Privacy Notice Regarding Neo4j’s Recruitment Process

This is Neo4j’s (“we” or “us”) statement on how we process personal data when recruiting new personnel. When recruiting new personnel, we need to process personal data. Personal data includes all information that by itself, or together with other information, can be used to identify a currently living person. To be able to submit an application for a position with us, certain personal data must be presented by the applicant in order to carry out the recruitment process. The information in this statement is applicable if you are applying for a job at one of the following Neo4j entities: Neo4j UK Limited, company reg. no. 10922328, registered office at Union House 182-194 Union street, SE1 0LH London (“UK office”); or Neo4j Germany GmbH, company reg. no. HRB 252331, registered office at Viktualienmarkt 8, 80331 München (“Germany Office”). The entity to which you have applied as your potential employer is the personal data controller for the processing of personal data in connection with the recruitment process. Please note that additional personal data may be required from you in order to finalise the recruitment if you are hired by Neo4j. Information concerning this will be provided in a separate privacy notice.

Each entity above is the personal data controller for the processing of personal data in relation to their respective recruitment process, meaning that they are responsible for the processing of personal data concerning you. Most central administrative functions are carried out in the Sweden office, whereas the UK office has a smaller, local HR program. You may also directly contact our data protection officer, at: Mattias Olsson DPO Neo4j@neo4j.com

Listed below is the personal data we process about you, along with information regarding our purposes and legal grounds:

• Purpose: To recruit the candidate most suited for the vacant position
  Personal data: Name, email address, telephone number, portrait, CV, cover letter, certificates and similar documentation, internal notes regarding the recruitment process
  Legal ground: Our legitimate interests
• Purpose: To verify the candidate’s merits and suitability for the position applied
  Personal data: Name, CV, personal letter, certificates and similar documentation
  Legal ground: Our legitimate interests
• Purpose: To communicate with the candidate
  Personal data: Name, email address and telephone number, correspondence with you during the recruitment process
  Legal ground: Our legitimate interests
• Purpose: To consider the application in respect of other roles that are available
  Personal data: Name, email address, telephone number, portrait, CV, personal letter, certificates and similar documentation
  Legal ground: Our legitimate interests

The personal data we collect during our recruitment process is provided by you directly. We may also receive information about you from third parties such as recruitment agencies, background check providers, former employers, credit reference agencies, group companies, public websites and public agencies. Neo4j’s legitimate interest is to recruit the most suitable person for the vacant position at hand, in order to remain a competitive company and a great place to work at. Also, we store applications from candidates for a year in order to further our legitimate interest to contact them regarding other opportunities to work at Neo4j if they are not selected for the position they applied for. We cannot pursue our legitimate interests without processing the personal data set out above, but we believe that we can process your personal data to pursue our legitimate interests in a way that does not interfere with your interests, rights and freedoms. We take all necessary steps to keep your personal data disclosed to only a minimum of Neo4j employees, and that it is securely protected. Our assessment is that the processing of personal data in connection with our legitimate interests is normal and what can be expected in a recruitment process.

We may share your personal data with other Neo4j entities (being Neo4j in Sweden, the UK, Germany and the U.S.) where it is in our legitimate interests to do so for internal administrative purposes (for example, for resource management, corporate strategy, compliance, auditing and monitoring, research and development and quality assurance.) We make use of several service providers, so that we can focus on doing what we are good at. This means that we transfer personal data to third parties. These consist of the following third parties or categories of third parties: Lever, Inc, which provides the recruitment tool used in our process is based in the U.S.; third parties that provide other services that enable us to focus on our core activities, such as external recruitment agencies including Fetcher, Stack Overflow, AmazingHiring and LinkedIn, all based in the U.S.. Any third parties with whom we share your personal information are limited (by law and by contract) in their ability to use your personal information. We will always ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this privacy policy and applicable laws.

We will transfer personal data to countries outside of the UK and the EEA, since the U.S. office will have access to the recruitment information, for example. Further details on third parties to whom your personal data may be disclosed are set out in section 4 above. If we provide any personal data concerning you to any such non-UK and non-EEA Neo4j entities or other third parties, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this privacy policy. These measures may include the following: Ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, or by the European Commission in the case of transfers out of the EEA, which means that the recipient country is deemed to provide adequate protection for such personal data; or Where we have in place standard model contractual arrangements with the recipient which have been approved by the European Commission (or the UK Government for transfers out of the UK in due course). These model contractual clauses include certain safeguards to protect the personal data. Please contact us to learn more about this, and if you want, obtain a copy of the relevant safeguard.

We will store information contained in job applications for one year after the recruitment process has ended. If you do not want us to do this, please let us know and we will delete the information. Certain personal data may be stored longer due to legal obligations of Neo4j or for the establishment or defence against legal claims.

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention which has a significant impact on them. We do not engage in automated decision-making and we will notify you in writing if this position changes.

You have certain rights in relation to your personal data. If you would like further information in relation to these or would like to exercise any of them, please contact us via email at Peopleteam-Global@neo4j.com at any time. You have a right to: receive confirmation whether personal data concerning you is being processed by us, to receive information about the processing and to access the personal data, and to obtain a copy of the personal data; object to our processing of personal data; have personal data concerning you deleted; have incorrect data about you corrected; ask us to complete data about you that you think is incomplete; and restrict the processing of data concerning you; data portability, meaning that you in certain cases have a right to receive personal data concerning you in a commonly used format, or to have it transmitted to another personal data controller in accordance with your specification. Please note that these rights are not absolute, and that for some rights certain criteria must be at hand for the right to exercised, or that certain exceptions might be applicable.

If you believe that our processing of personal data in conflict with the General Data Protection Regulation (GDPR), you may lodge a complaint at the relevant supervisory authority. The supervisory authorities are as follows: The Information Commissioner’s office (ICO). The practices described in this privacy policy statement are current as of October 2021.