Privacy Notice

1.    Purpose

Encora Digital LLC and its affiliates (“Encora,” the “Company” or “we”) believe that the responsible use of Personal Data is critical to our business objectives and reputation. This Privacy Notice (the “Privacy Notice” or “Notice”) explains the different ways in which we collect, use and share Personal Data. The extent and type of information we receive from you depends on the information you provide to us voluntarily. The purpose of this Notice is to ensure that all individuals whose Personal Data is collected by Encora are well informed about how and why Encora collects Personal Data and what rights are available to them, including under the General Data Protection Regulation (“GDPR”), California Consumer Privacy Act (“CCPA”) and any other applicable data protection legislation and regulations.

2.    Scope

This Notice is intended to provide website users, social media users, customers, job applicants, business partners/ vendors and other service providers with information on how Encora collects, protects and uses Personal Data.

IF YOU DO NOT AGREE WITH THE TERMS IN THIS PRIVACY POLICY, DO NOT USE THE SERVICES AND SITES OF ENCORA. CONTINUED USE OF THE SERVICES AND SITES OF ENCORA CONSTITUTES YOUR FREELY GIVEN, SPECIFIC AND INFORMED CONSENT AND AGREEMENT TO YOUR PERSONAL DATA BEING PROCESSED PURSUANT TO THIS NOTICE.

3.    Definitions

“Data Subject” means an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Personal Data” and “Personal Information” means any information relating to an individual that can be used to identify that individual either on its own or in combination with other readily available data.

“Pixels” mean small, graphic images on web pages, web-based documents or in email messages that allow us or third parties to monitor who is visiting our Sites (or other third-party sites) or if an email has been read.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of Encora.

“We”, “our” and “us” in this Privacy Notice refers to Encora Digital LLC, its affiliates and any sub-processor or contractor delivering the services and products herein on behalf of Encora and its affiliates.

“You” means the individual to whom any given Personal Data covered by this Privacy Policy relates.

4.    Collection of Personal Data

Information you actively submit

We collect Personal Data when you voluntarily provide it to us. Personal Data we collect may include contact information, such as your name, address, email address or telephone number, professional information. We may also collect information you choose to provide to us when requesting information. In the ordinary course of our business, we do not collect or otherwise process Personal Data about race, religion, sexual orientation, health or any other information that is deemed to be sensitive. Where sensitive personal data is being collected by Encora, it is your choice whether to provide such data or not without any consequence thereof except for any derogations under applicable privacy laws.

Personal Data from other sources

Personal Data may be collected either electronically or physically, including but not limited to, emails, cold calls, resumes, social media networking sites, subscription to databases, prospective candidate search engines and online identifiers, sales events, as well as offline events and information provided offline to one of Encora’s representatives.

Data we collect automatically

When you visit our sites, we automatically collect general technical user data, including but not limited to, your device’s Internet Protocol (IP) address, operating system and browser type, your location and the date and time of your visit, all which may be automatically collected through the use of “cookies”, as described below.

Combination & synchronization

We may combine and synchronize information that your device transmits, information that you actively submit and information that we obtain from third-party sources (including web publishers, advertisers, data brokers and online service providers that may have obtained information from you or your devices via cookies, pixels and other tracking technologies for the purpose of analytics and ecommerce).

Information tracking technologies

A technology called cookies may be used to provide you with tailored information. A cookie is a tiny element of data that a website can send to your browser, which may then be stored on your hard drive, so we can recognize you when you return.

If you prefer to not receive cookies while browsing the website, you can set your browser to warn you before accepting them and refuse the cookie(s) when your browser warns you, or you can set your browser to refuse all cookies from the website (or certain parts of the website) and/or you can delete cookies received from the website using your browser, for instance. Cookie handling instructions vary depending on the particular browser being used, and Encora does not assume responsibility for any undesired results arising from altering your browser's cookie handling settings.

We may use, and allow third parties to use, pixels (sometimes called web beacons) on our Sites (or other third-party sites). Pixel and/or cookie data may be linked to other data that we or third parties have about you. For more information on the categories and types of cookies used by Encora’s website, please refer our Cookie Disclosure Policy: https://www.encora.com/cookie-disclosure-policy.

Business information

We collect Personal Data of our employees, applicants and candidates, business partners, suppliers and vendors, which includes but is not limited to, contact names, addresses, phone numbers and email addresses for the administration of our business relationships. If you feel that your Personal Data is being collected inappropriately, please notify us at privacy@encora.com.

5.    Purpose & use of collected Personal Data

Personal Data we collect and use will depend on the Personal Information concerned, the specific context in which we collect it and the purpose for which it is used. In general, Encora uses the data collected for the purposes described below.

A. Sales and Operations: To operate our business, including our website, we use Personal Data to assess queries and requirements, process requests for services, understand and assess website usage and deliver our services to clients and potential clients.

B. Communications and Marketing: We use data collected to communicate and personalize our communications with you. Additionally, you can sign up for email subscriptions and choose whether you wish to receive promotional communications from Encora by email, SMS, post and telephone or other means of communication. We may process your Personal Data to contact you via email, telephone, SMS or other methods of communication to provide you with information regarding our offerings that may be of interest to you.

C. Careers: We may use information provided by you in connection with your application for employment to assess your qualifications for employment and we may share this information with clients and affiliates of Encora solely in connection with our efforts to evaluate you for current and future positions at Encora and for assignment to one or more Encora clients.

D. Personalized Advertising: We use Personal Data to deliver advertising to you on other sites.

E. Security: We use Personal Data to detect, investigate and prevent activities that are fraudulent or illegal, violate our policies or pose safety or security threats.

6.    Data protection rights 

You may exercise your data protection rights by filling up this online form or by sending an e-mail to our Data Protection Officer at privacy@encora.com. If you are in the European Economic Area, you have the right to lodge a complaint regarding the processing of your data with your country’s supervisory authority regulating data protection.

Below, you will find additional information about how Data Subjects may exercise their data protection rights:

• If the processing of Personal Data is based on your consent, you have a right to withdraw consent at any time for future processing.
• You have a right to request us to rectify or correct your Personal Data. Please inform us of any data which you would like rectified, and we usually respond within a month of the request.
• You have a right to access your Personal Data. Please contact us if you would like confirmation that your data is being processed and to request access to your Personal Data. There is no charge for providing you with this data and it will usually be provided within a month of the request.
• You have a right to request that your Personal Data be erased, subject to certain exceptions. You may exercise your right to have your Personal Data erased in a number of circumstances (e.g. if the data is no longer necessary in relation to the purpose for which it was created, or you withdraw your consent). Wherever possible, we will comply with all such requests, though some details are part of Encora’s permanent records (e.g., your name, accounting records) which cannot reasonably be deleted.
• You have a right to restrict processing of your Personal Data. You can tell us that we can keep your data but must stop processing it, including preventing future mailings and communications. If possible, we will inform any third parties to whom your data has been disclosed, of your requirement.
• You have a right to object to the processing of your Personal Data. We will stop processing your data if you object to processing based on legitimate interests or the performance of a task in the public interest / exercise of official authority.
• You have a right to request data portability. Your data is stored across manual records and electronic database. We will do our best to provide information in a portable format.
• You have a right to not to be subject to automated decision-making including profiling; and
• You have a right to lodge a complaint with a data protection authority.

Sale of Personal Information

Encora does not “sell” your Personal Data as defined by the CCPA.

7.    Information retention & accuracy

We take reasonable steps to ensure that Personal Data we receive, process or maintain is accurate, complete and reliable for its intended use. We rely on the accuracy of the information provided directly to us, but accept responsibility for the management and confidentiality of the Personal Information collected.

In general, we keep Personal Data only as long as we need it to provide the services you requested, to consider your application for current and future positions or for the purpose for which the information was provided. We retain your data as long as we have an ongoing relationship with you (in particular, if you have an account with us). We may also process data on behalf of third parties who have engaged us. We keep Personal Data processed on behalf of third parties for as long as needed to provide services to the third party in question. However, we reserve the right to retain Personal Data for any period required by law or to comply with our legal obligations, resolve disputes and enforce our agreements.

8.    Data Minimization

We take reasonable steps to ensure that the Personal Data that we process is limited to the purposes set out in this Notice or as required to provide the services you request.

9.    Sharing of Personal Information and

•  With your consent.
• We use affiliated and unaffiliated service providers all over the world that help us deliver our services and run our business subject to agreements with data protection obligations in line with this privacy policy.
• We will disclose data as required by law including to meet national security requirements or to protect you, other users, us or third parties from harm, including fraud, data security breaches or where someone’s physical safety seems at risk; and
• In a re-organization or sale of some or all of our company or assets, your data may be transferred, subject to the acquirer accepting the commitments made in this privacy policy and in compliance with applicable law.

• transfer such data only for limited and specified purposes.
• Ascertain, through written agreement, that the sub-processor is obligated to provide at least the same level of privacy protection as is required by this privacy policy.
• take reasonable and appropriate steps to ensure that the sub-processor effectively processes the Personal Data transferred in a manner consistent with our obligations under this Policy.
• require the sub-processor to notify Encora if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by this Policy.
• upon notice, take reasonable and appropriate steps to stop and remediate unauthorized processing;
• provide a summary or a representative copy of the relevant privacy provisions of its contract with that sub-processor to authorized regulators upon request; and
• remain liable to you if the sub-processor processes your personal data in a manner inconsistent with privacy principles of EU-U.S. Data Protection Framework.
  
  

b) International transfers and data processing

As a global organization, Personal Data we collect may be transferred or be accessible internationally throughout Encora’s offices around the world and between its entities and affiliates. Any transfers throughout Encora’s offices around the world take place in accordance with the applicable data privacy laws and in accordance with our internal Privacy and Security Policies. Such transfers are subject to Encora’s Intra-Group Agreement on Sharing of Personal Data. If you are visiting this website from a country other than the country in which our servers are located, your communications with us will result in the transfer of information across international boundaries. By visiting this website and communicating electronically with us, you consent to such cross-border transfers.

10.    Security of Personal Data

Encora is committed to protecting the security of your Personal Data. We use a variety of security technologies and procedures to help protect your Personal Data from unauthorized access, use or disclosure. However, we cannot guarantee that we will be able to protect your Personal Data against all security threats.

11.    Limits to Your Privacy

Our Sites may contain links to external websites and areas where you can provide information to third parties. These are provided for your convenience only, and we do not have control over the content or privacy and security practices and policies of such third parties or third-party sites. Any Personal Data you provide in such areas and on such linked pages is provided directly to that third party and is subject to that third party’s privacy policy. Please learn about the privacy and security practices and policies of external websites and third parties before providing them with Personal Data.

12.    Choice Regarding Collection, Use & Distribution of Personal Information

You can choose to opt-out whenever your Personal Information is (i) to be disclosed to a third party or (ii) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you.

If you choose to opt-out, please contact us via email at privacy@encora.com. In such an event, you will be only able to access public areas of the Sites and may be limited in the use of Encora’s Sites. In certain cases, limiting the use and disclosure of your Personal Data may impact functionality or prevent the use of Encora products or services.

13.    Automated Decision-Making

You may be subject to a fully automated decision that could have a legal or negative impact on you if this is necessary to conclude or perform a contract, or if you have granted consent. This automated decision can include profiling in some cases, i.e. the processing of Personal Data that evaluates resume characteristics.

14.    EU - U.S Data Protection Framework Notice

Encora Digital LLC (“Encora”, “we”, “our”, & “us”) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Encora has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Encora has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

For Non-HR data:

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Encora commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Encora at privacy@encora.com.

For HR data:

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Encora commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Encora commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, a global alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

The Federal Trade Commission has jurisdiction over Encora’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Encora commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, you have an option, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. You can check more details on invoking binding arbitration here: Data Privacy Framework.

The following entity associates of Encora also adhere to the EU-U.S. DPF Principles, including as applicable under the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF Principles:

• Group Avantica LLC
• Daitan Labs of America, Inc.
• Encora Nearshore, LLC
• Encora Technologies, LLC
• Prime Technology Group LLC
• Image Process Design, LLC
• Synerzip, LLC
• Lighthouse Software Solutions, LLC

15.    Modifications

We reserve the right to modify this Privacy Notice at any time. If we decide to change our Privacy Notice, we will prominently post those changes here and any other place we deem appropriate, so you are always aware of what information we collect, how we use it and under what circumstances, if any, we disclose it. If we make any material changes, we will notify you by means of a notice on this site. We will use information in accordance with this Privacy Notice under which the information was collected periodically, our operations and business practices are reviewed for compliance with corporate policies and procedures governing the confidentiality of information.

16.    How to Contact Us

If you have any comments, questions or concerns about any of the information in this Notice, or any other issues relating to the processing of user information carried out by us, or on our behalf, please contact us by email at privacy@encora.com.

17.    ENCORA’S PRIVACY STATEMENT FOR CALIFORNIA RESIDENTS

NOTICE OF COLLECTION OF PERSONAL INFORMATION

This Encora Privacy Notice (“Notice”) sets forth Encora Digital LLC and its affiliates (“Encora,” the “Company,” “we” or “us”) disclosure obligations under California law, including California Consumer Privacy Act of 2018 (“CCPA”).

We collect the following categories of Personal Data when you interact with us: identifiers and contact information, professional or employment-related information, Internet or other electronic network activity information and geolocation data.

We collect this Personal Data to operate and maintain our website, provide Encora’s services to you, evaluate employment applications and display advertising relevant to you.

We do not “sell” (as defined under the CCPA) information associated with your activity on our website.

CCPA Mandatory Disclosures

We collected the following categories of Personal Data in the last 12 months: identifiers and contact information, professional or employment-related information, Internet or other electronic network activity information and geolocation data.

We collected Personal Data from the following types of sources: website visitors (through direct submissions by visitors as well as automated means); customers; job applicants and employees; social media networking sites, third-party databases; and in-person events.

We disclosed the following categories of Personal Data for a business purpose in the last 12 months: identifiers, Internet or other electronic network activity information and geolocation data. We disclosed these categories of Personal Data to vendors who support the operation of our services and perform advertising services on our behalf. In addition, we disclosed information about job applicants and employees to our service providers and clients to support Encora’s human resources and business operations.

Consumer Rights under the CCPA

Under the CCPA, Data Subjects may have the following consumer rights:

a. Abbreviated Right to Know (Collection): You have the right to request, at no charge, that we disclose to you the categories and specific pieces of Personal Information collected in the prior 12 months.

b. Expanded Right to Know (Collection and Disclosure): You have the right to request that we disclose certain information about how we have handled your Personal Information in the prior 12 months, including the:

• categories of Personal Information collected about you;
• categories of sources from which we collected your Personal Information;
• business and/or commercial purposes for collecting and disclosing your Personal Information; and
• categories of third parties to/with whom your Personal Information has been disclosed/shared, including for a business purpose; and
• the specific pieces of Personal Information collected about you.

c. Access and Portability: You have the right to obtain a list of categories and a copy of the Personal Information, in a portable and (if technically feasible) readily usable format, collected on you covering the 12-month period preceding the request. d. Deletion: You have the right to request the deletion of your Personal Information we have collected from you. This right may be subject to certain conditions and limitations under the law.

Right to be Free from Discrimination: Encora will not discriminate against you for exercising your rights under the CCPA.

Instructions for CCPA Requests

Right to Know, Delete and Access: You can make a request to exercise your right to know, access or delete Personal Data by sending an email to privacy@encora.com. We may ask you to provide additional information to verify your identity before we process your request.

Instructions for Authorized Agents

You may authorize an agent to make a CCPA request on your behalf. The agent must present your signed authorization allowing the agent to act on your behalf, or a power of attorney that meets the applicable requirements of the California Probate Code. In addition, we may contact you directly to confirm that you authorized the agent to submit the request.

Additional Rights under California Law

A business subject to California Business and Professions Code Section 22581 must allow California residents under age 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted. Your request should include a detailed description of the specific content or information to be removed. Your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

18.    ENCORA’S PRIVACY STATEMENT FOR BRAZIL RESIDENTS

Introduction

Through this Privacy Statement ("Statement") Encora Holdings and its affiliates ("Encora" or the "Company") commit to comply with the legal determinations regarding the processing of data of identified and/or identifiable natural persons that are under the protection of the General Law for the Protection of Personal Data (Law No. 13,709/2018 – “LGPD”). This Statement is part of the Global Data Protection Policy.

The practices described herein apply to the processing of Personal Data in Brazil and are subject to local laws, including the LGPD. Accordingly, the guidelines set forth herein apply when Encora processes Personal Data from Data Subjects who, according to Article 3 of the LGPD, are the target of any data processing operation in Brazil, or who are in Brazil, and/or whose Personal Data has been collected in the Brazilian territory.

Personal Data Subject Rights

In addition to the rights listed elsewhere in this Policy, the General Data Protection Law of Brazil or the “LGPD” provides the following rights to Data Subjects:

• confirmation of the existence of the processing,
• anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the LGPD,
• obtaining information about public and private entities with which the Controller has shared data,
• opposing to the processing carried out based on one of the situations of waiver of consent,
• requesting the review of decisions made solely based on automated processing of Personal Data affecting the interests of the Data Subjects receiving clear and adequate information regarding the criteria and procedures used for automated decisions and, as applicable, and
• data portability.

In the event of a potential breach of the data security requirements (“data protection incident”), the Encora entity involved will have investigation, information and damage mitigation obligations. A data protection incident is considered a personal data breach (“Personal Data Breach”) if there is a breach of security leading to the unlawful destruction, alteration, unauthorized disclosure or use of Personal Data. When the Personal Data Breach is likely to result in a risk or relevant damage to natural persons, the Brazilian Data Protection Authority (“ANPD”) and the Data Subjects must be informed of the corresponding breach, in a reasonable period of time (up to 48 hours as of the discovery of the data protection incident).

Sub-contractors are required to report any Personal Data Breach immediately to the Company.

If you know or suspect that a Personal Data Breach has occurred, do not attempt to investigate the matter yourself, you are required to report this immediately to the DPO and Legal Department. You should preserve all evidence relating to the potential Personal Data Breach.

Definitions

"Sensitive Personal Data": Personal Data concerning racial or ethnic origin, religious conviction, political opinion, membership of a trade union or religious, philosophical, or political organization, data concerning health or sexual life, genetic or biometric data, when associated with a natural person.

"Data Protection Officer": A person indicated by the Controller and Processor to act as a communication channel between the Controller, the Data Subjects, and the National Data Protection Authority.

Instructions for Requests Related to Brazilian LGPD

According to the General Data Protection Law of Brazil (LGPD), DAITAN LABS SOLUÇÕES EM TECNOLOGIA S/A, an affiliate of Encora in Brazil, is considered a 'Controller' and 'Processor' of Personal Data, depending on the data processing context. If you need to contact someone about any matter involving Personal Data under the application of the LGPD, please send an e-mail to privacy@encora.com.

Below is the information relating to the Data Protection Officer of DAITAN LABS SOLUÇÕES EM TECNOLOGIA S/A:

DAITAN LABS SOLUÇÕES EM TECNOLOGIA S/A Data Protection Officer (LGPD): Lucas Carrenho BRAZIL Headquarters - Campinas Av. Selma Parada, 201, Bloco 1, Conjunto 103, Jardim Madalena Galleria Office Park Campinas/SP, Brazil 13091-904 CNPJ: 06.980.081/0001-10

Contact Information

If you have a question about Encora’s privacy practices, please send an email to privacy@encora.com.

Please note that this Privacy Notice will regularly be updated to reflect any changes in the way we handle your Personal Data or any changes in applicable laws. If we make a material change in how we process your Personal Data, we will provide appropriate notice and, if legally required, request your consent.