Privacy Notice

Momentum Spark Pte. Ltd. (“KitaHQ”, “we”, “us” or “our”), at 73 Ayer Rajah Crescent, #01-24, Singapore 139952, respects your privacy. This Notice explains how personal data is handled when you visit the KitaHQ website, use a KitaHQ business account, or participate in a recruitment process supported by KitaHQ.

KitaHQ’s role depends on the activity. We decide how and why we process website, account, security and support data. When an employer uses KitaHQ to process candidate information for recruitment, the employer normally decides the recruitment purpose and KitaHQ processes the information on the employer’s documented instructions. KitaHQ remains responsible for duties that apply to its own activities and role.

‍

1. Who this Notice covers

This Notice covers three audiences:

Candidates‍

People invited by an employer to submit a CV, complete an AI video interview or other assessment, or otherwise participate in a recruitment process supported by KitaHQ.

Recruiters and employer users

People who create or use a KitaHQ business account, configure recruitment workflows, review candidate information or contact KitaHQ about the service.

Website visitors

People who visit kitahq.com, submit a form, request a demonstration or contact us.

Customer contracts, including an applicable Order Form, Master Services Agreement and data-processing terms, may contain additional provisions for employer customers. Those documents govern the customer relationship where they apply.

‍

2. Personal data we process

The information we process depends on how you interact with KitaHQ.

Candidate data

We may process:

- identity and contact details, including name, email address and telephone number;

- CV, employment history, education, skills, qualifications and other application information;

- documents or portfolio materials submitted by the candidate or employer;

- interview video, audio, transcript and written or spoken responses;

- recruiter-configured job requirements, interview questions and assessment criteria;

- criteria-alignment scores, criteria-alignment rankings, summaries, observations and candidate or interview reports generated from submitted information;

- recruitment workflow events, invitation status and candidate stage information;

- device, browser, connection and diagnostic information needed to deliver or troubleshoot the interview; and

- communications and support requests.

Recruiter and employer-user data

We may process:

- name, business contact details, employer and role;

- account credentials and authentication records;

- job, interview, assessment and workflow configurations;

- candidate stage updates, workflow actions and communications;

- contract and account-administration information; and

- service, security, usage and support records.

Website-visitor data

We may process:

- information submitted through Webflow or other website forms;

- name, business contact details, employer and message content;

- IP address, browser, device, referral source and pages viewed; and

- analytics and cookie-related information described in our Cookie Policy.

Please do not submit information that is unnecessary for the relevant recruitment or support purpose.

Sources and required information

Candidate information comes from the candidate and the hiring employer. KitaHQ generates transcripts, criteria-alignment scores, criteria-alignment rankings, summaries and reports from those inputs. Recruiter-account information comes from the employer user and the employer; website information comes from the visitor, their device and the website technologies described in the Cookie Policy.

Information marked required is needed for the recruitment step or service function configured by the employer. If it is not supplied, that step or function may not be available. Other information is optional. A person may contact privacy@kitahq.com to ask about KitaHQ processing or available limits; accommodation, alternative-process and application questions should use any employer contact provided in the invitation or related email, or the original application channel.

‍

3. How we use personal data

Depending on the relationship and applicable law, we process personal data to:

- provide and operate KitaHQ’s website and recruitment services;

- create and secure recruiter accounts;

- deliver candidate invitations, reminders and interview experiences;

- receive and organize CVs, documents and interview responses;

- transcribe candidate responses and evaluate them against recruiter-configured, job-related criteria;

- generate AI-assisted criteria-alignment scores, criteria-alignment rankings, summaries, assessments and reports for recruiter review;

- support employer-configured workflow actions, including invitations, reminders, manager-interview invitations and requests for an authorised recruiter to review a candidate when configured conditions are met;

- allow recruiters and hiring managers to inspect recruitment evidence and AI-assisted assessments; KitaHQ does not automatically reject candidates, and an authorised recruiter must confirm any rejection or other adverse progression decision;

- provide technical support and investigate service issues;

- protect the service, detect abuse and maintain audit and security records;

- understand website and service usage and improve reliability; and

- meet legal, regulatory, tax, accounting and contractual obligations.

To provide and support the recruitment service, KitaHQ may contact candidates using the contact details associated with their invitation or application. Contact may include technical assistance, service-related notices, security or privacy communications, and responses to candidate requests.

KitaHQ does not use candidate data, including interview content, to train KitaHQ or third-party AI models.

‍

4. AI-assisted processing and human decisions

KitaHQ uses AI to support transcription and evaluation of candidate-provided information against recruiter-configured criteria. Outputs may include summaries, criteria-alignment scores, criteria-alignment rankings, assessment narratives and interview reports for recruiter review.

Criteria-alignment rankings indicate alignment with recruiter-configured criteria and provide decision support for recruiter review. Employers control their criteria and workflow rules. KitaHQ does not automatically reject candidates, and an authorised recruiter must confirm any rejection or other adverse progression decision.

Employers may configure workflow rules that create invitations, reminders, manager-interview invitations or review requests when specified conditions are met. KitaHQ does not automatically reject candidates. An authorised recruiter must confirm any rejection or other adverse progression decision after reviewing relevant candidate evidence. The employer remains responsible for its criteria, the confirmed decision, required notices and any review or reconsideration, while KitaHQ remains responsible for duties that apply to its role.

KitaHQ processes video and audio to deliver configured interviews, and those inputs can incidentally reveal personal characteristics. KitaHQ evaluates the content of candidate answers against recruiter-defined, job-related criteria. The assessment is not designed to evaluate appearance, facial expressions, gaze or eye movement, inferred emotions, gender, age, race, accent, voiceprints or vocal tone. Speech-recognition performance may vary with audio quality, language and accent, so reviewers should consider the candidate’s underlying answers and relevant context. Candidates who need an accommodation, correction, review or alternative route should use the employer contact provided in the invitation or related email, or the original application channel. Technical problems can be reported to support@kitahq.com.

Before starting an AI video interview, candidates will receive this explanation: “How AI is used: KitaHQ transcribes your recorded answers and evaluates their content against recruiter-configured, job-related criteria. It may create a transcript, criteria-alignment scores or rankings, summaries and an interview report for recruiter review. The hiring employer controls the criteria and makes recruitment decisions.” Candidates will then be asked to acknowledge: “I have read the Candidate Privacy Notice and understand that this interview will be recorded and that AI will assist with transcription and assessment of my answers against recruiter-configured, job-related criteria.” The interview cannot start until the existing required checkbox is selected. A separately reviewed explicit-consent variant will be used only where an applicable deployment requires it.

‍

5. Legal grounds and employer responsibility

The basis for processing depends on KitaHQ’s role and the law that applies:

- Employer-led recruitment: the employer determines and communicates its lawful basis for collecting and assessing candidate information. KitaHQ normally processes that information under the employer’s documented instructions.

- Recruiter account and service administration: KitaHQ processes account and configuration information to perform the customer relationship and operate the requested service.

- Website forms and requests: KitaHQ processes submitted information to respond to the request, take requested pre-contract steps or pursue the legitimate interest in communicating with a business contact, where that basis is available under applicable law.

- Website measurement: where prior consent is required, KitaHQ activates Google Analytics 4, Microsoft Clarity and Google Ads conversion measurement only after the visitor accepts non-essential technologies. Essential website technologies remain available when non-essential technologies are rejected.

- Security and legal compliance: KitaHQ processes necessary records to protect the service and comply with applicable legal obligations or legitimate security interests.

Where KitaHQ relies on consent, the person may withdraw it without affecting processing already lawfully completed. KitaHQ and each employer remain responsible for the duties that apply to their respective activities and roles.

‍

6. Who receives personal data

We may disclose personal data to:

- the employer, recruiters, hiring managers and authorized reviewers involved in the recruitment process;

- service providers that support cloud hosting, AI processing, analytics, communications, security and customer support;

- courts, regulators, law-enforcement bodies or other parties where disclosure is required or permitted by law.

Service providers process information under contractual and security requirements appropriate to their role.

‍

7. International processing

KitaHQ and its service providers may process personal data outside the country where it was collected. For transfers controlled by KitaHQ, KitaHQ uses the transfer basis and safeguards required by applicable law. The hiring employer is separately responsible for transfers it controls. Information about the arrangements applicable to KitaHQ’s processing is available from privacy@kitahq.com.

‍

8. Retention and deletion

KitaHQ retains personal data only for as long as needed to provide the service, follow documented employer instructions and customer agreements, meet legal, security or dispute-resolution requirements, and maintain necessary operational records. Retention periods vary by data type and system. When data is no longer required, KitaHQ deletes or anonymises it, subject to limited backup, legal-hold and security-record requirements. A specific period applies only where it is stated for a defined data category and verified across the relevant systems and providers.

‍

9. Security

KitaHQ uses technical and organizational measures designed to protect personal data, including encryption in transit and at rest, role-based access controls with multi-factor authentication, monitoring and vulnerability scanning, and documented incident-response procedures. KitaHQ internally maps its security procedures to selected security-related criteria within the AICPA Trust Services Criteria used in SOC 2 examinations. Available evidence for these documented controls can be provided through the appropriate customer security-review process.

More information is available on the KitaHQ Security page.

‍

10. Your choices and rights

Depending on applicable law and KitaHQ’s role, you may have rights to request information, access, a copy, completion, correction, deletion, restriction, objection, withdrawal of consent or data portability. Depending on applicable law, you may also have rights relating to significant automated decisions, including rights to receive information about the decision, make representations, obtain human intervention and contest the decision.

You may contact privacy@kitahq.com directly. If the hiring employer controls the relevant recruitment data, KitaHQ will route the request or assist the employer according to its role. Contacting KitaHQ does not affect your rights. We may verify identity and apply lawful exceptions before fulfilling a request.

‍

11. Cookies and website analytics

KitaHQ uses essential technologies on its website and product surfaces. With the visitor’s choice, KitaHQ uses Google Analytics 4 and Microsoft Clarity for website measurement and improvement, and Google Ads conversion measurement to understand whether marketing campaigns lead to actions such as booking a demo or submitting a form. KitaHQ does not display advertising on the public website. Details and available controls are explained in the Cookie Policy. Browser camera and microphone permissions are separate from cookie choices.

‍

12. Data incidents

KitaHQ assesses personal-data incidents and notifies affected customers, individuals and authorities when notification is required by applicable law. Where KitaHQ processes candidate data for an employer, KitaHQ will notify and assist the employer according to the applicable contract and legal requirements.

‍

13. Country-specific information

These summaries apply where the stated law governs the relevant processing. They supplement the global Notice and preserve the applicable rights and obligations in each country.

United States

United States privacy rights vary by state, sector and context. Where the California Consumer Privacy Act or another applicable state privacy law applies, individuals may have rights to know or access, correct, delete or obtain a copy of personal information; opt out of covered sale, sharing or targeted advertising; limit certain uses of sensitive information; and receive non-discriminatory treatment for exercising rights. Candidate and employee data may be treated differently by each statute. Requests may be sent to privacy@kitahq.com, while employer-controlled recruitment requests should be directed to the hiring employer.

Relevant authority: California Consumer Privacy Act and applicable United States state privacy laws.

United Kingdom

Where the UK GDPR, as amended by the Data (Use and Access) Act 2025, and the Data Protection Act 2018 apply, KitaHQ and the hiring employer handle personal data according to their respective roles. Where a significant decision is made without meaningful human involvement, the responsible organisation must provide applicable safeguards, including information about the decision, an opportunity to make representations, human intervention and a route to contest the decision. Restrictions continue to apply to the use of special-category information in significant automated decisions. Complaints may be made to the Information Commissioner’s Office. KitaHQ will publish UK-representative details if Article 27 requires a representative for the relevant processing.

Relevant authority: UK GDPR, Data Protection Act 2018 and Information Commissioner’s Office guidance.

Canada

Where the Personal Information Protection and Electronic Documents Act or applicable provincial privacy law applies, KitaHQ and the hiring employer handle personal information according to their activities and roles. Individuals may request access or correction and may challenge compliance. Consent or another permitted legal authority will be used where required, and the purposes, safeguards, retention and cross-border handling described in this Notice continue to apply. Complaints may be made to the Office of the Privacy Commissioner of Canada or the competent provincial authority.

Relevant authority: PIPEDA and applicable provincial private-sector privacy laws.

Australia

Where the Privacy Act 1988 and Australian Privacy Principles apply, KitaHQ may use CV information, application answers, interview responses, transcripts and employer-configured criteria to generate criteria-alignment scores, criteria-alignment rankings, summaries and assessments. These outputs may be substantially and directly related to an employer’s candidate-review and progression decisions. Workflow information may separately be used to create configured invitations, reminders or review requests. KitaHQ does not automatically reject candidates. An authorised hiring representative must confirm any rejection or other adverse progression decision. The hiring employer remains responsible for determining which automated-decision disclosures apply to its use of KitaHQ. Individuals may request access to or correction of personal information and may raise a privacy complaint with KitaHQ. Unresolved matters may be referred to the Office of the Australian Information Commissioner. Overseas handling will follow applicable requirements.

Relevant authority: Privacy Act 1988, Australian Privacy Principles and OAIC APP 1 guidance.

New Zealand

Where the Privacy Act 2020 applies, individuals may request access to or correction of personal information and may complain to the Office of the Privacy Commissioner. Where KitaHQ or a hiring employer collects candidate information indirectly from another person, an employer system or a connected recruitment source, the party responsible for the collection will take reasonable steps to provide the candidate with the information required by Information Privacy Principle 3A as soon as reasonably practicable, unless an applicable exception applies. The notice should identify the fact and purpose of collection, intended recipients, the collecting and holding organisations, and the candidate’s access and correction rights. Cross-border disclosures will be handled under Information Privacy Principle 12 where applicable, and reasonable safeguards will be used to protect personal information.

Relevant authority: New Zealand Privacy Act 2020 and Information Privacy Principles 3A, 5 and 12.

Singapore

Where Singapore’s Personal Data Protection Act applies, Momentum Spark Pte. Ltd. is the primary KitaHQ contact for KitaHQ-controlled processing. Individuals may request access to or correction of personal data, withdraw consent where consent is the applicable basis, and raise unresolved concerns with the Personal Data Protection Commission. The hiring employer remains responsible for the recruitment purposes and decisions it controls. KitaHQ’s global retention, protection, transfer and breach sections apply alongside this Singapore summary.

Relevant authority: Singapore Personal Data Protection Act and PDPC data-protection obligations.

Malaysia

Where Malaysia’s Personal Data Protection Act 2010 and applicable amendments apply, Momentum Spark Pte. Ltd. and the hiring employer handle personal data according to their respective activities and roles. Applicable notice, choice, access, correction, security, retention, transfer and breach requirements may differ by activity and lawful exception. Requests about an employer’s recruitment process should first be directed to that employer; requests about KitaHQ’s own processing may be sent to privacy@kitahq.com.

Relevant authority: Malaysia Personal Data Protection Act 2010 and Personal Data Protection (Amendment) Act 2024.

Indonesia

Where Law No. 27 of 2022 on Personal Data Protection applies, individuals may request information, access, a copy, completion, correction, deletion, restriction, withdrawal of consent and other rights provided by law. Individuals may object to decisions based solely on automated processing where the statutory conditions apply. Requests about an employer’s recruitment process should be sent to that employer; requests about KitaHQ’s own processing may be sent to privacy@kitahq.com.

Relevant authority: Indonesia Law No. 27 of 2022 on Personal Data Protection.

Germany and the European Union

Where the EU GDPR and Germany’s Federal Data Protection Act apply, the hiring employer determines the recruitment purpose and applicable legal basis, while KitaHQ normally processes candidate data under documented instructions and may act independently for limited service-security and administration purposes described in this Notice. Individuals may exercise applicable GDPR rights and complain to the competent supervisory authority. Employment-related processing, profiling and solely automated decisions require the applicable lawful basis, transparency and safeguards. KitaHQ will publish EU-representative details where Article 27 requires a representative.

Relevant authority: EU GDPR, Germany’s Federal Data Protection Act and competent German data-protection authorities.

‍

14. Changes to this Notice

We may update this Notice when our services, practices or legal obligations change. We will publish the revised effective date and provide additional notice where a material change or applicable law requires it. A privacy notice describes processing; continued website use is not treated as consent where the law requires a separate choice.

‍

15. Contact

Privacy contact

Momentum Spark Pte. Ltd.

73 Ayer Rajah Crescent, #01-24

Singapore 139952

privacy@kitahq.com

For technical interview problems: support@kitahq.com. For accommodation and application-status questions: contact the hiring employer.