Stack Candidate Data Protection Notice and Privacy Policy

1. What personal information do we collect and use?

We collect personal information at various stages during our recruiting relationship with you, such as when you apply for a role with Stack, and when we create a personnel file or engagement record. If you do not provide the personal information we request from you, we may not be able to evaluate your job candidacy or hire you. In connection with our recruiting and hiring relationship with you, we may collect the following types of personal information:

• basic information (e.g., name, work and home contact details);
• government identification or immigration details as required to comply with our obligations under law (e.g., date of birth, gender, identification numbers, passport data, residency, work permit);
• talent management information (e.g., degrees, licenses, trainings, professional references, work experience, job titles and duties, seniority, educational history, any role or roles for which you are applying or being considered, and other information about yourself that you provide in a CV or similar document);
• background information such as the results of pre-employment assessments and questionnaires;
• system-generated application insights, including automatic resume parsing data, skill extraction, candidate match scores, and qualification summaries derived by recruiting software;
• commercial information such as records of travel expenses for in-person interviews;
• internet activity information such as interactions with Stack’s website or job boards and publicly available social media activity;
• location-related data (e.g., office and room location for on-site interviews, CCTV, IP address)

We may also collect, under certain circumstances and to the extent permitted by local law, sensitive personal information which is a subset of personal information. Sensitive personal information varies under applicable law but generally includes information about your ethnicity, health, trade union membership, religious beliefs, and sexual orientation. Local data protection laws may include additional categories of personal information that constitute sensitive personal information. We sometimes need to collect sensitive personal information to manage certain activities in connection with our recruitment activities generally and our recruiting interactions with you, specifically. For instance, we may collect health information to manage a physical accommodation if you are coming onsite to interview or to facilitate a virtual interview. We may also collect information about ethnicity to monitor and maintain our diversity commitments (where permitted by law). In addition, where permitted by applicable law, we collect data related to criminal offenses or proceedings to perform background checks or to investigate behavior that may go against Stack’s values or violate Stack’s policies, professional standards, or law.

2. Where do we collect your personal information?

We collect your personal information from a variety of sources. We get our information from you, for example, in your job application, forms you fill out for us, assessments you complete, surveys you submit, and any other information you provide during the course of your application and interview process with us.

We also collect information from:

• what’s internally generated, for example, we may generate charts, summaries, memos, or notes when evaluating your job candidacy;
• our affiliated companies (e.g., if you are a current employee seeking a company-to-company job transfer);
• service providers (e.g., recruiters, staffing agencies, job boards, etc.);
• third parties (e.g., job references, affiliated companies, professional employer organizations);
• public internet sources (e.g., social media, job boards, and other public online sources);
• public records or public authorities, for example, court records and credentialing and licensing organizations; government agencies; law enforcement;
• recording and automated technologies implemented by Stack, for example, to track logins and activity across our network; video surveillance in common areas of our facilities; Bluetooth technologies, voicemail, webcams, audio recording technologies; and
• companies we acquired (where you previously worked).

If you disclose any personal information relating to other people to us, you represent that you have the authority to do so and to permit us to use the information in accordance with this Notice.

3. Why and how do we use your personal information?

We use your personal information for the following purposes:

• managing the application and recruitment process, assessing you for employment or other engagement;
• Utilizing technology tools, including applicant tracking software and artificial intelligence and machine learning algorithms, to assist in parsing resumes, extracting relevant work experience information, and highlighting qualified candidates based on criteria defined by our recruiting teams;
• conducting a pre-employment or criminal history background check (subject to applicable law), checking your honesty, integrity and reputation, competence, capability and financial soundness, conducting a fit-for-duty examination;
• monitoring and improving our recruitment process and for related purposes (which may, where permitted by local law, include equality of opportunity monitoring);
• training purposes or quality assurance with respect to Stack’s employees conducting the interviews or otherwise assisting with the recruiting and application process;
• honoring contractual obligations;
• managing travel, expenses, and reimbursements;
• protecting Stack’s legal rights, including assessing compliance with policies and procedures, monitoring telephone, email, internet and other company resources, conducting investigations including reporting of allegations of wrongdoing, policy violations, fraud, or financial reporting concerns;
• monitoring, safeguarding, and managing IT infrastructure and office facilities;
• complying with legal and other requirements applicable to our businesses in all countries in which we operate, including record-keeping and reporting obligations, conducting audits, compliance with government inspections and other requests from government or other public authorities, responding to legal process such as subpoenas, pursuing legal rights and remedies, defending litigation, and managing any internal or external complaints or claims (including those received through the company hotline or e-mail).

If you are unsuccessful in your application and you choose to consent for us to do so, we may use your personal information to assess your suitability for future positions and roles within Stack.

Stack processes your personal information to comply with our responsibilities as a company that is recruiting and evaluating potential employees, to comply with our legal obligations, to protect life or physical safety, and based on our legitimate interest to operate and protect our business (unless your fundamental rights outweigh our interests). In certain instances, we may process personal information based on your consent if (i) consent to the processing described in this Notice is required by local law, (ii) the processing involves sensitive personal information, or (iii) the specific processing activity does not align with the purposes described above. Subject to applicable law, some processing may also be necessary so that we can perform a contract with you or because it is required by law.

Monitoring tools and automated processes

Stack uses monitoring tools to ensure compliance with company policies, assist with our legal, regulatory, and recordkeeping and reporting obligations, safeguard sensitive and confidential information, prevent and address misconduct, maintain network security, and protect our legitimate interests. Such tools include for example: (i) monitoring technologies to capture on-screen and network activity, track location data (e.g., for information security and tax purposes), continually backup corporate data (including our communications with you); (ii) supplier and enterprise risk management technologies to ensure compliance with internal policies and procedures and regulatory obligations; (iii) analytical technologies to track use of company resources, manage travel and expenses, monitor financial transactions, conduct internal investigations, respond to compelled disclosures (e.g., subpoenas, litigation).

Stack uses technology features, including artificial intelligence (AI) and machine learning capabilities integrated within our applicant tracking platforms to assist our recruiting team in parsing resumes, identifying matching candidate skills, and prioritizing applicant pipelines. These features function strictly as assistive tools for human recruiters. Stack does not engage in candidate profiling that produces legal or similarly significant effects, nor do we make hiring, advancement, or rejection decisions based solely on automated decision-making without human intervention. All final evaluations and personnel decisions are made directly by human hiring managers and recruiting personnel.

4. With whom do we share your personal information?

We disclose personal information to personnel and departments throughout Stack and certain Stack affiliates (including SoftBank Group entities) to fulfill the purposes described in this Notice. Access to personal information within Stack will be limited to those who have a need to know the information, including potential managers and their designees, and personnel in POPs, Enterprise Infrastructure and Engineering (“EIE”), Compliance, Legal, Finance, and Accounting.

Stack will need to make personal information available to unaffiliated third parties such as our suppliers and service providers that we have engaged at the local or global level to assist us in our recruiting efforts (e.g., candidate database and management software and recruitment agencies); our legal and professional advisers; third parties in relation to compelled disclosures (e.g., subpoenas); and government authorities (e.g., in the U.S., the Equal Employment Opportunity Commission as required for reporting; the California Civil Rights Department (formerly California Department of Fair Employment and Housing) as required to respond to employment claims and charges).

In connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of Stack or any of its subsidiaries or affiliates, your personal information may be transferred to the acquiring person or entity.

We may also disclose personal information with your consent, which you may withdraw at any time.

5. Transfers of your personal information outside the country in which you are located

Some recipients of your information will be located outside your state or home jurisdiction, including any country in which we or they have operations (e.g., United Kingdom, Japan). We take appropriate measures to protect personal information that are consistent with applicable privacy and data security laws and regulations, including requiring service providers to implement technical and organizational measures to protect personal information, entering into data processing and transfer agreements (including applicable standard contractual clauses where legally appropriate).

6. How long do we retain your personal information?

Stack will not retain your personal information for longer than is necessary in relation to the purposes for which your personal information is processed. The criteria used to determine our retention periods are:

• The duration of your application and recruitment process;
• As required by a legal obligation to which we are subject; and
• As advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations).

Subject to applicable law, some personal data will be retained after the application and recruitment process ends, either because you are employed or otherwise engaged by us, or because your application was withdrawn or unsuccessful.

7. Your rights in relation to the personal information we process about you

If you are a resident of California, you may have certain rights related to your personal information, including the right to:

• know what personal information Stack has collected about you;
• request access to your personal information;
• correct your inaccurate, incomplete, or outdated personal information;
• restrict the processing of sensitive personal information;
• delete your personal information under certain circumstances;
• request a manual review of your job application and opt out of AI-assisted candidate matching tools; and
• port your personal information.

To the extent that we process your sensitive personal information based on your consent, you also have the right to withdraw your consent at any time.

You can seek to exercise your data privacy rights (where applicable) by contacting us at legal@stackav.com or by using the candidate AI opt-out feature provided on our job application pages.

To help protect your privacy and security, we will verify and respond to your request consistent with applicable law, taking into account the nature of the request and the applicable circumstances. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by applicable law. Please note that, depending upon the circumstances and the request, we may not be permitted to provide you with access to your personal information or otherwise fully comply with your request.

8. Security

We will take organizational, technical, and administrative measures against unlawful or unauthorized processing of your personal information, and against the accidental loss of, or damage to, your personal information. Your personal information is stored in a secure manner on protected equipment.

9. Your data protection authority

If you are a resident of California, you may have the right to lodge a complaint with the California Privacy Protection Agency (https://cppa.ca.gov/).

10. Questions or complaints

If you have any questions or complaints regarding Stack’s processing of your personal information, please contact us at legal@stackav.com.

11. California Supplement

If you are a California resident, this Notice should be read in conjunction with the California Supplement provided at the end of this document.