained for the duration necessary for the processing purpose or to meet legal or regulatory obligations and in compliance with applicable legislation and Regulation, namely:

• Data collected during your navigation on the Site (cookies): this information is deleted after 13 months (maximum) in the form of a cookie in your browser. Please refer to Article 7 and our cookie policy for more information;
• Data collected during your use of Marvin: retained for a period of 2 years. Marvin Recruiter undertakes to inform you of data obsolescence within a maximum period of sixty (60) days before expiration.
• Upon account deletion request: your data will be deleted within a maximum of thirty (30) days.
• Data collected during demo requests: this data is retained thirty (30) days maximum from your demo request;
• Data collected in managing your rights: data is subject to deletion one (1) year in case of exercising access and correction rights from the date of receipt of your request and three (3) years in case of exercising opposition rights from the date of receipt of your request.

As controller for the processing defined herein, Marvin undertakes to:

• Implement all appropriate technical and organizational measures to ensure processing security, guarantee protection of your rights and meet Regulation requirements, during navigation and use of our Site;
• Restrict access to your data to persons duly authorized;
• Have sensitized and trained its personnel in data processing, Regulation provisions in force and consequences;
• Never transfer your data, in any way, to a third party without having duly informed you in advance;
• Guarantee all your information, access, portability, deletion, correction, opposition, and limitation rights to your collected data under the conditions defined in Article 6 of the Privacy Policy;
• Notify the competent supervisory authority (National Commission for Computing and Freedoms or CNIL) and yourself, if applicable, of any security flaw presenting high risk to your rights and freedoms within seventy-two (72) hours of flaw discovery, if Regulation requires it;
• Delete your data within the timeframes indicated in Article 4 hereof.

We inform you that you have important rights concerning your data, namely:

• Right to information;
• Right of access;
• Right of rectification;
• Right to deletion;
• Right to processing limitation;
• Right of opposition;
• Right to portability,

regarding your personal data.

You can validly exercise your rights by writing an email to support@marvinrecruiter.com, or by mail, at the address: Marvin, 126 rue Saint Maur, 75011 PARIS.

In this context, Marvin may request supporting evidence of your identity to prevent identity theft risks. Marvin will have one (1) month from receipt of the request to respond (unless particularly complex request).

Furthermore, if you consider your rights are not respected, you can file a complaint with the competent supervisory authority. For France, this is the National Commission for Computing and Freedoms (CNIL), 3 Place de Fontenoy, 75007 Paris — Tel: +33 1 53 73 22 22. For more information: https://www.cnil.fr/

A cookie is a text file stored on your device's hard drive by your browser when you visit our Website to recognize the terminal concerned each time you access digital content containing cookies from the same sender.

Marvin may store the following cookies and trackers:

Essential cookies are not subject to your consent.

On your first visit, a banner lets you accept all, reject all or customize your choices by category ("Audience measurement", "Advertising"), both being off by default. Until you have made a choice, no Google Analytics or LinkedIn script is loaded and no audience measurement or advertising cookie is set. This banner is developed and hosted by Marvin: no third-party consent management provider is involved. We record your choice for a maximum period of six (6) months before requesting it again. You can change it or withdraw your consent at any time via the "Manage cookies" link at the bottom of the pages of the Site.

You can also configure your cookies via your browser settings. However, you are informed that refusing cookies may prevent you from navigating / using available functionalities on the Site.

These privacy rules may change. Any reduction in your rights under these privacy rules cannot be applied without your express consent. We will publish any modification to the privacy rules on this page and, in case of significant modifications, we will publish a prominently displayed warning (including, for certain services, through email notification).

If Marvin is subject to acquisition by or merger with another company, we commit to ensuring the confidentiality of your personal data and to informing you before this data is transferred or subject to new privacy rules.

For any exercise of your rights or if you simply wish to have more information, contact us at support@marvinrecruiter.com, or by mail to: MARVIN, 126 rue Saint Maur, 75011 Paris.