ExlService Holdings, Inc. and Affiliates

Applicant Privacy Policy

ExlService Holdings, Inc. and its affiliates and subsidiaries (“Company,” “we,” or “us”) are committed to protecting the privacy and security of your personal information. This privacy policy describes how we collect, use, and disclose personal information prior to, during, and after your application for employment with us (collectively, your “application”). It applies to all current and former applicants and contractors (collectively “applicants”) who are residents of the United States or European Union.

This privacy policy does not form part of any contract of employment or other contract to provide services. If you are offered and subsequently accept an offer of employment by the Company, we may collect and use personal information about you for additional purposes, as outlined in any employee privacy policy we may provide at the time.

It is important that you read and retain this policy, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

California Consumer Privacy Act (“CCPA”)

The California Consumer Privacy Act (“CCPA”) provides California residents, referred to in the law as “consumers,” with the right to receive certain disclosures regarding the collection, use and sharing of personal information. The CCPA defines “personal information” as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular” California resident. It does not include data from which identifying elements have been removed and that cannot be associated with you (“deidentified information”). Certain information we collect may be exempt from the CCPA because it is considered publicly available information (because it is lawfully made available from federal, state, or local government records) or covered by a federal privacy law, such as the Gramm–Leach–Bliley Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act. The following is a description of practices regarding information collected and describes:

• the information we collect;

• the sources of that information;

• the purposes for which we collect information;

• and whether we disclose that information to external parties.

The General Data Protection Regulation (“GDPR”)

The GDPR is a response to the rapid technological changes since the Data Protection Directive (95/46/EC) was implemented into national law. The GDPR is designed to harmonize data protection law across the EU, and transform the way in which personal data is collected, shared and used globally. Most processing of personal data is subject to the GDPR since there is a connection with EU personal data.

Information We Collect About You

We collect personal information about applicants and contactors through the application and recruitment process, directly from candidates, employment agencies, and screening services or other background-check providers. We may collect additional information from third parties including former employers, credit reference agencies, or other sources that supply employment verification services. We also collect personal information about you during the course of your application process with us. This can be in the form of information you provide directly to us, information we gather from outside parties, or information that we collect automatically about you.

Specifically, we collect the following information:

• Personal Identifiers:

o We collect your personal contact and job-related details such as name, title, and contact information (phone numbers, email address, current and former addresses).

o You provide us with information for background checks.

o We may collect sensitive information such as your date of birth, gender, driver’s license number, nationality/visa status, or passport number to verify your employment eligibility and to provide travel arrangements for you.

o We collect and maintain information about your racial or ethnic origin or sexual orientation if you choose to provide it during the application or onboarding process. We use this information only to support our efforts to attract and maintain a diverse workforce, including reporting required by federal law.

• Health and Biometric Information:

o We collect some information related to biological screenings or testing for controlled substances.

• Protected Classifications:

As listed above under Personal Identifiers:

o We collect your date of birth and gender in order to verify your identity.

o We collect and maintain information about your racial and ethnic origin or sexual orientation if you choose to provide it during the application or onboarding process. We use this information only to support our efforts to attract and maintain a diverse workforce, including reporting required by federal law.

• Commercial Information:

o We do not collect commercial information.

• Biometric Information:

o We do not collect information about your physiological, biological, or behavioral characteristics.

• Internet or Other Electronic Network Activity Information:

o We may use closed circuit cameras to create video records in certain of our offices, which may capture your image from time to time. We, or others acting on our behalf, also may store photographs of you for security purposes and collect records of your use of any access badges issued to you.

• Audio, electronic, visual, thermal, olfactory, or similar information:

o We may store photographs of you for identity verification, and we may record you on building security cameras.

o We do not collect any of your thermal, olfactory or similar information.

• Professional or employment-related information:

o We collect information about your professional and employment-related background through the recruitment and employment application processes (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of your application to work at the company). Background checks may include a criminal record check. Additional checks, such as a driving record or credit report, may be conducted on applicants for particular job categories if appropriate and job related.

o Your file also includes information you provided during the application process, such as your work history, start and separation date, and training records and professional memberships.

• Education information:

o Your file includes information you provided during the application process about the educational institutions you have attended or your level of education.

o We also collect and maintain information about your professional licenses, certifications you receive, or additional education or training.

• Inferences drawn to create a profile:

o We do not create profiles about you reflecting your preferences or characteristics.

How We Use Personal Information About You

We will only use your personal information as permitted by law. Situations in which we use your personal information include:

• Decisions related to your application, including setting your job duties and assessing our staffing needs; assessing your qualifications for roles within the company; determining salary and compensation; and ascertaining your fitness for work.

• Business Purposes, including conducting data analytics studies to review and better understand applicant hiring and response rates.

• Security measures and complying with health and safety obligations, including ensuring the physical safety of our facilities, resources, employees, and other people from threats; preventing fraud and to secure our systems, data, resources, and facilities from unauthorized access or exploitation; monitoring compliance with our IT policies; ensuring network and information security, including preventing unauthorized access to our computer and electronic communications systems, and preventing malicious software distribution; and investigating theft and other illegal activities.

• Compliance with legal obligations, including verifying that you are legally permitted to work in the country(ies) where you are applying to work.

We may use any and all of the information collected for any of the purposes described in this Notice, unless limitations are listed.

Disclosure of Your Personal Information

We may disclose personal information that we collect or you provide as described in this privacy notice:

• To the Company and its affiliates and subsidiaries.

• With service providers, which are companies we use to transmit, collect, process, or store information for us, and which we require to treat the information we share with them as confidential. Service providers may use information we share with them only for the purposes for which we disclose it to them. The categories of service providers that we share information with and the services they provide are:

o Auditing and accounting firms, such as firms that assist us in the creation of our financial records.

o Professional services consultants, such as firms that perform analytics, assist with improving our business, provide legal services, immigration advice, or supply project-based resources and assistance.

o Recruitment vendors that assist with the application process, including assessing candidate qualifications and providing the platform through which candidates submit their candidacy.

o Analytics services, including entities that analyze traffic to and on our website, and assist with identifying and communicating with potential customers.

o Security vendors, such as entities that assist with security incident verification and response, service notifications, and fraud prevention.

o IT vendors, such as entities that assist with website design, hosting and maintenance; data and software storage; and network operation.

• To external parties when required by law or to protect the Company or other persons.

• In the event of a merger or some other corporate event that modifies the structure and organization of Company.

The CCPA defines “selling” personal information as disclosing it to an external party for monetary or other benefit. We do not sell your personal information to any third parties.

Right to Access and Request Deletion of Information

Under the CCPA, we are not obliged at this time to comply with requests from former or current employees or contractors who request access to or deletion of information that was collected and used solely in the context of their role as a former or current employee, job applicant, or contractor.

Under the GDPR, we are obliged to comply with subject access requests from former or current employees or contractors, unless we fall within an exemption.

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure. We use physical, administrative, and technical safeguards to secure personal information.

The storage and processing of information via internet-connected computers can never be completely secure. Although we use industry standard measures to protect your personal information, we cannot guarantee the security of your personal information stored or processed by us.

Transferring Your Personal Information Abroad

Your personal information may be stored and processed in the United States, India, the European Union, the United Kingdom and/or the Philippines. The Company and its affiliates and service providers may also transfer information or provide online access to persons located abroad to information that we collect about you, including personal information, across borders and from your country or jurisdiction to other countries or jurisdictions around the world. These jurisdictions may not have the same data protection laws as your jurisdiction. Wherever your personal information is transferred, stored or processed by us, we will take industry steps to safeguard the privacy of your personal information.

Changes to this Privacy Policy

We reserve the right to update this privacy policy at any time. We also may notify you in other ways from time to time about the collection, use, and disclosure of your personal information.

If you have any questions about this privacy policy, please contact the General Counsel’s Office at generalcounsel@exlservice.com or the EXL’s Human Resources representative in your location at #HR-ERP@exlservice.com.