PRIVACY POLICY

The Spreadhire Portal (“Portal,” “we,” “us,” “our,” or “Spreadhire”) is an online platform operated by Spreadhire S.R.L., providing a centralized, secure, and user-friendly environment for managing recruitments and facilitating talent mobility opportunities (the “Service”). Through the Portal, we connect users, including candidates and employers, through referral partners, and consultants (“Users”), to deliver an efficient, streamlined, and secure Service experience. The Service enables the movement of candidates or employees across roles, locations, and organizations to meet staffing needs, support skill development, and match individuals with suitable opportunities. Personal Data (as defined herein) may be collected directly from candidates or indirectly via referral partners or consultants and is subsequently verified by the relevant candidate or employer.

We respect your privacy and the trust you place in us. This Privacy Policy (“Privacy Policy”) explains how and why we collect, use, store, and share Personal Data through the Portal and the Service, and outlines your rights in relation to your Personal Data. By accessing or using the Portal or Service, you acknowledge and agree to this Privacy Policy and provide your revocable consent for the processing of Personal Data for Service-related purposes, in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This Privacy Policy explains:

• What Personal Data we collect and why;
• How we use, store, and share your data; and
• Your rights regarding your Personal Data, including how to access, update, withdraw consent, or request deletion of your Personal Data.

We have endeavored to present this information as clearly as possible. However, if you are unfamiliar with terms such as “cookies,” “IP addresses,” “pixel tags,” or “browsers,” we recommend reviewing these concepts before proceeding. Protecting your privacy is important to us, and we encourage you to familiarize yourself with our practices. Should you have any questions or require further clarification, please contact us at info@spreadhire.com.

1. SCOPE

“Personal Information” or “Personal Data” refers to any information that directly or indirectly identifies, relates to, describes, or is reasonably capable of being associated with a specific User. Your use of our Service is subject to this Privacy Policy, which governs any disputes related to privacy and data protection.

• COLLECTION OF PERSONAL DATA

To provide the best experience to you, we collect and store Personal Data provided by you from time to time on the Portal. When you contact us, we keep a record of your communication to help address any questions or issues you may have while using the Portal. The Personal Data that we may collect about you broadly falls into the following categories:

• Information You Provide to Spreadhire[AT1] 

When you interact with the Portal or Service, we may collect contact details and unique identifiers, including your name, email, phone number, date of birth, and other personal information.

To enhance your experience on the Portal and facilitate recruitment or talent mobility, we may gather specific information and content from you, including:

• Identification of IP address: Your IP address, device identifiers, and characteristics of the networks you use to connect to the Portal;
• Network activity: Internet or electronic network activity information, including your interactions within the Portal;
• Geolocation data: Geolocation data, such as IP address or GPS coordinates, to improve your Service experience;
• User navigation: Your interactions and navigation patterns within the Portal to enhance usability;
• Recruitment & talent mobility information: Applications, job preferences, skills, education, work experience, professional qualifications, and other details relevant to the Service;
• Media files: Photographs, videos, CVs, or other documents uploaded to the Portal;
• Referral & recommendations: Data provided by referral partners or consultants for candidates or employers, including references or recommendations, subject to verification and consent by the relevant User;
• User contact and communication data: Emails, phone numbers, messages, notes, or other correspondence exchanged via the Portal;
• Employer/organizational information: Job roles, department details, hiring requirements, or other company-related data submitted by employers or consultants;
• User preferences: Likes, dislikes, and selections that help optimize talent mobility matching or recruitment recommendations;
• Special category personal data: Sensitive data such as diversity, health, or protected characteristics, collected only with explicit consent where applicable.

• Information That We Collect Automatically

When you engage with the Portal, certain information may be automatically collected, including details such as:

• Device and software information: Your device type, operating system, browser, and software characteristics;
• Device identifiers and network data: IP address, device identifiers, and network characteristics;
• Log and interaction data: Pages visited, features used, clicks, form submissions, and other interactions with the Portal;
• Usage patterns and frequency: Repeated actions, session duration, navigation flow, and other behavioral metrics to optimize Service performance;

We use technologies such as “Cookies,” as described below, to collect this data. The information gathered is utilized to support internal operations, conduct research and analysis, and generate aggregated reports for our internal use.

• Information That We Receive from Third Parties

We may receive personal information about you from third-party sources to support recruitment, talent mobility, and verification processes, including:

• Social media and professional networking platforms: If you choose to register via an external account, we may collect publicly available profile information (e.g., name, username, profile picture, or contact details);
• Background verification, KYC, or identity verification providers: Personal information necessary to validate your identity or credentials;
• Other authorized third parties: Providers assisting with talent mobility matching, recruitment services, or verification processes.

All third-party data is collected, processed, and stored in compliance with applicable data protection laws.

Any information submitted by referral partners or consultants is verified by the relevant User (candidate or employer) before it is used for Service-related purposes.

• DISCLOSURE OR SHARING OF PERSONAL INFORMATION

Spreadhire may disclose your Personal Data for specific purposes and to authorized third parties, as outlined below:

• Within Spreadhire and affiliated entities: We may share your information internally to manage recruitment, talent mobility, data processing, storage, customer support, and other functions necessary for the operation and improvement of the Service.
• With service providers and contractors: We may engage third-party providers, agents, or contractors (“Service Providers”) to perform services on our behalf, such as hosting the Portal, providing IT support, analytics, or facilitating the Service. Service Providers are only authorized to use Personal Data to the extent necessary to perform their services and must adhere to appropriate confidentiality and data protection requirements.
• For legal, regulatory, or compliance purposes: Spreadhire and its Service Providers may disclose Personal Data where reasonably necessary to: (i) comply with applicable laws, regulations, legal processes, or governmental requests; (ii) investigate or enforce potential violations of this Privacy Policy; (iii) detect, prevent, or address illegal or suspected illegal activity, security incidents, or technical issues; (iv) protect the rights, property, or safety of Spreadhire, Users, or the public.
• For talent mobility and recruitment purposes: Personal Data provided by Users (referral partners or consultants) may be shared with the relevant candidate, employer, subject to their consent, to facilitate verification, matching, and recruitment processes.
• International transfers: If Personal Data is transferred outside your jurisdiction, we ensure that such transfers are conducted in compliance with applicable data protection laws, including GDPR, using appropriate safeguards such as standard contractual clauses or agreements with countries recognized as providing adequate protection.

• WHY WE COLLECT AND PROCESS PERSONAL DATA

Spreadhire collects and processes Personal Data only where there is a valid legal basis under applicable data protection laws, including the GDPR. Depending on the context, this may include your consent, the performance of a contract, compliance with legal obligations, or our legitimate interests, provided such interests are not overridden by your rights and freedoms.

We collect and process Personal Data for the following purposes:

1. To facilitate recruitment and talent mobility processes, including creating and managing User profiles, verifying information submitted, matching candidates with employers, and enabling communication between Users through the Portal.
2. To confirm the accuracy, completeness, and legitimacy of information submitted on the Portal, including data initially provided by referral partners or consultants and subsequently verified by candidates or employers.
3. To tailor recommendations, opportunities, communications, and Portal functionality based on User roles, preferences, activity, and interactions, and to enhance overall usability and efficiency.
4. To send Service-related notifications, updates regarding recruitment or talent mobility opportunities, account information, support messages, and other necessary communications related to the use of the Portal.
5. To analyze usage patterns, improve matching algorithms, enhance recruitment outcomes, develop new features, and optimize the performance and security of the Service.
6. To share newsletters, platform updates, or information about new features or services, subject to your communication preferences and applicable consent requirements.
7. To meet applicable legal, regulatory, tax, accounting, or reporting requirements, and to respond to lawful requests from public authorities or regulators.
8. To protect the integrity of the Portal, prevent unauthorized access, detect or prevent fraudulent or unlawful activity, and safeguard the rights, property, and safety of Spreadhire and its Users.

Where we rely on legitimate interests, such interests typically include operating and improving the Portal, managing relationships with Users, ensuring data accuracy, maintaining security, responding to User inquiries, and enhancing Service outcomes. These interests are carefully balanced against your rights and expectations.

Spreadhire may also use Personal Data in an aggregated or anonymized form, such that it can no longer be linked to an identifiable individual. Such anonymized data may be used for statistical analysis, reporting, research, and service optimization, and we do not attempt to re-identify individuals from such data.

• YOUR RIGHTS REGARDING YOUR PERSONAL DATA

Under the GDPR and other applicable data protection laws, you have the following rights in relation to your Personal Data processed through the Spreadhire Portal and Service:

• Right of Access: You have the right to request confirmation as to whether your Personal Data is being processed and, where that is the case, to access such Personal Data. You may also request a copy of the Personal Data we hold about you.

• Right to Rectification: You have the right to request the correction or update of any Personal Data that is inaccurate, incomplete, or outdated. Where appropriate, you may update certain information directly through the Portal.

• Right to Erasure (“Right to Be Forgotten”): You have the right to request the deletion of your Personal Data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent (where processing is based on consent), or where you successfully object to processing and there are no overriding legitimate grounds to continue processing.

• Right to Restrict Processing: You have the right to request that we restrict the processing of your Personal Data in specific situations, such as where you contest the accuracy of the data, where the processing is unlawful but you oppose deletion, or where you have objected to processing pending verification of legitimate grounds.

• Right to Object: You have the right to object, on grounds relating to your particular situation, to the processing of your Personal Data where such processing is based on legitimate interests. You also have the right to object at any time to the processing of your Personal Data for direct marketing purposes. Where an objection is valid, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

• Rights Related to Automated Decision-Making: Spreadhire does not use Personal Data for solely automated decision-making, including profiling, that produces legal or similarly significant effects on Users.

• Right to Data Portability: Where processing is based on your consent or on a contract and carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and, where technically feasible, to request that such data be transmitted to another controller.

To exercise any of the above rights, or if you have questions regarding the processing of your Personal Data, please contact us at info@spreadhire.com. We will respond to your request within the timeframes required under applicable data protection laws.

• RETENTION, DELETION, AND SECURITY OF PERSONAL DATA

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including the provision of Service, maintaining user accounts, facilitating current or future opportunities, complying with legal and regulatory obligations, and resolving disputes. Retention periods may vary depending on the nature of the data, the role of the User (candidate, employer, referral partner, or consultant), and applicable legal requirements, but, in any case, Personal Data will not be retained for more than two (2) years [AT2] unless a longer period is required or permitted by law.

Personal Data relating to candidates and employers may be retained beyond a specific recruitment process to enable consideration for future roles or talent mobility opportunities, unless the relevant User requests deletion or withdraws consent where applicable. Where retention is required by law (for example, for compliance, audit, or record-keeping purposes), such data will be retained in accordance with applicable statutory retention periods.

Where we no longer have a legitimate business or legal need to process Personal Data, we will securely delete or irreversibly anonymize it. If immediate deletion is not technically feasible (for example, where data is stored in secure backup systems), the data will be isolated from active processing and securely retained only for as long as necessary until deletion can be completed.

We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include encryption, pseudonymization where appropriate, access controls, role-based permissions, and regular security assessments. In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of Users, we will notify affected Users and the relevant supervisory authorities without undue delay, in accordance with applicable data protection laws.

You may request the deletion of your Personal Data or withdraw your consent to processing at any time, subject to legal or contractual limitations. Please note that deleting or withdrawing consent for certain Personal Data may limit or prevent our ability to provide some or all aspects of the Service, including consideration for recruitment or talent mobility opportunities.

• MINORS

The Spreadhire Portal and its Services are not intended for Users under the age of 14. If a User is under 14, a parent or legal guardian must provide verifiable consent for the minor to use the Portal and access the Services. By granting such consent, the parent or guardian acknowledges and accepts responsibility for the minor’s use of the Portal, including the collection, processing, and storage of any Personal Data in accordance with this Privacy Policy.

Parents or guardians may contact us at info@spreadhire.com to review, correct, or request deletion of their minor’s Personal Data or to withdraw consent at any time.

• DATA PROTECTION FRAMEWORK

Spreadhire is committed to protecting the Personal Data of all Users of the Portal in compliance with the GDPR and other applicable data protection laws.

Our data protection measures include:

• Implementing strong technical and organizational security protocols to protect Personal Data;
• Ensuring that all Personal Data is processed lawfully, fairly, and transparently;
• Obtaining verifiable consent from Users where required;
• Facilitating Users’ rights to access, correct, delete, or restrict the processing of their Personal Data; and
• Adopting safeguards to prevent unauthorized access, disclosure, alteration, or misuse of Personal Data.

When Personal Data is shared with third parties, such as Service Providers or verification partners, they are required to maintain equivalent data protection standards and are held accountable under the same obligations as Spreadhire.

• COOKIES

This section explains how we use cookies and similar technologies to recognize you when you use the Spreadhire Portal and access our Services.

• What is a Cookie?

Cookies are small text files placed on your browser or device that help identify it when you return to the Portal. These cookies allow the Portal to recognize your device, remember your preferences, and provide a seamless user experience.

• Why Do We Use Cookies?

We use first- and third-party cookies for several purposes:

• Required for the Portal to function properly, including logging in, maintaining session security, and basic navigation.
• Remember your preferences, profile settings, and talent mobility or recruitment choices to enhance your user experience.
• Help us understand how Users interact with the Portal. This allows us to improve usability, Service performance, and overall functionality.
• Enable our partners or us to show relevant content, opportunities, or services based on your interactions with the Portal.

Some cookies may come from external services or social media platforms if you register using a social account, share Portal content, or access embedded media. These platforms have their own privacy policies governing the use of the data they collect.

• How to Manage or Delete Cookies

You can manage cookies through your browser settings, including:

• Viewing and deleting specific cookies stored on your device;
• Blocking third-party cookies or certain types of cookies;
• Blocking all cookies (note that this may prevent full use of Portal features);
• Automatically deleting cookies when you close your browser.

Please note that disabling cookies or similar technologies may limit your ability to access certain features of the Portal or receive a personalized talent mobility and recruitment experience.

1. Changes to This Privacy Policy

Spreadhire may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or technological developments. When updates are made, we will take appropriate steps to inform Users, depending on the significance of the changes.

If required by applicable data protection laws, we will obtain your consent before implementing any material changes that affect how your Personal Data is collected, processed, or shared.

All updates will be posted on the Spreadhire Portal, and once posted, the revised Privacy Policy will take effect immediately. You can always check the “last updated” date displayed at the top of this Privacy Policy to see when it was most recently amended.

---

 [AT1]@Spreadhire Please confirm the data that the Portal will collect from Users (candidates, employers, consultants, or referrers) directly. If there are any additional data points not listed, kindly include them as well.

 [AT2]@Spreadhire Please confirm.