Job Candidate Privacy Notice

Effective Date: June 25, 2026

Introduction

This Job Candidate Privacy Notice (the "Candidate Privacy Notice") describes the personal information that Quickbase, Inc. and its, subsidiaries, corporate affiliates, and related entities (collectively, the "Company", "Quickbase", "we", "us") collects from or about its job candidates ("Job Candidate Personal Information"). The purpose of this Candidate Privacy Notice is: (i) to provide a consistent policy statement and guidelines for the collection, processing, storage, transfer, and use of Job Candidate Personal Information, and (ii) to inform job candidates of the Company of the principles under which the Company processes Job Candidate Personal Information. This Candidate Privacy Notice does not form part of or create any employment contract or guarantee of any specific terms or treatment.

We disclose Job Candidate Personal Information to our private equity investor, Vista Equity Partners, and its affiliates, including, for example, Vista's Value Creation Team (collectively, "Vista") for administration, research, database development, workforce analytics, and business operations purposes in line with the terms of this Candidate Privacy Notice. Vista processes and shares Job Candidate Personal Information on the basis of its legitimate interests in managing, administering and improving its business, research and workforce analytics, overseeing the recruitment process, and, if applicable, your employment relationship with Company. If you have consented to us doing so, we and Vista also share Job Candidate Personal Information with other Vista portfolio companies for the purpose of being considered for other job opportunities in the pooling system, both inside and outside of the European Economic Area ("EEA") and United Kingdom ("UK"). Please find a list of Vista portfolio companies at https://www.vistaequitypartners.com/companies/ and Vista's privacy notice at https://www.vistaequitypartners.com/privacy/. In connection with the recruitment process Job Candidate Personal Information may be transferred outside of the EEA or UK to HireBridge LLC, Paylocity Holding Corporation, and Criteria Corp., which provide applicant tracking and evaluation services.

Compliance with Local Laws

This Candidate Privacy Notice is meant to guide the Company with respect to Job Candidate Personal Information. However, the Company has operations in many jurisdictions which have varied laws, rules and regulations related to the privacy of Job Candidate Personal Information. It is the Company's policy to comply with the privacy laws within each jurisdiction in which the Company operates.

While this Candidate Privacy Notice applies to Job Candidate Personal Information generally, the local laws, rules and regulations of jurisdictions that are applicable to the Company ("Local Laws") may require standards which are stricter than this Candidate Privacy Notice and, in such event, the Company will comply with applicable Local Laws, including, without limitation, any applicable confidentiality obligations. Specific privacy policies and procedures may be adopted to address the specific privacy requirements of particular jurisdictions as are required by applicable Local Laws.

Collection and Use of Job Candidate Personal Information

The Company collects or may collect the following types of Job Candidate Personal Information depending upon your prospective employment responsibilities, citizenship, location of employment, and other factors:

· Identifiers & Contact Information

o Real name, preferred name, name history (e.g., maiden name)

o Unique personal identifier, online identifier, IP address

o Phone numbers

o Email addresses

o Mailing/postal addresses

o Government identification numbers (e.g., Social Security, driver's license, state ID, passport, taxpayer ID)

· Demographic & Protected Classification Data

o Date of birth

o Gender

o Race

o Ethnicity

o Racial or ethnic origin

o Religious or philosophical beliefs

o Union membership

o Veteran status

o Characteristics of protected classifications under state or federal law

o Self-identified physical or mental health conditions

o Health and disability data

· Employment & Professional Information

o Work history and prior employer

o Resumes and employment applications

o References and interview notes

o Compensation history

o Professional memberships

o Documents and information related to proof of work eligibility

o Behavioral assessments

o Inferences drawn to create a profile (e.g., preferences, psychological trends, behavior, attitudes, abilities, aptitudes)

o Other data deemed necessary or voluntarily disclosed during an application for employment

· Education & Qualifications

o Education information and academic records

o Training, qualifications, and certifications

· Media & Biometric Data

o Photographs and video

o Profile photograph (if self-identified)

o Audio, electronic, visual, or similar information

o Written signatures

· Location & Criminal Data

o Non-individualized geolocation data

o Data related to criminal records

Company collects the majority of Job Candidate Personal Information directly from the applicable job candidate. In limited circumstances, third parties provide Job Candidate Personal Information to us including, without limitation, former employers, references, government agencies or regulators, law enforcement, and third party service providers.

The Company may hold, use, and disclose your Job Candidate Personal Information for the following purposes:

· Employment & HR Management

o Evaluate employment eligibility

o Verify qualifications and references

o Assess job/task suitability

o Contact candidates regarding employment

· Legal, Compliance & Security

o Comply with applicable laws and regulations

o Respond to legal inquiries and investigations

o Enforce company policies and defend legal rights

o Prevent fraud and ensure cybersecurity

o Verify identity

· Business Operations

o Process compensation, payroll, and benefits

o Support internal administration

o Operate business systems and processes

· Health & Fitness

o Assess capacity for work

o Assess accommodations that may be relevant

Company will only use Job Candidate Personal Information for the above purposes and for compatible purposes. If Company needs to use Job Candidate Personal Information for an incompatible or secondary purpose, Company will provide prior notice to you, and if required by applicable Local Laws, obtain consent. Company can use Job Candidate Personal Information where required by applicable law, regulation, subpoena, or court order.

Collection and Use of Sensitive Information

Certain jurisdictions provide special categories of personal data that are considered sensitive information under the applicable Local Laws. Where required by Local Law, Company will obtain prior consent from the job candidate before collecting sensitive data from the job candidate.

Company collects and uses the following special categories of personal data when you voluntarily provide them:

• Social Security number and other government identification numbers (e.g., drivers licenses)
• health and disability data
• race and ethnic origin

Company collects and uses the foregoing special categories of personal data for the following legitimate business purposes:

• to carry out our obligations under employment law;
• for the performance of the hiring process and creating the employment contract, and as reasonably expected in the job candidate-potential employer relationship;
• for the performance of the employment contract and to provide services reasonably expected in the employee-employer relationship;
• to protect the Company's legal interests and to ensure the safety of the Company and other individuals; and
• as otherwise required by law.

Where Company has a legitimate need to process special categories of personal data for purposes not identified above and where required by applicable law, Company will only do so after providing you with notice and, if required by applicable law, obtaining prior consent. Company does not sell or share sensitive personal information with any third parties for cross-context behavioral advertising or to use for their own purposes.

Disclosure of Personal Data to Third Parties

Additionally, where the Company is permitted to do so under applicable law, the Company may share your Job Candidate Personal Information with the following:

Affiliates & Service Providers. For each category of Job Candidate Personal Information listed above, we disclose such information to our affiliates and service providers for the purposes described in this Candidate Privacy Notice. Our service providers provide us with background check and verification services, services for our websites, as well as other products and services, such as web hosting, data analysis, payment processing, order fulfillment, customer service, infrastructure provision, technology services, email delivery services, credit card processing, legal services, and other similar services. We grant our service providers access to Job Candidate Personal Information only to the extent needed for them to perform their functions, and we require them to protect the confidentiality and security of such information.

Third Parties. For each category of Job Candidate Personal Information listed above, we disclose such information to the following categories of third parties:

· At Job Candidate's Direction. We may disclose your Job Candidate Personal Information to any third party with your consent or at your direction. In the case of marketing materials or events in or at which you have consented to appear, this includes disclosure of your Job Candidate Personal Information to the general public.

· Business Transfers or Assignments. We may disclose your Job Candidate Personal Information to other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

Legal and Regulatory. We may disclose your Job Candidate Personal Information to government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.

Security

We have implemented measures designed to secure Job Candidate Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of Job Candidate Personal Information also depends on you. Unfortunately, the transmission of information via the internet is not completely secure. Despite our measures, we cannot guarantee the security of Job Candidate Personal Information. Any transmission of personal information is at your own risk.

If you become aware of any breach regarding Job Candidate Personal Information security or of this Candidate Privacy Notice, please notify us at [email protected] immediately.

Accuracy

It is every job candidate's responsibility to provide the Company with accurate Job Candidate Personal Information. A job candidate must notify the Company when there are changes so Company is above to ensure the personal data collected is reliable for its intended use. Except as otherwise set forth in this Candidate Privacy Notice, the Company shall only use Job Candidate Personal Information in ways that are compatible with the purposes for which it was collected or subsequently authorized by the individual. To the extent necessary for these purposes, the Company shall take reasonable steps to ensure that Job Candidate Personal Information is accurate, complete, current and relevant to its intended use.

Information for California Residents

The following section of this Candidate Privacy Notice only applies to California residents.

Collection

Consistent with the "Collection and Use of Job Candidate Personal Information" section above, the Company collects certain categories and specific pieces of Job Candidate Personal Information about job candidates who reside in California ("CA Job Candidate Personal Information"). In the prior 12 months, the Company collected the following types of categories of Job Candidate Personal Information from California residents, which the Company will continue to collect:

Sources

Consistent with the "Collection and Use of Job Candidate Personal Information" section above, the Company collects certain categories of CA Job Candidate Personal Information directly from job candidates and, in some circumstances, third parties. The categories of sources that the Company collected CA Job Candidate Personal Information from in the prior 12 months includes the following:

· The Company's internal and external Website's (including a job candidate's email).

· The Company's third-party service providers.

· Recruiters.

· Third-party websites related to careers and job postings, such as LinkedIn.

· Job candidate communication with the Company.

· The U.S. Government (through E-Verify or TWIC).

Disclosures to Third Parties

In the preceding twelve (12) months, we have not sold or shared (as such terms are defined in the CCPA) any Job Candidate Personal Information.

Consistent with the "Disclosure of Personal Data to Third Parties" section above, the Company discloses certain categories of CA Job Candidate Personal Information with third parties pursuant to the purposes listed in the "Collection and Use of Job Candidate Personal Information" section above.

California Privacy Rights

The California Consumer Privacy Act (the "CCPA") grants individuals that are California residents, certain rights in regard to our collection of CA Job Candidate Personal Information. These rights include, only to the extent applicable and to the extent granted to you under the CCPA:

· The right to request the disclosures of (1) what CA Job Candidate Personal Information has been collected; (2) the categories of sources from which the CA Job Candidate Personal Information was collected; (3) the business or commercial purpose for collection or selling/sharing (if applicable) CA Job Candidate Personal Information; (4) the categories of third parties with whom the Company shares CA Job Candidate Personal Information; and (5) the specific pieces of CA Job Candidate Personal Information the Company has collected;

· The right to request the deletion of their CA Job Candidate Personal Information that has been collected;

· The right to request the correction of their CA Job Candidate Personal Information that has been collected;

·

· The right to not be discriminated against due to their exercise of their rights under the CCPA. The Company does not discriminate against job candidates for exercising the rights granted to them under the CCPA.

The above rights are only exercisable by you where the CCPA grants you the right to be exerted and where no exception or exemption under the CCPA applies. You may also have a registered agent (if and only as permitted under applicable law) that you authorize to act on your behalf. If you have a registered agent act on your behalf, we have the right to authenticate such agent's authority to act.

We do not sell your personal data to third parties, nor do we share your information for purposes of cross-contextual behavioral advertising as defined under the CCPA.

Exercising Your Rights

To exercise your rights as described herein, you may submit a request to us (as described above) by emailing [email protected]. We will respond to requests within the applicable timeframe required by the CCPA.

Information for Canadian Residents

In addition to the disclosures in elsewhere in this Candidate Privacy Notice, Canadian or provincial law requires further disclosures. This section only applies to the extent you reside in Canada.

As a Canadian resident, you may have the following rights with respect to personal information about you (subject to all applicable exemptions and exceptions):

· The right to request access to your personal information;

· The right to request corrections to your personal information;

· The right to lodge a complaint with the Office of the Privacy Commissioner of Canada and/or the applicable Canadian provincial regulatory body if you consider that the collection and use of your personal information violates this Notice or applicable law.

The above rights are only exercisable by you where applicable law in the jurisdiction in which you reside actually grants you the right to be exerted.

Information for Individuals Located in the EEA

This section of the Candidate Privacy Notice applies to job candidates located in countries or jurisdictions in the European Economic Area ("EEA"), including, without limitation, the European Union and the United Kingdom.

Rights of Individuals in the EEA

To the extent the European Union's General Data Protection Regulation or other law granting particular rights to data subjects applies to you (including, without limitation, those located in the United Kingdom) and subject to all applicable exceptions and exemptions granted under such applicable laws, you may have the following rights with regard to our processing of your personal information:

· Right to Access, Correct and Delete Your Personal Information: We will use reasonable measures designed to ensure that all personal information is accurate and up to date. You also have a responsibility to ensure that changes in your personal information are notified to us so we can ensure your personal information is up to date. You have the right to request access to any of your personal information that we hold and to request correction of any inaccurate personal information relating to you that we hold. You furthermore have the right to request deletion of personal information we hold about you.

· Right to Withdraw Consent: In the event your personal information is processed on the basis of your consent, you have the right to withdraw consent at any time with effect for the future.

· Data Portability: To the extent that we use your personal information on the basis of consent or for the performance of a contract, and that personal information is processed by automatic means, you have the right to receive all such personal information about you from us in a structured, commonly used and machine-readable format, and also to require us to transmit it to another data controller where this is technically feasible.

· Right to Restrict Personal Information Use and Right to Object: You may have the right to restrict our use of your personal information where (i) you contest the accuracy of the personal information; (ii) the use is unlawful but you do not want us to erase the personal information; (iii) we no longer need the personal information for the relevant purposes, but you require it for the establishment, exercise or defense of legal claims; or (iv) you have objected to our personal information use justified on our legitimate interests pending verification as to whether Company has compelling interests to continue the relevant personal information use.

· Lodge a Complaint: You also may have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, if you consider that the collection and use of your personal information violates this Candidate Privacy Notice or applicable law.

To exercise your rights, please contact us by emailing [email protected].

Legal Bases We Rely on When Processing Personal Information

To the extent the European Union's General Data Protection Regulation or other similar law applies to you (including, without limitation, those located in the United Kingdom) and is applicable to Company, we process your personal information for the purposes set forth in this Privacy Notice under the following legal bases (as applicable):

· Our Contract With You: Our processing is necessary to perform our obligations under a contract with you or to perform steps requested by you prior to entering into a contract with you: (e.g., to verify the information you have provided to us).

· Our Legitimate Interests: Our processing is necessary for our legitimate interests, including to protect the security of our services; to protect the health and safety of you or others; to establish, protect and defend our legal rights and interests; to prevent fraud and verify identity and authorization of clients; to understand and analyze usage trends; and to improve our products and services. Additionally, we have a legitimate interest in promoting our operations and goals as an organization and sending marketing communications for that purpose.

· Legal Compliance: Where our processing is required to comply with applicable law (for example, to maintain your payment transaction history for tax reporting purposes) e.g., in response to subpoenas, court orders and other lawful requests by regulators, courts and law enforcement agencies, or related to national security requests.

· Your Consent: When we have your express consent as defined by applicable law.

Certification Information for the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. The following information aligns the Quickbase Applicant Privacy Policy with the specific points required by the Data Privacy Framework (DPF) self-certification process, and ensures Quickbase's compliance with the DPF Principles.

Quickbase complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Quickbase has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the UK (including Gibraltar) in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Quickbase has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Quickbase's accountability for personal data that it receives under the Data Privacy Framework and subsequently transfers to a third party is described in the DPF Principles. In particular, Quickbase remains responsible and liable under the DPF Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles, unless Quickbase proves that it is not responsible for the event giving rise to the damage.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Quickbase commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner's Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship. EU, UK, or Swiss individuals with inquiries or complaints regarding this privacy policy should first contact the dedicated Quickbase compliance team at [email protected]

If your DPF complaint cannot be resolved through the above channels, under certain conditions you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf.

Quickbase is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

Organization Information:

Quickbase, Inc.

PO Box 962077, Boston, MA 02196

Individuals in the European Economic Area, UK, Switzerland. If you have a complaint about human resources data transferred to the United States from the European Union, the United Kingdom, or Switzerland, and Quickbase does not address it satisfactorily, Quickbase commits to cooperate with the panel established by the EU data protection authorities (DPA Panel), the UK Information Commissioner's Office, and the Swiss Federal Data Protection and Information Commissioner, as applicable and to comply with the advice given by the DPA panel ICO, or FDPIC, as applicable with regard to such human resources data. To pursue an unresolved human resources complaint, you should contact the state or national data protection or labor authority in the appropriate jurisdiction. Contact details for the EU data protection authorities can be found at https://edpb.europa.eu/about-edpb/board/members_en.

Quickbase has appointed a representative, DataRep, located in the European Union. The representative's contact information may be found at data-protection-representative.pdf.

Data Retention and Destruction

Company retains Job Candidate Personal Information in accordance with Company policies and practices, applicable law (including without limitation Local Laws) and contractual obligations. If there is no activity in relation to the Job Candidate Personal Information, Company removes it from its database, subject to its internal policies, and any applicable legal or regulatory obligations or for the period of time permitted by Local Laws.

Third Party Privacy Policies

This Candidate Privacy Notice only pertains to the Company's collection, use, or disclosure of Job Candidate Personal Information and does not apply to a third party's collection, use, or disclosure of Job Candidate Personal Information. If a job candidate clicks on a link to a third party website or is subject to a third party privacy policy, the job candidate should read that privacy policy.

Cross-Border Transfers of Job Candidate Personal Information

Company has centralized aspects of its processing of Job Candidate Personal Information. Accordingly, where the Company is permitted to do so under applicable law, the Company (including its international affiliates) may transfer or provide Job Candidate Personal Information to Company affiliates or third party service providers both in and outside of the nation where you reside and/or work. Where required by applicable law, your prior consent will be obtained for such transfers, or Company has ensured that Job Candidate Personal Information subject to such a transfer is adequately protected through the use of contractual clauses.

Changes to this Candidate Privacy Notice

This Candidate Privacy Notice applies from the date indicated above. Company reserves the right to amend the Candidate Privacy Notice from time to time, consistent with the requirements of applicable law. Any updated version of this Candidate Privacy Notice will be made available on this site.

Contacting the Company

If any individual has questions regarding this Candidate Privacy Notice, they may contact the Company

by emailing [email protected].