Corporate Governance
& Compliance

This Job Applicant Privacy Policy (the “Policy”) is designed to explain how CommerceGate Payment Solutions S.L.U., together with its affiliated companies and subsidiaries (collectively, “CommerceGate”), collects, uses, and protects the personal data of individuals who apply for roles with us (“you” or “your”).

By submitting a job application to CommerceGate—whether through our own online platforms or via third-party systems—you are acknowledging and agreeing to the terms set out in this Policy. If you do not accept the terms described here, we kindly ask that you do not submit your application.

Note: This Policy is strictly limited to the handling of personal data collected for recruitment purposes. For information on how we process data related to our products or services, please refer to the CommerceGate Privacy Policy, which is accessible via our website.

Our websites may also include links to other websites operated by third parties, which are subject to their own privacy practices. If you provide your personal data to any of these sites, that data will be governed by their respective privacy policies. We encourage you to review those policies carefully.

Purposes of This Policy

This Policy is meant to:

• Outline what kinds of personal data we collect from job applicants and candidates
• Explain how and why we use your data
• Describe the legal grounds that allow us to process your data
• Clarify how long your information is kept
• Inform you of your rights under data protection laws
• Identify any parties your data may be shared with
• Explain the safeguards we have in place to protect your information

Definitions and Legal References

Terms that begin with a capital letter in this Policy are based on definitions found in:

• The General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
• Spain’s Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD)
• Other applicable data protection laws

Please note that the terms Personal Information and Personal Data are used interchangeably in this Policy and refer to the same concept.

What We Collect From You

As part of the recruitment process, CommerceGate collects various types of personal data to assess your qualifications and manage your application. This information may fall under the following categories:

Personal Details

Includes your name, date of birth, nationality, contact information (email, phone number, physical address), education history, social media profiles (e.g., LinkedIn), and any details you provide in your CV, cover letter, or during interviews.

Employment and Professional Data

Covers job titles, previous or current employers, professional references, and any information gathered through background checks.

Recruitment-Related Information

This includes your application history, work preferences, assessments (such as skills tests or interviews), visa and relocation information, reference feedback, and any other materials shared during the hiring process.

Compensation Information

Includes your previous salary details and expectations, and where relevant, your banking information for offer processing.

Technical and Site Usage Data

We may collect your IP address, browser data, site activity (e.g., clicks on our Careers page), and data from corporate systems (e.g., Wi-Fi access logs or monitored access to our buildings or equipment). Video surveillance data may also be collected if you visit one of our offices.

Sensitive Data

This may include demographic information (e.g., race, gender, disability status), background check results, criminal history (if permitted by law), or health-related information necessary for workplace accommodations.

Other Information You Choose to Share

This includes any additional information you provide voluntarily, as well as personal data about third parties, such as references. If you share someone else’s personal data, please make sure you have their permission to do so.

Children’s Data

Our Careers pages and job application tools are not designed for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that an application has been submitted by someone under 16, we will delete that information. By applying, you confirm that you are at least 16 years old. If you believe a child’s data has been submitted to us in error, please contact us at dpo@cgpaytech.com.

Use of Anonymized or Aggregated Information

CommerceGate may take steps to anonymize or aggregate personal data, meaning it can no longer be linked to you. This data may be used for statistical analysis, internal research, or other business purposes, and may be shared with third parties at our discretion, provided it cannot be used to identify you.

Your Role in Protecting Your Data

It is your responsibility to ensure the information you submit is accurate and up to date. You are under no legal obligation to provide us with your personal data. However, not providing certain details—such as your CV or contact information—may prevent us from considering your application.

How CommerceGate Collects Your Personal Information

At CommerceGate, we gather your personal information from a variety of sources, with most of it coming straight from you during the hiring process.

You usually share this information when applying for a role through our Careers page—either on CommerceGate’s own website or a third-party platform. You might also provide personal details through emails, phone calls, virtual meetings, or during interviews. If you receive and accept a job or business offer from us, we may request additional information to prepare necessary documentation or support your onboarding.

When certain information is required—for example, your CV—we’ll clearly let you know. Without these key details, we may not be able to move forward with your application. You can also choose to voluntarily share additional information with us, including sensitive data, depending on your preferences and comfort level.

In most cases, we collect sensitive information directly from you. However, in some situations (such as background screening), we may receive it from trusted third-party providers—only when legally allowed.

Sometimes, you might share personal details about other people, such as professional references. Before doing so, you must inform those individuals that you’re passing along their information to us and explain how it will be used.

We may also access information you’ve made publicly available—such as your professional profile on platforms like LinkedIn—as part of our evaluation process.

In addition to direct communication, we may receive information from external sources, such as previous employers, academic institutions, credentialing bodies, or identity verification services. These sources help us validate qualifications, work experience, or licenses relevant to the role.

There are instances where we may gather information through technical systems. For example, if you visit a CommerceGate office, we may collect data through security tools like access control systems or CCTV, in line with local laws and our internal protocols. You’ll be informed if such monitoring applies.

When you browse our website, including the Careers section, we also collect certain data through cookies and web logs to better understand how our site is used. For more details about how cookies work and how you can manage them, please see our Cookie Policy, available via the link on our website.

Legal Basis for Processing Your Personal Information

The reasons we collect and use your personal information vary depending on the kind of information you provide and why we need it. We always process your personal data based on a legal foundation, as required by applicable privacy laws.

In some situations, we’ll ask for your explicit consent—but only when necessary. This happens when the law requires us to obtain your permission before processing specific types of data or using it for particular purposes. When this is the case, we’ll clearly explain why we’re asking, what your options are, and what happens if you choose not to consent. For example, you might choose to allow us to keep your application on file and contact you about future job opportunities.

When you’re offered a position with us, your information may be processed to prepare or fulfill a contract. This includes steps we take before your official start date, like preparing employment documents.

We may also need to process your information to meet legal obligations. For instance, we may be required to retain certain records, ensure workplace safety, or prevent discrimination. In these cases, processing is based on laws that apply to CommerceGate as an employer.

Sometimes we rely on what’s known as legitimate interest. This means we use your data in a way that supports our business operations, as long as your rights and freedoms aren’t negatively affected. When we rely on this basis, we put safeguards in place to respect your privacy and protect your data.

In all cases, our use of your personal information is grounded in the legal frameworks that apply to us—including the GDPR, national data protection laws, and any other relevant regulations.

How We Use Your Personal Data

Your personal information is collected and used throughout the recruitment process and, where necessary, to support human resources, legal, and compliance obligations.

Recruitment and Hiring Activities
We use your data to assess your qualifications, communicate with you during the hiring process, schedule interviews, conduct assessments, and make hiring decisions. If you are offered and accept a position, your information is also used to prepare employment contracts and onboarding documentation.

Future Opportunities
With your permission, we may retain your details to contact you about future roles that match your experience and career interests.

Verification and Background Checks
Your data may be used to confirm your identity, contact references, and—where permitted by law—perform background screening or similar verification processes.

HR Administration and Logistics
We may process your data to maintain up-to-date HR records, manage system and building access, and maintain effective communications.

Health and Safety Compliance
Where applicable, we may collect health-related data to evaluate your fitness for work, provide accommodations, or determine your eligibility for certain benefits. Such processing is done in compliance with health and safety regulations.

Equality, Diversity, and Inclusion Monitoring
We may analyze anonymized diversity data to promote fair hiring practices and ensure equal opportunity across all recruitment activities.

Compliance, Security, and Legal Obligations
Your personal data may be used to prevent fraud, detect policy violations, safeguard our IT infrastructure, and protect physical assets. It may also be processed to comply with applicable legal requirements or in response to lawful requests such as court orders or regulatory investigations.

Internal Access Within CommerceGate Group
For operational efficiency and global HR support, your data may be accessed by relevant teams within the CommerceGate group. Access is restricted to only those individuals who need the information for specific and lawful purposes.

Third-Party Service Providers
We work with trusted external partners who support our recruitment and HR functions—such as background check vendors, HR platforms, communication providers, and IT system operators. These service providers only access your data when necessary and are bound by strict confidentiality and data protection agreements. Some may also use advanced technologies, such as AI, to support hiring evaluations in a fair and secure manner.

Business Transitions
In the event of mergers, acquisitions, or reorganizations, your data may be shared with relevant third parties in accordance with applicable laws and only when necessary for such corporate transitions.

How Long We Keep Your Personal Data

We retain your personal information only for as long as necessary to fulfill the purpose for which it was collected, or to meet legal and contractual requirements.

Successful Applicants
If you join CommerceGate, your personal data will continue to be processed under a separate workforce privacy notice covering your employment or engagement with us.

Unsuccessful Applicants or Withdrawals
If you are not selected or choose not to proceed with the application, we may retain your data for a limited time to evaluate our recruitment efforts or consider you for future opportunities. With your consent, we may hold your information for up to two years or longer, depending on regional laws.

Extended Retention for Legal Purposes
In certain cases—such as complaints, audits, or anticipated legal proceedings—we may retain your data for longer periods to ensure we have accurate records.

Data Storage and Security
We use secure databases and systems to store different types of applicant data. Access is strictly controlled and limited to authorized personnel. When we rely on third-party platforms, we ensure they follow strict data retention and security standards in accordance with our policies.

Data Disposal
Once your data is no longer needed or required to be kept, we will delete, anonymize, or securely dispose of it following internal data retention and destruction procedures.

Your Data Protection Rights

As a data subject, you have several rights under applicable data protection laws such as the GDPR.

Right to Be Informed
You have the right to receive clear and transparent information about how your data is processed. This Policy is part of how we fulfill that obligation.

Right to Withdraw Consent
If you have given consent for specific processing, you may withdraw it at any time. This will not affect any data processed before the withdrawal.

Right of Access
You may request access to the personal information we hold about you, along with details on how it’s used and shared. We will respond to your verified request within the legal timeframe.

Right to Rectification
You can ask us to correct any inaccurate or outdated information we have about you. We encourage you to keep your contact and personal details up to date.

Right to Erasure (“Right to Be Forgotten”)
You may ask us to delete your personal data in certain situations—such as when it is no longer needed or if it has been processed unlawfully. Legal exceptions may apply in some cases.

Right to Restrict Processing
You can request that we temporarily limit how your information is used—for example, while we verify accuracy or assess an objection.

Right to Object
You may object to how your data is processed if we rely on legitimate interests as the basis. We will assess your objection and stop processing unless we have a compelling reason to continue.

Right to Data Portability
You can request your data in a structured, commonly used format to transfer it to another company or for your own use.

Right Against Automated Decisions
We do not use fully automated decision-making (including profiling) in the recruitment process. All significant decisions involve human input.

Right to File a Complaint
You have the right to raise a concern with a data protection authority if you believe your data rights have been violated.

Additional Rights
Depending on your location, additional rights may apply.

International Transfers of Personal Data

Your personal information may be transferred to, or accessed from, countries outside of your home jurisdiction—including countries where CommerceGate or its service providers operate. Any such transfer is done lawfully, using appropriate safeguards such as:

• Standard contractual clauses approved by data protection authorities
• Decisions confirming that the receiving country offers adequate data protection
• Supplementary measures where necessary to protect your rights

We ensure that all international transfers are limited to what is essential and that your data is handled securely.

How We Protect Your Personal Data

CommerceGate applies a combination of technical and organizational measures to protect your personal data against loss, misuse, or unauthorized access. These measures include:

• Encryption of data in transit
• Restricted access to data, limited to authorized personnel only
• Secure data storage systems with strong password and access protocols
• Regular monitoring and auditing of data protection practices

We also require our third-party service providers to implement similar high standards of data protection and confidentiality.

If you would like more details about how we secure your personal data—especially regarding international transfers—you may contact us directly.

Updates to This Policy

From time to time, we may update this Privacy Policy to reflect changes in how we handle your personal data or to comply with new laws. If material changes are made, we will notify you by email or through a notice on our careers website.

We recommend reviewing this Policy periodically to stay informed about how we protect your privacy.

Contacting Us

If you have questions about this Privacy Policy, your personal data, or your rights under data protection laws, you are welcome to contact CommerceGate.

CommerceGate Payment Solutions S.L.U.

Registered at: World Trade Center, North Building, 4th floor. C/Moll de Barcelona S/N, 08039, Barcelona, Spain.

CommerceGate is a private limited liability company, incorporated under the laws of Spain and registered under the number B67016634. CommerceGate is a EU authorized Payment Institution, licensed by the Bank of Spain under the license number 6896.

Phone: +34 931 149 991
info@cgpaytech.com
https://www.cgpaytech.com/

Data Protection Officer dpo@cgpaytech.com