Candidate Privacy Notice

Last update: April 2026

Thank you for your interest in joining Immutable. This Notice explains how Immutable Pty Ltd and its group entities collect, use, store and share your personal information when you apply for a role with us. We are committed to treating your personal information with care and transparency throughout the recruitment process.

This Notice applies whether you apply directly, through a recruitment agency, or are sourced by our talent team. It also applies to individuals with whom we may have talent sourcing discussions, even if no formal application has been made.

If you join Immutable, you will receive our Employee Privacy Notice during onboarding, which covers the broader data handling practices that apply during your employment or engagement.

If you also use Immutable's products and services (such as Passport, Immutable Play, or games built on the Immutable platform), your personal information in that context is governed by Immutable's Privacy Policy.

1. What personal information we collect

The information we collect depends on the role, your location, and how far you progress through the recruitment process. We may collect the following categories:

Some of the categories above involve sensitive information as defined under the Privacy Act 1988 (Cth) (such as diversity data). Where we collect sensitive information, we do so either with your consent or where permitted by law.

2. Why we collect your information

Note: This table uses GDPR-aligned terminology as our highest common standard. These bases also satisfy equivalent requirements under the Australian Privacy Principles (APPs 3 and 6), US state privacy laws, and other applicable regimes.

Where we rely on consent, you can withdraw your consent at any time by contacting privacy@immutable.com. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

3. How we collect your information

We collect personal information in a variety of ways, including:

Directly:

• Voluntarily — We collect personal information which you directly provide to us, including when you submit an application or form to us.
• Automatically — We may collect personal information which you indirectly provide to us while interacting with us as set out in this Notice.
• From Third Parties — In some circumstances where a third party service provider (such as a recruitment agency or assessment platform) collects personal information from you on our behalf, this may also be considered a direct collection by us.

Indirectly:

• From Third Parties — We may collect personal information from third parties such as recruitment agencies or referees (where this is not considered a direct collection by us — see above).
• From Publicly Available Sources of Information — We may collect personal information from publicly available sources, such as LinkedIn profiles and other social media, where relevant to your application or our talent sourcing activities.

4. Automated decision-making and AI

Immutable uses third-party AI-assisted tools during recruitment to support — not replace — human decision-making. These tools are used for various purposes, including:

• During interviews, to assist with note-taking and to generate interview summaries, insights and reporting. Outputs such as interview transcripts and reports may be further processed by other enterprise AI tools we use (including large language models such as Claude) for purposes such as generating summaries, drafting follow-up communications, or supporting interviewer review. The AI-generated outputs are reviewed by the interviewer and/or Talent before being used in any hiring decision.
• For technical assessments, such as for engineering and other technical roles. Assessment results are reviewed by human interviewers.
• More broadly, Immutable makes use of approved and enterprise versions of AI tools (including Claude and Gemini) for use across business functions. These tools may be used by recruiters and hiring managers in the course of their work.

If you would prefer that a particular stage of your assessment not involve AI-assisted tools, please let your recruiter know. We will try to accommodate such requests where operationally possible.

We do not make hiring decisions based solely or substantially on automated processing. A human always reviews AI-generated outputs before any decision that affects you. We conduct regular audits of our hiring decisions with the use of AI including bias checks.

If you have questions about how AI is used in your specific recruitment process, you are welcome to ask your recruiter.

5. Who we share your information with

We share your personal information only where necessary for the recruitment process. Recipients include:

• Hiring managers and interviewers at Immutable who are involved in assessing your application
• Lever (our applicant tracking system), MetaView (AI interview assistant), and CoderPad (technical assessments)
• Certn (pre-employment screening provider) — background checks are conducted with your consent
• LinkedIn Recruiter (if your application originated through LinkedIn sourcing)
• Recruitment agencies (where you were referred by an agency)
• Referees (where reference checks are conducted as part of the recruitment process)
• Immutable group entities (where the role sits within a subsidiary or related company)
• Enterprise tier, secure versions of AI and language model platforms — Claude (Anthropic), Gemini (Google), and other AI tools in use by Immutable, where personnel may input candidate data in the course of their work
• Professional advisers (such as legal counsel, where required)
• Government and regulatory bodies (where required by law)

We do not sell your personal information (however we may transfer it in the case of a merger or business sale — see further under "Data controller", below).

We do not share your personal information with third parties for their own marketing purposes.

6. How we protect your information

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction or alteration. These measures include encryption, access controls, and regular security assessments.

7. Cross-border transfers

Immutable is headquartered in Sydney, Australia, and recruits globally. Your personal information may be transferred to and processed in countries other than where you are located, including Australia, the United States, the United Kingdom, the European Union, Singapore and other jurisdictions where our service providers or group entities operate.

We protect these transfers through contractual safeguards, including data processing agreements with third-party providers, EU/UK Standard Contractual Clauses where required, and reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles (APP 8).

8. How long we keep your information

If your application is successful, your candidate data will be incorporated into your employee record and retained in accordance with our Employee Privacy Notice.

If your application is unsuccessful, we will retain your data for 24 months after the recruitment process concludes, to allow us to respond to any queries about the process and to comply with legal obligations.

With your consent, we may retain your data for a longer period to consider you for future opportunities at Immutable. You can withdraw this consent at any time by contacting privacy@immutable.com.

Where we no longer need personal information, we will take reasonable steps to securely delete or de-identify it.

9. Your rights and key contacts

You generally have the right to:

• Access your personal information held by Immutable
• Correct inaccurate or incomplete personal information
• Withdraw consent where we rely on consent as the basis for processing (such as diversity data or talent pool retention)
• Raise a concern about how your personal information is handled

To exercise any of these rights, or to raise a concern, you can contact privacy@immutable.com. The rights may also be subject to certain qualifications or exceptions as permitted by the applicable laws, which we will explain if relevant to a particular request.

If you have any concerns about the application of this Privacy Notice, please let us know in the first instance.

Additional rights by jurisdiction

EU/UK: Under the GDPR, you also have the right to erasure (deletion), data portability, restriction of processing, and the right to object to processing based on legitimate interests. If you are not satisfied with our response, you may lodge a complaint with your local supervisory authority (e.g., the Irish DPC, the UK ICO, or the French CNIL).

California: Under the CCPA/CPRA, you have the right to know, delete, correct, and limit use of sensitive personal information. You will not be discriminated against for exercising your privacy rights. We do not sell or share your personal information for cross-context behavioural advertising.

Data controller and contact

The data controller for your personal information is the Immutable group entity recruiting for the role you have applied for. For most roles, this is Immutable Pty Ltd (ABN 89 626 193 351) of L18/77 King Street, Sydney, NSW, Australia.

In the event of a merger, acquisition, reorganisation, or sale of all or part of Immutable's business, your personal information may be transferred to the successor entity. We will notify you of any such transfer.

For any questions about this Notice or how your personal information is handled during the recruitment process, contact privacy@immutable.com.

Changes to this Notice

Immutable reserves the right to update this Notice from time to time. The current version will always be available through our website.