GDPR and CCPA notice

1.Who this notice is for

This notice supplements our Privacy Policy for people protected by the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). It explains the legal bases we rely on, the rights you have, and how to use them. Where Caspian Solutions processes applicant data on behalf of an employer, the employer is the controller and this notice describes how we help you reach them.

2.Controller and contact

Caspian Solutions, operator of Apex ATS, is the controller for website visitor data and for the account data of our customers' users. We have not appointed a statutory Data Protection Officer because our processing does not require one; our privacy contact, who handles all data protection matters and requests, is reachable at management@apexsales.ai.

3.Legal bases (GDPR)

Contract: to provide the Service to customers and their users, including authentication, billing and support.
Legitimate interests: to secure the Service, prevent abuse, understand aggregate usage, respond to inquiries and run our business, balanced against your rights.
Consent: for the newsletter and for any non-essential cookies we may introduce. You can withdraw consent at any time.
Legal obligation: to keep records required by tax, accounting and other laws, and to respond to lawful requests.

For applicant data in an employer's workspace, the employer determines the legal basis, typically steps prior to entering into a contract of employment and the employer's legitimate interest in recruiting.

4.Your rights under the GDPR and UK GDPR

Access: a copy of the personal data we hold about you and information about how it is used.
Rectification: correction of inaccurate or incomplete data.
Erasure: deletion of your data where there is no overriding reason to keep it.
Restriction: limiting how we use your data in certain cases.
Portability: your data in a structured, machine-readable format.
Objection: to processing based on legitimate interests, and at any time to direct marketing.
Withdrawal of consent, without affecting processing already carried out.
Complaint: to your supervisory authority. We would appreciate the chance to address your concern first.

We respond within one month, extendable by two further months for complex requests, and we will tell you if that is needed.

5.Your rights under the CCPA

Right to know what personal information we collect, use, disclose and the categories of sources and recipients.
Right to delete personal information we collected from you, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information.
Right to limit the use of sensitive personal information.
Right to non-discrimination for exercising your rights.

You may designate an authorized agent to make a request; we will verify the agent's authority and your identity. We respond within 45 days, extendable once by 45 days with notice.

6.Do not sell or share

Caspian Solutions does not sell personal information and does not share it for cross-context behavioral advertising, and has not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. Because we do not sell or share, there is no opt-out to exercise, but you may still contact us with any concern.

7.Categories of personal information (CCPA)

In the preceding 12 months we have collected the following categories from website visitors and customer users: identifiers (name, email, phone, IP address); commercial information (subscription and billing records); internet activity (pages viewed, features used); professional information (company, role); and inferences limited to aggregate usage. Sources are you, your employer's workspace and our service providers. We disclose these categories to service providers listed in the Privacy Policy for business purposes only.

8.Applicants: reaching the employer

If your request concerns a job application you made through an Apex ATS careers page, the employer you applied to is the controller (or business). Contact them directly using the details on their careers page. If you cannot reach them, email us; we will forward your request to the employer within five business days and help them respond using the export and deletion tools in the Service.

9.How to make a request

Email management@apexsales.ai with the subject line "Privacy request", describe the right you want to exercise, and include the email address associated with your account or application. We verify identity by confirming control of that email address; for sensitive requests we may ask for additional confirmation. There is no charge for requests unless they are manifestly unfounded or excessive.

10.International transfers

Data is processed in the United States. For transfers from the EEA, UK and Switzerland we rely on Standard Contractual Clauses and the UK Addendum with our customers and subprocessors, as described in the Data Processing Addendum.

11.Changes and contact

We will update this notice as laws change and post the new date here. Contact management@apexsales.ai with questions.

Last updated: September 2026.

GDPR and CCPA notice.