Terms and Conditions

Data Privacy Statement for Applicants and Candidates

Everise (the “company,” “us,” “our” or “we”) is committed to the protection of personal and sensitive personal information of its applicants and candidates (“you”) whose information it holds or in its possession from unauthorized or illicit use and processing in accordance with privacy regulations.

To ensure that you can make informed decisions and feel confident about supplying your personal and sensitive personal information to us, we are providing you this Data Privacy Statement (“Privacy Statement”) which outlines our data collection, usage, retention, disclosure and disposal practices in respect of your personal information, your rights as data subject and your obligations towards any data you process in the course of your application.

This Privacy Statement also aims to explain how Everise and its affiliated entities process your personal information, who has access to it, for how long the information is kept and how it is kept secure.

1. What is personal information?

When we refer to personal information we mean information that identifies or can identify a specific individual. We may collect personal information about you, your, and where necessary, references to information about third parties such as your spouse, children (if any) and/or dependents (collectively, “Related person’s data”), as well as from authorized third parties (e.g., people you have named as your references, previous employers, schools, public authorities, or public resources), when you submit, enter, encode, or provide your job candidate information sheet or resume/curriculum vitae (“Recruitment Documents”) to us, in connection with recruiting and hiring activities.

For such purposes, we collect the following categories of personal and sensitive personal data through submitted Recruitment Documents:

• Name; contact information (including home and work address; home and work telephone numbers; mobile telephone numbers; web address data; instant messenger data; home and work email address, signature, facial recognition, voice, photograph, videos); marital status; ethnicity; citizenship information; visa information; national and governmental identification information; drivers’ license information; passport information; banking details; military service information; religion information; birth date and birth place; gender; disability information; employee identification information; education, language(s) and special competencies; certification information; probation period and employment duration information; job or position title; business title; job type or code; business site; company, supervisory, cost center and region affiliation; work schedule and status (full-time or part-time, regular or temporary); compensation and related information (including pay type and information regarding raises and salary adjustments); payroll information; allowance, bonus, commission and stock plan information; leave of absence information; employment history; work experience information; information on internal project appointments; accomplishment information; training and development information; award information; membership information.
• Related person’s data: Name and contact information of dependents or beneficiaries (including home address; home and work telephone numbers; mobile telephone numbers); date of birth; gender; emergency contacts; beneficiary information; dependent information).
• Additional information you provide on voluntary basis, such as information contained in documents you provide.

We may also process special categories of data about you (as permitted by applicable law), such as certain government identifiers (such as social security numbers); an account log-in, financial account, debit card, or credit card number with any required security code, password, or credentials allowing access to an account; precise geolocation; contents of mail, email, and text messages; genetic data; biometric information processed to identify you; information concerning disability (voluntary; for additional vacation days), health, information on religious beliefs, information concerning a natural person's sex life or sexual orientation, or information about racial or ethnic origin, religious or philosophical beliefs, or union membership; information relating to criminal convictions and offenses (collectively, "Sensitive Data").

The company may employ different means to gather your personal information, which includes, but is not limited to:

• Social Media public platforms such as but not limited to Linkedin, Facebook and job boards such as Jobstreet, BossJob or through employee and non-employee referral;
• Physical submission of Recruitment Documents on-site (including recruitment booths and those submitted to any authorized representative of Everise) or through regular mail;
• Digital copies sent to Everise business emails or via MS Teams, or when you upload documents through our Careers website or designated online job platforms or the Ever AI tool;
• Face-to-face, telephone and/or audio or video call conversations with you or your personal references;
• Text messages or chats through social media platforms and messaging apps.

The means stated above are the general means that the company may use to collect your personal information. It may seek your data via other means as necessary for processing and for as long as it does not breach the principles set by applicable data protection laws and regulations.

You have the option to choose which personal information you are comfortable to share with us. However, if you choose not to provide the personal information that we need or that are mandatory, we may not be able to process the requested services or complete your transaction and may result in the imposition of appropriate sanctions.

2. How do we use personal information?

Your personal information collected from the Recruitment Documents will be used, accessed, stored, transferred or otherwise processed during and after the recruitment or hiring process with the company for talent screening, compensation and benefits, training, and employment processing.

We process your personal information to:

• a. To evaluate if your qualifications meet the minimum requirements of a job vacancy;
• b. To screen and filter applicants and candidates for recruitment process;
• c. To ensure that we have an organized tracking system of applicants and candidates in our database including tracking applicants and candidates during the application process, security assessments including criminal records and credit checks where permitted by applicable local law and carrying out interviews and completing the hiring process in case you have been offered and accepted a position with Everise (including activities related to on-boarding and the new hire orientation processes);
• d. To manage all other activities for job application for audit;
• e. To meet our legal and compliance obligations such as but not limited to employment and immigration laws (e.g., record retention, exercise or defend legal claims, respond to government or court process or inquiries);
• f. To manage our risks, as deemed appropriate;
• g. To achieve our business and operational goals;
• h. To implement business continuity and recovery procedures (e.g. emergency situations, disaster response);
• i. To resolve or aid in administrative investigations (e.g. detect fraud or misrepresentations);
• j. Communicating with you, within the Everise Group, and/or with third parties;
• k. To respond to and comply with requests and legal demands, instructions or orders from regulators or other lawful authorities

The provision of Recruitment Data and Sensitive Data as described in this Notice is partly a statutory requirement, partly a (pre-)contractual requirement under the terms of our Careers Website, and partly a requirement to carry out the recruitment and hiring process with you. In general, you are required to provide the Recruitment Data, except in limited instances when we indicate that certain information is voluntary. Not providing the Recruitment Data and Sensitive Data may prevent Everise from carrying out recruiting and hiring activities as they relate to you and may require Everise to terminate your application and cease consideration for your potential employment with Everise.

3. How do we transfer or disclose personal information?

Any personal information we collect may be routed, stored or transferred internationally throughout the worldwide Everise organization and sometimes to third parties for our business purposes and to manage your prospective employment relationship with the company. We have internal policies to ensure protection of personal information is in place across our global organization. The company only discloses personal information within the organization if and as far as necessary for the purposes specified in this Privacy Statement.

Access within the company and across entities is only limited to those who have a need to know the information for the above-mentioned purposes, and may include your managers and their designees, global or local personnel in Operations, HR, IT, Legal & Compliance, Facilities, Finance, Marketing & Communications and Internal Audit. Thus, we made sure that any recruitment or hiring-related processing personal information is bound by confidentiality under their employment contracts.

The company does not usually share personal data with any third party outside of the organization unless one of the following circumstances applies:

• a. When it is necessary for the purposes. We may disclose personal information with third parties to the extent that a service provider’s services or access or a client’s requirements foresee or require such disclosure (e.g. background checks, performance assessments, and investigations), and your personal information was submitted for such purpose. We may disclose personal information with other members of the Everise group of companies and other service providers that support us in the realization of the purposes specified in Section 2 of this Privacy Statement.
• b. When required by law or for legal reasons. We may disclose personal information with third parties if we have good-faith belief that their access to and use of your personal information is necessary: (a) to meet any applicable law and/or court order or comply with registration and reportorial requirements of government agencies, (b) to detect, prevent or otherwise address fraud, security or technical issues, (c) to protect the interests, properties or safety of us, our employees, clients and guests, or the public, in accordance with the law; (d) to process your mandatory benefits such as social security, etc. We will notify you about such disclosure, as far as reasonably possible.
• c. In relation to corporate restructuring. If we are in a process of merger, acquisition or asset sale, we may transfer personal data to the involved third party. We continue to ensure the confidentiality of all personal data.
• d. Upon your consent. We may disclose personal data with third parties for reasons other than the above-mentioned if we obtained your explicit consent to do so. You have the right to withdraw this consent at any time.

Third parties are also expected and required to protect the security of your personal information and to use such information only for the provision of services to the company and in compliance with applicable laws. Any third party who may come in contact with your personal information is also obliged to keep and treat your personal information confidential.

Third parties who may obtain your personal information for the abovementioned purposes are service providers, subcontractors, clients, and/or government agencies who will need to know your personal information for legitimate business purposes. Service providers or subcontractors may include providers for marketing and advertising, recruitment, health and life insurance, background checks, clinic management, external payroll, banks (payroll), engagement partners, data analytics, actuarial studies, financial audits, and other similar services which are utilized by the company to manage your recruitment, administer your benefits, conduct business activities and perform other employment-related functions.

4. How do we keep personal information secure?

Everise takes appropriate measures to protect personal information consistent with applicable privacy and data security laws and regulations, including requiring service providers to use appropriate measures to protect the confidentiality and security of personal information.

To keep your personal data secure, we have implemented the following security measures:

• a. Secure operating environments. We store your data in secure operating environments and only accessible to Everise employees, agents and contractors on a need-to-know basis. Everise also follows generally accepted industry standards in this respect.
• b. Encryption. We use industry-standard encryption to provide protection for information that is transmitted to us.
• c. Prior authentication for IT access and access to premises. We require our employees and contractors to verify their identity (e.g. through login ID and badges) before they can access IT resources and business premises to prevent unauthorized access.
• d. Audit. We audit the application of our security measures and ask third party experts to review our security controls against international standards to help us to further improve our security level.

Should a security breach occur that is likely to result in a risk to your privacy despite of our security measures, we will inform you and other affected parties, as well as relevant authorities, when required by applicable data protection law about the security breach as soon as reasonably possible.

5. How do we ensure data integrity?

Everise takes reasonable measures to establish that the personal information processed is relevant for its intended use and is accurate and complete for carrying out the purposes described in this Privacy Statement. It will retain personal information as long as it has a relationship with you.

If you accept an offer from Everise, and you have been successfully employed, your personal information will be retained for the duration of your employment with Everise and shall be deleted or destroyed after 10 years from your severance or separation from the Company. If your application was not further processed for employment for any reason, Everise shall retention your application and/or any Recruitment Documents for a period no longer than 2 years.

Unless, when otherwise requested by enforcement authorities and / or Everise HR or Legal Department, in cases where personal data show possible policy violation, criminal activity or incidents that require investigation.

After the contractual relationship ends, the company keeps your personal information for a period of 1 or 10 years depending on the nature of the data in accordance with the statutory period of limitations imposed by law or mandated by the company’s contractual relationships with third parties.

On the other hand, images captured by CCTV or security cameras in and around company premises are kept for three (3) months from date of recording, except when otherwise requested by enforcement authorities and/or the HR or Legal Department in cases where the recorded images show possible policy violation, criminal activity or incidents that require investigation.

6. What are your rights?

The company acknowledges your rights as data subjects. Hence, as an employee, you have the following rights over your Personal Data:

• a. Right to be informed. You have the right to be informed that your personal information will be, are being or were collected and processed by the company. You may also contact us to get confirmation that we are processing your personal information.
• b. Right to access. You may request that we provide you with a written description of information that we have about you as well as the purpose for holding or processing them. You may also request for a copy of your information which the company will provide in a commonly portable format (e.g. a printed copy of any soft copy files you have requested, or a photocopy of the document you are requesting) within a month from date the request was made.
• However, the company is not generally required to undertake endless and disproportionate searches for information in order to respond to a request and the company may refuse your request if:
• - the relevant personal information is not in the company’s possession or control;
• - the request is identical or similar to the one you have recently requested;
• - the request is obviously unfounded or frivolous;
• - harm would arise or likely arise from disclosure (for example, if disclosure would be likely to prejudice a criminal investigation or unduly prejudice someone’s commercial interests); or
• - other cases allowed by applicable law.
• In case your request is declined, we will provide you a formal notification indicating the grounds for declining your request. We may also direct you to access your Workday account where most, if not all, of your personal information are retained and stored.
• c. Right to withdraw consent. In case our processing is based on consent, you may withdraw the consent at any time by contacting us. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• d. Right to rectification or correction. You have the right to have inaccurate or incomplete personal information we store about you rectified or completed, provided that the information is not necessary for compliance with a regulatory obligation and to establish, exercise or defend legal claims. If such personal information has been disclosed to a third party in accordance with this Privacy Statement, then we shall also ask them to rectify or update your personal information.
• e. Right to object to or restrict processing. In case our processing is based on our legitimate interest to run, maintain and develop our business, you have the right to object at any time to our processing. We shall then no longer process your personal information unless there are other compelling legitimate grounds for our processing that override your interests, rights and freedoms, or it is necessary to establish, exercise or defend the company’s legal claims or support its obligations. This right may be exercised upon discovery and substantial proof that personal information was obtained or processed unlawfully.
• f. Right to data portability. As mentioned above, you have the right to receive your personal information from the company in a structured, commonly used and machine-readable format and to independently transmit the data to a third party, in case our processing is based on user’s consent and carried out by automated means.
• g. Right to erasure. You have the right to have personal information we process about you erased from our systems if the personal information is no longer necessary for the purposes specified in this Privacy Statement. Upon your request, we will also erase information when you withdraw your consent or object to our processing, unless we have a legitimate ground to retain the data. We may not immediately be able to erase all residual copies from our servers and backup systems after the active personal information have been erased. Such copies shall be erased as soon as reasonably possible.
• h. Response Timing and Format. We shall endeavor to respond to a verifiable consumer request within 30 days of its receipt. If we require more time (up to another 30 days, or up to 2 further months if under GDPR), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically determined by the method of submitting the verifiable consumer request. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a reasonable or nominal fee to defray administrative and miscellaneous costs, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
• i. Discrimination. The California Consumer Privacy Act as amended by the California Privacy Rights Act prohibits us from discriminating against you in any way should you exercise any of the rights set forth above.
• j. Limit Use and Disclosure of Senstive Personal Information. If we collect any sensitive personal information about you, you have the right, at any time, to direct us to limit its use to that which is only necessary to perform the services or provide the goods that you reasonably expect.
• If we use or disclose your sensitive personal information for purposes other than those specified herein we shall provide you with a notice, that such information may be used, or disclosed to a service provider or contractor, for additional, specified purposes and that you have the right to limit the use or disclosure of your sensitive personal information.
• If you do not want us to use or disclose your sensitive personal information for any other purpose, we shall not do so unless you subsequently provide consent for the use or disclosure of your sensitive personal information for additional purposes.
• A service provider or contractor that assists Everise in performing any data processing may not use the sensitive personal information after it has received instructions from Everise and to the extent it has actual knowledge that the personal information is sensitive personal information for any other purpose. A service provider or contractor is only required to limit its use of sensitive personal information received pursuant to a written contract with Everise in response to Everise instructions and only with respect to its relationship with Everise.
• k. Right to Opt-Out from the Sale or Sharing of Personal Information. If you subscribe to the company’s website, you may receive emails containing promotional ads and other business related materials. You have a direct right to opt-out from the sale or sharing of your personal information and to refrain from doing so in the future. We will act upon your request to opt-out within 15 days from the date that you submit the request without need of verification. However, we may deny the request if we have a good-faith, reasonable and documented belief that the request is fraudulent. If we deny the request on this basis, we will notify the requesting party and provide an explanation why we believe the request is fraudulent.

To exercise any of the above-mentioned rights, please send us a letter or email to the address set out in Section 11, or by filling out the form at https://everise.privacy.saymine.io/Everise. In exercising your request, you should include the following information: name, address, phone number, email address and a copy of a valid proof of identity. We may request additional information necessary to verify your identity within a reasonable or reasonably high degree of certainty by verifying at least two to three pieces of personal information previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you may be required to submit a signed declaration under penalty of perjury stating that you are the individual whose personal information is being requested. We may also reject requests that are unreasonably repetitive, excessive or manifestly unfounded.

For verified opt-out requests, the company will comply with such requests from you twice within a 12-month period. Each such request must cover the twelve months preceding the request.

7. Authorized Agent

You may use an authorized agent to submit a request to know, delete or opt out of sales on your behalf.

If you use an authorized agent to submit a request to know or request to delete, we may require that: (1) the authorized agent provide proof of your written permission; and (2) you verify your identity directly with us. These requirements do not apply if you have provided the authorized agent with a power of attorney pursuant to California Probate Code sections 4000 to 4465.

If you use an authorized agent to submit a request to opt out of sales or sharing of your personal information, you will need to provide that authorized agent with written permission to do so and submit written proof to us that the agent has been authorized to act on your behalf.

8. Shine the Light Act

We do not disclose personal information obtained through our site or services to third parties for their direct marketing purposes. Accordingly, we have no obligations under California Civil Code § 1798.83.

9. What are your obligations?

In conjunction with your rights, you have a responsibility to keep your personal details accurate and up to date, which can be done through Workday, other office systems, and usual communication channels (e.g. Outlook, MS Teams). You should notify the appropriate channels of any changes to your personal information.

10. Any Updates?

We may amend this Data Privacy Statement from time to time and the updated version shall apply and supersede any and all previous versions. You will be asked to acknowledge that you have read and understood each updated version of this Privacy Statement via Workday.

11. Where do I go if I have questions about this Privacy Statement?

If you have concerns about how the company processes personal information or if you have any questions about this Privacy Statement, please contact:

Rev 19 March 2024

Acknowledgment & Consent Form

I hereby certify that the personal information I provide to the company is true, correct and accurate. I agree to keep such information up to date and to inform the company via Talent Acquisition of any material changes to my personal information or that of relevant third parties in connection with my application. I also agree to inform my individuals whose personal information I provided to the company about the content of this Privacy Statement and to obtain their consent for the use (including transfer, sharing and disclosure) of their personal information by the company, as my employer, as set out herein.

I hereby consent and authorize the company to collect, record, store, retain, and process my data for the purposes indicated herein. I acknowledge that I have read, understood and/or have been duly informed of the Data Privacy Statement and my responsibilities herein, and I acknowledge my full compliance with it.

Should my application be further processed for employment, I further agree to follow applicable law and comply with company polices, standards and procedures that apply to personal information which I may handle or process or to which I have access in the course of my employment with the company. In particular, I will not access or use such information for any purpose other than in connection with and to the extent necessary with my work in accordance with company policies.

I acknowledge that I am required to treat such information as strictly confidential at all times and that my obligations continue to exist even after the termination of my employment with the company.

I understand that any violation of the terms of this acknowledgement may result in disciplinary measures up to and including termination of my employment with Everise or appropriate legal action.

I further agree that my acknowledgment of this Data Privacy Statement in Workday or through any official means sent to me by the company constitutes as my explicit consent to abide by the contents of this policy.

The following companies (with corresponding location) are affiliated with Everise:

• (1) Everise, Inc., USA
• (2) Everise Labs, LLC, USA
• (3) Everise Guatemala, Limitada., Guatemala
• (4) Everise Colombia S.A.S. Colombia
• (5) Everise Holdings Pte. Ltd., Singapore (“Everise”)
• (6) Everise Malaysia BPO Services Sdn Bhd., Malaysia
• (7) Everise Labs Ireland Limited, Ireland
• (8) Everise (India) BPO Services Private Limited, India
• (9) Everise Philippines Ltd., Philippines branch office
• (10) Other companies that may be controlled by Everise or under common control with Everise or that control Everise now or in the future.