Job Applicant Privacy Notice

·Job Applicant Privacy Notice

·Last Updated September 16, 2026

• 1.1Information We Collect
• 1.2Information You Provide Directly to Us
• 1.3Information We Collect from Third Parties
• 1.4How We Use Information
• 1.5How We Disclose Information
• 1.6New Owner and Other Corporate Transactions
• 1.7Third-Party Service Providers
• 1.8Public Authorities, Officials, or Others
• 1.9Categories of Personal Information Collected and Disclosed
• 1.10Legal Bases for Processing
• 1.11International Transfers
• 1.12Data Privacy Framework
• 1.13How We Store and Protect Information
• 1.14Your Privacy Choices and Rights
• 1.15Your Choices
• 1.16Your Rights
• 1.17Exercising Your Rights
• 1.18Changes to This Notice
• 1.19Contact Us
• Appendix AAppendix A - Supplemental Notice for Job Applicants in Japan
• 11. APPI Contact Details
• 22. Sensitive Personal Information
• 33. Third-Party Provision and International Transfers
• 44. Additional Rights Under Japanese Law
• 55. My Number

·Thank you for your interest in joining Vercel Inc., including our subsidiaries and affiliates ("Vercel," "we," "our," or "us"). This Job Applicant Privacy Notice ("Notice") applies to job applicants and explains how we collect, use, and share personal information when you apply for a job or are considered for a position with Vercel. Depending on where you apply for a position, we may provide additional information to you relating to the content of this Notice.

·This Notice does not cover the following:

• ·Vercel products and services - For more information about how Vercel collects and uses personal information in delivering our websites, products, and services to customers and users, please see our Privacy Notice.
• ·Vercel employees or contingent workers - For more information about how Vercel collects and uses personal information from Vercel personnel, please contact privacy@vercel.com.

·Information We Collect

·We collect and process personal information for recruitment, interviewing, and hiring purposes as described in this Notice (collectively, "Recruitment Activities").

·Information You Provide Directly to Us

·In addition to the information that we collect when you use our websites, as described in the Privacy Notice, we may collect the following information directly from you as part of our Recruitment Activities:

• ·Academic and professional experience, such as employment history, level of education, skills, certifications, professional affiliations, and other relevant career information you choose to provide;
• ·Work eligibility, such as your eligibility to work in the country where you applied for a job and your start date;
• ·Special or sensitive categories of information, such as your ethnicity and immigration status;
• ·Job preferences, such as your salary expectations, preferred start date, type of work, work location, and other compensation and benefits for the position(s) of interest;
• ·Assessment information, such as information from screenings, interviews, and skills assessments; and
• ·Other information you provide during the recruitment process.

·Information We Collect from Third Parties

·We collect or reference information from publicly available sources (e.g., LinkedIn) or from third parties (e.g., recruiting agencies, former employers, background check providers) to engage in and support our Recruitment Activities. We only use information about you that we receive from third parties for the purposes described in this Notice.

·Personal information that third parties disclose to us may include:

• ·Contact information;
• ·Candidate salary expectations (if provided to them by you);
• ·Academic and professional background information, such as referrals from current and former employees, contractors, and recruiting agencies;
• ·Public information, such as public social media posts; and
• ·Special or sensitive categories of information, such as your criminal background if we conduct a background check (consistent with applicable law).

·How We Use Information

·When you interact with us during our Recruitment Activities, we use your information to carry out our Recruitment Activities, such as in the following ways:

• ·Communicate with you - We use your information to engage with you, including contacting you during the screening and interviewing process and communicating with you through our Recruitment Activities.
• ·Engage in our Recruitment Activities - We use your information to engage with you in providing, operating, monitoring, and maintaining our Recruitment Activities. For example, we need your information to evaluate and verify your application and qualifications for employment, define job roles and responsibilities, conduct interviews and screenings, conduct background and criminal checks (in accordance with applicable laws), check references, prepare and negotiate offers, salaries, and benefits, arrange travel where applicable, or reimburse you for travel expenses, where agreed upon by us.
• ·Provide and improve our Recruitment Activities - We use your information to internally evaluate our recruitment process, analyze how you interact with us during our Recruitment Activities (e.g., if you have previously visited our Careers page to determine the effectiveness of our job postings), gather survey feedback, conduct analytics, and improve your experience and the quality of our Recruitment Activities.
• ·Promote the security of our Recruitment Activities - We use your information to investigate and prevent fraudulent behavior, unauthorized access related to our Recruitment Activities, and other illegal activities by verifying that the information we collect about you is true and accurate, such as for reference checks.
• ·Legal, regulatory, safety and compliance purposes - We use your information to comply with laws or regulations, respond to regulatory, court, or government authority requests when necessary for enforcement or protection against harm, submit reports as required by law, resolve legal disputes, and review compliance with applicable usage terms, such as work eligibility in the country of employment.
• ·Other purposes - If we need to use your personal information for other purposes not described above, we will notify you in advance and ask for your consent.

·How We Disclose Information

·We disclose your personal information to outside parties as required by law and as part of our business practices, as described below.

·New Owner and Other Corporate Transactions

·We provide your information to our affiliates. We may also transfer your personal information to a party unaffiliated with Vercel as part of a merger, acquisition, or sale of all or a portion of our assets.

·Third-Party Service Providers

·We work with service providers, such as skills evaluation providers, software providers, recruiting agencies, background check providers, advisors, and consultants to help us with our Recruitment Activities. Under contract with Vercel, these third parties are authorized to use your personal information only as necessary to provide these services or perform them on our behalf.

·We do not sell or share your personal information to third parties as defined by applicable data protection laws.

·We require third-party service providers acting on our behalf or with whom we disclose your personal information to provide appropriate security measures in accordance with industry standards and in compliance with contractual obligations, their privacy and security obligations, and any other appropriate confidentiality and security measures. However, we are not responsible for the privacy and data security practices of third parties outside of the personal information we transfer to them.

·Certain third-party service provider services used by you may have separate terms and privacy notices that are independent of this Notice. We recommend carefully reviewing the terms and privacy notices of each third-party service, website, and/or application prior to use.

·Public Authorities, Officials, or Others

·We disclose your personal information when disclosure is:

• ·Reasonably necessary to comply with any applicable law, regulation, subpoena, legal process, or enforceable governmental request;
• ·Necessary to enforce this Notice;
• ·Required to enforce our contractual obligations, including investigation of potential violations; or
• ·Necessary to protect against harm to the rights, property, or safety of Vercel, you, or the public as required or permitted by law.

·Categories of Personal Information Collected and Disclosed

·The table below describes the categories of information we have disclosed to third parties for business purposes in the last twelve months.

·Legal Bases for Processing

·If you are an individual from the United Kingdom ("UK"), European Economic Area ("EEA"), or Switzerland, we collect, use, and store your personal information only where we have a legal basis for doing so under applicable laws. The legal basis depends on Vercel's relationship with you and how you choose to interact with us. This means that we collect and use your personal information only:

• ·To fulfill our contractual obligations to you, to the extent such obligations arise in connection with our Recruitment Activities;
• ·On the basis of our legitimate interests in operating our business, including improving and developing our Recruitment Activities, for fraud prevention purposes, and improving your experience;
• ·On the basis of your consent, such as collecting your personal information related to a position for which you are interested in applying; or
• ·As otherwise in compliance with law such as mandatory record keeping obligations.

·When we receive your personal information in the context of a contractual relationship, we will process it only to the extent that we must do so in order to carry out the contract. It will be necessary for us to process your personal information for the purposes of executing a contract if we would not be able to fulfill our contractual obligations without engaging in such processing.

·When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis, and you have the right to object to processing on this basis. To do so, please contact us using the email address in the "Contact Us" section below.

·If we process your personal information based on your consent, the purpose of the processing can be found in the declaration of consent.

·In similar fashion, we often need to process certain personal information in order to meet our legal obligations.

·If you have any questions about the relevant legal basis for processing, please refer to "Your Privacy Choices and Rights" or contact us using the email address in the "Contact Us" section below.

·International Transfers

·If you provide us with your personal information, we may transfer your personal information to other countries. These countries may not have equivalent privacy and data protection laws to the laws of your country. To the extent required by law, we will take measures to protect the cross-border transfer of your information.

·Some of the entities we send your personal information to are located outside of the European Economic Area and the United Kingdom ("UK"). The European Commission (and the UK Secretary of State) have determined that the data protection laws of some countries provide a level of protection equivalent to EU or UK law. You can see here the list of countries that the European Commission has recognized as providing an adequate level of protection to personal data.

·When the GDPR applies to the processing of your personal information, we will only transfer it out of the European Economic Area or the UK to countries that have not been recognized as providing an adequate level of protection to personal information by using appropriate transfer mechanisms such as certification to the Data Privacy Framework or the European Commission approved standard contractual data protection clauses under Article 46.2 of the GDPR.

·Data Privacy Framework

·Vercel complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce (collectively, the "Data Privacy Framework"). Vercel has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal information received from the European Union and the United Kingdom in reliance on the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework. Vercel has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (together with the EU-U.S. Data Privacy Framework Principles, the "Principles") with regard to the processing of personal information received from Switzerland in reliance on the Swiss-U.S. Data Privacy Framework. If there is any conflict between the terms in this Notice and the Principles, the Principles shall govern. To learn more about the Data Privacy Framework Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

·In compliance with the Data Privacy Framework, Vercel commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner's Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the Data Privacy Framework in the context of the employment relationship.

·For transfers of personal information to a third party acting as a controller, Vercel complies with the Data Privacy Framework Notice Principle and Choice Principle. For onward transfers, Vercel is responsible for the processing of personal information it receives under the Principles and subsequently transfers to a third party acting as an agent on its behalf. Vercel remains liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless Vercel proves that it is not responsible for the event giving rise to the damage.

·The Federal Trade Commission has jurisdiction over Vercel's compliance with the Data Privacy Framework.

·In compliance with the Data Privacy Framework, Vercel is obligated to arbitrate claims and follow the terms as set forth in Annex I of the Principles. Job applicants have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding Data Privacy Framework compliance not resolved by any of the other Data Privacy Framework mechanisms. For additional information see Annex I.

·How We Store and Protect Information

·We retain your personal information for as long as necessary for us to perform our Recruitment Activities, comply with legal obligations, resolve disputes, enforce rights, or as necessary for our business purposes, such as updating you on future opportunities or answering any queries in connection with your application.

·We use reasonable and appropriate physical, technical, and administrative safeguards designed to protect your information from unauthorized use, access, loss, misuse, alteration, or destruction. We also require that third-party service providers acting on our behalf or with whom we share your information also provide certain security measures under industry standards.

·Although we have security safeguards in place to protect your information, we cannot guarantee absolute security in all situations. If you have questions about our information security practices, please contact us using the email address in the "Contact Us" section below.

·Your Privacy Choices and Rights

·Your Choices

·Where appropriate or legally required, we describe how we use your personal information, so you can make choices about how your personal information is used. To update your preferences, correct your information, or submit a request to exercise your rights, please contact us using the email address in the "Contact Us" section below.

·When you engage in our Recruitment Activities, you may receive emails or other forms of communication from us. You can opt out of recruiting and event communications by following the unsubscribe instructions included in these emails.

·Unless otherwise explained to you in advance, you are not obligated to provide your personal information to us. If you decide not to provide your personal information, we will not be able to engage in Recruitment Activities with you. You may also request that we withdraw your application for a specific position without deleting your information.

·Your Rights

·Depending on where you are located, you may have certain rights in connection with your personal information. These rights vary depending on your jurisdiction and you may be able to exercise some rights directly on our job application site through your profile or by making choices on communications you receive from us.

• ·Right to Access. You have the right to request access and receive certain information about how we use your personal information and to whom we disclose it.
• ·Right to Rectification. You have the right to request correction of your personal information, where it is proven inaccurate or incomplete.
• ·Right to Objection. You have the right to object at any time to the processing of your personal information based on legitimate interests. Please note that this may impact our ability to provide our employment services to you.
• ·Right to Restriction. You have the right to request that Vercel restrict the processing of your personal information in certain instances and/or restrict further disclosures, such as for certain sensitive information.
• ·Right to Deletion. You have the right to request that we delete your personal information under certain circumstances.
• ·Right to Withdraw Consent. Where you have provided your consent for us to process your personal information, you may withdraw your consent.
• ·Right to Opt-out of the Sale or "Sharing" of Information. We do not "sell" or "share" your personal information to third parties as defined by applicable data protection laws.
• ·Right to Data Portability. You have the right to request a copy of your personal information in a structured, machine-readable format, and to ask us to share this information with another entity.
• ·Right to Limit Use of Sensitive Personal Information. We do not use or disclose sensitive personal information for purposes other than with your consent or as otherwise permitted by law.
• ·Automated Decision-Making: We do not rely solely on automated decision-making technologies for decisions that have legal or similarly significant effects on you.
• ·Right to Non-Discrimination. You have the right to not receive discriminatory treatment for exercising any of your rights. We will not treat you differently for exercising the rights described above.

·Exercising Your Rights

·You can exercise the rights listed above that apply to your jurisdiction by completing this form.

·Withdrawing your consent or objecting to certain processing activities may prevent us from administering the application process. In such instances, we may be unable to continue with the application process as we will not have the personal information necessary for the effective and efficient administration and management of our relationship with you.

·To help protect your privacy and maintain security, we take steps to verify your identity before responding to rights requests. To verify your identity when you make a request, we may ask for information that appears on your application records, such as name and date of birth or photo identification.

·We respond to requests within a reasonable amount of time, depending on your jurisdiction. Your request and choices may be limited in certain cases, for example, if fulfilling your request is not permitted by law or if we have compelling legitimate interests to keep your information.

·Depending on the jurisdiction in which you reside, you may have an authorized agent submit an access request on your behalf. If you wish to use an authorized agent, you must provide the party with written permission signed by you. We may deny a request from an authorized agent if the agent cannot provide your signed permission or other information as reasonably requested by us demonstrating that they have been authorized to act on your behalf.

·To the extent that the above rights apply to you, we encourage you to review this entire Notice to fully understand the choices and rights you may have and work with the Privacy and People teams for any questions or issues. If your issues remain unresolved, you may address any grievance directly with your jurisdiction's relevant supervisory authority.

·Changes to This Notice

·This Notice may be modified at any time and for any reason. You can determine when this Notice was last revised by referring to the "Updated" date at the top of this Notice. We encourage you to review the Notice whenever you interact with our Recruitment Activities to stay informed about our privacy practices and the ways that you can help protect your privacy.

·If we make significant changes to this Notice, we will notify you through our websites or via the email address associated with your application. If you do not agree with the privacy practices disclosed in the Notice, we recommend you stop engaging in our Recruitment Activities.

·Contact Us

·If you have questions or concerns about this Notice, please contact us at privacy@vercel.com.

Appendix AAppendix A - Supplemental Notice for Job Applicants in Japan

·This Appendix applies to job applicants in Japan and to personal information subject to Japan's Act on the Protection of Personal Information ("APPI"). To the extent this Appendix conflicts with the main Notice, this Appendix controls.

11. APPI Contact Details

·For APPI purposes, the business handling personal information is: Vercel Japan K.K., 36-6, Irifune 4-chome, Urayasu-shi, Chiba, Japan, Representative: Reinhard Werner Schwock. Privacy requests and complaints should be directed to: privacy@vercel.com.

22. Sensitive Personal Information

·To the extent Vercel collects sensitive personal information as defined under APPI, Vercel will obtain your prior consent unless an exception under applicable law applies.

33. Third-Party Provision and International Transfers

·Except as permitted by applicable law, Vercel will not provide your personal data to a third party without a lawful basis under the APPI. Where Vercel provides personal data to a third party outside Japan, Vercel will rely on a lawful transfer mechanism under Article 28 of the APPI. Upon request and to the extent required by law, Vercel will provide information regarding the measures taken for overseas transfers and the security control measures applied to personal data stored or handled outside Japan.

44. Additional Rights Under Japanese Law

·In addition to the rights described in the main body of this Notice, you may also request: (a) disclosure of records relating to the provision of personal data to third parties; and (b) cessation of use, deletion, or cessation of third-party provision where the data is no longer necessary, a reportable incident has occurred, or handling is likely to harm your rights or interests. Requests may be submitted to privacy@vercel.com. Vercel may verify your identity and, where applicable, your agent's authority.

55. My Number

·To the extent Vercel collects your Individual Number (My Number) or Specific Personal Information, Vercel will collect, use, retain, and provide it only for purposes permitted by applicable law, including tax, social insurance, and other legally required procedures. My Number will not be used beyond those purposes even with your consent, and will be disposed of when no longer necessary.