k-ID Job Applicants’ Privacy Notice

Effective Date: 22 January 2025

This k-ID Applicant Privacy Notice (“Privacy Notice”) applies to applicants and prospective Workers (collectively, “Applicants”) whose Personal Information we may collect and process in the context of our recruitment activities. As used in this Privacy Notice, “Personal Information” has the meaning given to it under the law where you live, but typically refers to information that can be used to identify you as an individual; meanwhile, our activities taken with respect to your Personal Information are referred to as “processing.”

The terms “k-ID,” “we,” “us,” and “our” include Kidentify Pte. Ltd. and its affiliates and subsidiaries, including Kidentify US Inc.. This Privacy Notice explains the kinds of Personal Information we may collect, how we intend to use and share that information, and the rights you may have related to these processing activities.

An Important Note: This Privacy Notice only applies to data that we collect and process when interacting with you in your capacity as an Applicant, regardless of your application method. If your application is successful, you will be provided with k-ID Employee Privacy Policy. Additionally, unless otherwise indicated on a specific website page or form, this Privacy Notice does not apply to any of the Personal Information that we process through your use of our public-facing websites, applications, or services, which are subject to our user Privacy Policy.

Personal Information we collect

The information we ask for is used to assess your suitability for employment. k-ID collects the following categories of Personal Information:

Profile/Demographic Information. Full name, mailing address, phone number, email address, date of birth.
Employment Information. Employment history, education information, professional qualifications, language abilities and other information that you may have provided on a resume/CV or application form, salary expectations, references, right to work and visa information.
Publicly available information. Such as information from professional social networks or job databases.
Sensitive Personal Information. Details of health and disability to allow us to make reasonable adjustments during your recruitment process; and optional demographic information such as race or veteran status, which helps us achieve our diversity goals.
Communications with Us. Personal contact information and content of the communication when you contact us, for example to inquire about your interview process.
Recruitment assessment data. Any assessment/tasks you performed during the recruitment process, the outcome of such assessments, interview notes.
Verification data. Outcome of background checks and any identity check (where permitted or required by law).
Technical information. Details about your visit to our careers page (hosted by our recruitment platform), including traffic data, location data, web-logs and other communication data, the site that referred you to our careers page.
Feedback. From time to time, we may ask you to provide your feedback or participate in optional surveys. If you decide to participate, you may be asked to provide certain information, which may include Personal Information.

Where we collect your Personal Information from

We collect your Personal Information from the following sources:

Directly from you. When you visit our careers page directly apply for a role with us, and from the start of your contract throughout the course of your relationship with us.
Other Sources. We may collect or receive information about you from other sources, including through third-party services and organizations to supplement information provided by you. For example, employment agencies, educational providers, referees (external or internal), government departments (e.g. tax, welfare and pension authorities), or where permitted by law, may conduct background and credit checks on you prior to your employment with k-ID.

How we use your Personal Information

We process your Personal Information to:

Assess your suitability, aptitude, skills, qualifications, and interests for employment with or provision of services to k-ID;
Shortlist applications for interview;
Communicate with you about the application process and/or your application;
Carry out pre-employment checks, such as references and background checks;
Take steps at your request prior to entering into a relationship with you. For example, after we have sent you an offer, to process certain Personal Information to enter into and commence employment;
Keep records related to our hiring practices for use in future recruitment activities and to ensure compliance with the local laws;
Support diversity, inclusion and equal opportunities initiatives;
Comply with other legal obligations, including verifying that you are legally permitted to work in the country where you are applying and resolving disputes and/or as part of a legal defense, if necessary;
Protect and defend our rights and property;
As you otherwise agree or consent.

‍

How We disclose your Personal Information

We may share your information as described in this Privacy Notice or with your permission with the following third parties:

Vendors and Service Providers. to perform our recruitment activities, k-ID may share any information we receive with vendors and service providers such as our recruitment platform, and our background-check service providers.
Affiliates and Subsidiaries. k-ID may share Personal Information with our affiliates and subsidiaries to carry out our recruitment activities as provided in this Policy or if we see that your profile is more suitable for other positions at k-ID.
Disclosures to Protect Us or Others. We may access, preserve, and disclose your Personal Information if we believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal processes, such as court orders or subpoenas; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation or prosecution of suspected or actual illegal activity.
Merger, Sale, or Other Asset Transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another entity, your information may be transferred as part of such a transaction as permitted by law and/or contract.

International Data Transfers

All information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

If we transfer personal information which originates in the European Economic Area, Switzerland, and/or the United Kingdom to a country that has not been found to provide an adequate level of protection under applicable data protection laws, one of the safeguards we may use to support such transfer is the EU Standard Contractual Clauses.

How long we keep your Personal Information

Your Personal Information is kept for as long as necessary, required by applicable law or to resolve any disputes within the hiring process. When deleting your Personal Information, we will take measures to make the information irrecoverable or irreproducible, and electronic files which contain Information will be deleted permanently.

If you are unsuccessful in your application, we will keep your information for no more than three years so that we can contact you about current and future positions at k-ID. If you are successful, we will save your information within your employee file in accordance with our internal policies. Information from background checks is retained for six months after the verification takes place, unless we have a legal requirement to keep it for longer.

Individual rights in Personal Information

In accordance with applicable law, you may have the right to:

Access your Personal Information, including: (i) confirming whether we are processing your Personal Information; (ii) obtaining access to or a copy of your Personal Information;

(iii) receiving an electronic copy of Personal Information that you have provided to us, or asking us to send that information to another company (the “right of data portability”);

Request correction of your Personal Information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your Personal

Information, or we may refer you to the controller of your Personal Information who is able to make the correction;

Request deletion of your Personal Information, subject to certain exceptions prescribed by law; and
Request restriction of or object to our processing of your Personal Information, including the right to (i) withdraw your consent to processing, (ii) object to or restrict processing of your sensitive Personal Information for certain purposes, or (iii) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, if applicable, where each such requests are permitted by law.

If you would like to exercise any of these rights, contact us as set forth below. We will process such requests in accordance with applicable laws. To protect your privacy, k-ID will take steps to verify your identity before fulfilling your request. You have the right to not receive discriminatory treatment or be retaliated against for exercising these rights.

An agent authorized to act on your behalf, may make a verifiable consumer request to exercise the rights described above related to your Personal Information. You may also make a verifiable request on behalf of your minor child. To authorize an agent, provide written authorization signed by you and your designated agent and contact us as set forth in the “Contact Us” section below for additional instructions.

Security of Your Information

We take steps to ensure that your information is treated securely and in accordance with this Privacy Notice. For this reason, we have implemented a range of technical and organizational measures. Unfortunately, the transmission of information via the internet is not completely secure and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

THIRD-PARTY WEBSITES/APPLICATIONS

Various resources and sites at k-ID may contain links to third party websites/applications and other websites/applications may reference or link to k-ID. These third-party services are not controlled by us. We encourage Applicants to read the privacy policies of each website and application with which they interact. We do not endorse, screen or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

Changes To Our Privacy Notice and Practices

We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Notice if you continue your employment with or services to the k-ID after the new Privacy Notice takes effect. If at any point you do not agree to any portion of the Privacy Notice in effect, you must immediately contact Human Resources.

CONTACT US

Kidentify Pte. Ltd. is the controller of the personal information we process under this Privacy Policy. If you have any questions about our privacy practices or this Privacy Policy or to exercise your rights as detailed in this Privacy Policy, you can initiate a support request through the Family Portal by navigating to the “Help” section and following the prompts to submit a request, or by contacting us directly at:

Kidentify Pte. Ltd. Data Protection Officer privacy@k-id.com

General Data Protection Regulation (GDPR) – European Representative

Pursuant to Article 27 of the General Data Protection Regulation (GDPR), KIDENTIFY Pte. Ltd. has appointed the European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR:

by using EDPO's online request form: https://edpo.com/gdpr-data-request/
by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium

UK General Data Protection Regulation (GDPR) - UK Representative

Pursuant to Article 27 of the UK GDPR, KIDENTIFY Pte. Ltd. has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

by using EDPO's online request form: https://edpo.com/uk-gdpr-data-request/
by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom

‍

SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

The following table describes the categories of Personal Information k-ID has collected and the categories of third parties to which such information has been disclosed for a business purpose in the preceding 12 months:

Category of PersonalInformation Collected by k-ID	Category of Third Parties to which Information is Disclosed
Identifiers - A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number or other similar identifiers.	● Service Providers ● k-ID affiliates ● Other k-ID workers (to the extent you share)
Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) - A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.	● Service Providers ● k-ID affiliates ● Other k-ID workers (to the extent you share)
Sensitive Personal Information - A social security, driver’s license, state identification card, or passport number, an account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, or union membership, contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication, or genetic information.	● Service Providers ● k-ID affiliates ● Other k-ID workers (to the extent you share)
Protected classification characteristics under California or federal law - Age (40 years or older), race, color, ancestry, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	● Service Providers ● k-ID affiliates ● Other k-ID workers (to the extent you share)
Geolocation data - Physical location or movements (of company-owned vehicles, tools or other devices)	● Service Providers ● k-ID affiliates
Professional or employment-related information - Current or past job history or performance evaluations.	● Service Providers ● k-ID affiliates

The categories of sources from which we collect Personal Information are described above in the section titled “Personal Information We Collect.”

We use the data we collect about you for the business purposes described above in the section titled “How We Use Your Information.” In addition, we may share any data we hold about you with the parties described above.

Your Personal Information is not (i) “sold” or (ii) “shared” (for purposes of targeted advertising) by us, nor do we have actual knowledge of any such activity involving the Personal Information of minors under 16 years of age.

Data Retention. The Data Retention section above outlines the criteria we utilize for determining how long to retain data.

Sensitive Personal Information. Processing of sensitive Personal Information is carried out exclusively for the purposes outlined above, to the extent permitted under law. This processing activity may include service providers and government entities.

SUPPLEMENTAL NOTICE FOR CHINESE MAINLAND RESIDENTS

This Supplemental Notice for Chinese Mainland only applies to our processing of Personal Information that is subject to the applicable data protection laws of Mainland China, including the Personal Information Protection Law (“PIPL”).

Your Privacy Rights. In addition to the applicable rights listed above, you have the following additional data subject rights: the right to request an explanation on how your Personal Information is handled, the right to file a lawsuit, and the right to allow your next of kin to exercise any of your rights unless other arrangements have been made before your death. For purposes of the PIPL, the k-ID’s Privacy Officer is your data handler, and data subject requests may be directed to the contact information provided above.

International Transfers. When transferring Personal Information which originates in Chinese Mainland internationally, we will comply with the applicable requirements governing the transfer and processing of such data. Providing k-ID information for employment, through the website, or

otherwise constitutes your consent for our international transfer of your data.

List of Entrusted Persons. If permitted under applicable law, data subjects may request a copy of our service providers (entrusted persons).

SUPPLEMENTAL NOTICE FOR UK / EEA APPLICANTS

Legal basis. The legal basis we rely on for processing your personal data are:

Art. 6(1)(a) of the UK and EU GDPR, which relates to processing based on your consent. E.g. when you participate in an optional survey.
Art. 6(1)(b) of the UK and EU GDPR, which relates to processing necessary to take steps at the request of the data subject prior to entering into a contract. E.g. to extend you an offer of employment.
Art. 6(1)(c) of the UK and EU GDPR, which relates to our compliance with a legal obligation. E.g. to comply with our obligations under employment law.
Art. 6(1)(f) of the UK and EU GDPR, which relates to the processing for the purpose of our legitimate interests. E.g. to ensure the security of our systems, premises, as well as effective business operations and communication.

The legal basis we rely on to process your special category of personal data such as health, religious, sexual orientation, or ethnicity information are:

Art. 9(2)(b) of the UK and EU GDPR, which relates to our obligations in the field of employment, social security, and social protection law and the safeguarding of your fundamental rights.
Art. 9(2)(h) of the UK and EU GDPR, which relates to the purposes of preventative or occupational medicine and the assessment of your working capacity. E.g. to manage sick leave or to conduct occupational health assessments to ensure that Workers are fit for their roles and to prevent workplace injuries.
The additional UK DPA 2018 processing conditions we rely on are Schedule 1 part 1(1) which again relates to processing for employment purposes.

Right to lodge a complaint. If you are located in the UK or European Economic Area, you have the right to lodge a complaint with your supervisory authority if you believe our processing of your Personal Information violates applicable law. You may find a list of local data protection authorities here.