Job Candidate Privacy Notice

Last Updated: April 27, 2026

This Job Candidate Privacy Notice (the “Candidate Privacy Notice”) describes the personal information that Bounteous, Inc. (doing business as Bounteous) and its subsidiaries, corporate affiliates, and related entities (individually and collectively, “Bounteous,” the “Company,” “we,” “us,” or “our”) collect from or about job candidates (“Job Candidate Personal Information”).

The purpose of this Candidate Privacy Notice is: (i) to provide a consistent statement of our principles and practices for the collection, processing, storage, transfer, and use of Job Candidate Personal Information; and (ii) to inform job candidates of the principles under which we process Job Candidate Personal Information.

Compliance with Local Laws. We have operations in many states and nations with varied laws, rules, and regulations related to the privacy of Job Candidate Personal Information. It is our policy to comply with the privacy laws within each jurisdiction in which we operate. While this Candidate Privacy Notice applies to Job Candidate Personal Information generally, the local laws, rules, and regulations of jurisdictions that are applicable to us (“Local Laws”) may require standards stricter than this Candidate Privacy Notice; in such event, we will comply with applicable Local Laws, including any applicable confidentiality obligations. Specific privacy notices and procedures may be adopted to address the specific privacy requirements of particular jurisdictions as required by Local Laws.

Collection and Use of Job Candidate Personal Information

We collect or may collect Job Candidate Personal Information to conduct our business and comply with applicable laws, rules, and regulations. We may use Job Candidate Personal Information as set forth in this Notice (or any other Company policy, as applicable), and for any other purposes for which your consent is required under applicable law, so long as we obtain your consent. We may use your Job Candidate Personal Information without your knowledge or consent where we are permitted or required to do so under applicable law.

Due to increasing instances of impersonation, identity fraud, and AI-generated interview responses, we may, in compliance with applicable laws, implement enhanced screening mechanisms including facial-matching technology, biometric validation, and AI-detection tools to ensure the authenticity of candidate-provided information.

We collect or may collect the following types of Job Candidate Personal Information depending on your prospective employment responsibilities, citizenship, and other factors:

name, including name history (e.g., maiden name);
resumes and employment applications;
references and interview notes;
compensation history;
beneficiary and emergency contact information;
phone numbers, email addresses, and mailing addresses;
photographs and video;
financial data;
government identification numbers (e.g., Social Security numbers, taxpayer identification numbers, driver’s license numbers);
date of birth;
gender (Local Laws may also deem this information to be sensitive);
race (Local Laws may also deem this information to be sensitive);
ethnicity (Local Laws may also deem this information to be sensitive);
health and disability data (Local Laws may also deem this information to be sensitive);
biometric information (Local Laws may also deem this information to be sensitive);
data related to criminal records (Local Laws may also deem this information to be sensitive);
documents and information related to proof of work eligibility;
veteran status;
behavioral assessments;
other data deemed necessary by us or voluntarily disclosed during an application for employment with us; and
other data related to immigration law compliance.

We collect the majority of Job Candidate Personal Information directly from the applicable job candidate. In limited circumstances, third parties provide Job Candidate Personal Information to us, including former employers, government agencies or regulators, law enforcement, and third-party service providers.

We may hold, use, and disclose your Job Candidate Personal Information for the following purposes:

to determine your eligibility for employment with us, including the verification of references and qualifications;
to identify you personally;
to communicate with you;
to assess your qualifications for a particular job, task, or assignment;
for human resources management purposes;
to comply with laws, rules, or regulations;
to provide and operate our business processes, systems, and operations;
when, in our judgment, disclosure is necessary to prevent fraud or to comply with any statute, law, rule, or regulation of any governmental authority or any order of any court of competent jurisdiction;
when we outsource some or all of our operations to third-party service providers who provide services for us;
to third parties engaged by us and serving in an agency capacity to perform functions on our behalf;
to enforce or apply our policies and other agreements; and
for other business purposes as are reasonably required by us.

If you are considered for a position that requires visa sponsorship or immigration support, we may collect and process additional Personal Information to determine your eligibility to work in the applicable jurisdiction and to comply with immigration laws. This information may include, but is not limited to, nationality, passport details, immigration status, and work authorization documents.

We will only use Job Candidate Personal Information for the above purposes and for compatible purposes. If we need to use Job Candidate Personal Information for an incompatible or secondary purpose, we will provide prior notice to you and, if required by applicable Local Laws, obtain your consent. We may also use Personal Data for our legitimate interests, including to:

prevent fraud;
ensure network and information security, including preventing unauthorized access to our computer and electronic communications systems and preventing malicious software or code distribution;
support internal administration with our affiliates; and
conduct data analytics and analysis to review job candidate retention, attrition rates, and other related statistics.

Job candidates will not be subject to decisions based solely on automated data processing.

Collection and Use of Biometric Information

Legal Basis and Compliance

Bounteous and its affiliates comply with all applicable biometric privacy laws and regulations, including but not limited to the Illinois Biometric Information Privacy Act (“BIPA”) and any other applicable laws. This section of the Candidate Privacy Notice applies to our collection and processing of job candidate biometric data.

Collection and Use

We collect, store, and use biometric information — including through our relevant service providers — only for the following purposes:

identification;
fraud prevention; and
security.

The foregoing purposes are in furtherance of access controls, as well as the safety and security of our facilities, hardware, software, systems, and the Company generally.

Pursuant to the foregoing, and for the purposes stated above, we collect the following categories of biometric data:

facial recognition and geometry.

No biometric data will be collected, used, or processed without obtaining explicit, informed, written consent from the individual, in accordance with applicable law. Individuals may decline or withdraw consent at any time, except where the use of biometric data is necessary for: (i) access control and security of facilities, hardware, or software; (ii) keeping time; (iii) improving workplace safety and security; or (iv) improving or monitoring the safety or security of the Company, its facilities, its systems, and events.

Sharing and Disclosure

Biometric data will be used solely for the purposes specified above (or, if different, in the applicable notice and consent form) and will not be used for any other purpose without obtaining new consent from you. Biometric data will not be shared with third parties, including vendors or service providers, unless:

the individual has provided explicit, informed, written consent for such sharing;
sharing is required by law or legal process; or
sharing is necessary to fulfill the original purpose for which the data was collected, and the third party is contractually bound to comply with all consent requirements and restrictions.

Retention and Destruction

Biometric data will be retained only as long as necessary to fulfill the purpose for which it was collected, as specified herein or in the applicable notice and consent form, or as required by law, and in no event longer than two (2) years after your last interaction with Bounteous or its affiliates, whichever occurs first.

Upon expiration of the retention period or withdrawal of consent (unless retention is required by law), biometric data will be permanently destroyed using secure deletion methods. Retention and destruction practices will be documented and periodically reviewed for compliance.

Security and Safeguards

Bounteous and its affiliates implement reasonable and appropriate technical, administrative, and physical safeguards designed to protect biometric data from unauthorized access, disclosure, alteration, or destruction. Safeguards are reviewed and updated regularly to address evolving threats and legal requirements. If we reasonably suspect a security incident that may compromise biometric data, we will promptly investigate in accordance with our internal security incident response procedures and policies. Where there has been an unauthorized acquisition of unencrypted biometric data maintained by us, we will—to the extent required under law applicable to our processing of the specific information—provide affected individuals with notice of such security incident without undue delay, and in any event within the timeframe required under applicable law.

Collection and Use of Sensitive Information

Certain jurisdictions designate special categories of personal data as sensitive information under applicable Local Laws. Where required by Local Law, we will obtain prior consent from the job candidate before collecting sensitive data from the job candidate.

Disclosure of Personal Data to Third Parties

Where permitted under applicable law, we may share your Job Candidate Personal Information with our affiliates, employees, contractors, consultants, and other parties who assist us in connection with your application for employment, including parties that provide information technology and data processing, fraud detection, identity verification, and background verification services—including those that utilize AI-assisted systems—where necessary to assess the authenticity and suitability of job candidates.

Because our business and operations are international, we have centralized certain elements of our human resources management. As a result, we have centralized aspects of our processing of Job Candidate Personal Information. Accordingly, where permitted under applicable law, we (including our international affiliates) may transfer or provide your Job Candidate Personal Information to our affiliates or third-party service providers both in and outside the nation where you reside or work. Where required by Local Law, we will obtain your prior consent for such transfers, or we will ensure that the Job Candidate Personal Information subject to such a transfer is adequately protected through the use of contractual clauses.

Your Job Candidate Personal Information may also be disclosed as required by applicable law, to comply with a court order, subpoena, warrant, or other legal process, or where the information is publicly available (unless otherwise restricted by applicable law).

General Principles for Processing Job Candidate Personal Information

Job Candidate Personal Information will be collected, stored, processed, and transmitted in accordance with our established policies and applicable federal, state, local, and foreign laws, rules, and regulations. Our principles regarding the processing of Job Candidate Personal Information are as follows:
Job Candidate Personal Information will be processed fairly and lawfully.
Job Candidate Personal Information will be collected for specified, explicit, and legitimate purposes and not further processed for incompatible purposes.
Job Candidate Personal Information collected by us will be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is collected and processed.
Job Candidate Personal Information collected by us will be accurate and, where necessary, kept up to date to the best of our ability.
Job Candidate Personal Information collected by us will be retained as identifiable data for no longer than necessary to serve the purposes for which it was collected.
Job Candidate Personal Information will be processed in a manner that ensures appropriate security, including reasonable protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

Transfers of Job Candidate Personal Information

We may transfer Job Candidate Personal Information in connection with an asset sale, acquisition, merger, consolidation, reorganization, divestiture, stock sale, purchase of part or all of our assets or those of any of our subsidiaries or affiliates, or other transaction, or by way of assignment (whether by operation of law or otherwise) in connection with any such or similar transaction or in connection with the administration of a bankruptcy estate. In such an event, your Job Candidate Personal Information may be transferred to the successor, in which case it will be subject to the successor’s privacy policies and applicable laws regarding the correct processing of your Personal Data. Your acceptance of this Notice constitutes your approval of the data transfers described in this section.

Security

We have implemented measures designed to secure Job Candidate Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of Job Candidate Personal Information also depends on you. Unfortunately, the transmission of information via the internet is not completely secure. Despite our measures, we cannot guarantee the security of Job Candidate Personal Information, and any transmission of personal information is at your own risk.

If you become aware of any breach concerning Job Candidate Personal Information or this Notice, please notify us at bnt-privacy@bounteous.com immediately.

Accuracy

It is each job candidate’s responsibility to provide us with accurate Job Candidate Personal Information and to notify us when there are changes so that we are able to ensure that the personal data collected is reliable for its intended use. Except as otherwise set forth in this Notice, we shall use Job Candidate Personal Information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the individual. To the extent necessary for these purposes, we shall take reasonable steps to ensure that Job Candidate Personal Information is accurate, complete, current, and relevant to its intended use.

Your Rights Over Information

Where provided under Local Laws, you have rights regarding your Personal Data, which may include the right to:

confirm whether such data concerning you is being processed;
receive copies of your Personal Data;
be informed of the purposes of processing of your Personal Data;
be informed of the categories and sources of your Personal Data;
be informed of the recipients or categories of recipients to whom your Personal Data is disclosed, in particular recipients in third countries or international organizations;
be informed of the envisaged retention period for your Personal Data, or, if not possible, the criteria used to determine that period;
request rectification or erasure of your Personal Data;
limit, restrict, or stop the processing of your Personal Data;
lodge a complaint with governmental authorities;
be informed whether your Personal Data is or will be subject to automated processing, including profiling, and, if so, the logic and potential consequences involved;
be informed of the safeguards that apply if your Personal Data is transferred to a third country or international organization;
transfer your Personal Data to another organization; and
withdraw consent, under circumstances where we previously obtained your consent in relation to the collection, use, or transfer of your Personal Data.

Information for California Residents

The following section of this Candidate Privacy Notice only applies to California residents.

Collection

Consistent with the “Collection and Use of Job Candidate Personal Information” section above, we collect certain categories and specific pieces of Job Candidate Personal Information about job candidates who reside in California (“CA Job Candidate Personal Information”). In the prior twelve (12) months, we collected the following categories of Job Candidate Personal Information from California residents, which we will continue to collect:

Identifiers: name, telephone number, address, age, email address, date of birth, and similar identifiers.
Characteristics of protected classifications under California or federal law: sex, gender, age, and similar.
Commercial information: financial account information, health information, medical information, health insurance information.
Internet or other electronic network activity information: computer and device information.
Audio, visual, or similar information: photographs, security camera video, audio or recordings.
Inferences drawn from the above categories of CA Job Candidate Personal Information.

Sources

Consistent with the “Collection and Use of Job Candidate Personal Information” section above, we collect certain categories of CA Job Candidate Personal Information directly from job candidates and, in some circumstances, third parties. The categories of sources from which we collected CA Job Candidate Personal Information in the prior twelve (12) months include:

Our internal and external websites (including a job candidate’s email).
Our third-party service providers.
Job candidate communication with us.
The U.S. Government (e.g., through E-Verify or TWIC).

Disclosures to Third Parties

In the preceding twelve (12) months, we have not sold or shared (as such terms are defined in the California Consumer Privacy Act, the “CCPA”) any Job Candidate Personal Information.

Consistent with the “Disclosure of Personal Data to Third Parties” section above, we disclose certain categories of CA Job Candidate Personal Information with third parties pursuant to the purposes summarized below:

Category of Information	Categories of Third Parties	Purposes for Disclosure
Identifiers (e.g., name, email, postal address)	Background verification (BGC) vendors	Background verification
Protected Classifications Under Applicable Law (e.g., race, gender)	Payroll and healthcare vendors	EEO-1 data reporting
Internet or Other Electronic Network Activity (e.g., IP address)	BGC vendors	Background verification; determine and secure work eligibility
Geolocation Information	BGC vendors	Background verification; determine and secure work eligibility
Professional or Employment-Related Information (e.g., resume, employment history)	BGC vendors	Background verification
Sensitive Information (e.g., Social Security number, driver’s license, passport)	BGC vendors; immigration services vendors	Background verification; determine and secure work eligibility in the applicable jurisdiction; comply with immigration laws

California Privacy Rights

The CCPA grants individuals who are California residents certain rights regarding our collection of Job Candidate Personal Information. These rights include:

the right to request the disclosure of (1) what Job Candidate Personal Information has been collected; (2) the categories of sources from which the Job Candidate Personal Information was collected; (3) the business or commercial purpose for collecting or selling/sharing Job Candidate Personal Information; (4) the categories of third parties with whom we share Job Candidate Personal Information; and (5) the specific pieces of Job Candidate Personal Information we have collected;
the right to request the deletion of Job Candidate Personal Information that has been collected;
the right to request the correction of Job Candidate Personal Information that has been collected;
the right to limit our processing of sensitive data (as described in this Notice) to what is necessary; and
the right not to be discriminated against for exercising any of the rights granted to you under the CCPA. We do not discriminate against job candidates for exercising the rights granted to them under the CCPA.

Our collection of CA Job Candidate Personal Information may also include recorded video and audio interview data (including AI-driven or asynchronous interview sessions); metadata from virtual interview tools used for identity validation and behavioral analysis; facial imagery or biometric templates where required for fraud detection or impersonation prevention; source-validation information such as IP address logs, email-header verification, and device/browser metadata collected during the application process; and third-party validation results used for identity, credential, or employment-history checks.

Exercising Your Rights

To exercise your rights as described above, you may submit a verifiable request to us by either calling 877-220-5862 or emailing bnt-privacy@bounteous.com. We will respond to requests within the applicable timeframe required by the CCPA.

Data Retention and Destruction

We retain Job Candidate Personal Information in accordance with our policies and practices, applicable law (including without limitation Local Laws), and contractual obligations. If there is no activity in relation to the Job Candidate Personal Information, we remove it from our database, subject to our internal policies and any applicable legal or regulatory obligations or for the period of time permitted by Local Laws.

Third-Party Privacy Policies

This Candidate Privacy Notice only pertains to our collection, use, and disclosure of Job Candidate Personal Information and does not apply to a third party’s collection, use, or disclosure of Job Candidate Personal Information. If a job candidate clicks on a link to a third-party website or is subject to a third-party privacy policy, the job candidate should read that privacy policy.

Changes to this Candidate Privacy Notice

We reserve the right to amend this Candidate Privacy Notice from time to time, consistent with the requirements of applicable law. Any updated version of this Candidate Privacy Notice will be made available on this site.

Right to Complain

A job candidate has the right to file a complaint regarding our use of their Job Candidate Personal Information. A job candidate may file a complaint directly with us, with any governmental agency, or with a judicial body. If applicable under Local Laws, a job candidate may also have the right to raise a concern or submit a complaint with the relevant data protection supervisory authority in the applicable jurisdiction.

A complaint may be submitted directly to us through the contact methods provided below.

Contact Us

If you have questions regarding this Candidate Privacy Notice, you may contact us and our appointed Data Protection Officer at bnt-privacy@bounteous.com.

EU / UK Data Protection Addendum

Applicable Jurisdictions: European Union, United Kingdom, European Economic Area

This Addendum supplements the Candidate Privacy Notice for job candidates in the European Union, the United Kingdom, and the European Economic Area. Where conflicts exist between this Addendum and the body of the Notice, this Addendum prevails for those job candidates.

GDPR and UK Data Protection Compliance

This Addendum applies to processing subject to the GDPR and the UK GDPR.

Lawful Basis for Processing

Standard Candidate Data: Article 6(1)(b) GDPR (processing necessary for taking steps prior to entering into an employment contract) and Article 6(1)(f) GDPR (legitimate interests in recruitment and talent acquisition, following completion of a balancing test).
Special Category Data (including biometric data): Article 9(2)(b) GDPR (processing necessary for employment purposes) and, where applicable, Article 9(2)(a) GDPR (explicit consent).
UK Processing: Schedule 1, Part 1, Paragraph 1 of the UK Data Protection Act 2018 for employment purposes.

International Data Transfers

When transferring candidate personal data from the EU/UK to countries without adequacy decisions, Bounteous implements:

Standard Contractual Clauses approved by the European Commission;
UK International Data Transfer Agreement, where applicable; and
supplementary measures as required by EDPB recommendations.

Data Subject Rights

EU/UK candidates may exercise rights under the GDPR and UK GDPR, including:

access, rectification, erasure, restriction, and portability;
objection to processing (including automated decision-making); and
withdrawal of consent where applicable.

To exercise these rights, contact bnt-privacy@bounteous.com.

Automated Decision-Making

Where automated processing (including profiling) is used in recruitment decisions, candidates have the right not to be subject to decisions based solely on automated processing under Article 22 GDPR and may request human intervention.

Retention

Candidate data is retained for twelve (12) months post-application, or as required by local employment law, whichever is longer.

Data Protection Contacts

EU Data Protection Officer: bnt-privacy@bounteous.com (DPO identity available upon request per GDPR Article 37(7)).
UK Data Protection Contact: bnt-privacy@bounteous.com.
UK supervisory authority: Information Commissioner’s Office (ICO).

Biometric Data Specific Provisions

Where biometric data is collected:

explicit consent will be obtained before processing;
the purpose will be limited to identity verification;
enhanced security measures will be applied to storage and transmission; and
biometric data will be automatically deleted upon withdrawal of consent or completion of the recruitment process.

Effective Date of this Addendum: April 27, 2026.