Hiree365 Candidate Privacy Notice

1. About this notice

1.1 What Hiree365 is

Hiree365 is a campus recruitment and employability platform. Institutions — universities, colleges, academies and vocational training providers — use it to run placement and careers programmes: building candidate profiles, publishing opportunities, managing applications, arranging campus drives and interviews, and tracking outcomes. It is sold both on its own and bundled with Classe365, our student information system and learning management system.

1.2 What this notice does

This notice explains what personal information Hiree365 holds about candidates, why, who sees it, how long it is kept, and what rights a candidate has. It sets out one point that matters more than any other and that candidates ask about most: employers receive your personal data only via your institution. We do not give your information to employers ourselves. Section 6 explains that in full.

Candidates are a distinct group with distinct concerns, which is why they have their own notice rather than a paragraph inside a general policy.

1.3 Which entity contracts

We use a regional contracting model. The entity that contracts depends on where the institution customer is located.

• Customers located in the United States contract with 365 Software, LLC, a Delaware limited liability company, registered office 131 Continental Dr, Suite 305, Newark, DE 19713, New Castle County, United States; registered agent Legalinc Corporate Services Inc. Governing law: the State of Delaware. Courts of the State of Delaware.

• All other customers, including those in the European Union, the United Kingdom, Australia and the rest of the world, contract with Sprout On Web Pty Ltd, ABN 72 138 602 418, registered office 22 Palm Street, St Ives, NSW 2075, Australia; business address 22 Giffnock Avenue, Macquarie Park, NSW 2113, Australia. Governing law: New South Wales, Australia. Courts of New South Wales.

• Support and engineering are provided 24/7 by Classe365 group staff in Australia, India, the Philippines, Spain and the United States. Section 11 explains what that means for candidate data, and candidates should read it.

In this notice, “Classe365”, “we”, “us” and “our” mean the contracting entity for your institution, together with the other Classe365 group companies whose staff support it. If you want to know which entity holds your information, ask your institution or email clientservice@classe365.com and we will tell you.

1.4 Related documents

Read this notice with our Privacy Policy, which is the master document covering all of our processing and describes our roles, sub-processors, hosting, security and international transfers in full; the Personal Data Processing Agreement, which governs our processing on behalf of an institution and sets out the transfer mechanisms we rely on; the AI Use and Transparency Statement; the Cookie Policy; and, where a United States institution is involved, the FERPA Compliance Statement. Where this notice summarises a topic covered in more detail elsewhere, the more detailed document governs.

2. The three user types

Hiree365 has three kinds of user, and what we do with information depends on which one you are.

2.1 Candidates — students and graduates seeking employment

You hold a candidate profile, apply for opportunities, take part in campus drives and assessments, and track your applications. Your profile normally exists because your institution enrolled you in its placement programme, or because you signed up through your institution’s careers service.

Your institution decides what a candidate profile contains, which employers and opportunities appear, and what is shared with an employer. Your institution is the controller of your candidate record and we are the processor; in United States terms, we are a service provider to the institution. Where your institution is a United States educational agency or institution subject to FERPA, your candidate record is an education record and we act as a school official with a legitimate educational interest, under the institution’s direct control.

2.2 Institutions — running campus placement

Placement officers, careers advisers and administrators use Hiree365 to run the programme: enrolling candidates, curating opportunities, inviting employers, running campus drives, shortlisting, and reporting on outcomes. The institution decides what is collected, what is shared, and with whom.

2.3 Employers — seeking candidates

Employers use Hiree365 to work with an institution’s placement office: posting vacancies, taking part in campus drives, and receiving the candidate information the institution decides to share with them. We hold contact and organisation details for employer users, records of vacancies posted and drives run, and the employer’s interactions with institutions. For employer users’ own account details, we act on behalf of the institution that invited the employer, and our Privacy Policy describes the limited processing we carry out for our own purposes, such as security and support.

An employer does not have open access to candidate profiles. Section 6 explains the boundary.

3. Minimum age: 16

Hiree365 has a minimum age of 16. It is not available to anyone under 16, and it has no users under 13.

We do not create candidate accounts for people under 16, we do not accept candidate registrations from people under 16, and institutions are contractually required not to enrol anyone under 16 in a Hiree365 placement programme.

Because there are no users under 13, the requirements of the United States Children’s Online Privacy Protection Act do not arise for Hiree365. Our COPPA position for Classe365, where children under 13 do have records — including the institution’s authorisation of our collection and use of children’s information for its educational purpose — is set out in the Children’s Privacy Policy and the Notice to Parents; neither applies to Hiree365.

If we become aware that a person under 16 holds a Hiree365 account, we notify the institution and the account is removed and its data deleted under the schedule in section 10.

Where a candidate is under 18, the institution should limit what it shares with employers to what the placement needs, and must follow any law in its country that gives young people extra protection.

4. The personal information we hold about candidates

What is actually held depends on what your institution collects and what you choose to provide. Nothing in this list is collected by us on our own initiative.

4.1 Profile information

• Name, and the contact details you or your institution provide: email address, telephone number, and postal or residential address where recorded.

• Date of birth, where the institution records it.

• Your institution, student or candidate reference number, and your relationship to the institution.

• A profile photograph, where you or the institution uploads one.

• Work eligibility and location preferences, where you record them — for example the cities or regions you are willing to work in.

4.2 Education history

• Programme or course of study, specialisation, year of study and expected or actual graduation year.

• Academic results, grade point average, class or division, and transcripts, where the institution shares them into the placement record.

• Prior education, certifications and qualifications you list.

• Awards, honours and academic distinctions you record.

4.3 CV and supporting documents

• Your curriculum vitae or résumé, cover letters, portfolios, project work, writing samples, references and any other supporting document you upload or your institution uploads for you.

• Anything you choose to put in those documents is held as you wrote it. If you include information you would rather not share with employers, remove it before uploading.

4.4 Skills and experience

• Skills, competencies and skill levels you record or that an assessment produces.

• Work experience, internships, part-time roles, volunteering and extracurricular activity.

• Languages, technical proficiencies, licences and certifications.

4.5 Assessment and placement records

• Results of assessments, aptitude tests, skill tests and employability exercises run through the platform by your institution.

• Interview scheduling, participation in campus drives, feedback the institution records, shortlisting decisions, offers made and outcomes.

• Placement status: registered, shortlisted, interviewed, offered, placed, or opted out.

• Notes your institution’s placement staff record about your readiness, coaching or preferences.

4.6 Application activity

• Opportunities viewed, saved and applied for.

• Application status and history, withdrawal of an application, and the outcome.

• Communications with your institution’s placement office through the platform.

4.7 Account and technical data

• Username, hashed password, and authentication and single sign-on identifiers.

• Sign-in records, IP address, device and browser information, and records of activity in the platform.

• Cookies and similar identifiers as described in the Cookie Policy. We do not place third-party advertising cookies in the authenticated platform.

4.8 What we do not collect

• We do not collect or process biometric identifiers ourselves. Hiree365 does not collect, store or process fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints, and does not perform facial or voice recognition. Institutions may choose to enable SMOWL, a third-party online proctoring service, which they contract with directly; any biometric processing by SMOWL occurs under SMOWL’s own terms and privacy policy, not ours.

• We do not require any government-issued identifier — a national identity number, social security number, tax number, passport number or driving licence number — to provide the platform. Where an institution configures its own forms to collect one, that identifier is treated as personal information, protected like the rest of the record, and held under the retention schedule in section 10.

• We do not enrich your profile from outside sources and we do not scrape social media. Where your institution has enabled AI features, some of them produce inferences, such as an engagement pattern, a risk-of-disengagement flag or a suggested match. These are advisory and are described in section 9.

4.9 Sensitive information

If your institution records health, disability or accessibility information, or information that reveals racial or ethnic origin, religion or similar characteristics — for example because it runs an accessibility adjustment process or a diversity programme — that information is held only because the institution chose to record it, is restricted to the institution’s own tenant and the people it authorises, subject to the support access described in section 11.2, is subject to the same encryption and access controls as the rest of the record, is never used for advertising or to train shared AI models, and is deleted on the same schedule. The institution is responsible for identifying its own lawful condition for holding it.

5. How candidate data is used

Candidate information is used to run the institution’s placement programme, on the institution’s instructions:

1. Creating and maintaining your candidate profile.

2. Registering you for the institution’s placement programme and recording your eligibility and preferences.

3. Showing you opportunities the institution has published or curated.

4. Managing your applications: submission, status, shortlisting, scheduling and outcome.

5. Running campus drives, interviews and assessment events.

6. Running employability assessments and recording results.

7. Enabling the institution to prepare and share candidate information with employers as part of its placement programme, within the limits in section 6.

8. Communication between you and the institution’s placement office.

9. Producing reports and analytics for the institution about its own placement programme and cohort outcomes.

10. Providing AI-assisted features the institution has enabled, within the limits in section 9.

11. Providing technical support, diagnosing faults, restoring data, keeping activity records and keeping the platform secure.

5.1 What we never do with candidate data

• We do not sell candidate personal information. Not to employers, not to recruiters, not to data brokers, not to anyone.

• We do not disclose candidate data directly to employers. See section 6.

• We do not serve advertising inside the authenticated platform, and we do not use candidate data for advertising or to build advertising profiles, or share it for cross-context behavioural advertising.

• We do not use candidate data to train, fine-tune or improve any general-purpose or shared AI model. See section 9.

• We do not send you our own marketing. We market to institutions and employers, not to candidates, and candidate records are never used to build a marketing list.

• We do not operate our own job board, candidate pool or talent database of our own from institutions’ candidate records, and we do not make candidates available to employers outside an institution’s programme.

6. Employers receive your data only through your institution

This is the most important boundary in Hiree365 and we state it without qualification.

Employers receive candidate personal data only via the institution. We do not disclose candidate data directly to employers on our own initiative. The institution controls what is shared as part of its placement programme.

6.1 What that means in practice

1. There is no open candidate database for employers. An employer cannot browse, search or filter an institution’s candidate records. It sees only the candidates and information the institution chooses to share with it.

2. The institution decides what an employer sees. Your institution’s placement office decides which candidates are put forward for which opportunity, which fields of the profile are included, and whether documents such as a CV or transcript are attached. It can share a shortlist, a full profile, a partial profile, or nothing.

3. The institution decides when. Sharing happens when the institution shares it, as part of a specific placement activity — an application it forwards, a shortlist it sends, a campus drive it runs.

4. We do not add to it. We do not supplement what the institution shares with information of our own, and we do not pass an employer any candidate information the institution has not chosen to share.

5. We do not sell or license candidate profiles to employers, and no employer pays us for access to candidates.

6.2 Your control, and where it sits

Because the institution controls what is shared, your control over employer disclosure runs through the institution. If you want to know what has been shared about you and with whom, ask your institution’s placement office — it holds that record and can tell you. If you do not want to be put forward for a particular employer or opportunity, tell the placement office, and it can act on that in the platform.

You can also ask us, at clientservice@classe365.com, and we will help you reach the right contact and give the institution reasonable technical help to answer you. What we will not do is disclose, change or withdraw something inside an institution’s tenant on our own initiative, because that would mean overriding the institution and altering your placement record without the institution’s knowledge. Section 13 explains how we route requests.

6.3 Once an employer holds your information

When an institution shares your information with an employer, the employer becomes responsible for what it then does with it, as a controller in its own right under its own privacy notice and under the terms of its arrangement with the institution. Employers using Hiree365 agree to use candidate information only for the recruitment activity the institution shared it for, to keep it confidential, and not to use it for any unrelated purpose. If you want to know what an employer does with your information after it receives it, the employer’s own privacy notice governs, and your institution can tell you which employers hold your details.

7. Institutions, employers and their own information

For an institution’s staff users and an employer’s staff users, we hold name, work email address, telephone number, job title, account credentials, sign-in and usage records, and records of what they did in the platform. For employer organisations we also hold company name, industry, size, locations and recruitment requirements, together with vacancies posted, drives run and interactions with institutions.

We use that information to provide and administer the platform, to bill and support the account, to keep the service secure, and — for business contacts at institutions and employers only — to send business-to-business marketing about our products, events and content, which they can opt out of at any time. We do not send marketing to candidates.

8. Legal bases

Where the UK GDPR or the EU GDPR applies, the legal bases below apply. Remember that for candidate records the institution is the controller and chooses the basis for its own processing; these are the bases we rely on for the processing we control and those that support our processing as processor.

8.1 Performance of a contract — Article 6(1)(b)

We rely on this to administer the customer account, provide the platform to the contracting institution or employer, manage sign-in and authentication, bill and collect payment, and support the users named under the contract.

8.2 Legitimate interests — Article 6(1)(f)

We rely on legitimate interests for keeping the platform and our systems secure, including logging, monitoring and abuse prevention; diagnosing faults and improving reliability; administering and developing our relationship with institutional and employer customers, including business-to-business marketing to professional contacts; and establishing, exercising or defending legal claims. In each case we have considered the effect on candidates, and a candidate may object at any time — see section 13.

For an institution’s own processing of candidate records, the institution commonly relies on performance of a task carried out in the public interest, on its legitimate interests in running a placement programme, or on a contract with the candidate; that determination is the institution’s, and a candidate who wants to know which basis applies should ask the institution.

8.3 Legal obligation — Article 6(1)(c)

We rely on this for retaining financial and tax records, responding to lawful requests from regulators and authorities, and meeting breach-notification and other statutory duties.

8.4 Consent — Article 6(1)(a)

We rely on consent for non-essential cookies and similar technologies on our marketing website and for marketing emails to business contacts where consent is required in their jurisdiction. Consent can be withdrawn at any time, and withdrawal does not affect processing carried out before it.

Where an institution asks a candidate to consent to a specific disclosure — for example to share a transcript with a particular employer — that consent is the institution’s to obtain and to record, and the candidate can withdraw it with the institution.

8.5 Special category data — Article 9

Where an institution records health, disability, ethnicity, religion or similar information about a candidate, the institution is responsible for identifying its Article 9 condition. We process such information solely on the institution’s instructions and under the Personal Data Processing Agreement.

8.6 Other jurisdictions

Candidates in Australia have rights of access and correction under the Australian Privacy Principles. Candidates in United States states with comprehensive privacy laws should read our US State Privacy Notice. Candidates elsewhere have the rights their local law gives them, and we honour them.

9. AI features, and human oversight

9.1 Our data commitment

We do not use customer, student or candidate data to train, fine-tune or improve any general-purpose or shared AI model.

Where a feature uses a model that learns from data, that model is trained only on that customer’s own data — it is per-tenant — and is used only for that customer. Data is never pooled across customers, and one institution’s candidate records are never used to improve the service for another institution or for any employer.

9.2 The features that can touch candidate data

AI features are an optional add-on module. If an institution has not taken it, no AI features are active and no candidate data is processed by AI. Where it has, the institution chooses whether to use the AI features, and it may ask us to switch specific features off.

Analytics features — grading analysis, attendance analysis, attrition tracking and behaviour analytics — use small language models hosted in our own environment on Amazon Web Services; candidate data used by those features does not leave our hosting. Agent automation and workflow features, and other features that use general-purpose AI models, use models provided by OpenAI, Anthropic and Google, accessed through their business API services under terms that do not permit the provider to use our customers’ data to train its models. Those three providers are sub-processors only where the institution has the AI add-on (section 11.3).

The features most likely to operate on a candidate record are:

• the AI chat assistant, which answers questions within the platform;

• the agent automation and workflow engine, which executes workflows and administrative actions the institution has configured — for example moving an application to the next stage;

• grading analysis, where academic results form part of a candidate’s placement profile;

• behaviour analytics, which analyses engagement and activity patterns;

• attrition tracking, which identifies students at risk of disengaging;

• the writing assistant, which can help draft a CV, cover letter or profile summary;

• AI plagiarism checking, where submitted work is checked.

9.3 Human oversight — the commitment

All AI outputs are advisory. Decisions about candidates remain with the institution, its placement staff, and the employers making hiring decisions. Our AI features are not designed to make decisions that produce a legal or similarly significant effect on a candidate without human review.

Our AI features are designed to support, not replace, human decisions. Where a feature suggests a match, a ranking or a flag, it is a suggestion to a member of the institution’s staff, who decides. Where an institution configures automated workflows or eligibility rules, it is responsible for making sure that any decision with a significant effect on a candidate is reviewed by a person.

We design our AI features so that you can recognise AI-generated output and know when you are interacting with the AI chat assistant. This reflects the transparency obligations in Article 50 of the EU AI Act, which applied from 2 August 2026. Our AI features are not designed to infer the emotions of candidates, students or staff, and we do not use AI for any practice prohibited by Article 5 of the EU AI Act.

9.4 EU AI Act high-risk obligations — our position, stated precisely

The Annex III high-risk obligations of the EU AI Act cover AI systems used in education and vocational training and in employment, worker management and access to self-employment, which includes systems used to recruit or select people, to filter applications, or to evaluate candidates. Hiree365 candidate processes fall within that scope, as do attrition tracking, behaviour analytics and grading analysis.

Those obligations apply from 2 December 2027, following the deferral introduced by the Digital Omnibus.

We commit to meeting those obligations by that date. We do not claim high-risk conformity now, and nothing in this notice should be read as a claim that any Hiree365 feature is already conformant with the Annex III requirements. We say this deliberately: an institution or employer completing an AI governance assessment should record our position as a commitment with a date, not as a present certification. The human-oversight approach in section 9.3 applies now and is not contingent on that date.

9.5 Your rights around automated processing

Where the UK GDPR or EU GDPR applies, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. Our AI features are designed so that decisions about candidates are not made solely by automated means, and where an institution configures automated workflows or eligibility rules, it is responsible for ensuring human review of any decision with a significant effect on you. If you believe a decision about you was made without human involvement, tell your institution, or tell us at clientservice@classe365.com and we will raise it with the institution and give it the information we hold that it needs to check.

10. How long candidate data is kept

The institution decides how long it needs a candidate record and when to delete it. Our published schedule describes what happens after that, and it is the same schedule we publish for all customer data.

Marketing and CRM contact data is never candidate data; it consists of business contact records for staff at institutions and employers.

10.1 The 7-day backup window

We take daily backups. Each daily backup is retained for 7 days on a rolling basis, giving the institution a seven-day restore window: it may request restoration from any of the preceding 7 days. Backups are maintained for the life of an active subscription.

Because of that rolling window, a candidate record deleted by an institution persists in backups for no more than 7 days, after which the last backup containing it has expired and the record is permanently gone. During that period the record is not present in the live platform, is not visible to anyone, and is not used for any purpose.

10.2 On termination

When an institution’s subscription ends, all of its customer data, including employer user data held in its account, and all backups containing that data, are deleted within 30 days. Any per-tenant AI model trained on that data is deleted with it.

10.3 Longer retention where the law requires it

We retain financial and tax records for the period required by applicable tax and company law, which may exceed the periods above, and we retain records subject to a legal hold until the hold is lifted and no longer. Neither exception is used to retain candidate records for a purpose of our own.

10.4 Information already shared with an employer

Once an institution has shared your information with an employer, that employer holds its own copy, and its retention of that copy is governed by its own policies, its arrangement with the institution, and the law that applies to it. Deleting your record from Hiree365 does not delete the employer’s copy. If you want an employer to delete information it holds about you, ask the employer directly, or ask your institution’s placement office to raise it. We will tell the institution and support it, but we cannot reach into an employer’s own systems.

11. Where your data is held, and global support

11.1 Hosting

• Standard customers: data is hosted on Amazon Web Services in the AWS region allocated to the customer’s account at set-up, which is generally the region nearest to the customer. That region may be outside the customer’s own country. The region that applies to a particular account is confirmed on request.

• On request: data can be located in the nearest available AWS region to the customer.

• Enterprise customers: an optional private cloud deployment is available on Amazon Web Services, Microsoft Azure or Google Cloud.

If you want to know where your institution’s Hiree365 data is hosted, ask the institution, or ask us and we will confirm the region for that tenant.

11.2 Global support and remote access

Classe365 provides 24/7 follow-the-sun support. Our support and engineering staff are employees of the Classe365 group, located in Australia, India, the Philippines, Spain and the United States, and they may access customer data, including candidate data, to provide support and engineering.

Customer data is hosted on Amazon Web Services as described in section 11.1 and is not stored in any of those locations. Staff access it remotely, and only when needed to resolve a support request or fix a fault. It is part of the normal running of the service. A support ticket, fault diagnosis, data restoration request or configuration request may be handled by staff in any of the five locations, depending on the time of day, and doing that work can require access to the records held in a customer’s tenant, including candidate profiles, CVs, assessment results and application histories.

That access is subject to:

• role-based, least-privilege access controls, so an individual can reach only the data needed for the task at hand;

• authentication controls and logging of staff access to customer environments;

• written contractual confidentiality obligations binding on each group company and on individual staff members;

• intra-group data transfer agreements between the Classe365 group companies;

• for personal data from the European Economic Area, the United Kingdom or Switzerland, the transfer mechanisms set out in our Personal Data Processing Agreement;

• the same instruction-bound limits that apply to us as processor — the data is used only to provide support and engineering, never for any other purpose of a group company or staff member.

We disclose this because institutions and employers need it for their own data protection assessments, and because candidates are entitled to know who can see their CV and their application history.

11.3 Sub-processors

Each is bound by a written contract that restricts its use of the information to providing its service to us and requires confidentiality and security, and each is assessed before engagement and reviewed afterwards. OpenAI, Anthropic and Google are sub-processors only where an institution has taken the AI add-on.

Google Analytics, Semrush, Mailchimp and ActiveCampaign operate on the classe365.com marketing website only. They never receive student or candidate records from the platform.

SMOWL (online proctoring) and Zapier (customer-configured automation) are not our sub-processors. Where an institution enables one, it contracts with that provider directly and takes responsibility for what the provider receives.

11.4 Transfer mechanisms

Where personal information is transferred out of the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, we rely on the transfer mechanisms set out in our Personal Data Processing Agreement and described on our International Data Transfers page. Those documents govern, and we do not restate their terms here. Institutions and employers that need the executed transfer documentation for their records should request it at clientservice@classe365.com.

12. Security

12.1 Controls in place

• Hosting on Amazon Web Services infrastructure.

• Encryption of data in transit using TLS.

• Encryption of data at rest.

• Network segregation between environments, and logical separation of each institution’s data from other institutions’.

• Least-privilege access control, granted by role and reviewed.

• An OWASP-aligned secure development lifecycle.

• Daily backups, retained 7 days on a rolling basis.

• DDoS protection.

• Continuous monitoring of systems and security events.

• Logging of staff access to customer environments and of changes to records.

12.2 Certifications — stated accurately

A SOC 2 Type II audit is in progress and is expected to complete in December 2026. We do not hold a SOC 2 report today and do not claim one. We do not hold ISO 27001 certification and do not claim one. We will update this section when the position changes.

12.3 Breach notification

If we become aware of a personal data breach affecting customer data, including candidate data, we notify the affected customer within 24 hours of becoming aware, with the information available at that point, and follow up as the investigation develops. Where we act as processor, the institution decides whether and how to notify regulators and individuals, and we support it in doing so.

12.4 What we ask of you

Protect your account: use a strong and unique password, do not share your credentials, and tell your institution or clientservice@classe365.com immediately if you think your account has been compromised. Remember that your CV and supporting documents are visible to your institution’s placement staff, and to any employer the institution shares them with.

13. Your rights as a candidate, and how to use them

13.1 The rights

Depending on where you are and which law applies, you have the right to:

1. Be informed about what is done with your personal information — which is what this notice is for.

2. Access your personal information and receive a copy of it.

3. Correct information that is inaccurate, and complete information that is incomplete.

4. Delete your personal information where a ground for erasure applies.

5. Restrict processing while an issue is being resolved.

6. Portability — to receive information you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

7. Object to processing based on legitimate interests, and to object to direct marketing at any time and without qualification.

8. Withdraw consent where processing is based on consent.

9. Not be subject to a decision based solely on automated processing producing legal or similarly significant effects. See section 9.

10. Complain to a regulator.

13.2 Start with your institution

Your institution controls your candidate record. It can look something up, correct it, delete it, change what is shared with an employer, or withdraw you from a placement activity — usually quickly. Contact the placement office, the careers service, the registrar, or the institution’s data protection or privacy contact.

This is not us passing you around. The institution genuinely is the fastest and most complete route, because it holds the decision and the context.

13.3 If you come to us

Email clientservice@classe365.com. Tell us your name, your institution, and what you want. Then:

1. We acknowledge the request and identify the institution concerned.

2. We forward it to that institution without undue delay, because the institution is the controller and the decision is legally its to make.

3. We tell you that we have done so, and who to expect a response from.

4. We give the institution reasonable technical help to fulfil the request, using the platform’s standard export, search, correction and deletion functions, as part of the service. Bespoke or bulk work beyond that may be charged to the institution at our then-current rates, agreed in advance. Charges to you are covered by section 13.5.

5. We do not disclose, correct or delete records inside an institution’s tenant on our own initiative, and we do not act against the institution’s instruction.

Where we are the controller — for example for support correspondence you send us directly, or for the limited processing of employer contacts’ account data we carry out for our own purposes — none of that routing applies and we deal with the request ourselves.

13.4 Verification

We ask you to confirm information we already hold so that we can be satisfied you are who you say you are, and we match what you tell us against our records. We will not ask for a government-issued identity document unless there is no other way to verify a high-risk request, and we will not create a new record of one. If we cannot verify you to a reasonable degree of certainty, we will tell you and explain what would allow us to proceed.

13.5 Response times, and cost

We respond to requests we control within one month of receiving a verifiable request. Where a request is complex, or where we have received several from you, we may extend by up to a further two months and will tell you within the first month, with the reason. For requests we forward to an institution, the institution’s own timeframe applies, and we will have passed it on promptly.

We do not charge for responding to a request. We may charge a reasonable fee, or decline, if a request is manifestly unfounded or excessive, and we will explain why if that happens.

13.6 Complaints

If you are unhappy with how we have handled your personal information, tell us first at clientservice@classe365.com. Set out what happened and what you would like us to do. We will investigate and respond.

If you are not satisfied, you may complain to a regulator: in the European Union, the supervisory authority where you live, work or where the issue arose; in the United Kingdom, the Information Commissioner’s Office; in Australia, the Office of the Australian Information Commissioner; in the United States, your State Attorney General, and in California the California Privacy Protection Agency; elsewhere, your national or state data protection authority. Where your complaint concerns information your institution controls, the institution is usually the correct respondent.

14. Changes to this notice

We review this notice at least annually and whenever we make a change that affects it.

Where a change materially affects how we handle candidate personal information, we will give at least 30 days’ notice before it takes effect, by email to institutional and employer account contacts and by a notice on our website and in the platform. Minor corrections — a broken link, a clarified sentence, an updated address — take effect when published.

Every version carries a “Last updated” date and an “Effective” date at the top. This version was published on 22 September 2026 and takes effect on 22 October 2026.

15. How to contact us

Privacy enquiries: clientservice@classe365.com Support: clientservice@classe365.com Accessibility line: +61 2 9472 5000

Legal notices — United States customers: 365 Software, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

Legal notices — all other customers: Sprout On Web Pty Ltd 22 Palm Street St Ives, NSW 2075 Australia

If you write to us, tell us your institution and whether you are a candidate, a member of institution staff, or an employer contact. It lets us route your request correctly the first time.

Your institution: for anything about your candidate record, what has been shared with an employer, or your place in a placement programme, your institution’s placement office or careers service is the right first contact. If you do not know who that is, ask us and we will point you to the contact your institution has given us.

Hiree365 and Classe365 are operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with 24/7 support and engineering provided by our group team in Australia, India, the Philippines, Spain and the United States.