Candidate Privacy Policy

Effective Date: May 26, 2026

1. INTRODUCTION AND SCOPE

Hashgraph Foundry Inc. (“Hashgraph,” “we,” “our,” or “us”), a corporation incorporated under the laws of the State of Delaware with its principal place of business at 1920 McKinney Ave, STE 700, Dallas, TX 75201, United States is committed to protecting the privacy and personal information of individuals who apply for employment or otherwise engage with us as part of our recruiting and hiring processes. This Recruiting Candidate Privacy Policy (“Recruiting Policy”) describes how Hashgraph collects, uses, stores, shares, and protects personal information from job applicants, candidates, and related individuals (“Candidates” or “you”) in connection with our recruitment activities.

Hashgraph Foundry Inc. is the data controller responsible for your personal information collected through the recruiting process. Our contact details are set out in Section 13 below.

This Recruiting Policy supplements, and should be read in conjunction with, Hashgraph’s general Privacy Policy available at https://hashgraph.com/privacy-policy/ (“General Privacy Policy”). In the event of any conflict between this Recruiting Policy and the General Privacy Policy with respect to recruiting and hiring activities, this Recruiting Policy controls.

This Recruiting Policy applies to personal information collected through:

Our career website and job application portals;
Recruiting platforms and applicant tracking systems (“ATS”) used by Hashgraph;
Communications via email, telephone, video conferencing, or in person;
Third-party recruiting agencies, executive search firms, or staffing partners acting on our behalf;
Professional networking platforms such as LinkedIn;
Background check and reference check providers; and
Any other means by which you provide information to us in connection with a potential employment opportunity.

2. PERSONAL INFORMATION WE COLLECT

We may collect and process the following categories of personal information about Candidates:

2.1 Identification and Contact Information

Full name, preferred name, and pronouns (if voluntarily provided);
Home and mailing address, city, state, and country of residence;
Email address and telephone numbers;
Date of birth and government-issued identification numbers (where required for eligibility verification or background screening);
Photograph Identification Document (where requested for identity verification purposes, as described in Section 8 below);
Social media handles or professional profile URLs (e.g., LinkedIn) provided by you; and
Emergency contact information (collected after an offer of employment is extended).

2.2 Professional and Employment Information

Résumé, curriculum vitae (CV), cover letter, and supporting application materials;
Work history, job titles, employers, dates of employment, and responsibilities;
Educational background, degrees, certifications, and professional licenses;
Professional skills, competencies, and areas of expertise;
Portfolio materials, work samples, publications, patents, or links to professional work;
Compensation history and salary expectations (where permitted by applicable law); and
References and information provided by professional references.

2.3 Interview and Assessment Information

Notes and evaluations from interviews, phone screens, and hiring panels;
Results of skills assessments, technical evaluations, take-home assignments, or other screening tools;
Video or audio recordings of interviews (where notice is provided and consent obtained as required by law); and
Communications with Hashgraph employees, recruiters, and hiring managers.

2.4 Background and Verification Information

Criminal background check results (where permitted and required by applicable law and position);
Employment and education verification results;
Credit history (only where directly job-related and legally permissible);
Professional license and certification verifications; and
Immigration or work authorization status and documentation (after conditional offer of employment).

2.5 Special Categories of Sensitive Personal Information

In limited circumstances and only where required or permitted by applicable law, we may collect or process certain categories of sensitive personal information, including:

Health or disability-related information, solely to the extent necessary to evaluate and implement reasonable accommodations under applicable law;
Information regarding criminal convictions or offenses, as part of background screening in jurisdictions that permit such inquiries for the relevant role; and
Biometric data, such as facial recognition data or fingerprints (only where expressly required for the role or mandated by law, and with separate prior consent where applicable).

We process sensitive personal information only with an appropriate legal basis (see Section 6), and we apply heightened protections to such data. We will never use sensitive personal information to make unlawful employment decisions.

2.6 Demographic Information (Where Voluntarily Provided)

Where permitted by applicable law and on a purely voluntary basis for diversity, equity, and inclusion (“DEI”) reporting purposes, we may request:

Race, ethnicity, or national origin;
Gender identity;
Veteran status; and
Disability status.

Voluntary demographic information is used solely for aggregate DEI reporting and monitoring and will not be used in individual hiring decisions.

2.7 Technical and Device Information

If you access our career portal or application systems online, we may automatically collect certain technical data, such as IP address, browser type, device identifiers, and browsing activity within our portals, consistent with the General Privacy Policy. Our ATS and HR systems also use cookies and similar tracking technologies, as further described in Section 10 below.

3. HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect Candidate personal information in the following ways:

Directly from you, when you submit an application, complete forms, participate in interviews or assessments, or communicate with us;
From third parties, such as recruiting agencies, staffing firms, executive search partners, professional references, or prior employers you have authorized us to contact;
From publicly available sources, such as professional networking platforms (e.g., LinkedIn) or publicly accessible portfolios and publications;
From background check service providers, following your explicit consent and in compliance with the Fair Credit Reporting Act (“FCRA”) and applicable state law; and
Through automated means, such as cookies and tracking technologies used on our career portal and ATS, as described in Section 10.

4. HOW WE USE YOUR PERSONAL INFORMATION

We use Candidate personal information for the following purposes:

Evaluating your qualifications, skills, and suitability for open or future positions at Hashgraph;
Communicating with you throughout the application and interview process;
Scheduling and conducting interviews, assessments, and other evaluation activities;
Verifying the accuracy of information you have provided, including your identity and work authorization;
Conducting background checks and reference checks, where applicable and with appropriate notice and consent;
Extending, negotiating, and formalizing offers of employment;
Complying with applicable federal, state, and local legal and regulatory obligations, including equal employment opportunity (“EEO”) and affirmative action requirements;
Identifying and contacting you about other suitable job openings at Hashgraph for which you may be qualified, where you have not been selected for the position to which you initially applied (subject to your right to opt out);
Maintaining internal records and audit trails for legal, compliance, and dispute resolution purposes;
Improving our recruiting processes, tools, and Candidate experience;
Aggregating and anonymizing data for internal workforce planning and DEI analytics; and creating recruiter capacity models.
Protecting the security and integrity of Hashgraph’s operations.

We will not use your personal information for purposes that are incompatible with those described in this Recruiting Policy without providing you with advance notice.

5. AUTOMATED DECISION-MAKING AND PROFILING

Hashgraph does not use solely automated decision-making, including profiling that produces legal or similarly significant effects, when evaluating Candidate applications or making hiring decisions. All material hiring decisions involve human review and judgment.

We may use technology tools to assist human reviewers (for example, applicant tracking software that organizes and surfaces applications), but no such tool operates as the final or sole decision-maker with respect to your candidacy. If our practices change in this area, we will update this Recruiting Policy and provide any additional disclosures or safeguards required by applicable law, including Article 22 of the GDPR and equivalent provisions under other applicable data protection laws.

6. LEGAL BASIS FOR PROCESSING

6.1 All Jurisdictions

We process Candidate personal information on the following general bases:

Pre-contractual necessity: Processing required to take steps at your request prior to potentially entering into an employment contract (e.g., evaluating your application, scheduling interviews, conducting verifications);
Legal obligation: Processing required to comply with applicable law (e.g., EEO recordkeeping, I-9 work authorization verification, FCRA compliance);
Legitimate interests: Processing in furtherance of Hashgraph’s legitimate business interests (e.g., improving our recruitment processes, protecting against fraud, maintaining accurate records), to the extent those interests are not overridden by your rights and interests; and
Consent: Processing for which we rely on your explicit consent (e.g., voluntary DEI data, certain background check components, recording of interviews, consideration for future roles).

6.2 EEA, UK, and Switzerland

For Candidates located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, the legal bases described in Section 6.1 correspond to Articles 6 and 9 of the EU General Data Protection Regulation (“GDPR”) and equivalent provisions under UK GDPR and Swiss data protection law. Where we process special categories of sensitive data, we rely on additional bases under Article 9 GDPR, including your explicit consent (Article 9(2)(a)) or processing necessary for the purposes of carrying out obligations in the field of employment law (Article 9(2)(b)).

Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal. Withdrawal of consent will not invalidate any processing that occurred while consent was in effect, and we will continue to retain data already collected as permitted or required by applicable law. Withdrawal of consent for certain processing activities (such as background checks) may, however, affect our ability to continue your candidacy.

7. HOW WE SHARE YOUR PERSONAL INFORMATION

We may share Candidate personal information in the following circumstances:

7.1 Within Hashgraph

We share Candidate information internally among Hashgraph employees and teams who have a legitimate need to access that information in connection with the applicable recruiting and hiring process, including HR personnel, hiring managers, interviewers, and executives involved in a hiring decision, on a need-to-know basis.

7.2 With Our Service Providers

We share Candidate information with third-party vendors and service providers who assist us with recruiting and HR operations, including applicant tracking system providers, interview scheduling tools, background check providers, skills assessment platforms, and video conferencing services. Such service providers are contractually bound to use your information only as directed by Hashgraph and in compliance with applicable privacy law.

7.3 With Auditors, Legal Counsel, and Professional Advisors

We may disclose Candidate information to auditors, lawyers, accountants, consultants, and other professional advisors engaged by Hashgraph, to the extent necessary for them to provide services to us and subject to professional obligations of confidentiality.

7.4 With Our Affiliated Entities

We may share Candidate information with our parent, subsidiary, or affiliated entities for purposes consistent with this Recruiting Policy, including consideration of Candidates for positions at those entities where you have expressed interest or consented to such consideration.

7.5 With Recruiting Partners

If you were referred to Hashgraph through a recruiting agency, staffing firm, or executive search partner, we may share limited information with that partner to the extent necessary to manage our relationship with the partner and the applicable referral.

7.6 For Legal Compliance and Protection

We may disclose Candidate information where required or permitted by law, including in response to subpoenas, court orders, legal process, or government inquiries, or to protect the legal rights, safety, or security of Hashgraph, our employees, or others.

7.7 In Connection with Corporate Transactions

In the event of a merger, acquisition, sale of assets, reorganization, or similar corporate transaction, Candidate information may be transferred as part of that transaction. We will provide notice of any such transfer to the extent required by applicable law.

7.8 With Your Consent

We may share your information in other circumstances with your explicit prior consent.

We do not sell Candidate personal information.

8. VIDEO RECORDING, PHOTOGRAPHY, AND IDENTITY VERIFICATION

In connection with certain stages of the recruiting process, Hashgraph may:

Request a current head-and-shoulders photograph or capture a still image for identity verification purposes, used together with government-issued identification documents you provide as part of your application;
Record video-based interviews, where we will provide advance notice and, where required by applicable law, obtain your written consent prior to recording; and
Use video conferencing platforms that may capture session recordings, screen captures, or metadata.

Photographs and recordings collected for identity verification are processed solely for security and authentication purposes. Where required by applicable law (including the Illinois Biometric Information Privacy Act and similar state statutes), we will obtain separate written consent before collecting biometric identifiers derived from such materials. You may decline to be recorded, though this may affect our ability to proceed with your candidacy for certain roles.

9. BACKGROUND CHECKS AND FAIR CREDIT REPORTING ACT

Hashgraph uses third-party consumer reporting agencies to conduct background checks on Candidates who have received a conditional offer of employment. Background checks may include verification of employment history, education, criminal records (where permitted by applicable law), and other job-related information.

Before initiating a background check, we will:

Provide you with a clear and conspicuous written disclosure that a consumer report may be obtained;
Obtain your written authorization; and
Provide you with a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act,” as required by the FCRA, 15 U.S.C. § 1681 et seq.

If we take an adverse employment action based in whole or in part on information in a consumer report, we will comply with the pre-adverse and adverse action notice requirements of the FCRA and applicable state and local law, including providing you an opportunity to dispute inaccurate information.

10. COOKIES AND TRACKING IN OUR APPLICANT SYSTEMS

Our career portal and ATS, including any third-party HR systems we use to manage the recruiting process, may employ cookies and similar tracking technologies. These technologies may be used for the following purposes:

Strictly necessary cookies: Required to enable core functionality of the application portal (e.g., maintaining your session state and saved application progress). These cookies cannot be disabled without affecting the ability to use the portal.
Functional cookies: Remember your preferences within the portal (e.g., language settings).
Analytics cookies: Help us understand how Candidates navigate our portal so we can improve the experience. These are set by us or third-party analytics providers.
Social media features: Our career portal may include LinkedIn or similar integrations that may set their own cookies and collect your IP address.

Where required by applicable law, we will request your consent before placing non-essential cookies. You may manage cookie preferences through your browser settings or any consent management tool presented within our portals. Note that disabling certain cookies may impair the functionality of our application systems. For a full description of cookie practices on Hashgraph’s websites, please refer to the General Privacy Policy at https://hashgraph.com/privacy-policy/.

11. DATA RETENTION

We retain Candidate personal information for as long as necessary to fulfill the purposes described in this Recruiting Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Our general retention practices for Candidate data are as follows:

Active Candidates: Information is retained throughout the active application and interview process.
Unsuccessful Candidates: Information is generally retained for a period not to exceed three (3) years following the conclusion of the applicable recruiting process, in order to comply with EEO and affirmative action recordkeeping obligations (including 29 C.F.R. § 1602 et seq.), to consider the Candidate for future positions with consent, and for legal and audit purposes.
Hired Candidates: Upon hire, personal information transitions to the employee personnel record and is governed by Hashgraph’s employee data retention policies.
Voluntary Demographic Data: Retained in anonymized, aggregated form only, following the conclusion of the applicable process.

You may request deletion of your Candidate information at any time, subject to our overriding legal obligations as described in Section 12 below.

12. YOUR PRIVACY RIGHTS

12.1 Exercising Your Rights — General Process

To exercise any of the rights described in this Section, please submit a written request to us using the contact information in Section 13. Your request must: (i) provide sufficient information to allow us to verify your identity as the Candidate about whom we hold information; and (ii) describe your request in sufficient detail to allow us to understand, evaluate, and respond to it (“Valid Request”). We will not respond to requests that do not meet both criteria. We will work to respond to Valid Requests within the timeframe required by the laws applicable to your location. We will not charge a fee for a Valid Request unless it is excessive, repetitive, or manifestly unfounded.

12.2 All Candidates

Regardless of location, Candidates may:

Request access to the personal information we hold about you;
Request correction of inaccurate or incomplete personal information;
Withdraw consent for optional processing activities (e.g., voluntary DEI data collection, consideration for future roles, or interview recording);
Opt out of being contacted about future job opportunities; and
Contact us with questions or concerns about this Recruiting Policy.

12.3 California Residents (CCPA/CPRA)

Candidates who are residents of California have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), including:

The right to know the categories and specific pieces of personal information we collect, use, disclose, and share;
The right to delete personal information, subject to applicable exceptions;
The right to correct inaccurate personal information;
The right to limit use and disclosure of sensitive personal information to specified purposes; and
The right not to be discriminated against for exercising your rights.

Certain exemptions apply under the CCPA/CPRA for personal information collected in the context of employment relationships and business-to-business transactions. For CPRA purposes, the categories of third parties to whom we disclose personal information for business purposes include: service providers (ATS, background check providers, assessment platforms), auditors, legal counsel, and affiliated entities, as described in Section 7.

12.4 EEA, UK, and Switzerland Residents (GDPR)

Candidates located in the EEA, UK, or Switzerland have the following rights under applicable data protection law:

Right of access (Article 15 GDPR): Obtain a copy of your personal data and information about how it is processed;
Right to rectification (Article 16 GDPR): Request correction of inaccurate or incomplete data;
Right to erasure (Article 17 GDPR): Request deletion in certain circumstances (e.g., where data is no longer necessary or consent is withdrawn);
Right to restriction of processing (Article 18 GDPR): Request that we limit processing in certain circumstances;
Right to data portability (Article 20 GDPR): Receive your data in a structured, machine-readable format;
Right to object (Article 21 GDPR): Object to processing based on legitimate interests; and
Right to lodge a complaint with a supervisory authority: EEA — https://edpb.europa.eu/about-edpb/board/members_en; UK — https://ico.org.uk/; Switzerland — https://www.edoeb.admin.ch/.

13. DATA SECURITY

Hashgraph implements commercially reasonable administrative, technical, and physical safeguards designed to protect Candidate personal information against unauthorized access, disclosure, alteration, or destruction. These measures include access controls, encryption of sensitive data in transit and at rest, vendor due diligence, and employee training on data privacy.

While we strive to protect your personal information, no system of safeguards is completely secure. We cannot guarantee the absolute security of information transmitted to or stored in our systems.

14. INTERNATIONAL DATA TRANSFERS

Hashgraph operates and engages service providers in multiple jurisdictions. Candidate personal information may be transferred to, stored in, or processed in the United States or other jurisdictions that may not provide the same level of data protection as your home country.

For Candidates in the EEA, UK, or Switzerland, we will implement appropriate safeguards for cross-border transfers as required by applicable law, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement (“IDTA”), or other lawful transfer mechanisms. For Candidates in other countries with cross-border transfer restrictions (including Brazil under the LGPD), we may rely on your consent for the transfer of your personal data outside your country of residence.

15. U.S. EQUAL EMPLOYMENT OPPORTUNITY AND ACCOMMODATIONS

For Candidates applying to positions in the United States:

Equal Employment Opportunity: Hashgraph is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, disability, genetic information, veteran status, or any other characteristic protected by applicable federal, state, or local law.
Unemployment Status: It is Hashgraph’s policy to comply with all applicable laws prohibiting adverse consideration of unemployment status in making hiring decisions.
Disability Accommodation: Hashgraph complies with the Americans with Disabilities Act (“ADA”), the ADA Amendments Act of 2008, Section 503 of the Rehabilitation Act of 1973, and applicable state and local law. We consider reasonable accommodation measures that may be necessary for qualified applicants and employees to perform the essential functions of a job. To request an accommodation in connection with the application process, please contact us using the information in Section 17.
Genetic Information Non-Discrimination: Hashgraph complies with the Genetic Information Nondiscrimination Act (“GINA”) and will not use genetic information in hiring decisions.

16. RECRUITMENT FRAUD NOTICE

Hashgraph will never ask Candidates for personal financial information, payment, fees, banking or account information, or gift cards at any stage of the recruiting process. All legitimate Hashgraph job postings appear on our official careers page at https://hashgraph.com/careers. All official communications from Hashgraph recruiting staff will come from email addresses bearing the @hashgraph.com domain.

If you receive a recruiting communication that requests personal financial information or payment, appears to originate from a non-Hashgraph domain, or otherwise seems suspicious, do not respond and contact us immediately at [email protected]. Hashgraph is not responsible for fraudulent offers made by unauthorized third parties.

17. HOW TO CONTACT US

If you have any questions, requests, or concerns regarding this Recruiting Policy or our handling of your personal information as a Candidate, please contact us at:

Hashgraph Foundry Inc.

Attn: Privacy – Recruiting Matters

Email: [email protected]

Website: https://hashgraph.com

Please mark your inquiry “Recruiting Privacy Request” in the subject line.

18. CHANGES TO THIS RECRUITING POLICY

Hashgraph reserves the right to modify this Recruiting Policy at any time in its sole discretion. Any changes will be effective upon posting of the revised policy with an updated Effective Date. If you are an active Candidate at the time of a material change, we will make reasonable efforts to notify you. Your continued participation in the recruiting process following any such update constitutes your acknowledgment of the revised policy.

We encourage you to review this Recruiting Policy periodically.

19. RELATIONSHIP TO GENERAL PRIVACY POLICY

This Recruiting Policy is a supplement to, and incorporated by reference into, Hashgraph’s General Privacy Policy located at https://hashgraph.com/privacy-policy/. Terms not otherwise defined herein have the meanings ascribed to them in the General Privacy Policy. This Recruiting Policy does not limit the rights or remedies available to Hashgraph under the General Privacy Policy or applicable law.

This document is intended for use in connection with Hashgraph’s recruiting and hiring activities.