Alan’s Candidate Privacy Policy

Privacy policies are often intimidating. They are generally lengthy, dry and can be unclear. Instead of being reassuring, they end up having the opposite effect, or not even being read at all.

We have written ours to be as clear and accessible as possible, so that, as a candidate for a job at Alan, you can understand exactly how we use your personal data.

Happy reading, and let us know if you have any questions.

As part of processing your application to work with us at Alan, we need to process some of your personal data. The protection of your personal data is important to us, and so is being transparent about how we collect and use information about you through our recruitment website.

This privacy policy applies to any personal data (as defined in the General Data Protection Regulation, the “GDPR”) collected about candidates who apply to work for Alan in any of our geographies, and candidates we identify and would like to work with.

This privacy policy may be updated regularly, to enrich it, according to Alan's needs, circumstances or if required by law. We therefore invite you to check for updates on a regular basis, although we will always notify you of any significant changes affecting the way your data is processed.

Version dated June 30, 2026

When it comes to applying to work at Alan, there are two things you should keep in mind:

• Alan only collects the information we need to make a decision about your application, including information related to your professional background, hard & soft skills, references, or motivation. We will not ask you unnecessary questions for the sake of accumulating information.
• If you are not hired at the end of this process, we commit to giving feedback and we'd like to stay in touch. Alan will keep a copy of your application so that we can keep you in mind for potential future recruitment opportunities. That being said, if you'd rather we didn't keep your data on file, please let us know and we'll make sure your request is fulfilled.

Alan, including all of its affiliates (Alan Insurance, Alan Services, Alan Tech, Alan CA, Marmot BE and Marmot Iberia) is responsible for collecting your personal data in the context of your job application, as data controller under the GDPR.

If you're being considered for a position in one of our new markets, we may share this responsibility with one of our local entities.

Alan's legal details are as follows:

• Alan SA
• 117 quai de Valmy 75010 Paris, France
• Siren: 818 353 070 R.C.S. Paris

If you have any questions about this privacy policy or your personal data, please reach out to our Data Protection Officer at [email protected] or [email protected].

For your safety and ours, we may need to ask you for proof of your identity before we answer your question or request.

The personal data we collect when we consider you for a job at Alan will always be relevant to the evaluation of your profile for the position at stake.

It includes the following information:

• your name
• your contact details (phone number, email address, location)
• your professional background (resume, education, skills, work experience, LinkedIn profile, contact details for references you have permission to provide to us, copy of your highest diploma, etc.)
• your bank details (if we owe you traveling expenses according to our candidate travel policy, available upon request)
• any websites showcasing your work (examples: Github, Twitter, Portfolio)
• copies of communications between you and Alan
• our notes, transcripts, feedback, and assessments following interviews with you or calls with your references
• your salary expectations and availability
• any additional information you proactively share with us (which may include sensitive data)

We rely on you to give us this personal data, or we collect them from other sources that we consider relevant to you professionally, such as:

• Your public LinkedIn profile, your profile on other professional social networks, or publicly available sources that we consider relevant to your professional online presence (like your blogs, conference videos, university websites, etc.)
• The people referring you, if you have been referred to us by an Alan employee or an external person known to Alan,
• The references we check in the recruiting process
• Headhunters and recruitment agencies who support our recruitment efforts and forward your profile to us
• Third parties we may hire as sourcing service providers

Information we collect automatically:

When you submit an application through our Ashby (our Applicant Tracking System) careers page, we collect technical information sent to us by the device you use to submit your application, such as your computer IP address, device identifiers, and how you came to our website.

For more information on cookies used by Ashby, check their privacy policy. You can find more information on cookies used on Alan's websites in Alan's general privacy policy.

Alan collects and uses personal data only to process your application and assess your suitability for jobs at Alan.

On what legal basis?

• We rely on the contract that we wish to enter with you and pre-contractual measures in managing your recruitment process and processing your application.
• We rely on your consent, where you proactively decide to disclose information about a specific trait in your recruitment process which may qualify as sensitive data. We will gather and use such optional information only for the purpose of ensuring to give every candidate a fair chance to succeed and with your prior consent.
• We also rely on legitimate interest to automatically process information on your application using artificial intelligence. Human reviewers remain in control of all hiring decisions at every stage of the process. We respect your choice to opt-out of AI processing, and choosing to opt-out will not negatively impact how your application is evaluated.
• We process some of your data to comply with our legal and regulatory obligations to prepare aggregated reports on our recruitment practices.
• We also rely on our legitimate interests to fulfill our business needs such as improving our recruitment process, saving your record for future roles at Alan

We use your personal data for the following purposes.

To process your application:

• to make informed decisions on your application and assess your suitability for the role, or for other roles available at the time you apply
• to coordinate and facilitate your application process
• to communicate with you about your application, your advancement in the application process
• to check that the information you give us access to is true and accurate, and to check your references
• using artificial intelligence, while maintaining human oversight and decision-making at every stage:
• to automatically flag matches of application criteria we defined
• to get automated transcript notes from the interviews to prepare feedback
• to automatically draft feedback
• to automatically classify candidates based on their answer to our messages
• to automatically tailor emails when contacting candidates
• to automatically search candidates from our Applicant Tracking System Ashby based on specific criteria we defined

To improve our recruitment process:

• if your application is unsuccessful, to consider your record for future roles at Alan
• to perform data analytics and reporting to monitor, test, and improve the effectiveness of our recruiting processes and tools
• to communicate with you about the roles and events that we believe may interest you

To comply with our legal obligations:

• In aggregated form, to create and submit reports on our recruitment practices as required by applicable laws or regulations

If you are not hired, and unless you ask us not to, we retain your personal data for 2 years after your last interaction with us.

If you are hired, your data collected during the recruitment process will be transferred to your employee file and retained for five years after the duration of our employment relationship.

Just send a request to our Data Protection Officer at [email protected] or [email protected].

Your personal data may be communicated to Alan's employees and providers for the purposes outlined above. They will always be duly informed by Alan of the confidentiality of the personal data communicated to them in this context, and we'll always make sure the right contractual measures are in place to protect you.

To meet our legal and regulatory obligations, we may be required to communicate personal information to administrative or judicial authorities upon request. If this were ever the case, we would make sure we grant authorities' access only to the data they strictly require.

Your personal data may also be transferred outside the European Union. When we transfer them to a country that does not have data protection laws equivalent to the European Union (such as the U.S. through some of our providers), we ensure adequate contractual measures are in place and the transfer is consistent with our GDPR obligations.

People who might have access to your personal data in the context of your application include:

• 1) Alan employees: Alan has a strong culture of distributed ownership and transparency, which means our recruitment process is distributed between many different Alan employees. Your application will be shared with them transparently. It also means that all Alan employees have access to most of our core tools and system including Ashby, our Application Tracking System which allows us to move really fast with hiring and provide candidates with an excellent experience. All Alan employees are bound by a confidentiality obligation and are trained on the sensitivity of this information. None of this data may be shared outside the organisationI. If you have any concerns about who has accessed your data, please reach out to us at [email protected] or [email protected].
• 2) Our service providers: We work with other companies or contractors to perform services on our behalf or to assist us with our recruiting process, including:
• Ashby (Application Tracking System)
• LinkedIn (Sourcing and contacting)
• Slack (messaging platform)
• AngelList (job board platform)
• GSuite (email and documents)

The service providers on this list may change from time to time.

The GDPR gives you several rights, which you can easily request to exercise by emailing Alan's Data Protection Officer at [email protected] or [email protected].

Right to access, correct, and delete your personal data: You can request access to your personal data or correct or update out-of-date or inaccurate personal information we hold about you, but this may not affect your application if we have already filled the position or assessed your candidacy based on the information first provided. We will also consider any requests to exercise your right to data portability.

Right to opt-out: If you would like to withdraw your application, opt-out of AI processing or if you do not want Alan to use your personal data to consider you for potential future recruitment, please let your contact at Alan know or reach out to us at [email protected] or [email protected].

Note that if you accept employment with Alan: we will keep your personal data will be held on the basis of our employment contract, and this policy will no longer apply.

Right to complain to your local data protection authority: You also have the right to complain to your local data protection authority if you believe the collection and use of your personal data infringe this privacy policy or applicable law.

Again, if you contact us, we may need to check your identity before we answer your question or request for your safety and ours.