Biometric Data Retention and Destruction Policy

Purpose and scope

This policy sets out how Releady collects, uses, stores, discloses, retains, and destroys biometric data gathered through Candidate Identity Verification.

The policy applies to every candidate who completes Candidate Identity Verification for Releady, including candidates in the United States, Canada, Costa Rica, Colombia, and Nicaragua. It also applies to every Releady employee and contractor who handles that data.

The policy is written to meet the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's biometric identifier law (RCW 19.375), the biometric provisions of the Colorado Privacy Act, and the privacy laws of the other countries where Releady recruits. Where these laws differ, Releady follows the most protective requirement.

Definitions

Biometric identifier

A scan of face geometry, a fingerprint, a voiceprint, or a retina or iris scan used to identify a person. For Releady, this is the facial geometry Didit creates from a candidate's selfie and ID photo.

What Releady collects and why

Releady collects biometric data to confirm that the person who interviews is the person who applied, which protects candidates, Releady, and Releady's clients from identity fraud.

During Candidate Identity Verification, Didit collects the following on Releady's behalf:

• An image of the candidate's government-issued photo ID

• A live selfie

• The facial geometry Didit creates to compare the selfie with the ID photo

• Basic device and network information used to detect fraud

• The verification result

Releady uses verification data for three purposes: confirming a candidate's identity before a screening interview, re-confirming identity at onboarding if the candidate joins a client engagement, and investigating suspected identity fraud during the retention period. Releady uses verification data for no other purpose, including marketing, hiring decisions unrelated to identity, or training AI models.

Notice and consent

Releady obtains written consent from every candidate before any biometric data is collected. The Candidate Identity Verification and Interview Notice, available in English and Spanish, tells candidates that biometric data will be collected, the specific purpose, how long it's kept, and that Didit processes it on Releady's behalf.

Candidates give consent through a required checkbox on the Releady application. For candidates in Colombia, the consent is prior, express, and informed, as Ley 1581 of 2012 requires. Releady keeps a record of each consent with the candidate's profile.

Alternative identity check

Candidates who can't complete verification through Didit, including because of a disability, or who prefer to keep their biometric information private, can ask for a live identity check over video with a member of the Releady operations team. Releady does not capture or store images during that check, so it involves no biometric data.

Disclosure

Releady never sells, leases, trades, or otherwise profits from biometric data. Releady discloses verification data only in these cases:

• To Didit, as Releady's data processor, to perform Candidate Identity Verification

• To a client the candidate was presented to, when that client needs to confirm the candidate's identity, under the consent the candidate gives at application

• With the candidate's written consent in any other case

• When federal, state, or local law requires it, or when a valid warrant or subpoena compels it

When Releady shares verification data with a client, it shares only the ID image, selfie, and verification result, never the facial data Didit creates. Releady sends the data through a secure channel, requires the client to protect it and delete it once its review is complete, and records each disclosure with the date, the client, and the reason.

Didit stores verification data in the European Union, and Releady keeps only the verification result and session ID in its recruiting system. Releady protects biometric data with at least the same standard of care it applies to its other confidential and sensitive information.

Didit's controls

SOC 2 Type 2 and ISO/IEC 27001:2022 certifications, iBeta Level 1 liveness testing at a NIST-accredited lab, and compliance with the EU General Data Protection Regulation.

Retention schedule

Releady permanently destroys verification data at the earliest of these events:

• One year after the verification date

• When the candidate asks for deletion, unless a legal requirement prevents it

• When Releady determines the data is no longer needed for the purposes in this policy

This schedule falls within BIPA's limit of three years after a person's last interaction and within CUBI's limit of one year after the purpose for collection ends.

Legal holds: When Releady receives notice of litigation, a government investigation, a warrant, or a subpoena involving a candidate, Releady preserves that candidate's verification data until the hold is lifted. Releady then destroys the data under this schedule.

Didit deletes verification data automatically after 12 months, and Releady deletes it sooner on request through Didit's console or API.

• Automatic deletion: Releady sets Didit's retention policy to 12 months and checks the setting each quarter.

• Deletion on request: Releady deletes a candidate's session within 10 business days of a valid request.

• Deletion log: Releady records each deletion with the session ID, date, and reason, and keeps no biometric data in the log.

• Vendor exit: If Releady stops using Didit, Releady instructs Didit to delete all remaining verification data and obtains written confirmation.

Candidates can ask to access or correct their information, ask Releady to delete their verification data, or withdraw consent at any time. They can contact the Releady team member who requested their interview or email dataprotection@releady.com.

Releady aims to respond to every request within 10 business days and always meets the deadline the candidate's local law sets. Colombia allows 10 business days for access requests and 15 for correction or deletion, and Canada allows 30 days. When a candidate withdraws consent, Releady deletes the candidate's verification data and offers the alternative identity check so the candidate can continue in the process.

Didit leads the technical response to an incident in its systems, and Releady, as the data controller, owns every notice to candidates and regulators. The same protocol applies to an incident on Releady's side, such as verification data shared by mistake.

Before an incident: Didit notifies Releady within the window set in the Data Processing Agreement, with a target of 72 hours or less. Didit sends notices to dataprotection@releady.com. Releady keeps a candidate log of session ID, name, state or country of residence, and verification date, with no biometric data, so it can identify who is affected and which laws apply. Releady names an incident lead, a backup, outside counsel, and its cyber insurance contact.