Legal

Candidates and Job Applicants Privacy Notice

1. Who we are

We respect the privacy rights of individuals and are committed to handling personal information responsibly and in accordance with applicable law. It is important that you read this Candidates and Job Applicants Privacy Notice (“Privacy Notice”) carefully as it sets out how Bullish handles your personal information when you apply for a job or other role with us and the rights you have in connection with that information. The term “applicants” is used in this Privacy Notice to refer to anyone who applies for a job role, or who otherwise seeks to carry out work with or for us (whether on a permanent or non-permanent basis).

If you have any comments or questions about this Privacy Notice, please contact us using the contact details set out in Section 15 below.
Where a law or regulation in the applicable jurisdiction, for example, the EU General Data Protection Regulation (GDPR), requires us to provide you with a notice or other explanation of the information about you that we collect and process or similar, this Privacy Notice is intended to fulfill this obligation.

2. Acceptance to this Privacy Notice

We are committed to protecting your privacy. By submitting your CV, applying for a job or participating in our recruitment process you acknowledge, fully understand and signify your acceptance to the Bullish’s Privacy practices described in this Privacy Notice and how we will process your data.

3. Controller information

The Bullish company to whom you applied for employment determines the means and purposes of processing of your personal information in accordance with this Privacy Notice (usually referred to as a “data controller”). This Privacy Notice applies to Applicants who apply for the Bullish entities listed below, as well as any other Bullish entity that connects to this Privacy Notice:

• Bullish Global – c/o Maples Corporate Services Limited, P.O. Box 309, Ugland House, Grand Cayman KY1-1104, Cayman Islands
• Bullish US Operations, LLC – 1500 Wilson Boulevard, 15th Floor, Arlington, VA 22209
• Bullish Ventures – c/o Maples Corporate Services Limited, P.O. Box 309, Ugland House, Grand Cayman KY1-1104, Cayman Islands
• Bullish Capital – c/o Maples Corporate Services Limited, P.O. Box 309, Ugland House, Grand Cayman KY1-1104, Cayman Islands
• Bullish US LLC – 1500 Wilson Boulevard, 15th Floor, Arlington, VA 22209
• Bullish HK Limited – 31/F, The Centrium, 60 Wyndham Street, Central, Hong Kong
• Bullish SG Pte. Ltd – 1 Keong Saik Road, Singapore, 089109
• Bullish (GI) Limited – Unit No. 2Ab, Leisure Island Business Centre, Ocean Village, GX11 1AA, Gibraltar
• Bullish KY SEZC – c/o Maples Corporate Services Limited, P.O. Box 309, Ugland House, Grand Cayman KY1-1104, Cayman Islands
• BMC1 – c/o Maples Corporate Services Limited, P.O. Box 309, Ugland House, Grand Cayman KY1-1104, Cayman Islands
• BMC2 – c/o Maples Corporate Services Limited, P.O. Box 309, Ugland House, Grand Cayman KY1-1104, Cayman Islands

4. The Personal Information We Collect

Personal Identifiers & Contact Information: such as your title, name, phone number, home address and personal email address.

Job Application Information & Professional or Employment Related Information: such as position applied for, previous roles, job description, responsibilities and assignments, years of service, qualifications and experience, compensation and salary data, membership in professional organizations and professional certifications, eligibility for and participation in benefit schemes and other information contained in your CV/resume.

Educational Information & Qualifications: such as your highest level of education, the schools you attended and when you attended them, degrees, certificates or other educational qualifications, your academic transcripts, and educational references.

Financial Information: such as your desired salary, bonus, benefits and stock or equity grants. You may volunteer your previous salary and/or financial and benefit package as part of the recruitment process but we will not ask for this information.

Background Check Information: We will conduct a background check in connection with your application such as to verify professional and educational history and qualifications, credit worthiness or identify criminal history that may be relevant for a position with us. The background check is conducted once you accept employment at Bullish. The results of the background check may include personal information we do not already have about you.

Nationality, Citizenship and Right to Work Information: such as country of birth, government identification documents (including passports and residency permits) and, where relevant, visa information.

Other Application and Interview Information: any personal information you choose to share with us in your interview or application, CV, resume, transcripts, or other supporting documentation or to help us in the event we need to coordinate travel for an interview.

Equal Opportunity Information & Protected Classifications Under California and U.S. Federal Law: as part of our diversity and inclusion strategy depending on jurisdiction we will monitor and report on gender/gender identity, race, ethnicity, and veteran status when you choose to provide it and where this is applicable. As part of the standard recruitment process outside of the equal opportunity monitoring, we may also collection information related to age, national origin, citizenship, sex, gender identity, gender expression, sexual orientation, religion, disability or accommodation request, or marital status. When you choose to provide any such information it will not be used in the hiring decision, unless specifically permitted by law.

Travel-related Expenses: to the extent incurred during the recruitment process your banking details so that we can reimburse you for such expenses, whenever applicable.

CCTV/Building access control: for the purposes of any visit to a Bullish premises (e.g. for interview), please note that we may deploy CCTV and/or building access controls (which involve the processing of CCTV images and/or other personal information such as visitor name and time of access to the building) for security and law enforcement purposes, to establish, exercise or defend our legal rights and/or to protect the vital interests of any person.

Other information you voluntarily provide throughout the process, including through assessment, exercises, and interviews.

5. How Your Personal Information is Used

We use and process your personal information for certain purposes that align with applicable data protection law in the jurisdiction in which you are located. We use your information:

• to communicate with you about the recruitment process and/or your application(s), including, in appropriate cases, informing you of other potential career opportunities at Bullish.
• where necessary for making hiring decisions;
• to comply with our legal obligations (such as to carry our checks in relation to your right towork);
• to allow us to carry out our legitimate business interests, including:
• business planning and restructuring exercises;
• dealing with legal claims made against us;
• visa application and tax reporting purposes;
• preventing crime and fraud;
• ensuring our administrative and IT systems are secure and robust against unauthorized access except where such interests are overridden by your interests in not having your personal information processed;
• to make improvements to our application and/or recruitment process including improving diversity in recruitment practices; and
• operate and improve our hiring and employment processes.

6. Legal Basis for Processing Your Personal Information

7. Sharing your Personal Information

Personal information is only disclosed to third parties in compliance with this Privacy Notice and applicable law.
When we share your personal information to a third party, we only do so when there’s a need-to-know basis and we require that the third-party:

• Have a legitimate need to know
• Process your personal data only in accordance to our instructions and for the an specific purpose
• Comply with applicable law, implement specific privacy and security measures, and inform us if those procedures fail or cannot be implemented
• Permit us to take reasonable precautions to protect the confidentiality of your personal information and to remedy any unlawful use

In addition, your personal information and other data may be shared with:

• Our employees and affiliates: to operate our business, including our recruitment and human resources functions
• References: you have provided to us during the recruitment process
• Third party service providers: that support our business operations, including:
  • Network, cloud, data, and information technology infrastructure and operations
  • Security
  • Payment and transaction processing and monitoring
  • Customer service and support
  • Identity verification and background check
  • Recruitment and employment
• With our professional advisors who provide banking, legal, compliance, insurance, accounting, or other consulting services in order to complete third-party financial, technical, compliance and legal audits of our operations or otherwise comply with our legal obligations.
• We may also share your details with people or companies if there’s a corporate restructure, merger, acquisition or takeover.
• Other recipients of data can be any person for which you have given us your consent to transfer data.
• Law enforcement, government entities, or crime and fraud prevention services: or other third parties as required to comply with our legal duties, prevent real or prospective fraud, maintain privacy and security, or for similar reasons.

8. Third Party Applications

Our websites and applications (“Applications”) may contain links to third-party applications not affiliated with us. Your use of an external application or any informational content found on external Applications is subject to and governed by the privacy policies, terms, and conditions of that application.

We do not endorse or make any representations or warranties concerning, and will not in any way be liable for, any informational content, products, services, software, or other materials available on external Applications even when those are framed in our own Applications.

While we do review the privacy practices of our Service Providers prior to engaging them to ensure that they meet Bullish Service Provider privacy standards, we ultimately do not control the privacy practices of any external Applications. The Applications may contain links to websites not affiliated with us. Your use of external Applications or any informational content found on external websites is subject to and governed by the privacy policies, terms, and conditions of those websites. We do not endorse or make any representations or warranties concerning, and will not in any way be liable for, any informational content, products, services, software, or other materials available on external Applications even if one or more pages of the external websites are framed within a page of our own Applications.

9. Your Rights

Applicable privacy legislation may entitle you to some or all of the following rights with respect to your Personal Data:

• To access the Personal Data we maintain about you. We will provide you with one copy of your Personal Data free of charge, but we may charge you a reasonable fee to cover our administrative costs if you request further copies of the same information. In the cases we charge a fee, our time to respond to your request starts after we have received the fee.
• To be provided with information about how we process your Personal Data. This will include information on the categories of data, the sources from which it originated, the purpose and legal basis for the processing, the expected retention period, the recipients of your Personal Data, and the safeguards regarding data transfers to other jurisdictions, subject to the limitations set out in applicable laws and regulations.
• To correct your Personal Data. You have the right to ask us to rectify Personal Data you think is inaccurate or incomplete.
• To have your Personal Data erased. You have the right to ask us to delete your Personal Data. If we have shared your Personal Data with a third party in the manner described above, we will require the third party to delete the Personal Data that we have shared with them (consistent with their legal obligations to do so). We will decline your request for deletion if processing your Personal Data is necessary: (i) to comply with our legal obligations such as fraud detection and monitoring, (ii) or being required to perform a task in the public interest; (iii) in pursuit of a legal action; (iv) for exercising the right of freedom of expression and information; and (v) for archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing.
• To object to how we process your Personal Data. Where we process your Personal Data based on our legitimate interest (or that of a third party), you have the right to object to this processing on grounds relating to your particular situation if you feel it impacts on your fundamental rights and freedoms. We will decline your request where we have compelling legitimate grounds for the processing which override your rights and freedoms, or where the processing is in connection with the establishment, exercise or defense of legal claims.
• To stop your Personal Data from being used for direct marketing purposes. At your request, we will stop using your Personal Data for the purpose of direct marketing. Our marketing communications include an unsubscribe facility, which we encourage you to use. If you want to stop us from contacting you in connection with marketing communications, please email us at the email address specified below.
• To restrict how we process your Personal Data. At your request, we will limit the processing of your Personal Data if:
  • you dispute the accuracy of your Personal Data;
  • your Personal Data was processed unlawfully, and you request a limitation on processing, rather than the deletion of your Personal Data;
  • we no longer need to process your Personal Data, but you require your Personal Data in connection with a legal claim; or
  • you object to the processing and no overriding legitimate interest for the processing exists.
• The right to data portability. You have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and to have us transfer your personal information to another controller.
• To withdraw any consent that you gave us to process your Personal Data. You have the right to withdraw any consent you may have previously given us at any time. Your consent withdrawal will not affect the lawfulness of the processing done before the withdrawal.
• To complain to a supervisory authority. If you are not satisfied with our response, you have the right to complain to or seek advice from a supervisory authority and/or bring a claim against us in any court of competent jurisdiction. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.
• Not to be subjected to automated decision making. In some jurisdictions, you have the right not to be subject to a decision based solely on automated processing of your personal information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.

To exercise the above rights, please complete a Data Subject Rights Request Form or contact us at [email protected]. We will consider and process your request within the required period of time. Please be aware that under certain circumstances, or in relation to certain types of data, the applicable legislation may limit your exercise of these rights.

Please note that in some cases, if you do not agree with the way we process your information, it may not be possible for us to continue to operate your account and/or provide certain products and services to you.

It is our policy to respect the rights of individuals. However, please be aware that your exercise of these rights may be subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime); where an overriding legitimate interest for the processing exists (e.g. the maintenance of legal privilege) an; some of these rights may be limited (for example, the right to withdraw consent) where we are required or permitted by law to continue processing your personal data to establish, exercise, and defend our legal rights or meet our legal and regulatory obligations; and for the protection of the rights of another natural or legal person.

10. International Data Transfers

We may transfer your Personal Data to vendors and our offices in countries outside of your jurisdiction for processing in accordance with this Privacy Notice and as permitted by the applicable laws. These locations include, but are not limited to the EU, United States, and Asia-Pacific region. Such intra-organizational transfers are based on approved mechanisms.

Where we rely on our service providers located outside of your jurisdiction and acting as data processors, we ensure that anyone to whom we pass it protects it in the same way we would and in accordance with applicable laws.

In the event we transfer information to countries outside the European Economic Area, we will only transfer data to third parties where one of the conditions below apply:

• The European Commission has decided that the country or the organization we are sharing your information with will protect your information adequately.
• The transfer has been authorized by the relevant data protection authority.
• We have entered into a contract with the organization with which we are sharing your information (on terms approved by the European Commission) to ensure your information is adequately protected.

11. How long we keep your information

We retain Personal Data for the period of time necessary to fulfil the purposes outlined in this Privacy Notice unless a longer retention period is required by law. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

Retention periods may be changed from time to time based on business or legal and regulatory requirements.

We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies or our regulators. This is intended to make sure that the bank will be able to produce records as evidence, if needed.

If you would like more information about how long we keep your information, please contact us at [email protected].

12. Data Security

We have a significant investment in cybersecurity controls, including, but not limited to in-house and external expertise, state of the art technologies and processes. We follow a security by design approach, strengthened by continuous vulnerability and threat management, regular penetration testing, a bug bounty program, ongoing security monitoring and risk management practices.

Procedures have been put in place to deal with any suspected breach of personal information. We will notify you and any applicable regulator of a data breach when we are legally required to do so

13. Do Not Track

Certain web browsers and other devices may permit you to submit your preference for not being “tracked” online, also known as “Do Not Track” or “DNT” signals. Since uniform standards for DNT signals have not been adopted, we do not currently process or respond to “DNT” signals. We will make efforts to monitor developments around “do not track” browser technology and the implementation of a standard.

14. Updates to the Privacy Notice

To keep up with changing legislation, best practices, and changes in how we process your personal data, we reserve the right to revise this Privacy Notice at any time and without notice by posting an updated version on this Website. To stay up to date on any changes, we would therefore encourage you to review this Privacy Notice regularly to stay informed of the purposes for which we process your Personal Data and your rights to control how we process it.

15. Our Role and How to Contact Us

If you have any questions, comments, or complaints, or would like to exercise your rights concerning your Personal Data and privacy preferences, you may use self-service options if they are available to you or contact in the following ways:

• Submit a request through the Bullish Data Subject Rights Request web form.
• Contact us directly at [email protected].
• Alternatively, you may contact our Data Protection Officer (DPO) at [email protected].