[Last updated: (on January 20, 2023)]

OUR APPROACH TO PRIVACY

CENTIFIC GLOBAL SOLUTIONS, Inc. and its affiliates ("CENTIFIC" "we," "our," or "us") are committed to protecting your privacy. This privacy policy sets out how we collect, store, process, transfer, share, and use data that identifies or is associated with you ("personal information") and information regarding our use of cookies and similar technologies.

CENTIFIC operates a platform ("OneForma") used to recruit crowd resources globally to support hosted projects, process work for different projects, and track resources working hours; users can register via our websites under the https://www.oneforma.com domain (our "Website") and browse, apply for published job opportunities, and take tasks from the online interface. ("Service").

This privacy policy applies to OneForma and all the tools that are part of it. Terms used in this privacy policy have the same meaning as in our Terms and Conditions, unless otherwise defined in this privacy policy.

Before accessing or using OneForma, please ensure that you have read and understood our collection, storage, use, and disclosure of your Personal Information as described in this privacy policy.

CENTIFIC is the data controller of the Personal Information we hold about you. You can reach out to CENTIFIC at the address: 14980 NE 31st Way, Suite 100, Redmond, WA, U.S. 98052; contact email: data_protection@centific.com; phone: 1.425.233.8578.

PERSONAL INFORMATION WE COLLECT ABOUT YOU AND HOW WE USE IT

We collect Personal Information about you when you voluntarily submit information directly to us when using OneForma. This can include information you provide to us when you register for an account; fill in a form on OneForma; create or edit your profile on OneForma; correspond with us via the Website, phone, e-mail, or otherwise; subscribe to our mailing lists, newsletters, or other forms of marketing communications; respond to surveys; or use some other feature of OneForma as available from time to time.

If you choose not to provide Personal Information, we may not be able to provide certain services to you or respond to your requests.

The table at Annex 1 sets out the categories of Personal Information we collect about you and how we use that information. The table also lists the legal basis on which we rely to process the Personal Information, the categories of recipients of the Personal Information, and information as to how we determine applicable retention periods.

We also automatically collect Personal Information about you indirectly about how you access and use OneForma and information about the device you use to access OneForma.

The table at Annex 2 sets out the categories of Personal Information we collect about you automatically and how we use that information. The table also lists the legal basis which we rely on to process the Personal Information, the categories of recipients of the Personal Information, and information as to how we determine applicable retention periods.

SECURITY AND TRANSFERRING YOUR PERSONAL INFORMATION

Security

We implement appropriate technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, change, or damage. All Personal Information we collect will be stored on secure servers. All electronic transactions entered into via our Website will be protected by SSL encryption technology. While we use these precautions to safeguard your Personal Information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

International Transfers of your Personal Information

The Personal Information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations. We will only disclose the Personal Information to third-party service providers who perform services on behalf of us in accordance with applicable data protection laws and on the basis that they are bound by contractual obligation to use it only for the specific business purposes for which we disclose it to them, to comply with applicable data protection obligations, and to provide a same or higher level of privacy protection on the Personal Information.

If you are located in the European Union ("EU"), your Personal Information will be processed outside of the EU; these international transfers of your Personal Information are made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission. If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of this privacy policy.

We will take reasonable steps to ensure that your Personal Information is treated securely and in accordance with applicable law and this privacy policy.

YOUR RIGHTS IN RESPECT OF YOUR PERSONAL INFORMATION

If you are located in the EU, in accordance with applicable privacy law, you have the following rights in respect of the Personal Information that we hold:

Right of access. TThe right to obtain access to your Personal Information.
Right to rectification. The right to obtain rectification of your Personal Information without undue delay where that Personal Information is inaccurate or incomplete.
Right to erasure. The right to obtain the erasure of your Personal Information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed.
Right to restriction. The right to obtain the restriction of the processing undertaken by us on your Personal Information in certain circumstances, such as where the accuracy of the Personal Information is contested by you, for a period enabling us to verify the accuracy of that Personal Information.
Right to Data Portability. You have the right to receive personal data concerning you in a structured, common, and machine-readable format or request transmission of the data to a third party, if the conditions in Article 20 of the GDPR are met.
Right to Object. You have the right to object to the processing of your personal data based on our legitimate interests at any time. We will no longer process the data, unless there are compelling legitimate grounds for our processing that override the interests, rights, and freedoms of the data subject, or the processing serves the purpose of asserting, exercising, or defending legal claims. You also have the right to object at any time to the use of your data for direct marketing.
Right to Withdraw Consent. If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time.

If you wish to exercise one of these rights, please contact us using the contact details at the end of this privacy policy (“Contact Us”). You may also review and edit the Personal Information you have submitted to us by logging into your account on OneForma.

You also have the right to lodge a complaint to the Supervisory Authority in your jurisdiction.

SUPPLEMENTAL PRIVACY NOTICE FOR CALIFORNIA AND NEVADA RESIDENTS

California law requires us to disclose information regarding the categories of personal information that we have collected about California consumers (as that term is defined in the California Consumer Privacy Act ("CCPA")), the categories of sources from which the information was collected, the business or commercial purposes (as those terms are defined by applicable law) for which the information was collected, and the categories of parties with whom we share personal information.

We may collect Personal Information for the following business or commercial purposes (as those terms are defined in applicable law):

Provide, maintain, analyze, and improve our website;
Communicate with you for a range of reasons (including providing information we think will be of interest to you, conducting surveys, and responding to your comments, questions, and requests);
Detect, prevent, and respond to fraud, abuse, and security issues;
Audit consumer interactions on our site (e.g., measuring ad impressions);
Bug detection, error reporting, and activities to maintain the quality or safety of our Service;
Investigate compliance with, enforcing, and/or complying with the law;
Short-term, transient use, such as customizing content that we or our service providers display on the Service;
Improving our existing Service and developing new services (e.g., by conducting research to develop new products or features); and
Carry out any other purpose described to you at the time the information was collected.

We may aggregate or de-identify information such that it is no longer linked to you or your device. This notice does not limit our ability to use or disclose aggregated or de-identified information that is not linked to you. Please refer to the tables in Annex 1 and Annex 2 for details about the categories of Personal Information we may collect and the categories of parties with whom we may share your information.

If you are a California resident, you are provided with the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Access and Data Portability: You have the right to request us to disclose to you (1) the categories of Personal Information that is collected, sold, or shared; (2) the categories of sources from which the Personal Information is collected; (3) the business or commercial purpose for collecting, selling, or sharing your Personal Information; and/or (4) the categories of third parties to who we share, disclose, or sell your Personal Information.
Right to Access and Data Portability: You have the right to request us to disclose to you (1) the categories of Personal Information that is collected, sold, or shared; (2) the categories of sources from which the Personal Information is collected; (3) the business or commercial purpose for collecting, selling, or sharing your Personal Information; and/or (4) the categories of third parties to who we share, disclose, or sell your Personal Information.
Right to Correct: : You have the right to have your Personal Information corrected if it is inaccurate or incomplete.
Right to Delete: You have the right to have your Personal Information deleted, subject to certain exceptions.
Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to direct us to límit our use of your Sensitive Personal Information to that use which is necessary to perform the Services.
Right to Object to Treatment: You have the right to object to a certain type of treatment (for example, where the treatment is based on our legitimate interests)
Right to be free from Discrimination and Retaliation: You have the right to be free from discrimination and retaliation imposed by us due to your exercise of any of the CCPA and CPRA rights.

To exercise your CCPA and CPRA rights, please submit your request by using the contact details at the end of this privacy policy (“Contact Us”).

Once we receive your request to delete, correct or access your Personal Information, we may verify it by requesting information sufficient to confirm your identity. If you would like to use an authorized agent registered with the California Secretary of State to exercise your rights, we may request evidence that you have provided the such agent with power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. We will respond to your request within 45 days of receiving a verifiable request from you or provide you with a notice of extension of the response period during this 45-day period. In the event of a notice of extension of the response period, the response period will be extended for an additional 45 days when reasonably necessary. We reserve the right to deny requests in certain circumstances permitted by applicable laws.

We will not discriminate or retaliate against you for exercising your CCPA and CPRA rights.

If you are a Nevada resident, you may opt out of the sale of “Personally Identifiable Information” for monetary consideration to a person for that person to license or sell such information to additional persons. “Personally Identifiable Information” includes first and last name, address, email address, phone number, Social Security Number, or an identifier that allows a specific person to be contacted either physically or online.

We do not engage in such activity. However, if you are a Nevada resident who registers or use OneForma or has performed Services for us, you may submit a request to opt out of any potential future sales under Nevada law by using the contact details at the end of this privacy policy. Please note that we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

COOKIES AND SIMILAR TECHNOLOGIES

Our Website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our Website.

You can read our cookie policy here.

LINKS TO THIRD-PARTY SITES

Our Website may, from time to time, contain links to and from third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

OUR POLICY TOWARDS CHILDREN

Our Service is not directed at persons under 18 and we do not knowingly collect Personal Information from children. If you become aware that your child has provided us with Personal Information without your consent, then please contact us using the details below so that we can take steps to remove such information.

Transfer of Information to the U.S. and Other Countries

CENTIFIC is a global company with affiliated compnaies across the world. As such, your Personal Information may be trasferred to our affiliated companies in other countries. We may also transfer your personal information to our third party service providers, who may be located in a different country to you. We transfer information in order to operate efficiently, to improve performance, and to create redundancies in order to protect information in the event of an outage or other problem. We will process your personal information in a way that meets the commitments of this Privacy Policy and complies with the law wherever we transfer it. Whenever CENTIFIC transfers personal information beyond the country of origin, we will do so in accordance with applicable laws.

CHANGES TO THIS POLICY

We may update this privacy policy from time to time and so you should review this page periodically. When we change this privacy policy in a material way, we will update the "last modified" date at the end of this privacy policy. Changes to this privacy policy are effective when they are posted on this page.

CONTACTING US

Questions, comments, and requests regarding this privacy policy are welcome and should be addressed to the Data Protection Officer at: dataprotection@centific.com.

This privacy policy was last modified on 26/05/2022.

ANNEX 1 – PERSONAL INFORMATION WE COLLECT

Processing activity	Category of personal Information	How we use it (purpose of the processing)	Legal basis for the processing	Categories of recipients	Retention period
Register and manage the relation with the user through OneForma	Contact, identification and personal characteristics data (such as name, email, country of residence, native Language, phone number).	. For registration and to operate and provide you the features and functionality of OneForma; . To communicate with you to deal with queries made by you and, where you have subscribed, to send you relevant updates regarding work opportunities and other necessary communications.	Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;	. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our Website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business.	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods. Data may be kept for no longer than 5 years after contract termination according to applicable laws.
Payment	Economic and tax data (such as bank name and account number or PayPal account and related information)	. Payment for the provision of resources via OneForma . Prevent fraud	. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; . Processing is necessary for the purposes of the legitimate interests pursued by the controller	. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our Website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business.	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods. Data may be kept for no longer than 10 years after contract termination according to applicable laws.
Correspondence and comments	Contact and identification data (such as name, email, phone number)	Address your questions, issues, and concerns and to deal with queries made by you, and to improve OneForma where you have provided feedback.	. The data subject has given consent (unequivocal consent) to the processing of his or her personal data for one or more specific purposes	. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our Website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business.	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods. Data may be kept for no longer than 5 years after contract termination according to applicable laws.
Profiling	Contact, identification and personal characteristics data. Education and professional data (such as (i) basic details (such as gender, nationality, alternative email address and phone number, PO box details); (ii) language skills; (iii) completed tests; (iv) education and work experience (such as your CV and weekly availability); and (v) technical skills and setup (such as typing speed, operating system used).	Operate and provide you the features and functionality of OneForma.		. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our Website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business.	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods. Data may be kept for no longer than 5 years after contract termination, according to applicable laws.
Location	General information about your location, including IP address	Operate and provide you targeted job advertisement and the functionality of OneForma.		. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our Website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business.	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods. Data may be kept for no longer than 5 years after contract termination, according to applicable laws.
Commercial communications	Contact and identification data (such as name, email, phone number)	Send you commercial information of your interest related to similar or new services from our company.	. The data subject has given consent to the processing of his or her personal data for one or more specific purposes . Processing is necessary for the purposes of the legitimate interests pursued by the controller	. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business.	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods. Data may be kept for no longer than 1 year, according to applicable laws. Or until the user withdraws consent.

ANNEX 2 – PERSONAL INFORMATION COLLECTED AUTOMATICALLY

Processing activity	Category of personal data	How we use it (purpose of the processing)	Legal basis for the processing	Categories of recipients	Retention period
Web acess and user navigation and device	Information about website from which you came and the website to which you are going when you leave our Website, how frequently you access our Website, the time you access our Website and how long you use it for, whether you open emails or click the links contained in emails, whether you access the Website from multiple devices, and other actions you take on the Website. Information about the device you use to access our Website	Present our Website to you on your device and to monitor and improve our Website.	The data subject has given consent to the processing of his or her personal data for one or more specific purposes	. Law enforcement, regulators, and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our Terms of Website or to protect the security or integrity of our Website; and/or (c) exercise or protect the rights, property, or personal safety of CENTIFIC, our customers, or others. . Purchasers and third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business	For no longer than necessary for the purposes set out and in accordance with our legal obligations, legitimate business interests and our table of retention periods and our cookie policy.

You can read our our table of retention period below

Table of retention periods (ES)

Processing activities	Type of document	Retention Period	Applicable legislation
Clients	Invoices	10/15 years	Criminal Law, Crimminal Law
	Forms	15 years	Consultant recomendation
	Contracts	5/10/15 years	Civil Law, Criminal Law
Human Resources	Payroll	5/6/10 years	Laboral Law, Commercial Law, Criminal Law
	CV	2 years (previous consent)	Consultant recommendation
	Compensations	5 years	Labor Law
	Contracts	5 years	Labor Law
	Temporary workers	5 years	Labor Law
	Employee file	5 years after end of relation	Consultant recomendation
Marketing	Data Base	1 year	Consultant recomendation
Marketing	Website visitors	1 year	Consultant recomendation
Vendors	Invoices	10 years	Criminal Law, Commercial Law
Vendors	Contracts	5 years	Civil Law
Finances	Accounting documentation	6 years	Commercial Law
	Company documentation	6 years	Commercial Law
	Finances, Audit	6 years	Commercial Law
Tax	Tax	10 years	Tax Law, Criminal Law

	Payments	10 years	Tax Law
Security & Health	Health register	5 years	Security and Health regulation
Insurances	Insurances	6 years	Commercial Law, Civil Law.
Legal	IP	5 years	IP Law, Copyright Law
	Agreements	5 years	Civil Law
	Licences	5 years	Commercial Law
	NDA	Agreement (3 years)	Consultant recomendation
GDPR	International data transfers	3 years	Data Protection Law
GDPR	Rights of data subjects	3 years	Data Protection Law