This Applicant and Candidate Data Privacy Notice (this “Notice”) explains:

• What personal data we collect during our application and recruitment process and why we collect it;


• How we use that personal data;


• How to access and update that personal data;

As a controller of personal data, we are responsible for deciding how we process personal data about you. We will only process your personal data in accordance with applicable law including the Cayman Islands Data Protection Act (Revised) (the “DPA”) and the EU General Data Protection Regulation (“EU GDPR”), if applicable, together, the “Data Protection Laws”.

Your use of our services is governed by our general User Agreement and Privacy Policy found on our website.

This Notice does not form part of any offer of employment or an offer to engage you as a contractor or in any other capacity, and we may amend it at any time to reflect any changes in the way in which we process your personal data. If you are in the application process when any changes are made to the way we process your personal data, we will bring this to your attention. We may also notify you in other ways from time to time about the processing of your personal data.

Types of personal data we collect

“Personal data” is any information about a living individual from which they can be identified such as name, ID number, location data, any online identifier (such as IP address), or any factor specific to the physical, physiological, genetic, mental, economic or social identity of that person. It does not include data where any potential identifiers have been removed (anonymous data) or data held in an unstructured file.

There are “special categories” of more sensitive personal data which are more private in nature and therefore require a higher level of protection, such as biometric data, race or ethnic origin, and physical or mental health. or condition (please see section 3 of the DPA and Article 9 of the EU GDPR for a complete list of such special categories of personal data). 

When we refer to “processing”, this means anything from collecting, using, storing, transferring, disclosing, altering or destroying personal data.

This Notice covers personal data you share with us and/or which may be acquired or produced by CoinPayments Inc., Star Ventures, UAB, PaidInSatoshi Inc. or Symbio Technologies Ltd. SEZC (trading as CoinPayments where applicable), (referred to as “we”, “us”, “our”) and their respective current and future parent companies, subsidiaries, affiliates and companies under common control during the application or recruitment process including:

• Your name, address, email address, telephone number, place of residence and other contact information;


• Your resume or CV, cover letter, previous and/or relevant work experience or other experience, education, transcripts, or other information you provide to us in support of an application and/or the application and recruitment process;


• Information from interviews and phone-screenings you may have, if any;


• Transcripts, interview summaries, notes and other recruitment materials generated or prepared using AI-assisted tools and, where applicable, audio or video recordings of recruitment interviews or meetings;


• Voicemails, emails, correspondence, and other communications created, stored or transmitted by you on or to our computer or communications equipment in order to progress the application through the recruitment process;


• Details of the type of engagement or employment you are or may be looking for, current and/or desired compensation or salary and other terms relating to compensation and benefits packages, willingness to work remotely, relocate, or other job preferences;


• Details of how you heard about the position you are applying for;


• Any sensitive and/or demographic information processed during the application or recruitment process such as gender, information about your citizenship and/or nationality, medical or health information and/or your racial or ethnic origin;


• Network and information security data in order for us to take steps to protect your information against loss, theft or unauthorized access;


• Video footage of you onsite in our building reception area if applicable for security reasons, for the protection of our property and for health and safety reasons;


• Reference information and/or information received from background checks including credit, criminal, sanction and financial background checks (where applicable), including information provided by third parties;


• Information relating to any previous applications you may have made to us and/or any previous work history with us;


• Your information from publicly available sources, including online, that we believe is relevant to your application or a potential future application (e.g. your LinkedIn profile);


• Information related to any assessment you may take as part of the interview screening process.

Why and on what legal basis do we use your personal data?

a. To comply with our legal and regulatory obligations

We use your personal data to comply with our legal obligations or exercise legal rights conferred upon us. This may include:

• To verify the elements necessary for identity control and conduct identity checks;


• To perform background checks including credit, criminal, sanction and financial background checks on candidates if the role requires it and where we have a legal right or reason for doing so;


• Where requested by you, assisting you with obtaining an immigration visa or work permit where required;


• To implement a system for handling professional alerts;


• To comply with regulation relating to sanctions and embargoes;


• To create, exchange and submit reports as required under any local laws and/or regulations, where applicable or report information or reply to official requests from a duly authorized local or foreign financial, tax, administrative, criminal or judicial authorities, arbitrators or mediators, law enforcement, state agencies or other governmental or public bodies;


• To comply with applicable laws, regulations or legal processes;


• To maintain security e.g., to ensure network and information security, including protecting us against malicious and inadvertent data security breaches.

b. To take steps at your request prior to entering into a possible contract with you

We use your personal data to conduct the recruitment process to enter into and perform your possible contractor or employment contract, including:

• To select and to analyze applications and professional skills (pre-selection of applications);


• To assess and to verify your abilities, skills, professional skills and interest for the target role (conducting interviews, face-to-face or remote; conducting tests and evaluation);


• To communicate with you about the current recruitment process and your application;


• To use data collected during the recruitment phase for human resources management purposes for selected candidates.

c. To fulfil our legitimate interest

We also collect and process your personal data to pursue our (or a third party's) legitimate interests as a business. This may include:

• Communications with you about the recruitment process and/or your application(s), including, in appropriate cases, informing you of other potential work opportunities with us;


• To offer you work or employment opportunities related to your skills;


• To inform you of activities or events of interest (such as forums or fairs, conferences or thematic meetings);


• To establish a CV/resume-bank for the purpose of researching and identifying candidate profiles;


• To manage recruitment and mobility through the performance of personality tests, personality, matching of personality, comparison your test result to standard test result;


• To manage our platform for job applications;


• To proactively conduct research about your educational and professional background and skills and contacting you if we think you would be suitable for a role with us;


• To check professional references;


• To verify your information and carry out reference checks and/or conducting background checks including credit, criminal, sanction and financial background checks where applicable and where we have a legal right or reason for doing so;


• To implement a system for handling professional alerts;


• To manage inquiries and surveys;


• To access information from your social network profile (e.g., LinkedIn) when it is public and is authorized by terms and conditions of the social network;


• To prepare aggregated statistics and conduct aggregated or, where appropriate, anonymised analytics to understand and improve our application and recruitment processes, and to implement administrative tools such as chatbots where appropriate.


• To conduct data analytics studies to review, better understand and monitor our recruitment procedures;


• To ensure security of our network, systems, buildings, in particular systems protection;


• To prevent, detect and manage fraud, bribery and money laundering and financing terrorism;


• To monitor and keep record keeping of phone calls and communication (including voice over IP), of electronic communications (such as e-mails, chats emails, SMS) in order to comply with our code of conduct and foreign legal and regulatory obligations to which we are subject;


• To manage our defense of legal claims and litigation;


• To ensure we recruit the best candidates;


• To protect our rights and property, our users, applicants, candidates, contractors, employees or the public as required or permitted by law.

d. To respect your choice if we requested your consent for a specific processing

For certain processing activities, we may provide additional information and ask for your consent. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. We do not currently make recruitment decisions based solely on automated processing that produces legal effects or similarly significantly affects candidates. If we propose to introduce such processing, we will first assess its lawfulness and provide any additional information required by applicable law, including information about the logic involved, significance and envisaged consequences, and applicable rights and safeguards.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.

Data sharing and who may have access to your personal data

• Your personal and special categories personal data may be accessed by the relevant individuals internally or externally to facilitate the hiring, recruitment or onboarding process. This includes recruitment and the HR team involved in the hiring, recruitment or onboarding process; managers; consultants; advisors; and/or other appropriate persons who may be involved in the recruitment or onboarding process for the role(s) you are applying for.


• We may share your personal data and special category personal data with current or future parent companies, affiliates, subsidiaries and with other companies under common control or ownership. Such entities may use your personal data in relation to the purposes described above and as part of our usual reporting requirements, in the context of a business reorganization or group restructuring exercise, a possible sale of all or part of our assets or business, for systems support and hosting of data.


• If you have been referred for a position with us by someone who currently works with us, with your consent, we may inform that person about the progress of your application and let that person know the outcome of the process. In some cases, if it is identified that you have attended the same university/school or worked with someone who currently works with us or who we know we may consult with that person for feedback on you.


• We may share your personal and special categories personal data with:


• Service providers acting on our behalf to perform some of the services described above including for the purposes of the verification / background checks. These service providers may be located outside the country in which you live or the country where the position you have applied for is located;


• Our IT service providers in order to support, maintain and host our information systems, including the software and hardware infrastructure required for it to operate/be accessible online and to keep a backup of your personal information. We also use online IT service providers to provide contract execution services;


• Providers of approved AI-assisted, transcription, document-processing and recruitment-administration tools;


• Our legal and other professional advisors (including accounting and audit services) to provide us with advice in relation to our business, including our legal, financial and other obligations and claims;


• Recruitment agencies to assist with recruitment into our organization;


• Employee benefit providers for employee benefits to be provided, if applicable;


• Occupational health providers for working capacity of worker to be assessed, if applicable;


• To external third parties such as to local labour authorities, courts and tribunals, regulatory bodies and/or law enforcement agencies for the purpose of complying with applicable laws and regulations, or in response to legal process;


• With other third parties if we have your consent (for example if you have given us permission to contact your referees); and


• With other third parties to detect, prevent or otherwise address fraud, security or technical issues, or to protect against harm to our rights, property or safety, our users, applicants, candidates, contractors, employees or the public or as otherwise required by law.

We may obtain personal data and/or special category personal data about you from third party sources, such as recruitment agencies, job boards, recruitment assessment centers, occupational health professionals and background check providers. Where we receive such information from these third parties, we will only use it in accordance with this Notice. In some cases, they will be acting as a controller of your personal data and therefore we advise you to read their privacy notice and/or data protection policy.

Apart from personal data relating to you, you may also provide us with personal data of third parties, notably your dependents, other family members or references, for purposes of HR administration and management. Before you provide such third party personal data to us you must first inform these third parties of any such information that you intend to provide to us and obtain their consent to the processing to be carried out by us, as detailed in this Notice before providing their personal data to us.

International transfer of personal data

We operate globally, which means your personal data may be stored and processed outside of the country or region where it was originally collected. In some of these countries, you may have fewer rights in respect of your personal data than you do in your country of residence. Regardless of where your personal data is processed, we apply the same protections described in this Notice. If we must transfer your personal data to countries which do not provide equivalent data protection standards, we will ensure that we will either rely on a derogation applicable to the specific situation or have in place appropriate safeguards in accordance with applicable Data Protection Laws.

Data security and storage

We have put in place appropriate technical, physical and organizational measures in order to keep your personal data secure and to maintain the confidentiality, integrity and availability of your personal data.

Our retention of your information

We keep your personal data and special category personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

If you apply for a position with us and your application is unsuccessful (or you withdraw from the process or decline our offer), we will retain your information for a period of 12 months after your application. We retain this information for various reasons, including in case we face a legal challenge in respect of a recruitment decision, to consider you for other current or future roles with us and to help us better understand, analyze and improve our recruitment processes. If you are offered and accept a role with us or engaged by us in any capacity, the information collected during the application and recruitment process will become part of your work record with us.

If you do not want us to retain your information for consideration for other roles, or want us to update it, please contact us at privacy@coinpayments.net. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

Your duties

We encourage you to ensure that the personal data that we hold about you for the purposes of your application or for the purposes of considering you for any similar roles is accurate and up to date by keeping us informed of any changes to your personal data. You can contact us at privacy@coinpayments.net to update your details.

Your rights in respect of your information

You are entitled to request access to your personal data that we hold about you at any time. This is known as a data subject access request. In most cases, we will respond to any such request within one calendar month. However, we are permitted to extend this timeframe by an additional two months where your request is complex or numerous in nature. We may also charge a reasonable fee based on our administrative costs where your request is manifestly unfounded, excessive or a request for further copies. Alternatively, we may refuse to comply with the request in such circumstances.

Under certain circumstances, by law you also have the right to:

• have your personal data corrected where it is inaccurate;


• have your personal data erased where it is no longer required. Provided that we do not have any continuing lawful reason to continue processing your personal data, we will make reasonable efforts to comply with your request;


• have your personal data transferred to another organization in an appropriate format where we process that data in reliance on your consent and the processing is carried out by automated means;


• withdraw your consent to processing where this is our lawful basis for doing so;


• restrict the processing of your personal data where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings;


• to object to the processing of your personal data, where we rely on our legitimate interest as a lawful basis for the processing of your data. If we are unable to demonstrate legitimate grounds for the processing of your data which override your interest and rights we will stop processing your data. Otherwise, we will provide you with our justification as to why we need to continue using your data.

The way we process your personal data and the lawful basis on which we rely to process it may affect the extent to which these rights apply. If you would like to exercise any of these rights, please contact us at privacy@coinpayments.net.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. In certain circumstances, we may need to also clarify your request.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. You can withdraw your consent by contacting us at privacy@coinpayments.net. Unless there is another lawful basis under which we are processing this data, once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to. If you withdraw your consent, our use of your personal data which was collected before your withdrawal is still lawful.

If you are concerned about the way we are processing your personal data, you should raise your concerns with us in the first instance. If you remain dissatisfied in the way we have handle your complaint, in certain countries, you will be able to raise any questions or concerns you have regarding your personal data with your local data protection authority.

Use of AI-assisted tools in recruitment

We may use artificial intelligence or machine-learning-enabled tools (“AI Tools”) to support certain administrative aspects of our recruitment process. These tools may be used to generate draft interview transcripts and summaries and to extract, organise or summarise factual information contained in CVs, applications and other recruitment materials.

AI Tools may process personal data provided during recruitment (“Candidate Data”), including application information, CVs, correspondence, interview recordings, transcripts and notes. AI-generated outputs may be inaccurate, incomplete or inconsistent. Relevant outputs are reviewed by our recruitment team against the underlying recruitment materials and may be corrected, supplemented or disregarded.

Human decision-making

AI Tools support, but do not replace, human judgment. We do not rely on AI-generated outputs to decide whether to shortlist, interview, progress, reject or make an offer to a candidate. Recruitment decisions are made by authorised individuals who review the candidate’s original materials and exercise independent judgment.

Within the recruitment processes described in this Notice, we do not use AI Tools to make solely automated recruitment decisions or to automatically reject, rank, score or filter candidates. We also do not use them to infer candidates’ emotions or sensitive characteristics or to perform biometric identification.

Interview transcription

Where an interview may be transcribed or, where applicable, audio or video recorded, we will inform the candidate before enabling the relevant functionality and ask for the candidate’s consent.

Live transcription involves the real-time processing of interview audio even where no audio or video recording is retained. If the candidate does not agree, the relevant functionality will not be enabled and, where reasonably practicable, an alternative such as human note-taking will be used. Candidates will not be disadvantaged solely because they decline transcription or recording.

AI training and provider processing

Where supported by our AI providers, we configure the relevant AI services so that Candidate Data and other data submitted by us are not used to train or improve general-purpose AI models.

AI providers and their authorised subprocessors may process and retain data in accordance with their applicable service terms, data processing agreements, security and abuse-monitoring practices, documented service configurations and legal obligations. This may include processing necessary to provide, host, secure, maintain or troubleshoot their services and to detect or prevent fraud, misuse or security threats.

Lawful basis and sensitive information

We generally use AI Tools on the basis of our legitimate interests in efficiently and securely administering recruitment, maintaining appropriate records and reducing administrative work, balanced against candidates’ rights and interests. We rely on consent where required by applicable law. Other legal bases described in this Notice may also apply.

Candidates should not provide sensitive or special-category personal data unless specifically requested and necessary. If such information is incidentally included in recruitment materials or AI-generated outputs, we will process it only where permitted by applicable law and may redact, restrict or delete information that is not required.

Retention

We retain interview recordings, AI-generated transcripts, summaries and related Candidate Data in accordance with the retention periods described in the “Our retention of your information” section of this Notice. In particular, information relating to an unsuccessful application is generally retained for 12 months after the application, subject to the exceptions described in that section.

A recording created solely to prepare a transcript or summary may be deleted when it is no longer reasonably required for that purpose. AI providers may retain limited copies in backups or for security, abuse-monitoring or legal-compliance purposes in accordance with their applicable terms and data processing agreements. Such copies may remain subject to restricted access until deleted or anonymised through the provider’s ordinary retention cycle.

Candidate rights and changes to our use of AI

Subject to applicable law, candidates may contact us to ask whether an AI Tool was used in relation to their application, request access to or correction of their personal data, object to processing based on legitimate interests, withdraw consent where applicable.

We may change providers or update AI functionality where the purposes, categories of data and risks remain materially consistent with this section. Before introducing materially different uses, such as candidate scoring, ranking, filtering, suitability evaluation or automated recruitment recommendations, we will conduct appropriate assessments and update this Notice or provide additional information where required.

Questions

If you have any questions about any matter relating to the processing of your personal data, please contact us at privacy@coinpayments.net.