GDPR and CCPA notice.

1.Who this notice is for

This notice supplements our Privacy Policy for people protected by the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). It explains the legal bases we rely on, the rights you have, and how to use them. Where Caspian Solutions processes applicant data on behalf of an employer, the employer is the controller and this notice describes how we help you reach them.

2.Controller and contact

Caspian Solutions, operator of Apex ATS, can be contacted about website and account-data questions at [email protected]. Controller and processor roles, and whether a Data Protection Officer must be appointed, should be confirmed for the applicable processing and agreement.

3.Legal bases (GDPR)

• Contract: to provide the Service to customers and their users, including authentication, billing and support.
• Legitimate interests: to secure the Service, prevent abuse, understand aggregate usage, respond to inquiries and run our business, balanced against your rights.
• Consent: where consent is requested for a specific feature or communication. You can withdraw consent as described in the relevant notice.
• Legal obligation: to keep records required by tax, accounting and other laws, and to respond to lawful requests.

For applicant data in an employer's workspace, the employer determines the legal basis, typically steps prior to entering into a contract of employment and the employer's legitimate interest in recruiting.

4.Your rights under the GDPR and UK GDPR

• Access: a copy of the personal data we hold about you and information about how it is used.
• Rectification: correction of inaccurate or incomplete data.
• Erasure: deletion of your data where there is no overriding reason to keep it.
• Restriction: limiting how we use your data in certain cases.
• Portability: your data in a structured, machine-readable format.
• Objection: to processing based on legitimate interests, and at any time to direct marketing.
• Withdrawal of consent, without affecting processing already carried out.
• Complaint: to your supervisory authority. We would appreciate the chance to address your concern first.

We handle requests in accordance with the time limits and verification requirements that apply under law.

5.Your rights under the CCPA

• Right to know what personal information we collect, use, disclose and the categories of sources and recipients.
• Right to delete personal information we collected from you, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information.
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

You may designate an authorized agent to make a request. We may need to verify the agent's authority and your identity and will follow the response requirements that apply under law.

6.Do not sell or share

Caspian Solutions does not sell personal information and does not share it for cross-context behavioral advertising, and has not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. Because we do not sell or share, there is no opt-out to exercise, but you may still contact us with any concern.

7.Categories of personal information (CCPA)

In the preceding 12 months we have collected the following categories from website visitors and customer users: identifiers (name, email, phone, IP address); commercial information (subscription and billing records); internet activity (pages viewed, features used); professional information (company, role); and inferences limited to aggregate usage. Sources are you, your employer's workspace and our service providers. We disclose these categories to service providers listed in the Privacy Policy for business purposes only.

8.Applicants: reaching the employer

If your request concerns a job application you made through an Apex ATS careers page, contact the employer using the details on its careers page. If you cannot reach them, email us and we can help route your request to the employer as appropriate. Data export and deletion methods depend on the workspace and written data terms; do not assume self-service tools are available.

9.How to make a request

Email [email protected] with the subject line "Privacy request", describe the right you want to exercise, and include the email address associated with your account or application. We verify identity by confirming control of that email address; for sensitive requests we may ask for additional confirmation. There is no charge for requests unless they are manifestly unfounded or excessive.

10.International transfers

Provider regions and applicable transfer mechanisms depend on the active deployment and connected accounts. Confirm them in the applicable written data-processing terms before cross-border processing begins.

11.Changes and contact

We will update this notice as laws change and post the new date here. Contact [email protected] with questions.

Last updated: September 2026.