Privacy Policy

3.1 The entity responsible for your information

The entity responsible for the personal information described in this Policy — the “controller” under the EU/UK GDPR, the “business” under U.S. state privacy laws, and the “organization” under Canadian privacy law — is:

ExitOpp
1000 S Michigan Avenue
Chicago, Illinois 60605
United States
Email: cam@exitopp.com

Our designated Privacy Officer and, for purposes of Quebec's Law 25, our Person in Charge of the Protection of Personal Information, is Cam at cam@exitopp.com.

3.2 Whose information this Policy covers

• Candidates— professionals who submit contact information, resumes, or other materials to us, or whose professional information we obtain from public or third-party sources, in connection with potential employment opportunities.
• Client and employer contacts— individuals at startups, private equity firms, venture capital firms, and other employers who engage us or discuss engaging us.
• Site visitors— anyone who visits or interacts with our Site.
• Newsletter and marketing subscribers— anyone who subscribes to our email communications.
• References and other third parties— individuals whose contact details are provided to us by a candidate, for example as a professional reference. If you provide us with someone else's information, you confirm you have the right to do so and that you have told them we may contact them.

3.3 What this Policy does not cover

• The privacy practices of employers, clients, or any other third party to whom your information is disclosed as described in this Policy. See Section 10.
• Third-party websites, job boards, recruiting marketplaces, or applications that we link to or that link to us. See Section 23.
• Information that is not personal information, including information that has been aggregated or de-identified so that it can no longer reasonably be linked to you.

4.1 Information you provide directly

• Identity and contact information— your name, email address, telephone number, city, state or province, country, LinkedIn profile URL, and any personal website you share.
• Professional and employment information— your resume or CV, current and prior employers, job titles, dates of employment, industry group and sector coverage, transaction and deal experience, client and project descriptions you choose to share, promotions, and reasons for seeking a change.
• Education and credentials— schools attended, degrees, majors, graduation dates, academic honors, GPA where you volunteer it, professional certifications, and securities or other licenses and registrations.
• Job-search preferences— the types of roles, functions, industries, company stages, and geographies you are interested in; specific employers you are or are not interested in; willingness to relocate or work in a hybrid or remote arrangement; availability and notice period; and your work authorization or visa status.
• Compensation expectations— the compensation you are targeting. We do not ask for, and you should not send us, your current or prior salary history. The Illinois Equal Pay Act (820 ILCS 112/10(b-5)) and comparable laws in other jurisdictions prohibit an employer, employment agency, or its agents from requesting salary history as a condition of being considered for employment. If you volunteer salary history without prompting, we will not consider or rely on it, we will not pass it to an employer, and we will delete it from our records.
• Compensation you enter into our Upside planning tool— our Upside tool asks you to enter your own current compensation so it can model financial outcomes for different career paths. That figure is used only to produce your projection. It is not attached to your candidate record, is never shared with an employer, and is not used to evaluate you for any role.
• Screening and evaluation materials— written answers to screening questions, case or work-sample responses you submit, interview notes, our internal assessments, and feedback we receive about you.
• Reference information— the names and contact details of professional references you provide, and the substance of reference conversations.
• Communications— emails, text messages, messages sent through our Site or third-party platforms, call and meeting notes, scheduling information, and calendar details.
• Marketing preferences— your newsletter subscription status, topic preferences, and communication opt-ins and opt-outs.
• How you came to us— which part of our own site you signed up from, for example the home page or a firm profile, so we know which parts are actually useful. Where a link you followed to reach us carried a campaign tag, we store that tag as well, so we know which of our own posts, newsletters, or partner pages reached you. We do not collect either from any other website, and we never share them with an advertising platform.
• Client and employer information— for our clients and prospective clients: name, business email, telephone number, job title, employer, role requirements and job descriptions, hiring process details, engagement and fee terms, and billing and remittance information.

4.2 Information collected automatically when you use the Site

• Device and connection data— IP address, approximate location derived from IP address (generally city or region level, not precise geolocation), browser type and version, operating system, device type, screen size, and language settings.
• Usage data— pages and content viewed, date and time of access, time spent on pages, links and buttons clicked, scroll depth, form interactions and submissions, referring and exit URLs, and search terms used on the Site.
• Browser local storage— our Upside tool stores a small amount of data in your browser so it can remember your session. See Section 8.
• Email engagement data— whether you opened an email we sent and which links you clicked, collected through tracking pixels and tagged links in our newsletter and outreach emails.

4.3 Information we receive from third parties

• Publicly available professional sources— professional networking profiles such as LinkedIn, firm biography pages, company websites, published deal and transaction databases, press releases, conference materials, and alumni or professional association directories.
• Referrals— information provided by candidates, clients, colleagues, or members of your professional network who recommend you.
• Employers and clients— interview scheduling and feedback, assessment results, offer and rejection status, start dates, and other information about the progress of your candidacy.
• Recruiting marketplaces, applicant tracking systems, and job boards— where you have created a profile, applied to a role, or otherwise made your information available for recruiting purposes, subject to those platforms' terms.
• Service providers— our customer relationship management, email, analytics, and scheduling vendors, which return data about your interactions with our Services.
• Background and reference checks— where you have consented and where permitted by law. We do not order consumer reports or background checks without providing any disclosures and obtaining any authorizations required by the U.S. Fair Credit Reporting Act and comparable state and non-U.S. laws.
• Public registries and regulatory records where directly relevant to a role, such as securities registration status.

If we obtain your information from a third party or a public source and you have not previously been in contact with us, we will tell you where we obtained it in our first communication with you and, in any event, within one month of obtaining it, as required by Article 14 of the GDPR, section 7 of Quebec's Law 25, and PIPEDA's knowledge and consent principle. That communication will explain how to have your information removed. You may also ask us in advance never to source or retain your information through Your Privacy Choices or by emailing cam@exitopp.com; we will add you to a do-not-source suppression list and will not build a record on you.

4.4 Sensitive information

We deliberately limit the sensitive information we collect. We may receive or collect the following, and only for the purposes stated:

• Work authorization and immigration status— because it is necessary to determine whether you are eligible for a role and whether sponsorship is required.
• Voluntary demographic information— where an employer operates a diversity reporting program and you choose to provide it. Providing it is always optional, we hold it separately from evaluative materials where practicable, and we never use it to make or influence an adverse decision about you.
• Accommodation information— if you tell us you need an accommodation in the interview process, we use it only to arrange that accommodation.

We do not collect biometric identifiers or biometric information as those terms are defined by the Illinois Biometric Information Privacy Act (740 ILCS 14/) or comparable laws. We do not use facial recognition, voiceprint analysis, or fingerprint scanning.

Please do not send us sensitive personal information we have not asked for. This includes Social Security numbers or other government identification numbers, dates of birth, financial account or payment card numbers, health or medical information, genetic data, criminal history, precise geolocation, union membership, religious or philosophical beliefs, political opinions, racial or ethnic origin (outside a voluntary demographic program), sex life or sexual orientation, and passwords or account credentials. If you send us unsolicited sensitive information, we may delete it, and we will not use it to evaluate you.

Please also do not send us information that is confidential to your current or former employer, including non-public deal information, client lists, internal financial models, or anything covered by a non-disclosure or confidentiality obligation. You are responsible for ensuring you have the right to share anything you send us.

6.1 With prospective employers and clients

Sharing candidate information with employers is the core of what we do. We share your information with a prospective employer where any of the following applies:

• You have indicated interest in that employer, or in a role or opportunity at that employer;
• You have asked us to represent you, submit you, or introduce you for a role;
• You have otherwise consented to the introduction; or
• You responded to an outreach from us about a specific role at that employer and expressed interest in proceeding.

When we present you to an employer, the information we share typically includes your name and contact details, your resume, a summary of your professional background and transaction or project experience, a summary of your screening answers and stated preferences, your availability, your work authorization status, your compensation expectations, and our written assessment of why we believe you fit the role.

We do not blast your resume to employers you have not agreed to. We do not distribute candidate materials to employers indiscriminately, post them on job boards, or add them to shared industry databases.

6.2 Resume sharing and background previews

Your resume may be shared with an employer when that employer is previewing your background in connection with a role in which you have indicated interest. Your resume and related materials are also reviewed internally by ExitOpp when we are previewing your background in order to assess which opportunities may be a fit, to prepare you for a process, and to decide whether to recommend you.

Where practicable, we will tell you before we submit your materials to a named employer. In some cases we may first share a blinded or de-identified summary of your background — for example, “a Senior Associate at a bulge-bracket bank with four years of healthcare M&A experience” — without your name or current employer, so that an employer can indicate interest before you are identified. You may ask us at any time to use a blinded preview by default, or to seek your explicit approval before each submission, through Your Privacy Choices or by emailing cam@exitopp.com.

6.3 With service providers and processors

We share personal information with vendors that perform services on our behalf, in the following categories:

• Cloud hosting, databases, and file storage
• Applicant tracking systems, recruiting marketplaces, and candidate relationship management platforms
• Email, calendaring, video conferencing, and document collaboration
• Email marketing and newsletter delivery
• Website hosting, analytics, and performance monitoring
• Electronic signature, scheduling, and transcription tools
• Payment processing, invoicing, accounting, and bookkeeping
• Security, backup, fraud prevention, and IT support
• Legal, accounting, insurance, and other professional advisors

Vendors in the categories above — other than recruiting marketplaces — act as our service providers or processors. They are contractually restricted to using your information only to perform services for us and only in accordance with our instructions. Where required, we enter into service provider, processor, or data processing agreements containing the terms mandated by applicable law, including the U.S. state privacy laws described in Section 15 and Article 28 of the GDPR.

Recruiting marketplaces act as independent third parties or independent controllers for some purposes and handle data under their own privacy policies. See Section 23.

We do not sell personal information to, or permit it to be used to train, general-purpose artificial intelligence or large language models, and where our agreement with a vendor allows us to do so, we opt out of any use of your personal information to train that vendor's models.

6.4 For legal, safety, and compliance reasons

We may disclose personal information where we believe in good faith it is necessary to: comply with applicable law, regulation, legal process, subpoena, or governmental request; enforce our agreements and terms; investigate, prevent, or take action regarding suspected fraud, security incidents, or illegal activity; or protect the rights, property, or safety of ExitOpp, our candidates, our clients, or the public. Where we are legally permitted to do so, we will notify you before disclosing your information in response to compelled legal process.

6.5 In connection with a corporate transaction

If ExitOpp is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, personal information may be transferred to the counterparty or successor as part of that transaction or its due diligence, subject to customary confidentiality protections. We will seek to require the recipient to honor this Policy with respect to information transferred and, where we remain able to do so, we will provide you with notice and, where required by law, a choice before your information becomes subject to a materially different privacy policy.

6.6 At your direction

We share information with others when you ask us to — for example, when you ask us to introduce you to a specific person, forward your materials, or coordinate with a third party on your behalf.

6.7 Aggregated and de-identified information

We may create and share aggregated or de-identified information — such as compensation benchmarks, hiring trend data, or market reports — that cannot reasonably be used to identify you. We maintain such information in de-identified form, will not attempt to re-identify it, and will contractually obligate recipients not to attempt re-identification.

8.1 What we use

• Strictly necessary cookies— required for the Site to function, to route traffic, and to protect against fraud and abuse. These cannot be switched off through our Site.
• Analytics and performance technologies— help us understand how visitors find and use the Site. Our analytics provider sets no cookies and does not store your IP address.
• Browser local storage— remembers your preferences and settings within our Upside tool. It stays in your browser and is not transmitted to advertising platforms.
• We use no advertising or targeting technologies. There are no advertising pixels, tags, or cross-site identifiers on the Site.

8.2 Your controls

• Your Privacy Choices.The “Your Privacy Choices” link in the footer of every page of our Site takes you to a single page where you can opt out of targeted advertising and sale or sharing, limit our use of sensitive personal information, and submit any other privacy request.
• Cookie banner. We do not set non-essential cookies, so there is no consent banner to present. If that changes we will present one before setting any.
• Global Privacy Control. We recognize and honor the Global Privacy Control (GPC) and other browser- or device-level universal opt-out signals as a valid opt-out of sale, sharing, and targeted advertising for the browser or device transmitting the signal. A browser sending GPC receives no analytics. Because these signals are not tied to your identity, you may also submit a request as described in Section 15.3 to have your opt-out applied across all of your interactions with us.
• Browser settings. Most browsers let you block or delete cookies and clear local storage. Blocking strictly necessary cookies may cause parts of the Site to stop working.
• Email tracking. You can disable remote image loading in your email client to limit open tracking.

8.3 Do Not Track

There is no common industry standard for responding to browser “Do Not Track” signals, and we do not currently respond to them. We do honor the Global Privacy Control as described above.

9.1 Recruiting and service communications

If you are an active candidate or client contact, we will send you communications about roles, scheduling, feedback, and the status of a process. These are service communications rather than marketing, and they are part of the service you asked us to provide. You can stop them at any time by telling us you no longer wish to be contacted or by asking us to withdraw you from consideration.

9.2 Newsletter and marketing

• Unsubscribing. Every marketing email includes an unsubscribe link. You may also email cam@exitopp.comwith the subject line “Unsubscribe.” We honor unsubscribe requests promptly and, in any event, within the period required by law.
• United States (CAN-SPAM). Our commercial emails identify ExitOpp, include a valid physical postal address, do not use deceptive subject lines or headers, and provide a functioning opt-out.
• Canada (CASL).We send commercial electronic messages to Canadian recipients only where we have express or implied consent as defined by Canada's Anti-Spam Legislation. Each message identifies us, provides our contact information, and includes an unsubscribe mechanism that remains valid for at least 60 days and that we action within 10 business days.
• EEA, UK, and Switzerland.We send marketing emails on the basis of your consent, or on the basis of the limited “soft opt-in” where permitted, and you may withdraw consent at any time without affecting the lawfulness of prior processing.

9.3 Text messages and calls

We send text messages only to individuals who have provided a mobile number for recruiting purposes and have not objected. Message and data rates may apply. Reply STOP to any message to opt out and HELP for assistance. We maintain an internal do-not-call and do-not-text suppression list and honor the U.S. National Do Not Call Registry where applicable. We do not use automatic telephone dialing systems or prerecorded voice messages for marketing without prior express written consent as required by the Telephone Consumer Protection Act.

9.4 Suppression records

If you unsubscribe or ask us not to contact you, we retain the minimum information necessary — a one-way cryptographic hash ofyour email address or phone number, not the address itself — on a suppression list so that we do not contact you again. This means the list of people who have asked not to be contacted cannot be read, only checked against. This is a legal requirement in several jurisdictions and is in your interest. We do not use suppression records for any other purpose.

14.1 Rights we extend to everyone

Regardless of where you live, and whether or not a particular privacy statute applies to you, ExitOpp will honor the following requests:

• Access— ask us what personal information we hold about you and receive a copy.
• Correction— ask us to correct information that is inaccurate or incomplete.
• Deletion / removal from our databases— ask us to remove your data from our databases.
• Withdrawal from consideration— ask us to stop presenting you to employers generally, or to a specific employer.
• Restriction of sharing— ask us to obtain your explicit approval before each submission, or to use blinded previews.
• Opt out of marketing— unsubscribe from newsletters and marketing communications.
• Opt out of targeted advertising and analytics — see Section 8.
• Portability— receive your information in a portable, machine-readable format where technically feasible.

14.2 How to make a request

Use our Your Privacy Choices page at exitopp.com/privacy-choices. This is the fastest and most reliable route. Choose what you want, confirm your email address through the link we send you, and the request is logged and processed automatically. You will receive a reference number and email confirmation at each stage, and you can check the status of your request at any time.

Or email cam@exitopp.comwith the subject line “Privacy Request,” or “Data Deletion Request” for a deletion. Email requests are routed into the same tracked system as web requests, so they are subject to the same deadlines and the same audit trail. Tell us your full name and the email address and phone number you used with us.

Or write to us at ExitOpp, Attn: Privacy, 1000 S Michigan Avenue, Chicago, Illinois 60605, USA.

We will acknowledge your request immediately, by email. We will then complete it:

• within 45 days where a U.S. state privacy law applies, extendable once by a further 45 days where the request is complex or we receive a high volume of requests, with notice to you within the initial period;
• within 30 days where PIPEDA or Quebec's Law 25 applies; and
• within one month where the EU or UK GDPR applies, extendable by up to two further months for complex requests, with notice to you within the first month.

In practice most requests are finished within seconds of you confirming your email address. We do not charge for responding to requests. We may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded, excessive, or repetitive, or where an applicable U.S. state law permits a fee for more than two requests in a 12-month period. We will explain our reasoning if we do.

14.3 Verification

To protect you, we must verify your identity before acting on a request. For requests made through our Your Privacy Choices page, we send a single-use link to the email address the request concerns and act only once you open it; control of that mailbox is the verification. For requests that reach us by email or post, or where we have reason to doubt a request, we may also ask you to confirm two or more data points we already hold. We use information you provide for verification only for that purpose and delete it afterward. If we cannot verify your identity, we will tell you and explain what we would need.

14.4 What “deletion” means, and what we may keep

When we act on a deletion request, we delete your candidate profile, resume, screening materials, notes, and contact records from our active databases and instruct our service providers to do the same. Because complete erasure is not always possible or lawful, we may retain the following:

• Information that a prospective employer has already received. We cannot retrieve it. See Section 10.
• Placement, engagement, invoice, and fee records where you were placed, as required for tax, audit, contract, and legal-claims purposes.
• The minimum suppression record necessary to ensure we do not re-contact you or re-add you to our database from a public source. As described in Section 9.4, this is a one-way hash rather than your address itself.
• Information subject to a legal hold, subpoena, regulatory inquiry, or pending or reasonably anticipated legal claim.
• Information needed to detect and prevent fraud or security incidents, and security and audit logs.
• De-identified or aggregated information that can no longer be linked to you.
• Information contained in routine backups, which are overwritten on a rolling cycle; deleted data in backups is not restored to active systems.
• Email and message archives, which we retain for our general business records period. On request, we will search those archives and purge your resume and related materials from them, and we will never use archived material to re-add you to our active database.
• Anything else that a statutory exception permits us to retain.

We will tell you if we rely on an exception and which one.

14.5 No retaliation

We will not discriminate or retaliate against you for exercising any privacy right. Exercising a right will not, by itself, affect whether we represent you or present you to employers. We note honestly that if you ask us to delete your data entirely, we will no longer have the information needed to consider you for opportunities — that is a practical consequence of the request, not a penalty.

14.6 If you are unhappy with our response

Please tell us first at cam@exitopp.com so we can try to resolve it. You also have the right to complain to a regulator; see Section 26.

15.1 States covered

The following U.S. states have comprehensive consumer privacy laws in effect: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Iowa, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Additional states have enacted laws that take effect in 2027 and later. Nevada, Washington, and Connecticut also have specific laws governing consumer health data.

These laws apply to businesses that meet certain thresholds. Whether or not ExitOpp currently meets the threshold in your state, we extend the substantive rights described below to residents of every U.S. state. We do so voluntarily and this does not constitute an admission that any particular statute applies to us.

15.2 Your rights

• Right to know / access— confirm whether we process your personal information and obtain a copy, along with the categories we collect, the sources, our purposes, and the categories of third parties we disclose to.
• Right to correct— have inaccurate personal information corrected.
• Right to delete— have your personal information deleted, subject to the exceptions in Section 14.4.
• Right to data portability— obtain your information in a portable and, where technically feasible, readily usable format.
• Right to opt out of targeted advertising— direct us to stop processing your information for targeted or cross-context behavioral advertising. We do not do this today (Section 7), and we will record your request so that it binds us if that ever changes.
• Right to opt out of sale— we do not sell personal information. You may submit this request and we will honor it.
• Right to opt out of profiling— opt out of profiling in furtherance of decisions producing legal or similarly significant effects, and in some states to question the result of profiling and request that it be re-evaluated by a person. We do not make decisions about you through profiling (Section 19).
• Right to limit use of sensitive personal information— restrict our use of sensitive personal information to what is necessary to provide the service. We already limit our use of sensitive information as described in Section 4.4 and do not use it to infer characteristics about you.
• Right to appeal — appeal a denial of any request. See Section 15.4.
• Right to non-discrimination— not be discriminated against for exercising these rights.
• Right to consent— in most states, we must obtain your consent before processing sensitive personal information; in Utah and Iowa, you have the right to opt out instead. In Maryland, the sale of sensitive personal information is prohibited outright, and we do not sell it.

15.3 How to exercise your rights

• Use the “Your Privacy Choices” link in the footer of every page of our Site, or go directly to exitopp.com/privacy-choices. Every right described in this Section can be exercised there, and requests submitted through that page are verified and processed automatically.
• Email cam@exitopp.comwith the subject line “Privacy Request” and tell us which right you wish to exercise and the state you reside in.
• Opt out of targeted advertising or sale by enabling the Global Privacy Control in your browser or through the Your Privacy Choices page. No account or verification is required to opt out.
• Authorized agents. You may use an authorized agent to submit a request on your behalf. We will ask the agent for written proof of authorization signed by you, and we may ask you to verify your identity directly and to confirm that you gave the agent permission. An agent acting under a valid power of attorney need not provide separate written authorization.

15.4 Appeals

If we decline your request, we will tell you why. You may appeal by replying to our response or emailing cam@exitopp.comwith the subject line “Privacy Appeal.” We will review the appeal and respond in writing within 45 days (or 60 days where your state allows and we notify you of the extension), explaining the reasons for our decision. If we deny your appeal, we will provide you with a method to contact your state Attorney General to submit a complaint.

15.5 Additional disclosures for California residents

• Notice at collection. The categories of personal information we collect, our purposes, our retention periods, and the categories of third parties to whom we disclose are described in Sections 4, 5, 6, and 11 and summarized in Appendix A.
• Sale and sharing. In the preceding 12 months we have neither sold nor shared personal information for cross-context behavioral advertising.
• Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by CCPA section 1798.121(d), and therefore the right to limit is not triggered. We honor limitation requests regardless.
• Financial incentives. We do not offer financial incentives or price or service differences in exchange for personal information.
• Shine the Light.California Civil Code section 1798.83 permits residents to request information about disclosures of personal information to third parties for those parties' direct marketing purposes. We do not make such disclosures.
• Minors. California Business and Professions Code section 22581 gives California residents under 18 the right to request removal of content they posted. We do not host user-posted content, but we will honor any such request at cam@exitopp.com.
• Data broker status. We are not a data broker under California Civil Code section 1798.99.80 and the California Delete Act. The definition reaches businesses that knowingly collect and sell personal information about consumers with whom they do not have a direct relationship. We collect candidate information in order to provide a recruiting service to that candidate, we contact anyone whose information we source from a public source and give them a direct route to have it removed (Section 4.3), and we do not disclose candidate information to advertising platforms.
• Employment applicants.California's employment-related exemptions expired on January 1, 2023. Candidates are treated as consumers with full rights under this Section.

15.6 Additional disclosures for other states

• Colorado, Connecticut, Delaware, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Maryland, and California — we recognize universal opt-out mechanisms including the Global Privacy Control.
• Minnesota— you additionally have the right to obtain a list of the specific third parties to which we have disclosed your personal data, and the right to question the result of profiling. This list is included automatically in the copy of your information you receive through our Your Privacy Choices page.
• Oregon— you additionally have the right to obtain a list of specific third parties to which we have disclosed your personal data. This list is included automatically in the copy of your information you receive through our Your Privacy Choices page.
• Connecticut— effective July 1, 2026, you additionally have the right to obtain a list of the specific third parties to which we have sold your personal data, and the right to question, be informed of the reasoning behind, and request re-evaluation of a covered automated profiling decision. Connecticut also treats Social Security, driver's license, passport, and financial account numbers as sensitive data; we do not collect them.
• Texas— we do not sell sensitive personal data or biometric personal data, so the notices required by Texas Business & Commerce Code section 541.102(b)–(c) do not apply to us. We disclose your work authorization status to a prospective employer only where necessary to evaluate your eligibility for a role in which you have indicated interest.
• Nevada— we do not sell covered information as defined by Nevada Revised Statutes Chapter 603A.
• Washington and Nevada consumer health data— we do not seek consumer health data. The only health-related information we may hold is information you volunteer about an interview accommodation, which we use solely to arrange that accommodation, never disclose to an employer without your instruction, do not sell or share, and delete when the process ends. To the extent the Washington My Health My Data Act or Nevada SB 370 applies to that information, we process it with your consent, which you may withdraw at any time.
• Illinois— we do not collect biometric identifiers or biometric information under the Biometric Information Privacy Act (740 ILCS 14/), and we comply with the Illinois Personal Information Protection Act (815 ILCS 530/) regarding safeguards and breach notification.

15.7 Metrics

Where a state law requires businesses of a certain size to publish annual request metrics, we will publish those metrics on the Site. As of the effective date of this Policy, we are not required to do so.

16.1 Accountability

Our designated Privacy Officer and, for Quebec purposes, our Person in Charge of the Protection of Personal Information, is Cam, reachable at cam@exitopp.com or at 1000 S Michigan Avenue, Chicago, Illinois 60605, USA. This individual is accountable for our compliance with Canadian privacy law and will respond to your questions and complaints.

16.2 Consent

• We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise.
• Consent may be express — for example, when you submit your resume and ask us to represent you, or when you subscribe to our newsletter — or implied from your actions and the obvious purpose, for example when you send us an email with your professional details.
• We seek express consent for sensitive personal information and for disclosures of your resume and candidacy to a named employer.
• You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. We will explain the consequences of withdrawal. Withdrawing consent will generally mean we can no longer represent you.
• We do not require you to consent to collection, use, or disclosure beyond what is necessary to provide the service as a condition of providing that service.

16.3 Your rights

• Access— request access to your personal information and information about how it has been used and to whom it has been disclosed.
• Correction— challenge the accuracy and completeness of your information and have it amended.
• Withdrawal of consent and deletion — as described in Section 14.
• Complaint— to us in the first instance, and then to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

16.4 Additional rights under Quebec Law 25

• Portability— receive the computerized personal information you provided to us in a structured, commonly used technological format, and have it transferred to a third party where technically feasible.
• De-indexing and cessation of dissemination— request that we cease disseminating your personal information or de-index any hyperlink providing access to it where dissemination contravenes the law or a court order, or where the conditions in section 28.1 are met.
• Automated decision-making— be informed if a decision about you is based exclusively on automated processing, and to obtain the reasons and principal factors, and to submit observations to a person who can review the decision. As described in Section 19, we do not make such decisions.
• Confidentiality by default— our technological products and services are configured to provide the highest level of confidentiality by default.
• Privacy impact assessments— we conduct assessments before transferring personal information outside Quebec and before implementing new information system projects involving personal information.
• Incident register— we maintain a register of confidentiality incidents for 5 years.

16.5 Storage and transfer outside Canada

Your personal information is stored and processed in the United States, and may be accessed by our service providers in the United States and other countries. As a result, it may be subject to the laws of those jurisdictions, including lawful access requests by courts, law enforcement, and national security authorities in those countries. Before transferring personal information outside Quebec, we conduct a privacy impact assessment and take reasonable steps, including contractual protections, to ensure the information receives protection equivalent to that afforded under Quebec law. You may contact cam@exitopp.com for more information about our policies and practices regarding service providers located outside Canada.

17.1 Controller

ExitOpp, 1000 S Michigan Avenue, Chicago, Illinois 60605, USA, cam@exitopp.com, is the controller of your personal data. ExitOpp has no establishment in the European Economic Area or the United Kingdom.

Representative. Article 27 of the EU GDPR and Article 27 of the UK GDPR require a controller established outside those territories to designate a representative there, unless the exemption in Article 27(2)(a) applies. ExitOpp relies on that exemption and has not designated a representative. We do so on the basis that our processing of the personal data of individuals in the EEA and the UK is occasional rather than systematic; does not involve large-scale processing of special category data under Article 9(1) or of criminal conviction and offence data under Article 10; and is unlikely to result in a risk to the rights and freedoms of individuals, given that it concerns professional information voluntarily provided by senior professionals for the purpose of considering career opportunities.

We keep this assessment under review. If our handling of EEA or UK candidate data becomes regular or systematic rather than occasional, we will designate EU and UK representatives and publish their details in this Section.

You may contact us directly at cam@exitopp.com about any matter relating to our processing of your personal data, and you retain every right described in Section 17.3 regardless of whether a representative has been designated.

17.2 Legal bases

The legal bases on which we rely are set out in the table in Section 5. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you may object as described below.

17.3 Your rights

• Access— obtain confirmation of whether we process your data and a copy of it, together with the information set out in Article 15.
• Rectification— have inaccurate data corrected and incomplete data completed.
• Erasure— have your data deleted where one of the Article 17 grounds applies.
• Restriction— have processing restricted while a dispute about accuracy or legitimate interests is resolved.
• Portability— receive data you provided to us in a structured, commonly used, machine-readable format and transmit it to another controller.
• Objection— object at any time to processing based on legitimate interests, on grounds relating to your particular situation. You may object to direct marketing at any time, for any reason, and we will stop.
• Withdrawal of consent— at any time.
• Automated decisions— not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. See Section 19.
• Complaint— lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In the UK, the Information Commissioner's Office (ico.org.uk). In Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch). A list of EEA authorities is available at edpb.europa.eu.

17.4 Providing your data

You are not under a statutory or contractual obligation to provide us with your personal data. However, if you do not provide the professional information described in Section 4.1, we will not be able to evaluate you for roles or represent you to employers.

17.5 Special category data

We do not seek to process special category data (Article 9 GDPR). Where you voluntarily provide it — for example, health information relating to an accommodation request, or demographic information for a diversity program — we process it on the basis of your explicit consent (Article 9(2)(a)), or where necessary for the establishment, exercise, or defense of legal claims (Article 9(2)(f)). You may withdraw that consent at any time.

17.6 Retention

Retention periods are set out in Section 11. Where no specific period is stated, we determine the period by reference to the purpose, the sensitivity of the data, the risk of harm from unauthorized use, and applicable legal requirements.

24.1 No employment guarantee

Submitting information to ExitOpp does not create an employment relationship, an agency relationship, or any obligation on our part to present you to an employer, to secure an interview, or to obtain an offer for you. We may decline to represent any candidate, or to submit any candidate to any employer, in our sole discretion. ExitOpp is not the employer for any role we discuss with you, and we do not control any employer's hiring decisions.

24.2 Not a contract

This Policy is a disclosure of our practices provided to satisfy legal notice requirements and in the interest of transparency. It is not a contract, does not form part of any contract of employment or engagement, and does not create any rights, warranties, or obligations beyond those imposed by applicable law — except for the commitments we make voluntarily in Sections 14.1 and 15.1, which we will honor as stated. It does not create third-party beneficiary rights.

24.3 Governing law

This Policy and any dispute arising from it are governed by the laws of the State of Illinois and the federal laws of the United States, without regard to conflict of laws principles. Nothing in this Section limits any right you have, or any obligation we have, under the mandatory privacy or consumer protection law of your own jurisdiction, including the GDPR, PIPEDA, Quebec Law 25, and U.S. state privacy laws.

24.4 Severability

If any provision of this Policy is held to be invalid or unenforceable, that provision will be modified to the minimum extent necessary or severed, and the remaining provisions will continue in full force.

24.5 Language and accessibility

This Policy is provided in English. If we provide a translation and there is a conflict, the English version controls except where applicable law requires otherwise. If you need this Policy in an alternative accessible format, contact cam@exitopp.com and we will provide one at no cost.