Job Applicant Privacy Notice

BlueMountain Capital Management, LLC

Applicant Privacy Notice

Effective Date: 27 March 2019

Definitions:

EEA” means the then-current member states and member countries of the European Union and European Economic Area, respectively, and, upon its withdrawal from the European Union, the United Kingdom.

GDPR” means the General Data Protection Regulation 2016/679 and, upon the United Kingdom’s withdrawal from the European Union, the transposition of the General Data Protection Regulation 2016/679 into the United Kingdom’s domestic law.

The terms, “controller,” “data subject,” “personal data,” “processing (including “process(es)” and “processed”),” “processor,” and “supervisory authority” used herein shall have the meanings set forth in the GDPR.

Controller Details: BlueMountain Capital Management, LLC (“BMCM,” “we, “us,” or “our”) acts as controller of the personal data received by, or about, job applicants (“Applicants,” “you,” or “your”) as described in this Applicant Privacy Notice (this “Notice”). Our affiliates (which shall include Blue Mountain Capital Partners (London) LLP (“BMCP”) ) shall also be controllers when in receipt of your personal data as discussed herein.

Please reach out to LegalNotices@bmcm.com for questions/inquiries regarding this Notice.

BMCP is registered in the UK, our registered address is at 3rd Floor, 5 Hanover Square, London W1S 1HE, United Kingdom, and our company registration number is 431877.

Processing Activities: As an Applicant, you will create an account on our site, whereby you can upload requested materials for consideration as part of your job application, such as your resume/CV, cover letter, references, and contact information (e.g., name, email address, physical address). As applicable, we may receive similar information from other individuals on your behalf, such as a recruiter or other referral source on your behalf, in each case potentially before you have made an account with us.

We may also process additional information received from or about you, such as (i) during correspondences and meetings with us via phone, in person or email and technical interviews and case studies; (ii) for Applicants that we intend to hire, background check information obtained from our third-party background screening providers (e.g., employment history, education history, court and criminal records and home address); and (iii) qualitative information provided to us by your professional references as part of the recruitment process.

Purposes and Legal Bases of Processing: We process your personal data (i) for purposes of managing our recruitment related activities, which include setting up and conducting interviews and tests for applicants, evaluating and assessing the results thereto, and as is otherwise needed in the recruitment and hiring processes; (ii) our legitimate interest in (a) solicitation, evaluation, and selection of applicants for employment, (b) feedback and analysis of your applicant candidacy from personnel, including regarding your correspondences with us, results of technical interviews and case studies and your application materials, (c) verifying the details that you provide and to ensure that you are suitable for the role for which you have applied, (d) analyzing hiring data from Applicant pool (e.g., recruiter performance, use of recruitment platforms), (e) retaining your job application on file for future jobs, and (f) processing for ensuring cybersecurity (including to prevent unauthorized access to networks, stopping damage to computers and systems, and maintaining audit logs); and (iii) for compliance with, or as authorized by, applicable law and regulatory guidelines, including in order to establish, exercise, or defend our legal rights or for the purpose of legal proceedings.

Categories of Recipients: BMCM may disclose personal data regarding Applicants to the following categories of recipients to effectuate the purposes described herein: (i) partners, officers, managers, or employees of BMCM; (ii) BMCM’s affiliates and their respective partners, officers, managers, or employees; (iii) processors engaged by BMCM and its affiliates (collectively, “Processors”) that provide products and/or services including, but not limited to, data storage and third party administrative services; (iv) applicable governmental, judicial, or regulatory authorities/bodies; and (v) in case of acquisition, reorganization, merger, dissolution, or similar corporate event, to the surviving or acquiring entity (including as needed for due diligence purposes).  Your personal data will be shared with Greenhouse Software, Inc., a cloud services provider and Processor located in the United States of America and engaged by BMCM to help manage its recruitment and hiring process on BMCM’s behalf.

Transfer of Personal Data outside the EEA: BMCM may disclose your personal data from the EEA to its categories of recipients above in countries outside of the EEA, including countries that may not be deemed to provide an “adequate” level of protection for personal data by the European Commission (each, a “Transfer”), such as the United States.

BMCM may do so pursuant to having appropriate grounds to Transfer your data, including by (i) use of Standard Contractual Clauses pursuant to GDPR Article 46(5); (ii) the recipients’ self-certification to the Privacy Shield Framework pursuant to GDPR Article 45(3); (iii) Transfer to an “adequate” country pursuant to GDPR Article 45(1); or (iv) an appropriate derogation, such as GDPR Article 49(1)(b)/(c) (as necessary for performance of contract or pre-contractual measures at data subject’s request, and performance or conclusion of contract concluded in data subject’s interest, respectively) and GDPR Article 49(1)(e) (necessary for the establishment, exercise, or defense of legal claims).

Retention: How long we hold your personal data for will vary. The retention period will be determined by the following criteria (i) the purpose for which we are using your personal data (we will need to keep the data for as long as is necessary for that purpose); and (ii) legal obligations (laws or regulation may set, or recommend, a minimum period for which we have to keep your personal data).

Your Rights: Natural persons have a right to: (i) request access to, correction, and/or erasure of their personal data; (ii) object to processing of their personal data; (iii) restrict processing of their personal data; and (iv) request a copy of their personal data, or have a copy thereof sent to another controller, in a structured, commonly-used, and machine-readable format under the right of data portability. These rights may be exercised by contacting LegalNotices@bmcm.com. Natural persons also have the right to lodge a complaint about the processing of their personal data with a relevant supervisory authority (e.g., UK Information Commissioner’s Office, place of residence or infringement).