PRIVACY POLICY

Effective Date: November 19, 2025

1. INTRODUCTION

This Privacy Policy explains how Limited Liability Company "SmileTech s.r.o." ("we", "us", "our", "Talentgrator") collects, uses, discloses, stores, and otherwise processes personal data when you interact with or access our recruitment services, in accordance with the EU General Data Protection Regulation ("GDPR") and other applicable data protection laws.

For the purposes of this Privacy Policy, the term "Services" refers to Talentgrator's activities in connection with:

(I) operating our recruitment and talent acquisition platform;

(II) receiving, reviewing, evaluating and managing candidate profiles;

(III) matching candidates with job opportunities;

(IV) contacting candidates regarding vacancies;

(V) sharing candidate information with potential employers or contracting partners;

(VI) maintaining a database of candidates for future opportunities (where permitted by law);

(VII) communication, interview coordination and feedback exchange;

(VIII) providing career-related information and resources; and

(IX) operating our website located at https://talentgrator.com/ (the "Site").

Our Services are designed to connect job seekers and independent contractors with employers and business clients seeking talent, primarily within the technology and related sectors.

By interacting with our Services, including by visiting our website, submitting a CV or application, completing a questionnaire provided by us (whether through our website or by email), responding to job postings, or otherwise communicating with us, you acknowledge that Talentgrator will process your personal data for recruitment-related purposes in accordance with this Privacy Policy and applicable data protection laws.

We will not use or share your information except as described in this Privacy Policy. We are committed to protecting the privacy and security of all personal data processed as part of our business activities.

Depending on your interaction with us and the nature of processing, we rely on one or more lawful bases under GDPR, including performance of pre-contractual steps at your request, compliance with legal obligations, legitimate interests, or your consent where required.

2. HOW WE COLLECT YOUR PERSONAL DATA

We may collect and process your personal data in the course of providing our recruitment and talent acquisition services. We collect personal data from the following sources:

(1) Directly from you

Including when you:

(I) submit your CV, application, profile or portfolio to us (including through our Site, by email or by other communication channels);

(II) complete a form or questionnaire on our Site or platform;

(III) communicate or interact with us by phone, email, messaging services or social media;

(IV) participate in interviews, assessments or meetings organised by Talentgrator;

(V) attend events, webinars, recruitment campaigns or networking activities conducted by Talentgrator;

(VI) request information from us or otherwise engage with our Services.

(2) Automatically, when you use our Site or digital services

Including through:

(I) cookies and similar tracking technologies;

(II) analytics tools and logs related to usage, device and browser data.

(For more information, please see our Cookies Policy.)

(3) From third-party sources

Including:

(I) professional networking platforms (such as LinkedIn) where you have chosen to make your information public or otherwise allow access to recruiters;

(II) publicly available sources (including professional websites, public CV databases or publications);

(III) job boards, applicant tracking systems and employment platforms where you have made your profile available or applied for roles;

(IV) candidate referrals (for example, where your information is provided by a colleague, friend, former employer or professional connection — we will inform you when we receive your data in this way).

(4) From our clients or business partners

Where:

(I) you are considered for a role with or through one of our clients or partners;

(II) your information has been shared with us in the context of a hiring request or engagement.

We will process personal data obtained from third-party or public sources only in accordance with this Privacy Policy and applicable data protection laws. Where required by law, we will inform you within the statutory time frame after receiving your data.

3. PERSONAL DATA WE COLLECT AND PROCESS

We collect and process personal data only to the extent necessary for the performance of our recruitment and talent acquisition activities, compliance with legal obligations, and the legitimate interests pursued by Talentgrator or our clients, as described in this Privacy Policy.

We may collect the following categories of personal data, depending on your interaction with us:

(1) Identification and Contact Details

Information that allows us to identify and contact you, such as:

(I) full name, title, and preferred form of address;

(II) date of birth and age (if provided voluntarily);

(III) nationality or citizenship;

(IV) contact details including email address, phone number(s), postal address, and communication handles (e.g., Skype, Telegram, WhatsApp, LinkedIn, or other professional messengers);

(V) location and country of residence.

(2) Professional and Career Information

Information contained in your CV, résumé, or professional profile, including:

(I) current and previous employment details (employers, job titles, responsibilities, start and end dates);

(II) professional experience, industry sector, and seniority level;

(III) skills, competencies, professional certifications, and qualifications;

(IV) professional memberships or associations;

(V) references and referee contact details (where provided).

(3) Education and Training

(I) details of education, academic degrees, courses, diplomas, or other certifications;

(II) name and address of educational institutions attended;

(III) field of study and graduation year;

(IV) participation in professional development or retraining programs.

(4) Recruitment and Assessment Data

(I) information you provide during interviews or assessments (notes, interview recordings, test results, and recruiter observations);

(II) your salary expectations, availability, preferred working conditions, or willingness to relocate;

(III) information collected through background checks or reference checks (where lawful and applicable).

(5) Financial and Contractual Information

(I) where relevant for certain roles or client requirements: information about remuneration history, expected compensation, or contractor status;

(II) business registration details (for individual entrepreneurs or contractors);

(III) tax or billing information, when necessary to establish or perform a contract.

(6) Online and Technical Information

(I) data automatically collected when you visit our Site or interact with us online, including IP address, browser type, operating system, device identifiers, log files, and browsing behavior on our Site;

(II) cookies and similar technologies used to improve our Services (see our Cookies Policy for details).

(7) Visual and Communication Data

(I) profile photographs or other images you provide voluntarily (for example, included in your CV or LinkedIn profile);

(II) recordings or screenshots of video interviews (where applicable and with prior notice);

(III) correspondence records, such as emails or messages exchanged with Talentgrator.

(8) Data Obtained from Third Parties or Public Sources

We may also receive personal data about you from:

(I) professional networking sites (e.g., LinkedIn), job boards, or recruitment platforms where you have chosen to make your profile public;

(II) third-party referrers or colleagues (when someone recommends you for a position — we will inform you of such referral);

(III) publicly available databases, publications, or company websites;

(IV) our clients, when your profile is proposed for a specific vacancy.

Special Categories of Personal Data

Talentgrator does not intentionally collect or process sensitive or special categories of personal data such as:

(I) racial or ethnic origin,

(II) political opinions,

(III) religious or philosophical beliefs,

(IV) trade-union membership,

(V) genetic or biometric data,

(VI) health information,

(VII) sex life or sexual orientation,

(VIII) criminal convictions or offences.

However, if you voluntarily provide such information (for example, health information related to accessibility needs, or diversity-related details in your CV), we will process it only:

(I) where required for compliance with employment or equality laws; or

(II) based on your explicit consent, which you may withdraw at any time.

We rely on the accuracy of the information you provide to us. You are encouraged to update your personal data if it changes or becomes outdated, particularly regarding your contact details, employment history, or professional qualifications.

4. PURPOSES OF PROCESSING PERSONAL DATA

We process personal data solely for specified, explicit and legitimate purposes related to the provision of our recruitment, talent acquisition, and placement services. We will not use your personal data for any purpose that is incompatible with those described in this Privacy Policy.

(1) Recruitment and Placement Activities

We process your personal data in order to:

(I) assess your qualifications, experience, and suitability for current or future job opportunities;

(II) match your profile with vacancies available through Talentgrator or our clients;

(III) contact you regarding potential roles, interviews, or recruitment processes;

(IV) maintain a database of candidates and potential contractors, where permitted by law;

(V) communicate with you about your application, interview feedback, or employment opportunities;

(VI) introduce or recommend you to our clients (potential employers or business partners);

(VII) facilitate the negotiation or conclusion of contracts between you and our clients;

(VIII) verify the accuracy of data or references you have provided, where necessary.

(2) Service Management and Operations

We use personal data to:

(I) manage and administer our Services, client and candidate relationships, and internal processes;

(II) ensure the proper functioning, security, and integrity of our systems, databases, and platforms;

(III) handle your inquiries, requests, or complaints;

(IV) communicate updates or relevant information regarding our Services or recruitment process;

(V) analyze recruitment trends and improve the efficiency and quality of our Services.

(3) Legal and Regulatory Compliance

We may process your personal data to:

(I) comply with obligations arising under applicable employment, tax, or data protection laws;

(II) fulfil requests or requirements of competent authorities or regulators;

(III) establish, exercise, or defend our legal rights;

(IV) prevent, detect, or investigate fraud or other unlawful activity.

(4) Marketing and Business Development

We may occasionally use your personal data to provide you with relevant information about our Services or job opportunities that may match your professional profile. You may withdraw from or object to such communications at any time by contacting us at GDPR@talentgrator.com.

(5) Website Operation and Analytics

When you visit our Site, we may process certain technical and usage data (such as IP address, browser type, device identifiers, date and time of access, and cookies) for the purposes of:

(I) maintaining and improving our Site and online services;

(II) ensuring cybersecurity and preventing unauthorized access;

(III) understanding user interactions to enhance functionality and candidate experience;

(IV) providing information that best matches your professional profile and interests.

(For more information, please refer to our Cookies Policy.)

5. LAWFUL BASES FOR PROCESSING

Talentgrator will process personal data only where there is a valid legal basis under applicable data protection laws.

Depending on the circumstances, we rely on one or more of the following legal bases:

(I) Performance of a contract or pre-contractual steps: when processing is necessary to take steps at your request prior to entering into a contract (e.g., evaluating your candidacy or facilitating a placement).

(II) Legitimate interests: when processing is necessary for our legitimate business interests (such as operating and improving recruitment services, maintaining relationships with candidates and clients, ensuring network security, or defending legal claims), provided that such interests are not overridden by your fundamental rights and freedoms.

(III) Compliance with legal obligations: where processing is necessary to comply with applicable laws (for example, in relation to record-keeping, taxation, anti-money laundering, or equal opportunity obligations).

(IV) Where Consent Is Required: in specific cases, where you have given us clear consent (for example, to retain your profile for future opportunities or process special categories of data voluntarily provided by you). You may withdraw your consent at any time by contacting us at GDPR@talentgrator.com, without affecting the lawfulness of processing based on consent before its withdrawal.

6. PERSONAL DATA SHARING

We do not sell your personal data. However, in the course of providing our recruitment and related services, we may share your personal data with certain third parties, always in accordance with applicable data protection laws and subject to appropriate safeguards. We ensure that any disclosure of personal data is limited to what is necessary for the relevant purpose and that recipients are bound by confidentiality and data protection obligations.

(1) Clients and Potential Employers

We share candidates' personal data with our clients (potential employers, contracting partners, or business customers) for recruitment and placement purposes, including to:

(I) evaluate your suitability for specific vacancies;

(II) facilitate interviews, assessments, or hiring processes;

(III) conclude or negotiate a potential contract or employment relationship.

Such sharing occurs only where you have expressed interest in or applied for a particular position, or where the data transfer is necessary to provide our recruitment services to you. We require all our clients to process your personal data strictly for recruitment-related purposes and to ensure an equivalent level of data protection.

(2) Service Providers and Business Partners

We may engage trusted third-party service providers that support our business operations, such as:

(I) IT hosting, cloud storage, and database providers;

(II) communication and collaboration tools;

(III) software vendors (including applicant tracking systems, CRM, and HR platforms);

(IV) professional advisors (legal, tax, or compliance consultants).

These providers process personal data only on our behalf and under written data processing agreements that meet the requirements of the GDPR.

(3) Affiliates

We may share personal data with affiliated entities where necessary to provide, manage, or improve recruitment services, including administrative and operational purposes. All such data transfers are conducted in accordance with GDPR and other applicable data protection laws, with appropriate safeguards to ensure the security and confidentiality of personal data.

(4) Public Sources and Candidate Referrals

In some cases, information about your professional background (e.g., on LinkedIn or public CV databases) may be visible to or accessed by our clients as part of the recruitment process. Additionally, when your profile is shared based on a referral (for example, by a colleague, acquaintance, or another candidate), we will notify you accordingly, as required by applicable law.

(5) Legal and Regulatory Disclosures

We may disclose personal data where required to do so by law, court order, or regulatory authority, or to establish, exercise, or defend our legal rights. We may also share data to prevent or investigate suspected fraud, security incidents, or other unlawful activity.

(6) Corporate Transactions

In the event of a merger, acquisition, reorganization, or sale of Talentgrator or its assets, personal data may be transferred to the acquiring or successor entity, subject to continued protection consistent with this Privacy Policy.

7. INTERNATIONAL TRANSFER

As Talentgrator operates globally, your personal data may be transferred to and processed in countries outside the European Economic Area ("EEA"). Some of these countries may not offer the same level of data protection as within the EEA.

Whenever such transfers occur, we ensure they are carried out in compliance with applicable data protection laws, including GDPR. Where required, we implement appropriate safeguards such as:

(I) the European Commission's Standard Contractual Clauses (SCCs) or equivalent legal instruments;

(II) transfers based on adequacy decisions; or

(III) your explicit consent, where no other lawful mechanism applies.

We take reasonable legal, technical, and organizational measures to ensure that your personal data remains protected and handled securely during and after any international transfer.

For further information about applicable safeguards, you may contact us at GDPR@talentgrator.com

8. SECURITY OF PERSONAL DATA

Talentgrator applies appropriate technical, organizational, and administrative measures to protect personal data against unauthorized access, disclosure, alteration, or destruction.

Access to personal data is restricted to authorized personnel, clients, and service providers who need such access for legitimate business purposes and are bound by confidentiality and data protection obligations.

While we take reasonable steps to ensure the ongoing security and integrity of personal data, no system or transmission over the internet can be guaranteed to be fully secure. We continuously review and enhance our security measures in line with applicable legal requirements and industry best practices.

9. RETENTION

Talentgrator retains personal data only for as long as necessary to fulfill the purposes for which it was collected, including providing recruitment and related services, complying with legal obligations, resolving disputes, and enforcing agreements.

Where we process candidate data based on consent (for example, to include a candidate in our talent pool or consider them for future opportunities), we retain such data until the consent is withdrawn or it is no longer necessary for the stated purpose, or for the maximum period permitted by applicable law.

After the applicable retention period expires, or once personal data is no longer required, it will be securely deleted, anonymized, or archived in accordance with applicable data protection laws and our internal policies.

10. YOUR PRIVACY RIGHTS AND CHOICES

We respect the privacy rights of all individuals whose personal data we process. Depending on your place of residence and the applicable data protection laws, you may be entitled to exercise certain rights in relation to your personal data.

These rights generally include:

(I) Right to be informed: to receive clear information about how and why your personal data is collected, used, and shared.

(II) Right of access: to request confirmation of whether we process your personal data and to obtain a copy of the information we hold about you.

(III) Right to rectification: to request that inaccurate or incomplete personal data be corrected or updated.

(IV) Right to erasure ("right to be forgotten"): to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected or where processing is unlawful.

(V) Right to restrict processing: to request that we limit or suspend the processing of your personal data in certain situations, for example while we verify its accuracy.

(VI) Right to data portability: to request a copy of your personal data in a structured, commonly used, and machine-readable format, and to have it transferred to another controller where technically feasible.

(VII) Right to object: to object to the processing of your personal data based on our legitimate interests, including processing for direct marketing purposes.

(VIII) Right not to be subject to automated decision-making: to request human review where decisions producing legal or similarly significant effects are made solely by automated means.

(IX) Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

(X) Right to lodge a complaint: to raise a concern with a competent data protection authority if you believe your rights have been violated.

We primarily adhere to the principles of the EU General Data Protection Regulation (GDPR). However, If you are located in jurisdictions with local data protection frameworks (such as the United Kingdom, Switzerland, certain U.S. states, or other regions), you may have additional or similar rights under those laws. We will respond to such requests in accordance with the applicable legal requirements and our obligations under GDPR.

To exercise any of your rights or to submit a privacy-related inquiry, please contact us at GDPR@talentgrator.com. We may need to verify your identity before processing your request and will respond within the timeframes required by applicable law.

For information regarding the use of cookies and similar technologies, please refer to our separate Cookies Policy available on our website.

11. PROCESSING OF PERSONAL DATA OF MINORS

Our services are intended for individuals of legal working age. We do not knowingly collect or process personal data of individuals under the age of 18.

If we become aware that we have inadvertently received personal data from a minor without appropriate parental or guardian consent, we will take steps to delete such data as soon as reasonably possible.

If you believe that a minor has provided personal data to us without consent, please contact us at GDPR@talentgrator.com

12. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses cookies and similar technologies to improve its functionality, analyze traffic, and enhance your user experience.

For detailed information about the types of cookies we use, their purposes, storage periods, and how you can manage or disable them, please refer to our separate Cookies Policy available on our website.

By continuing to use our website, you agree to the use of cookies in accordance with that policy, unless you change your browser settings or opt out through the cookie preferences tool provided on our website.

13. LINKS TO OTHER WEBSITES

Our website may contain links to third-party websites or platforms that are not operated or controlled by us. Please note that this Privacy Policy applies only to our own website and services.

We are not responsible for the content, security, or privacy practices of such external websites. When you follow a link to another website, you should review the privacy policy of that website to understand how your personal data is collected and used.

14. CONTACT INFORMATION

If you have any questions about this Privacy Policy, our data protection practices, or if you wish to exercise your privacy rights, please contact us at:

Email: GDPR@talentgrator.com

Mailing address: SmileTech s.r.o., Na Hřebenech II 1718/10, 140 00 Prague 4, Czech Republic

We take privacy matters seriously and will respond to your inquiry in accordance with applicable data protection laws.

If you believe your data protection rights have been infringed, you also have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz) or with your local data protection authority.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our business operations, legal requirements, or data protection practices.

The most current version of this Policy will always be available on our website, and the date of the latest revision will be indicated at the top of the document.

If we make any material changes, we will take appropriate steps to inform you, such as by posting a prominent notice on our website or by other means as required by applicable law.

Your continued use of our website or services after the publication of an updated version of this Privacy Policy constitutes your acknowledgment and acceptance of the changes.