Privacy Policy

Global Coverage

IMPORTANT: This Privacy Policy applies globally. Benevolve complies with applicable privacy, data protection, cybersecurity and AI governance laws in the jurisdictions in which it operates and provides services.

1. What Does This Privacy Policy Cover?

This Privacy Policy ("Policy") sets out how Benevolve ("we," "us," or "our") collects, uses, discloses, retains, transfers, and safeguards Personal Data in connection with the Benevolve workforce skills intelligence platform ("Platform") and related services ("Services") accessible at https://benevolve.com

This Policy applies to:

• Client organisations ("Clients") that deploy Benevolve to manage their workforce data; and
• Individual employees, contractors, and other personnel ("End Users") whose Personal Data is processed through the Platform on behalf of clients.
• "Benevolve Personnel" means Benevolve's employees, officers, directors, contractors, consultants, temporary workers, and approved service providers who are authorised to access Personal Data solely for the purpose of providing, supporting, securing, maintaining, or improving the Services and who are subject to appropriate confidentiality and data protection obligations.

Benevolve operates as a Data Processor and Service Provider — we process Personal Data on behalf of Clients under written Data Processing Agreements ("DPAs"). We do not independently:

• Decide why Personal Data is collected;
• Seek consent from individuals;
• Use Personal Data for our own commercial purposes; or
• Sell, rent, or trade Personal Data.

Supplemental Notices

In connection with specific features or Services, we may provide additional context-specific ("just-in-time") disclosures about our data processing practices. These supplemental notices may add to this Policy, clarify our practices in the specific circumstances described, or provide you with additional choices about how your Personal Data is processed. We recommend reading this Policy in full alongside any supplemental notice applicable to your use of the Platform.

De-Identified and Aggregated Data

Benevolve may create de-identified or aggregated data derived from Personal Data. De-identified data refers to data that can no longer reasonably be used to identify you. Where we maintain or use de-identified data, we make no attempt to re-identify it except for the purpose of determining whether our de-identification process satisfies the requirements of applicable laws. Aggregated, de-identified data may be used to improve our Services, subject to the restrictions set out in Section 5 (AI features) and our DPA with each Client.

2. Governing Laws & Jurisdiction

Benevolve respects the privacy of all individuals whose Personal Data we process and is committed to complying with applicable privacy laws across all jurisdictions in which we operate.

United States

Benevolve is committed to complying with applicable US federal and state privacy, data protection and AI governance laws, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other applicable state privacy laws.

This Policy is governed by the laws of the State of Washington, USA. US-related disputes shall be subject to the exclusive jurisdiction of courts in King County, Washington, USA.

Singapore

For Singapore-based data subjects, this Policy complies with the Personal Data Protection Act 2012 (PDPA) and all 11 PDPA obligations: Consent, Purpose Limitation, Notification, Access and Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, Openness, Accountability, and Data Breach Notification.

India

For India-based data subjects, this Policy complies with the Digital Personal Data Protection Act, 2023 (DPDPA).

Data Protection Officer

In compliance with the PDPA Accountability Obligation and applicable US privacy laws, Benevolve has appointed a Data Protection Officer ("DPO") responsible for ensuring global privacy compliance. The DPO can be contacted at: [email protected].

This Policy has been prepared in line with ISO 27001 and SOC 2 Type II certification requirements.

3. What Personal Data Does Benevolve Collect?

Benevolve receives Personal Data from the Clients and authorised End Users, as necessary to provide and continually improve its products and services. The categories of Personal Data collected include, but are not limited to:

We do not independently determine the categories of Personal Data collected. We rely on the Organisation to ensure the accuracy and completeness of Personal Data provided to us, in compliance with the Accuracy Obligation under the PDPA and equivalent obligations under applicable US state laws.

Sensitive Personal Information

Salary, compensation, and benefits data constitutes Sensitive Personal Information under the California Privacy Rights Act (CPRA). We apply heightened protections to this category, including strict purpose limitation (used only to deliver the contracted service), role-based access controls, and a prohibition on use for any secondary purpose without explicit Client authorization.

Special Categories of Personal Data — Prohibition

Benevolve does not collect, process, or seek to receive Special Categories of Personal Data through the Benevolve Platform. "Special Categories" include, without limitation, Personal Data pertaining to racial or ethnic origin, genetic data, biometric data used for identification, physical or mental health, political opinions, religious or philosophical beliefs, trade union membership, or sexual orientation.

Clients and their authorised users agree and acknowledge that they shall not, directly or indirectly, use the Platform to collect, upload, or process Special Categories of Personal Data or transfer any such data to Benevolve. If Benevolve becomes aware that Special Category data has been inadvertently submitted, we will notify the Client and take steps to delete such data promptly.

4. How Does Benevolve Process Your Personal Data?

Benevolve, while processing Personal Data, relies on the Organisation to confirm that:

• A lawful basis for processing exists;
• Individuals have been provided with appropriate privacy notices; and
• Necessary consents (where required) have been obtained.

We process Personal Data for legitimate uses, in order to provide our Services and perform, among other actions, the following:

We process Personal Data solely for providing Services to the Organisation, as well as maintaining, securing, and improving our infrastructure and complying with applicable legal obligations in the US, Singapore, and India.

We do not process Personal Data for purposes other than those documented in our DPA with the Organisation. We do not sell, rent, trade, or otherwise commercialize Personal Data. We do not use Personal Data for independent marketing, profiling, or analytics purposes except as expressly authorized by the Organisation. We do not use identifiable Personal Data of Client employees to train or improve AI models without authorization from the Client. Benevolve may use de-identified, anonymised and aggregated data to improve, maintain, secure and enhance the Platform and its AI-powered features, subject to applicable law and contractual commitments with the Client.

5. How Does Benevolve Use AI to Process Personal Data?

Benevolve is an AI-powered workforce skills intelligence platform. The following AI-driven features process Personal Data:

• Skills Inference: AI analyses End User data to identify, map, and assess workforce skills and skill gaps.
• Career Recommendations: AI generates personalised career development pathways based on skills profiles and organisational needs.
• Talent Modeling: AI performs workforce modelling to predict future skills requirements and reskilling priorities.
• 360° Assessment Analytics: AI processes multi-source feedback to generate assessment scores and team-level insights.

5.1 Human Oversight

No solely automated decisions with legal or similarly significant effects are made about individuals without human oversight by the Organisation. AI-generated insights are provided to authorised administrators who retain full decision-making authority over all employment-related decisions.

6. How Does Benevolve Handle Personal Data of Children?

Benevolve is a business platform for workforce management and is not directed at individuals under 18 years of age. We do not collect or process children's Personal Data for the said Services.

We do not knowingly collect Personal Data from children under the age of 16 or the minimum age of minors in the applicable jurisdiction if lower. If we learn that we have inadvertently collected such data, we will delete it promptly in compliance with applicable law and jurisdictions. If you believe a child's Personal Data has been submitted to the Platform in error, please contact [email protected].

7. Does Benevolve Use Cookies and Other Tracking Technologies?

Benevolve uses cookies and other tracking technologies, depending on the features offered, to enhance your experience, analyse usage patterns, and personalise content. Cookies may collect technical information such as IP addresses, device identifiers, and browsing behaviour, which may constitute Personal Data under applicable law. We process such data in accordance with our Cookie Policy at https://benevolve.com/cookies.

Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly. They enable core functionalities such as security, network management, and accessibility. You cannot turn off these cookies through our cookie consent tool.
• Performance and Analytics Cookies: Help us understand how users interact with the Platform by collecting and reporting information anonymously.
• Functional Cookies: Enable enhanced functionality and personalisation, such as remembering your preferences (e.g., language or region).
• Advertising and Targeting Cookies: Used to deliver personalised advertisements and track the effectiveness of marketing campaigns. We do not use these cookies to profile End Users for behavioral advertising.

Legal Basis for Using Cookies

• Consent: For non-essential cookies (analytics, advertising, social media), we seek your explicit consent via our cookie banner.
• Legitimate Interest: For strictly necessary cookies required for Platform functionality and security.

Retention of Cookies

• Session Cookies: Deleted when you close your browser.
• Persistent Cookies: Retained for a specified duration of up to 2 years, or until manually deleted.

Managing Your Cookie Preferences

When you visit the Platform for the first time, a cookie banner will explain our use of cookies. You can accept all cookies, reject non-essential cookies, or customise your preferences using our Cookie Consent Tool. You can also manage cookies through your browser settings at any time.

Third-Party Cookies

We use third-party cookies placed by trusted external service providers such as analytics, advertising, and functionality partners. These third parties may collect information about your online activities over time and across different websites. We recommend reviewing the respective privacy policies of these third-party providers for further information.

8. Does Benevolve Share Personal Data with Third Parties?

We only share Personal Data on a "need-to-know" basis with designated personnel or third parties, affiliates, or subsidiaries involved in our business and operational processes. All such parties are bound by contractual confidentiality and data protection obligations.

Sub-Processor Transparency

We share Personal Data with vetted sub-processors who assist us in delivering the Platform, including cloud infrastructure providers (AWS), analytics tools, security vendors, and customer support platforms. All sub-processors are bound by data processing agreements requiring equivalent data protection standards.

No Sale of Personal Data

We do not sell, rent, trade, or otherwise transfer Personal Data to third parties for monetary or other valuable consideration. We do not share Personal Data for cross-contextual behavioural advertising. Should either of these practices change, we will update this Policy and notify Clients in advance.

Legal Disclosures

We may disclose Personal Data where required by applicable law, court order, or regulatory authority; to protect the rights, property, or safety of Benevolve, our Clients, or the public; or to prevent death or imminent bodily harm, in connection with national security or law enforcement activities, or to establish, exercise, or defend our legal rights or in connection with a corporate transaction such as a merger or acquisition, subject to confidentiality obligations.

Business Transfers

If Benevolve undergoes a business transition such as a merger, acquisition, or sale of all or a portion of its business, services, or assets, Personal Data may be among the assets transferred. In accordance with applicable laws, we will use reasonable efforts to notify affected Clients and, where required, seek consent prior to transferring Personal Data to an unaffiliated third party. Any successor entity will be required to honour the commitments in this Policy.

9. Does Benevolve Share Personal Data Internationally?

Benevolve operates globally with infrastructure and personnel in the US, Singapore, and India. Data storage and processing practices by region are as follows:

• US Clients: Personal Data is processed on AWS servers located in the United States. The specific AWS region applicable to your deployment will be confirmed in your Terms of Service.
• Singapore Clients: All Personal Data of Singapore-based users is stored and resides on servers located in Singapore (AWS ap-southeast-1 region). As Personal Data does not leave Singapore, the Transfer Limitation Obligation under Section 26 of the PDPA does not apply to this data.
• India Clients: Personal Data is stored on India-region servers.

Benevolve Inc., as a US-incorporated entity with a Singapore subsidiary (Benevolve Pte. Ltd.), may access Personal Data from outside the country of storage for Platform maintenance and support purposes. Such access is governed by:

• Data Processing Agreement;
• Encryption in transit (TLS 1.2+) and at rest (AES-256 via AWS KMS); and
• Compliance with ISO 27001 and SOC 2 Type II certification standards.

10. What Are Your Privacy Rights and How Can You Exercise Them?

Depending on your jurisdiction, you have the following rights in relation to your Personal Data:

10.1 Universal Rights (All Jurisdictions)

• Right to be Informed: You have the right to be informed about the manner in which your Personal Data is collected and used, which this Policy endeavours to address.
• Access: Request access to the Personal Data we hold about you, including information about how it is processed.
• Rectification / Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of Personal Data when it is no longer needed for its original purpose.
• Data Portability: Obtain a copy of your data in a portable, machine-readable format.
• Restriction: Request a limitation on the processing of your data where the processing is inappropriate.
• Objection: Object to certain processing activities (e.g., direct marketing or profiling).
• Withdraw Consent: Withdraw your consent where processing is based on consent. Withdrawal will not affect the lawfulness of processing conducted prior to withdrawal.
• Third-Party Notification: Request that we inform any third parties to whom we have disclosed your Personal Data of any correction, deletion, or restriction you have requested, where technically feasible.

10.2 Additional Rights for US Residents

We honour the broadest set of rights available under all enacted US state privacy laws. US residents have the following additional rights, applicable depending on state of residence:

• Right to Know: Request disclosure of the categories and specific pieces of Personal Data collected, their sources and purposes, and categories of third parties with whom they were shared.
• Right to Delete: Request deletion of Personal Data, subject to legal exceptions.
• Right to Opt-Out of Sale / Sharing: We do not sell or share Personal Data for cross-context behavioural advertising. Should this change, we will provide a clear opt-out mechanism before any such practice begins.
• Right to Limit Sensitive Personal Information: Direct us to limit use of Sensitive Personal Information (including salary and compensation data) to what is strictly necessary to provide the service.
• Right to Non-Discrimination: We will not deny, downgrade, or otherwise discriminate against you for exercising any privacy right.
• Right to Appeal: Where we deny a privacy rights request, you have the right to appeal that decision within the timeframe set by your applicable state law.

10.3 How Requests Are Handled

Because Benevolve acts as a Data Processor and Service Provider, End Users should direct privacy requests to their employer — the Client organisation that deployed Benevolve. We do not respond directly to individual End User requests unless authorised by the Organisation. Upon receiving a direct request from an individual, we promptly notify the relevant Organisation and provide reasonable assistance to enable compliance.

Client organisations and our direct business contacts may submit privacy requests through:

• Email: [email protected]

We will acknowledge receipt within 10 business days and provide a substantive response within 45 days. Where necessary and permitted by law, this period may be extended with notice. We do not charge a fee for submitting privacy requests.

10.4 Right to Grievance Redressal

You have the right to access grievance redressal mechanisms provided by us. We will respond to grievances within prescribed timeframes. You are encouraged to utilise the mechanisms above before seeking further legal recourse. To raise queries or complaints, email: [email protected].

10.5 Authorized Agent (CCPA)

California residents may designate an authorized agent to submit privacy rights requests on their behalf. To protect the security of your account and Personal Data, we will verify the identity of both you and your authorized agent before processing any such request. Verification may include confirming your name and the email address you use when interacting with us or your organisation's Benevolve administrator. Authorized agent requests that cannot be verified may be declined.

11. How Does Benevolve Keep Your Personal Data Safe?

Benevolve implements industry-standard administrative, technical, and physical safeguards to protect Personal Data against misuse, loss, unauthorised access, modification, or disclosure, including:

Our security program includes:

While Benevolve implements robust security measures, no system is entirely immune from security incidents due to factors outside our control, including hacking, virus dissemination, or force majeure events. Users are responsible for protecting their own credentials, limiting access to their devices, and signing out of the Platform after each session.

12. How Long Does Benevolve Keep Your Data?

We retain Personal Data only for as long as necessary to provide Services to Clients and to meet our legal obligations. The appropriate retention period for any category of Personal Data is determined based on:

• The amount, nature, and sensitivity of the Personal Data;
• The potential risk of harm from unauthorised use or disclosure;
• Whether the purposes of processing can be achieved through other means; and
• Applicable legal requirements, including statutes of limitation.

Standard retention periods are as follows:

• Active service period: Personal Data is retained throughout the contract term as directed by the Client's DPA.
• Post-termination: Upon contract expiration or termination, Personal Data is returned to the Client or securely deleted, anonymised, or rendered inaccessible within 90 days, unless retention is required for backup, disaster recovery, legal, regulatory, audit, security or compliance purposes.
• Legal holds: Data may be retained for a longer period if required by applicable law, pending litigation or regulatory investigation, or for legitimate safety, security, and integrity purposes.
• Cookies: Session cookies are deleted when the browser is closed; persistent cookies expire within 2 years.

After expiry of the applicable retention period, Personal Data will be deleted, de-identified, anonymised, or otherwise irreversibly destroyed in accordance with applicable laws. Where data cannot be deleted for technical reasons, we will implement appropriate measures to prevent any further use of that data. Our retention obligations may require us to retain certain Personal Data even where a deletion request has been submitted, and we will notify the requesting party accordingly.

Benevolve may retain Personal Data for longer periods in the following additional circumstances: if necessary for compliance with applicable law; in the event of any legal or regulatory proceeding; for judicial and/or governmental investigations; or to protect our rights, property, or Services.

13. What Happens in Case of a Data Breach?

In the event of a confirmed Personal Data breach, we will:

• Notify the affected Client organisation without undue delay, and in any event within 72 hours of confirming the breach, to enable the Client to assess and meet its own statutory notification obligations;
• Provide all information reasonably necessary for the Client to comply with applicable breach notification laws in its jurisdiction, including information about the nature of the breach, the categories and approximate volume of Personal Data affected, and the measures taken to address the breach; and
• Take immediate and reasonable measures to contain the breach, mitigate harm, and prevent recurrence.

Singapore

For Singapore-based data, we provide all relevant information to enable statutory reporting to the Personal Data Protection Commission (PDPC) within 3 calendar days of assessing the breach, as required under the PDPA.

United States

US breach notification obligations to affected individuals and regulators rest primarily with the Client in its capacity as data controller. We will cooperate fully and promptly with the Client's notification process. US state breach notification laws generally require notification to affected individuals without undue delay. Applicable timelines and requirements vary by state and by the nature and volume of data affected. Clients should consult qualified legal counsel to determine their specific notification obligations, including any requirements to notify state Attorneys General or other regulatory bodies.

14. How Will You Know About Changes to This Privacy Policy?

Benevolve reserves the right to modify this Privacy Policy periodically to reflect updates to its business processes, current acceptable practices, or legislative or regulatory changes. The latest version can always be accessed at https://benevolve.com/privacy.

For material changes, we will notify Client administrators by email and post a prominent notice on the Platform at least 30 days before any material change takes effect. The 'Last Updated' date at the top of this Policy reflects the most recent revision. Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

15. How to Contact Benevolve

If you have questions or concerns related to this Privacy Policy, you may contact our Data Protection Officer or privacy team through any of the following channels:

Regulatory Escalation

For Singapore: If your concern is not resolved to your satisfaction, you may contact the Personal Data Protection Commission (PDPC) at https://www.pdpc.gov.sg.

For United States: For US-related privacy concerns not resolved to your satisfaction, you may contact the Federal Trade Commission (FTC) at https://www.ftc.gov or the Attorney General of your state.

Capitalised terms not defined herein have the meaning ascribed to them in the Personal Data Protection Act 2012 of Singapore or the applicable US state privacy law.

Privacy Policy | Benevolve Inc. | © 2026