GLOBAL CANDIDATE PRIVACY NOTICE
Last updated: May 2026
For Exadel, Inc. and its related subsidiaries and affiliates (collectively “Exadel Group”) applicants, prospective candidates, and recruitment contacts.
1. General Information
This Privacy Notice is provided to you in accordance with the Applicable Data ProtectionLaws that apply to Exadel’s Group’s recruitment and candidate-selection activities in thejurisdictions where we operate or where candidates are located.1It applies to individualswho apply for roles with the Exadel Group, are considered for roles through sourcing orreferral activities, participate in Exadel Group recruitment or selection process, or provideinformation in connection with references or recruitment administration.. It describes thePersonal Data we collect about you, how we use that Personal Data, and your rights andthe choices you have relating to your Personal Data.
The recruitment process consists of three main stages:
- Application stage: collecting applications and supporting documents from and about candidates or prospects and conducting preliminary selection;
- Evaluation stage: reviewing applications and supporting documents, conducting interviews, tests, and assessments, and gathering feedback for final selection, and;
- Job offer and pre-onboarding stage: conducting background screening where permitted and applicable, preparing letters, employment agreements, or contractor documentation, arranging onboarding, verifying identity and work authorization, delivering work-related equipment (e.g. laptops) where applicable, and obtaining documents confirming that the selected candidate is authorized to work in the relevant country.
This Privacy Notice does not apply to the privacy practices of third parties that independently collect, use, or determine how to process your Personal Data, such as job boards, social media platforms, recruitment agencies acting as independent controllers, background screening providers acting independently, or clients that independently participate in the evaluation stage of the recruitment process. Such third parties areresponsible for providing their own privacy notices where required by applicable law.
“Personal Data” or “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual, including any information treated aspersonal data, personal information, personally identifiable information, sensitive personal information, or similar terms under applicable Data Protection Laws. For ease of reference, this Privacy Notice uses the term “Personal Data” to refer to all such information.
2. Data Controller / Responsible Exadel Entity
The Exadel Group entity responsible for the role for which you apply or are considered will generally be responsible for processing your Personal Data in connection with that role. Exadel, Inc. and other Exadel Group entities may also process Personal Data for centralized recruitment, HR administration, IT, information security, compliance, reporting, legal, finance, audit, and group management purposes. Depending on the applicable legal framework, these entities may act as controllers, joint controllers, independent controllers,businesses, responsible parties, operators, processors, or service providers. You will find acomplete list of Exadel Group companies in Appendix 1. For any inquiries regarding your Personal Data, you can contact us at privacy@exadel.com.
2. What data we collect about you
The data controller responsible for your Personal Data is the Exadel Group company where the position that you are interested in is open. Your Personal Data may be shared within other Exadel Group companies that may act as joint controllers, but your main data controller will remain the company where the role is open. You will find a complete list of Exadel Group companies in EU/EEA in Appendix 1. For any inquiries regarding your Personal Data, you can contact us at privacy@exadel.com.
3. What data we collect about you
We collect, use, store and transfer different kinds of Personal Data about you, depending on the role, recruitment stage, location, applicable legal requirements, and the information you choose to provide. We have grouped together the following categories of Personal Data to explain how this type of information is used by us. These terms are used throughout this Privacy Notice:
- Identity data: first name, middle name, surname, title, preferred name, username or candidate ID, and where relevant and permitted by applicable law, date of birth, passport number, PESEL, social security number, etc.;
- Professional experience: includes prior employers, roles, work period, responsibilities and achievements;
- Education data: educational institutions, learning period, acquired education, qualifications, certificates, attended conferences and trainings;
- Skills: knowledge of programming languages, technologies, tools, platforms, professional certifications, industry knowledge, language skills, driving skills where relevant to the role, and other competencies, including information provided by you in your CV, cover letter, portfolio, profile, or other application documents;
- Contact data: email address, telephone number, mailing address, country, region, city, general location, and, where needed for later-stage recruitment or onboarding, residential address or address of place of residence;
- Assessment information: interview notes,recruiter and hiring-manager feedback, technical assessment results, test scores, coding exercises, case studies, work samples,evaluation forms, role-fit assessments, and related observations or recommendationsgenerated during the recruitment process;
- Other voluntary information: information you choose to provide in your application form, CV, cover letter, portfolio, correspondence, interview responses, or other recruitment materials, including information that may not be requested by Exadel Group. We ask that you do not provide sensitive or unnecessary personal information unless we specifically request it or it is relevant to the recruitment process.
- Government identification and work authorization data: passport number, national identification number, Social Security number or equivalent tax or government identifier, PESEL, visa, work permit, immigration status, right-to-work documentation, and other documents or information needed to verify identity, work authorization, background screening, tax, payroll, or onboarding requirements, in each case only where permitted orrequired by applicable law and generally at the offer, pre-onboarding, or onboarding stage;
- Aggregated data: include statistical or demographic data. Aggregated data may be derived from your Personal Data but is not considered Personal Data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. You can read more about what data we collect with Cookies and Similar Technologies on our website: https://exadel.com/privacy-policy/;
- Sensitive Personal Data: information that may be considered sensitive under applicable law, such as health, disability, accommodation, biometric, government identifier, racial orethnic origin, diversity, equal employment opportunity, criminal history, background check, immigration, or other legally protected information. This Personal Data will only becollected and processed where permitted or required by applicable law, relevant to the roleor recruitment process, and subject to any required notice, consent, authorization, or procedural safeguards. Sensitive Personal Data is generally collected only at later stages of recruitment, during background checks, for accommodations, for voluntary diversity/equal opportunity reporting, or during onboarding;
- Professional social media profiles (e.g. LinkedIn): including professional experience,education data, skills and any other information you make publicly available or makeavailable to us on your professional social media profilewhere relevant to recruitment andpermitted by applicable law and platform terms;
- References, employers’ feedback: the name, title, organization, contact details,and feedback provided by a reference, prior employer representative, client representative,colleague, or other person who provides information about your qualifications, experience,performance, or suitability for a role, where permitted by applicable law and subject torequired notice or authorization;
4. How your Personal Data is collected
We use different methods to collect Personal Data from and about you, including through the channels set out below.
Direct interactions with you
You give us your Personal Data in your direct interactions with us: (i) byfilling in forms onour website, careers page, job boards, or professional platforms such as LinkedIn; (ii)through our electronic portals and platforms; (iii) by corresponding with us by email,messaging tools, or posts; (iv) by speaking to us in person, over the telephone, or overonline communication tools (e.g. Teams, Zoom, Slack, etc.); and (v) while visiting ourfacilities.
Third-party sources
We obtain Personal Data:
- From recruitment agencies, staffing providers, searchfirms, and other recruitmentpartners who carry out the initial selection, sourcing, or candidate-support activities;
- From social media, professional networks, job boards, portfolio sites, and publiclyavailable professional sources (e.g., LinkedIn), when verifying your information orwhen searching for new candidates, where permitted by applicable law;
- Fromyourprioremployer,client,reference,colleague,educationalinstitution,certification provider, or other individual whose contact details you have provided tous to verify information that you have provided;
- From Exadel Group staff or other individuals who referred you for the role for whichyou are considered under the Exadel Group referral program;
- From background screening, identify verification, work authorization, assessment,or testing providers, where permitted by applicable law;
- From Exadel clients or prospective clients, where they participate in interviews,technical assessments, project staffing, or role evaluation; and
- Automatically from recruitment platforms, websites, devices, cookies, logs, orsimilar technologies, where applicable and disclosed through our website or cookienotices.
To evaluate your suitability
for positions you are
applying for or are being
considered for at Exadel
Group companies.
Identity data, contact data,
professional experience,
education data, skills,
assessment information,
professional pro file data, and other voluntary application materials.
The processing is necessary to take steps prior to entering into a contract, to administer
recruitment and selection
activities, to comply with
applicable employment and
labor laws, and to pursue
Exadel’s legitimate interest
in evaluating candidates
and filling open roles, where
such legal bases are recognized by applicable law.
To reach out to potential candidates whom Exadel Group staff or other individuals havere commended through the Exadel Group referral program.
Identity data, contact data,
professional social media
profiles, referral information, and professional experience.
Our legitimate interest to
search for and recruit
suitable candidates, and
consent or authorization
where required by
applicable law.
To reach out to potential
candidates whom Exadel
Group recruiters have found
via recruitment pages, job
boards, social media,
professional networks (e.g.
LinkedIn), recruitment
agencies, referrals, or other
professional sources.
Identity data, contact data,
professional social media
profiles, professional experience, education data,
certifications, portfolio
information, and skills.
Our legitimate interest to
search for and recruit
suitable candidates, and
consent or authorization
where required by
applicable law.
Evaluation stage
To manage your selection
procedure, e.g. scheduling interviews, preparing
assessments, reporting on
progress, gathering
feedback, communicating
with you, and coordinating
with interviewers, recruiters,
hiring teams, and clients
where relevant.
Identity data, contact data,
assessment information, skills, professional experience, education data, professional profile data, and other voluntary information you provide.
Our legitimate interest in
operating and administering
an efficient recruitment
system and carry out
recruitment activities, to
take steps prior to entering
into a contract, and consent
or authorization where
required by applicable law.
To evaluate your suitability
for other open positions
within the Exadel Group.
Identity data, contact data,
professional experience,
education data, skills,
professional profile data, and assessment information.
Consent where required byapplicable law, or Exadel’s legitimate interest inconsidering candidates forsuitable open roles where permitted by applicable law.
To assess your suitability
for future recruitment and
future roles that may
become available after your
initial application, rejection,
withdrawal, or completion
of a recruitment process,
where permitted by
applicable law or where you
have agreed to remain in
our candidate database.
Identity data, contact data,
professional experience,
education data, skills,
professional profile data,
and assessment information.
Consent where required by
applicable law, or Exadel’s
legitimate interest in
maintaining a candidate
database and considering
candidates for suitable
future opportunities where
permitted by applicable law.
Job offer stage
To verify that the candidate
is eligible to work for the
Exadel Group company
where the role is open or
where services will be
performed, e.g. work permit,
visa, right-to-work
documentation,
immigration status, or other
authorization, and to verify
candidate identity.
Identity data, contact data,
government identification
and work authorization data.
Legal obligation that Exadel
Group companies are
subject to, taking steps
prior to entering into a
contract, compliance with
employment, immigration,
tax, and labor laws, and
legitimate interest in
verifying identity and work
authorization where
permitted by applicable law.
To verify information
provided by the candidate
during the course of
application, including
employment history, study
diplomas, certifications, qualifications, references,
and other role-related
information.
References, prior employer
feedback, educational data,
professional experience,
certifications, identity data,
and contact data.
Our legitimate interest to
check compliance with
employment and role
requirements, taking steps
prior to entering into a
contract, and consent or
authorization where
required by applicable law.
To prepare and administer
offers of employment,
administer agreement
drafts, and manage
pre-onboarding and
onboarding activities,
including delivery of work
equipment.
Identity data, contact data,
governmental identification
and work authorization
data, compensation
information, tax
information, bank or
payment information where
needed, emergency or
administrative contact
information where required,
financial data, and other
data required under
applicable employment,
labor, tax, immigration, and
onboarding requirements.
The processing is
necessary to take steps
prior to entering into a
contract, to perform
obligations under an
employment, contractor, or
services-related agreement,
and to comply with
applicable employment,
labor, tax, immigration,
payroll, and onboarding
laws.
To conduct background
checks, criminal history
checks, sanctions
screening, security checks,
or other legally permitted
screening for suitable
candidates where relevant
to the role and permitted or
required by applicable law,
client, regulatory, security,
or contractual
requirements.
Sensitive personal data,
including criminal offence,
criminal history, background
screening, sanctions,
identify verification, or
related screening data.
Legal obligation to which
Exadel Group companies
are subject under applicable
law, consent or
authorization where
required, and Exadel’s
legitimate interest in
meeting client, regulatory,
security, and contractual
requirements where
permitted by applicable law.
To assess your ability to
perform the essential
requirements of a role,
provide reasonable accommodations or
workplace adjustments,
comply with occupational
health, safety, disability, and
employment obligations,
and manage medical or
health-related information
where permitted or required
by applicable law
Sensitive personal data,
including health-related
information where
permitted or required by
applicable law.
Processing is necessary to
comply with legal
obligations, take steps prior
to entering into or
performing an employment
or contractor relationship,
protect health and safety,
provide accommodations,
and satisfy client,
regulatory, or contractual
requirements where
permitted by applicable law.
Exadel will process such
information only where
permitted or required by
applicable law and subject
to required safeguards.
General
To protect Exadel Group’s
legal rights, comply with
legal, regulatory, audit, and
compliance obligations,
maintain information
security, prevent fraud or
misuse of systems,
investigate concerns,
respond to legal requests,
and establish, exercise, or
defend legal claims.
Identity data, contact data,
professional experience,
assessment information,
system and security data,
correspondence,
application records,
background check
information where relevant,
and other Personal Data
necessary for the relevant
purpose.
Legal obligation, legitimate
interest in protecting
Exadel’s rights, systems,
personnel, clients, and
business, and consent or
authorization where
required by applicable law.
To support equal
employment opportunity,
diversity and inclusion,
workforce analytics,
reporting, and compliance
with applicable employment
laws.
Voluntary demographic,
diversity, disability, veteran
status, race, ethnicity,
gender, or other legally
protected or sensitive
information, where
collected.
Consent where required,
legal obligation where
applicable, and Exadel’s
legitimate interest in
monitoring and improving
equal opportunity and
inclusive recruitment
practices where permitted
by applicable law. Providing
this information is voluntary
unless otherwise required
by law.
We only require the Personal Data that is reasonably necessary to process your application, evaluate your suitability, comply with legal obligations, and administer the recruitment process. Please do not provide any other information, especially Sensitive Personal Data, unless expressly requested by us or relevant to your application. If you include information in your application or accompanying documents that is not necessary for us to process for the purposes described above, we may process it to the extent relevant to recruitment, compliance, security, or legal purposes, or we may delete, disregard, or restrict use of such information where appropriate and permitted by applicable law.
6. Who do we disclose your Personal Data to
Personal Data may be disclosed for the purposes set forth in this Privacy Notice, where
necessary for recruitment or related business purposes, or in accordance with applicable
laws.
Your Personal Data may be shared with the following recipients:
Within Exadel group:
- Exadel recruiters, talent acquisition, HR, people operations, legal, compliance, finance, payroll, immigration, security, and IT teams, where relevant;
- Candidate selection and hiring teams, e.g. Project Manager, Line Manager, HR, technical interviewers, delivery leaders, and other personnel involved in evaluating or approving candidates; and
- IT support, information security, systems administrations, and other authorized internal support teams.
Outside Exadel Group:
- Third-party service providers, e.g. recruitment platforms, GreenHouse, Workday, applicant tracking systems, assessment providers, background screening providers, identity verification providers, payroll/onboarding providers, cloud hosting providers, and communication tools;
- Recruitment agencies, staffing firms, search firms;
- Legal, regulatory, tax, audit, immigration, law enforcement, labor, benefits, professional advisers, or governmental authorities as required or permitted by law;
- IT system providers and IT support providers;
- Our clients or prospective clients, where relevant to interviews, role evaluation, project staffing, client-required screening, or contractual requirements, where permitted by applicable law;
- Technical interviewers, assessors, or other individuals involved in evaluating candidates; and
- Successors or counterparties in connection with a merger, acquisition, corporate reorganization, financing, sale of assets, or similar transactions, subject to appropriate confidentiality protections.
7. Data Transfers
Your Personal Data may be transferred to, stored in, or otherwise processed in countries outside your country of residence, including countries outside the EEA, the United Kingdom, Brazil, Canada, Mexico, Colombia, Chile, or other jurisdictions where you may be located, where this is necessary for the purposes described in this Privacy Notice. In particular, your Personal Data may be shared with Exadel Group entities, including Exadel Group headquarters located in the United States. Your Personal Data may be hosted in a third party recruitment tool or other HR, recruiting, cloud, communication, or business systems, including systems hosted in the United States or other countries.
Where your Personal Data is transferred to countries that do not provide a level of data protection considered equivalent to that applicable in your jurisdiction, Exadel will take steps designed to ensure that appropriate safeguards are implemented in accordance with applicable Data Protection Laws, including the GDPR, the UK GDPR, the Brazilian LGPD, and other applicable transfer, notice, consent, authorization, and contractual safeguard requirements.
For transfers subject to the GDPR or the UK GDPR, such safeguards may include, where applicable, standard contractual clauses adopted or approved by the European Commission or the UK Information Commissioner’s Office, as well as supplementary measures where required.
For transfers subject to the Brazil LGPD, international transfers of Personal Data will take place only in accordance with the legal mechanisms provided for under Article 33 of the LGPD, including, where applicable, standard contractual clauses, specific contractual clauses, global corporate rules, or other lawful transfer mechanisms recognized by the Brazilian National Data Protection Authority (ANPD).
For transfers subject to other Data Protection Laws, including those of Canada, Mexico, Colombia, Chile, or other applicable jurisdictions, Exadel will rely on appropriate safeguards or lawful transfer mechanisms where required, which may include notice, consent or authorization, intra-group agreements, data processing agreements, standard or model contractual clauses, contractual safeguards, adequacy decisions, or other mechanisms recognized by applicable law.
Exadel ensures that appropriate contractual, technical, and organizational safeguards are in place to maintain an adequate level of data protection consistent with the applicable standards.
You may request further information about international data transfers and the safeguards applied by contacting us at privacy@exadel.com.
8. Data Retention
We will retain your Personal Data only for as long as necessary to fulfil the purposes outlined in this Privacy Notice, or as required or permitted by law. Retention periods may vary depending on the jurisdiction, role, recruitment stage, system, legal requirements, and whether you are hired. We may retain candidate Personal Data for the duration of the recruitment process and thereafter as necessary to comply with applicable employment, labor, immigration, tax, audit, recordkeeping, and other legal obligations, to ensure information security, resolve disputes, and establish, exercise, or defend legal claims.
Where we rely on your consent to retain your Personal Data for future recruitment opportunities, we will retain it for up to one (1) year from the end of the relevant recruitment process (or from the date consent is given, where applicable), unless you withdraw your consent earlier or a longer retention period is required or permitted by applicable law. Before the expiry of this period, where permitted by applicable law, we may ask you to renew your consent if you wish to remain in our talent pool.
When Personal Data is no longer needed, Exadel will delete, anonymize, or otherwise handle it in accordance with applicable law and internal retention procedures.
9. Your Rights
Depending on your location and applicable law, you may have the following rights regarding your Personal Data:
- ●Right to be informed: You have the right to be informed about processing of your Personal Data;
- ●Right to access: You have the right to request access to your Personal Data;
- ●Right to rectification or correction: You can request the correction of inaccurate or incomplete Personal Data;
- ●Right to erasure or deletion: You have the right to request the deletion of your Personal Data under certain circumstances;
- ●Right to restriction or blocking of processing: You can request the restriction/blocking of processing of your Personal Data in certain situations;
- ●Right to data portability: You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, where this right applies;
- ●Right to object: You can object to the processing of your Personal Data in certain situations, such as direct marketing or processing based on legitimate interests, where applicable;
- ●Right to withdraw consent or authorization: Where we rely on consent or authorization to process your Personal Data, you may withdraw it at any time, subject to applicable legal limitations;
- ●Right to limit certain uses: You have the right to limit certain uses of Sensitive Personal Data, opt out of certain sales, sharing, targeted advertising, or profiling, or appeal a decision, where these rights apply under applicable law; and
- ●Right to lodge a complaint: If you believe that we have not complied with applicable Data Protection Laws, you have the right to lodge a complaint with a competent data protection authority, regulator, or other applicable supervisory authority in your country or jurisdiction.
In the European Economic Area (EEA)
You can find a list of all EU DPAs on the European Data Protection Board website.
In the United Kingdom
The competent authority is the Information Commissioner’s Office (ICO). You can contact them through the ICO website at www.ico.org.uk.
In Brazil
You may contact the Autoridade Nacional de Proteção de Dados (ANPD) through their official website at www.gov.br/anpd.
In Canada
You may contact the Office of the Privacy Commissioner of Canada (OPC) or an applicable provincial privacy regulator, depending on your location and the nature of the processing.
In Mexico, Colombia, Chile, and other jurisdictions
You may have the right to contact the applicable data protection, consumer protection, labor, or other competent authority, depending on your location and applicable law.
If you wish to exercise your rights, please use the contact form available on our website: https://exadel.com/privacy-policy/
10. Obligation to Provide Personal Data
Providing certain Personal Data is necessary to process your application, evaluate your suitability for a role, communicate with you, verify information, comply with legal obligations, and administer recruitment or onboarding activities. Failure to provide such data may affect your recruitment process and we may not be able to proceed. Providing Personal Data based on consent or authorization, including information for future recruitment or voluntary demographic information, is voluntary, unless otherwise required by applicable law.
11. Automated decision-making and AI-Assisted Recruitment Tools
We do not make decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless permitted by applicable law and subject to required safeguards.
We may use AI-assisted tools and other recruitment technologies to help organize and match candidate profiles based on skills, experience, and role alignment. These tools support our recruiters and hiring teams by helping to organize applications, extract and standardize information from CVs or profiles, identify potentially relevant skills and experience, match candidates to role criteria, and support recruiter review. These tools are used to assist, not replace, human review. Hiring decisions are made with human involvement.
Where required by applicable law, you may have the right to request additional information about automated processing, request human review, object to certain profiling, or exercise other rights described in this Privacy Notice.
12. How we use Personal Data relating to other individuals collected from you
On certain occasions, you may provide us with Personal Data of individuals who are not
aware of our involvement or of our processing of their Personal Data, for instance,
Personal Data of your prior employers’ representatives, references, referral contacts,
emergency contacts, or other individuals who we may contact to verify your references or
administer the recruitment process. Before you pass any such Personal Data to us, you
must take reasonable steps to ensure that the relevant individuals have received any
requisite privacy notices and that you are permitted to provide their information to us or
that there is an applicable legal basis, consent, or authorization, where required, to pass us
such Personal Data in connection with the recruitment process.
13. Updates to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our data processing practices, recruitment technologies, organizational structure, service providers, or legal requirements. We will notify you of any significant changes where required by applicable law or where the changes materially affect how we process your Personal Data.
This version of the Privacy Notice was approved by Exadel and issued in May 2026.
13. Jurisdiction-Specific Schedules
This Privacy Notice includes jurisdiction-specific schedules that provide additional information for individuals located in, or otherwise subject to the privacy laws of, certain jurisdictions. These Schedules supplement the main body of this Privacy Notice and should be read together with it as applicable. If there is a conflict between the main body of this Privacy Notice and an applicable Schedule, the applicable Schedule will control only for individuals covered by that Schedule and only to the extent necessary to resolve the conflict or comply with applicable law. All other provisions of this Privacy Notice will continue to apply.
APPENDIX 1 - List of Exadel Group Companies
Exadel Poland sp. z o.o.
Emilii Plater 28, 00-688 Warsaw, Poland
Exadel Georgia LLC
Ilo Mosashvili st., 24 Tbilisi 0162, Georgia
Exadel Ukraine LLC
Ukraine, 21001, Vinnytsia region, Vinnytsia city,
103 Bratslavska street
Solarix Consulting LTD (Ukraine)
61129, m. Kharkiv, prosp. Traktorobudivnykiv,
158, k. 43
Exadel LT, UAB (Lithuania)
Žalgirio g. 90-100, korpus D, LT-09303 Vilnius,
Lithuania
Exadel FLLC (Belarus)
Minsk, Kuprevicha str.1/5-320, 220141, Belarus
Exadel Romania (Romania)
Calea Moșilor, no. 88, Staircase F, apartment F1,
Sector 3, Bucharest 30152, Romania
Exadel Bulgaria EAD
1202 Sofia Center, Knyagina Maria Luisa Blvd
53
Exadel Hungary Kft. (in
liquidation)
Roosevelt building, Széchenyi István tér 7-8,
Budapest 1051. Hungary
Exadel GmbH (Germany)
Krausenstr. 9-10 (Mindspace), office 415, 10117
Berlin, register number HRB 265191 Amtsgericht Berlin (Charlottenburg)
Exadel Spain S.L.
Avenida de la Aurora, 69, 5th floor, Module 1,
Malaga, Spain
Exadel UK Ltd.
Regent's Court Princess Street, Hull, East
Yorkshire, England HU2 8BA
Americas
Exadel, Inc. (USA)
Domicile (Registered Agent) address: 1209
Orange Street, Wilmington, DE 19801
Business Address: 101 E Kennedy Blvd, Suite
2320, Tampa, FL 33602
CPQI ULC (Canada)
CPQI INC. (USA)
1255 Treat Blvd. Suite 300 Suiter 336 Walnut
Creek, CA 94597
Exadel Financial Services
Brasil Ltda
Avenida Litorânea, S/N, Shopping Ville, Loja 17,
Porto das Dunas, Aquiraz, Ceará, CEP
61.700-000, Brazil
CPQi Servicios Y
Tecnologia Chile Ltda
Callao 2970, oficina 207, Las Condes, Santiago,
Chile
CPQI CANADA LIMITED
172 Wentworth Drive, Unit B Halifax, NS B3M
0P4
Exadel Colombia S.A.S.
Cra 42 # 3 Sur - 81 Edificio Milla de Oro, Torre 1
Piso 15
Coppei, LLC
7853 Se 27th St Ste 283
Mercer Island
WA 98040-2897
Centre de Programacion
Calidade Implementacion
S.A. (Mexico)
AMADO NERVO 785 B LADRON DE GUEVARA
GUADALAJARA JALISCO
Asia
Exadel LLC (Uzbekistan)
Mirzo Ulugbek district, 73 Mirzo-Ulugbek str.,
Tashkent, 100170, Uzbekistan
Schedule 1: Supplemental Terms for U.S. Candidates
This Schedule 1 applies to individuals located in the United States whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
1. General U.S. Candidate Privacy Terms
Exadel may collect, use, disclose, retain, and otherwise process candidate Personal Data for the purposes described in the Global Candidate Privacy Notice, including to:
- receive, review, and evaluate applications;
- identify and contact potential candidates;
- communicate with candidates regarding roles and recruitment activities;
- conduct interviews, assessments, technical evaluations, and reference checks;
- verify identity, qualifications, experience, education, certifications, and work authorization;
- conduct background checks, criminal history checks, sanctions screening, or other legally permitted screening where relevant to the role and subject to applicable notice and authorization requirements;
- prepare and administer offers, agreements, onboarding, and work equipment delivery;
- comply with employment, labor, tax, immigration, equal employment opportunity, audit, recordkeeping, and other legal obligations;
- protect Exadel’s rights, systems, personnel, clients, and business operations;
- establish, exercise, or defend legal claims; and
- consider candidates for future roles where permitted by law or where the candidate has agreed to remain in Exadel’s candidate database.
Certain U.S. laws may require Exadel to provide additional notices, obtain specific consents or authorizations, or follow specific procedures before collecting or using certain categories of information, including background check information, credit history, criminal history, drug testing information, biometric information, medical or disability-related information, equal employment opportunity information, work authorization documentation, or other legally protected information. Where applicable, Exadel will provide those notices or obtain those authorizations separately.
Exadel does not intend to collect Sensitive Personal Data from U.S. candidates unless it is necessary for a lawful recruitment, employment, compliance, accommodation, screening, or onboarding purpose and permitted by applicable law. Candidates should not provide Sensitive Personal Data unless specifically requested by Exadel, required for the recruitment process, or relevant to an accommodation, work authorization, background screening, or legal compliance purpose.
U.S. candidates may contact Exadel at privacy@exadel.com with questions or requests relating to their Personal Data.
2. California Candidate Privacy Notice at Collection
This California Candidate Privacy Notice applies to California residents whose Personal Information is collected by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
For purposes of this California section, “Personal Information,” “Sensitive Personal Information,” “sell,” “share,” “business purpose,” “commercial purpose,” “service provider,” and “contractor” have the meanings given in the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations, collectively referred to as the “CCPA.”
a) Categories of Personal Information Exadel May Collect
Depending on the role, recruitment stage, location, systems used, and information
provided, Exadel may collect the following categories of Personal Information about
California candidates:
Identifiers
Name, preferred name, alias, mailing address, email address, telephone number, online identifier, candidate ID, IP address, government identifier, Social Security number, passport number, driver’s license number, or similar identifiers where required or permitted.
Personal information described in Cal. Civ. Code § 1798.80
Contact details, signature, government ID information, financial or bank information where needed for onboarding, employment-related information, and similar information.
Protected classification characteristics
Information such as age, gender, race, ethnicity, disability, veteran status, citizenship, immigration status, or other protected characteristics, where voluntarily provided or collected for equal employment opportunity, accommodation, work authorization, or legal compliance purposes.
Professional or employment-related information
Resume, CV, work history, prior employers, job titles, references, skills, certifications, compensation expectations, interview feedback, assessment results, recruiter notes, and hiring team evaluations.
Education information
Schools attended, degrees, training, certifications, transcripts, academic records, or other educational information you provide or authorize Exadel to verify.
Internet or other electronic network activity information
Information about your use of Exadel’s careers site, application portals, emails, or recruitment systems, including device information, IP address, log data, browser information, cookies, and similar technologies, where collected.
Geolocation information
General location, such as country, state, city, region, or approximate location derived from IP address or application information.
Audio, electronic, visual, or similar information
Video interview information, recorded interviews where applicable, voicemail, meeting recordings, security camera footage at Exadel premises, or other electronic communications.
Sensitive Personal Information
Government identifiers, Social Security number, passport number, driver’s license number, work authorization documents, immigration information, health or disability/accommodation information, criminal history or background check information, and voluntary demographic information, where collected and permitted by law.
Inferences
Candidate profiles, role-fit assessments, skills matching, recruiter observations, hiring team feedback, evaluation notes, and similar information used to assess suitability for roles.
b) Sources of Personal Information
Exadel may collect Personal Information directly from you; from recruiters, referral sources, prior employers, references, educational institutions, certification providers, background screening providers, assessment providers, professional networks, job boards, social media platforms, Exadel clients, service providers, and publicly available sources; and automatically through Exadel’s careers site, application systems, devices, cookies, logs, and similar technologies.
c) Purposes for Collection, Use, and Disclosure
Exadel may collect, use, retain, disclose, or otherwise process California candidate Personal Information for the following purposes:
- evaluating applications and candidate suitability;
- communicating with candidates;
- managing recruitment, interviews, assessments, and selection processes;
- verifying identity, work authorization, qualifications, references, employment history, education, certifications, and other application information;
- conducting background checks, criminal history checks, sanctions screening, or other legally permitted screening where relevant to the role and subject to applicable notice and authorization requirements;
- preparing offers, agreements, pre-onboarding materials, and onboarding activities;
- administering candidate databases and considering candidates for future opportunities where permitted;
- complying with employment, labor, tax, immigration, equal employment opportunity, audit, recordkeeping, and other legal obligations;
- maintaining security, preventing fraud, protecting systems, and investigating misuse or misconduct;
- responding to legal, regulatory, law enforcement, or governmental requests;
- establishing, exercising, or defending legal claims;
- managing Exadel’s business, corporate transactions, audits, compliance programs, and internal administration; and
- any other purpose disclosed at or before the time Personal Information is collected.
d) Disclosure of Personal Information
Exadel may disclose candidate Personal Information to Exadel Group entities, recruiters, HR personnel, hiring teams, technical interviewers, clients or prospective clients where relevant to role evaluation or project staffing, service providers, contractors, background screening providers, assessment providers, identity verification providers, recruitment platforms, IT and cloud providers, professional advisers, legal or regulatory authorities, and other recipients described in the Global Candidate Privacy Notice.
Exadel discloses Personal Information for recruitment, HR, compliance, legal, security, audit, and other business purposes. Exadel does not knowingly permit service providers or contractors to use candidate Personal Information for purposes other than providing services to Exadel or as otherwise permitted by applicable law.
e) Sale, Sharing, and Sensitive Personal Information
Exadel does not sell candidate Personal Information as the term “sell” is defined under the CCPA.
Exadel does not share candidate Personal Information for cross-context behavioral advertising as the term “share” is defined under the CCPA, unless Exadel separately discloses such sharing through an applicable website, cookie, or privacy notice and provides any required opt-out mechanism.
Exadel does not use or disclose candidate Sensitive Personal Information for purposes that require a right to limit under the CCPA, unless otherwise disclosed to you or permitted by applicable law.
f) Retention
Exadel retains California candidate Personal Information for as long as reasonably necessary for the purposes described in this California Candidate Privacy Notice and the Global Candidate Privacy Notice, including recruitment administration, future recruitment where permitted, legal compliance, recordkeeping, audit, security, dispute resolution, and the establishment, exercise, or defense of legal claims.
Retention periods vary based on the category of Personal Information, recruitment stage, role, applicable legal requirements, system, business need, and whether the candidate is hired. When Personal Information is no longer needed, Exadel will delete, anonymize, or otherwise handle it in accordance with applicable law and internal retention procedures.
g) California Privacy Rights
Subject to applicable exceptions, California residents may have the right to:
- know the categories and specific pieces of Personal Information Exadel has collected about them;
- access or receive a copy of their Personal Information;
- request correction of inaccurate Personal Information;
- request deletion of Personal Information;
- opt out of the sale or sharing of Personal Information, if applicable;
- limit the use or disclosure of Sensitive Personal Information, if Exadel uses or discloses Sensitive Personal Information for purposes that trigger this right; and
- not be discriminated or retaliated against for exercising CCPA rights.
To exercise California privacy rights, please use the contact form available on Exadel’s website or contact privacy@exadel.com. Exadel may need to verify your request consistent with applicable law. Authorized agents may submit requests where permitted by the CCPA and subject to verification requirements.
Schedule 2: Supplemental Terms for Canadian Candidates
This Schedule applies to individuals located in Canada whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
Exadel processes Canadian candidate Personal Data in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act and substantially similar provincial privacy laws where applicable.
1. Purposes of Processing
Exadel collects, uses, and discloses Canadian candidate Personal Data only for purposes that a reasonable person would consider appropriate in the circumstances, including to:
- receive, review, and evaluate applications;
- identify and contact potential candidates;
- communicate with candidates regarding roles and recruitment activities;
- conduct interviews, assessments, technical evaluations, and reference checks;
- verify identity, qualifications, experience, education, certifications, and work authorization;
- conduct background checks or other legally permitted screening where relevant to the role and subject to applicable notice and consent requirements;
- prepare and administer offers, agreements, onboarding, and work equipment delivery;
- comply with employment, labor, tax, immigration, audit, recordkeeping, and other legal obligations;
- protect Exadel’s rights, systems, personnel, clients, and business operations;
- establish, exercise, or defend legal claims; and
- consider candidates for future roles where permitted by law or where the candidate has consented to remain in Exadel’s candidate database.
2. Consent
Where required by applicable Canadian privacy laws, Exadel will obtain meaningful consent for the collection, use, or disclosure of Personal Data. Consent may be express or implied depending on the sensitivity of the information, the reasonable expectations of the candidate, and the circumstances of the processing.
Candidates may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect Exadel’s ability to continue considering a candidate for a role, complete screening, administer an offer, or comply with legal obligations.
3. Cross-Border Processing
Canadian candidate Personal Data may be transferred to, stored in, or accessed from countries outside Canada, including the United States and other countries where Exadel Group entities or service providers operate. Personal Data processed outside Canada may be subject to the laws of those jurisdictions.
Exadel uses contractual, technical, and organizational safeguards designed to protect Canadian candidate Personal Data when it is transferred or processed outside Canada.
4. Access, Correction, and Questions
Canadian candidates may request access to or correction of their Personal Data, subject to applicable legal exceptions. Candidates may also contact Exadel with questions or complaints regarding Exadel’s privacy practices.
Requests and questions may be submitted to privacy@exadel.com or through the rights request mechanism described in the Global Candidate Privacy Notice.
Canadian candidates may also contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator, depending on their location and the nature of the processing.
Schedule 3: Supplemental Terms for Brazilian Candidates
This Schedule applies to individuals located in Brazil whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
Exadel processes Brazilian candidate Personal Data in accordance with the Lei Geral de Proteção de Dados, Law No. 13,709/2018, as amended, referred to in this Schedule as the “LGPD.”
1. Legal Bases
Depending on the purpose and context, Exadel may process Brazilian candidate Personal Data based on one or more legal bases under the LGPD, including:
- taking preliminary steps related to a contract or performing a contract;
- compliance with legal or regulatory obligations;
- Exadel’s legitimate interests, where permitted and balanced against the candidate’s rights and freedoms;
- regular exercise of rights in judicial, administrative, or arbitral proceedings;
- protection of life or physical safety;
- health protection, where applicable and permitted;
- consent, where required; and
- other legal bases permitted by the LGPD.
2. Sensitive Personal Data
Exadel will process Sensitive Personal Data of Brazilian candidates only where permitted by the LGPD and applicable law. Sensitive Personal Data may include health or disability/accommodation information, biometric information, racial or ethnic origin, criminal history or background screening information, or other information treated as sensitive under applicable law.
Exadel will collect and process Sensitive Personal Data only where necessary for a lawful recruitment, employment, accommodation, compliance, security, screening, or onboarding purpose and subject to applicable safeguards.
3. International Transfers
Brazilian candidate Personal Data may be transferred to, stored in, or accessed from countries outside Brazil, including the United States and other countries where Exadel Group entities or service providers operate.
Where required, Exadel will conduct international transfers of Brazilian Personal Data in accordance with the LGPD and applicable rules issued by the Autoridade Nacional de Proteção de Dados, including through appropriate contractual safeguards, standard contractual clauses, specific contractual clauses, global corporate rules, adequacy decisions, consent where applicable, or other lawful transfer mechanisms.
4. Brazilian Privacy Rights
Subject to applicable legal requirements and exceptions, Brazilian candidates may have the right to request:
- confirmation of whether Exadel processes their Personal Data;
- access to their Personal Data;
- correction of incomplete, inaccurate, or outdated Personal Data;
- anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed Personal Data;
- portability of Personal Data, where applicable;
- information about public and private entities with which Exadel has shared Personal Data;
- information about the possibility of refusing consent and the consequences of refusal;
- withdrawal of consent, where processing is based on consent;
- review of decisions made solely on automated processing, where applicable; and
- deletion of Personal Data processed based on consent, subject to legal exceptions.
Requests may be submitted to privacy@exadel.com or through the rights request mechanism described in the Global Candidate Privacy Notice.
The DPO in Brazil is Data Guide, represented by Taynara Rodrigues Bernardo, or such other DPO/contact as Exadel may designate from time to time.
Brazilian candidates may also contact the Autoridade Nacional de Proteção de Dados, where applicable.
Schedule 4: Supplemental Terms for Mexican Candidates
This Schedule applies to individuals located in Mexico whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
Exadel processes Mexican candidate Personal Data in accordance with applicable Mexican data protection laws.
1. Primary Purposes
Exadel may process Mexican candidate Personal Data for the following primary purposes:
- receiving, reviewing, and evaluating applications;
- identifying and contacting potential candidates;
- communicating with candidates regarding roles and recruitment activities;
- managing interviews, assessments, technical evaluations, and selection processes;
- verifying identity, qualifications, experience, education, certifications, references, and work authorization;
- conducting background checks, criminal history checks, sanctions screening, or other legally permitted screening where relevant to the role and subject to applicable notice, consent, or authorization requirements;
- preparing and administering offers, agreements, onboarding, and work equipment delivery;
- complying with employment, labor, tax, immigration, audit, recordkeeping, and other legal obligations;
- protecting Exadel’s rights, systems, personnel, clients, and business operations;
- establishing, exercising, or defending legal claims; and
- managing Exadel’s recruitment, HR, compliance, legal, audit, and administrative operations.
2. Secondary Purposes
Exadel may also process Mexican candidate Personal Data for secondary purposes, such as:
- considering candidates for future roles;
- maintaining candidate databases;
- conducting recruitment analytics and workforce planning;
- improving recruitment processes and candidate experience; and
- sending recruitment-related communications about future opportunities.
Where required by applicable law, Exadel will obtain consent for secondary purposes or provide a mechanism to object to processing for such purposes.
3. Sensitive, Financial, and Government Identification Information
Exadel will process Sensitive Personal Data, financial information, government identification information, work authorization information, criminal history or background check information, and similar information only where necessary and permitted by applicable law, and subject to any required notice, consent, authorization, or safeguards.
Candidates should not provide Sensitive Personal Data unless Exadel specifically requests it, it is legally required, or it is relevant to an accommodation, work authorization, screening, or recruitment compliance purpose.
4. Transfers
Exadel may transfer Mexican candidate Personal Data to Exadel Group entities, service providers, recruitment platforms, background screening providers, assessment providers, clients or prospective clients where relevant, professional advisers, legal or regulatory authorities, and other recipients described in the Global Candidate Privacy Notice.
Transfers may include transfers to recipients outside Mexico, including the United States and other countries where Exadel Group entities or service providers operate. Where required by applicable law, Exadel will rely on appropriate notice, consent, contractual safeguards, or other lawful transfer mechanisms.
5. Mexican Privacy Rights
Subject to applicable law, Mexican candidates may have the right to access, rectify, cancel, or object to the processing of their Personal Data, and to withdraw consent where applicable.
Requests may be submitted to privacy@exadel.com or through the rights request mechanism described in the Global Candidate Privacy Notice.
Schedule 5: Supplemental Terms for Colombian Candidates
This Schedule applies to individuals located in Colombia whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
Exadel processes Colombian candidate Personal Data in accordance with applicable Colombian data protection laws.
1. Authorization
By submitting information to Exadel, participating in Exadel’s recruitment process, or otherwise providing Personal Data to Exadel, you authorize Exadel to collect, use, store, disclose, transmit, transfer, and otherwise process your Personal Data for the purposes described in the Global Candidate Privacy Notice and this Schedule, subject to applicable law.
Where required by applicable law, Exadel may request separate, prior, express, and informed authorization for specific processing activities, including processing Sensitive Personal Data or conducting background checks.
2. Purposes of Processing
Exadel may process Colombian candidate Personal Data for the following purposes:
- receiving, reviewing, and evaluating applications;
- identifying and contacting potential candidates;
- communicating with candidates regarding roles and recruitment activities;
- managing interviews, assessments, technical evaluations, and selection processes;
- verifying identity, qualifications, experience, education, certifications, references, and work authorization;
- conducting background checks, criminal history checks, sanctions screening, or other legally permitted screening where relevant to the role and subject to applicable authorization and legal requirements;
- preparing and administering offers, agreements, onboarding, and work equipment delivery;
- complying with employment, labor, tax, immigration, audit, recordkeeping, and other legal obligations;
- protecting Exadel’s rights, systems, personnel, clients, and business operations;
- establishing, exercising, or defending legal claims;
- considering candidates for future roles where permitted or authorized; and
- managing Exadel’s recruitment, HR, compliance, legal, audit, and administrative operations.
3. Sensitive Personal Data
Exadel will process Sensitive Personal Data of Colombian candidates only where permitted by applicable law and, where required, with prior, express, and informed authorization.
Candidates are not required to provide Sensitive Personal Data unless such information is necessary for a legally permitted recruitment, accommodation, work authorization, screening, compliance, or onboarding purpose. Exadel will inform candidates where providing Sensitive Personal Data is voluntary or where refusal may affect Exadel’s ability to process an application or complete a legally required step.
4. International Transfers and Transmissions
Colombian candidate Personal Data may be transferred or transmitted to Exadel Group entities, service providers, recruitment platforms, background screening providers, assessment providers, clients or prospective clients where relevant, professional advisers, legal or regulatory authorities, and other recipients described in the Global Candidate Privacy Notice.
Such recipients may be located in Colombia or in other countries, including the United States and other countries where Exadel Group entities or service providers operate. Where required by applicable law, Exadel will rely on appropriate authorization, contractual safeguards, data transfer or transmission agreements, or other lawful mechanisms.
5. Colombian Privacy Rights
Subject to applicable law, Colombian candidates may have the right to:
- know, access, update, and rectify their Personal Data;
- request proof of authorization, where applicable;
- be informed about Exadel’s use of their Personal Data;
- submit complaints regarding alleged violations of applicable law;
- revoke authorization or request deletion of Personal Data, where applicable and subject to legal exceptions; and
- access their Personal Data free of charge in accordance with applicable law.
Requests may be submitted to privacy@exadel.com or through the rights request mechanism described in the Global Candidate Privacy Notice.
Colombian candidates may also have the right to contact the Superintendence of Industry and Commerce or another competent authority, where applicable.
Schedule 6: Supplemental Terms for Chilean Candidates
This Schedule applies to individuals located in Chile whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
Exadel processes Chilean candidate Personal Data in accordance with applicable Chilean data protection laws, including Law No. 19,628 and, when effective, Law No. 21,719.
1. Purposes of Processing
Exadel may process Chilean candidate Personal Data for the following purposes:
- receiving, reviewing, and evaluating applications;
- identifying and contacting potential candidates;
- communicating with candidates regarding roles and recruitment activities;
- managing interviews, assessments, technical evaluations, and selection processes;
- verifying identity, qualifications, experience, education, certifications, references, and work authorization;
- conducting background checks, criminal history checks, sanctions screening, or other legally permitted screening where relevant to the role and subject to applicable notice, consent, or legal requirements;
- preparing and administering offers, agreements, onboarding, and work equipment delivery;
- complying with employment, labor, tax, immigration, audit, recordkeeping, and other legal obligations;
- protecting Exadel’s rights, systems, personnel, clients, and business operations;
- establishing, exercising, or defending legal claims;
- considering candidates for future roles where permitted by law or with consent where required; and
- managing Exadel’s recruitment, HR, compliance, legal, audit, and administrative operations.
2. Legal Bases
Where required by applicable Chilean law, Exadel will rely on an appropriate legal basis for processing Personal Data, which may include consent, contractual necessity, pre-contractual steps, legal obligation, legitimate interest, regular exercise of rights, or another basis permitted by applicable law.
3. Sensitive Personal Data
Exadel will process Sensitive Personal Data of Chilean candidates only where permitted by applicable law and subject to applicable safeguards. Sensitive Personal Data may include health or disability/accommodation information, biometric information, criminal history or background check information, or other information treated as sensitive under applicable law.
Candidates should not provide Sensitive Personal Data unless Exadel specifically requests it, it is legally required, or it is relevant to an accommodation, work authorization, screening, or recruitment compliance purpose.
4. International Transfers
Chilean candidate Personal Data may be transferred to, stored in, or accessed from countries outside Chile, including the United States and other countries where Exadel Group entities or service providers operate.
Where required by applicable law, Exadel will rely on appropriate safeguards or lawful transfer mechanisms, which may include consent, contractual safeguards, intra-group arrangements, adequacy mechanisms, or other mechanisms recognized by applicable law.
6. Chilean Privacy Rights
Subject to applicable law, Chilean candidates may have rights to access, rectify, delete, cancel, block, object to processing, or request portability of their Personal Data, where applicable.
Requests may be submitted to privacy@exadel.com or through the rights request mechanism described in the Global Candidate Privacy Notice.
Chilean candidates may also have the right to contact the competent data protection authority or other applicable authority, where available under applicable law.
Schedule 7: Supplemental Terms for EU/EEA and UK Candidates
This Schedule applies to individuals located in the European Economic Area or the United Kingdom whose Personal Data is processed by Exadel in connection with recruitment, candidate sourcing, job applications, interviews, assessments, background screening, work authorization, offer administration, onboarding, or related pre-employment activities.
For purposes of this Schedule, references to “Data Protection Laws” include the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the UK Data Protection Act 2018, and other applicable European or UK data protection and employment privacy laws.
1. Controller
The Exadel Group entity responsible for the role for which you apply or are considered will generally be the controller of your Personal Data for recruitment purposes. Exadel, Inc. and other Exadel Group entities may also process Personal Data for centralized recruitment, HR administration, IT, information security, compliance, reporting, legal, finance, audit, and group management purposes.
Where required by applicable law, Exadel will make available additional information regarding the relevant controller or controllers involved in processing your Personal Data.
2. Legal Bases for Processing
Exadel processes EU/EEA and UK candidate Personal Data based on one or more of the following legal bases, depending on the purpose and context of processing:
- taking steps prior to entering into an employment, contractor, or other work-related agreement;
- compliance with legal obligations, including employment, labor, tax, immigration, equal opportunity, audit, and recordkeeping obligations;
- Exadel’s legitimate interests, including identifying and evaluating candidates, managing recruitment processes, verifying qualifications, protecting Exadel’s rights and systems, maintaining security, preventing fraud, managing legal claims, and operating Exadel’s global business, provided those interests are not overridden by your rights and freedoms;
- consent, where required by applicable law, including for certain future recruitment, optional candidate database retention, or voluntary information; and
- the establishment, exercise, or defense of legal claims.
Where Exadel relies on legitimate interests, you may request additional information about those interests by contacting privacy@exadel.com.
3. Limits on Data Collection and Minimization
In accordance with the strict statutory requirements of certain EEA jurisdictions (such as Article 22¹ of the Polish Labour Code and Ordinance No. 4 in Bulgaria), Exadel limits the collection of candidate Personal Data during the initial application and evaluation stages.
During the Application and Evaluation Stages: We will only request and process your name, date of birth, contact details provided by you, education, professional qualifications, and employment history.
Unsolicited/Extra Information: You are requested not to provide any national identification numbers (e.g., PESEL, Bulgarian Civil Number/EGN), identity document details, bank account details, or photographs during the initial application. Form fields in our Applicant Tracking Systems (ATS) for these categories are blocked or restricted for EU/EEA and UK candidates at the application stage.
Onboarding Stage: National identification numbers, residential addresses, and documents proving identity and work authorization will only be requested and processed after an official job offer has been made, or as strictly necessary during the immediate pre-onboarding stage.
4. Special Category and Criminal Offense Data
Exadel will process special category Personal Data, criminal offense data, or similar sensitive information only where permitted by applicable law and subject to required safeguards.
This may include processing health, disability, accommodation, diversity, equal opportunity, work authorization, criminal history, or background screening information where necessary for recruitment, legal compliance, accommodations, occupational health and safety, client or regulatory requirements, or the establishment, exercise, or defense of legal claims.
Where required by applicable law, Exadel will obtain explicit consent or rely on another applicable condition for processing such information.
5. Personal Data Collected from Other Sources
In some cases, Exadel may collect candidate Personal Data from sources other than you, including recruitment agencies, referral sources, professional networks, job boards, publicly available professional sources, prior employers, references, educational institutions, certification providers, assessment providers, background screening providers, Exadel clients, or other third parties.
Exadel uses such information for the purposes described in the Global Candidate Privacy Notice, including candidate sourcing, application evaluation, verification, interviews, assessments, screening, offer administration, onboarding, compliance, security, and legal purposes.
6. International Transfers
EU/EEA and UK candidate Personal Data may be transferred to, stored in, or accessed from countries outside the EEA, Switzerland, or the United Kingdom, including the United States and other countries where Exadel Group entities or service providers operate.
Where Personal Data is transferred to a country that has not been recognized as providing an adequate level of protection, Exadel will rely on appropriate safeguards or lawful transfer mechanisms where required, which may include European Commission standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, adequacy decisions, intra-group agreements, supplementary measures, or other mechanisms recognized by applicable law.
You may request additional information about international transfers and applicable safeguards by contacting privacy@exadel.com.
7. EU/EEA and UK Privacy Rights
Subject to applicable legal requirements and exceptions, EU/EEA and UK candidates may have the right to:
- request access to their Personal Data;
- request correction of inaccurate or incomplete Personal Data;
- request deletion of Personal Data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing, if applicable;
- request portability of Personal Data, where applicable;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
- request information about automated decision-making or profiling, where applicable; and
- lodge a complaint with a competent data protection authority.
Requests may be submitted to privacy@exadel.com or through the rights request mechanism described in the Global Candidate Privacy Notice.
7. Retention Period
To ensure full compliance with the principle of storage limitation, Exadel implements a strict retention system for unsuccessful candidates:
- Immediate Deletion Rule: If you are not selected for the role and have not provided consent for future recruitments, your active recruitment file will be closed immediately upon the conclusion of the recruitment process.
- ●Passive Segregated Archiving (Legitimate Interest for Defense of Claims): To protect Exadel's legal rights and defend the company against potential civil or labor law claims (such as claims of discrimination in hiring), your basic application data may be retained for up to 3 years from the date of rejection (matching the standard statute of limitations for employment-related claims under local laws, such as Article 291 § 1 of the Polish Labour Code). During this 3-year period, your data will be strictly passive and locked; it will be completely segregated from our active recruitment databases, will not be searched, and will be inaccessible to hiring managers or recruiters. It will only be accessed in the event of a formal legal dispute or regulatory audit.
- Consent-Based Retention for Future Recruitments: If you explicitly opt-in and consent to be considered for future job opportunities, we will retain your active CV and application profile in our talent pool for a maximum period of 2 years, or until you withdraw your consent. You may withdraw this consent at any time without any negative consequences.
8. Automated Decision-Making (Human-in-the-Loop)
Exadel may use AI-assisted tools and ATS algorithms to help parse CVs and match candidates’ professional experience with open positions. However, to protect your rights under Article 22 of the GDPR and the European AI Act:
●No Automated Rejections: Exadel strictly prohibits fully automated decision-making or profiling that results in the automatic rejection of a candidate. Every stage of candidate evaluation, filtering, and final selection involves direct human review and intervention by a qualified member of our Talent Acquisition team.
AI Act Compliance: Any AI systems utilized by Exadel for CV parsing or talent matching are continuously audited, tested for algorithmic bias, and configured to meet the high standards of safety, human oversight, and non-discrimination required for high-risk AI recruitment software under the EU AI Act.
9. Distinction between Employment Contracts and B2B Contracts
We distinguish between candidates applying for a standard employment relationship (employment contracts) and those applying as independent contractors (B2B contracts). While the strict statutory limits of national labor codes apply exclusively to employment relationships, Exadel applies the principles of proportionality, transparency, and strict data minimization under the GDPR to all B2B recruitment activities. Background checks, screening, and data collection for B2B candidates will remain proportionate to the specific services to be performed under the B2B agreement.
10. Supervisory Authorities
If you believe that the processing of your Personal Data infringes applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority, such as:
- In Poland: Prezes Urzędu Ochrony Danych Osobowych (PUODO).
- In Bulgaria: Commission for Personal Data Protection (CPDP).
- In the UK: Information Commissioner’s Office (ICO).
If you explicitly opt-in and consent to be considered for future job opportunities, we will retain your active CV and application profile in our talent pool for a maximum period of 2 years, or until you withdraw your consent. You may withdraw this consent at any time without any negative consequenc