Privacy Notice for Candidates

This Privacy Notice for Candidates ("Notice") governs processing by CPS Solutions OÜ ("Cryptopay", "we", "us", "our") of your personal data during and after the recruitment process.

At Cryptopay we value the privacy of candidates. As a controller, we ensure that all processing activities are conducted transparently and comply with relevant legal requirements to protect your rights.

We recommend that you read this entire Notice to ensure you are fully informed about the manner in which we collect, use, store, disclose, or otherwise process your personal data, as well as your privacy rights. By continuing communications with us regarding opportunities with Cryptopay or its group companies, you confirm that you have read and understood this Notice.

This Notice contains the following sections:

• What Is Personal Data
• Personal Data We Collect
• Legal Basis for Processing
• Data Sharing
• Data Security
• Data Retention
• Your Rights
• Contact Information
• Notice Amendments

1. What Is Personal Data

This Notice applies to your "personal data", being any information relating to you as an identified or identifiable person.

2. Personal Data We Collect

2.1. Information we receive from you. We may collect personal data from you through various channels, such as filling out online forms, communicating with us via phone, email, or in-person at interviews, or by engaging with a recruitment agency or another third party acting on our behalf. We may collect the following types of information from candidates:

• Personal details. Name, contact details (email address, phone number, address), date of birth, gender, country of residence, citizenship, the eligibility to work in the country you are applying to, and other relevant identification details.
• Education information. Educational background, qualifications, certifications, training courses, and transcript information.
• Professional information. Resume/CV, cover letter, personal statement, employment history, performance information, skills, publications; whether you have any government experience and if you signed any or accepted any agreement or are otherwise subject to any restriction with your current or former employers.
• Application information. References, assessments you complete during the application and/or work sample (if applicable to the role), links to social media accounts, video interview recordings (subject to your consent), information you provide to us during an interview.
• Additional information. Other information you voluntarily provide in connection with your application during the recruitment process.

2.2. Personal data we may receive from third parties. While the majority of the personal data described above is collected directly from you, it is important to note that we may also obtain personal data about you from third parties, which can include:

• Cryptopay's personnel who recommend or nominate you for positions with Cryptopay;
• your named referees, whom you have authorized to provide us with references;
• background check providers, credit reference agencies, fraud prevention agencies, sanction screening agencies, and criminal convictions screening agencies, to the extent permitted by law;
• governmental authorities;
• other relevant publicly available sources where permitted by applicable laws and regulations, including professionally-oriented social media networking sites like LinkedIn. We may also process data from other social media networks if specifically referenced by you or for specific roles (e.g. community managers).

2.3. You confirm that the information you provided to us is accurate and complete. You should promptly update any details if there are any changes.

3. Legal Basis for Processing

We use the collected personal data for the following purposes and on the following grounds:

Please be aware that the processing activities listed in this section are not exhaustive but rather serve as examples of the types of processing we may engage in. The information we will process about you may vary depending on a specific role and personal circumstances.

If you have any questions regarding whether we process your personal data for a particular purpose not mentioned in this section, please reach out at privacy@cryptopay.me.

4. Data Sharing

4.1. Share of Personal Data. Subject to applicable law (including consent, if required), we may share your personal data with the following parties:

• Cryptopay's authorized personnel who are involved in the processes of recruitment and hiring;
• other group companies for purposes of recruitment and HR administration;
• professional advisors, such as lawyers, accountants, and auditors, when necessary to ensure compliance with our legal and regulatory obligations;
• service providers who assist us in the recruitment process, such as recruitment agencies, background check providers (e.g. LexisNexis), and applicant tracking system providers (e.g. recruitment platforms and dashboards such as Indeed or LinkedIn);
• IT service providers, including those providing infrastructure services (e.g. cloud hosting such as AWS);
• regulatory or legal authorities, when required by law or in response to a valid legal request.

Where applicable, such data sharing will be accompanied by data processing agreement with the particular Cryptopay's counterparty. Whenever we share your personal data with third parties, we ensure they are obliged to follow strict rules to protect it.

We do not sell your personal data or allow our third-party service providers to use it for advertising.

4.2. International Transfers. When necessary your personal data may be transferred or viewable to recipients outside EU/EEA, Switzerland and/or UK (e.g. if our service provider is located in the third country). In such an event, the international transfer of your personal data will be based on an adequacy decision or governed by EU's Commissions latest Standard Contractual Clauses. We implement appropriate safeguards to ensure that your data is treated securely, and any such transfer complies with EU data protection laws, including the General Data Protection Regulation (GDPR), and other applicable laws, particularly those governing data transfers to third countries as may be applicable to Cryptopay.

5. Data Security

5.1. We implement appropriate technical, organizational and legal measures to protect your personal data from unauthorized access, use, disclosure, alteration, or destruction. We restrict access to your information to authorized personnel only and ensure they are subject to a duty of confidentiality.

5.2. We also maintain procedures to address any suspected data security breach. In the event of a suspected breach, we notify you and any relevant authorities, where legally required.

5.3. To protect your and others' personal data, please do not send us excessive or unnecessary data, including other person's personal data (e.g. health and other special (sensitive) kinds of data).

6. Data Retention

6.1. We store your personal data for as long as necessary to fulfill the purposes outlined in this Notice. The retention periods may vary depending on several factors, including our legal obligations, the duration of the application and candidate selection processes, and considerations relating to any potential litigation or regulatory investigations.

6.2. Once the processes mentioned above are complete and where permitted by law and this Notice, we will erase or anonymise your data, ensuring it no longer personally identifies you. Such anonymized data may be used for the purpose of improving our application and recruitment practices.

6.3. If you are given and accept an offer by Cryptopay, your personal data may become part of your personnel file and in such an event will be stored in accordance with our internal policies.

6.4. If you are not selected for a position, we will retain your personal data for the duration of the application process, plus an additional period to document the reasons for our decision.

6.5. With your consent, we may also keep your information for a reasonable time to consider you for future job opportunities. If you would like to opt-out, please email privacy@cryptopay.me.

7. Your Rights

7.1. As a candidate, you have the following rights regarding your personal data:

• Access. Request access to the personal data we hold about you.
• Correction. Request correction of any inaccurate or incomplete information.
• Erasure. Request the deletion of your personal data, subject to legal obligations.
• Restriction. Request the restriction of processing of your personal data in certain cases.
• Objection. Object to the processing of your personal data for legitimate reasons.
• Portability. Request the transfer of your personal data to another organization or receive a copy in a structured, commonly used, machine-readable format. This applies only to the information you have provided to us when we process it based on your consent or a contract, and the processing is carried out through automated means.
• Withdraw of consent. Withdraw your consent where you have previously given us this. This will not affect the lawfulness of processing prior to the withdrawal of your consent.

To exercise your rights as outlined in this section and in accordance with data protection laws, you can contact us at privacy@cryptopay.me. We may ask for additional information to confirm your identity.

7.2. We will make every effort to respond to your request within the time frame required by applicable law. In the EEA, this means we aim to respond within one month. However, please note that this time frame may be extended by an additional two months taking into account the complexity and number of the requests.

7.3. Please be aware that while you have certain rights, they may not be absolute, and there may be situations where we are not obligated to fulfill your request due to exemptions under applicable data protection laws.

7.4. Automated decision-making: We do not rely on decisions based solely on automated processing of your personal data, including profiling. While certain aspects of suitable candidates' search may involve automated tools, all decisions regarding progression through interview stages and final hiring are made by our personnel.

8. Contact Information

8.1. Your data is processed by CPS Solutions OÜ, with the registered address at Harju maakond, Tallinn, Haabersti linnaosa, Meistri tn 16, 13517.

8.2. If you have any questions about this Notice or wish to exercise any of your rights regarding your personal data, please reach out to us at privacy@cryptopay.me.

8.3. If you are not satisfied with our processing of your data, you have the right to lodge a complaint to a relevant data protection authority. For more information, please contact your local data protection authority.

However, we advise you to contact us first so we can discuss and seek resolution of your concerns.

9. Notice Amendments

9.1. We may update this Notice from time to time to reflect changes in legal, regulatory, technical or business developments.

9.2. The updated version of this Notice will be available on this page, and the effective date will be reflected accordingly. When required under applicable law, we will take appropriate measures to notify you of any changes to this Notice.

We encourage you to review this Notice regularly to stay informed about how we protect your information and any updates to our practices.