Hiree365 Candidate Privacy Notice

1. About this notice

1.1 What Hiree365 is

Hiree365 is a campus recruitment and employability platform. Institutions — universities, colleges, academies and vocational training providers — use it to run placement and careers programmes: building candidate profiles, publishing opportunities, managing applications, arranging campus drives and interviews, and tracking outcomes. It is sold both on its own and bundled with Classe365, our student information system and learning management system.

1.2 What this notice does

This notice explains what personal information Hiree365 holds about candidates, why, who sees it, how long it is kept, and what rights a candidate has. It sets out one point that matters more than any other and that candidates ask about most: employers receive your personal data only via your institution. We do not give your information to employers ourselves. Section 6 explains that in full.

Candidates are a distinct group with distinct concerns, which is why they have their own notice rather than a paragraph inside a general policy.

1.3 Which entity contracts

We use a regional contracting model. The entity that contracts depends on where the institution or employer customer is located.

• Customers located in the United States contract with 365 Software, LLC, a Delaware limited liability company, registered office 131 Continental Dr, Suite 305, Newark, DE 19713, New Castle County, United States; registered agent Legalinc Corporate Services Inc. Governing law: the State of Delaware. Courts of the State of Delaware.
• All other customers, including those in the European Union, the United Kingdom, Australia and the rest of the world, contract with Sprout On Web Pty Ltd, ABN 72 138 602 418, registered office 22 Palm Street, St Ives, NSW 2075, Australia; business address 22 Giffnock Avenue, Macquarie Park, NSW 2113, Australia. Governing law: New South Wales, Australia. Courts of New South Wales.
• Classe365 India Pvt Ltd, 37, Venjay Edifice Complex, 3rd Floor, JLB Road, Chamarajapuram, Mysuru – 570 005, India, is a group affiliate providing support and engineering services to both contracting entities. Section 11 explains what that means for candidate data, and candidates should read it.

In this notice, “Classe365”, “we”, “us” and “our” mean the contracting entity for your institution or employer, together with the group affiliate that supports it. If you want to know which entity holds your information, ask your institution or email clientservice@classe365.com and we will tell you.

1.4 Related documents

Read this notice with our Privacy Policy, which is the master document covering all of our processing and describes our roles, sub-processors, hosting, security and international transfers in full; the Personal Data Processing Agreement, which governs our processing on behalf of an institution or employer and sets out the transfer mechanisms we rely on; the AI Use Statement; the Cookie Policy; and, where a United States institution is involved, the FERPA Compliance Statement. Where this notice summarises a topic covered in more detail elsewhere, the more detailed document governs.

2. The three user types

Hiree365 has three kinds of user, and what we do with information depends on which one you are.

2.1 Candidates — students and graduates seeking employment

You hold a candidate profile, apply for opportunities, take part in campus drives and assessments, and track your applications. Your profile normally exists because your institution enrolled you in its placement programme, or because you signed up through your institution’s careers service.

Your institution decides what a candidate profile contains, which employers and opportunities appear, and what is shared with an employer. Your institution is the controller of your candidate record and we are the processor; in United States terms, we are a service provider to the institution. Where your institution is a United States educational agency or institution subject to FERPA, your candidate record is an education record and we act as a school official with a legitimate educational interest, under the institution’s direct control.

2.2 Institutions — running campus placement

Placement officers, careers advisers and administrators use Hiree365 to run the programme: enrolling candidates, curating opportunities, inviting employers, running campus drives, shortlisting, and reporting on outcomes. The institution decides what is collected, what is shared, and with whom.

2.3 Employers — seeking candidates

Employers use Hiree365 to work with an institution’s placement office: posting vacancies, taking part in campus drives, and receiving the candidate information the institution decides to share with them. We hold contact and organisation details for employer users, records of vacancies posted and drives run, and the employer’s interactions with institutions. For that employer-account information we act as controller or processor depending on the arrangement, and the employer’s own contract governs.

An employer does not have open access to candidate profiles. Section 6 explains the boundary.

3. Minimum age: 16

Hiree365 has a minimum age of 16. It is not available to anyone under 16, and it has no users under 13.

We do not create candidate accounts for people under 16, we do not accept candidate registrations from people under 16, and institutions are contractually required not to enrol anyone under 16 in a Hiree365 placement programme.

Because there are no users under 13, the parental consent requirements of the United States Children’s Online Privacy Protection Act do not arise for Hiree365. Our COPPA position for Classe365, where children under 13 do have records, is set out in the Children’s Privacy Policy and the Direct Notice to Parents; neither applies to Hiree365.

If we become aware that a person under 16 holds a Hiree365 account, we notify the institution and the account is removed and its data deleted under the schedule in section 10.

4. The personal information we hold about candidates

What is actually held depends on what your institution collects and what you choose to provide. Nothing in this list is collected by us on our own initiative.

4.1 Profile information

• Name, and the contact details you or your institution provide: email address, telephone number, and postal or residential address where recorded.
• Date of birth, where the institution records it.
• Your institution, student or candidate reference number, and your relationship to the institution.
• A profile photograph, where you or the institution uploads one.
• Work eligibility and location preferences, where you record them — for example the cities or regions you are willing to work in.

4.2 Education history

• Programme or course of study, specialisation, year of study and expected or actual graduation year.
• Academic results, grade point average, class or division, and transcripts, where the institution shares them into the placement record.
• Prior education, certifications and qualifications you list.
• Awards, honours and academic distinctions you record.

4.3 CV and supporting documents

• Your curriculum vitae or résumé, cover letters, portfolios, project work, writing samples, references and any other supporting document you upload or your institution uploads for you.
• Anything you choose to put in those documents is held as you wrote it. If you include information you would rather not share with employers, remove it before uploading.

4.4 Skills and experience

• Skills, competencies and skill levels you record or that an assessment produces.
• Work experience, internships, part-time roles, volunteering and extracurricular activity.
• Languages, technical proficiencies, licences and certifications.

4.5 Assessment and placement records

• Results of assessments, aptitude tests, skill tests and employability exercises run through the platform by your institution.
• Interview scheduling, participation in campus drives, feedback the institution records, shortlisting decisions, offers made and outcomes.
• Placement status: registered, shortlisted, interviewed, offered, placed, or opted out.
• Notes your institution’s placement staff record about your readiness, coaching or preferences.

4.6 Application activity

• Opportunities viewed, saved and applied for.
• Application status and history, withdrawal of an application, and the outcome.
• Communications with your institution’s placement office through the platform.

4.7 Account and technical data

• Username, hashed password, authentication and single sign-on identifiers, and multi-factor authentication settings.
• Sign-in records, IP address, device and browser information, pages and records accessed, and audit trail entries.
• Cookies and similar identifiers as described in the Cookie Policy. Marketing and advertising cookies are not served to authenticated student users.

4.8 What we do not collect

• We do not collect or process biometric identifiers ourselves. Hiree365 does not collect, store or process fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints, and does not perform facial or voice recognition. Institutions may choose to enable SMOWL, a third-party online proctoring service, which they contract with directly; any biometric processing by SMOWL occurs under SMOWL’s own terms and privacy policy, not ours.
• We do not require any government-issued identifier — a national identity number, social security number, tax number, passport number or driving licence number — to provide the platform. Where an institution configures its own forms to collect one, that identifier is treated as personal information, protected like the rest of the record, and held under the retention schedule in section 10.
• We do not enrich your profile from outside sources, we do not scrape social media, and we do not infer characteristics about you that you have not recorded.

4.9 Sensitive information

If your institution records health, disability or accessibility information, or information that reveals racial or ethnic origin, religion or similar characteristics — for example because it runs an accessibility adjustment process or a diversity programme — that information is held only because the institution chose to record it, is restricted to the institution’s own tenant and the staff it authorises, is subject to the same encryption and access controls as the rest of the record, is never used for advertising or to train shared AI models, and is deleted on the same schedule. The institution is responsible for identifying its own lawful condition for holding it.

5. How candidate data is used

Candidate information is used to run the institution’s placement programme, on the institution’s instructions:

1. Creating and maintaining your candidate profile.
2. Registering you for the institution’s placement programme and recording your eligibility and preferences.
3. Showing you opportunities the institution has published or curated.
4. Managing your applications: submission, status, shortlisting, scheduling and outcome.
5. Running campus drives, interviews and assessment events.
6. Running employability assessments and recording results.
7. Enabling the institution to prepare and share candidate information with employers as part of its placement programme, within the limits in section 6.
8. Communication between you and the institution’s placement office.
9. Producing reports and analytics for the institution about its own placement programme and cohort outcomes.
10. Providing AI-assisted features the institution has enabled, within the limits in section 9.
11. Providing technical support, diagnosing faults, restoring data, keeping audit trails and keeping the platform secure.

5.1 What we never do with candidate data

• We do not sell candidate personal information. Not to employers, not to recruiters, not to data brokers, not to anyone.
• We do not disclose candidate data directly to employers. See section 6.
• We do not serve advertising inside the authenticated platform, and we do not use candidate data for advertising or to build advertising profiles, or share it for cross-context behavioural advertising.
• We do not use candidate data to train, fine-tune or improve any general-purpose or shared AI model. See section 9.
• We do not send you our own marketing. We market to institutions and employers, not to candidates, and candidate records are never used to build a marketing list.
• We do not operate our own job board, candidate pool or talent database of our own from institutions’ candidate records, and we do not make candidates available to employers outside an institution’s programme.

6. Employers receive your data only through your institution

This is the most important boundary in Hiree365 and we state it without qualification.

Employers receive candidate personal data only via the institution. We do not disclose candidate data directly to employers on our own initiative. The institution controls what is shared as part of its placement programme.

6.1 What that means in practice

1. There is no open candidate database for employers. An employer with a Hiree365 account cannot browse, search or filter the candidates of an institution it is not working with, and cannot help itself to profiles.
2. The institution decides what an employer sees. Your institution’s placement office decides which candidates are put forward for which opportunity, which fields of the profile are included, and whether documents such as a CV or transcript are attached. It can share a shortlist, a full profile, a partial profile, or nothing.
3. The institution decides when. Sharing happens when the institution shares it, as part of a specific placement activity — an application it forwards, a shortlist it sends, a campus drive it runs.
4. We do not add to it. We do not supplement what the institution shares with information of our own, and we do not pass an employer any candidate information the institution has not chosen to share.
5. We do not sell or license candidate profiles to employers. An employer pays for access to a recruitment workflow, never for access to candidates.

6.2 Your control, and where it sits

Because the institution controls what is shared, your control over employer disclosure runs through the institution. If you want to know what has been shared about you and with whom, ask your institution’s placement office — it holds that record and can tell you. If you do not want to be put forward for a particular employer or opportunity, tell the placement office, and it can act on that in the platform.

You can also ask us, at clientservice@classe365.com, and we will help you reach the right contact and give the institution whatever technical help it needs to answer you. What we will not do is disclose, change or withdraw something inside an institution’s tenant on our own initiative, because that would mean overriding the institution and altering your placement record without the institution’s knowledge. Section 13 explains how we route requests.

6.3 Once an employer holds your information

When an institution shares your information with an employer, the employer becomes responsible for what it then does with it, as a controller in its own right under its own privacy notice and under the terms of its arrangement with the institution. Employers using Hiree365 agree to use candidate information only for the recruitment activity the institution shared it for, to keep it confidential, and not to use it for any unrelated purpose. If you want to know what an employer does with your information after it receives it, the employer’s own privacy notice governs, and your institution can tell you which employers hold your details.

7. Institutions, employers and their own information

For an institution’s staff users and an employer’s staff users, we hold name, work email address, telephone number, job title, account credentials, sign-in and usage records, and records of what they did in the platform. For employer organisations we also hold company name, industry, size, locations and recruitment requirements, together with vacancies posted, drives run and interactions with institutions.

We use that information to provide and administer the platform, to bill and support the account, to keep the service secure, and — for business contacts at institutions and employers only — to send business-to-business marketing about our products, events and content, which they can opt out of at any time. We do not send marketing to candidates.

8. Legal bases

Where the UK GDPR or the EU GDPR applies, the legal bases below apply. Remember that for candidate records the institution is the controller and chooses the basis for its own processing; these are the bases we rely on for the processing we control and those that support our processing as processor.

8.1 Performance of a contract — Article 6(1)(b)

We rely on this to administer the customer account, provide the platform to the contracting institution or employer, manage sign-in and authentication, bill and collect payment, and support the users named under the contract.

8.2 Legitimate interests — Article 6(1)(f)

We rely on legitimate interests for keeping the platform and our systems secure, including logging, monitoring and abuse prevention; diagnosing faults and improving reliability; administering and developing our relationship with institutional and employer customers, including business-to-business marketing to professional contacts; and establishing, exercising or defending legal claims. In each case we have considered the effect on candidates, and a candidate may object at any time — see section 13.

For an institution’s own processing of candidate records, the institution commonly relies on performance of a task carried out in the public interest, on its legitimate interests in running a placement programme, or on a contract with the candidate; that determination is the institution’s, and a candidate who wants to know which basis applies should ask the institution.

8.3 Legal obligation — Article 6(1)(c)

We rely on this for retaining financial and tax records, responding to lawful requests from regulators and authorities, and meeting breach-notification and other statutory duties.

8.4 Consent — Article 6(1)(a)

We rely on consent for non-essential cookies and similar technologies on our marketing website and for marketing emails to business contacts where consent is required in their jurisdiction. Consent can be withdrawn at any time, and withdrawal does not affect processing carried out before it.

Where an institution asks a candidate to consent to a specific disclosure — for example to share a transcript with a particular employer — that consent is the institution’s to obtain and to record, and the candidate can withdraw it with the institution.

8.5 Special category data — Article 9

Where an institution records health, disability, ethnicity, religion or similar information about a candidate, the institution is responsible for identifying its Article 9 condition. We process such information solely on the institution’s instructions and under the Personal Data Processing Agreement.

8.6 Other jurisdictions

Candidates in Australia have rights of access and correction under the Australian Privacy Principles. Candidates in United States states with comprehensive privacy laws should read our US State Privacy Notice. Candidates elsewhere have the rights their local law gives them, and we honour them.

9. AI features, and human oversight

9.1 Our data commitment

We do not use customer, student or candidate data to train, fine-tune or improve any general-purpose or shared AI model.

Where a feature uses a model that learns from data, that model is trained only on that customer’s own data — it is per-tenant — and is used only for that customer. Data is never pooled across customers, and one institution’s candidate records are never used to improve the service for another institution or for any employer.

9.2 The features that can touch candidate data

Institutions choose which AI features to enable. The ones most likely to operate on a candidate record are:

• the AI chat assistant, which answers questions within the platform;
• the agent automation and workflow engine, which executes workflows and administrative actions the institution has configured — for example moving an application to the next stage;
• grading analysis, where academic results form part of a candidate’s placement profile;
• behaviour analytics, which analyses engagement and activity patterns;
• attrition tracking, which identifies students at risk of disengaging;
• the writing assistant, which can help draft a CV, cover letter or profile summary;
• AI plagiarism checking, where submitted work is checked.

9.3 Human oversight — the commitment

All AI outputs are advisory. Decisions about candidates remain with the institution, its placement staff, and the employers making hiring decisions. No automated decision produces a legal or similarly significant effect on a candidate without human review.

Concretely: no candidate is rejected, deselected, ranked out of a shortlist, or excluded from a placement opportunity by an automated process without a human being reviewing that outcome and taking the decision. Where a feature suggests a match, a ranking or a flag, it is a suggestion to a member of the institution’s staff, who decides.

Where you interact with our AI chat assistant, we say so in the interface. This reflects the transparency obligations in Article 50 of the EU AI Act, which applied from 2 August 2026.

9.4 EU AI Act high-risk obligations — our position, stated precisely

The Annex III high-risk obligations of the EU AI Act cover AI systems used in education and vocational training and in employment, worker management and access to self-employment, which includes systems used to recruit or select people, to filter applications, or to evaluate candidates. Hiree365 candidate processes fall within that scope, as do attrition tracking, behaviour analytics and grading analysis.

Those obligations apply from 2 December 2027, following the deferral introduced by the Digital Omnibus.

We commit to meeting those obligations by that date. We do not claim high-risk conformity now, and nothing in this notice should be read as a claim that any Hiree365 feature is already conformant with the Annex III requirements. We say this deliberately: an institution or employer completing an AI governance assessment should record our position as a commitment with a date, not as a present certification. The human-oversight commitment in section 9.3 applies now and is not contingent on that date.

9.5 Your rights around automated processing

Where the UK GDPR or EU GDPR applies, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. Given section 9.3, decisions about candidates in Hiree365 are not made solely by automated means. If you believe a decision about you was made without human involvement, tell your institution, or tell us at clientservice@classe365.com and we will raise it with the institution and give it the audit information it needs to check.

10. How long candidate data is kept

The institution decides how long it needs a candidate record and when to delete it. Our published schedule describes what happens after that, and it is the same schedule we publish for all customer data.

Marketing and CRM contact data is never candidate data; it consists of business contact records for staff at institutions and employers.

10.1 The 7-day backup window

We take daily backups. Each daily backup is retained for 7 days on a rolling basis, giving the institution a seven-day restore window: it may request restoration from any of the preceding 7 days. Backups are maintained for the life of an active subscription.

Because of that rolling window, a candidate record deleted by an institution persists in backups for no more than 7 days, after which the last backup containing it has expired and the record is permanently gone. During that period the record is not present in the live platform, is not visible to anyone, and is not used for any purpose.

10.2 On termination

When an institution’s or employer’s subscription ends, all of its customer data and all backups containing that data are deleted within 30 days.

10.3 Longer retention where the law requires it

We retain financial and tax records for the period required by applicable tax and company law, which may exceed the periods above, and we retain records subject to a legal hold until the hold is lifted and no longer. Neither exception is used to retain candidate records for a purpose of our own.

10.4 Information already shared with an employer

Once an institution has shared your information with an employer, that employer holds its own copy, and its retention of that copy is governed by its own policies, its arrangement with the institution, and the law that applies to it. Deleting your record from Hiree365 does not delete the employer’s copy. If you want an employer to delete information it holds about you, ask the employer directly, or ask your institution’s placement office to raise it. We will tell the institution and support it, but we cannot reach into an employer’s own systems.

11. Where your data is held, and access from India

11.1 Hosting

• Standard customers: data is hosted on Amazon Web Services in the us-east-1 region (Northern Virginia, United States) by default.
• On request: data can be located in the nearest available AWS region to the customer.
• Enterprise customers: an optional private cloud deployment is available on Amazon Web Services, Microsoft Azure or Google Cloud.

If you want to know where your institution’s Hiree365 data is hosted, ask the institution, or ask us and we will confirm the region for that tenant.

11.2 Access from India — stated plainly

Personnel of Classe365 India Pvt Ltd, located at 37, Venjay Edifice Complex, 3rd Floor, JLB Road, Chamarajapuram, Mysuru – 570 005, India, provide support and engineering services to the group and may access customer data, including candidate data, for those purposes.

This is a real and ongoing arrangement, not a contingency. Support tickets, fault diagnosis, data restoration requests, configuration assistance and engineering work on the platform may be handled by staff in Mysuru, and doing that work can require access to the records held in a customer’s tenant, including candidate profiles, CVs, assessment results and application histories.

That access is subject to:

• role-based, least-privilege access controls, so an individual can reach only the data needed for the task at hand;
• authentication controls and audit logging of access;
• written contractual confidentiality obligations binding on the affiliate and on individual personnel;
• intra-group data transfer agreements between the contracting entities and Classe365 India Pvt Ltd;
• the same instruction-bound limits that apply to us as processor — the data is used only to provide support and engineering services, never for any purpose of the affiliate’s own.

We disclose this because institutions and employers need it for their own data protection assessments, and because candidates are entitled to know who can see their CV and their application history.

11.3 Sub-processors

Each is bound by a written contract, may act only on our instructions, is subject to confidentiality obligations, is assessed before engagement and monitored afterwards.

Google Analytics, Semrush, Mailchimp and ActiveCampaign operate on the classe365.com marketing website only. They never receive student or candidate records from the platform.

SMOWL (online proctoring) and Zapier (customer-configured automation) are not our sub-processors. Where an institution enables one, it contracts with that provider directly and takes responsibility for what the provider receives.

11.4 Transfer mechanisms

Where personal information is transferred out of the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, we rely on the transfer mechanisms set out in our Personal Data Processing Agreement and described on our International Data Transfers page. Those documents govern, and we do not restate their terms here. Institutions and employers that need the executed transfer documentation for their records should request it at clientservice@classe365.com.

12. Security

12.1 Controls in place

• Hosting on Amazon Web Services infrastructure.
• Encryption of data in transit using TLS.
• Encryption of data at rest.
• Network segregation between environments and between tenants, so one institution’s candidates are never visible to another.
• Least-privilege access control, granted by role and reviewed.
• An OWASP-aligned secure development lifecycle.
• Daily backups, retained 7 days on a rolling basis.
• DDoS protection.
• Continuous monitoring of systems and security events.
• Audit logging of access to records.

12.2 Certifications — stated accurately

A SOC 2 Type II audit is in progress and is expected to complete in December 2026. We do not hold a SOC 2 report today and do not claim one. We do not hold ISO 27001 certification and do not claim one. We will update this section when the position changes.

12.3 Breach notification

If we become aware of a personal data breach affecting customer data, including candidate data, we notify the affected customer within 24 hours of becoming aware, with the information available at that point, and follow up as the investigation develops. Where we act as processor, the institution decides whether and how to notify regulators and individuals, and we support it in doing so.

12.4 What we ask of you

Protect your account: use a strong and unique password, enable multi-factor authentication where your institution offers it, do not share your credentials, and tell your institution or clientservice@classe365.com immediately if you think your account has been compromised. Remember that your CV and supporting documents are visible to your institution’s placement staff, and to any employer the institution shares them with.

13. Your rights as a candidate, and how to use them

13.1 The rights

Depending on where you are and which law applies, you have the right to:

1. Be informed about what is done with your personal information — which is what this notice is for.
2. Access your personal information and receive a copy of it.
3. Correct information that is inaccurate, and complete information that is incomplete.
4. Delete your personal information where a ground for erasure applies.
5. Restrict processing while an issue is being resolved.
6. Portability — to receive information you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
7. Object to processing based on legitimate interests, and to object to direct marketing at any time and without qualification.
8. Withdraw consent where processing is based on consent.
9. Not be subject to a decision based solely on automated processing producing legal or similarly significant effects. See section 9.
10. Complain to a regulator.

13.2 Start with your institution

Your institution controls your candidate record. It can look something up, correct it, delete it, change what is shared with an employer, or withdraw you from a placement activity — usually immediately. Contact the placement office, the careers service, the registrar, or the institution’s data protection or privacy contact.

This is not us passing you around. The institution genuinely is the fastest and most complete route, because it holds the decision and the context.

13.3 If you come to us

Email clientservice@classe365.com. Tell us your name, your institution, and what you want. Then:

1. We acknowledge the request and identify the institution concerned.
2. We forward it to that institution without undue delay, because the institution is the controller and the decision is legally its to make.
3. We tell you that we have done so, and who to expect a response from.
4. We give the institution the technical help it needs to answer you — exports, searches, corrections, deletions and confirmations — as part of the service and at no extra charge.
5. We do not disclose, correct or delete records inside an institution’s tenant on our own initiative, and we do not act against the institution’s instruction.

Where we are the controller — for example for support correspondence you send us directly, or for an employer contact’s own account data — none of that routing applies and we deal with the request ourselves.

13.4 Verification

We ask you to confirm information we already hold so that we can be satisfied you are who you say you are, and we match what you tell us against our records. We will not ask for a government-issued identity document unless there is no other way to verify a high-risk request, and we will not create a new record of one. If we cannot verify you to a reasonable degree of certainty, we will tell you and explain what would allow us to proceed.

13.5 Response times, and cost

We respond to requests we control within one month of receiving a verifiable request. Where a request is complex, or where we have received several from you, we may extend by up to a further two months and will tell you within the first month, with the reason. For requests we forward to an institution, the institution’s own timeframe applies, and we will have passed it on promptly.

We do not charge for responding to a request. We may charge a reasonable fee, or decline, if a request is manifestly unfounded or excessive, and we will explain why if that happens.

13.6 Complaints

If you are unhappy with how we have handled your personal information, tell us first at clientservice@classe365.com. Set out what happened and what you would like us to do. We will investigate and respond.

If you are not satisfied, you may complain to a regulator: in the European Union, the supervisory authority where you live, work or where the issue arose; in the United Kingdom, the Information Commissioner’s Office; in Australia, the Office of the Australian Information Commissioner; in the United States, your State Attorney General, and in California the California Privacy Protection Agency; elsewhere, your national or state data protection authority. Where your complaint concerns information your institution controls, the institution is usually the correct respondent.

14. Changes to this notice

We review this notice at least annually and whenever we make a change that affects it.

Where a change materially affects how we handle candidate personal information, we will give at least 30 days’ notice before it takes effect, by email to institutional and employer account contacts and by a notice on our website and in the platform. Minor corrections — a broken link, a clarified sentence, an updated address — take effect when published.

Every version carries a “Last updated” date and an “Effective” date at the top. The current version is dated 15 September 2026 and takes effect on 15 October 2026.

15. How to contact us

Privacy enquiries: clientservice@classe365.com Support: clientservice@classe365.com
Accessibility line: +61 2 9472 5000

Legal notices — United States customers: 365 Software, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

Legal notices — all other customers: Sprout On Web Pty Ltd 22 Palm Street St Ives, NSW 2075 Australia

If you write to us, tell us your institution and whether you are a candidate, a member of institution staff, or an employer contact. It lets us route your request correctly the first time.

Your institution: for anything about your candidate record, what has been shared with an employer, or your place in a placement programme, your institution’s placement office or careers service is the right first contact. If you do not know who that is, ask us and we will point you to the contact your institution has given us.

Hiree365 and Classe365 are operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with support and engineering services provided by Classe365 India Pvt Ltd.