Atlas Bio Candidate Privacy Notice

Last updated: 27 October 2026

This notice explains how Atlas Bio handles the personal data you share through our talent form.

Who we are.

Atlas Bio AG, Sandgrubenstrasse 44, 4058 Basel, Switzerland, is responsible for your data. For any question or request about your data, write to privacy@atlas.bio.

What we collect.

• What you give us: your name, email address, professional links, CV and any other documents you upload, and your answers to the questions in the form.
• Technical data: your IP address and basic browser information, used only to keep the form secure and block spam.

Please do not include sensitive information in your documents, such as health data, religious beliefs or identity numbers. We do not need it to assess your profile.

Why we use it.

We use your data to assess your profile for current and future roles at Atlas Bio and to contact you about them.

We process your data under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). We do so because you asked to be considered for roles with us, which are steps before a possible employment contract (Art. 6(1)(b) GDPR), and because we have a legitimate interest in recruiting and in keeping our systems secure (Art. 6(1)(f) GDPR). We do not use your data for marketing and we do not sell it.

A person at Atlas Bio reviews every profile. We do not make decisions about you based solely on automated processing.

Who sees it.

Only the people at Atlas Bio involved in recruitment can access your data. We also use these service providers, which process your data only on our behalf and under contract:

• Notion Labs, Inc. (United States) stores your application, your documents and the record that you read this notice.
• Cloudflare, Inc. (United States, with servers worldwide) hosts this website, runs the spam check and keeps a temporary backup copy of your application.
• Google (Google Workspace) handles the emails we exchange with you.

We may disclose data if the law requires it. If Atlas Bio is merged or acquired, your data may pass to the new owner, who must continue to respect this notice.

Where it is stored.

Your application and documents are stored in the United States. The temporary backup copy is stored in the European Union. Technical data is processed on Cloudflare's servers worldwide, including in the United States. Emails are handled on Google's servers, which may be located in the United States.

When data leaves Switzerland or the European Economic Area, we rely on recognised safeguards: the Swiss-U.S. and EU-U.S. Data Privacy Framework, under which Notion, Cloudflare and Google are certified, or standard contractual clauses approved by the authorities.

How long we keep it.

We keep the information you submit, and the emails we exchange with you, for up to 2 years from your submission, then delete them. We delete them sooner if you ask us to. If you join Atlas Bio, the relevant data moves to your employee file. If there is a legal dispute, we keep what is needed until it is resolved.

Technical data used for security, such as server logs, is kept for up to 7 days. The spam check uses technical data only for the check itself.

When you submit the form, we make a temporary backup copy of your application in case our storage service is unavailable. It is deleted as soon as your application is saved, and in any case within 30 days.

Your rights.

Under the FADP and, where it applies, the GDPR, you can ask us at any time to:

• see the data we hold about you and receive a copy;
• correct it;
• delete it;
• send it to you in a common, machine-readable format;
• stop using it (objection);
• limit how we use it (restriction).

Write to privacy@atlas.bio and we will reply within 30 days. We may ask you to confirm your request from the email address you applied with.

If you are unhappy with how we handle your data, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the European Union, to the data protection authority in your country.