UK/EEA (excluding Ireland & France) Applicant Privacy Notice

Last updated: July 16, 2026

Introduction

Harvey respects your right to privacy and we are committed to securing and protecting any information we have about you.

This privacy notice (this “Notice”) describes the ways we collect, use and share personal data that relates to job applicants, including referrals and applicants who have applied directly through our website as well as through third party agencies and recruiters. Furthermore, this Notice applies to those applicants who have applied to work for a Harvey company or an Employer of Record (“EOR”) organization providing services to a Harvey company in the European Economic Area (excluding Ireland and France) and the United Kingdom.

It is important you read this Notice so that you are aware of how and why we are using information that relates to you (“Personal Data”), your rights and how the law protects you. This Notice also explains how you can exercise your rights under applicable privacy and data protection laws.

Harvey AI UK Ltd. (“Harvey”, “we”, “us” or “our”) is the Data Controller (as defined by UK GDPR or GDPR).

Personal Data We Collect and Use

We collect Personal Data directly from you when you apply for or are referred for a job at a Harvey company or an EOR providing services to a Harvey company and we also collect Personal Data from third parties. All the Personal Data we collect, both from you, from third parties about you, and automatically is outlined in the table below.

Category of Personal Data Collected

Examples (where applicable)

Identity Data

Information to help us identify you including, first name, middle name(s), surname, title, government issued identifiers such as national identification and/or passport details, national insurance / personal public service number or other tax-related information, driver’s license, photographs.

Contact Data

Information to allow us to contact you including, your home address, work address, email address and telephone numbers.

Biographical and Demographic Data

Title, date of birth, gender, education history, professional history, professional qualifications and memberships, references, information contained within letters of application and CVs, language proficiencies and other skills, certifications, certification dates, and social media biographies and photographs.

Immigration Information

Information that would allow us to verify your employment eligibility including, national identification, passport number, details of residency, and work permit.

Other Data

This might include data not listed above that you provide to us, such as your feedback and survey responses where you choose to identify yourself.

Content and Communications

Interview records, assessment responses, recordings (if applicable), and results including for psychometric and ability tests (if applicable).

Information we collect automatically

Information that your browser or device automatically sends us when you use Harvey’s systems (e.g. devices, communications, IT systems and applications).

To the extent permitted by applicable law we may collect sensitive or special category Personal Data. Sensitive and special category data is personal data that may have special protections under certain laws. The categories of sensitive or special category data we collect may also include:

  • Data related to diversity such as racial or ethnic origin, religious or similar beliefs, membership of a trade union, works council membership if you disclose this information in your application or during the interview process.
  • Data related to your health or disabilities you disclose regarding an accommodation request or in countries where pre-employment medical checks are required by law.
  • Data related to criminal convictions or offenses collected (if at all) during background screening and results that we may carry out if applicable law permits.

If you provide your consent for Harvey to collect sensitive data about you, you have the right to withdraw your consent at any time. If you wish to withdraw consent, please contact us at privacy@harvey.ai.

Purpose of Processing

Lawful basis

Create and manage the recruitment process, job applications, and a database of interested individuals and leads.

Our legitimate interest to conduct our recruitment processes efficiently and fairly or to manage applications effectively. When we rely on our legitimate interest to process your Personal Data we ensure your fundamental rights do not override those interests.

Assess and evaluate your skills, qualifications and interests against the position applied for and other positions within Harvey, including to determine the compensation and other benefits that may be offered to you. We may also use machine-learning tools and algorithms from third parties to help us identify suitable applicants and review/analyze applicant information based on relevant qualifications, skills, and experience. The hiring team evaluates the results of this analysis, along with other factors, in considering an applicant for a role.

To assess your suitability for the vacancy prior to entering into an employment contract with Harvey or an EOR providing services to Harvey (necessity for entering an employment contract).     When assessing a candidate’s suitability for positions other than the one they originally applied for, this is done on the basis of our legitimate interest in identifying the most suitable role for all applicants. When we rely on our legitimate interest to process your Personal Data we ensure your fundamental rights do not override those interests.

Create recordings and transcripts of interviews, including using AI systems for transcription and note taking.

Our legitimate interest to create records for use in evaluating your application. When we rely on our legitimate interest to process your Personal Data we ensure your fundamental rights do not override those interests.

Communicate with you about your interest in Harvey, job opportunities, applications, or the recruitment process.

To assess your suitability for the vacancy prior to entering into an employment contract with Harvey or an EOR providing services to Harvey (necessity for entering an employment contract).

Verify your information, including through reference checks and background checks (which may include employment, education, and criminal record checks, subject to applicable law).

As necessary to serve Harvey’s legitimate interests (or those of a third party) to ensure the accuracy of the information provided and assessing suitability for employment. When we rely on our legitimate interest to process your Personal Data we ensure your fundamental rights do not override those interests; and to comply with a legal obligation (where applicable).

Send you information about the onboarding and employment experience before your first day.

Our contractual necessity for entering into an employment contract with you or facilitating the EOR's employment contract with you.

Keep your record for future hiring needs, including for the purpose of communicating with you and providing you with information regarding potential career opportunities that suit your profile.

As necessary to serve Harvey’s legitimate interests (or those of a third party) to effectively recruit talent. When we rely on our legitimate interest to process your Personal Data we ensure your fundamental rights do not override those interests.

Comply with legal obligations (including employment laws and regulations), deal with legal disputes and to establish, exercise and defend potential legal claims.

To comply with legal obligations; and     As necessary to serve Harvey’s legitimate interests (or those of a third party). When we rely on our legitimate interest to process your Personal Data we ensure your fundamental rights do not override those interests.

Data Sharing and Data Transfers

Harvey may share your Personal Data with third parties for specific purposes including with:

  • Affiliates. Our corporate parent (Harvey AI Corporation), its subsidiaries, and other affiliates (when they become incorporated) under the control of our corporate parent.
  • Service Providers. These service providers process Personal Data on Harvey’s behalf. The service providers may include recruiting, HR tools, screening, verification, or background checks, compensation benchmarking, and hosting.
  • Employers of Record (EORs). We may share your Personal Data with the EOR to facilitate your employment with the EOR.
  • Government regulators, law enforcement, tax authorities, court officials and others. We may share your Personal Data if necessary to comply with legal or regulatory obligations.
  • Professional advisors, including lawyers, immigration advisors, and other professional advisors.

We may share your Personal Data with third parties, our parent company (Harvey AI Corporation), affiliates and subsidiaries who are based outside of the EEA, UK, and Switzerland.

In such circumstances, the processing of your Personal Data will involve a transfer of your Personal Data to countries based outside the EEA, UK, and Switzerland. Whenever we transfer your Personal Data outside the UK, EEA, and Switzerland, we take steps to ensure a similar degree of protection is afforded to it by making sure that at least one of the following mechanisms is implemented:

  • Transfers to territories with an adequacy decision. We may transfer your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data by the UK Government or the European Commission from time to time including the United States under the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce.
  • Transfers to territories without an adequacy decision. We may transfer your Personal Data to countries that have not been deemed to provide an adequate level of protection for Personal Data by the European Commission or the UK Government – provided that, in these cases:
    • we may use specific appropriate safeguards, which are designed to give Personal Data effectively the same protection it has in the UK (e.g., the EU SCCs, UK’s International Data Transfer Agreement or International Data Transfer Addendum to the European Commission’s ‘Standard Contractual Clauses); or
    • in limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer your Personal Data to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’ – e.g., reliance on your explicit consent to that transfer or because it is necessary for the establishment, exercise or defense of legal claims (including regulatory, administrative or any out-of-court procedure, and seeking advice).

You can contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of the EEA, UK, or Switzerland. You may have the right to receive a copy of the appropriate safeguards under which your Personal Data is transferred – you can make a request by contacting us using the contact details shown in the “Contact Us” section below.

Data Retention

Harvey’s retention periods for Personal Data are based on business needs and legal requirements. We retain Personal Data for as long as is necessary for the processing purpose(s) for which it was collected, as set out in this Notice, and any other permissible, related purposes. For example, we may retain certain information to comply with regulatory requirements regarding the retention of such data, or in the event a litigation hold is imposed.

When Personal Data is no longer needed, we either irreversibly anonymise the data (and we may further retain and use the anonymised information) or securely destroy the Personal Data.

Data Security

The security of your information is important to us. We protect your Personal Data through technical and organizational measures designed to mitigate the risk of unlawful or unauthorized access, destruction, loss, alteration, disclosure, or use of your Personal Data. The measures are designed to provide a level of security appropriate to the risk of processing.

Your Rights Relating to your Personal Data

Under certain circumstances, by law you have the right to:

  • Request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you.
  • Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
  • Object to processing of your Personal Data. This right exists where we are relying on a Legitimate Interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to processing on this ground.
  • Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your Personal Data. We will provide to you, or a third party you have chosen, your Personal Data which you have provided to us, in a structured, commonly used, machine-readable format. Note that this right only applies to Personal Data we process by automated means which you initially provided consent for us to use or where we used the information to perform a contract with you.

Please also note that in certain circumstances the rights above will not apply and some categories of Personal Data will be exempt from the scope of those rights. We will notify you where this is the case.

How to exercise your rights:

If you want to exercise any of the rights described above, please email us at privacy@harvey.ai.

Contact Us

Please direct any questions or inquiries about this Notice to the privacy team via email at privacy@harvey.ai. You may also contact our Data Protection Officer at DPO@harvey.ai.

We are committed to working with you to resolve any concern you may have about privacy. If, however, you believe that we have not been able to assist you with your concern, you have the right to contact your local data protection authority or regulatory body in the country you reside. If you reside in a country that is a member of the European Union or that is in the European Economic Area, you may find the contact details for your appropriate data protection authority on this website. If you reside in the United Kingdom, you may make a complaint directly to the UK Information Commissioner’s Office:

Information Commissioner’s Office

Water Lane, Wycliffe House

Wilmslow - Cheshire SK9 5AF

Telephone: +44 303 123 1113