Employee & Candidate Privacy Notice

1. Overview & Scope

This Employee and Candidate Privacy Notice applies to all individuals whose personal data is processed by Privexus Technologies Co., Ltd. in the context of employment and recruitment activities.

This includes job applicants and candidates, current employees (full-time and part-time), independent contractors and consultants, interns and trainees, and former employees.

This notice is governed by the Personal Data Protection Law of the Kingdom of Cambodia (PDPL 2026) and applicable labor regulations.

2. Controller Information

The data controller responsible for your personal data is:

• Entity: Privexus Technologies Co., Ltd.
• Registered address: Phnom Penh, Kingdom of Cambodia
• Data Protection Officer: dpo@privexus.io
• HR Privacy contact: hr-privacy@privexus.io
• For any questions regarding this notice or your personal data, please contact our HR Privacy team.

3. Personal Data We Collect

We collect the following categories of personal data depending on whether you are a candidate or an employee:

4. Purposes of Processing

We process your personal data for the following purposes:

• Recruitment, selection, and onboarding of candidates
• Employment contract management and administration
• Payroll processing, tax withholding, and benefits administration
• Performance management, training, and career development
• Compliance with Cambodian labor law, tax obligations, and social security requirements
• Workplace health and safety management
• IT security and protection of company systems and assets
• Internal investigations and disciplinary proceedings
• Business planning, organizational management, and workforce analytics
• Defense of legal claims and regulatory compliance

5. Legal Basis for Processing

Under the PDPL 2026, we process your personal data on the following legal bases:

6. Data Sharing & Recipients

We may share your personal data with the following categories of recipients:

• Payroll service providers and benefits administrators
• Tax authorities, social security agencies, and labor inspectorates
• Insurance providers for employee benefits and workplace coverage
• Background check agencies (only with your prior consent)
• Legal counsel and professional advisors
• Regulatory authorities when required by law
• Group companies for internal administration purposes

We do not sell, rent, or trade employee or candidate personal data to any third party.

7. Cross-Border Data Transfers

In the course of our operations, your personal data may be transferred to and processed in countries outside the Kingdom of Cambodia, including the Kingdom of Saudi Arabia, the United Arab Emirates, and European Union member states.

All cross-border transfers are conducted in compliance with Chapter [X] of the PDPL 2026 on international data transfers. We implement appropriate safeguards including Standard Contractual Clauses, data processing agreements with all recipients, and supplementary technical and organizational measures to ensure your data receives equivalent protection.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this notice, or as required by law. Our retention periods are:

9. Your Rights Under PDPL 2026

Under the Personal Data Protection Law 2026, you have the following rights in relation to your personal data:

To exercise any of these rights, contact our HR Privacy team at hr-privacy@privexus.io or our DPO at dpo@privexus.io. We will respond within 30 days.

10. Automated Decision-Making

Privexus does not make solely automated decisions that produce legal or similarly significant effects on employees or candidates.

Where automated tools are used in recruitment (such as CV screening software), all automated outputs are subject to meaningful human review before any hiring decision is made.

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls with least privilege principle
• Regular security assessments and penetration testing
• Employee data access auditing and monitoring
• Incident response procedures with breach notification within 72 hours
• Physical security controls for premises and server rooms

12. Monitoring in the Workplace

Privexus may monitor certain workplace activities for security, compliance, and operational purposes. This section explains the scope and limits of workplace monitoring.

• CCTV surveillance operates in common areas such as entrances, lobbies, and server rooms. Private spaces such as restrooms and prayer rooms are never monitored.
• IT systems including company email, internet usage, and application access may be monitored for security threats and policy compliance.
• Company-issued devices may be subject to mobile device management (MDM) for security purposes.
• All monitoring activities are proportionate, necessary, and conducted in accordance with PDPL 2026 requirements.

Employees are informed of the scope of monitoring during onboarding and through this notice.

13. Changes to This Notice

We may update this Employee and Candidate Privacy Notice from time to time to reflect changes in our practices, legal requirements, or organizational structure.

Material changes will be communicated to employees via company email at least 30 days before they take effect. The current version of this notice is always available on our Trust Center.

For candidates, the applicable version is the one published at the time of your application.