Candidate Privacy Policy

This Candidate Privacy Policy (the “Policy”) describes how Kyriba SEMEA SAS and Kyriba UK Ltd. (collectively and each entity “Kyriba”) and/or its affiliated entities, including but not limited to Kyriba Corp., Kyriba Engineering Poland sp. z.o.o., Kyriba HK Limited, Kyriba (Chongqing) Software Development Ltd., Kyriba SEA PTE. Ltd., Kyriba Japan, Co., Ltd., Kyriba Middle East FZ-LLC, and Kyriba Software Technology (Shanghai) Limited, (“Affiliates” or “Affilate”), each as data controller may process the personal data (“Personal Data”) of applicants (“You”) for positions advertised on https://www.kyriba.com (the “Site”) in order to manage Your application for employment with Kyriba.

Scope and Relation to Other Policies

This Privacy Policy applies to the personal information we collect from our Websites’ visitors and supplements other Kyriba privacy policies, including our Cookie Policy. Please refer to the Technology Platform Privacy Notice for information on the privacy policy applicable to the Kyriba SaaS Services. If you are a job applicant or a candidate for a position at Kyriba, please refer to the Candidate Privacy Policy.

You may have additional rights available to you based on your applicable location. Notice of your additional rights are available for your review by clicking on your applicable location on the left of the screen: California, Canada, Japan, Mexico or Singapore.

Identity and Contact Details of the Controller

If you have any questions or concerns about our Privacy Policy or data practices, or our compliance with applicable law please contact us by email at [email protected] or by writing to:

Kyriba SEMEA
247 Bureaux de la Colline
92210 Saint-Cloud CEDEX, France

Kyriba Corp.
4435 Eastgate Mall, Suite 200
San Diego, CA 92121

Description of the Personal Data Processing Operations Carried Out

2.1 Purposes and legal basis of the Processing

The purpose of the Processing is to enable us to:

• in our legitimate interest, to constitute a CV-library or candidate’s data base;
• as part of pre-contractual measures, if your application is successful, to respond to and manage your online applications submitted in the candidates’ area under the “Careers” section of the Site to initiate the recruitment process and manage the interviews;
• subject to your consent, to share your application with the HR departments of other Affiliates in order to give us the possibility to propose offers for which your profile would be suitable;
• subject to your consent, to carry out, via the use of cookies (tracers), statistics relating to the use and frequentation of our Site for the purpose of measuring the interest shown in it by persons seeking employment or an internship.
• We may also need to retain your Personal Data where required by law or in order to enforce our legal rights.

2.2 Personal data processed

The Personal Data collected and processed for the purposes described above are:

• For the management of your applications: name, first name, email address, telephone number, professional experience, as well as all the information you provide us with when sending your curriculum vitae or your cover letter: photo, skills, level of study, languages spoken, salary expectations, personal address, hobbies, family situation, possible feedback from interviews, exchanges with you, etc. This Data is only collected and kept for the purpose of managing your applications and, if applicable, for the management of your recruitment and is not used for any other purpose, particularly commercial purposes;

Data that is required by Kyriba or its Affiliates to fulfil the purposes described above is marked as mandatory. If you do not fill in these required fields, Kyriba or its Affiliates will not be able to respond to your requests and/or provide you with the requested services.

2.3 Recipients of your Personal Data

Accessibility within Kyriba

Your Personal Data are processed only by persons authorized by virtue of their missions or functions from appropriate departments of Kyriba or its Affiliates:

• human resources department of Kyriba or the relevant Affiliate;
• the manager concerned by your application within Kyriba or the relevant Affiliate;
• financial department of Kyriba or the relevant Affiliate (for any salary concern).

Accessibility by third parties
Your Personal Data may also be accessible to third parties, namely: (i) recruitment agencies with which Kyriba or its Affiliates work and which help Kyriba in the selection of profiles; (ii) for hosting services or, in the event of an incident, for technical and logistical reasons, to subcontractors of Kyriba or any other Affiliates; (iii) to sub processors of Kyriba like Workday (application tracking system) which helps Kyriba automating the recruitment process.

Kyriba may transfer, if you consent, your Personal Data to other Affiliates so that you may be contacted about a possible offer that matches your profile. If you choose not to consent to the transfer of your personal data to Affiliates, you may not be contacted regarding any offers that match your profile, without affecting the ongoing selection process.

They may also be transferred to a third party in the event of a restructuring of Kyriba or the Affiliate concerned, including in the event of a total or partial sale of assets, merger, acquisition, spin-off and more generally any reorganisation operation.

Finally, Kyriba or its Affiliates may be required to disclose your Personal Information to third parties when such disclosure is required by law, regulation or court order or if such disclosure is necessary to protect and defend its rights.

2.4 Transfers of your Personal Data outside of the European Economic Area (“EEA”)

The recipients of your Personal Data may be located in countries other than those in which your data was collected, including in a country where the legislation on the protection of Personal Data will be different from that of the country where your Personal Data was collected and outside of the EEA.

In accordance to the purposes and legal basis as described in this Policy, your Personal Data may be transferred to Affiliates and/or sub processors of Kyriba outside of the EEA and outside the country where your Personal Data was collected. Specifically, if you are applying for a position with Kyriba and/or its Affiliates, please be aware that your Personal Data will be transferred to, stored and processed in the United States where Workday’s servers are located. Such processing will be governed by the laws of the United States law. The data protection and other laws of the United States might not be as comprehensive as those in your country. By using the Site, you consent to your information being transferred to the facilities of those third parties with whom we share it as described in this Policy.

For EU Candidates, the GDPR requires transparency and accountability with regard to the use of Personal Data, and the ability to demonstrate both to regulators and the individuals concerned. The GDPR does not require the Personal Data of EU Candidates remain within the EU, but the GDPR restricts transfers outside of the European Economic Area. “Restricted” means that unless the European Commission has assessed a country’s privacy regime and declared it to be “adequate”, the data must be further protected by contract, or other EU-approved means. For any transfers to non-adequate countries, Kyriba ensures that any such transfers are done in accordance with EU-approved means, namely the European Commission’s standard contractual clauses entered into between Kyriba, its affiliates and any related sub-processors. Candidates can rely on these protections to transfer EU Personal Data using Workday’s servers.

2.5 How long we keep your Personal Data

Your Personal Data will be retained for a period of two years from the date of submission or last contact with you, and will then be destroyed (unless your application has been accepted and you are a Kyriba employee).

Your Rights

Subject to the legislation applicable in your country, you may have the right to access and correct your Personal Data, the right to request the deletion of your Personal Data (right to be forgotten), the right to object to the processing of your Personal Data and the right to obtain the limitation or portability of your Personal Data, subject to any legitimate reason that Kyriba or the relevant Affiliate may have for retaining your Data. These rights can be exercised through your applicant area in Workday.

With regard to Personal Data relating to your application, we invite you to keep your information up to date in your applicant area in Workday.

You can also modify your Personal Data at any time directly in your applicant area.

Subject to the applicable legislation in your country, you also have the right to lodge a complaint with the supervisory authority in your country.

Cookies

We may collect certain information through cookies, web beacons and other tracking devices, which is described within our Cookie Policy.

Effective Date of the Policy

This Policy is effective as of April 28, 2023.

Our Policy may change to reflect developments in the way we process information about you. We will ensure that you are informed of any significant changes. We will also post an updated version of this Policy on the Site.

Additional Disclosures for California Residents

This section provides additional information for California residents pursuant to the California Consumer Privacy Act (“CCPA”).

Categories of Personal Information Collected

The table below describes the categories of personal information, as enumerated under the CCPA, that we have collected and disclosed for a business purpose in the prior 12 months for California residents. For more information about these categories, and the business and commercial purposes for which we may collect or disclose such information, please review the Policy above. In addition, we may disclose such data as is required by laws applicable to Kyriba.

Categories Collected in the Last 12 Months

Categories of Sources

Purposes for Processing

Disclosed

Categories of Parties Who Receive This Personal Data

Identifiers

Directly from you

See above Sections

Yes

Affiliates and business partners Service providers
Regulatory and governmental entities

Employment-related information

Directly from you

See above Sections

Yes

Affiliates and business partners, Service providers
Regulatory and governmental entities

Education information

Directly from you

See above Sections

Yes

Affiliates and business partners, Service providers, Regulatory and governmental entities

Sensitive personal information

Directly from you

See above Sections

Yes

Affiliates and business partners, Service providers, Regulatory and governmental entities

As outlined in the proceeding chart and further described above, Kyriba discloses Personal Data to service providers (as defined under the CCPA). These recipients are required to take appropriate security measures to protect your Personal Data in line with our policies and are not permitted to use Personal Data for their own purposes. We do not sell or share Personal Data to “third parties” as defined by the CCPA.

Your California Privacy Rights

If you are a resident of California, starting January 1, 2023, you may have additional rights regarding your Personal Data under the CCPA. These rights are described below.

• Right to Know/Access. You have the right to request (subject to certain exemptions):
  • The categories of Personal Data we collected about you;
  • The sources from which we have collected that Personal Data;
  • Our business or commercial purpose for collecting, selling, or sharing that Personal Data;
  • The categories of third parties to whom we have disclosed that Personal Data; and
  • A copy of the specific pieces of Personal Data we have collected.
• Right to Correct. You have the right to request that we correct inaccuracies in your Personal Data. Candidates merely seeking to update their information may do so by updating your account in WorkDay.
• Right to Delete. Subject to certain conditions and exceptions, you have the right to request deletion of Personal Data that we have collected from you. Please note, Kyriba is not obligated to delete Personal Data that is necessary for Kyriba to provide services that you request (if applicable) or required to comply with applicable laws.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this Section.

We not have actual knowledge that we sell or share the Personal Data of individuals under 16 years of age.

We do not use or disclose candidate “sensitive personal information,” as defined under the CCPA, for purposes other than those permissible under the CCPA and implementing regulations or to comply with applicable laws.

How to Exercise Your Privacy Rights

To exercise any of these CCPA rights, please email the Kyriba at [email protected] or send a letter addressed to Kyriba Corp., 4435 Eastgate Mall, Suite 200, San Diego, CA 92121. You must indicate you are exercising your “CCPA rights.” Kyriba may require additional information to confirm your identity before fulfilling the request, such as your home address.

You may designate someone as an authorized agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow the authorized agent to act on your behalf. We may also ask you directly to verify you have authorized your authorized agent to act on your behalf.

Note, this Policy applies only to rights and practices pursuant to the CCPA. These rights are in addition to any rights that may be available to you under other California laws. To the extent you wish to exercise any rights pursuant to other applicable California laws, contact the Kyriba Privacy Office at [email protected].

Additional Disclosures for Canada

Data Transfers to Third Parties

We may share Personal Data with third parties for processing, as described above and we may engage third parties to conduct such additional activities as background checks. Those third parties may be located outside of the jurisdiction in which you are located. Applicable ‎‎laws in ‎the applicable jurisdictions might permit foreign governments, courts, law enforcement or ‎‎regulatory ‎agencies to ‎access the Personal Data in those jurisdictions.‎ In these cases, Kyriba will comply with local ‎law requirements relating to the conditions for disclosure of Personal Data outside of your ‎jurisdiction.

We may also disclose your Personal Data without your consent if authorized or required by law.‎

Your Data Rights

To the extent applicable, you may have the following rights under Canadian laws:

• Right to Access Personal Data: Subject to applicable exceptions, you have the right to request that Kyriba provide you with (a) access to your Personal Data that Kyriba has under its control; and (b) information about the ‎ways in which that Personal Data is being ‎used and a description of ‎the individuals and organizations to ‎whom that Personal Data has been ‎disclosed‎.
• Right to Correct Personal Data: Kyriba will make reasonable efforts to ensure that your Personal Data is accurate, complete ‎‎and ‎up-to-date for the purposes for which it is to be used. In most cases, we will rely on you to ensure that ‎‎Personal Data is ‎correct, accurate and complete.‎ You can question the accuracy and completeness of your Personal Data and request in writing ‎that it ‎be ‎amended as appropriate. If you reasonably demonstrate that Personal Data is inaccurate or incomplete, we will update the Personal Data as required. If a challenge regarding the accuracy of Personal Data is not resolved to your ‎satisfaction, ‎‎we will make a note to the Personal Data that the correction was ‎requested but not ‎‎made.‎
• Right to Withdraw Consent: Applicable law may permit Kyriba to collect and Process your Personal Data without consent. To the extent that Kyriba relies on your consent to collect or Process your Personal Data, you have the right to withdraw your consent at any time. In this case, your withdrawal may have an impact on Kyriba’s ‎ability to manage various ongoing aspects of your application for employment with Kyriba, in that your consent ‎to certain collections, uses and disclosures may be a condition of your continued employment or of your continued ability to qualify for certain benefits offered by Kyriba from time to ‎time.‎

Questions or Complaints

Kyriba has designated Erin Doyle Toburen, Sr. Legal Counsel, and the Kyriba Privacy Office as the persons responsible for the protection of personal information matters within the Province of Quebec, who may be contacted at [email protected].

If you have any questions or complaints regarding this Policy or Kyriba’s privacy practices, please contact us at [email protected].

Additional Disclosures for Japan

This Section provides additional information for Japanese residents pursuant to the Act on the Protection of Personal Information (“APPI”). As used in this Section, “Personal Data” means any information relating to a living individual containing name, date of birth or other descriptions whereby a specific individual can be identified including those which can be readily collated with other information and thereby identify a specific individual and those containing an individual identification code as defined under Article 2.1 of the APPI.

We may directly obtain from you and process your Individual Number prescribed in Article 2 (5) of Act on the Use of Numbers to Identify a Specific Individual in the Administrative Procedure (the “My Number Act”) (“Individual Number”) for the purpose of considering your applicable for employment in accordance with the APPI, the My Number Act and other relevant laws and regulations and guidelines.
We directly obtain from you with your consent and process your Sensitive Personal Data in accordance with this Policy and the APPI.

Data Transfers outside of Japan

Where Personal Data is transferred out of Japan to other countries and territories, Kyriba has put in place appropriate measures to ensure that such data transfers are made in accordance with the APPI.

You may request us to disclose the following:

• measures to ensure the data recipients located outside of Japan take sufficient data security measures (the “Measures”) and the details of the Measures;
• measures and frequency that we audit the data recipients’ implementation of the Measures;
• name of the recipient country and rules of the country that could hinder the implementation of the Measures; and
• other obstacles that could hinder the implementation of the Measures and measures that Kyriba has conducted to solve such obstacles, if any.

Data Transfers to third parties

Your Personal Data specified in Section 4 of this Policy will be jointly used by Kyriba or its Affiliates for the purposes outlined in the Policy. Kyriba Corp. will be responsible for management of the jointly used Personal Data.

In the case where we transfer your Personal Data to third parties other than Kyriba or its Affiliates and data processors such as service providers, we may request you to consent to such data transfer if required under the APPI.

Your Privacy Rights

You may have additional rights regarding your Personal Data under the APPI. These rights are described below:

• Right to access. You may access your Personal Data and record of transfer we are keeping about you, if applicable.
• Right to correct, add and delete incorrect or incomplete Personal Data. If the Personal Data we have pertaining to you are incorrect or incomplete, you are entitled to have the Personal Data corrected, added, or deleted.
• Right to erase and cease of processing. You have the right to request deletion of or cessation of processing of your Personal Data if your Personal Data has been used beyond the scope necessary to achieve the purpose for which they were collected, processed or obtained by deceit or in violation of the APPI, if our use of your Personal Data triggers illegal acts, are no longer necessary in relation to the purposes for which they were collected, compromised or otherwise processed in a manner which could harm the rights or legitimate interest of you. We may be permitted by applicable laws to retain some of your Personal Data to satisfy our business needs.
• Right to cease of transferring to third parties. You have the right to request cessation of transferring of your personal data if your Personal Data is transferred to a third party in violation of the APPI or the transfer could harm your rights or legitimate interest.

If you have any complaints regarding our processing of your Personal Data, questions on this Policy, our use of your Personal Data or our data protection measures implemented, and/or want to confirm the measures to exercise your privacy rights above, please contact us at [email protected].

Additional Disclosures for Mexico

This Section provides additional information for Mexico residents. Kyriba Corp., residing in San Diego, California, is the data controller (the “Data Controller”) of the processing and protection of your Personal Data, as defined by Mexican Federal Law for the Protection of Personal Data in Possession of Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (the “Mexican Privacy Law”).

Sensitive Personal Data

Please note that Kyriba may process the following personal information that is considered or may be considered as Sensitive Personal Data under Mexican law:<

• Racial and ethnic origin.
• Immigration status.
• Criminal record and background checks.

For more information about our collection and purposes for processing this information, please see Sections 4-6 above.

Means to revoke consent for the processing of your Personal Data

You can revoke the consent that, where appropriate, you have given us for the processing of your Personal Data. However, it is important that you bear in mind that not in all cases we will be able to respond to your request or terminate the use immediately, since it is possible that due to some legal obligation, we will need to continue processing your Personal Data. Likewise, you should consider that, for certain purposes, the revocation of your consent will imply the termination of your relationship with us.

The Data Controller has implemented a mechanism by which you can limit the use or disclosure of your Personal Data or revoke your consent for the processing of the same, by requesting via email to [email protected].

ARCO Rights

You have the right to: (i) access your Personal Data; (ii) rectify them, if t\hey are inaccurate or incomplete; (iii) cancel them; and (iv) oppose the use of the same for specific purposes (together, the “ARCO Rights”).

In case you wish to exercise any of the ARCO Rights, please send an email to [email protected], which must contain, at least, the following information:

1. Full name and email or address, to communicate the response to your request.
2. The documents that prove your identity, or where appropriate, that of your legal representative.
3. A clear description of the Personal Data with respect to which you seek to exercise any of the ARCO Rights.
4. Any other element or document that facilitates the location of the Personal Data.
   If required, the Data Controller may request additional information.
   The response to your request will be communicated to you within 20 (twenty) business days and, if it is appropriate, it will be implemented within a maximum period of 15 (fifteen) business days.

Disagreeement or Complaint to the INAI

If you consider that your right to the protection of Personal Data has been harmed by any conduct or omission on the part of the Data Controller, or you presume any violation of the provisions provided in the Law, its Regulations and other applicable regulations, you may file your disagreement or Complaint before the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). For more information, we suggest you visit its official website: www.inai.org.mx.

Additional Disclosures for Singapore

You have the following rights under Singapore’s laws:

• Right to Access Personal Data. Subject to applicable exceptions, you have the right to request that we provide you with (a) Personal Data about you that is in our possession or under our control; and (b) information about the ways in which such Personal Data has or may have been used or disclosed by us within a year before the date of the request.
• Right to Correct Personal Data. Subject to applicable exceptions, you have the right to request that we correct an error or omission in Personal Data about you that is in our possession or under our control.
• Right to Withdraw Consent. Where you have provided your consent to the collection, use, disclosure and/or Processing of your personal information, you may have the legal right to withdraw your consent under certain circumstances. To withdraw your consent, contact the Kyriba Privacy Office via email at: [email protected]. Depending on the type of consent withdrawn, we may not be in a position to continue reviewing your application for employment.

If you would like to exercise your rights as set out above, contact the Kyriba Privacy Office via email at: [email protected].