Individuals located in Canada have certain rights pursuant to applicable provincial privacy laws. Subject to certain exceptions and limitations, and depending upon the jurisdiction where you reside, such rights may include:

a. Access: The right to request that we disclose the personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business purpose for collecting or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you, as well as how the information is used.

b. Accuracy and Correction: The right to request that we correct an error or omission in the personal information we maintain about you, and to challenge the accuracy and completeness of your personal information and have it amended, updated or rectified as appropriate.

c. Right to Withdraw Consent: The right to withdraw your consent to the collection, use or disclosure of your personal information, subject to certain exceptions relating to our legal or business requirement to continue processing the information. In the event you withdraw consent, we will inform you of the likely consequences of this withdrawal, and we will immediately stop collecting, using or disclosing the relevant personal information.

d. The right to be informed of the existence, use, and disclosure of your personal information, and to be provided with an account of the use that has been made or is being made of this information as well as the third parties to which it has been disclosed (including a list of organizations to which your information may have been disclosed).

e. The right to acquire information about our policies and practices with respect to personal information, including: a description of the type of personal information held by Harvey Nash and a general account of its use; a copy of any brochures or other information that explain our policies, standards, or codes; and information about what personal information is shared with or accessible to our affiliates.

f. The right to challenge Harvey Nash’s compliance with the applicable Canadian Privacy Laws.

Additional Information for Residents of Quebec

Residents of Quebec have additional rights under the Quebec Privacy Act, including:

g. Right to Data Portability: You can request a copy of your computerized personal information in a structured, commonly used format.

h. Automated Decision-Making: Harvey Nash uses technology that incorporates artificial intelligence to assist with candidate search and selection. This technology is used to parse and analyse resumes and candidate profiles, and to return search results based on recruiter-defined parameters. Results may be ranked by relevance score. Candidates whose profiles do not meet the specified search criteria may not appear in search results. Human recruiters review all returned profiles and make all decisions regarding whether to contact candidates.

For more information about how this technology is used, or to exercise any rights you may have in connection with automated decision-making, please contact our Privacy Officer at the contact details provided below.

i. Right to De-indexation: Residents of Quebec have the right to request that we stop disseminating your personal information or de-index a hyperlink associated with your name that provides access to your information, if such dissemination causes harm or violates the law or a court order. Once we receive and confirm a privacy request, we will evaluate the circumstances and inform you whether we will de-index, re-index or delete the information. Please note that we may not be able to de-index, re-index or delete the personal information entirely in certain cases, such as where doing so would violate any law or legal requirement, where the information is necessary for servicing or collecting on an active account, or where our evaluation determines that de-indexation or re-indexation is not possible in the circumstances.

Canadian Response Timelines: Subject to applicable legislation in your province of residence you may benefit from certain access rights. For residents of Alberta, upon receiving a request to access, delete, or correct an error or omission, we will respond within forty-five (45) days of its receipt. If we require more time (up to an additional 30 days for a total of 75 days), we will inform the requestor of the reason and extension period in writing. For residents of Quebec, upon receiving a request to access, delete, or correct an error or omission, we will respond within thirty (30) days of its receipt. For residents of British Columbia, upon receiving a request to access, delete, or correct an error or omission, we will respond within thirty (30) days of its receipt. If we require more time (up to an additional 30 days for a total of 60 days), we will inform the requestor of the reason and extension period in writing.

We will deliver our written response electronically unless you specifically request to receive this information by mail.

Data Storage, Cross-Border Transfers, and Protection

We may store your personal information on servers and systems under our control or on servers and systems. To carry out the purposes described in our Privacy Notice and this section your personal information may be transferred and stored outside of Canada, including in the United States. If you are a resident of Quebec, please note that your Personal Information may be transferred and stored outside of Quebec, including in other provinces in Canada and the United States, for these purposes. This means your data may be subject to the laws of other jurisdictions, which may not provide the same level of protection as in your province or in Canada generally. U.S. government or law enforcement agencies may access your data under U.S. law.

When the Company transfers personal data across borders to a third party, it will take all reasonable steps to protect the data from unauthorized use and disclosure. The Company will only engage third-party processors that have adequate security measures, policies, and staff training in place to safeguard personal information. The Company will proceed with a Privacy Impact Assessment as defined in the Quebec Privacy Act and written agreements when required to ensure the safety of your personal information.

If you have any questions or concerns about this Privacy Policy or our privacy practices, you may contact us by emailing us at CPRA@harveynash.com or calling us at 1-833-496-0299.

Appendix

Appendix 1
Audio Recording and Transcription

We may record telephone calls or virtual meetings with clients, consultants, candidates, and other business contacts where necessary and proportionate. Before any recording begins, we will inform participants that recording is taking place and that we rely on our legitimate interests to maintain accurate records of communications and agreements. Where recording is not necessary or if you object, we will pause or avoid recording and document the discussion through written notes instead.

The recordings are used to create written notes or transcripts using secure AI-based transcription tools. These notes help us maintain accurate records of our communications and any agreements reached. Recordings are automatically deleted within 30 days unless transcription or verification is still in progress. Once notes are finalized, audio files are deleted. Resulting notes or transcripts may be stored on our internal systems in line with our data retention policy.

Recording tools used by us (e.g., secure AI-based transcription services) are configured to enforce the above deletion window (for example, auto-delete settings set to "delete within 30 days"). Access is strictly limited to authorized personnel and handled in accordance with GDPR and our internal acceptable use and data security policies.

Appendix 2
Use of Artificial Intelligence Tools

This Appendix explains how we use artificial intelligence (“AI”) tools in connection with our recruitment, consultancy, outsourcing and related services. It should be read together with the rest of this Privacy Notice.

1. AI tools we may use
We may use approved AI tools to support recruitment workflows, candidate matching, communications, summarization, drafting and internal productivity. We may update the AI tools we use from time to time, subject to appropriate privacy, security and supplier due diligence.

2. Personal information processed
Depending on the tool and purpose, AI tools may process candidate, consultant, client contact and business contact information, including names, contact details, CV or professional history, recruitment preferences, application status and communications data such as emails, call notes, summaries or transcripts.

We do not intentionally input special category data into AI tools unless this is necessary, lawful and subject to appropriate safeguards.

3. Purposes of use
We may use AI tools to identify and match candidates to roles, support recruiter and administrative workflows, generate summaries, assist with drafting and improve the efficiency and consistency of our services. Where AI tools are used to assist with candidate matching or role suitability, this may involve profiling. Where AI-assisted scoring is used, it may help us identify potentially suitable roles, candidates or opportunities, but it does not determine recruitment outcomes without human review. Any such profiling is used to support, not replace, human decision-making. AI-generated outputs are subject to appropriate human review and are not relied on exclusively.

4. Lawful basis
Our lawful basis will depend on the relevant processing activity. We may rely on legitimate interests, performance of a contract, legal obligation and, where required, consent. Where we rely on legitimate interests, our interests may include improving the efficiency, quality and consistency of our recruitment services, matching candidates to suitable opportunities, managing communications and supporting internal administration. Where AI tools are used to record or transcribe calls or meetings, individuals will be informed before the recording or transcription begins and, where required, consent will be obtained.

5. Controls and safeguards
We apply controls to ensure that AI tools are used appropriately and proportionately. These include data minimization, employee usage rules, restrictions on highly sensitive or confidential information, supplier due diligence, contractual safeguards, access controls, encryption and monitoring where appropriate.

6. Retention and model training
Personal information processed using AI tools is retained only for as long as necessary for the relevant purpose and in line with our retention policy. This information is used for inference and employee training but not to train AI models. Where available and appropriate, we configure AI tools, and put contractual controls in place, to limit retention of prompts, inputs and outputs and restrict the use of personal information to train third-party AI models, unless expressly agreed, documented and lawful.

7. Automated decision-making and individual rights
AI tools support our services but do not replace human involvement. We do not use AI tools to make solely automated decisions about candidates, workers or consultants that produce legal or similarly significant effects, such as decisions to submit, shortlist, reject, engage or terminate, without meaningful human involvement. You retain the rights set out in this Privacy Notice, including rights to access, correct, delete, restrict or object to processing and rights relating to automated decision-making.