Talent Acquisition Privacy Notice

Last Updated: 13 June 2023

At Chainstack, we are committed to protecting the privacy and confidentiality of personal data we collect during the Talent Acquisition process. This privacy notice explains how we collect, use, disclose, and store personal data related to job applicants in compliance with the General Data Protection Regulation (GDPR) and the Personal Data Protection Act (PDPA) of Singapore.

This notice explains how Chainstack (referred to as “we” in this document) identified below collects, stores, uses, or otherwise processes the personal data of candidates (referred to as “you” in this document) in their recruitment activities. This outlines your rights if we are processing your personal data.

Data Controller

Chainstack Pte. Ltd., headquartered in Singapore, is responsible for determining how and why personal data is processed.

8 Temasek Boulevard
#30-01/02 Suntec Tower 3
Singapore 038988

During the Talent Acquisition process, we may collect and process the following categories of personal data:

• Personal contact information (name, address, email, phone number)
• Information is provided in the CV, cover letter, or similar documents
  • Educational background and qualifications
  • Employment history and references
  • Skills, experience, and certifications
  • Online professional profiles or work portfolios (e.g.: LinkedIn, GitHub, etc.)
  • Other information is submitted through our online application system
• Content and metadata of communications with us (including emails exchanged with our People Team team)
• Any additional information included in the application or shared during interviews or assessments
• Results and information related to tests or assignments completed as part of the Talent Acquisition process
• Information provided by third-party placement firms, if applicable
• Recommendations and reference check details
• Other information is necessary to make an employment offer and facilitate employment with us, including relocation services, if applicable

Why do we process your data and on what basis?

We may process your data for the following purposes:

• Evaluating your qualifications and suitability for employment
• Managing the recruitment process, including updates on application status, interviews, assessments, background checks and potential employment offers, and finalisation of offers
• Sending updates about our open positions
• Maintaining recruitment records
• Analysing and improving our Talent Acquisition process
• Monitoring workplace diversity, equity, and inclusivity
• Other purposes required or permitted by applicable laws and regulations

The legal basis for processing your data depends on the data in question and the context of the processing. In many cases, we process your data based on our legitimate interest in finding and securing talent. We may also process your data with your consent or as necessary to enter into or perform a contract with you. When required by law, we process your data to comply with our legal obligations.

Where do we collect your data from?

We collect data related to you from the following sources:

• Directly from you, such as when you submit information through our online application system, during the Talent Acquisition process, in other interactions with us (including at Talent Acquisition or industry events), or referrals
• Online services used for Talent Acquisition, networking, and sharing work portfolios
• Third-party placement firms, if you are introduced to Chainstack through them

If permitted by applicable laws and regulations, we may also collect information from a third party to conduct a background check on you. Any background check will be performed only with your explicit consent, following the scope and manner determined by the relevant laws and regulations.

Providing data to us is voluntary. However, if we have inadequate information about you, we may be unable to complete the Talent Acquisition process or consider you for a position. If you choose to provide data, please ensure that it is complete and accurate.

Who do we share your data with?

To fulfill the purposes outlined in this policy, we may share your data with the following types of recipients:

• Service providers: We use BambooHR, an HR Information System (HRIS) and an Applicant Tracking System (ATS)
• Legal requirements: Your data may be disclosed to competent governmental authorities, courts of law, or similar entities when we believe disclosure is required by applicable laws and regulations, or to exercise, establish, or defend our legal rights
• Business transactions: In the context of a planned or actual acquisition, merger, or business restructuring, your data may be shared with prospective or actual buyers and their agents or advisors

Personal data may be transferred to countries outside the European Economic Area (EEA) and Singapore if necessary for Talent Acquisition purposes. We ensure that appropriate safeguards are in place to protect personal data during such transfers, such as using standard contractual clauses or relying on other lawful mechanisms recognised under the General Data Protection Regulation (GDPR) and the Personal Data Protection Act (PDPA) of Singapore.

How long do we keep your data?

We will retain your data for as long as necessary to fulfill the purpose(s) for which it was collected, including any legal, accounting, or reporting requirements.

Regarding unsuccessful candidates, we will retain applicant data for two years from the date you were informed of the decision. If you are selected for a position, your data will be transferred to our employee records and retained according to our employee data retention policies.

Please note that certain situations may require deviation from the aforementioned retention guidelines. After the applicable retention period, we may retain and use non-identifiable data (including aggregate data) for statistical purposes.

How do we keep your data secure?

We have implemented appropriate security measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The specific measures employed vary across services or systems but
typically include access controls, contractual safeguards with third parties, regular training for personnel involved in recruitment, procedures to handle security incidents, and modern encryption protocols.

Your Rights

If we are processing your data, you have the right to:

• Access, correct, or request the deletion of your data
• Request us to restrict our processing of your data
• Object to our processing of your data to the extent our processing is based on the legitimate interests of Chainstack or a third party, or
• Where technically feasible, request a copy of the personal data you have provided to us in a machine-readable format

Where our processing of your data is based on your consent, you also have the right to withdraw your consent at any time.

To exercise any of these rights, please contact our People Team. To fulfill your request, we need to confirm your identity to verify your right to make the request, which may involve requesting additional information from you. While we will usually not do so, we reserve the right to charge an appropriate fee from you for the exercise of your rights where permitted by applicable law or regulation.

Changes

We may update this notice from time to time, for example, due to changes in our operations or the legal obligations that apply to us. We will inform you of any changes made by means that are appropriate considering the significance of the changes.

Contact Information

Our People Team, in collaboration with the Security Team, is your primary contact for matters related to this notice. If you have any questions or concerns regarding the use of your data, you may reach out to us via email at
[email protected].