Global Applicant and Job Candidate Privacy Notice

This Privacy Notice describes how Uphold collects, uses, and shares your Personal Data when you apply for a role with us, interact with our careers website or recruitment platforms, or otherwise participate in our recruitment process. It answers the following questions:

• Where does this Privacy Notice apply?
• How do we collect Personal Data about you?
• What Personal Data do we collect?
• How do we use your Personal Data and on what legal basis?
• How do we keep your Personal Data safe?
• How do we share your Personal Data?
• Do we transfer your Personal Data internationally?
• What does Uphold’s real-time public reserve transparency mean for your Personal Data?
• What are your legal data privacy rights?
• How long do we retain your Personal Data?
• How do we make changes to this Privacy Notice?
• Who can you contact if you have further questions about your privacy?

Uphold Group consists of several affiliated entities worldwide, including Uphold HQ Inc., Uphold Worldwide Ltd., Uphold International Equities, Inc., Uphold Operating Canada Ltd., Uphold Europe Limited, UAB Uphold Digital Assets Europe, Unipessoal Lda in Portugal, and other affiliates.

The entity responsible for processing your Personal Data will generally be the Uphold entity to which you are applying, or which is conducting the recruitment process.

For applicants residing in Canada, the entity responsible for processing your Personal Data is Uphold Operating Canada Ltd.

If you are applying for a role with an entity located in the United Kingdom or European Economic Area, your Personal Data will be processed in accordance with applicable local data protection laws.
It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice that we may provide to you on specific occasions when we collect or process your Personal Data, so that you are fully aware of how and why we are using your information. This Privacy Notice supplements other notices and is not intended to override them.

How do we collect Personal Data about you?

We collect Personal Data about you when you apply for a role with us and throughout the recruitment process. “Personal Data” means any information that identifies you or relates to an identifiable individual. Personal Data” means information that identifies you or relates to an identifiable individual. Definitions may vary depending on local data protection laws.

The types of personal data we may collect, use, or process about you will depend upon the nature of the job to which you have applied or are being recruited for, and the location of the job. 

• Personal Identifiers & Contact Information: such as your name, title, phone number, date of birth, home address, and personal email address.
  
  
• Job Application Information & Professional or Employment Related Information: such as position applied for, previous roles, job description, responsibilities and assignments, years of service, qualifications and experience, compensation and salary data,  membership in professional organizations and professional certifications, eligibility for and participation in benefit schemes, and other information contained in your CV/resume.  
  
  
• Educational Information & Qualifications: such as your highest level of education, the schools you attended and when you attended them, degrees, certificates or other educational qualifications, your academic transcripts, and educational references.
  
  
• Financial Information: such as your desired salary, bonus, benefits, and stock or equity grants. You may choose to provide information about your compensation expectations. Where required by applicable law, we do not request or rely upon prior salary history information.
• Background Check Information: When permitted by applicable law, we may choose to conduct a background check in connection with your application, such as to verify professional and educational history and qualifications, creditworthiness, or identify criminal history that may be relevant for a position with us. The results of the background check may include personal data we do not already have about you.
  
  
• Nationality, Citizenship and Right to Work Information: such as country of birth, government identification documents (including passports and residency permits), and, where relevant, visa information.
  
  
• Other Application and Interview Information: any personal data you choose to share with us in your interview or application, CV, resume, transcripts, or other supporting documentation, or to help us coordinate travel for an interview.
  
  
• Equal Opportunity Information & Protected Classifications Under California and U.S. Federal Law: as part of our diversity and inclusion strategy, depending on jurisdiction, we will monitor and report on gender/gender identity, race, ethnicity, and veteran status when you choose to provide it and where this is applicable. As part of the standard recruitment process outside of the equal opportunity monitoring, where permitted or required by law, we may also collect information related to age, national origin, citizenship, sex, gender identity, gender expression, sexual orientation, religion, disability or accommodation request, or marital status. You are not obligated to provide any of this information. When you choose to provide any such information, it will not be used in the hiring decision, unless specifically permitted by law.

Although we often collect the personal data described above directly from you (for example, from the application forms that you submit to us), we may also collect certain information from references, recruiters, job-related social media sites (such as LinkedIn), and publicly available sources. 
In addition, we may also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers, scheduling providers, and application providers.

Finally, we may collect personal data about you through background checks and credit reference agencies where permitted or required by law. 
When you visit our careers website, our service providers and we may automatically collect certain technical information using cookies, web beacons, tags, scripts, and similar technologies. This may include your IP address, browser type, device information, and usage data.
We use this information to operate and secure our recruitment systems, enable application functionality, measure site performance, and prevent fraud.

For more information about how we use cookies and how you can manage your preferences, please see our Cookie Policy.

How do we use your Personal Data and on what legal basis?

We use and process your personal data for certain purposes that align with applicable data protection law in the jurisdiction in which you are located. We use your information:

We use your Personal Data to:

• Communicate with you about your application and other career opportunities.
  
  
• Assess your application and make hiring decisions.

• Verify your eligibility to work and comply with legal obligations.

• Maintain secure and reliable systems and prevent fraud.

• Manage and defend legal claims.

• Analyse and improve recruitment processes, including diversity monitoring where permitted by law.
  
  

Legal Bases for Processing Your Personal Information

Where required by applicable data protection laws, we rely on specific legal bases for processing your personal data. These legal bases are described in the table below:

Category of Personal Data	How We Use It	Legal Basis for Processing
Personal Identifiers and Contact Information	To manage your application and communicate with you about recruitment opportunities.To manage your application and communicate with you about recruitment opportunities.	Legitimate interests in managing recruitment processes and communicating with applicants.
Job Application, Professional, Employment, and Educational Information	To assess your suitability for a role, determine compensation and benefits eligibility, and improve our recruitment processes.	Steps taken before entering into a contract, and our legitimate interests in managing recruitment.
Reference Checks and Screening Information.	To verify your qualifications and assess your suitability for a role.	Steps taken before entering into a contract and compliance with legal obligations, where applicable.
Nationality, Citizenship, and Right to Work Information	To verify your eligibility to work and comply with legal requirements.	Compliance with legal obligations.
Interview Information	To evaluate your application and determine suitability for a role.	Steps taken before entering into a contract and legitimate interests in managing recruitment.
Information Provided by You in the Course of the Application Process	To assess your application and support recruitment decision-making.	Steps taken before entering into a contract and legitimate interests in managing recruitment.
Equal Opportunity Information (U.S. only)	To comply with legal reporting obligations and support diversity and inclusion monitoring. Where possible, this information is anonymised or aggregated.	Compliance with legal obligations or your consent where required by law.

How do we keep your personal data safe?

We have implemented security measures to prevent your Personal Data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorized way.

We protect your Personal Data by maintaining physical, electronic, and procedural safeguards, incorporating tested security technologies in line with applicable laws, and considering the sensitivity of the data. For example, we may use firewalls, encryption, and access controls, and restrict access to employees and authorized third parties who need it to perform their job responsibilities.

Those with access to your Personal Data are required to keep it confidential and are carefully screened and periodically reviewed to ensure ongoing compliance with our privacy and security standards.

How do we share your Personal Data?

We take care to allow your personal information to be accessed only by those who require access to perform their tasks and duties, and to share only with third parties who have a legitimate purpose for accessing it. Uphold will never sell or rent Applicant's personal information to third parties. We will only share your information in the following circumstances:

• Your personal information will be shared with Uphold employees where it is necessary for them to undertake their duties with respect to our hiring process. This includes, for example, Uphold’s People Department, which facilitates Uphold’s recruitment efforts and maintains employment records, and the direct hiring manager or others involved in the interview process.
• We may share your personal information with the other Uphold Group entities identified in this policy as may be necessary to administer our relationship with you or operate our business.
  
  
• We may also disclose your personal information for the purposes described previously to:

• • references as part of the recruitment process (provided we obtained your consent); 

  • third-party service providers who assist us in administering our hiring process; 

  • credit and criminal background check companies (where this is our legal obligation or necessary for our legitimate interest); 

  • professional service providers and advisors who perform functions on our behalf, such as lawyers; and

  • government, regulatory authorities, and other organizations (such as the police or other law enforcement agents) as required or authorized by law or other regulatory requirements in jurisdictions in which we operate.

• We may also disclose your personal information to third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets in circumstances that may require the use or transfer of such personal information. This may also include, without limitation, in connection with any bankruptcy or insolvency event. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this privacy notice.
  
  
• Finally, we may collect, use, and disclose your personal information for other purposes not listed in this Privacy Notice. If we do so, we will make it known to you at the time we collect, use or disclose your personal information, and, where required, obtain your consent for doing so.

Do we transfer your Personal Data internationally?

Uphold operates entities and offices around the world. As part of our global operations, your Personal Data may be transferred between Uphold entities and their service providers in countries outside of your jurisdiction, including countries where privacy laws may be less stringent than those in your country.

When we transfer your Personal Data internationally, we take appropriate measures to ensure it is protected in accordance with applicable privacy laws. These measures may include:

• entering into contracts incorporating Standard Contractual Clauses approved by the European Commission for transfers from the UK or EEA;

• relying on adequacy decisions where a country is deemed to provide an adequate level of protection; or

• other safeguards required under local law.

Your Personal Data will only be shared internationally when necessary to operate our business or manage the recruitment process. We limit access to Personal Data to employees and third parties who need it for legitimate business purposes and require them to maintain confidentiality.

What does Uphold’s real-time public reserve transparency mean for your personal data?

Uphold maintains real-time public reserve transparency to provide certain aggregated and anonymized information about our financial reserves. Your personal data as a job applicant is not included in this public transparency. The transparency practice only involves aggregated data and does not expose, identify, or share any personal information about candidates or job applicants.

What are your legal data privacy rights?

Depending on the privacy laws applicable in your location, you may have certain rights with respect to your personal information as described below: 

• Request Access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.. 

• Request correction of your personal data. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it. You also have the right to ask us to erase your personal data where you have successfully exercised your right to object, where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law.

• Object to the processing of your personal data. This applies where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object. You also have the right to object to where we are processing your personal data for direct marketing purposes.

• Request restriction of processing. This enables you to ask us to suspend the processing of your personal data in certain scenarios.

• Request the transfer of your personal data. You may request that we provide your personal data to you, or to a third party you have chosen, in a structured, commonly used, machine-readable format.

• Withdraw consent. Where we are relying on consent to process your personal data, you may withdraw your consent at any time. Your withdrawal will not affect the lawfulness of processing before the withdrawal.

We may request additional information to verify your identity before fulfilling a request related to your personal data. This is a security measure to ensure personal data is not disclosed to anyone without the right to access it.

We strive to respond to all legitimate requests within one month. Complex cases or multiple requests may take longer, but we will notify you and keep you updated.

Depending on where you reside, you may have specific rights under applicable privacy laws, such as the California Consumer Privacy Act (CCPA/CPRA) or EU/EEA data protection laws. These may include the right to access, correct, delete, restrict, or object to certain processing, and to withdraw consent where relevant.

To exercise one of the above rights, please contact Uphold by contacting Support, or by post at:

• UK: Suite A, 6 Honduras Street, London, England, EC1Y 0TH

• EU & EEA: Uphold Digital Assets Europe Unipessoal Lda, Rua do Alecrim 26, 1200-018 Lisbon, Portugal

• US/ROW: Uphold HQ Inc., 530 Fifth Avenue, Suite 3A, New York, NY 10036

Your rights are subject to applicable legal restrictions, and we may take appropriate steps to verify your identity before responding to your request. We will not discriminate against you for exercising your rights. 

How long do we retain your data?

We retain your personal information only for as long as necessary to evaluate your application, comply with legal obligations, and support our legitimate business interests.

If you are successful in your application, your recruitment information will become part of your personnel record and will be retained in accordance with applicable local law and our internal records retention policies.

If your application is unsuccessful, we will retain your personal data for up to 12 months from the date the recruitment process concludes. We retain this information to defend against or manage potential legal claims, comply with regulatory or legal obligations, analyse and improve our recruitment processes, and, where permitted or with your consent where required, consider you for future opportunities at Uphold.

Equal Opportunities information is stored separately from your application data and may be anonymised and/or aggregated for monitoring, reporting, and improving our recruitment practices. Once anonymised, this information no longer identifies you and may be retained for statistical purposes.

How do we make changes to this Privacy Notice?

We may update this Privacy Notice from time to time. The “Last Updated” date at the top indicates the most recent version. Material changes will be communicated to applicants where required by law, typically via the contact information you provide during the recruitment process.

Who can you contact if you have further questions about your privacy?

To exercise your rights or submit questions about this Privacy Notice, please contact Uphold:

• Support Team: via the Uphold platform or your application portal

• By email: [email protected]

• By post:

• UK: Suite A, 6 Honduras Street, London, England, EC1Y 0TH

• EU & EEA: Uphold Digital Assets Europe Unipessoal Lda, Rua do Alecrim 26, 1200-018 Lisbon, Portugal

• US/ROW: Uphold HQ Inc. 530 Fifth Avenue, Suite 3A, New York, NY 10036