Privacy Policy

Overview

This Privacy Policy ("Policy") describes how we at Remote collect, protect, share and use the Personal Data you ("User", "you," or "your") may provide on the remote.com/en-GB website and within any of our products or services (collectively, "Website" or "Services").

Remote corporate group is made up of a number of legal entities which we use as infrastructure to provide our Services. However, for data protection purposes the entities in control of all Personal Data processed in connexion with our Website and Services are:

• Remote Europe Holding, B.V., a company registered in the Netherlands under number 7403597, VAT Number NL 860597155B01, at Apollolaan 151, Unit 439, 1077AR Amsterdam, The Netherlands; and

• Remote Technology Services, Inc., a company registered in the United States of America under number 7946800 at 1209 Orange St, Wilmington, DE 19801;

collectively referred to as "Remote", "we," "us," or "our".

This Privacy Policy applies to the following Data Subjects:

• Registered Users of the Website and Services who have a contractual relationship with Remote, including: Clients’, Prospects’ and Partners’ representatives; Contractors and Employees;

• Visitors to our Website that do not have a contractual relationship with us;

• Participants at Remote promoted events;

• Individuals with whom we interact with and process their personal data.

Depending on the Data Subject category and country of residence, this Policy may from time to time be supplemented by additional privacy notices issued by us and other parties which will be notified to you separately. For example, Personal Data about Employees and Contractors hired by any of our local legal entities can be co-controlled by these local entities and, where required by law, an additional policy will be notified to you in case the local entities engage in Personal Data Processing not covered in this Policy.

We commit ourselves to the highest standard for data protection and privacy. Due to our global footprint, we are subject to the applicable data protection regulations and as a guiding principle, we apply the strictest regulation to protect your data and privacy globally. This results in a broad set of rights and choices made available to you.

We have a Data Protection Officer (DPO) who monitors our compliance with the EU 2016/679 General Data Protection Regulation (EU GDPR) and UK GDPR (collectively, "GDPR"), other data protection regimes and policies of Remote in relation to the protection of Personal Data and privacy. To reach out to our DPO, please use the 'Help' button in the lower right corner of Your dashboard if you are a registered user or via this form if You are not a registered user.

Remote Technology, Inc. and Remote Technology Services, Inc. are active participants in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) and has committed to comply with the Data Privacy Framework principles.

The terms "Personal Data", "processing", "Data Subject", "Controller” "Processor", have the same meaning as in the GDPR.

Roles

Under GDPR, we may process Personal Data as a Controller or a Processor. This Privacy Policy applies to Personal Data We collect and process for Our own purposes where We act as a Controller. Where We process Your Personal data on behalf of Our Clients, We act as a Processor and We have limited rights and responsibilities.

When and how we collect data

Remote may collect your Personal Data through Our communication and Your usage of our Website and Services. Personal Data can be directly provided by You or indirectly collected by Us (i.e. from your interactions, use, and experiences with our products).

Types of data we collect

How we use your data

What is "lawful basis"?

Under GDPR, we need to have a lawful basis to legally process your Personal Data for Our own purposes. For the described Personal Data Processing above, we rely on the following legal grounds:

• Consent: (Art. 6(1)(a) GDPR) when we rely on this basis we only process Personal Data about you for the specific purposes you expressly authorise. You can withdraw your consent whenever you wish.

• Performance of a contract: (Art. 6(1)(b) GDPR) when we rely on this basis the Data Processing is necessary for the performance of a contract with you or to take steps at your request before entering into such a contract.

• Compliance with a legal obligation: (Art. 6(1)(c) GDPR) when we rely on this basis we are obliged to process the relevant Personal Data to comply with our legal obligations.

• Legitimate interests: (Art. 6(1)(f) GDPR) when we rely on this basis we process Personal Data as necessary in pursuit of our own, our business partners', or your legitimate interests. When we do this we must ensure that the interests we pursue do not override your fundamental rights and freedoms.

• Substantial public interest: (Art. 9(2)(g) GDPR) when we rely on this basis we do it to prevent harm, fraud, money laundering, terrorist financing, child labour and to enable trust safety and compliance.

For Special Category data:

• Employment and social security: (Art. 9(2)(b) GDPR) when we need to process data according to our employment and social protection legal obligations.

• Substantial public interest: (Art. 9(2)(g) GDPR) when we rely on this basis we do it to prevent harm, fraud, money laundering, terrorist financing, child labour and to enable trust safety and compliance.

• relevant provisions of applicable national laws that Remote is subject to (Art. 9(4) GDPR).

Use of artificial intelligence (AI)

Our Platform incorporates AI functionalities powered by OpenAI Ireland Limited (OpenAI). Depending on the purpose of the AI functionality we share necessary data with OpenAI that may include personal data.

When We use AI to process Personal Data for Our Services, We will provide relevant information about the details of the processing. We commit using AI in accordance with the applicable laws and respecting individual’s privacy rights.

We engage OpenAI Ireland Limited as our Processor under Article 28 GDPR. We have imposed restrictions and instructions regarding the processing of personal data under the GDPR, and OpenAI has provided sufficient guarantees of implementing appropriate technical and organisational measures.

We have implemented robust technical and organisational measures to protect the personal data used by Our AI functionalities. We transmit to OpenAI only necessary personal data related for the purpose of the AI functionality, as explained in this policy and in compliance with the GDPR.

Additionally, we participate in OpenAI’s enhanced privacy program to further safeguard your data meaning that your data is not available to other Clients and not used to train AI models.

The use of our AI functionalities is voluntary and at your discretion. If you prefer not to have your personal data disclosed to OpenAI, please refrain from using our AI-powered functionalities. We will clearly identify which AI functionalities operate with personal data, ensuring our practices remain transparent and compliant.

Remote Talent

If You use Our Remote Talent service (remote.com/en-GB/jobs), We only process Your Personal Data while browsing on Our Website. When applying to a job on remote.com/en-GB/jobs, the job Publisher will be responsible for the Personal Data You provide in the application process. We do not have access to this Personal Data and We are not responsible for it.

Freelancer Hub

If you use our Freelancer Hub service as a Contractor (Freelance contractor), we process Your personal data as a Controller under GDPR. You can exercise your data subject rights under GDPR before us as described in the relevant section below. For personal data of Contractors that are invited to our platform by our Clients, we are acting as a Processor under GDPR.

Contractor Management Protect

If you engage with the Contractor Management Protect service (CMP) as a Contractor (CMP contractor), we process Your Personal Data as a Controller under GDPR. You may exercise your data subject rights under GDPR as described in the relevant section below.

Acting as a Processor

When We process Personal Data on behalf of Our Clients to deliver Our Service, We are acting as their Processor under GDPR. In this context, We have limited rights and responsibilities regarding Your Personal Data under GDPR.

As a Processor, We are processing Your Personal Data following the instructions of Our Clients. We are not responsible for facilitating the exercise of Your data subject rights under GDPR. Please note that We will not be able to respond to such data subject requests if We act as a Processor.

Data Subjects rights

Where we are acting as a controller, and depending on your location and subject to applicable law, you may have the following rights regarding the personal information we control about you:

• You may access, correct, update or request deletion of Your Personal Data;

• You can object to the processing of Your Personal Data, ask us to restrict processing of Your Personal Data or request portability of Your Personal Data;

• You have the right to opt-out of marketing communications we send You at any time. You can exercise this right by clicking on the unsubscribe or opt-out link in the marketing emails we send You. If You choose to opt-out of marketing, we will still send You non-promotional emails, such as emails about our ongoing business relations.

• If we have collected and processed Your Personal Data with your consent, then You can withdraw Your consent at any time.

• You have the right to complain to a supervisory authority about our collection and use of Your Personal Data. For more information, please contact Your local supervisory authority.

• In addition, under certain conditions, You may be able to initiate binding arbitration for complaints regarding Data Privacy Framework compliance. Please check here: www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf

You may exercise any data subject rights under GDPR related to the Personal Data we process as a Controller via the "Help” button in the lower right corner of Your dashboard if You are a registered user, or via this form if You are not a registered user. We will then verify your identity and respond to your inquiry without undue delay and within one month of receipt of the request.

That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension, together with the reasons for the delay.

Where GDPR is not applicable, we will respond to such requests within the prescribed time period according to the applicable law.

We note that where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may refuse to act on the request. In such cases Remote shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

We kindly inform you that if we are not the Controller, we may not be able to directly address data subject requests we receive. In cases where we act as the Processor for your personal data, we will promptly notify the Controller about your request. Please understand that any response to your request will be provided only if we are authorised by the Controller. For any inquiries or additional information, we encourage you to reach out directly to the Controller.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Remote Technology, Inc. and Remote Technology Services, Inc. commit to resolve DPF Principles-related complaints about our collection and use of your personal data. EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Remote at dpo@remote.com/en-GB

How we keep your data secure

Compliance

We are committed to safeguarding Personal Data through rigorous technical and organisational measures, We use appropriate technical and organisational measures to protect the Personal Data that We collect and process. Our comprehensive data protection strategy includes encryption and security measures that are diligently applied throughout the entire lifecycle of Personal Data. Our measures are designed to provide a level of security appropriate to the risk of processing.

Infrastructure security

• Data encryption in transit

• Data encryption at rest

• Architecture network isolation through private networks

• Fully auditable access and changes

• AWS is our trusted cloud provider and is compliant with the following industry standards:

• All systems are protected by a firewall with security threat detection and prevention mechanisms.

Internal best practices

• We follow the least privilege principle to limit systems' access to essential personnel only.

• All internal tools and systems require SSO.

• We practice continuous credentials auditing and management.

• We conduct internal security and privacy training.

Reliability

• Infrastructure-as-code allows for quick rebuilding and portability.

• Our average response times are under 150ms.

• We practice continuous monitoring of applications and infrastructure.

• Applicational logs are shipped off site and kept for 30 days.

• We create daily data backups.

Data Privacy

• Users have control of their data.

• We do not keep any data other than data strictly necessary for business operations.

Personal Data Disclosures

In order to provide, maintain, improve, secure and promote our Services, Remote needs to disclose Personal Data to third parties. All Personal Data in the scope of this Policy is shared within the Remote corporate group and is hosted on Amazon Web Services. This section provides further details about the specific disclosures we make to other third parties.

Suppliers (Processors)

Certain Personal Data may be disclosed to our suppliers who help us run our business. Our suppliers may process Personal Data on Our behalf solely in accordance with Our instructions and pursuant to a written agreement. For example, we use suppliers for web-hosting, secure cloud storage, video conferencing, analytics, email delivery, Client relationship management, web fonts and other services. We also use suppliers such as social media companies and search engines in order to promote our Services.

The suppliers may also process personal data on behalf of Our Clients in accordance with their instructions and pursuant to a written agreement with Us. In such cases, We act as Processor of Our Clients and our suppliers as sub-Processors. We have the right to engage sub-Processors to provide Our Services to Clients. Our Clients have the opportunity to object to Our changes of sub-Processors.

• These disclosures apply to all categories of Data Subjects in the scope of this Policy. These disclosures are either necessary for the purpose of performing our contract with you or necessary for the purposes of our legitimate interests (that are to provide, maintain, improve, secure and promote our Services). When none of these bases apply, we will seek permission (consent) to share Personal Data with a specific supplier.

• Our suppliers may change over the time but registered Website Users can find a regularly updated list of key suppliers (Processors and sub-Processors) here: https://employ.remote.com/en-GB/dashboard/processors

Suppliers (Controllers)

Certain Personal Data may be disclosed to other suppliers who also help us run our business but act as controllers. These suppliers process Personal Data in accordance with their own privacy policies, however in any case, our contracts with such suppliers require them to comply with applicable data protection law when processing any Personal Data they receive from us. These suppliers include financial institutions, lawyers or notaries, licensed auditors assisting or supervising us in connexion with our compliance obligations, HR and payroll providers, identity verification service providers and others.

• These disclosures apply to all categories of Data Subjects in the scope of this Policy. These disclosures are either necessary for the purpose of performing our contract with you; or necessary for the purposes of our legitimate interests (that are to provide, maintain, improve, secure and promote our Services);

• These suppliers may be different, depending on our business needs.

Clients (Controllers)

Personnel files, such as employment and contractor agreements, payslips information about sick leave, ID and RTW verification outcomes and other information you upload on the platform may be disclosed to Clients upon request. Our contracts with Clients require them to comply with applicable data protection law when processing any Personal Data they receive from us.

• This applies to Employees and Contractors only. These disclosures are necessary for the purposes of our Client's legitimate interests (that are connected with our Client's legal obligations to have copies of personnel files; their need to produce personnel files in the context of investment rounds, acquisitions, corporate restructuring, etc in the context of the related due diligence; their need to verify any information unavailable on our Website; and other legitimate needs, so long as the related Personal Data processing complies with applicable data protection law).

• These disclosures apply only to Clients on whose behalf Remote employs or contracts you.

Local authorities (Controllers)

Various authorities such as regulators, tax authorities, law enforcement agencies, courts of law and others may require us to produce information that may include Personal Data about you. What Personal Data is included depends on each request. In such cases We disclose only the requested Personal data in a secure manner and strictly upon the requirements of the applicable law.

• These disclosures apply to all categories of Data Subjects in the scope of this Policy. These disclosures are necessary for the purpose of us complying with our legal obligations.

• These authorities vary depending on the jurisdictions where we and our Clients operate and where Employees and Contractors reside.

Partners in HR technology

Our platform integrates with other SaaS products such as applicant tracking systems (ATS) and human resource information systems (HRIS) through our application programming interface (API). We partner with such SaaS providers to make it easier for their clients to access our services and for our clients to access their services. More information about the different use cases of our API is available here: https://remote.com/en-GB/platform/remote-api#overview-partnerships.

When partner systems integrate with our platform, they are able to pull personal data we store upon a Client request. This means that when Clients integrate Remote with other SaaS systems they use Remote will send Employee and Contractor data to the requesting Client via the partner SaaS system.

• These disclosures apply to Employees and Contractors only and are necessary for the purposes of our Client's legitimate interests (that are to make it easier for them to access our services via a third party system).

• The Personal Data involved depends on the data the Client requests and on the configuration of the partner SaaS system.

Corporate restructuring

If we sell or buy any assets or business, we may disclose Personal Data about you to the prospective seller or buyer of such business or assets. Conversely, if we are acquired by another business, Personal Data about our Clients will be transferred to the buyer.

• These disclosures apply to all categories of Data Subjects and types of Personal Data in the scope of this. These disclosures are necessary for the purposes of our legitimate interests (that are to properly run our business and our business' continued ability to provide our Services.)

• These recipients depend on who we engage with in the context of any type of corporate restructuring.

Further information

We would be happy to address any specific queries you may have about the Personal Data we disclose to third parties. If you need more specific information, please contact us using the contact details provided in this Policy.

International data transfers

Remote operates at a global level and therefore Personal Data may need to be transferred to countries outside of where it was originally collected.

When we transfer Personal Data outside the EEA or UK, we will ensure that this transfer complies with GDPR, UK GDPR and applicable laws.

This includes reliance on the EU-US Data Privacy Framework ("EU-US DPF"), the UK Extension to the EU-US DPF ("UK Extension") and the Swiss-US Data Privacy Framework ("Swiss-US DPF") as set forth by the US Department of Commerce, where such transfers are to an entity that is certified under these applicable framework(s). Find out more about Data Privacy Framework in the section below.

Where we share Personal Data with a country or organisation which does not benefit from an adequacy decision, such transfer will be based on the latest EU Standard Contractual Clauses approved by the European Commission and UK Addendum issued by the UK Information Commissioner's Office (as applicable). We implement extra measures to ensure that transfers originating from jurisdictions with transfer restriction regulations are in full accordance with local laws.

Data Privacy Framework

Remote Technology, Inc. and Remote Technology Services, Inc. have been certified to the Data Privacy Framework (DPF) program, which is administered by the International Trade Administration (ITA) within the U.S. Department of Commerce, that it adheres to the DPF Principles. Remote Technology, Inc. and Remote Technology Services, Inc. are active participants in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) and have committed to comply with the DPF principles.

If there is any conflict between the terms in this Privacy Policy and the DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework program and to view our certification, please visit www.dataprivacyframework.gov

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Remote Technology, Inc. and Remote Technology Services, Inc. commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Please find the contact details of the EU DPAs here.

Remote is responsible for the collection and processing of data it may receive under the Data Privacy Framework, including subsequent transfers to third parties Remote engages that act on our behalf. Remote complies with the Data Privacy Framework Principles of all transfers of data in the EU.

The Federal Trade Commission (FTC) has jurisdiction over Remote Technology, Inc. and Remote Technology Services, Inc.’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Data retention

In accordance with applicable data protection laws, we do not store Personal Data for longer than needed for the purposes of the respective processing activity. The relevant retention periods depend on the national legislation of the country you are based in.

If the Personal Data is no longer required for the performance or enforcement of contractual or legal obligations, we will either delete it or anonymise it or, if this is not possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from further processing until deletion is possible. Remote may retain your data for longer than the usual retention period if it is still necessary to:

• fulfil Remote's obligations pursuant to the agreement between Remote and the Client;

• fulfil Remote's obligations pursuant to the employment agreement or other agreements with you, including payment of holiday allowance;

• establish, exercise, and defend a legal claim;

• to deal with and resolve requests and complaints;

• fulfil statutory obligations to which Remote is subject, such as continued storage pursuant to accounting legislation.

For more detailed information about the retention periods of the Personal Data that Remote processes, you can request a copy of our Retention Policy via the 'Help' button in the lower right corner of your dashboard if you are a registered user or via this form if you are not a registered user.

Privacy choices

Although restricting access to certain data might affect your experience, you can always make changes, such as:

• Disable optional cookies: You can block optional cookies in your web browser (check your browser's Help page) or via the Cookie manager on our Website.

• Don't provide Personal Data: You can still navigate the Website and access all our features that don't require your personal information.

• You can withdraw your consent for marketing communications: We will contact you directly if we receive your consent to send marketing communication, but if you don't wish to hear from us again, please click the Unsubscribe button on the communication or use this form to let us know.

Cookies

The Website and our mobile app “Remote: Global Employment” use "cookies" and similar technologies, such as pixel tags and software development kits, to help personalise your online and in-app experience. A cookie is a text file that is placed on your hard device by a web page server or a mobile app. For detailed information about cookies and which types of cookies we use, please read our cookie policy.

• Cookies cannot be used to run programs or deliver viruses to your computer.

• Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie to you.

• We may use cookies to collect, store, and track information for statistical purposes to operate our Website and Services. You can accept or decline such cookies.

• Most web browsers automatically accept cookies, but you can modify your browser settings to disable optional cookies if you prefer (check your browser's Help page or Our website cookies manager).

• If you choose to decline all cookies, you may not be able to experience all the features of the Website and Services.

To learn more about cookies and how to manage them, visit internetcookies.org.

Data of minors

We do not knowingly collect any Personal Data from persons under the age of 18. If you are under the age of 18, please do not submit any Personal Data through our Website or Service.

If you have reasons to believe that an individual under the age of 18 has provided Personal Data to us through our Website or Service, please contact us via the "Help" button in the lower right corner of your dashboard if you are a registered user or via this form if you are not a registered user.

Changes and amendments

We reserve the right to modify this Policy relating to the Website or Services at any time in response to changing legal, regulatory, technical or business developments. You can find the date of our last update at the top of the Policy. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

Region-specific provisions

Depending on your region we may have to offer some additional information. Please find below any additional provisions applicable to you:

Contact us

For inquiries or requests about this Policy, please reach out to us via the 'Help' button in the lower right corner of Your dashboard if you are a registered user or via this form if You are not a registered user.