CANDIDATE PRIVACY NOTICE

Last updated: 2 September 2025

We at X-FLOW LTD (“X-FLOW”, “we” or “us”) are committed to respecting your privacy and the integrity and security of your personal data.

X-FLOW is the data controller with its registered office at 8 Genethliou Mitella, 3036 Limassol, Cyprus.

This Candidate Privacy Notice explains how we collect, process, store, use, and share your personal data when you apply for a position at X-FLOW and how you can exercise your privacy rights. Please note that this Candidate Privacy Notice does not apply to the use of X-FLOW’s Services. By using any of X-FLOW’s Services, including apps and websites, you are subject to the Privacy Policy available here (https://xflowgames.com/privacy-policy.html).

Please read the following carefully and make sure you fully understand this Candidate Privacy Notice.

1. What Data We Collect

We collect only the data that is necessary for the purposes described in this Candidate Privacy Notice - we don't gather any more information than we need.

We collect data you provide directly, or from third-party sources such as recruitment agencies, references, former employees, websites used for seeking employment opportunities, such as LinkedIn.

Depending on the role and stage of the process, we may process:

Identity and contact information such as first name, last name, date of birth, email address, mailing address, residence, telephone number, messengers usernames, citizenship, nationality, your photo included in your CV. We also collect contact information for the references you provide; it is your responsibility to obtain consent from your references before providing their personal information to the Company.
Professional information such as your CV, cover letter, employment history (such as job titles, workplaces, dates of employment, job descriptions, skills), portfolio, professional qualifications, references provided, certifications, training courses, education history.
Public information such as your social media profile (for example, your LinkedIn profile, if permitted).
Employment eligibility information such as immigration status, social security number or similar identifier, citizenship documentation (such as a copy of your passport), identity card information, vaccination records or visa information, marital status (when required to prove your right to work).
Employment expectations such as your desired salary or remuneration, benefits package, information regarding any job or work offers we have made to you and your responses.
Interview information such as interview history and notes, assessment results, your feedback about the interview.
Audio and video materials such as CCTV footage from our office or recordings of online video meetings (if permitted).
Other information you voluntarily choose to provide in connection with your job application, such as salary history or reasons for leaving previous positions.

We generally do not collect special categories of personal data (such as health data or any criminal convictions and offences) and discourage providing it, unless its processing is mandated by applicable law - in which case we will expressly request it from you.

2. Why We Collect and Use Your Data

We use your personal information only for the following purposes and legal bases:

Purposes	Personal Data	Legal basis
To assess your skills, experience and suitability for our roles	Identity and contact information Professional information Public information Employment eligibility information Employment expectations Interview information Other information provided voluntarily	Legitimate interest of managing recruitment and evaluating the candidates
To contact candidates about the applied role or, where permitted, other suitable roles	Identity and contact information	Legitimate interest of managing recruitment; Consent (where required)
To conduct interviews and assessments	Identity and contact information Professional information Public information Employment expectations Interview information Other information provided voluntarily	Legitimate interest of managing recruitment and evaluating the candidates
To perform background checks and verify references	Identity and contact information Professional information Employment eligibility information	Legitimate interest of managing recruitment and evaluating the candidates
To ensure right-to-work compliance and immigration checks	Identity and contact information Professional information Employment eligibility information	Legal obligation
To make hiring decisions	Identity and contact information Professional information Public information Employment eligibility information Employment expectations Interview information Audio and video materials Other information provided voluntarily	It is necessary for entering into or performing a contract
To prepare offer letters	Identity and contact information Professional information Public information Interview information Employment expectations Audio and video materials	It is necessary for entering into or performing a contract
To establish, exercise, or defend legal claims	Any information mentioned in Section 1 above	Legitimate interest to establish, exercise, or defend against legal claims
To analyze, report on, and improve recruitment processes	Identity and contact information Public information Professional information Interview information Employment expectations	Legitimate interest of improving hiring and recruitment activities
To protect our property and people in the office	Identity and contact information Audio and video materials	Legitimate interest of ensuring security

Notes:

Where we rely on consent (e.g., for keeping profiles on file for future roles or contacting about other positions where consent is required), consent can be withdrawn at any time without affecting prior processing.

3. How We Share Your Data

Apart from X-FLOW, your data may be accessed by others in the following situations:

Law enforcement, government agencies and other authorized recipients for legal, security, and safety purposes. When required by the applicable law, we may share your personal information with law enforcement, government agencies and other authorized recipients to comply with legal obligations, ensure security, and protect safety.
Companies involved in corporate transactions. This includes scenarios where we sell, acquire, or merge all or part of our assets. In such cases, your data may be transferred as part of the transaction.
Our service providers and partners. We may share your information with our affiliates or partner studios who may have similar job opportunities. We also use third parties to assist us in navigating the recruitment process. These service providers may include:
- Recruitment agencies. We partner with recruitment agencies to identify and evaluate potential candidates. If your candidacy is referred by an agency, we may share information about the interview process and its outcomes with them.
- Recruitment tracking system provider. We utilize a third-party recruitment tracking system to manage and organize your application efficiently.
- Professional consultants, such as lawyers and migration advisors. When necessary, we may share your information with professional consultants to ensure compliance with right-to-work regulations and conduct migration checks.

We share your personal data with these third parties only where we have a legal basis as set out above or where such third parties process data on our behalf based on a data processing agreement, which may restrict further subcontracting by such third parties.

4. International Data Transfers

We may transfer your data to countries other than your country of residence, including those outside the European Economic Area (EEA). Since data protection laws vary between countries, we take steps to ensure adequate safeguards are in place to protect your data, as explained in this Candidate Privacy Notice. Adequate safeguards that our partners may use include transfers of data to the jurisdictions considered by the European Commission to be offering an adequate level of protection for personal data of EU residents or standard contractual clauses approved by the European Commission or other methods approved by the relevant regulators in other countries.

5. DATA SUBJECT RIGHTS

If we process your personal data and you are an EU resident, or a resident of another jurisdiction that grants you the rights outlined below, you:

have the right to be informed about how we process your personal data and why (we provide this information in our Candidate Privacy Notice);
have the right to access the data we hold about you;
have the right to rectification, allowing you to request changes or corrections to your personal data or to restrict processing if it is inaccurate or incomplete;
have the right to erasure, enabling you to request the deletion of your personal data when we do not have a compelling reason to continue processing it. This may apply in certain circumstances, such as when we are legally obligated to retain the data or need it to protect and enforce our legal rights;
have the right to data portability, which allows you to receive your data in a structured, commonly used, and machine-readable format and, where technically feasible, to transmit that data to another controller;
have the right to withdraw consent at any time where you have previously given your consent to the processing of your personal data. Please note that withdrawing your consent will not affect the lawfulness of any processing we conducted before your withdrawal, nor will it impact the processing of your personal data based on lawful grounds other than consent.
have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you. Please note that we do not engage in any decision-making based solely on automated processing, including profiling;
have the right to object to or restrict how we use or process your data in certain circumstances. Please be aware that, in such cases, we may not be able to provide you with all of our services, or the quality of our services may be diminished;
have the right to lodge a complaint with a data protection supervisory authority.

To submit your request, please use the contact details in Section 8 below. However, we may still request additional information necessary for us to respond.

Please note that your request must:

provide sufficient information necessary to verify you as our candidate about whom we have collected and processed personal data or to verify you as an authorized representative of such a candidate;
contain sufficient details describing your request to allow us to understand, review and respond appropriately.

We reserve the right to ask for reasonable information to verify your identity before we process your request, and not to respond to your request or provide you with personal data if we were unable to verify your identity or authority to make such a request.

6. How We Protect Your Data

Security Safeguards

We are continuously developing and implementing administrative, technical, and physical security measures to protect the confidentiality, security and integrity of the collected data and to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the data under our control. This includes, but is not limited to, the limitation of access to personal information based on a “need-to-know” principle.

Although we use commercially reasonable efforts to ensure that your data remains secure when maintained by us, please be aware that no security measures are perfect or impenetrable.

Data retention

We keep your information only so long as we need it to fulfill the purposes described in this Candidate Privacy Notice, including to comply with applicable legal or regulatory requirements. When we no longer need to use your information and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either permanently destroy it or anonymize it so that it cannot identify you. Personal information printed on paper will be destroyed by shredding.

7. Updates

We may update our Candidate Privacy Notice from time to time. When we do so, we will revise the date at the top of this notice. Any updates to this Candidate Privacy Notice shall be effective as of the stated “Last updated”. If we make changes that are material, we will use reasonable efforts to notify you. If we make minor amendments, no notice will follow. We encourage you to check this Candidate Privacy Notice regularly for updates, so that you know our current practices.

8. Contact us

If you have questions about data protection, or if you have any requests for resolving issues with your personal data, you can contact us via email at [email protected]. You can also contact our Data Protection Officer at [email protected].