UCTalent Privacy and Data Security Policy

1. Introduction and scope

This Policy explains how UCTalent collects, uses, shares, stores and protects personal data, and the rights you have over it. It applies to:

• uctalent.io: the job platform for talent, referrers and employers;
• business.uctalent.io: Referral ATS, recruitment management software for companies and headhunters;
• recruitment and job placement (headhunting) services provided by UCTalent;
• our mobile app, AI assistants (Uma, Cora), Zalo Official Account, emails and related services (together, the "Services").

It does not cover third-party websites or services. This Policy forms part of the Terms of Service.

2. Who we are

UCTalent Labs Company Limited (Công ty TNHH UCTalent Labs, "UCTalent", "we")

Enterprise code: 0402238274

Address: Hoa Xuan Ward, Da Nang City, Vietnam

Data protection contact: privacy@uctalent.io

3. Our role

3.1 When UCTalent is the controller

We decide the purposes and means of processing when you:

• create a talent account, build your profile or receive job recommendations on uctalent.io;
• apply through UCTalent or are introduced by UCTalent to an employer (job placement services);
• join the referral program and receive rewards;
• sign up, purchase a plan or contact us.

We are also the controller of data used to operate and secure the platform.

3.2 When UCTalent processes data on a company's instructions (Referral ATS)

Companies and headhunters use Referral ATS as software to run their own hiring. For data they upload or create in their workspace (CVs uploaded by HR, talent pools, notes, interview feedback, internal reward amounts, headhunters' client information), the company is the controller. UCTalent only stores and processes that data on the company's instructions, through features the company itself operates.

This applies on every plan, including the free Starter plan. If you are a candidate and want to exercise your rights over data a company holds in Referral ATS, please contact that company. We will help them respond.

3.3 When your profile is shared with an employer

When you apply, or agree to be introduced by UCTalent to an employer, we send your profile to that employer. Once received, the employer processes that copy as a separate controller and must comply with data protection law. We keep your application history in your account.

3.4 Company career pages

On the Business plan, a company may host its career page on its own domain. On that page, the company is the controller of candidate data and is responsible for giving candidates a privacy notice. UCTalent acts as processor.

4. Data we collect

People you refer and people in your network:

Only share another person's contact details or CV when they know about it and agree.

When you declare a professional relationship with someone who has no UCTalent account, we store only their name and former company or role, never their phone number or email.

If we contact that person, we tell them on first contact, including how to opt out and ask for deletion.

Sensitive data:

We do not request or knowingly collect data about health, religion, political views, ethnicity, sexual life, criminal records, biometrics or precise location. Please leave these out of your CV.

We do not collect or store images of ID cards or passports. Referral contracts use only the ID number, date and place of issue.

If identity verification is needed, it is performed by UCTalent's eKYC partner, a licensed provider; we receive only the result.

Video introductions are used only to assess what you present, never for biometric identification.

5. Purposes and legal bases

We will not use your data for a new purpose incompatible with these without telling you and, where the law requires, obtaining your consent.

6. Artificial intelligence

UCTalent uses AI to: extract information from CVs; assess fit between a profile and a job description (match score, missing requirements, strengths); recommend jobs and potential referrers; draft content; and run our assistants Uma (for talent) and Cora (for recruiters).

Model provider: Google Gemini API (OPEN AI, Claude AI ), paid tier. Google processes data as a processor under Google's data processing terms and does not use submitted data to train its models.

Our commitments:

AI never rejects candidates automatically. When you apply, the system creates a basic assessment for the recruiter's reference. Advanced assessment runs only when a recruiter requests it. Hiring decisions are always made by people.

Data minimisation: before a CV is sent to the AI model, we remove direct identifiers such as name, email, phone number, address, photo and ID numbers.

No model training on your data, by UCTalent or by our AI provider.

Companies can turn AI features off for their workspace. When off, workspace data is not sent to the AI provider.

AI assistants send messages or emails on your behalf only after you review and confirm them.

Data is kept separate by side: companies cannot see your conversations with Uma, and Uma cannot read a company's internal workspace data.

You can ask for an explanation of an AI-generated assessment, or for a human review, at privacy@uctalent.io.

7. Sharing

We do not sell personal data. We share data only in the following cases.

7.1 Employers

When you apply, agree to be introduced, or agree to let employers view your profile. Expected salary is never shown on a public profile.

7.2 Referrers

The person who referred you sees only the status of the referral (for example applied or hired) so reward eligibility can be determined. They cannot see detailed assessments. Likewise, in the UPP program, the person who invited you sees only which steps you have completed (for example account created), never your profile or applications.

7.3 Members of the same workspace

Access is role-based. For example, interviewers see only candidates assigned to them, and not internal notes, salaries or rewards.

7.4 Service providers

Providers process data under contract and only as needed:

7.5 Public authorities

Where required by law, including updating hiring results on Vietnam's National Employment Exchange and reporting to employment authorities as required for job placement services, and in response to valid requests from competent authorities.

7.6 Business transfers

In a merger, acquisition or restructuring. The recipient must keep protecting your data under this Policy, and we will notify you.

8. Data from Google

When you connect a Google account, UCTalent requests only the permissions needed to send recruiting emails from your mailbox and to schedule interviews. We do not read your inbox. Consent is given separately for each workspace.

UCTalent's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, do not sell it, and do not use it to train AI models.

You can disconnect at any time in Settings or from your Google account permissions page.

9. Storage location and international transfers

Data is stored on servers located in Vietnam. When you or a company use AI features, de-identified CV content and job descriptions are sent to the Google Gemini API (or OPEN AI, Claude AI ) and may be processed outside Vietnam. Some other providers listed in section 7.4 may also process data abroad.

When we transfer data abroad, we:

• transfer only what is necessary for the stated purpose;
• put written data processing terms in place with the recipient;
• follow the procedures required by Vietnamese law for cross-border transfers of personal data.

If you are outside Vietnam, your data will be transferred to and processed in Vietnam.

10. Retention

11. Security

Key measures:

• encryption in transit (TLS);
• encryption at rest for financial and ID fields;
• hashed passwords;
• workspace isolation;
• role-based access;
• least-privilege staff access, with confidentiality commitments;
• access logging;
• regular backups;
• an incident response process.

Details are at uctalent.io/security. No system is completely secure. Please use a strong password, do not share your account, and tell us right away if you suspect unauthorised access.

12. Your rights

You have the right to:

• be informed about how your data is processed;
• give or withdraw consent;
• access, correct and obtain a copy of your data;
• request deletion;
• restrict or object to processing;
• complain, bring legal action and claim compensation.

How to exercise them: edit your profile and notifications in Settings; delete your account under Settings > Account; send any other request to privacy@uctalent.io.

Timelines: we acknowledge requests within 2 working days and respond within the statutory periods:

• 10 days for access, correction or data provision;
• 15 days for withdrawal of consent, restriction or objection;
• 20 days for deletion.

We may extend once as permitted by law and will tell you why. We may need to verify your identity first.

Some data cannot be deleted where the law requires us to keep it, such as contracts, invoices and tax records. Withdrawing consent does not affect processing carried out before the withdrawal.

If you are not satisfied with our response, you may complain to the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security of Vietnam, or to the data protection authority where you live.

13. Emails, notifications and marketing

Service notices (security, transactions, application status, changes to terms) are sent as needed to run your account.

Job alerts: you choose whether to turn them on at sign-up, and you can change their frequency or switch them off completely at any time in Settings. Every email has an unsubscribe link.

Marketing messages are sent only with your separate consent, which covers their content, channel and frequency. You can unsubscribe at any time.

14. Cookies

We use essential cookies for sign-in (including single sign-on across uctalent.io and business.uctalent.io) and for security. Analytics cookies (for aggregated statistics only, without recording individual user sessions) and advertising cookies (measuring and showing UCTalent ads on Facebook, Instagram, Google and LinkedIn) are used only with your consent through the cookie banner. We do not send CVs or profile data to advertising partners. You can change your choice under "Cookie settings" in the footer. Details are at uctalent.io/cookies.

15. Age

The Services are for people aged 18 and over. We do not knowingly collect children's data. If we find any, we will delete it.

16. Data breaches

If a personal data breach occurs, we will:

• contain and remediate it;
• notify the competent authority within the period required by law;
• notify affected individuals where the breach is likely to harm them;
• notify customer companies if their workspace data is involved.

17. Additional information by region

If you are in one of the countries below, you have additional rights under local law. Send requests to privacy@uctalent.io.

Singapore (PDPA): rights of access, correction and withdrawal of consent; you may complain to the PDPC.

Hong Kong (PDPO): rights to request access and correction; you may complain to the PCPD.

Australia (Privacy Act 1988): rights of access and correction; you may complain to the OAIC.

Japan and Republic of Korea: additional information will be published before UCTalent formally offers the Services in these markets.

18. Changes to this Policy

For material changes, we will notify you by email or in-app at least 30 days before they take effect, and ask for your consent again where the law requires. Previous versions are kept at uctalent.io/privacy/history.

19. Contact

UCTalent Labs Company Limited – 50 Hoang Hiep, Hoa Xuan Ward, Da Nang City, Vietnam

Personal data: privacy@uctalent.io · General support: support@uctalent.io

20. Language

This Policy is provided in Vietnamese and English. If they differ, the Vietnamese version prevails; for consumers, the interpretation more favourable to them applies.