Privacy Notice

HYPES SB UK LTD (the "Company", “we”, “us” or “our”) acts as the data controller for the processing of personal data in connection with recruitment for roles at our UK entity and enquiries submitted via our website contact forms (including investment enquiries, sales & business enquiries, and other enquiries). We process personal data lawfully, fairly and transparently in accordance with the UK GDPR and the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR)(EU)2016/679. Unless otherwise stated, terms have the meanings given in the UK GDPR and/or the EU GDPR, as applicable. Our contact details (and, where applicable, those of our DPO and EU representative) are set out in the Contact section below.

1. Categories of personal data we process

We may process the following categories of personal data:

Identification and contact details (e.g., name, postal address, email, phone).
Demographic and professional information (e.g., date of birth, education, employment history, qualifications, professional memberships, current/desired remuneration).
Application materials and communications (e.g., CVs, cover letters, forms, interview notes, correspondence, call recordings where lawful and notified).
Assessment, verification and vetting data (e.g., test results, right-to-work checks, reference responses, background screening results where proportionate and lawful).
Recruitment process metadata (e.g., application/participation history, outcomes). Special category data and criminal offence data are addressed in Section 6.
Enquiry details: enquiry type (investment/sales/other), subject and message content, files you upload.
Technical & logs: IP address, device/browser information, language, timestamps, referrer/UTM, user agent and other standard web logs collected by our web and security tools.

2. Sources of personal data

We obtain personal data:

Directly from you — for example, when you apply for a role or submit a query via our website contact form, and through related communications (emails, calls, meetings, interviews or assessments you choose to participate in).
From third parties where lawful and relevant — for example, recruitment agencies/head-hunters, referral and background/identity verification services in the recruitment context, and professional referral services or event organisers who may legitimately refer your enquiry to us.
From public sources, where appropriate to the purpose — for example, professional networking services for role-related screening, and official company registers or public corporate websites for limited B2B due diligence connected to enquiries you initiate.

3. Purposes and lawful bases

We process personal data for the following purposes and on the corresponding lawful bases:

To publicise job openings, source and identify potential candidates (for example, via professional networking services like LinkedIn), and manage our talent pipeline.
- Lawful Basis: Legitimate Interests. Our legitimate interests are to ensure we can effectively recruit and hire suitable candidates for our business.
- Additional Information: When we send job alerts or other direct electronic marketing messages (e.g., via email or SMS) to individual subscribers, we will comply with the Privacy and Electronic Communications Regulations (PECR) by obtaining your consent.
To accept and manage your job application, which includes arranging interviews, scheduling, communicating with you, and handling travel logistics.
- Lawful Basis:
  - Performance of a Contract (pre-contractual): This is the primary basis for processing your data when you submit an application. By taking steps to apply for a job, you are requesting us to take steps toward a potential employment contract.
  - Legitimate Interests: We also rely on our legitimate interests to effectively manage our recruitment process and handle all related administrative tasks.
To assess your skills, qualifications, and overall suitability for a role, which includes shortlisting and conducting tests.
- Lawful Basis: Legitimate Interests. Our legitimate interests are to ensure we hire suitable candidates and maintain an effective and fair recruitment process.
To verify your identity and confirm your eligibility to work in the UK.
- Lawful Basis: Legal Obligation. We are legally required to conduct these checks under UK immigration and employment laws before you start work with us.
To manage your conditional job offer and handle all the necessary pre-onboarding administration.
- Lawful Basis:
  - Performance of a Contract (pre-employment steps): This applies to the steps we take at your request to finalize the employment contract, such as preparing and sending your offer letter.
  - Legal Obligation: This applies to any checks or administrative steps we are legally required to complete before your employment begins.
To monitor diversity within our applicant pool and, where applicable, to make reasonable adjustments to our recruitment process to accommodate candidates.
- Lawful Basis: The lawful basis for this processing is explicit consent. This is because diversity data (such as racial or ethnic origin, health data, sexual orientation, etc.) is considered special category data under UK GDPR. Processing this type of data requires a higher standard of protection and justification. We will also process this data in compliance with the conditions and safeguards outlined in our Section 7.
To analyze data for metrics and audits to improve the quality, fairness, and effectiveness of our recruitment process.
- Lawful Basis: Legitimate Interests. Our legitimate interests are to monitor and improve the efficiency and fairness of our hiring practices. Where feasible, we use aggregated or de-identified data for this purpose.
To receive and respond to your enquiries, including investment, sales, or general business questions submitted via our contact forms. This involves using the contact details you provide (e.g., your name and email), routing your request to the appropriate team, and maintaining a record of the correspondence.
- Lawful Basis: Legitimate Interests. It is our legitimate interest to operate our business by responding to and managing incoming requests effectively.
To take specific steps you have requested before entering into a contract with us. This could include providing a business proposal, a quote, or arranging a meeting to discuss a potential business relationship.
- Lawful Basis: Performance of a Contract (pre-contractual). This applies when your enquiry is a direct request to us to take action toward a future agreement.
To evaluate and manage potential collaborations, partnerships, and other business transactions. This includes handling communications, coordination, record-keeping, and negotiating terms with organizations and individuals.
- Lawful Basis: Legitimate Interests. It is our legitimate interest to grow our business by exploring and developing new partnerships and business opportunities.
To take steps you've requested before entering into a contract with us (for example, when we provide a quote or arrange a meeting), and to carry out checks required by law.
- Lawful Basis: Performance of a Contract (pre-contractual). This applies when your data is processed to take actions at your request that are aimed at forming a contract. Additionally, we may process your data based on a Legal Obligation where required by law, such as for anti-bribery or sanctions checks.
To assess and respond to investment inquiries, as well as to conduct our own outreach for potential mergers, acquisitions, and other corporate transactions. This includes initial due diligence, communication, and coordination.
- Lawful Basis: Legitimate Interests. Our legitimate interests are to operate our business and explore strategic growth opportunities, such as investments and corporate transactions.
To conduct legally required checks, such as those related to sanctions or anti-money laundering, and to take specific actions at a counterparty’s request before finalizing an agreement.
- Legal Obligation: We must process data to comply with legal requirements, particularly in the context of financial and corporate transactions.
- Performance of a Contract (pre-contractual): This applies to processing data when we take steps you have requested before entering into a binding agreement.
To improve our products and services by conducting user interviews, surveys, and product trials. This involves collecting and analyzing feedback to ensure quality.
- Lawful Basis: Legitimate Interests. It is our legitimate interest to continuously improve our offerings and ensure they meet a high standard of quality.
To manage your participation in specific product trials or research governed by a separate set of terms and conditions.
- Lawful Basis: Performance of a Contract (pre-contractual/contractual). This applies when your participation is part of an agreement or is a step toward a future contract.
To communicate with you about research opportunities, and, where applicable, to process data from recordings or special category data (e.g., health information, racial or ethnic origin) during our research.
- Lawful Basis:
  - Consent: When our communications constitute direct marketing to individual subscribers under the Privacy and Electronic Communications Regulations (PECR), we will obtain your consent. For corporate subscribers, we will provide a clear opt-out.
  - Explicit Consent: If our research involves optional recordings or the collection of special category data, we will seek your explicit consent beforehand. This is a higher standard of consent required by UK GDPR for sensitive data.
To contact influencers and other individual partners to explore potential collaborations. This involves managing all related communications, coordination, and record-keeping.
- Lawful Basis:
  - Legitimate Interests: It is our legitimate interest to grow our business by developing new marketing and partnership opportunities.
  - Performance of a Contract (pre-contractual): This applies when we take steps at your request to enter into a potential agreement with you.
To send electronic communications for marketing and outreach purposes.
- Lawful Basis: We will process your data for this purpose in compliance with the Privacy and Electronic Communications Regulations (PECR).
  - For individual subscribers, we will obtain your consent before sending any electronic marketing messages.
  - For corporate subscribers, we will provide a clear opt-out in every message.
To ensure the security of our systems and data by preventing fraud, abuse of our forms, and other harmful activities. This also involves meeting all our legal and regulatory requirements.
- Lawful Basis:
  - Legitimate Interests: It is our legitimate interest to protect our business, systems, and customers from security threats, fraud, and abuse.
  - Legal Obligation: This applies where we are legally required to process your data to comply with regulations or legal mandates.

4. Recipients (disclosures)

We share personal data, where necessary and proportionate, with:

Group entities involved in the relevant decision-making or enquiry handling.
Service providers acting as our processors under Article 28 (with appropriate contractual and security safeguards), including providers of hosting and infrastructure, communications and collaboration tools, applicant-tracking/assessment platforms, identity and right-to-work verification, customer/support and case-management systems, analytics/consent-management, and related IT support. Our processors may engage approved sub-processors subject to equivalent safeguards.
Referral and verification/background-screening services (where relevant and lawful), as well as professional advisers (e.g., legal, compliance, audit, insurance) and financial or corporate advisers supporting our business operations.
Public or judicial authorities where required by law or to protect rights, safety, or security.
Other recipients at your direction or with your consent.

We do not sell your personal data, and we do not share it with third parties for their own direct marketing.

5. International Data Transfers

Your personal data may be transferred outside the UK (and, if relevant, outside the EEA). Where we do so, we rely on:

UK adequacy regulations where available (e.g., Japan—partial adequacy; US recipients certified under the UK-US Data Bridge), or
Appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and apply supplementary measures as needed. Details are available on request.

6. Special category data and criminal offence data

We process special category data (e.g., health data for reasonable adjustments) only where strictly necessary and where a relevant Article 9 UK GDPR condition applies—typically Article 9(2)(b) (employment, social security and social protection) and/or 9(2)(h) (occupational health). Where required by the DPA 2018 Schedule 1, we maintain an Appropriate Policy Document (APD) setting out safeguards, retention and access controls. If processing is genuinely optional and no relevant condition applies, we will seek your explicit consent.
For criminal convictions and offences data, we process only where permitted by Article 10 UK GDPR together with a relevant Schedule 1 condition and appropriate safeguards.

7. Automated decision-making

We do not make decisions solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you. If we introduce such processing, we will inform you in advance and implement the Article 22 safeguards (including the right to obtain human review and to contest the decision).

8. Retention of Data

We store the personal data we collect as described in this notice for as long as you engage with the Company, necessary to fulfill the purpose(s) for which it was collected, provide our services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws. The specific retention period is determined based on the purpose of acquisition and processing, the nature of the personal data, and its necessity for legal or business grounds.

9. Your Rights (subject to applicable law)

You may exercise the following rights by contacting us or a representative or data protection officer. If you request to exercise the following rights, please contact us as set out in the Contact section below.
Right of access: You have the right to obtain confirmation as to whether we process personal data about you and, where that is the case, access to such personal data and certain information about our processing.

Right to rectification: You have the right to have inaccurate personal data corrected without undue delay and to have incomplete data completed.
Right to erasure: You may obtain the erasure of your personal data, subject to certain exceptions under the GDPR, where: (i) such personal data is no longer necessary in relation to the purposes for which we collected and processed it; (ii) you withdraw your consent to our processing solely based upon your consent; (iii) you object to our processing and there are no overriding legitimate grounds for such processing; (iv) our processing is unlawful; (v) your personal data has to be erased in compliance with a legal obligation.
Right to restriction of processing: You may obtain restriction of processing of your personal data, subject to certain exceptions under the GDPR, where: (i) you contest the accuracy of your personal data: (ii) our processing is unlawful and you select to restrict our processing instead of requesting erasure of your personal data: (iii) you request us to establish, exercise or defense legal claims that need your personal data no longer necessary for the purposes of our processing; or (iv) you exercise the right to object to our processing and wait for verification on where we have overriding legitimate grounds.
Right to data portability: Where processing is based on your consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to have that data transmitted to another controller where technically feasible.
Right to object: You may object to the processing of your personal data where our processing is based upon the exercise of our official authority or our legitimate interests, including “profiling” or for direct marketing purposes. You may also object at any time to processing for direct marketing, including related profiling; in that case we will stop processing for such purposes.
Rights related to automated decision-making (including profiling): You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you, and to obtain human intervention, express your point of view, and contest the decision, subject to applicable exceptions.
Right to the withdrawal of your consent: You may withdraw your consent at any time to the processing of your personal data that we have collected about you. The lawfulness of processing based on consent before its withdrawal will not be affected. Withdrawal of consent does not affect processing that is carried out on other lawful grounds, and we will inform you if certain services or recruitment steps can no longer be provided without your consent.
Right to lodge a complaint: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. In the EU, you may complain in the Member State of your habitual residence, place of work, or place of the alleged infringement. In the United Kingdom, you may complain to the Information Commissioner’s Office (ICO). The supervisory authority (or the ICO) will inform you of the progress and outcome of the complaint, including the possibility of a judicial remedy.

10. Requirement to provide data

Provision of certain personal data may be a statutory or contractual requirement, or necessary to enter into or perform a contract, or otherwise necessary for the purposes set out in this notice. Where we indicate that provision of particular data is mandatory, failure to provide it may mean we are unable to proceed or fulfil the relevant request. We will indicate where information is mandatory.

11. Contact

If you have any questions about our privacy practices or this notice, or to exercise your rights as detailed in this notice, please contact us at:
Email: privacy@hypes-bet.com

For EU data subjects, you can contact our EU representative at:
Name: Classmethod (Europe) GmbH
Email: rh@gdpr-contact.email

Data Protection Officer (DPO) Contact
For any data protection inquiries, you may also contact our Data Protection Officer.
Email: dpo@hypes-bet.com

Data Protection Authority
You can also raise a concern or lodge a complaint with the relevant data protection authority or other official with jurisdiction in your country or region of residence.

If you are in the UK, you may lodge a complaint with the Information Commissioner’s Office (ICO).

12. Cookies and Similar Technologies

We do not use cookies or similar storage and access technologies (such as web storage, tracking pixels or device fingerprinting) on our website. As a result, no consent banner is required under PECR. If this changes, we will update this notice and, where required, obtain your consent before setting any non-essential technologies.

13. Changes To This Notice

The Company will strive to make appropriate improvements to this notice. The Company may change this notice without notifying individuals. Unless otherwise specified by the Company, the revised notice will take effect from the time it is posted on this website.

Established: 24th September, 2025