REQeV GDPR Policy

Effective date: September 17, 2026

This GDPR Policy (“Policy”) is provided by ECDG, Inc., a California corporation, doing business as REQeV (“REQeV”, “we”, “us”). It supplements our Privacy Policy for individuals and customers located in the European Economic Area (“EEA”), the United Kingdom and Switzerland.

It describes how we comply with the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 (“UK GDPR”), and the Swiss Federal Act on Data Protection (“FADP”). We refer to these laws together as “European Data Protection Law”. Terms such as “controller”, “processor”, “personal data” and “processing” have the meanings given in those laws.

1. Who This Policy Applies To

This Policy applies to individuals in the EEA, the UK and Switzerland whose personal data REQeV processes, including:

Visitors to reqev.com and our other websites.
Prospects, customer contacts, vendors, partners and event attendees.
Individual users of REQeV ATS, REQeV Sourcing, REQeV Mission Control and our APIs, integrations, browser extensions and AI features (together, the “Services”).
People who apply for jobs at REQeV.
Candidates and contacts whose personal data is stored in a customer’s account, to the extent described in Sections 2 and 5.

It also explains, for customers established in these regions, how REQeV supports their own compliance obligations.

2. Our Roles: Controller and Processor

When REQeV is a controller

REQeV is the controller of personal data that we process for our own purposes. This includes website and marketing data, account and billing data, support communications, security logs and job applicant data. This Policy mainly describes that processing.

When REQeV is a processor

Our customers are recruiting firms and employers. When they use the Services to store, source or manage information about candidates, contacts and other individuals (“Customer Data”), the customer is the controller and REQeV is its processor. We process Customer Data only on the customer’s documented instructions under our Data Processing Addendum (“DPA”).

If your personal data is held in a customer’s account, that customer decides why and how it is processed and is responsible for responding to your requests. Our Candidate Privacy Notice explains how to contact the relevant customer. If you contact us instead, we will forward your request to the customer where we can identify it and will assist the customer as the DPA requires.

3. Personal Data We Process as a Controller

Depending on how you interact with us, we process the following types of personal data:

Contact and identity data, such as your name, work email address, phone number, job title and employer.
Account data, such as your username, log-in credentials, user role, preferences and the customer account you belong to.
Billing data, such as billing contact details, purchase history, subscription and credit pack details, and tax identifiers. Payments are processed by Stripe, Inc., and REQeV does not store full card numbers.
Usage and device data, such as IP address, approximate location derived from IP address, browser and device type, pages viewed, product events and log data.
Communications data, such as emails, support tickets, chat messages and, where enabled and disclosed, call recordings.
Marketing data, such as your communication preferences, event registrations and interactions with our emails and advertising.
Applicant data, such as your CV, work history, education, interview notes and references, when you apply for a role at REQeV.

We do not intentionally collect special categories of personal data as a controller. If a REQeV job applicant chooses to share such data, we process it only where permitted by law.

4. Legal Bases for Processing

European Data Protection Law requires us to have a legal basis for each purpose for which we process personal data. The table below sets out our purposes and the legal bases we rely on.

Purpose	Data	Legal basis
Creating and administering accounts and providing the Services	Contact, account, usage and device data	Performance of a contract with the account holder (Art. 6(1)(b)); for users of a customer’s account, our legitimate interest in providing the Services the customer purchased (Art. 6(1)(f))
Processing payments, invoicing and keeping financial records	Contact and billing data	Performance of a contract (Art. 6(1)(b)); compliance with legal obligations such as tax and accounting rules (Art. 6(1)(c))
Providing customer support and service communications	Contact, account and communications data	Performance of a contract (Art. 6(1)(b)); legitimate interest in supporting our users (Art. 6(1)(f))
Securing the Services and preventing fraud, abuse and security incidents	Account, usage and device data	Legitimate interest in protecting our users, systems and business (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c))
Analyzing and improving our websites and Services	Usage and device data, feedback	Legitimate interest in understanding and improving our products (Art. 6(1)(f)); consent where non-essential cookies are used (Art. 6(1)(a))
Sending marketing emails to business contacts	Contact and marketing data	Legitimate interest in promoting our Services to business contacts (Art. 6(1)(f)), or consent where required by applicable e-privacy rules (Art. 6(1)(a))
Placing non-essential cookies and personalized advertising	Cookie identifiers, usage and device data	Consent (Art. 6(1)(a))
Responding to sales inquiries and running events and webinars	Contact and communications data	Steps taken at your request before entering into a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f))
Recruiting for roles at REQeV	Applicant data	Steps taken at your request before entering into an employment contract (Art. 6(1)(b)); legitimate interest in assessing candidates (Art. 6(1)(f)); consent to keep your data for future roles (Art. 6(1)(a))
Complying with law and responding to lawful requests	Any relevant data	Compliance with legal obligations (Art. 6(1)(c))
Establishing, exercising or defending legal claims and enforcing our agreements	Any relevant data	Legitimate interest in protecting our rights (Art. 6(1)(f))
Carrying out a merger, acquisition, financing or reorganization	Any relevant data	Legitimate interest in running and developing our business (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about that balancing by contacting support@reqev.com. Where we rely on consent, you can withdraw it at any time.

5. Recruitment Context: Sourcing and Candidate Data

REQeV Sourcing and REQeV ATS help customers find and engage candidates, including people who have not applied for a role. When customers use these features, they act as controllers and are responsible for having a legal basis and for giving candidates the required information.

Legitimate interests for sourcing

Customers typically rely on legitimate interests to source candidates from professional profiles and other sources. Before doing so, a customer should carry out and document a legitimate interests assessment. That assessment should consider whether candidates would reasonably expect to be contacted about job opportunities, what data is truly necessary, and how long it is kept.

Article 14 notice obligations

When a customer collects personal data about a candidate from a source other than the candidate, Article 14 of the GDPR and UK GDPR generally requires the customer to provide a privacy notice. That notice must be given within a reasonable period and no later than one month after collection, or at the time of first communication with the candidate if that is earlier. The exceptions to this duty are narrow, and customers should not assume they apply.

The notice should identify the customer as controller, explain the purposes and legal basis, name the source of the data, and describe the candidate’s rights, including the right to object.

Objections and suppression

Customers must honor a candidate’s objection to processing and stop contacting a candidate who asks them to. The Services include tools that customers can use to record objections, delete records and prevent re-importing a candidate’s data.

6. Your Rights

Under European Data Protection Law, and subject to conditions and exceptions in those laws, you have the following rights regarding personal data for which REQeV is the controller:

Access. You can ask for confirmation of whether we process your personal data and for a copy of it, along with information about how we use it.
Rectification. You can ask us to correct inaccurate personal data or complete incomplete data.
Erasure. You can ask us to delete your personal data, for example where it is no longer needed or you have withdrawn consent and no other legal basis applies.
Restriction. You can ask us to restrict processing, for example while we check the accuracy of data or consider an objection.
Portability. You can ask for personal data you provided to us in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where technically feasible. This applies where processing is based on consent or contract and carried out by automated means.
Objection. You can object to processing based on legitimate interests on grounds relating to your particular situation. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
Objection to direct marketing. You can object at any time to our use of your personal data for direct marketing, including any related profiling. We will always stop when you object.
Withdrawal of consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before withdrawal.
Automated decisions. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you. See Section 7.

7. Automated Decision-Making and AI Features

REQeV does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects for its own purposes.

The Services include AI features that can help customers summarize, rank, match or draft content about candidates. Customers decide whether and how to use these features and remain responsible for hiring decisions. Customers using AI features must ensure meaningful human involvement in any decision that significantly affects a candidate, must not rely solely on automated outputs to reject a candidate, and must meet any transparency and assessment obligations that apply to them, including under the EU Artificial Intelligence Act where relevant.

AI features are provided using third-party AI model providers, which act as our subprocessors and are listed on our Subprocessors page. We do not use Customer Data to train general-purpose AI models, and we do not permit our model providers to do so.

8. How to Exercise Your Rights

To exercise any of your rights, email support@reqev.com with the subject line “Privacy Request”. Please tell us which right you want to exercise, where you are located, and how you have interacted with us, such as through an account, a purchase or a job application.

You can also manage some choices yourself:

Update account details in your settings at app.reqev.com.
Unsubscribe from marketing emails using the link in any marketing email.
Read about browser cookie controls in our Cookie Policy page.
Review other options at Your Privacy Choices.

If your data is held in a customer’s account, please contact that customer directly, as described in Section 2.

9. Identity Verification

To protect your personal data, we may need to confirm your identity before acting on a request. We will usually do this by asking you to respond from the email address we hold for you or to confirm the request while signed in to your account.

If we have reasonable doubts about your identity, we may ask for limited additional information. We will only ask for what is necessary, and we will use it only to verify your identity and keep a record of the request. If you make a request through a representative, we may ask for proof of their authority.

10. Response Timing

We will respond to your request without undue delay and within one month of receipt. If a request is complex or we receive many requests, we may extend this period by up to two further months, and we will tell you about the extension and the reasons within the first month.

We do not charge a fee to respond. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, and we will explain why. If we do not act on a request, we will tell you the reasons and your right to complain to a supervisory authority.

11. Complaints to a Supervisory Authority

We encourage you to contact us first at support@reqev.com so we can try to resolve your concern. You also have the right to complain to a data protection supervisory authority.

EEA. REQeV does not have an establishment in the EU, so the GDPR’s one-stop-shop mechanism does not apply and we do not have a lead supervisory authority. You may complain to the supervisory authority in the EEA country where you live, work or where the alleged infringement took place. A list of authorities is available from the European Data Protection Board.
United Kingdom. You may complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
Switzerland. You may complain to the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

12. International Data Transfers

REQeV is based in the United States, and our Services are hosted in the United States. Personal data we receive from the EEA, the UK and Switzerland is therefore processed in the United States, which may not provide the same level of data protection as your home country.

Where European Data Protection Law requires a transfer mechanism, we rely on the following safeguards:

EEA. The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (“SCCs”).
United Kingdom. The SCCs together with the UK International Data Transfer Addendum issued by the ICO.
Switzerland. The SCCs with the amendments required for transfers subject to the FADP, as recognized by the FDPIC.

Our DPA incorporates these safeguards for Customer Data, and we put equivalent terms in place with our subprocessors. We assess the laws of destination countries and apply supplementary measures, such as encryption in transit and at rest and access controls, where appropriate.

REQeV is not certified under the EU-U.S. Data Privacy Framework, the UK Extension to it or the Swiss-U.S. Data Privacy Framework, and we do not rely on those frameworks for transfers. You may request a copy of the relevant safeguards by emailing support@reqev.com. We may redact commercial terms.

13. EU and UK Representative

Because REQeV is not established in the EU or the UK, Article 27 of the GDPR and UK GDPR may require us to appoint a representative in those regions.

REQeV has not currently appointed a representative in the EU, the UK or Switzerland. If we appoint one, we will publish their name and contact details here. In the meantime, please contact us directly at support@reqev.com.

14. Data Protection Officer

REQeV has not appointed a data protection officer. Our privacy team handles all data protection questions and can be reached at support@reqev.com.

15. Data Retention

We keep personal data only as long as necessary for the purposes described in this Policy. When deciding retention periods, we consider the purpose of the processing, our ongoing relationship with you, legal and tax requirements, limitation periods for legal claims, and security needs.

For example, we keep account data for the life of the account and a limited period afterward. We keep marketing data until you opt out or it becomes outdated. Retention of information about applicants for roles at REQeV depends on the recruitment purpose, applicable law and any consent to consider the applicant for future roles.

For Customer Data, customers control retention while their subscription is active. At the end of the Services, we return or delete personal data at the customer’s choice under the DPA. Unless earlier deletion is requested, data remains available during the applicable export window and is then deleted without undue delay, subject to legally required retention. Backup copies are put beyond use pending scheduled overwrite. These arrangements do not extend applicable privacy-request deadlines.

16. Security

We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include encryption in transit, access controls based on least privilege, per-tool authentication for tool-to-hub calls and HMAC signatures on outbound credit-grant commands, logging and monitoring, and vendor due diligence.

If we become aware of a personal data breach affecting Customer Data, we will notify affected customers without undue delay and no later than 72 hours after becoming aware of the breach, as described in the DPA. More information is available at Security. To report a vulnerability or incident, contact support@reqev.com.

17. Resources for Customers

Customers established in or serving individuals in the EEA, the UK or Switzerland can use the following resources to meet their own obligations:

Data Processing Addendum, which sets out our processor commitments and incorporates the SCCs and UK and Swiss transfer terms.
Subprocessors, which lists the third parties that process Customer Data and explains how to receive update notices.
Security, which describes our security program.
Candidate Privacy Notice, which explains to candidates how their data may be processed through the Services.

We will provide reasonable assistance to customers with data subject requests, data protection impact assessments and consultations with supervisory authorities, as described in the DPA.

18. Changes to This Policy

We may update this Policy from time to time. When we do, we will change the effective date shown at the top of this page. If changes are material, we will provide additional notice, such as by email or in the Services.

19. Contact

If you have questions about this Policy or want to exercise your rights, contact ECDG, Inc., a California corporation, doing business as REQeV, 236 West Portal Ave #390, San Francisco, CA 94127.

Privacy requests and questions: support@reqev.com

Security incidents and vulnerabilities: support@reqev.com