Privacy Policy on Recruitment

Effective date: 15-05-2026

Data Controller: Fluido Group [https://www.fluidogroup.com/]

Data Protection Officer: Vasudev Kamath, vasudevrk@infosys.com

Write to: privacy@infosys.com.

1. Introduction

This Candidate Recruitment Privacy Notice (“Notice”) explains how the Company collects, uses, stores, shares, and protects your personal data when you apply for employment or engage with our recruitment processes. We are committed to processing your personal data lawfully, fairly, and transparently, in accordance with the EU General Data Protection Regulation (“GDPR”) and all other applicable data protection laws.

Our recruitment processes are managed through Workday, a cloud-based Human Capital Management platform. When you apply, your personal data will be processed within the Workday Recruitment Module and may be accessible to authorized personnel on a need-to-know basis. By submitting your application, you acknowledge that you have read and understood this Notice.

2. Personal Data We Collect

We collect personal data at various stages of the application process. Certain data elements are mandatory and are required for us to process your application. Other data elements are voluntary, and your decision not to provide them will not affect your candidacy. The tables below describe the personal data we collect, organized by stage of the application process.

2.1 Candidate Profile

The following personal data is collected when you create your candidate profile and submit your application:

2.2 Application — Introduction and Background

The following data is collected or processed during the introductory stage of your application:

2.3 Application — Personal Information (Equal Employment Opportunity Data)

In accordance with applicable equal employment opportunity (“EEO”) laws and regulations, the following personal data is collected on a voluntary self-identification basis. This information is used solely for EEO compliance, reporting, and monitoring purposes and is not used in the evaluation of your candidacy or in any hiring decision. Responses are maintained separately from your application and are not accessible to hiring managers or recruiters involved in the selection process.

2.4 Application — Previous Worker Verification

3. Lawful Bases for Processing

We process your personal data on the basis of one or more of the following lawful bases, as determined by the jurisdiction in which you are located and the applicable data protection law.

3.1 European Union and United Kingdom (GDPR / UK GDPR)

Under the GDPR and UK GDPR, we rely on the following lawful bases under Article 6 and, where applicable, Article 9:

Performance of a Contract or Pre-Contractual Steps (Article 6(1)(b)). The processing of your mandatory application data — including your name, email, phone number, resume/CV, and related information — is necessary in order to take steps at your request prior to entering into an employment contract. Without this data, we cannot evaluate your application or progress your candidacy.

Legitimate Interests (Article 6(1)(f)). We process certain optional and automated data on the basis of our legitimate interests, where those interests are not overridden by your fundamental rights and freedoms. Specifically:

• LinkedIn Profile. Processing a publicly available professional profile serves our legitimate interest in evaluating candidates holistically. We limit our review to information relevant to the role and do not scrape or store entire profile data beyond what is reasonably necessary for assessing your candidacy.
• Referral Employee Name. Processing the name of the referring employee serves our legitimate interest in administering and tracking the effectiveness of our employee referral program. We note that this involves processing a third party’s personal data; the referring employee is separately informed of this processing through our internal privacy notices.
• Recruiting Sources (Auto-Tagging). Automatically tagging the recruitment source through which you arrived serves our legitimate interest in measuring recruitment marketing effectiveness. This automated tagging does not produce any legal or similarly significant effects on your candidacy and does not constitute automated decision-making within the meaning of GDPR Article 22. Tagging is limited to source attribution and does not influence the evaluation of your application.
• Resume Parsing (Automated Extraction). Automatically extracting structured data from your uploaded resume/CV serves our legitimate interest in operational efficiency and improving the candidate experience by reducing manual data entry. The parsed data is presented for your review and correction within your candidate profile. Resume parsing does not involve automated decision-making that produces legal or similarly significant effects; it is a data entry facilitation tool, and all substantive hiring decisions are made by human recruiters and hiring managers.
• Visa Sponsorship Information. Processing information about your current or future visa sponsorship needs serves our legitimate interest in workforce planning and immigration compliance. This information is not used to make discriminatory decisions based on nationality, national origin, or citizenship status; it is used solely to assess the Company’s ability to meet its obligations under applicable immigration laws. We do not use visa sponsorship responses to filter candidates prior to assessing their qualifications and suitability for the role.

Consent (Article 6(1)(a)). Where we rely on your consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

3.2 Special Category and Sensitive Data (Cross-Jurisdictional)

Certain data elements collected during the application process may constitute special category data (under the GDPR and UK GDPR) or otherwise require heightened protections under applicable law. We process such data only where a specific legal exemption or authorization applies in the relevant jurisdiction.

Gender, Race/Ethnicity, Hispanic or Latino Origin, Veteran Status, and Disability Status.

• EU/UK (GDPR / UK GDPR): Processed based on Article 9(2)(b), Article 9(2)(g) — processing is necessary for the purposes of carrying out our obligations and exercising our specific rights in the field of employment and social security law, insofar as it is authorized by applicable law.

This data is collected separately from the substantive evaluation of your application, is not accessible to hiring decision-makers, and is used only in aggregate for compliance reporting and workforce diversity monitoring.

Gender Pronouns. We recognize that gender pronouns may, in certain circumstances, reveal information about an individual’s sex life or sexual orientation, which constitutes special category data under GDPR Article 9(1). Accordingly, we collect gender pronouns on an entirely voluntary basis:

• EU/UK: Processed based on GDPR Article 9 (2) (a) your explicit consent.

You are under no obligation to provide your gender pronouns, and your decision not to do so will have no effect on your application. If you do choose to share your pronouns, we will use them solely for the purpose of addressing you respectfully throughout the recruitment process. You may withdraw your consent and request deletion of this data at any time by contacting us at privacy@infosys.com.

3.3 Legal Name (as on Government ID)

The collection of your legal name at the application stage is processed on the basis of Article 6(1)(b) pre-contractual steps. However, we acknowledge that this data element is not typically required at the initial application stage and becomes necessary only at later stages such as background verification and employment contract execution. If your legal name differs from your preferred name, you are not required to provide it at the point of application; we will request it at the appropriate stage if your candidacy progresses. Where collected at the application stage, legal name data is stored securely, and access is restricted to authorized personnel who require it for identity verification or pre-employment screening purposes.

Photograph / Visual Introduction: Where Fluido invites you to submit a photograph or visual introduction, this is collected on an entirely voluntary basis. Under the GDPR, we process this data based on Article 9(2)(a) your explicit consent — recognizing that photographic images may reveal racial or ethnic origin, health conditions, or religious beliefs.

4. Automated Processing and Profiling

4.1 Resume Parsing

When you upload your resume or CV, our recruitment system may use automated tools to extract and structure information such as your name, contact details, work history, education, and skills. This automated extraction is performed solely to facilitate the population of your candidate profile and improve the efficiency of the application process. It does not constitute solely automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22. All substantive decisions regarding your candidacy — including screening, shortlisting, and selection — are made by human recruiters and hiring managers who review your complete application.

4.2 Recruiting Source Auto-Tagging

Our recruitment system may automatically identify and record the source through which you arrived at our career site (e.g., a specific job board, social media platform, or career page URL). This automated tagging is used for recruitment analytics and does not influence the evaluation of your application or any hiring decision. You will not be subject to any adverse decision on the basis of your recruitment source.

4.3 Your Rights Regarding Automated Processing

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (GDPR Article 22). If at any stage of the recruitment process you believe that a decision affecting your candidacy has been made solely by automated means without meaningful human involvement, you have the right to request human intervention, to express your point of view, and to contest the decision. To exercise this right, please contact us at [Privacy Contact Email].

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• To evaluate your qualifications, experience, skills, and suitability for the position for which you have applied and, where you consent, for other positions that may become available.
• To communicate with you regarding your application status, interview scheduling, and other recruitment-related matters.
• To verify the information you have provided, including through background checks and reference checks (at the appropriate stage of the process and with your knowledge).
• To comply with applicable legal and regulatory obligations, including equal employment opportunity reporting and immigration law requirements.
• To administer and track the effectiveness of our recruitment channels, sources, and employee referral program.
• To improve our recruitment processes and candidate experience through analytics and reporting on aggregated, non-identifying data.
• To address you respectfully and in accordance with your stated preferences (e.g., gender pronouns), where voluntarily provided.
• To assess logistical and administrative considerations such as work location, relocation, compensation alignment, and engagement model (e.g., full-time versus freelance/consulting).

6. How We Share Your Personal Data

We may share your personal data with the following categories of recipients, each of whom is bound by appropriate confidentiality and data protection obligations:

Internal Recipients. Your application data will be accessible to authorized personnel within the Company who are directly involved in the recruitment process, including recruiters, hiring managers, and members of the relevant interview panel. EEO data is accessible only to authorized HR and compliance personnel and is not shared with hiring decision-makers.

Service Providers and Data Processors. Your personal data is processed within the Workday Recruitment Module, a cloud-based platform operated by Workday, Inc. as a data processor on behalf of the Company. A Data Processing Agreement has been executed with Workday governing its obligations with respect to your personal data. Your data may also be shared with other service providers engaged by the Company to support the recruitment process, such as background check providers, assessment or psychometric testing providers, and recruitment agencies, each under appropriate data processing agreements.

Legal and Regulatory Authorities. We may disclose your personal data to governmental or regulatory authorities where required to comply with applicable laws, regulations, or legal proceedings, including EEO reporting obligations.

Group Entities. Where the Company is part of a group of affiliated entities, your personal data may be shared with affiliates for the purposes of centralized recruitment administration, subject to appropriate data sharing agreements.

We do not sell your personal data to third parties. We do not share your personal data with third parties for their own direct marketing purposes.

7. International Data Transfers

Your personal data may be transferred to, stored in, or accessed from countries outside the European Economic Area (“EEA”), the United Kingdom, or Switzerland, including the United States, and also India where parent entity operates. Where such transfers occur, we ensure that appropriate safeguards are in place, including:

• Adequacy Decisions adopted by the European Commission under GDPR Article 45.
• Standard Contractual Clauses (“SCCs”) approved by the European Commission under GDPR Article 46(2)(c).
• Binding Corporate Rules approved by the competent supervisory authority as part of intra-group entities.

You may request a copy of the applicable transfer mechanism by contacting us at privacy@infosys.com.

8. Data Retention

We retain your personal data for the following periods:

Successful Candidates. If you are offered and accept employment with the Company, your recruitment data will be transferred to your employee personnel file and retained in accordance with our Employee Privacy Notice and applicable retention policies.

Unsuccessful Candidates. If your application is unsuccessful, we will retain your personal data for a period of [insert period — typically six months to two years, depending on jurisdiction] following the conclusion of the recruitment process, in order to defend against potential legal claims, to comply with applicable legal obligations, and to contact you about future opportunities (where you have consented to this). After the expiration of this retention period, your personal data will be securely deleted or anonymized.

Talent Pool. Where you have provided your consent, we may retain your personal data in our talent pool for the purpose of contacting you about future job opportunities. You may withdraw your consent and request removal from the talent pool at any time.

9. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Right of Access — to request a copy of the personal data we hold about you.
• Right to Rectification — to request correction of inaccurate or incomplete personal data.
• Right to Erasure — to request deletion of your personal data where processing is no longer necessary or where you withdraw consent.
• Right to Restriction of Processing — to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability — to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object — to object to the processing of your personal data on grounds relating to your situation, where processing is based on legitimate interests.
• Right Not to Be Subject to Automated Decision-Making — to not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Right to Withdraw Consent — where processing is based on consent, to withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint — to lodge a complaint with your local data protection supervisory authority.

To exercise any of your rights, please contact us at privacy@infosys.com. We will respond to your request within the timeframe required by applicable law.

10. Security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, role-based access controls, multi-factor authentication, and regular security assessments. Your personal data is processed within the Workday Recruitment Module, which maintains SOC 2 Type II certification, ISO 27001 certification, and other industry-recognized security standards.

11. Changes to This Notice

We may update this Notice from time to time to reflect changes in our recruitment practices, applicable laws, or the technology we use. Where material changes are made, we will notify you by posting the updated Notice on our career site and updating the effective date. We encourage you to review this Notice periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Notice or the If you have any questions, concerns, or requests regarding this Notice or our processing of your personal information, please contact us at: privacy@infosys.com

Data Protection Officer: Vasudev Kamath, vasudevrk@infosys.com

You also have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

United Kingdom: Information Commissioner’s Office (ICO) Website: https://ico.org.uk/ Complaints information: https://ico.org.uk/make-a-complaint/

Annexure – List of Data Controllers

Privacy Notice — HR Workday Recruitment Portal (Account Opening)

1. Introduction

This Privacy Notice (“Notice”) describes how Group Infosys entities, more fully covered in Annexure A (“Company,” “we,” “us,” or “our”) collects, uses, stores, discloses, and otherwise processes the personal information of individuals (“you” or “your”) who create candidate accounts on our Workday-powered recruitment portal (the “Portal”) for the purpose of registering and applying for job opportunities. This Notice applies to all individuals who open an account on the Portal, regardless of geographic location, including individuals located in the European Union and European Economic Area (“EU/EEA”), the United States (“US”), Australia, the Philippines, Canada and New Zealand.

We are committed to protecting your privacy and handling your personal information in accordance with applicable data protection and privacy laws. By creating an account on the Portal, you acknowledge that you have read and understood this Notice. Where required by applicable law, we will obtain your consent before processing your personal information.

2. Data Controller and Contact Information

For the purposes of applicable data protection legislation, the data controller responsible for your personal information collected during account opening is:

Legal Entities, under Group Infosys, click here.

If you have questions or concerns about this Notice or our data practices, or if you wish to exercise any of your rights as described below, please contact our Data Protection Officer or Privacy Team at the details provided above.

Data Protection Officer (where applicable): Vasudev Kamath Email: vasudevrk@infosys.com.

Write to: privacy@infosys.com.

3. Scope of This Notice

This Notice applies solely to the personal information collected through the Portal in connection with the account opening process, including the creation of your candidate account and the submission of the information necessary to register and apply for jobs. This Notice does not cover subsequent stages of the recruitment process (such as interviews, assessments, or onboarding), the personal information of employees or contractors, or personal information collected through other Company websites, platforms, or services unless expressly stated.

4. Categories of Personal Information We Collect

In the course of operating the Portal and processing your account registration, we may collect and process the following categories of personal information:

Identity and Contact Information. This includes your full name, email address, telephone number, mailing address, date of birth, and any usernames or account credentials you create when registering on the Portal.

Professional and Employment Information. This includes your resume or curriculum vitae, cover letters, employment history, job titles, professional qualifications, certifications, licenses, skills, languages spoken, and details of your education and training, as submitted during the account opening and application process.

Demographic and Diversity Information. Where permitted or required by applicable law and provided on a voluntary basis during account creation, this may include information relating to gender, race, ethnicity, disability status, veteran status, or other diversity-related data collected solely for equal opportunity monitoring and compliance purposes.

Technical and Usage Data. This includes your IP address, browser type, device identifiers, operating system, login timestamps, session duration, pages visited within the Portal, and other data automatically collected through cookies and similar tracking technologies during the account opening process.

5. How We Collect Personal Information

We collect personal information through the following means:

Directly from You. We collect information that you voluntarily provide when you create an account on Portal, complete your candidate profile, upload your resume, and submit a job application.

From Third-Party Platforms. Where you choose to link a professional networking profile (such as LinkedIn) or import information from another platform during account registration, we may receive personal information from that source.

Automatically Through the Portal. When you access the Portal to create your account, we automatically collect certain technical and usage data through cookies, web beacons, and similar technologies, as further described in Section 11 of this Notice.

6. Purposes of Processing

We process your personal information collected during account opening for the following purposes:

Account Creation and Management. To create and manage your candidate account on the Portal, authenticate your identity, and enable you to save your profile and submit job applications.

Job Application Submission. To enable you to apply for available positions through the Portal and to confirm receipt of your application.

Compliance and Legal Obligations. To comply with applicable legal and regulatory requirements, including equal opportunity and anti-discrimination laws and lawful requests from regulatory authorities or law enforcement.

Portal Improvement. To improve the functionality and user experience of the account registration process.

Transparency and User Confirmation. To maintain a transparent record of your interactions with Portal during account opening, including time-stamped logs of actions taken and confirmations provided, so that you may verify your activity and the information you submitted.

Security and Fraud Prevention. To protect the integrity of the Portal, detect and prevent unauthorized access, fraud, or other malicious activity, and to enforce our terms of use.

7. Legal Bases for Processing

The legal bases upon which we rely for processing your personal information collected during account opening vary depending on your jurisdiction and the specific processing activity, as set forth below.

EU/EEA Candidates. Under the General Data Protection Regulation (“GDPR”), we process your personal information on the following legal bases: (a) your consent, where you have provided it (for example, for diversity monitoring data or the use of non-essential cookies); (b) the performance of pre-contractual steps taken at your request in connection with a potential employment relationship; (c) compliance with a legal obligation to which we are subject; and (d) our legitimate interests in providing an accessible and secure account registration process, provided such interests are not overridden by your fundamental rights and freedoms.

US Candidates. In the United States, there is no single comprehensive federal privacy law governing recruitment data; however, we process your personal information in accordance with applicable federal and state laws, including but not limited to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), and similar state-level privacy statutes. Where required by applicable state law, we will provide additional disclosures and obtain your consent before processing certain categories of personal information.

Australian Candidates. Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), we collect, use, and disclose your personal information only for purposes that are reasonably necessary for or directly related to the recruitment process. We will seek your consent before collecting sensitive information unless an exception under the APPs applies.

Philippine Candidates. Under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, we process your personal information based on one or more of the following criteria: your consent, the fulfillment of a contract or pre-contractual obligations, compliance with a legal obligation, the protection of your vital interests, or the pursuit of our legitimate interests. We will obtain your consent before processing sensitive personal information, as defined under Philippine law.

New Zealand Candidates. Under the Privacy Act 2020, we collect, use, and disclose your personal information in compliance with the Information Privacy Principles (“IPPs”). We collect personal information directly from you where reasonably practicable, use it only for the purpose for which it was collected or a directly related purpose, and take reasonable steps to ensure it is accurate and secure.

Canadian Candidates. For candidates located in Canada, we process personal information in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, substantially similar provincial privacy laws, including privacy laws in Alberta, British Columbia, and Quebec. We collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, including account creation, candidate profile management, job application submission, recruitment administration, legal compliance, security, and portal improvement. Where required, we obtain meaningful consent for the collection, use, or disclosure of personal information, and we seek express consent before collecting, using, or disclosing sensitive personal information unless permitted or required by law.

8. Sharing and Disclosure of Personal Information

We may share or disclose your personal information to the following categories of recipients:

Affiliated Entities. We may share your personal information with our parent company, subsidiaries, and affiliates for internal administrative purposes and to facilitate recruitment across the organization, including where a role is based in a different jurisdiction from where you reside.

Service Providers and Processors. We engage third-party service providers who process personal information on our behalf to support the account registration process. This includes Workday, Inc. (as our recruitment platform provider), cloud hosting and IT service providers, and communication platforms. These service providers are contractually bound to process your personal information only in accordance with our instructions and applicable data protection laws.

Professional Advisors. We may disclose your personal information to our legal, tax, accounting, or other professional advisors where necessary for the provision of their services to us.

Regulatory Authorities and Law Enforcement. We may disclose your personal information to governmental or regulatory authorities, courts, tribunals, or law enforcement agencies where required by applicable law, regulation, or legal process, or where we believe in good faith that disclosure is necessary to protect our legal rights, investigate suspected fraud, or comply with a judicial or administrative order.

With Your Consent. We may share your personal information with other third parties where you have given your explicit consent to such disclosure.

We do not sell your personal information to third parties. For the purposes of the CCPA/CPRA, we do not “sell” or “share” (as those terms are defined under California law) the personal information of job applicants.

9. International Data Transfers

Because we operate across multiple jurisdictions, your personal information may be transferred to and processed in countries other than the country in which you reside. In particular, personal information may be transferred between the EU/EEA, the United States, Australia, the Philippines, and New Zealand, as well as any other jurisdiction in which we or our service providers maintain operations.

EU/EEA Transfers. Where personal information is transferred from the EU/EEA to a country that has not been deemed to provide an adequate level of data protection by the European Commission, we implement appropriate safeguards to protect your personal information, including Standard Contractual Clauses (“SCCs”) approved by the European Commission, Binding Corporate Rules, or other legally recognized transfer mechanisms. You may request a copy of the relevant safeguards by contacting us at the details set out in Section 2.

Australian Transfers. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles your personal information in accordance with the APPs or that you have consented to the transfer.

Philippine Transfers. Cross-border transfers of personal information from the Philippines are conducted in compliance with the requirements of the Data Privacy Act of 2012 and the guidelines issued by the National Privacy Commission.

New Zealand Transfers. Where personal information is transferred outside New Zealand, we ensure that the recipient is subject to comparable privacy protections or that another exception under the Privacy Act 2020 applies.

Canadian Transfers. Where personal information of Canadian candidates is transferred to or processed by affiliates, service providers, or other recipients outside Canada, we remain accountable for that information and use contractual, technical, and organizational safeguards designed to provide a comparable level of protection. Your personal information may be subject to the laws of the country in which it is processed, including lawful access requests by courts, law enforcement, or governmental authorities.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy applicable legal, regulatory, accounting, or reporting requirements. Our general retention practices for account data are as follows:

Active Accounts. Your personal information will be retained for as long as your candidate account remains active on the Portal.

Inactive Accounts. If your account is inactive for a period of [insert period, e.g., 12 months / 24 months], we may delete or anonymize your personal information, unless a longer retention period is required by law or you have consented to the retention of your information for consideration for future opportunities.

Upon the expiry of the applicable retention period, we will securely delete or anonymize your personal information in accordance with our data retention and destruction policies, unless further retention is required by law.

11. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to the personal information collected during account opening:

Right of Access. You have the right to request confirmation of whether we process your personal information and, if so, to obtain a copy of such information.

Right to Rectification. You have the right to request the correction of inaccurate personal information and the completion of incomplete personal information. You may also update certain information directly through your Portal account.

Right to Erasure (Right to Be Forgotten). You have the right to request the deletion of your personal information in certain circumstances, such as where the information is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing. You have the right to request that we restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of the information or object to processing based on legitimate interests.

Right to Data Portability. Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another controller.

Right to Object. You have the right to object to the processing of your personal information where such processing is based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Withdraw Consent. Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

Right to Account Deletion. You may request the deletion of your candidate account and all associated personal information at any time by contacting us or using the account settings within the Portal.

Rights Under US State Laws. If you are a resident of California or another US state with applicable consumer privacy legislation, you may have additional rights, including the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information (though we do not sell or share personal information), and the right to non-discrimination for exercising your privacy rights.

Rights Under Philippine Law. Under the Data Privacy Act of 2012, you have the right to be informed, the right to access, the right to object, the right to erasure or block, the right to rectification, the right to damages, and the right to file a complaint with the National Privacy Commission.

Rights Under New Zealand Law. Under the Privacy Act 2020, you have the right to access your personal information, the right to request correction of your personal information, and the right to make a complaint to the Office of the Privacy Commissioner.

Rights Under Canadian Law. If you are located in Canada, you may have the right to request access to personal information we hold about you, to request correction of inaccurate or incomplete personal information, to withdraw consent where processing is based on consent, and to challenge our compliance with applicable privacy obligations. We will respond to access and correction requests within the timeframes required by applicable law and may require information to verify your identity before processing your request.

To exercise any of your rights, please contact us using the details provided in Section 2. We will respond to your request within the timeframes required by applicable law. We may need to verify your identity before processing your request.

11. Cookies and Tracking Technologies

The Portal uses cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and support the functionality of the platform. The types of cookies used on the Portal include:

Strictly Necessary Cookies. These cookies are essential for the operation of the Portal and enable core functionality such as account login, session management, and security features. These cookies cannot be disabled.

Performance and Analytics Cookies. These cookies collect aggregated information about how users interact with the Portal, including pages visited, time spent on pages, and error messages encountered. We use this information to improve the Portal and the recruitment experience.

Functional Cookies. These cookies enable enhanced functionality and personalization, such as remembering your preferences and pre-filling form fields.

For EU/EEA users, non-essential cookies will only be placed on your device with your prior consent, which you may provide or withdraw through the cookie consent mechanism displayed upon your first visit to the Portal. For users in other jurisdictions, we comply with applicable local requirements regarding cookie consent and disclosure.

For Canadian users, we provide clear information about cookies and similar technologies used on the Portal and, where required by applicable law, obtain meaningful consent before using non-essential cookies or similar tracking technologies.

12. Data Security

We implement appropriate technical and organizational security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to, encryption of data in transit and at rest, access controls and authentication mechanisms, regular security assessments and vulnerability testing, employee training on data protection and information security, and incident response and breach notification procedures.

While we take reasonable steps to protect your personal information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal information.

13. Children’s Privacy

The Portal is not intended for use by individuals under the age of 16 (or such other age as may be specified by applicable local law). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take reasonable steps to delete such information promptly.

14. Changes to This Notice

We may update this Notice from time to time to reflect changes in our data practices, applicable laws, or regulatory requirements. When we make material changes to this Notice, we will notify you by posting the updated Notice on the Portal with a revised “Last Updated” date and, where required by applicable law, by providing you with direct notice (such as by email or an in-Portal notification). We encourage you to review this Notice periodically to stay informed about how we protect your personal information.

15. Complaints

If you are dissatisfied with how we handle your personal information or believe that your privacy rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction:

EU/EEA: You may lodge a complaint with the data protection supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

Australia: You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Philippines: You may lodge a complaint with the National Privacy Commission (NPC) at www.privacy.gov.ph.

New Zealand: You may lodge a complaint with the Office of the Privacy Commissioner at www.privacy.org.nz.

United States: You may contact the relevant state attorney general’s office or, where applicable, the agency responsible for enforcing applicable state privacy laws.

Canada: You may lodge a complaint with the Office of the Privacy Commissioner of Canada or, where applicable, with the relevant provincial privacy commissioner or authority in your province.

We encourage you to contact us first so that we may attempt to resolve your concern directly.

16. Contact Us

If you have any questions, concerns, or requests regarding this Notice or our processing of your personal information, please contact us at: privacy@infosys.com

Data Protection Officer: Vasudev Kamath, vasudevrk@infosys.com

Annexure A

List of Legal Entities