Volta Recruitment & Candidate Privacy Notice

1. Introduction / who we are

Volta Infrastructure Holdings Limited (“Volta”, “we”, “us” or “our”) is the organisation responsible for your personal information during recruitment. In data protection terms, we are the data controller - which means we decide how and why your information is used, and we are accountable for protecting it.

This notice applies however you come to us - whether you apply through our careers website or by email, through a recruitment agency, via a job board such as LinkedIn, or because we reached out to you about an opportunity. It covers our recruitment activities only.

If you join Volta, a separate Employee Privacy Notice will take over. As explained in Section 8, some parts of your recruitment record may still be held under this notice and our recruitment retention rules after you are hired.

We handle your information in line with all data protection laws that apply to you, including the UK GDPR and the Data Protection Act 2018, the EU GDPR, and other national, state or local laws (for US applicants, this includes the California Consumer Privacy Act as amended by the CPRA - see Section 13).

2. What information we collect

The information we collect depends on the role you apply for and how you interact with us. It falls into the following groups.

2.1 Information you give us

• Identity and contact details - your name, title, date of birth, address, phone number, personal email and nationality;
• Your application - CV or résumé, cover letter, photograph (if you include one), work history, education and qualifications, professional memberships, languages, references, any reasonable adjustments you ask for, and anything else you choose to share;
• Right-to-work and immigration details - passport, visa and work-permit information, and proof of your right to work in the relevant country;
• Diversity information, if you choose to share it (for example ethnicity, gender, disability status or sexual orientation) - used only in an anonymised, aggregated form for equal-opportunities monitoring;
• Interview and assessment information - interviewer notes, psychometric or skills-assessment results, and any work samples or case-study responses;
• Your salary expectations and notice period.

2.2 Information we receive from others

• Recruitment agencies, head-hunters and other recruiters who introduce you to us;
• Professional networking sites such as LinkedIn, including your public profile and information available through LinkedIn Recruiter and similar tools;
• References from current or former employers, colleagues, education providers or other referees you nominate;
• Background-screening providers - identity, education and employment verification and, where lawful and relevant to the role, criminal-records, credit, sanctions and adverse-media checks;
• Providers who run psychometric, technical or skills assessments on our behalf;
• Publicly available sources, such as professional publications and public professional profiles (e.g. LinkedIn, GitHub), where relevant to the role.

2.3 Information we create during the process

• Records of our communications with you - emails, messages, interview scheduling, and recorded calls or video interviews (only where you have been told in advance);
• Interview notes and scorecards;
• Decisions about your application and the reasons for them, including whether to progress, decline or make an offer.

2.4 Special category and sensitive information

Some information is treated as "special category" data (for example your health, racial or ethnic origin, religious beliefs or sexual orientation). We only collect it where the law allows, for example:

• To meet our obligations under employment, social-security or social-protection law (such as considering reasonable adjustments for a disability);
• For equal-opportunities monitoring, where you have explicitly consented;
• Where we are required or permitted by law to run criminal-records checks, with appropriate safeguards in place. EU/EEA candidates: where we rely on the substantial-public-interest condition we do so under Article 9(2)(g) of the EU GDPR and applicable Member-State law; for UK candidates, under Article 9(2)(g) of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

3. How we use your information

We use your information to run a fair, efficient and transparent hiring process. In practice, that means we use it to:

• review your application and assess your suitability for the role;
• arrange and conduct interviews, assessments and skills tests, and record the outcomes;
• verify the information you give us, including references and background checks where relevant;
• check your right to work in the country where the role is based;
• communicate with you and keep you updated at each stage;
• make an offer and prepare the paperwork - directly or through our Employer of Record;
• keep you in mind for future opportunities, if you have asked us to (our talent pool);
• monitor equality of opportunity, and meet our legal, regulatory and good-governance obligations. After the process: if you are not successful, we keep your details for a limited time (see Section 8). If you have opted in to our talent pool, we may contact you about suitable future roles. If you join us, the relevant parts of your record move into your employee file.

4. Our legal basis for processing

Data protection law requires us to have a valid “lawful basis” for using your information. We rely mainly on taking steps at your request before entering into a contract (Article 6(1)(b)) and on our legitimate interests (Article 6(1)(f)), and we use your consent for the talent pool and diversity monitoring. The table below sets out the detail.

Where we rely on legitimate interests, we have weighed them against your interests, rights and freedoms (a "legitimate-interests assessment"), and you can ask us for more detail using the contacts in Section 17. If you choose not to give us certain information, we may not be able to consider you for the role, process your application properly, or enter into a contract with you.

5. The recruitment tools and providers we use

We work with a small number of trusted providers to run our hiring process:

• Applicant Tracking System (ATS): we use Ashby to receive, manage and track applications, store interview notes and scorecards, and send and store recruitment correspondence. Ashby acts as our processor and handles your data only on our instructions (see Section 9).
• Sourcing and networking platforms: to find and contact potential candidates.
• Background-screening providers: for certain roles, to verify identity, employment history and qualifications and, where lawful and relevant, run criminal-records, sanctions and credit checks.
• Assessment providers: to run cognitive, personality, technical or skills assessments relevant to the role.
• Employer of Record (EOR): where you will be hired in a country in which Volta has no local entity, we use Deel as our EOR. Deel receives the information needed to onboard you as their employee on our behalf, and Deel’s own privacy notices apply to that processing.
• IT and infrastructure providers: cloud-hosting, email, video-conferencing and document-management services that support recruitment. You can ask for a current list of our providers by emailing askpeople@volta-ai.com. Every provider acting as our processor is bound by a written contract requiring them to use your information only on our instructions and to keep it secure.

6. How we share your data

We share your information only where it is necessary and lawful. Recipients may include:

• Volta colleagues involved in hiring - hiring managers, the people and talent teams, interviewers and senior leadership;
• Other companies in our group, where relevant to the role;
• Our recruitment providers (see Section 5), including Ashby (our ATS), sourcing, assessment and background-screening providers;
• Deel, our Employer of Record, where you will be hired in a country in which Volta has no local entity;
• Referees you nominate;
• Professional advisers such as lawyers, auditors and accountants, where we need their advice or the law requires it;
• Regulators, courts, law-enforcement and other public authorities, where required or permitted by law;
• Any prospective or actual buyer of, or investor in, our business, as part of a corporate transaction (with appropriate confidentiality protections). We do not sell or share your personal information, including for cross-context behavioural advertising (see Section 13).

7. International data transfers

Volta is based in the United Kingdom and hires globally, so your information may be transferred to and processed in countries outside the one you are in - including the UK, the European Economic Area (EEA), the United States, and other countries where our group, providers or EOR partner operate. Some of these countries have data protection laws that differ from, and may be less protective than, those in your own.

Whenever we move your information out of the UK or EEA, we make sure it stays protected by relying on safeguards such as:

• transfers to countries the UK or European Commission has recognised as providing adequate protection;
• the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and/or the EU Standard Contractual Clauses, with any additional safeguards required (informed by a transfer risk assessment);
• where a US provider is certified under the EU-US, Swiss-US and/or UK Data Privacy Framework (DPF), reliance on that certification [confirm current DPF status of Ashby and Deel; otherwise rely on SCCs/IDTA]. You can ask us for more information about these safeguards using the contacts in Section 17.

8. How long we keep your data

We keep your information only for as long as we need it for the purposes above, and to meet any legal, accounting or reporting requirements. Our standard periods are:

If you join us: the parts of your record we need for your employment (such as your CV, signed offer and right-to-work evidence) become part of your employee file. Other recruitment correspondence and notes that aren’t needed for your employment are not kept indefinitely - we review and anonymise or delete this wider material once it is no longer needed, and we may switch off the syncing of new email correspondence to your candidate record after you are hired.

Before we anonymise recruitment data, we may give you advance notice so you can exercise your rights first (for example, request a copy of your data). When we no longer need your information, we securely delete or irreversibly anonymise it. Anonymising means removing or transforming identifiers so you can no longer be identified; anonymised data may be kept for internal analytics without a time limit.

9. Automated decisions and AI

We use Ashby as our applicant tracking system. Ashby acts as our processor and handles your data only on our instructions.

People, not machines, make our hiring decisions. We do not make hiring decisions based solely on automated processing - shortlisting and hiring decisions are always made by a human reviewer. We have not switched on the ATS’s optional AI features (such as automated candidate scoring, AI interview notetaking or transcription, or AI-assisted sourcing).

If we ever introduce an automated decision that has a legal or similarly significant effect, or an AI tool that analyses interviews, we will tell you in advance, explain the logic and your rights (including the right to ask for human review), obtain any consent required, and complete any bias audit or notice the law requires - for example New York City Local Law 144 or the Illinois Artificial Intelligence Video Interview Act - and meet applicable obligations under the EU AI Act.

10. Keeping your data secure

We use appropriate technical and organisational measures to protect your information from unauthorised access, alteration, disclosure, loss or destruction. These include role-based access controls and access logging, encryption in transit and at rest, secure cloud-hosting, staff training, and security obligations on our providers. In the unlikely event of a personal data breach affecting your information, we follow an incident-response process and will notify the relevant regulator - and you, where required - within the timeframes the law sets.

11. Cookies and our careers site

If you apply through our careers website, cookies and similar technologies may collect information about your visit. Please see our website Cookies Policy for details.

12. Non-disclosure agreements

For some roles, we may ask you to sign a non-disclosure agreement (NDA) before we share confidential information about Volta or the opportunity. We process your NDA and related correspondence to protect that confidential information and to take steps at your request before entering into a contract. Signing an NDA protects our confidential information; it does not limit your data protection rights - including your right to access the information we hold about you or to complain to a data protection authority.

13. US / California privacy disclosures

This section applies to applicants and candidates who are California residents and adds to the rest of this notice. It is provided to meet the California Consumer Privacy Act, as amended by the CPRA. The table summarises the personal information we collect during recruitment.

We keep each category for the periods in Section 8. If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to access, correct or delete it; and to limit the use of sensitive personal information. We do not sell or share (including for cross-context behavioural advertising) your personal information, and we will not retaliate against you for exercising your rights. You may use an authorised agent to make a request. To exercise these rights, email askpeople@volta-ai.com.

14. Equal-opportunity statement

Volta is an equal-opportunity employer. We recruit, hire and promote without regard to race, colour, religion, national origin, sex, sexual orientation, gender identity, age, disability, veteran status, genetic information or any other characteristic protected by law. Any diversity information you choose to share is voluntary, is used only in an anonymised and aggregated form for equal-opportunities monitoring, and is never used to make hiring decisions.

15. If we approached you, and changes to this notice

If we contacted you about a role, rather than you applying to us - for example through LinkedIn, a recruitment agency or a referral - we will provide you with this notice and tell you where we got your details, within a reasonable period and at the latest within 30 days of obtaining your information, or sooner if we contact you first.

We may update this notice from time to time to reflect changes in our recruitment practices, the tools we use, or the law. The latest version will always be on our careers website, and we will draw any material changes to your attention where required.

16. Your rights

Depending on the law that applies to you, you have the following rights over your personal information:

• Access - ask for a copy of the information we hold about you, including recruitment correspondence in our ATS, whether or not it is hidden from day-to-day view.
• Rectification - ask us to correct anything inaccurate or incomplete.
• Erasure - ask us to delete your information in certain circumstances.
• Restriction - ask us to limit how we process your information in certain circumstances.
• Portability - receive the information you gave us in a structured, commonly used, machine-readable format, and ask us to send it to another controller.
• Objection - object to processing where we rely on legitimate interests.
• Withdraw consent - where we rely on consent, withdraw it at any time; this doesn’t affect processing carried out beforehand.
• No solely automated decisions - ask not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (see Section 9). To exercise any of these rights, contact us using the details in Section 17. We may need to verify your identity first, and we will respond within the time limits the law sets. If you are unhappy with how we have handled your information, you can complain to a data protection authority - in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk; in the EEA, your local authority. We’d genuinely appreciate the chance to put things right first, so please consider contacting us before you do.

17. Contact us and complaints

This notice is issued by Volta Infrastructure Holdings Limited, a company incorporated in England and Wales, registered office: 66 Lincoln’s Inn Fields, London, WC2A 3LH.

We take your privacy seriously and will respond to any question or concern in line with the data protection laws that apply to you.