A. PRIVACY POLICY

This Privacy Policy informs you how EVERISE HOLDINGS PTE. LTD. (“Everise”) and its affiliated companies collect and process your personal data and what your rights are in relation to such data. This Privacy Policy applies to all information submitted directly or indirectly on this website.

This Privacy Policy is organized in two parts. Part One addresses website visitors, job applicants, Everise’s clients, and “Client Customers” (individuals whose personal data Everise processes as a service provider/processor on behalf of its business process outsourcing (“BPO”) clients). Part Two addresses Everise employees. Where Everise processes personal data as a processor on behalf of a Client, that processing is additionally governed by the applicable Data Processing Agreement, Standard Contractual Clauses, and/or Information Protection Addendum between Everise and the Client, which take precedence over this Statement as between Everise and that Client.

Part One — Disclosures To Website Visitors, Job Applicants, Clients And Client Customers

B. DISCLOSURES

Everise data centers and servers are hosted and located in the United States. By providing us with your personal information it may be stored or processed in a country different from your country of residence that may not have privacy laws that are as strong or comprehensive as the privacy laws in your own country. Where your personal data is transferred outside your country of residence, we apply the transfer safeguards described in Section H. If you do not wish to allow collection, processing, and storage of your personal information within a country different from your own country of residence, you may exercise your data subject rights in accordance with clause J. You may also opt out of the collection of cookies by changing or withdrawing your consent from the Cookie Declaration on our Site. Depending on your country of residence, applicable privacy laws may provide you with a right to additional disclosures as well as special data subject rights with regard to your personal information. This Statement applies to Everise and all of its affiliates globally. We are not responsible for the privacy practices of third parties, including any websites that may indicate a special relationship or engagement with us. To ensure your privacy rights are protected, always review the privacy policies of the websites you visit. Everise does not sell personal information, and does not share personal information for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”). We disclose personal data to third parties only as described in Section H.

In addition to the United States, Everise and its affiliates operate service centers, offices, and personnel in the Philippines, India, Colombia, and Guatemala, and maintain a corporate office in Singapore. Your personal information may accordingly also be stored or processed in any of these countries, subject to the cross-border transfer safeguards described in Section H below.

Role as Service Provider for Client Customer Data (new)

Where you interact with Everise because Everise provides customer support, back-office, or other outsourced services on behalf of one of its BPO clients (a “Client”), Everise processes your personal data (“Client Customer Data”) as a service provider/processor acting on the Client’s instructions, and not as an independent controller. In that capacity, the Client’s own privacy notice, and the Data Processing Agreement, Standard Contractual Clauses, and/or Information Protection Addendum between Everise and the Client, govern that processing. This Statement provides supplementary transparency about Everise’s role but does not itself create rights against Everise as though Everise were the controller of that data; requests concerning Client Customer Data should generally be directed to the relevant Client in the first instance, and Everise will support the Client in responding as required by the governing agreement.

C. COMMITMENT TO PRIVACY

The primary purpose of this website (“Site”) is to be a dynamic resource to help you learn more about EVERISE. When you use our Site, we intend to give you as much control as possible over your personal information and we are committed to protecting your privacy. We respect and protect your privacy. It is our goal to explain whom you can contact regarding your concerns about your personal information. This Statement is provided to you for transparency. Where applicable law requires your consent for a particular processing activity, that consent will be requested separately, specifically and granularly, and may be withdrawn at any time; your use of the Site alone is not treated as consent. Accordingly, when you use our Site, you should check the date of this Privacy Policy and review any changes we have made from the previous version. In order to make sure that your data is being kept safe, we have also implemented applicable requirements of Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”), applicable from 25 May 2018; the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (effective 1 January 2023) and its implementing regulations, as amended; and Philippine Republic Act No. 10173, the Data Privacy Act of 2012 (“DPA”), together with its Implementing Rules and Regulations and the issuances of the National Privacy Commission (“NPC”).

We have also implemented applicable requirements of: India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025 and published 14 November 2025, with the substantive obligations phased in over an eighteen-month transition period); Colombia’s Statutory Law 1581 of 2012 on the protection of personal data (“Habeas Data”), Decree 1377 of 2013, and the Superintendence of Industry and Commerce’s Circular Externa No. 003 of 2025 on model contractual clauses for international transfers; and Singapore’s Personal Data Protection Act 2012 (No. 26 of 2012), as amended (including by the Personal Data Protection (Amendment) Act 2020). Guatemala does not currently have a comprehensive statutory data protection law of general application to private-sector processing; pending the enactment of legislation now before the Guatemalan Congress, Everise voluntarily extends the substantive protections of this Statement to Guatemala-based data subjects as a matter of policy, without prejudice to applicable constitutional and sectoral protections.

D. COLLECTION OF PERSONAL DATA

We may collect and process different types of Personal Data in the course of operating our business, talent acquisition and providing our services. Such personal data may include, without limitation:

Personal Data You Provide

We collect some Personal Information when you use the Site or when you communicate directly with us, which includes when you:

When you do this, you may need to provide Everise with any of the following types and categories of Personal Information:

Personal Identifiers:

Sensitive data:

You may choose not to provide your Personal Information or withdraw your consent at any time which you have provided to us for our processing of your information, although it may affect our ability to provide you with relevant information or provide you with any requested service.

Artificial Intelligence in Recruitment Processing (new)

Everise may use artificial intelligence (“AI”) and other automated tools to support Everise’s talent acquisition function — for example, to parse and organize resumes/CVs, match stated qualifications against job requisition criteria, and assist with interview scheduling. These tools are decision-support aids only. Everise does not use AI or any other automated means as the sole or primary basis to make a final hiring decision, reject a candidate, or otherwise produce a decision that has a legal or similarly significant effect on a candidate, without meaningful human review and involvement by a qualified Everise recruiter or hiring manager. A human decision-maker always reviews and makes the final recruitment decision.

Candidates may contact Everise using the details in Section O to request information about the use of such tools in connection with their application, and to request human review of any AI-assisted output. Where applicable law confers a right not to be subject to a decision based solely on automated processing, or a right to notice, explanation or human review in connection with automated tools used in recruitment, Everise will honor that right in the manner and within the timeframes required by that law.

Personal Information Received from Third Parties

We also collect some Personal Information from other sources, such as our affiliates, or other third parties, directly or through technology such as cookies.

Personal Information we receive from third parties may include the same categories of Personal Information described above under “Personal Data You Provide”.

In order to offer you a more consistent and personalized experience in your interactions with Everise, information collected from one source may be combined with information Everise obtains through other sources. This may include information that allows us to identify you across multiple devices through which you access the Site. We may also supplement the information we collect with information obtained from other parties, including our business partners and other third parties.

Other Data Collected Automatically by the Site

When you visit the Site, we may utilize cookies or similar technologies to automatically receive the following types and categories of Personal Information:

We will also store or process details of your visits to our website, the pages you view and resources you access or download, including but not limited to, traffic data, location data, weblogs and other communication data.

Although you can visit our Site without telling us who you are or revealing any information about yourself, we indirectly obtain your information by keeping track of the domains from which people visit our Site through our website’s technology.

If you provide us with personal data of another person, you are responsible for ensuring that such person is made aware of the information contained in this Privacy Policy and that the person has given you his/her consent for sharing the information with Everise. We will treat such data as “personal data” when this information directly relates to or reasonably identifies you.

E. THIRD PARTY LINKS

The Site may contain links to other third-party websites as a service to you and we do not provide any personal data to these websites, and therefore, we will not accept responsibility for their privacy practices. We do not control these third-party websites and are not responsible for the privacy policies and practices of other third parties. By visiting third party websites, your Personal Information may be collected by that third party and will be subject to the third party’s privacy policies. When you are redirected to a third-party website, application, or other online service, for your protection, we encourage you to read the privacy policy applicable to that third party to understand how that third party collects and processes your data. Our Privacy Policy does not apply to such other websites or to the use that those entities make of your information. We have no control over the content displayed on such websites, nor over the measures if any, that are taken by such websites to protect the privacy of your information.

F. USE OF PERSONAL DATA

We use personal data to provide you with information that you request, and for other purposes which we would describe to you at the point where it is collected, or which will be obvious to you:

We also analyze such data for market trends or research and statistics about site traffic. We may also use your IP address or browser information to help diagnose problems with our server, to administer our web site or to help us identify ways to make it relevant. While we do not link IP addresses to any personally identifiable information, we will be able to track which areas of our site the users are visiting. Although the users will be anonymous, usage will be tracked for the above-mentioned purposes. We will process your personal data for the purposes mentioned above based on your prior consent, to the extent such consent is mandatory under applicable laws. Where consent is the applicable legal basis, it will be sought separately and granularly for each distinct purpose, in clear and plain language, and may be withdrawn at any time as easily as it was given. Acknowledging receipt of this Statement is not, by itself, consent to any particular processing purpose. In all other countries, such action will be considered as a mere acknowledgement, and the legal basis of the processing of your personal data will not be your consent but any other applicable legal basis. We will not use your personal data for purposes that are incompatible with the purposes of which you have been informed, unless it is required or authorized by law, or it is in your own vital interest to do so.

We may aggregate or de-identify any personal information collected about you through your interactions with Everise or when you use the Site, and we may use that aggregated or de-identified information for any purpose.

G. HOW WE COLLECT AND PROCESS PERSONAL INFORMATION

We collect both electronic and physical personal information from the following sources:

H. DISCLOSURE AND TRANSFER OF PERSONAL DATA

We only share personal data within our organization, if, and as far as necessary, for the purposes specified in this Privacy Policy. To ensure protection of your Personal Information, Everise has an internal Data Transfer Agreement and has in place Data Sharing Protocols. All Everise employees processing personal data are bound by confidentiality agreements. We may transfer personal data to our service providers, consultants, public and governmental authorities or third parties in connection with a potential or on-going corporate or commercial transaction. Such third parties may be located in other countries. But before we do so, we shall take the necessary steps to ensure that your personal data will be given adequate protection as required by relevant data privacy laws and Everise internal policies. Sharing of personal data with any third party outside of our organization may occur under any of the following circumstances:

Any third party who may come in contact with your personal data is obliged to keep and treat your personal data as confidential in accordance with the applicable data privacy law.

Everise stores and processes data both inside and outside of the United States. If you live in the European Economic Area, your Personal Information therefore may be processed outside the European Economic Area (EEA), and in countries that are not subject to an adequacy decision by the European Commission and which may not provide for the same level of data protection as in the EEA. If we transfer or store Personal Information outside of the EEA, or other countries or economies that require legal protection for international data transfer, we will ensure that an adequate level of protection is provided, as further described below, entering into written data processing agreements with recipients that require them to provide the same level of protection, or relying on other legally-approved transfer mechanisms.

If you are a resident of the EEA, and your personal information is transferred outside of the EEA, we will:

If you are located in Colombia, international transfers and transmissions of your personal data are made on the basis of your prior authorisation, a declaration of conformity, or the model contractual clauses issued by the Superintendence of Industry and Commerce, as applicable. If you are located in India, transfers are made in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, including any restrictions notified by the Central Government in respect of specified territories. If you are located in the Philippines or Singapore, transfers are made subject to contractual and organizational safeguards requiring the recipient to provide a comparable level of protection, and Everise remains accountable for the personal data so transferred.

I. CHILDREN’S ONLINE DATA PROTECTION

Everise does not knowingly collect or maintain personal data of individuals under 18 years of age through this Site. If you are under 18 years of age, please do not use or access our Site(s) or otherwise provide any information to Everise without the knowledge and consent of your parent/legal guardian. If we learn that the personal information of an individual under 18 years old has been collected without verifiable consent of a parent or lawful guardian, we will delete it without undue delay. Everise does not undertake tracking, behavioural monitoring or targeted advertising directed at children.

J. RIGHTS OF DATA SUBJECT TO PERSONAL DATA

You have the choice on how to manage your Personal Information and the types of communications, ads, materials, or information you want to receive from Everise. However, please note that we may have a legal obligation to preserve and secure certain data and in order to do so, we may need to request additional information from you in order to confirm and verify your identity. This is to ensure that we can properly service your request by locating relevant data that pertains to you and that your Personal Information is not disclosed to a person who does not have a right to receive it. We do not charge a fee for responding to a rights request. Where permitted by applicable law, we may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, and we will explain our reasons if we do so.

Marketing Communications: You may choose to opt-out from receiving certain email communications from us by using the unsubscribe link email communication you receive from us, visiting the applicable email preference center, or by contacting us directly.

Access to Your Personal Information: If you have provided Personal Information directly to us, you may exercise your data subject rights by emailing dataprivacy@weareeverise.com, or through the Data Subject Request Form available at https://everise.privacy.saymine.io/Everise and referenced at the end of this Privacy Policy.

EU Site Users, Job Applicants, and Customers:

EU Privacy Rights: If you reside in the European Economic Area, you may have the right to exercise certain privacy rights available to you under applicable laws. We will process your request in accordance with applicable data protection laws. We may need to retain certain information for record-keeping purposes or to complete transactions that you began prior to requesting any deletion.

Please note that we may have legal or other obligations to preserve certain data which could prevent us from deleting certain data.

California Site Visitors, Users and Customers:

In accordance with the requirements of the California Consumer Privacy Act, you may have certain rights in relation to your Personal Information.

Your California Privacy Rights:

Everise will attempt to provide responses to legitimate and verified written requests for information pursuant to the CCPA. The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

You have the right to request that we disclose certain information to you about our collection and use of your personal information, unless doing so proves impossible or would involve a disproportionate effort. Once we receive and confirm your verifiable consumer request, we will disclose to you:

The categories of personal information we collected about you. The categories of sources for the personal information we collected about you. Our business or commercial purpose for collecting that personal information. The categories of third parties with whom we share that personal information. The specific pieces of personal information we collected about you (also called a data portability request).

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. Everise will assess each deletion request on its own facts against the statutory exceptions for example, where retention is necessary to complete a transaction, to detect security incidents, to comply with a legal obligation, or to make an internal use reasonably aligned with your expectations. Where an exception applies, we will delete the balance of the personal information and explain the basis for any partial refusal. Where Everise holds your personal information solely as a service provider on behalf of one of its clients, we will notify the client and act on that client’s instructions as required by our contractual obligations.

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by using the Data Subject Request Form resource page. A verifiable consumer request may be made by you, or by an authorised agent acting on your behalf. Where an agent acts for you, we may require written permission signed by you, and may require you to verify your own identity directly with us and to confirm that you granted the agent permission, except where the agent holds a lawful power of attorney. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must: (i) Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative and (ii) Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically determined by the method of submitting the verifiable consumer request. Disclosures will ordinarily cover the 12-month period preceding receipt of the request, and will cover the longer period described in Section J.1 where you ask us to do so. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

The California Consumer Privacy Act prohibits us from discriminating against you in any way should you exercise any of the rights set forth above.

You have the right to request Everise to correct any inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.

To exercise the correction of inaccurate information rights, you may submit a verifiable request to us by using the Data Subject Request Form resource page. We may reach out to you and request for any additional information to verify any relevant information before we process your request.

If we collect any sensitive personal information about you, you have the right, at any time, to direct us to limit its use to that which is only necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services we provide.

If we use or disclose a consumer’s sensitive personal information for purposes other than those specified herein we shall provide a notice to consumers, that such information may be used, or disclosed to a service provider or contractor, for additional, specified purposes and that consumers have the right to limit the use or disclosure of their sensitive personal information.

If you do not want us to use or disclose your sensitive personal information for any other purpose, we shall not do so unless you subsequently provide consent for the use or disclosure of your sensitive personal information for additional purposes.

A service provider or contractor that assists Everise in performing any data processing may not use the sensitive personal information after it has received instructions from Everise and to the extent it has actual knowledge that the personal information is sensitive personal information for any other purpose. A service provider or contractor is only required to limit its use of sensitive personal information received pursuant to a written contract with Everise in response to Everise instructions and only with respect to its relationship with Everise.

Everise does not sell personal information and does not share personal information for cross-context behavioural advertising. If this position changes, we will update this Statement, publish a “Do Not Sell or Share My Personal Information” link on the Site, and honor opt-out preference signals transmitted by your browser or device, including the Global Privacy Control. Where Everise uses automated decision-making technology to make a decision that produces legal or similarly significant effects concerning you, you may request information about that use and opt out of it, to the extent and from the date required by applicable California regulations.

If you are a resident of the State of California, this Privacy Policy is supplemented by our CCPA Privacy Policy which fully explains how we process your personal data.

Philippines Site Visitors, Users and Customers

You have the right to be informed that your personal data will be, is being or was collected and processed by Everise.

You may contact us to get confirmation that we are processing your personal data and request that we provide you with a written description of information that we have about you as well as the purpose for holding or processing the information.

If our processing of your personal data is based on your consent, you may withdraw the consent at any time by contacting us. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful basis for processing it other than consent.

You have the right to have inaccurate or incomplete personal data we hold about you corrected or completed. Where that personal data has been disclosed to a third party, we will inform the third party of the correction and request that it be applied.

If our processing of your personal data is based on our legitimate interests in operating, maintaining and developing our business, you have the right to object at any time to our processing. We shall then no longer process your personal data unless there are other compelling legitimate grounds for our processing that override your interests, rights and freedom, such as legal claims or obligations.

You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and to independently transmit the data to a third party, if the processing is based on your consent and carried out by automated means.

You have the right to have personal data we process about you deleted or removed from our systems if the personal data is no longer necessary for the purposes specified in this Privacy Policy. Upon your request, we will also delete data when you withdraw your consent or object to our processing of it, unless we have a legitimate basis for not doing so. We may not immediately be able to remove all residual copies from our servers and backup systems after the active data has been deleted. Such copies shall be deleted as soon as reasonably possible.

You may claim compensation if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, considering any violation of your rights and freedoms as data subject.

Just like any physical property, such as real estate, you can assign your rights as a data subject to your legal assignee or lawful heir. Similarly, you may assert another person’s rights as a data subject, provided he or she authorized you as a “legal assignee”. You may also invoke another person’s data privacy rights after his or her death if you are his or her legal heir. This same principle applies to parents of minors, or their legal guardian, who are responsible for asserting their rights on their behalf. This right, however, is not applicable in case the processed personal data being contested are used only for scientific and statistical research.

We reserve the right to request additional information necessary to confirm your identity. We may also reject requests that are unreasonably repetitive, excessive or manifestly unfounded.

As deemed applicable, you may also lodge a complaint before the Philippine National Privacy Commission through its website: https://privacy.gov.ph.

India Site Users, Job Applicants, and Customers

If you are located in India, you have the following rights under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as and when the relevant provisions are brought into force and subject to any applicable exemptions:

Colombia Site Users, Job Applicants, and Customers

If you are located in Colombia, you have the following “habeas data” rights under Statutory Law 1581 of 2012 and Decree 1377 of 2013:

Singapore Site Users, Job Applicants, and Customers

If you are located in Singapore, you have the following rights under the Personal Data Protection Act 2012, subject to the exceptions in the Fifth and Sixth Schedules to that Act:

Guatemala Site Users, Job Applicants, and Customers

Guatemala has no comprehensive statutory data protection law of general application to private-sector processing. Pending enactment of legislation, Everise voluntarily extends to individuals located in Guatemala the substantive protections of this Statement, including the ability to request access to, correction of, and deletion of their personal data, and to raise a concern with the Data Protection Officer using the details in Section O.

K. PERSONAL DATA SECURITY AND PROTECTION

We take reasonable steps to ensure that the personal data, whether in manual or electronic form, we collect, use or disclose is accurate, complete, and up to date. We strictly enforce this Privacy Policy within Everise and we have implemented technological, organizational and physical security measures to protect your personal data from loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction. To keep your personal data secure, we have implemented the following security measures:

Should a security breach occur that is likely to result in a risk to your privacy despite of our security measures, we will notify the competent supervisory authority and affected individuals in the manner and within the timeframes required by the applicable law, including where relevant the Philippine National Privacy Commission, the competent European supervisory authority, the Personal Data Protection Commission of Singapore, the Data Protection Board of India and the Superintendence of Industry and Commerce of Colombia. However, please be aware that no data transmission over the Internet can be guaranteed to be 100% secure. As such, while we strive to protect your information, we cannot guarantee its absolute security. Therefore, the Terms of Use on Indemnity and Limitation of Liability on this Site shall apply.

We retain personal data only for as long as is necessary for the purposes for which it was collected. Where no specific statutory period applies, we determine the retention period by reference to the following criteria: the duration of our relationship with you; whether the data is required to establish, exercise or defend a legal claim; the limitation and prescriptive periods applicable in the relevant jurisdiction; and applicable tax, labor, corporate and regulatory record-keeping requirements. Indicatively, website inquiry and marketing records are retained 2 years from last contact or until consent is withdrawn, whichever comes first, and unsuccessful job-application records for 4 years from date of application, unless a longer period is required by law. Following deletion, personal data is removed from our active systems and is no longer accessible or searchable. Residual copies may persist in secure backup or archival media for a limited period until those media are overwritten or securely destroyed in the ordinary course, during which time the data remains protected by the safeguards described in this Section and is not used for any other purpose.

     3. THIRD PARTY DISCLOSURES

L. COOKIE POLICY

All our websites engage third-party service providers to analyze the web traffic data for us. This service uses cookies or web beacons. A “cookie” is a text file that websites send to a visitor‘s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. Cookies are small files that our website puts on your personal computer (PC) to store information about your preferences. Cookies can improve your browsing experience by allowing our website to remember your preferences or letting you avoid signing in each time you visit our website. If you don’t want our website to store cookies on your PC, you can block cookies. But blocking cookies might prevent some pages from displaying correctly, or you might get a message from our website letting you know that you need to allow cookies to view our website. A “web beacon,” is also called a Web bug or a pixel tag or a clear GIF. Used in combination with cookies, a Web beacon is an often-transparent graphic image, usually no larger than 1 pixel x 1 pixel, that is placed on a website or in an e-mail that is used to monitor the behavior of the user visiting the website or sending the e-mail. Cookies and similar technologies used on the Site fall into the following categories: (a) strictly necessary cookies, which are required for the Site to function and are set without consent; (b) functional or preference cookies; (c) analytics or performance cookies; and (d) where deployed, advertising or targeting cookies. Cookies in categories (b) to (d) are set only with your prior consent where consent is required by applicable law, and you may grant, refuse or withdraw that consent at any time, and as easily as it was given, through the cookie preference center accessible at Privacy Policy – Everise on the Site. The data collected through these technologies may include:

PART TWO — DISCLOSURES TO EVERISE EMPLOYEES

This Part Two supplements Sections A to K above and describes how Everise, as employer, collects, uses, and protects the personal data of its employees, worldwide, across its operations in the United States, the Philippines, India, Colombia, Guatemala, and its Singapore office. Where a provision of Part One also applies to employees (for example, the security measures in Section K.1 or the retention principles in Section K.2), it applies here as well and is not repeated. This Part Two is a summary only. The full description of how Everise handles employee personal data — including the categories collected, the specific purposes and legal bases, workplace monitoring, and retention periods — is set out in the Everise Employee Privacy Notice, which is issued to employees on onboarding and is available at all times through the HR portal and from the Data Protection Officer on request.

In summary, Everise processes employee personal data in the following categories: recruitment and onboarding records; employment, payroll, tax and benefits records; performance, training and conduct records; records generated by the authorized use and administration of Everise IT, communications and site-security systems; and exit and final-settlement records.

Purposes and Legal Bases

Everise processes employee personal data to administer the employment relationship, including recruitment, payroll and benefits administration, performance management, compliance with labor, tax, immigration and social security laws, workplace safety and security, and, where relevant, defense of legal claims. Depending on the jurisdiction, the legal basis for this processing may be the necessity of processing for the employment contract, compliance with a legal obligation, Everise’s legitimate interests in operating its business, or, where required, employee consent (for example, for certain optional benefits programs).

AI in Recruitment — Cross-Reference

As described in Section D above, Everise may use AI-assisted tools to support (but never to replace) human recruiters in evaluating job applications. No hiring decision affecting a candidate or internal applicant is made solely by automated means; a qualified human recruiter or hiring manager always reviews and makes the final decision. Employees or candidates with questions about the use of these tools may contact the Data Protection Officer using the details in Section O.

Cross-Border Transfer of Employee Data

Because Everise operates as a single, global BPO organization, employee personal data may be transferred among Everise affiliates in the United States, the Philippines, India, Colombia, Guatemala, and Singapore, and to Everise’s HR systems providers, for the purposes described above. Such transfers are subject to the same safeguards described in Section H (including Standard Contractual Clauses and compliant transfer mechanisms), and to Everise’s internal Data Transfer Agreement and Data Sharing Protocols referenced in Section H.

Employee Rights

Employees may exercise the same categories of rights described for site users and customers in Section J above (EU, California, Philippines, India, Colombia, and Guatemala (where Everise extends equivalent rights voluntarily), as applicable to the employee’s location), subject to any employment-specific exceptions under the relevant law. Requests should be directed to the Data Protection Officer using the contact details in Section O, or, for matters concerning the employment relationship specifically, to Everise Human Resources.

M. DATA PRIVACY TRAINING AND HUMAN RESOURCES GOVERNANCE

We will implement periodic and mandatory training for all its employees, representatives, and agents on data privacy and data protection in areas reflecting job-specific content. We will ensure that all employees, representatives, and agents exposed to personal data pursuant to their functions are adequately bound by strict confidentiality covenants.

This training will include role-appropriate content on the use of AI-assisted recruitment tools described in Section D and this Part Two, so that recruiters and hiring managers understand their obligation to exercise independent human judgment and not to treat any AI-generated output as determinative.

N. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time in response to changing legal, technical, organizational, or business developments or when dictated by issuances of relevant data privacy laws. Any change to this Privacy Policy will be posted on this Site together with a revised effective date. Where a change materially alters the purposes for which we process your personal data, or the categories of recipients, we will provide notice and, where applicable law so requires, obtain your consent before the change takes effect in relation to you. Data subjects are encouraged to periodically check for such updates.

O. ANY QUESTIONS OR CONCERNS?

If you have any questions about your rights or concerning data privacy or you want to let us know about our Site/marketing permissions, please contact us:

Legal Department

EVERISE US Headquarters

8517 Southpark Cir., Suite 400 Orlando Florida, 32819, U.S.A.

Email: legal@weareeverise.com

Or you may reach our Data Protection Officer by communicating to:

DATA PROTECTION OFFICER

Everise Philippines Ltd.

20th Floor Bonifacio One Technology Tower Rizal Drive cor. 31st St., Bonifacio Global City Taguig City, Philippines 1634

Email: dataprivacy@weareeverise.com

GRIEVANCE OFFICER | Data Protection Officer (India)

Email: Namita.Prasad@weareeverise.com | dataprivacy@weareeverise.com

This Privacy Policy was originally effective 10 January 2026 and restated as of 23 September 2026.

Any changes we may make in the future to this Privacy Policy will be posted on this page.

Affiliated Companies (as updated from time to time)

(1) Everise, Inc., USA

(2) Everise Labs, LLC, USA

(3) Everise Guatemala, Limitada, Guatemala

(4) Everise Colombia S.A.S.

(5) Everise Holdings Pte. Ltd., Singapore (“Everise”)

(6) Everise Malaysia BPO Services Sdn Bhd., Malaysia(non-operational — see note below)

(7) Everise Labs Ireland Limited, Ireland (non-operational — see note below)

(8) Everise Philippines Ltd.

(9) Everise (India) BPO Services Private Limited

*Everise Malaysia BPO Services Sdn Bhd and Everise Labs Ireland Limited are included above for corporate-structure completeness. Neither entity conducts business process outsourcing operations, neither has any employees, and neither holds personal data. Should either entity be identified as holding any residual personal data, that data will be retained only for the balance of the applicable period, and destroyed thereafter, in accordance with the Everise Records Retention Policy.