Privacy & Candidate Data

1. Who We Are

Talent Passage is a trade name of FIKA LLC, a New York limited liability company ("Talent Passage," "we," "us," or "our"). We source, vet, engage, and manage professional talent on behalf of business clients.

For the purposes of data protection law, FIKA LLC is the controller of the personal data described in this policy.

• Principal place of business: 805 Lea Avenue, Nashville, Tennessee 37203, United States
• Mailing address: PO Box 94, Coopers Plains, New York 14827, United States
• Privacy contact: support@talentpassage.com

This policy explains what personal data we collect, why we hold it, who we share it with, how long we keep it, and what rights you have. It applies to www.talentpassage.com (the "Site") and to our services.

2. If You Are a Candidate and We Contacted You

This section is for people we found and approached, rather than people who came to us. If you have received a message from us and are wondering how we got your details, this is the answer.

Where we got your information. We identify potential candidates from professional networking platforms — most often LinkedIn — and from other publicly available professional sources, professional communities, and referrals. We did not receive your information from a data broker, and we did not purchase it.

What we collected. Initially, only the professional information visible on your profile or CV: your name, professional headline, work history, skills, education, general location, and a means of contacting you.

Why we are allowed to hold it. We rely on legitimate interests (Article 6(1)(f) UK/EU GDPR) — specifically our interest in identifying professionals whose experience matches roles we are hiring for, and your interest in learning about relevant opportunities. We have weighed our interest against your privacy rights, we limit ourselves to professional information relevant to that purpose, and we stop when you ask us to. You can request details of that assessment at any time.

How long we keep it. We keep candidate information for 24 months from our last meaningful contact with you, after which we delete it or ask whether you would like to remain in our pool. If you tell us to remove you, we do so promptly regardless of that period.

What you can do about it. You can ask us to delete your information, correct it, or stop contacting you entirely, at any time, with no obligation and no need to give a reason. Email support@talentpassage.com and we will action it. You also have the fuller set of rights described in Section 10.

We know unsolicited outreach is not always welcome. If you would rather we did not hold your details, tell us and it is done.

3. Whose Data This Policy Covers

• Site visitors — anyone browsing www.talentpassage.com
• Client contacts — people at businesses that engage or enquire about our services
• Candidates — professionals we source, contact, or consider for roles, whether or not they proceed
• Placed talent — professionals we contract with and place with a client

4. What We Collect

4.1 Site visitors

Pages viewed, referring source, approximate location derived from IP address, device and browser type, and interactions with the Site. Collected through cookies and similar technologies — see Section 11. Also anything you voluntarily submit when booking a call or emailing us.

4.2 Client contacts

Name, business email, phone number, job title, company name, the details of your hiring requirements, correspondence with us, and billing and payment records.

4.3 Candidates

We collect in stages, and we collect only what the stage requires.

• At sourcing: name, professional profile, work history, skills, education, general location, contact details.
• If you engage with us: CV, portfolio or work samples, availability, salary or rate expectations, time zone, language proficiency, interview notes and skill assessment results, and references where you provide them.
• Only if you advance toward placement: home address, date of birth, a copy of a passport or national identity document, tax identification details, and bank or payment account details.

We do not request identity documents, financial details, or date of birth at the early stages of a process. If you have been asked for those, it is because you are at the contracting stage.

4.4 Placed talent

Everything in 4.3, plus contract documentation, engagement records, payment history, invoices, timesheets or availability records where applicable, and correspondence relating to the engagement.

4.5 Data we do not seek

We do not seek information about your health, race or ethnic origin, religion, political opinions, trade union membership, sexual orientation, or biometric data. Please do not include such information in a CV or message to us. If you send it to us unsolicited, we will not use it in any decision and will remove it where practical.

5. Background and Reference Checks

We conduct reference and employment verification checks in the ordinary course, with your knowledge.

We conduct criminal record checks only in limited circumstances: where a client role specifically warrants it, where the law of your country permits a check for that type of role, and where it is carried out by a provider authorized to conduct such checks in your jurisdiction. We do not screen all candidates as a matter of course.

We recognize that many jurisdictions — including EU member states under Article 10 GDPR — restrict who may process criminal conviction data and for which roles. Where a check is not permitted for a role in your country, we do not run one. Where a check is run, we retain the outcome only for as long as needed to make the placement decision, and we do not retain the underlying report.

6. Where We Get Your Data

• Directly from you — messages, CVs, calls, forms, onboarding documents
• From professional networking platforms and public professional sources — for initial candidate sourcing
• From referrals — where someone recommends you to us
• From referees — where you have provided their details
• From our clients — role requirements, feedback on candidates, engagement records
• From authorized check providers — where a check has been conducted with your knowledge
• Automatically from the Site — see Section 11

7. Why We Use Your Data, and Our Legal Basis

Where we rely on legitimate interests, you have the right to object — see Section 10. Where we rely on consent, you may withdraw it at any time, and doing so does not affect processing that already took place.

8. Who We Share Your Data With

We do not sell your personal data, and we do not share it with data brokers or list vendors.

We share it with:

Our clients. Where you are a candidate under consideration, we share your professional profile and assessment with the client hiring for that role, so they can decide whether to interview you. Clients are contractually required to keep candidate information confidential and to use it only to evaluate you for that role. Where you are placed, the client receives the information necessary to work with you.

Service providers who process data on our behalf:

• Google (Google Workspace — Gmail, Drive, Sheets) — email, file storage, and internal records
• DocuSign — contract execution and signed document storage
• Wise, Payoneer, and Deel — payment of placed talent
• Authorized background and reference check providers — where a check is conducted
• Website hosting and analytics providers — see Section 11

Each is bound by contract to process data only on our instructions and to maintain appropriate security.

Professional advisers — accountants, lawyers, and insurers, where necessary.

Authorities — where required by law, court order, or lawful request, or to establish or defend legal claims.

A successor — if our business is sold or reorganized, data may transfer as part of that transaction, subject to this policy.

9. International Transfers

We are based in the United States, our service providers are primarily based in the United States, our clients are primarily in the United States and Canada, and we source talent worldwide. Your personal data will therefore be transferred across borders, including out of the European Economic Area, the United Kingdom, and other regions with data transfer restrictions.

Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards, principally the Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum, incorporated into our agreements with our service providers. Where a provider is certified under the EU–US Data Privacy Framework, we may rely on that certification.

You may request a copy of the relevant safeguards by emailing support@talentpassage.com.

10. Your Rights

Depending on where you live, you have some or all of the following rights. We honour these requests regardless of where you are based, as a matter of practice.

• Access — a copy of the personal data we hold about you
• Correction — to have inaccurate or incomplete data fixed
• Deletion — to have your data erased, subject to records we are legally required to keep
• Objection — to object to processing based on legitimate interests, including our sourcing and outreach
• Restriction — to have processing paused while a dispute is resolved
• Portability — to receive your data in a portable format, or have it sent to another provider
• Withdraw consent — at any time, where we rely on consent
• Opt out of marketing — at any time, via the unsubscribe link or by emailing us
• Complain — to your local data protection authority

How to exercise them. Email support@talentpassage.com. We will respond within 30 days. There is no charge. We may ask you to verify your identity before we action a request, to be sure we are not disclosing your data to someone else.

If you object to our holding your candidate data, we will delete it. We do not require a reason.

Automated decision-making. We do not use artificial intelligence or automated systems to screen, rank, score, or filter candidates. Every decision about a candidate is made by a person.

Right to complain. If you are in the EEA or UK, you may complain to your national supervisory authority. In Brazil, this is the ANPD; in Colombia, the Superintendencia de Industria y Comercio. We would appreciate the chance to address your concern first, but you are not required to come to us before going to a regulator.

11. Cookies and Tracking

The Site uses cookies and similar technologies:

• Strictly necessary — required for the Site to function and to remember your privacy choices. These cannot be switched off.
• Analytics — Google Analytics. Helps us understand how visitors find and use the Site.
• Advertising — Meta Pixel. Measures the performance of our advertising and allows us to show relevant ads to people who have visited the Site.

Consent. Analytics and advertising cookies are non-essential. Where the law of your country requires consent for such cookies — including throughout the EEA and the UK — these do not load until you accept them, and you may change or withdraw your choice at any time through the cookie settings on the Site.

You can also block or delete cookies through your browser settings, and opt out of Google Analytics using Google's browser add-on. Blocking strictly necessary cookies may prevent parts of the Site from working.

12. How Long We Keep Data

Where we are required to retain records to comply with tax, accounting, or legal obligations, or to defend a legal claim, we retain only what is necessary for that purpose and nothing further.

13. Security

We restrict access to personal data to those who need it. Our systems are protected by access controls and multi-factor authentication, and data held with our providers is encrypted in transit and at rest. Identity documents and payment details are held only where required and deleted when no longer needed.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by law.

14. Marketing

We may send business marketing to client contacts and prospective clients about our services. You can unsubscribe at any time using the link in any email or by emailing support@talentpassage.com.

We do not sell or rent contact details, and we do not use candidate data for marketing purposes.

15. Notice to United States Residents

We do not sell personal information for money.

Some United States state privacy laws, including in California, treat the use of advertising cookies for cross-context behavioural advertising as "sharing." You may opt out of this at any time through the cookie settings on the Site, or by enabling a Global Privacy Control signal in your browser, which we honour.

California residents may also request access to, correction of, or deletion of personal information, and may not be discriminated against for exercising those rights. Email support@talentpassage.com.

16. Children

Our Site and services are intended for businesses and working professionals. We do not knowingly collect data from anyone under 18, and we do not place anyone under 18. If you believe we hold data about a minor, contact us and we will delete it.

17. Changes to This Policy

We may update this policy. The current version is always posted at this URL with the Last Updated date shown at the top. Where a change materially affects how we handle your personal data, we will take reasonable steps to notify you.

18. Contact Us

Questions, requests, or complaints about this policy or your data:

• FIKA LLC (operating as Talent Passage)
• Email: support@talentpassage.com
• Principal place of business: 805 Lea Avenue, Nashville, Tennessee 37203, United States
• Mailing address: PO Box 94, Coopers Plains, New York 14827, United States