Candidate Privacy Notice

VERSION: 1.0
LAST UPDATED: April 15, 2026

1. INTRODUCTION

At Spendbase, we are deeply committed to safeguarding the privacy of our candidates, whether for an employee, worker, or contractor position (hereinafter referred to as Candidate). Therefore, we have put in place this Notice, which outlines our data protection practices.

This Notice applies to our processing of your personal data, which identifies or may identify you (“Personal data”) in connection with your engagement with us via https://spendbase.peopleforce.io/careers, LinkedIn, or other similar tools or sources for the purposes described below. Please note that this Notice covers neither the list of services presented at https://www.spendbase.co/ nor the processing operations of Spendbase products. Data processing operations of already engaged employees and contractors are subject to Spendbase’s respective internal privacy policy.

We may update this Notice from time to time. In case of significant changes, we will notify you by email (if any). We encourage you to review this notice frequently to be informed of how we protect your information. In the event you disagree with the current version of this Notice, you should refrain from submitting your application.

This Notice may be presented in several languages. In the event of discrepancies between the languages, the English text of this Notice shall prevail.

2. ABOUT SPENDBASE

Spendbase Inc. (“we,” “us,” or “our”) is incorporated in Delaware, USA. We operate globally and recruit candidates across multiple regions, including the European Union, Ukraine, Latin America, and beyond.

3. PERSONAL DATA WE PROCESS

When you apply for a role with us, we may process the following categories of Personal Data depending on the lawful grounds defined herein:

NB! We do not intentionally collect sensitive categories of Personal Data, which may reveal health, ethnicity, nationality, gender, political and religious beliefs, but we may, upon your explicit consent, collect sensitive personal data on the occasions described herein. Please try to avoid sharing your personal data unless we have asked you to do so. In the event you have mistakenly provided us with the data we have never requested, and you would like us to delete it, please do not hesitate to reach out to us at: privacy@spendbase.co

4. SENSITIVE PERSONAL DATA

In addition, we may collect, store, and use information about your criminal conviction history if we perform a background check. Typically, we perform background checks if we would like to offer you the role. Such an offer is usually conditional on checks and any other conditions, such as references, being satisfactory. We are entitled to ask you to apply for a basic criminal record check to satisfy ourselves that there is nothing in your criminal conviction history that makes you unsuitable for the role. Certain roles at Spendbase require the highest degree of trust and integrity, and therefore require a criminal background check. Such background checks are conducted in accordance with applicable law and where proportionate to the position. In cases where we engage third parties, we put appropriate technical and organisational measures in place to manage the security of your Personal Data to the best of our efforts.

5. MINORS PERSONAL DATA

We do not collect Personal Data of minors. In the event we become aware of a Candidate who is not considered to be of the legal age, we will immediately destroy such data. If you believe that you have shared data of someone who corresponds to the scope of this paragraph, please do not hesitate to reach out to us at: privacy@spendbase.co

6. SOURCES OF PERSONAL DATA

We may collect your personal data from the following sources:

• Directly from you — via our application form, email, or interviews.
• Professional networking platforms — such as LinkedIn, GitHub, or similar platforms, where you have made your profile publicly available for recruiters.
• Recruitment agencies and headhunters — third-party recruiters acting on our behalf.
• Job boards — such as Indeed, Glassdoor, DOU, or regional equivalents, where you have posted your profile or voluntarily applied for the open roles.
• Referrals — employees or contacts who recommend you for a role based on their knowledge of your interest in the position.
• Third-party providers — background check providers, who verify your documents before the offer is being sent
• Publicly available sources — professional websites, portfolios, or publications you have made publicly accessible for recruitment purposes.

7. PURPOSES AND LAWFUL BASES

Where processing cannot be based on taking steps before entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interests (Art. 6(1)(f) GDPR), we will rely on your consent or other applicable legal grounds as required by law. In such cases, we ensure that such processing is necessary and proportionate to the purpose pursued.

EU/UK/EEA candidates: You have the right to object to processing based on legitimate interests (Art. 6(1)(f)) of the GDPR at any time. Where we rely on consent, you may withdraw it without affecting the lawfulness of prior processing.

California residents: We do not sell or share your personal information for cross-context behavioral advertising. The categories of personal information collected and their business purposes are described above.

Ukrainian candidates: Processing is conducted in accordance with the Law of Ukraine on Personal Data Protection No. 2297-VI. You have the right to access, correct, and request erasure of your data.

LATAM candidates: Where local law requires a specific legal basis or registration (e.g., Brazil’s LGPD), we comply with those requirements.

NB! If you fail to provide information when requested, and that information is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully.

8. PERSONAL DATA RETENTION

In general, we retain candidate data for no longer than 12–24 months after the end of the recruitment process, unless otherwise required by law or based on your consent. This may include our need to satisfy a legal, regulatory, or reporting requirement. Considering the volume, nature, and sensitivity of your Personal Data, the potential risk of harm from unauthorised use or disclosure, as well as legal requirements, lawful basis for processing, we determine the retention period for your Personal Data categories. Regardless of the retention period that may apply, every candidate has the right to request deletion of their Personal Data pursuant to this Notice.

9. AUTOMATED DECISION-MAKING

We use an Applicant Tracking System (ATS) to manage applications and AI-assisted tools to support CV screening and interview transcription. AI outputs are always reviewed by a human recruiter — no decision is made solely by automated means, in accordance with Art. 22 GDPR.

10. PERSONAL DATA SHARING

We may share your data with:

• Internal teams — hiring managers and HR personnel involved in the recruitment process.
• Service providers — applicant tracking systems, background check providers, and IT vendors acting as processors under respective data processing agreements.
• Legal authorities — where required by applicable law or court order.

We neither sell your personal data to third parties nor use it for our own marketing campaigns.

11. INTERNATIONAL DATA TRANSFER

We are headquartered in the US and may transfer your data internationally. Where we transfer personal data from the EU/EEA, we rely on appropriate safeguards, including:

• EU Standard Contractual Clauses (SCCs), or
• Adequacy decisions issued by the European Commission.

For transfers involving other jurisdictions (e.g., Ukraine, LATAM countries), we implement equivalent contractual safeguards in compliance with applicable local law.

12. PERSONAL DATA SECURITY

We have put in place appropriate technical and organisational measures to prevent your Personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors, and third parties who have a business need to know and are subject to a duty of confidentiality and specific data processing instructions.

13. CANDIDATE PRIVACY RIGHTS

Depending on your location, you may exercise the rights set out below:

¹ EU/EEA & UK: Rights are governed by the GDPR and UK GDPR, respectively. The right to erasure and the right to object are not absolute and may be limited where we have overriding legitimate grounds or legal obligations. You may also lodge a complaint with your national Data Protection Authority (see here)

² California (CCPA/CPRA): We do not sell or share your personal information. You have the right not to be discriminated against for exercising your privacy rights.

³ Ukraine: Rights are governed by the Law of Ukraine on Personal Data Protection No. 2297-VI. You may direct complaints to the Commissioner for Human Rights of the Verkhovna Rada of Ukraine (see here)

⁴ Brazil (LGPD): You also have the right to information about the consequences of refusing to provide consent, and to request review of decisions made solely by automated processing.

⁵ Colombia: You may find supervisory authority of your rights at the Superintendence of Industry and Commerce; contact data is presented here.

Response deadlines: EU/EEA & UK — 30 days (can be extendable); California — 45 days (can be extendable); Ukraine — 30 days; Brazil — 15 days; Colombia — from 10 to 15 business days (can be extendable). We may verify your identity before processing a request and will not charge a fee unless a request is manifestly unfounded or excessive.

14. DON’T HESITATE TO CONTACT US

If you have concerns about how we handle your Personal Data, send us an email at: privacy@spendbase.co