Candidate Privacy Policy

How we handle your personal data during recruitment

This policy explains how Verda collects and uses personal data when you visit our Career Site, apply for a role, or are considered for one. For all other matters please refer to Verda’s general privacy policy.

Effective date: November 6, 2026

At a glance

A short summary. It does not replace the full policy that follows.

What this policy covers. It tells you how we handle your personal data when you interact with our recruitment, whether you visit our Career Site, apply, connect with us, are sourced or referred, or act as a reference for someone.

Who we are. Verda is the controller of your data. You can reach our Data Protection Officer at [email protected].

What we collect. What you give us (such as your contact details, CV and application), what we create (such as interview notes and assessments), and, for some candidates, information from third parties, such as public professional sources or from people who refer you.

Why do we use your data? To run a fair recruitment process and to consider you for current and future roles. Usually this is our legitimate interest; sometimes we rely on your consent.

Is AI used for decision-making? No. We may use technology to assist with applications, but a qualified person always makes the decision about your application.

Who sees your data? Only the people involved in the relevant hiring decision, on a need-to-know basis, plus trusted providers such as our recruitment platform, acting under contract.

How long do we keep your data? If you are not hired, we keep your application data for 12 months after our decision, or up to 24 months if you consent to being considered for future roles. Section 10 has the details.

Your rights. You can access, correct or delete your data, object to processing, withdraw consent, and complain to a regulator. Section 11 has the details.

1. About this policy and who it covers

Verda Cloud Oy and its group entities (“Verda”, “we”, “us”, “our”) manage employer branding and recruitment through our Career Site and a related applicant tracking system. This policy explains how we process your personal data as a controller, and what rights you have related to your personal data. We are committed to handling your data lawfully, fairly and transparently.

We are the sole data controller for application related data. The information you submitted as part of your application is processed through our recruitment platform, which acts as a data processor for our recruitment activities.

This policy covers Visitors to our Career Site; Candidates who connect with us (Connecting), apply (Applying), are identified (Sourced) or are recommended to us (Referred); and References named by a candidate.

2. About personal data

Data protection laws govern how we may process your personal data. Depending on where you are located and the circumstances of your application, different privacy laws may apply to you. These include the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”), and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). Where a specific law gives you additional rights or requires different handling, this is explained in the relevant section of this policy.

KEY TERM Personal data: Any information that can be linked, directly or indirectly, to a living person, such as your name, email address, telephone number, IP address, date of birth and information about your career. Information that cannot be linked to your real identity is not personal data.

KEY TERM Processing: Anything done with personal data, such as collecting, creating, analysing, sharing or deleting it.

3. What personal data we might process

3.1 For all individuals

• Cookies, device and usage data. When you visit our Career Site, and where you accept them or they are strictly necessary, we use cookies and collect information about your device and how you use the site, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, approximate geographic location, operating system and device settings, and which pages you visit. See our Cookie Policy for details.
• Communications data. Your communications with us and their content, such as emails, messages, survey responses, and information you add to your account. This can include interview recordings, transcripts where you have consented.
• Contact details. If provided, such as your name, email address, telephone number and postal address.

3.2 For candidates

• Recruitment process data. Such as interview notes, assessments and tests, and salary expectations.
• Application information. Such as your CV, cover letter, work samples, references, letters of recommendation and education.
• Public profile information. Professional information from public sources, such as a professional networking profile or your current employer's website, when applicable.
• Information from references and referrals. Information from people who refer you, or from those you list as references.

3.3 Sensitive data, and what we do not collect

KEY TERM Special category (sensitive) data: Data needing extra protection under the GDPR, such as data revealing health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, and genetic or biometric data.

WHAT WE DO NOT COLLECT We do not ask for special category data as part of recruitment, and we ask that you do not include it in your CV or application. If you need reasonable accommodations to take part in our recruitment process, we use that information only for facilitating equal participation in the recruitment process, and only with your consent.

4. Where we get your data from

• Directly from you. Most information comes from you, for example when you apply or connect with us. You can choose not to provide some information, but we may then be unable to process your application or give you what you asked for.
• From the Career Site. Technical and device information when you use the site.
• From sourcing services. Professional information about Sourced Candidates from public sites, sourcing platforms and third-party agencies or services.
• From referrals. From our employees or partners, such as recruitment service providers, who think your profile fits a vacancy.
• From your references. Information about you from the references you provide.
• Data we create. Notes, assessments and evaluations created during the recruitment process, sometimes together with you.

5. Why we process your data, and our legal grounds

We process your data only where we have a valid legal ground under the privacy laws. The table below sets out our main purposes, who they affect, and the legal ground we rely on.

IMPORTANT Where we rely on our legitimate interest, we have weighed that interest against your rights and concluded that the processing is necessary and proportionate. Our legitimate interests, includes: finding, assessing and hiring suitable people efficiently; running a fair and consistent recruitment process; contacting the references you provide; verifying the information you give us and meeting our compliance requirements before making an offer; operating, securing and improving our Career Site and recruitment process, including through aggregated statistics; answering questions about our recruitment decisions; managing recruitment across the Verda group and in connection with corporate transactions; and establishing, exercising or defending legal claims. You can ask us how we made that assessment, and you can object (see Section 11). Where we rely on consent, you can withdraw it at any time.

6. How we use technology to review applications

We may use AI-enhanced tools to support and improve the assessment of candidates, but AI does not make decisions and does not automatically reject candidates. To manage application processes efficiently, we may use technology that helps source candidates, summarise application information, create highlights on specific experience or skills, facilitate workflows, automate communications, interview note-taking, among others.

These tools support our recruiters and hiring managers. They do not replace human judgement, and a qualified member of our team always reviews candidates and makes the final decision. Recruiters treat tool output as a starting point, and they can see and change it, based on their judgement.

IMPORTANT We do not make hiring decisions, or other decisions that have a legal or similarly significant effect on you, based solely on automated processing. There is always meaningful human involvement. Where we use AI tools to process your data, the AI providers act only on our instructions, we use enterprise services under contracts that prohibit the provider from using your data to train their models, and only for our own recruitment purposes. The tools have conducted bias tests and will be evaluated on regular basis.

You can ask for more information, request review or contest a decision, by contacting us at [email protected].

7. Who we share your data with

We share your data only where there is a clear purpose and appropriate safeguards, and we share the minimum necessary. Inside Verda, access is limited to the people involved in the relevant hiring decision, on a need-to-know basis. Data sent through our recruitment process is protected in transit using TLS encryption. We do not share your personal data with any unauthorised third-party recipients.

Subject to these controls, we may share your data with the following, among others:

8. International data transfers

We prioritise processing your data within the EEA.

Some of our service providers, or their parent companies or subcontractors, are located outside the EEA, and some recipients may be outside the EEA. In those cases your data is transferred outside the EEA.

KEY TERM Standard Contractual Clauses (SCCs): Model data protection contracts approved by the European Commission that safeguard personal data transferred to countries without an adequacy decision.

As Verda operates globally, we maintain entities across the EEA, the United Kingdom, the United States, and other regions. We may share your application and candidate information among our group companies to support recruitment, hiring, and administrative needs. For all transfers extending beyond the EEA, we rely on Data Processing Agreements and Intra-group Data Transfer Agreement. This framework incorporates the European Commission’s SCCs, the UK International Data Transfer Agreement (IDTA) and is supported by necessary technical and organisational safeguards.

IMPORTANT When we or our providers transfer your data outside the EEA, (or, for UK candidates, outside the UK), we use at least one of the following safeguards, in particular: an adequacy decision by the European Commission, including reliance on the EU-US Data Privacy Framework for certified US recipients and its UK Extension for transfers from the UK; the European Commission's SCCs and the UK IDTA, together with additional technical and organisational measures where needed. Every provider that processes your data for us is bound by a data processing agreement under Article 28 GDPR. Our group companies are bound by an intra-group Data Transfer Agreement that incorporates the SCCs and the UK equivalents. Where needed, we also carry out a transfer risk assessment and add technical and organisational measures.

You can ask us for more information about these transfers and the safeguards we use by contacting [email protected].

9. How we keep your data secure

We protect your data with a combination of organisational, technical and administrative measures, aligned with the certifications and compliance frameworks we maintain. These include encryption of data in transit and at rest, role-based and least-privilege access, monitoring, provider due diligence, and staff training. No system can be guaranteed completely secure, but we work continuously to protect your data and to detect and respond to incidents.

10. How long we keep your data

11. Your rights and how to exercise them

You can exercise your rights by visiting the Data and Privacy page on our Career Site, using the privacy settings in your candidate account, or contacting us at [email protected].

• Be informed. To know how we process your data, including if we plan to use it for a new purpose.
• Access. To know whether we process data about you and to receive a copy.
• Portability. To receive data you gave us, where we rely on consent or a contract, in a machine-readable format, and to have it sent to another recipient where technically feasible.
• Erasure. To have your data deleted, for example where it is no longer needed, you withdraw consent, or you object and there is no overriding reason to continue.
• Object. To object, on grounds relating to your situation, to processing based on our legitimate interest.
• Restriction. To ask us to limit our processing in certain situations, for example while we check a correction or an objection.
• Rectification. To have inaccurate data corrected and incomplete data completed.
• Withdraw consent. To withdraw consent at any time, without affecting processing that already took place.
• Complain. To complain to a data protection authority. In Finland this is the Office of the Data Protection Ombudsman. If you are in another EU country you may contact your national authority, and if you are in the UK you may contact the Information Commissioner's Office.

12. Updates to this policy

We review and update this policy at least annually, but more frequently when needed, for example if we start processing your data in a new way, want to make the information clearer, or need to take additional measures to comply with data protection law. The date of the latest version is shown at the top of this policy.

13. Contact

For any question, comment or concern about how we handle your personal data, or to exercise your rights, contact our Data Protection Officer at [email protected].

Verda Cloud Oy (Business ID 2886809-8, registered in Finland) is the primary data controller for the personal data collected under the hiring processes.

For particular roles, or jurisdictions you might contract with another Verda entity, which will control the data collected under that role specifically. Should contact details vary across group entities controlling or processing applications, the specific recruiting entity and its contact information will be provided in the relevant job information. Verda entities may share personal data with each other to conduct recruitment operations. These transfers are covered by an intra-group data processing agreement and appropriate lawful transfer mechanisms.

Additional information for UK candidates

This section applies in addition to the rest of this policy if you are applying for, or being considered for, a role based in the United Kingdom. It reflects the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which govern how we process your personal data in the UK. The controller is the Verda entity that is recruiting for the role. You can contact us about UK data protection matters at [email protected].

Supervisory authority. You have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.

Right to work checks. If we decide to offer you a UK role, we are under a legal obligation to confirm that you are entitled to work in the United Kingdom. We collect and check documents or share codes for this purpose, and we keep a record of the check as required by law. Our legal ground is compliance with a legal obligation.

Criminal record checks. For most roles we do not carry out criminal record checks. Where a role requires one, and only where the law allows, we may obtain a check through the Disclosure and Barring Service (in England and Wales), Disclosure Scotland, or AccessNI (in Northern Ireland). We process criminal offence information only where we meet a condition under the Data Protection Act 2018 and in line with our internal policy governing that data.

International transfers from the UK. Where we transfer your personal data outside the United Kingdom, we use a transfer mechanism recognised under UK law, in particular UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, and, for certified recipients in the United States, the UK Extension to the EU-US Data Privacy Framework, together with any additional measures needed.

Additional information for California residents (CCPA/CPRA)

This section applies in addition to the rest of this policy if you are a California resident and a candidate or applicant. It serves as our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Terms have the meaning given in that law.

Categories of personal information we collect

We collect, or expect to collect, the following categories about candidates, among others:

• identifiers, such as name and contact details;
• records under California Civil Code section 1798.80, such as professional and application information;
• characteristics of protected classifications, only where you provide them voluntarily;
• professional and employment-related information, and education information;
• internet and network activity on our Career Site;
• approximate geolocation, in limited circumstances;
• audio and visual information, such as an interview recording where you consent;
• inferences drawn from the above; and
• sensitive personal information, only where strictly necessary, such as a government identifier where required.

The sources, purposes and recipients are described in Sections 3 to 7.

Sensitive personal information

We use and disclose sensitive personal information only for purposes permitted by the CCPA, and we do not use it to infer characteristics about you.

No sale or sharing

IMPORTANT We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA. Your cookie choices on the Career Site are managed through our Cookie Policy.

Retention

We keep each category of personal information only as long as needed for the purposes described in this policy and as set out in Section 10.

Your California rights

Subject to the law, you have the right to know and access, delete, and correct your personal information; to opt out of sale or sharing (not applicable, as we do not sell or share); to limit the use of sensitive personal information; and to be free from discrimination or retaliation for exercising your rights. You may use an authorised agent.

To exercise these rights, contact us at [email protected]. We will verify your request, usually by confirming details we already hold, and respond within the timeframes set by the CCPA.

Glossary