GDPR & Data Protection

Uni5d Technology Solutions LLC operates the Quali5d platform and processes personal data in two capacities: Data Processor: When your organisation (the Data Controller) uses Quali5d to process personal data of your employees, hiring managers, and job candidates, Uni5d acts as a Data Processor under Article 28 of the GDPR. Data Controller: Uni5d acts as a Data Controller for the personal data of our own customers (company administrators and users) collected during account registration and platform use. Lawful Basis for Processing: • Contract performance — processing necessary to deliver the subscribed services • Legitimate interests — platform security, fraud prevention, product improvement • Legal obligation — retaining billing records as required by law • Consent — where explicitly obtained for specific processing activities

Under GDPR, individuals whose data we process have the following rights: Right of Access (Article 15) Request a copy of the personal data we hold about you, the purposes of processing, and the categories of data involved. Right to Rectification (Article 16) Request correction of inaccurate or incomplete personal data. Right to Erasure / "Right to Be Forgotten" (Article 17) Request deletion of your personal data where there is no legitimate reason for continued processing. Note: we may retain certain data where required by legal obligation (e.g. billing records for 7 years). Right to Restriction of Processing (Article 18) Request that we restrict processing of your personal data in certain circumstances. Right to Data Portability (Article 20) Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller. Right to Object (Article 21) Object to processing based on legitimate interests or for direct marketing purposes. Rights Related to Automated Decision-Making (Article 22) Quali5d uses AI to generate candidate scores and assessments. These outputs are advisory tools to assist human decision-makers — they are not binding automated decisions. However, you have the right to: • Be informed about automated processing • Request human review of any AI-generated assessment • Contest any AI-generated output How to Exercise Your Rights: Email: admin@uni5d.ai Subject: "GDPR Data Subject Request" Response time: Within 30 days of receipt

Uni5d Technology Solutions LLC is based in the United States. When EU/EEA personal data is processed using Quali5d, it is transferred to and processed in the United States. Legal Mechanism for Transfers: We rely on Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914) as the lawful transfer mechanism for EU/EEA personal data transferred to the United States. Sub-Processor Transfers: All our sub-processors are US-based. We ensure each sub-processor has appropriate safeguards in place: • Microsoft Azure — EU SCCs, Azure Data Protection Addendum • Anthropic, Inc. — Data Processing Agreement with SCCs • ElevenLabs, Inc. — Data Processing Agreement • Stripe, Inc. — EU SCCs, Stripe Data Processing Agreement Copies of applicable SCCs and DPAs are available upon request at admin@uni5d.ai.

We use the following sub-processors to deliver our services. All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security measures. Sub-Processor | Service | Location | Safeguard ───────────────────────────────────────────────────── Microsoft Azure | Cloud infrastructure, storage, speech services | United States | SCCs + Azure DPA Anthropic, Inc. | AI document generation and candidate scoring | United States | DPA ElevenLabs, Inc. | AI voice conversations (intake calls, interviews) | United States | DPA Stripe, Inc. | Payment processing and billing | United States | SCCs + Stripe DPA We will notify customers of any intended changes to sub-processors (additions or replacements) with at least 14 days notice, giving customers the opportunity to object. To request the full list of sub-processors with their current DPAs, contact admin@uni5d.ai.

For customers who are subject to GDPR and process EU/EEA personal data using Quali5d, a Data Processing Agreement (DPA) is required under Article 28 GDPR. Our DPA covers: • Subject matter and duration of processing • Nature and purpose of processing • Type of personal data processed • Categories of data subjects • Obligations and rights of the controller • Sub-processor arrangements • Security measures • Deletion and return of data • Audit rights How to obtain a DPA: Email admin@uni5d.ai with the subject "DPA Request" and your company name. We will respond with the DPA within 3 business days. The DPA is incorporated by reference into the Quali5d Terms of Service upon execution.

We apply the GDPR data minimisation and storage limitation principles to all personal data: Audio & Video Recordings: 90 days from upload/session date, then permanently deleted. This includes interview recordings of candidates and intake call recordings of hiring managers. Transcripts & AI-Generated Documents: Retained for the duration of the subscription plus 30 days. Deleted within 30 days of account termination. Account & Contact Data: Retained for the duration of the subscription plus 90 days. Billing & Transaction Records: 7 years as required by US federal tax law (IRC § 6001) and applicable state law. Right to Request Early Deletion: Data subjects may request deletion of their personal data prior to the standard retention period by contacting admin@uni5d.ai. We will process valid deletion requests within 30 days, subject to legal retention obligations.

If you are located in the EU/EEA and believe we have not handled your personal data in compliance with GDPR, you have the right to lodge a complaint with your local supervisory authority. Find your supervisory authority: https://edpb.europa.eu/about-edpb/about-edpb/members_en We encourage you to contact us first at admin@uni5d.ai so we can address your concern directly. We aim to resolve all privacy complaints within 15 business days. For UK residents: You may also contact the Information Commissioner's Office (ICO) at ico.org.uk.