The fine print, kept readable

OLAMEE MASTER PRIVACY POLICY

INTRODUCTION

This Master Privacy Policy (the "Privacy Policy") describes how Olamee Corp., a corporation incorporated under the laws of the State of Texas ("Olamee Corp." "we," "our," or "us"), the owner, developer, and operator of the Olamee Platform, collects, uses, discloses, retains, transfers, and otherwise processes Personal Data in connection with the Olamee Platform and its integrated Sub-Portals (collectively, the "Service", as defined in the Terms).

This Privacy Policy is incorporated by reference into, and forms part of, the Olamee Master Terms of Use (the "Terms"). Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms. In the event of any conflict between this Privacy Policy and the Terms regarding the processing of Personal Data, the Data Processing Addendum (the “DPA”) controls first, followed by Section 9 of the Terms, followed by the remainder of the Terms, consistent with the order of precedence set out in Section 9.12 and 18.4 of the Terms. This Privacy Policy governs as to the disclosure required of Olamee Corp. under Applicable Data Protection Laws and as to Olamee Corp.’s processing as Controller, and as to the enumeration and mechanics of Data Subject rights as set out in Section 11. 

Wherever this Privacy Policy states that "Service" collects, processes, determines the means of processing, discloses, retains, or otherwise handles Personal Data, that statement means Olamee Corp. acting through the Olamee Platform, consistent with the Interpretation provision of the Terms.

Scope and Application

This Privacy Policy applies to Personal Data processed through the Olamee Platform and all integrated Sub-Portals, including the Application Portal, the ATS Portal (Olamee ATS), the EOR Service, TimeWorks, ChatWorks, and TaskWorks. Each Sub-Portal may be subject to its own Sub-Portal Privacy Policy that supplements this Privacy Policy and addresses data practices unique to that Sub-Portal. In the event of any inconsistency between this Privacy Policy and a Sub-Portal Privacy Policy, the Sub-Portal Privacy Policy governs with respect to the data collected and processed by that specific Sub-Portal, consistent with Section 7.3 of the Terms.

This Privacy Policy addresses the disclosures required of Olamee Corp. under Applicable Data Protection Laws. The operative allocation of data-protection roles and responsibilities between you and Olamee Corp. is set out in Section 9 of the Terms (Data Protection Roles & Compliance) and in the DPA.

1. DATA PROTECTION ROLES

The role in which Olamee Corp. processes Personal Data depends on the specific data flow, as allocated in Section 9.1 of the Terms.

1.1. Olamee Corp. as Processor / Service Provider

With respect to Personal Data that you or your Organization submit to, or generate within, the Service in the course of using the Sub-Portals, including candidate, applicant, employee, contractor, and beneficiary data processed for recruitment, applicant tracking, EOR, payroll, time-tracking, communication, and task-management purposes, you (or your Organization, or the relevant employer) act as the Controller, and Olamee Corp. acts as a Processor / service provider that processes such Personal Data only on your documented instructions and as necessary to provide the Service, except where Olamee Corp. is required to process by law. Such processing is governed by the DPA.

Where Olamee Corp. acts as Processor, the relevant Controller is responsible for honoring the rights of Data Subjects, providing notices, establishing a lawful basis, and obtaining required consents. Individuals whose Personal Data is processed in this capacity should direct their requests to the relevant Controller.

Where a Controller uses a Sub-Portal to process protected health information (“PHI” or “ePHI”) subject to the U.S. Health Insurance Portability and Accountability Act (“HIPAA”), and Olamee Corp. and the relevant Customer have entered into a Business Associate Agreement or Subcontractor Business Associate Agreement (each, a “BAA”), Olamee Corp. processes such PHI as a business associate or subcontractor business associate, solely on the documented instructions of the Controller (which may act on behalf of, and ultimately at the instruction of, an upstream covered entity or business associate) and in accordance with HIPAA and the BAA. The Controller determines, and is responsible for configuring, whether PHI is collected through a Sub-Portal. The handling of such PHI is governed by the Terms (Section 7.10. HIPAA and Business Associate Arrangements) and the BAA, which control over this Privacy Policy solely as to that PHI and only to the extent of any conflict.

1.2. Olamee Corp. as Controller

Olamee Corp. acts as an independent Controller with respect to Personal Data for which it determines the purposes and means of processing, including: a) account-administration, billing, authentication, security, fraud-prevention, and audit data; b) the third-party professional-profile dataset licensed from Bright Data and used in AI Search; c) De-Identified Data and Derived Data used to develop and improve Olamee Corp.’s models and the Service, to the extent such data constitutes Personal Data under Applicable Data Protection Laws; d) product-analytics data collected subject to cookie consent; e) the Olamee Corp. talent pool of candidates who register with, or submit their Personal Data directly to, Olamee Corp., as described in Section 6A; and f) business-contact, prospect, and marketing data relating to representatives of current and prospective customers and partners. This Privacy Policy describes Olamee Corp.’s processing in its capacity as Controller.

1.3. Joint or Independent Controllers

Where the parties jointly determine the purposes and means of certain processing, or where applicable law characterizes them as joint or independent controllers, each party shall comply with its respective obligations under Applicable Data Protection Laws and, where required, enter into the arrangements mandated by such laws, including Article 26 of the EU GDPR or its UK GDPR equivalent.

2. CATEGORIES OF PERSONAL DATA WE PROCESS

Depending on your interaction with the Service, the Sub-Portals you use, and your role (for example, as an Organization administrator, recruiter, employee, contractor, candidate, or beneficiary), we may process the following categories of Personal Data:

2.1. Account and Identity Data

Name, username, email address, telephone number, postal address, job title, organizational affiliation, login credentials, authentication data, and account preferences.

2.2. Candidate and Applicant Data

Resumes and CVs, professional history, education, skills, qualifications, contact details, application materials, candidate communications, assessment responses and results, interview recordings and transcripts, and AI-generated scores, rankings, and recommendations relating to candidates and applicants.

2.3. Employee and Contractor Data

Identity and contact details, employment or engagement details, role and compensation information, onboarding documentation, performance and time-tracking data, leave and scheduling data, tax identification information, and related workforce-administration data.

2.4. Financial Account Data

As described in Section 7.6 of the Terms, where relevant to the Service we may collect, receive, store, organize, use, and transmit employee, contractor, beneficiary, or other third-party payment details, including bank account numbers, routing numbers, SWIFT/BIC codes, IBAN details, account holder names, tax identification numbers, and related payroll and disbursement information ("Financial Account Data"). Financial Account Data is processed for purposes including payroll administration, payment processing, tax compliance, benefits administration, audit, fraud prevention, identity verification, recordkeeping, regulatory reporting, and service continuity.

2.5. Sensitive Data

Where you submit it through the Service, we may process Sensitive Data, including data revealing racial or ethnic origin, health data, biometric data processed to uniquely identify a person, and other special categories of data, as well as voice recordings and biometric identifiers processed in connection with the AI Audio Interview Assessment and related AI Features. Such processing is conducted only where the Controller has satisfied the heightened conditions for processing such data under Applicable Data Protection Laws, and where the EU GDPR, UK GDPR, or Swiss FADP applies, only where a condition under Article 9(2) of the GDPR (or its equivalent), such as the explicit consent of the Data Subject, or the necessity of processing for the purposes of carrying out obligations in the field of employment law, has been established by the Controller, including any consent, notice, retention-limitation, and written-policy requirements under laws such as the Illinois Biometric Information Privacy Act (BIPA) and comparable biometric and recording-consent laws. Where Sensitive Data also constitutes protected health information (PHI or ePHI) under HIPAA, such data is additionally subject to Section 1.1. (Olamee Corp. as Processor/ Service Provider) herein, Section 7.10 of the Terms, and the applicable BAA, which govern Olamee Corp.’s processing of that PHI. Except where a Service feature expressly requires it, Users and Organizations should not submit Sensitive Data to the Service, and Olamee Corp. does not request or require Sensitive Data.

2.6. Integrated Account Data

Where you enable an optional Third-Party Integration that surfaces external data within the Olamee Platform, for example, a Gmail integration that displays external email within the ATS, or a calendar integration that displays your external calendar, such Integrated Account Data is displayed to you within the Service for your convenience. Except as expressly stated in the applicable Sub-Portal documentation or this Privacy Policy, Integrated Account Data is accessed in real time and is not stored, retained, or copied onto Olamee Corp.’s infrastructure beyond what is technically necessary to display it to you during your session, together with transient caching, logs, and metadata reasonably necessary for performance, security, and troubleshooting.

2.7. Third-Party Data

Data licensed or obtained by Olamee Corp. from third-party data providers, including the professional-profile dataset (approximately 350 million profiles) licensed from Bright Data and originally collected by Bright Data from publicly accessible LinkedIn pages. This dataset currently excludes data relating to the United States and Canada, and its scope and availability may change. Where we obtain Personal Data about an individual from a source other than the individual, including Third-Party Data and candidate or applicant data submitted by an Organization or recruiter rather than by the candidate, the source of such Personal Data is the relevant third-party data provider or the submitting Organization, as applicable.

2.8. Usage, Device, and Log Data

IP address, device and browser information, access logs, activity logs, application and website usage data (including data collected through TimeWorks, which may include activity levels and, where enabled by the Organization, screenshots or similar workforce-monitoring data), version history, metadata, and analytics data collected subject to applicable cookie-consent requirements. Some Sub-Portals offer to take screenshots (for example, TimeWorks screenshots are workforce-monitoring data configured and controlled by the Organization).Where an Organization operates a HIPAA-configured Sub-Portal account under a BAA, screenshots that may contain protected health information (PHI or ePHI) are processed only in that HIPAA-configured account and are stored in storage environments configured for HIPAA-regulated data, handled in accordance with Section 7.10 of the Terms and the applicable BAA. The Organization controls whether the screenshot features are enabled, disabled, or configured to obscure PHI.

2.9. Communications Data

Messages, files, and other content shared through ChatWorks, TaskWorks, and other communication and collaboration features of the Service, as well as support communications and correspondence with Olamee Corp.

2.10. Sources of Personal Data

We obtain Personal Data: a) directly from you or your Organization; b) from candidates, applicants, employees, contractors, and beneficiaries whose data is submitted through the Service; c) automatically from your use of the Service (Section 2.8); d) from Third-Party Integrations you enable (Section 2.6); e) from third-party data providers, including Bright Data (Section 2.7); and f) from identity-verification, background-check, sanctions-screening, and payment partners.

3. PURPOSES AND LEGAL BASES OF PROCESSING

We process Personal Data for the purposes set out below. Where the EU GDPR, UK GDPR, Swiss FADP, or comparable laws apply, the legal bases on which we rely are indicated for each purpose. Where Olamee Corp. acts as Processor, the Controller is responsible for establishing the legal basis for the underlying processing.

3.1. To Provide and Operate the Service

To create and administer Accounts, authenticate Users, provide access to the Sub-Portals, deliver the contracted functionality, and operate the Service as an integrated platform. 

Legal basis: performance of a contract; legitimate interests; and, where Olamee Corp. acts as Processor, the documented instructions of the Controller.

3.2. To Process Payments and Administer Payroll

To process subscription fees, administer payroll and disbursements, perform tax compliance and benefits administration, and conduct identity verification, fraud prevention, and sanctions screening. 

Legal basis: performance of a contract; compliance with legal obligations; and legitimate interests.

3.3. To Provide the AI Features

To provide the AI Features described in Section 8 of the Terms, including AI-assisted email generation, job description generation, candidate search and ranking, assessment generation, resume parsing, audio interview transcription and scoring, and, where enabled, online screening interviews and AI agent functionality. Input data, which may include candidate and applicant Personal Data, is processed by Olamee Corp. and transmitted to the AI Subprocessors identified in Section 5 of this Privacy Policy. 

Legal basis: performance of a contract; legitimate interests; the documented instructions of the Controller; and, where required, consent obtained by the Controller.

3.4. To Develop, Train, and Improve Models and the Service

To develop, train, evaluate, benchmark, and improve Olamee Corp.’s models, algorithms, the Service, and other products, and to create Derived Data and De-Identified Data. Olamee Corp. does not use Personal Data or candidate data in identifiable form to train its models. Olamee Corp. may, however, process Personal Data to the limited extent necessary to transform it into De-Identified Data; such transformation is distinct from, and does not constitute training models on identifiable Personal Data. For these purposes, Olamee Corp. processes De-Identified Data, Derived Data, and Non-Personal Business Data, and processes such data as Controller to the maximum extent permitted by applicable law. 

Legal basis: legitimate interests (in respect of any limited processing of Personal Data necessary to generate De-Identified Data); processing of De-Identified Data and Non-Personal Business Data falls outside the scope of Applicable Data Protection Laws to the extent such data does not identify and cannot reasonably be used to identify a natural person by any party, taking account of all means reasonably likely to be used; where de-identification is reversible or re-identification key is retained, such data is treated as pseudonymized Personal Data and remains subject to Applicable Data Protection Laws.

We maintain and use De-Identified Data in de-identified form, do not attempt to re-identify it (except as permitted by law solely to test the effectiveness of our de-identification processes), and contractually require recipients of De-Identified Data to commit to the same. To the maximum extent permitted by applicable law, Olamee Corp. may use, disclose, license, and commercialize De-Identified Data, aggregated data, Derived Data, and Non-Personal Business Data for any lawful purpose, consistent with Sections 8.3 and 10.3A of the Terms.

3.5. To Maintain Security and Prevent Fraud

To protect the security and integrity of the Service, detect and prevent fraud, abuse, and unauthorized access, conduct AML/KYC and sanctions screening, and enforce the Terms. 

Legal basis: legitimate interests; compliance with legal obligations.

3.6. To Comply with Legal Obligations

To comply with applicable laws and regulations, including tax, financial services, anti-money laundering, employment, and recordkeeping obligations, to respond to lawful requests from public authorities, and to establish, exercise, or defend legal claims. 

Legal basis: compliance with legal obligations; legitimate interests.

3.7. To Communicate with You

To send service-related communications, respond to inquiries and support requests, and provide notices regarding the Service and changes to the Terms or this Privacy Policy. 

Legal basis: performance of a contract; legitimate interests; and, where required, consent.

3.8. For Analytics and Product Improvement

To generate analytics, statistics, benchmarks, and insights, and to understand and improve how the Service is used. Product-analytics data collected through cookies and similar technologies is processed subject to applicable cookie-consent requirements. Such analytics may include the use of session-recording, heatmap, and product-analytics tools that record interactions with the Service (such as pages viewed, clicks, and navigation) to help us understand usage and improve the Service; where required, such tools operate only on the basis of your consent.

Legal basis: consent (where required for cookies and similar technologies); legitimate interests.

3.9. For Marketing and Business Development

To send marketing and promotional communications regarding the Service to business contacts and prospective customers, to maintain customer-relationship records, and to conduct business development, subject to applicable opt-out and consent requirements. You may opt out of marketing communications at any time via the unsubscribe mechanism provided or the contact details in Section 13.

Legal basis: legitimate interests; consent where required

4. DISCLOSURE OF PERSONAL DATA

We disclose Personal Data only as described in this Privacy Policy and the Terms, and in accordance with Applicable Data Protection Laws. We disclose Personal Data to the following categories of recipients:

4.1. Sub-processors and Service Providers

We engage Sub-processors and other Third-Party Providers to process Personal Data on our behalf in connection with the Service, including cloud infrastructure and hosting providers, content-delivery and network-security providers, payment processors and banking partners, identity-verification and background-check providers, communication, SMS, and email-delivery providers, analytics, session-recording, and monitoring providers, and customer-support platforms. A current list of Sub-processors is available at https://olamee.com/legal/subprocessors. We impose data-protection obligations on each Sub-processor no less protective than those in the DPA, remain responsible for each Sub-processor's performance, and provide a mechanism to notify Controllers of intended additions or replacements and an opportunity to object, as set out in the DPA.

We may also disclose Personal Data to Affiliates of Olamee Corp. (as defined in the Terms, including entities under common ownership with Olamee Corp. that are linked by a cross-entity service agreement), whose personnel may perform services for or on behalf of Olamee Corp., including operating, administering, or supporting Olamee Corp.’s system processes, and internal controls, under Olamee Corp.’s authority, direction, and supervision. Affiliates are not Third-Party Providers; where an Affiliate processes Personal Data on Olamee Corp.’s behalf, it does so as a Sub-processor bound by data-protection obligations no less protective than those in the DPA and is identified on the Sub-processor list referenced above. 

4.2. AI Subprocessors

To provide the AI Features, we transmit input data, which may include candidate, applicant, and other Personal Data, to the AI Subprocessors identified in Section 5 of this Privacy Policy, currently including OpenAI and Lambda Labs, and to other AI and compute providers identified in the Sub-processor list referenced in Section 5, as well as to models hosted on Olamee Corp.’s own infrastructure. Each AI Subprocessor processes data subject to its own applicable terms and any data processing agreement in place with Olamee Corp.

4.3. Payment Providers

We disclose Financial Account Data and related information to Payment Providers, banking partners, treasury and payroll-disbursement providers, and foreign-exchange providers as necessary to process payments and administer payroll, consistent with Section 3.6 of the Terms.

4.4. Within Your Organization and Across Sub-Portals

Consistent with Section 3.4A of the Terms, data associated with your Account or Organization may be accessed, shared, surfaced, combined, aggregated, or processed across Sub-Portals and administrative areas of the Olamee Platform by Olamee Corp. to provide and improve a unified experience, in accordance with this Privacy Policy and Section 9 of the Terms.

4.5. Legal and Regulatory Disclosures

We may disclose Personal Data where required to comply with applicable law, regulation, legal process, or governmental request, to enforce the Terms, to detect, prevent, or address fraud, security, or technical issues, and to protect the rights, property, or safety of Olamee Corp., its users, or others.

4.6. Corporate Transactions

We may disclose or transfer Personal Data in connection with a merger, acquisition, corporate reorganization, consolidation, sale of assets, sale of equity, change of control, or financing transaction, including disclosures made during due diligence in contemplation of such a transaction, subject to appropriate confidentiality protections, consistent with Section 19.2 of the Terms.

4.7. No Sale or Sharing of Personal Data

When acting as Processor / service provider, Olamee Corp. does not "sell" or "share" Personal Data within the meaning of the CCPA/CPRA or comparable U.S. state laws, and does not combine it with personal information from other sources except as permitted by such laws. The disclosure of Personal Data by you to Olamee Corp. acting as a service provider is not a sale and is made only for the limited and specified business purpose of providing the Service. Olamee Corp. certifies that it understands and will comply with these restrictions. Acting as Controller, Olamee Corp. does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising within the meaning of the CCPA/ CPRA, and does not use or disclose Sensitive Personal Information for purposes other than those permitted under the CCPA regulations. De-Identified Data, Derived Data, and Non-Personal Business Data are not Personal Data, and their use, licensing, or disclosure does not constitute a "sale" or "sharing" of Personal Data. We do not knowingly sell or share the Personal Data of consumers under sixteen (16) years of age. If our practices change such that a disclosure would constitute a "sale" or "sharing" under applicable U.S. state laws, we will update this Privacy Policy and provide the required opt-out mechanisms before engaging in such practices.

4.8. Storage of Interview and Assessment Media

Where the Service is used to collect interview recordings, assessment-related media, candidate portfolios, or similar documents, such media may be stored with cloud object-storage and hosting providers engaged by Olamee Corp. as Sub-processors. Such media may include voice recordings and other Sensitive Data, and is retained and deleted in accordance with Section 9 (Data Retention) and the instructions of the relevant Controller. The processing of such Sensitive Data remains subject to Sections 2.5 and 5.4 and to the Controller's obligation to establish a valid condition for processing.

5. AI FEATURES AND AI SUBPROCESSORS

5.1. Processing for the AI Features

The AI Features process input data, which may include candidate and applicant Personal Data, to generate AI Output, including content, transcriptions, summaries, structured data, scores, rankings, and recommendations. This processing is described in Section 8 of the Terms and is conducted in accordance with this Privacy Policy, Section 9 of the Terms, and any applicable data processing agreement.

5.2. AI Subprocessors

A current list of AI Subprocessors is available at https://olamee.com/legal/subprocessors  and forms part of the Terms, as provided in Section 8.2 of the Terms. The AI Subprocessors currently include, without limitation, OpenAI and Lambda Labs, together with models hosted on Olamee Corp.’s own infrastructure. Olamee Corp. may add, replace, or remove AI Subprocessors from time to time in accordance with Sections 3.7 and 9.4 of the Terms.

5.3. Automated Processing in Recruitment

Certain AI Features generate, score, rank, transcribe, or assess candidates, applicants, or interviews. These features are decision-support tools only and are not a substitute for human judgment; they are designed to be used with a qualified human reviewing and confirming outcomes before any decision is made, and the Controller (deployer) must ensure that such review occurs. Accordingly, the AI Features are not designed or intended to be used to make decisions producing legal or similarly significant effects concerning an individual based solely on automated processing within the meaning of Article 22 of the EU GDPR; the Controller (deployer) is responsible for ensuring that meaningful human review is applied before any such decision is made. The Controller (deployer) is responsible for ensuring that its use of the AI Features complies with Applicable AI Laws and laws governing automated or AI tools in recruitment and employment, and applicable transparency, notice, consent, candidate-notification, accommodation, anti-discrimination, and bias-audit requirements. Certain AI Features involve profiling, the automated evaluation of personal aspects such as skills, experience, and interview responses to produce scores or rankings. Meaningful information about the logic involved and the significance and envisaged consequences of such processing is available in the applicable product documentation and on request through the contact details in Section 13.

5.4. Voice Recordings, Transcripts, and Biometric Data

Where the AI Features process audio interview recordings to produce transcripts and automated scores or rankings, the Controller is responsible for providing all notices to, and obtaining all consents from, candidates required under applicable wiretap, recording-consent (including one-party and all-party/two-party consent), and biometric-privacy laws, including BIPA and similar laws. AI-generated transcripts and scores may contain errors and are indicative aids only. Voice recordings, transcripts, and any biometric data are retained only for the period determined by the Controller's instructions and are deleted or de-identified in accordance with Section 9 and applicable retention-and-destruction requirements under biometric-privacy laws.

5.5. Model Training

Olamee Corp. does not use Personal Data or candidate data in identifiable form to train its models. Olamee Corp. may use De-Identified Data, Derived Data, and Non-Personal Business Data to develop, train, evaluate, and improve its models and the Service, in accordance with Section 8.3 of the Terms. Where User Content is used for these purposes, any Personal Data it contains is used only in De-Identified form, consistent with Section 8.3 of the Terms.

6. THIRD-PARTY DATA SOURCES

Certain AI Features incorporate Third-Party Data licensed from third-party providers and originally sourced from publicly accessible profiles, including the dataset of professional profiles licensed from Bright Data and described in Section 8.9 of the Terms. Olamee Corp. does not warrant the accuracy, completeness, currency, or lawfulness of Third-Party Data for any particular use. Data-protection, privacy, and data-subject rights may apply to Personal Data within Third-Party Data even where it is publicly accessible, and the Controller is responsible for ensuring that its use of Third-Party Data complies with applicable laws. For the Bright Data dataset, Olamee Corp. acts as Controller. The categories of Personal Data concerned are professional-profile data made publicly accessible by the individual, such as name, current and past positions and employers, education, skills, location, and public profile URL. The source is Bright Data, which represented that it collected the data from publicly accessible LinkedIn pages; the dataset currently excludes data relating to the United States and Canada. Olamee Corp. processes this data for candidate discovery and ranking through AI Search, on the legal basis of Olamee Corp.’'s and its customers' legitimate interests in identifying and evaluating potential candidates. Profiles are retained while the dataset remains licensed and current, and are updated or removed as the dataset is refreshed or upon a verified objection or erasure request. Given the number of data subjects concerned, providing the information required by Article 14 of the EU GDPR individually to each data subject would involve disproportionate effort within the meaning of Article 14(5)(b); Olamee Corp. therefore makes this information publicly available through this Privacy Policy. Recipients are customers using AI Search. Individuals may object to this processing, or request access, rectification, or erasure, directly from Olamee Corp. using the contact details in Section 13, and Olamee Corp. may suspend, restrict, or remove all or part of the dataset at any time, consistent with Section 8.9 of the Terms.

6.A The Olamee Talent Pool

Olamee Corp. maintains a talent pool of candidates who register with, or submit their Personal Data directly to, Olamee Corp. (the “Olamee Talent Pool”), which may be searched, matched, and ranked through AI Search, as described in Sections 8.7(c) and 9.1(b) of the Terms. With respect to the Olamee Talent Pool, Olamee Corp. acts as Controller. The categories of Personal Data concerned are the Account and Identity Data, and the Candidate and Applicant Data described in Sections 2.1 and 2.2, as submitted by or on behalf of the candidate. Olamee Corp. processes this data to create, and administer talent-pool profiles; to enable candidate discovery, matching, scoring, and ranking through AI Search; to make profiles available to customers seeking candidates through the Service; and to communicate with candidates regarding their profile and relevant opportunities. The legal bases are the performance of a contract with the candidate (or steps taken at the candidate's request prior to entering into a contract) and the legitimate interests of Olamee Corp. and its customers in identifying, evaluating, and connecting with potential candidates; the profiling involved in AI Search is described in Section 5.3. Recipients are customers using AI Search and the Sub-processors identified in Section 4. By registering in the Olamee Talent Pool, the candidate directs and intends that their profile be made available to prospective employers/customers using the Service; such disclosure is made at the candidate's direction and does not constitute a "sale" or "sharing" of Personal Data within the meaning of the CCPA/CPRA, consistent with Section 4.7. Talent-pool profiles are retained for as long as the candidate's registration remains active and for a reasonable period thereafter, unless earlier deletion is requested. Candidates may withdraw from the Olamee Talent Pool at any time and may exercise the rights described in Section 11 using the contact details in Section 13.

7. OPTIONAL INTEGRATIONS

The Service offers optional integrations with third-party services, which may currently include Zoom, LinkedIn (XML feed), Hubstaff, Wise (TransferWise), Airwallex, Google Calendar, Gmail, DocuSeal, and QuickBooks. These integrations are not required to use the Service. If you enable an integration, you authorize the connection using your own account credentials or access tokens, your use of each third-party service is governed by that provider's own terms and privacy policy, and Olamee Corp. is not responsible for the acts, omissions, security, and data practices of third-party services. Data surfaced from such integrations is subject to Section 3.4B of the Terms (Integrated Account Data) and Section 2.6 of this Privacy Policy. Notwithstanding anything to the contrary in this Privacy Policy, Olamee Corp.'s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

8. INTERNATIONAL DATA TRANSFERS

Your Personal Data may be stored and processed in jurisdictions other than your country of residence, including the United States, and where personnel of Affiliates of Olamee Corp. provide services on Olamee Corp.’s behalf, the jurisdiction in which such personnel are located. Where Personal Data originating in the EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, such transfer is governed by the applicable Standard Contractual Clauses (EU Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Agreement/Addendum, or another lawful transfer mechanism, in each case incorporated into the DPA. Intra-group transfers to Affiliates are made under intra-group agreements incorporating the applicable Standard Contractual Clauses or another lawful transfer mechanism. 

For transfers subject to other Applicable Data Protection Laws, including Brazil's LGPD, China's PIPL, India's DPDP Act, South Africa's POPIA, and Québec Law 25, Olamee Corp. implements the transfer mechanisms, consents, or assessments required by such laws, consistent with Section 9.5 of the Terms. You may request further information regarding the transfer mechanisms applicable to your Personal Data using the contact details in Section 13 of this Privacy Policy, including, where applicable, a copy of the relevant safeguards.

9. DATA RETENTION

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Service, comply with our legal, tax, accounting, financial-services, anti-money-laundering, audit, and recordkeeping obligations, enforce the Terms, resolve disputes, and prevent fraud and security incidents. The specific retention periods and disposal methods for each category of data are set out in the Olamee Data Retention Schedule, which is maintained as part of Olamee Corp.’s data-retention program and is the controlling source for the applicable retention period for a given data category. The periods described in this Section 9 are a summary; where this Section and the Data Retention Schedule differ as to a specific category, the Data Retention Schedule governs the applicable period.

In general, and except where a longer period is required by applicable law, Account and Identity Data is retained for the duration of the Account and for a reasonable period thereafter; Candidate and Applicant Data is retained for the period determined by the relevant Controller and, where Olamee Corp. acts as Controller, for no longer than necessary for the purposes described in Section 3; and usage, Device, Log, and Communication Data is retained for the period necessary for security, operational, and analytics purposes. Retention of Sub-Portal’s data (for example, TimeWorks monitoring data) is category-specific and set out in the Data Retention Schedule.

The specific retention period applicable to Personal Data processed on a Controller’s behalf is determined by the Controller’s instructions and retention policies. Certain categories of data, including Financial Account Data, payroll records, tax records, and compliance documentation, are retained as necessary to comply with financial-services regulations, tax laws, audit requirements, and legal obligations. Such retention periods may extend for significant periods, typically seven (7) to ten (10) years or longer, as required by applicable law. Separately, and distinct from that financial and tax retention period, where Olamee Corp. processes PHI as a business associate or subcontractor business associate under HIPAA, Olame Corp. retains HIPAA-required documentation (including policies, ePHI risk analysis, BAAs, HIPAA training records, and security-incident records) for a minimum of six (6) years from the later of the date of their creation of the date they were last in effect.

Upon termination of the Service and on the Controller's written request, Olamee Corp. will delete or return Personal Data processed as Processor, except to the extent retention is required by applicable law or such data exists in De-Identified or Derived form, consistent with Section 9.7 of the Terms. Olamee Corp.’s retention and use of Non-Personal Business Data and Derived Data as Controller survives termination. Where retention is no longer required, we will delete or anonymize Personal Data within a reasonable period following termination. Personal Data held in routine backups and archives may persist until such backups expire or are overwritten in the ordinary course, and remain protected under this Privacy Policy until deletion.

10. SECURITY

Olamee Corp. implements and maintains appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, consistent with Article 32 of the EU GDPR and comparable requirements under Applicable Data Protection Laws, as further described in the DPA. Persons authorized to process Personal Data, including personnel of Affiliates acting under Olamee Corp.’s authority, direction, and supervision, are bound by appropriate confidentiality obligations. No method of transmission or storage is fully secure, and Olamee Corp. does not guarantee absolute security. You are responsible for maintaining the confidentiality and security of your login credentials and for implementing sufficient safeguards to protect your data and operations.

In the event of a personal-data breach affecting Personal Data processed on a Controller's behalf, Olamee Corp. will notify the affected Controller without undue delay after becoming aware of the breach, and will provide information reasonably available to assist the Controller in meeting its breach-notification obligations, consistent with Section 9.6 of the Terms. Notification of, or response to, a breach shall not be construed as an acknowledgment of fault or liability. Where Olamee Corp. acts as Controller, Olamee Corp. might notify competent supervisory authorities and affected individuals of a personal-data breach where and as required by Applicable Data Protection Laws.

11. RIGHTS OF DATA SUBJECTS

Individuals whose Personal Data is processed through the Service (including candidates, applicants, employees, and contractors) have the rights afforded to them under Applicable Data Protection Laws. Depending on the applicable law and the basis of processing, these rights may include:

• the right of access to their Personal Data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure or deletion;
• the right to restriction of, or objection to, processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent;
• the right to opt out of the "sale" or "sharing" of personal information and of certain targeted advertising and profiling;
• the right to non-discrimination for exercising these rights; and
• where provided by applicable law, the right to appeal a refusal of a rights request and the right to lodge a complaint with a competent supervisory authority.

Where processing is based on legitimate interests, you have the right to object at any time on grounds relating to your particular situation; we will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary to establish, exercise, or defend legal claims. Information about the balancing assessment applied is available on request (Section 13).

11.1. How to Exercise Your Rights

Where Olamee Corp. processes Personal Data as Processor on behalf of a customer, the customer is the Controller responsible for honoring these rights, and individuals should direct their requests to that customer. Where Olamee Corp. acts as Controller, individuals may exercise their rights by contacting us using the details in Section 13 of this Privacy Policy.

We will respond to verified requests within the timeframes required by Applicable Data Protection Laws. We may need to verify your identity before fulfilling your request, and certain exceptions and limitations under applicable law may apply. This Privacy Policy controls as to the enumeration and mechanics of such rights, consistent with Section 9.6A of the Terms.

11.2. U.S. State Privacy Rights

Residents of California and other U.S. states with comprehensive privacy laws may, subject to applicable exceptions, exercise the rights to know/access, correct, delete, and obtain a portable copy of their Personal Data, to opt out of sale, sharing, and targeted advertising, to limit the use of sensitive personal information, and to non-discrimination, as described in Section 11. The categories of Personal Data we collect are described in Section 2, the purposes in Section 3, the categories of recipients in Section 4, and retention criteria in Section 9. Requests may be submitted using the contact details in Section 13, including through an authorized agent; we will verify your identity (and an agent's authority) before acting on a request. Where required, we honor opt-out preference signals such as the Global Privacy Control. If we deny your request, you may appeal by replying to our decision or by contacting us using the details in Section 13 with the subject line “Privacy Appeal”, and, where provided by law, you may contact your state attorney general.

11.3. EEA, UK, and Switzerland

Where the EU GDPR, UK GDPR, or Swiss FADP applies to Olamee Corp.'s processing as Controller, the controller is Olamee Corp. (Section 13). 

11.4. Other Jurisdictions

Where other data-protection law applies, individuals may exercise the rights available under those laws using the contact details in Section 13.

12. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate the Service, authenticate Users, maintain security, remember preferences, and, subject to your consent where required, to collect product-analytics data and to operate session-recording, heatmap, and similar product-analytics tools that record interactions with the Service. You can manage your cookie preferences through the consent mechanism provided within the Service or through your browser settings. Where consent is required for non-essential cookies, we collect such data only on the basis of your consent.

13. CONTACT INFORMATION

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your Personal Data, or if you wish to exercise your rights, you may contact us at:

• Email: support@olamee.com 
• Legal Notices: legal@olamee.com 
• Mailing Address: 7114 Schafer St., Dallas, TX 75252

Where Olamee Corp. acts as Controller, we will make reasonable efforts to respond to inquiries and rights requests within the timeframes required by applicable law. Response times may vary depending on the nature of the request, the applicable jurisdiction, and the complexity of the issue.

14. CHILDREN’S DATA

The Service is intended for use by Organizations and by individuals who are at least 18 years of age or of the age of majority in their jurisdiction, consistent with Section 2.4 of the Terms. Olamee Corp. does not knowingly collect Personal Data directly from children. If you believe that a child has provided Personal Data to us, please contact us using the details in Section 13 and we will take appropriate steps to delete such data where required by applicable law.

15. CHANGES TO THIS PRIVACY POLICY

Olamee Corp. reserves the right to modify, update, or replace this Privacy Policy at any time, to reflect changes in law, regulatory requirements, business practices, Sub-Portal functionality, third-party service-provider relationships, or other operational needs. When material changes are made, we will make reasonable efforts to notify users, which may include posting the updated Privacy Policy within the Olamee Platform, sending an email to your registered address, or displaying a notice upon login. Unless otherwise specified, changes become effective upon posting within the Olamee Platform or upon notification to users. Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the modified Privacy Policy. You are responsible for reviewing this Privacy Policy periodically to stay informed of any updates.

16. RELATIONSHIP TO THE TERMS

This Privacy Policy is a disclosure statement provided under Applicable Data Protection Laws and, except to the extent required by such laws, does not create contractual or third-party-beneficiary rights beyond those set out in the Terms. The disclaimers, exclusions, and limitations of liability set out in the Terms (including Sections 13, 8.4, and 3.5 of the Terms) apply to this Privacy Policy to the maximum extent permitted by applicable law.

Last Update: 31 July, 2026