Candidate Privacy Notice

Recruitment information, handled deliberately

Effective when Kestrel Careers applications open
Last updated: 4 October 2026

This notice explains how Kestrel Advanced Systems Pte. Ltd. ("Kestrel", "we", "us" or "our") handles personal information about people who apply for employment, internships or other roles with Kestrel. It supplements our general Privacy Policy. It is not an employment contract and does not guarantee an interview, offer or employment.

01Who is responsible

Kestrel Advanced Systems Pte. Ltd., UEN 202644596C, decides why and how candidate information is processed for Kestrel recruitment.

Registered and business address
Blk 31, #01-16C
535 Clementi Road
Singapore 599489

Data Protection Officer
Rai Krish Kumar, Chief Executive Officer
privacy@kestreladvanced.com

Recruitment and accommodation contact
careers@kestreladvanced.com

02Who this notice covers

This notice applies when you view or respond to a Kestrel job advertisement; begin, submit or withdraw an application; communicate with us about a role or accommodation; participate in a recruitment stage; or separately choose to join our talent pool. Applicants must be at least 18 years old.

03Information collected initially

Depending on the role, we collect:

• the selected role or roles and advertised work arrangement;
• your full name and email address;
• city, country or territory, and time zone;
• work-authorisation, sponsorship and start-availability information;
• concise employment, education or equivalent-experience summaries;
• skills, certifications, projects and relevant technical experience;
• answers to structured and role-specific questions;
• optional links to a professional profile, portfolio, publications, GitHub or personal website;
• how you learned about the role;
• your acknowledgement of this notice and the application declaration;
• an optional, separate talent-pool choice; and
• limited security information such as IP address, browser type, timestamps, request identifiers and rate-limit events where necessary to protect the service.

We do not collect a resume, CV or telephone number at the initial stage, and we do not use SMS or WhatsApp for launch recruitment.

04Information not requested initially

Do not submit information that is unnecessary for the application. The initial form does not request a full residential address; date of birth; national identity, passport or Social Security numbers; photographs; bank, tax, payroll or financial information; salary history; medical or disability information; criminal history; protected-trait information; identity or qualification documents; referee details; or confidential material belonging to another person or organisation.

We may request additional information later only where reasonably necessary and lawful for interviews, work-eligibility verification, an accommodation, a conditional offer, a background check or onboarding. We will provide any additional notice or authorisation required by law.

05Why we use candidate information

We use candidate information to receive and secure applications; communicate by email; assess job-related experience, skills and suitability; arrange recruitment stages; determine whether location, work-authorisation and sponsorship requirements can be met; provide accommodations; lawfully verify relevant information; prevent misuse; meet legal and recordkeeping obligations; establish or defend legal claims; prepare an offer or onboarding; maintain the optional talent pool; and produce de-identified recruitment statistics.

Candidate information is not Customer Data. It is not placed in customer workspaces, demonstrations, enterprise audit records, product telemetry or model-training datasets.

06Legal grounds

The applicable legal ground depends on the applicant, role, purpose and law.

In Singapore, Kestrel may rely on consent or deemed consent arising from a voluntary application for purposes reasonably connected with receiving and assessing it, and on applicable statutory exceptions or obligations.

Where European Economic Area or United Kingdom law applies, Kestrel may process information to take steps at your request before an employment contract, to meet legal obligations, or for legitimate interests in a fair, secure and effective recruitment process where those interests are not overridden by your rights. Protected information is processed only where an additional lawful condition applies.

To the extent the California Consumer Privacy Act, as amended, applies, Kestrel processes candidate information for the business purposes in this notice and provides applicable disclosures and rights.

Where consent is the appropriate basis, the optional 24-month talent-pool choice is separate and unticked by default. Applying does not require broad consent to unrelated processing.

07Work location and eligibility

Global-remit and APAC-remit roles are onsite in Singapore. Other roles may be advertised as remote for approved countries in APAC, Europe or North America. "Global" and "APAC" describe role remit and do not themselves authorise work from any country.

Accepting an application does not guarantee that Kestrel can employ or engage a person in every country. Any offer depends on confirmation of a lawful country-specific arrangement. If an advertised work arrangement materially changes during an active application, we will notify the applicant and allow them to continue or withdraw.

08Who receives information

At launch, application access is limited to Rai Krish Kumar. Additional reviewers may be added individually only where necessary and under least-privilege access.

Information may also be processed by Amazon Web Services, which hosts the protected application and transactional-email infrastructure in Singapore; Lark, which provides Kestrel business email and stores Kestrel email data in Japan; authorised legal, privacy, security or professional advisers; and authorities where disclosure is required or permitted by law.

Kestrel does not use an external applicant-tracking system, recruitment AI provider, assessment provider or background-check provider at launch. This notice will be updated before one is introduced.

09International processing

Kestrel is headquartered in Singapore. Applications submitted elsewhere are received and may be accessed in Singapore. Completed applications are delivered to Kestrel's restricted Lark mailbox, configured to store email data in Japan.

Where law requires an international-transfer safeguard, Kestrel will put the required contractual and organisational mechanism in place before accepting covered applications. This may include processor terms, contractual transfer clauses, due diligence and supplementary security measures. Information about applicable safeguards may be requested from privacy@kestreladvanced.com, subject to lawful confidentiality restrictions.

10Security and duplicate prevention

The application channel is designed with encrypted transmission and storage, least-privilege permissions, rate limiting, abuse detection, no file uploads, safe text rendering, restricted logs, and multifactor-protected mailbox access. Application answers are excluded from ordinary application logs.

To prevent repeated submissions across browsers and private-browsing sessions, Kestrel verifies the supplied email address and stores a keyed, non-reversible representation of the normalised address in a minimal application register. This does not prove that two different email addresses belong to the same person, and Kestrel does not use invasive device fingerprinting to make that claim.

No system eliminates every security risk. Please do not provide protected information belonging to another organisation.

11Retention

• Unverified or abandoned applications: 30 days after abandonment.
• Active applications: for the recruitment process.
• Withdrawn or unsuccessful applications: 12 months after closure.
• Optional future-opportunities talent pool: 24 months from the choice or latest candidate-confirmed update.
• Careers security logs: 30 days under the launch configuration.
• Successful applicants: only information needed for onboarding, employment, compliance or legal recordkeeping is transferred to the employee record.

After the applicable period, records are deleted or de-identified, including ordinary mailbox copies and trash, subject to provider backup cycles, legal holds and longer country-specific legal requirements.

12Recruitment AI and automated decisions

Kestrel does not use artificial intelligence to summarise, extract, match, rank, score or reject candidates at launch. We do not use personality inference, emotion recognition or solely automated hiring decisions. Candidate content is not used to train Kestrel models or third-party general-purpose models.

Kestrel will complete a new privacy, employment, bias, security and human-oversight assessment and provide any required notice before introducing recruitment AI or qualifying automated decision-making.

13Sale, sharing and advertising

Kestrel does not sell candidate personal information, share it for cross-context behavioural advertising, or use it to target advertising. Careers and application pages do not use advertising pixels, retargeting technology or session replay.

14California notice at collection

To the extent the CCPA applies, Kestrel may collect identifiers; approximate location; professional, employment and education information; internet or electronic-network activity; job-related assessments made by human reviewers; and limited sensitive information concerning work authorisation or immigration status where relevant.

These categories are used for the purposes in Section 5 and retained under Section 11. Kestrel does not sell or share them for cross-context behavioural advertising. California applicants may exercise applicable rights through privacy@kestreladvanced.com.

15Your privacy rights

Depending on law, you may have rights to request access, correction, deletion, restriction, objection or portability; withdraw consent where processing depends on consent; obtain information about qualifying automated processing; or complain to a competent regulator. Lawful exceptions may apply.

Send requests to privacy@kestreladvanced.com or to the Data Protection Officer at the address in Section 1. We may request information reasonably necessary to verify identity, authority and the relevant application.

16Withdrawal and talent pool

You may withdraw an active application by emailing careers@kestreladvanced.com. You may withdraw a talent-pool choice through privacy@kestreladvanced.com. Withdrawal does not invalidate earlier lawful processing or remove records Kestrel must retain by law, under a legal hold, or to establish, exercise or defend legal claims.

17Other people's information

Do not submit another person's information unless authorised and reasonably necessary. Do not submit trade secrets, source code, confidential business information or protected material belonging to a current or former employer or any other person.

18Contact and changes

Kestrel may update this notice when its recruitment process, vendors, locations, technology or legal obligations change. We will revise the Last Updated date and provide additional notice of a material change where required.

Recruitment and accommodations: careers@kestreladvanced.com
Privacy rights and concerns: privacy@kestreladvanced.com

Kestrel Advanced Systems Pte. Ltd.
UEN 202644596C
Blk 31, #01-16C
535 Clementi Road
Singapore 599489