Data Privacy Statement for Candidates

Last update: 26 June 2026

1. General Information

At Revolut Bank Colombia S.A., hereinafter "Revolut Bank," we are committed to protecting and respecting the privacy of our job applicants. We guarantee the security and confidentiality of your personal data at all times. The primary purpose of this policy is to regulate the processing of such data, ensuring compliance with the fundamental right to habeas data (Article 15 of the Political Constitution of Colombia) and the right to information (Article 20 of the Political Constitution of Colombia), as well as Law 1581 of 2012, Law 1266 of 2008, its implementing regulations, and any laws that modify, add to, replace, or supplement them.

2. Recipients

This policy shall apply to all databases, both physical and digital, that contain personal data of job applicants (hereinafter, the "job applicants," the "Applicants," the "Applicant," the "Data Subject," or the "Data Subjects") and that are subject to Processing (as defined below) by Revolut Bank. For the purposes of this policy, a candidate is defined as any person who has provided, through any means, their resume or personal information by applying for or expressing an interest in a role or position at Revolut Bank, whether through an employment contract or another type of contract permitted by applicable law.

"Processing" means any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

3. Guiding Principles

Principle of legality: Processing is a regulated activity that must comply with the provisions of the law and other regulations that develop it.

Principle of purpose: Processing must serve a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Data Subject.

Principle of freedom: The processing can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that waives consent.

Principle of truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The Processing of partial, incomplete, fragmented, or misleading data is prohibited.

Principle of transparency: Processing must guarantee the right of the Data Subject to obtain information from the Data Controller or Data Processor at any time and without restriction regarding the existence of data concerning them.

Principle of restricted access and circulation: The Processing is subject to the limits derived from the nature of the personal data and the provisions of the applicable regulations. In this sense, the Processing can only be done by persons authorized by the Data Subject and/or by the persons provided for by law; Personal data, except for public information, may not be available on the Internet or other means of mass disclosure or communication, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or authorized third parties in accordance with the law.

Principle of security: Information subject to Processing shall be handled with technical, human, and administrative measures necessary to provide security to the records, avoiding their alteration, loss, consultation, use, or unauthorized or fraudulent access.

Principle of confidentiality: All persons involved in the Processing of personal data that is not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks involved in the Processing has ended, and may only supply or communicate personal data when this corresponds to the development of the activities authorized by law.

4. Data Controller

Company Name: Revolut Bank Colombia S.A.
Domicile: Bogotá, Colombia
Address: Cra 11B # 99 - 25, 13th floor, office 108
Email Address:dpo@revolut.com
Tax ID: 902.002.134-1

5. Personal Data Processing

The personal data of Revolut Bank's employee candidates will be subject to the following treatments, in accordance with applicable regulations and the authorization of the Data Subjects:

Collection
Storage
Circulation
Use
Deletion

6.1 Purposes of Personal Data Processing

The personal data of Revolut Bank's employee candidates will be used for the following purposes:

Fulfill the applicable regulatory, legal, and contractual obligations and to develop the pre-contractual, contractual, and post-contractual relationship.
Attend to the requirements of competent authorities.
Control access to facilities and monitor through video surveillance systems for the safety of employee candidates and people and assets in general, as well as manage the entry and exit of employee candidates to Revolut Bank's physical premises, as well as access to information systems, networks, and technological assets.
Conduct the consultation of public, judicial, tax, and/or disciplinary records by verifying national or international sources related to the prevention of money laundering and terrorist financing (such as OFAC, UN, among others), negative credit information and/or similar, as well as in databases of Colombian authorities or international organizations on these matters.
Consult financial and credit behavior in credit reporting agencies.
Share information on job offers or other nature from Revolut Bank, their requirements, and application mechanisms.
Evaluate, corroborate, and determine the candidate's compliance with the requirements of the position and the company they are applying to, in accordance with the established policy and the attraction and selection procedure of Revolut Bank.
Share candidate information with third parties for reliability validation, meaning home visit, medical examination, security study, and integrity tests, among other related ones.
Be an input for the process of linking to the companies and feeding the Employee Candidate databases in the required cases.
Build management and analytical metrics and analysis.

6.2 Processing of Sensitive Data

Revolut Bank informs the Job Applicant that they are not obliged to authorize the processing of their sensitive data, unless there is a legal mandate requiring its collection or it is strictly necessary for the execution of the contract.

Likewise, it clarifies that no activity shall be conditioned upon the Job Applicant providing sensitive personal data. It also informs that answering questions is optional when they concern sensitive data.

However, for the purposes of the employment relationship, these will be processed for the following specific purposes:

Occupational Health Management (OHS):

Recording of pre-employment medical examinations, periodic examinations, and exit examinations.
Management of medical records in the event of work-related accidents or occupational diseases.
Monitoring of medical recommendations and restrictions to ensure a safe working environment.

Biometric Identification:

Processing of fingerprints, facial features, or other biometric data for access control, exit, and recording of the work day through technological systems.

6.3. Processing of Candidates Data

The personal data provided by aspiring Data Subjects in their resumes and during the recruitment stages of Revolut Bank will be processed for the following purposes:

Vacancy and Call Management: Providing information about the job offers available at Revolut Bank, including their specific requirements and official application channels.
Professional Profile Evaluation: Corroborating and determining the suitability of the candidate for the position's demands, according to talent attraction standards and Revolut Bank's internal policies.
Reliability and Security Validation: Sharing information with specialized third parties to execute background check processes, security studies, integrity tests, and entry, periodic, or exit medical examinations, with the aim of ensuring transparency and risk mitigation in hiring.
Onboarding and Document Management: Using the data as the main input for the formal hiring process and, if selected, populating the Employee candidate databases and human talent management systems of Revolut Bank.
Human Talent Analytics: Building management metrics, statistical reports, and data analytics to optimize selection processes and the operational efficiency of Revolut Bank.

7. Rights of Data Subjects

As a Job Applicant, you have the following rights, in accordance with the law, to exercise regarding your personal data:

To know, update, and rectify your personal data. This right may be exercised, among others, against partial, inaccurate, incomplete, or fragmented data, data that leads to error, or data whose Processing is expressly prohibited or has not been authorized.
To request proof of the authorization, except when expressly exempted as a requirement for Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
To be informed, upon request, regarding the use that has been given to your personal data.
To file complaints with the Superintendency of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add to, or complement it, once the consultation or claim process before Revolut Bank has been exhausted.
To revoke the authorization and/or request the deletion of the data when the constitutional and legal principles, rights, and guarantees are not respected during Processing. The request for deletion or revocation shall not apply when the Data Subject has a legal or contractual duty to remain in the database.
To access your personal data free of charge that has been subject to Processing.

8. International Transfer and Transmission of Data

Revolut Bank may transfer and transmit personal data to third parties with whom it has an operational relationship that provide necessary services for its proper operation, or in accordance with the functions established under its charge by law. In such cases, the necessary measures will be adopted to ensure that the persons who have access to your personal data comply with this Policy and with the principles of personal data protection and obligations established by Law.

In any case, when Revolut Bank transmits data to one or more processors located within or outside the territory of the Republic of Colombia, it will establish contractual clauses or contracts, in accordance with the provisions of applicable regulations.

Additionally, we inform you that we may share your personal data with the following third parties to the extent necessary to fulfill the purposes established in this policy:

With Revolut Group companies, such as Revolut Ltd.
Our external service providers, such as our data hosting providers and communication service providers, among others.

Other Revolut Group companies are located in the United Kingdom and other countries, and our main data hosting facilities are located in the United Kingdom and the European Union. Please be assured that we will always take steps to ensure the protection of your personal data when we transmit it internationally, as well as to ensure that Processors in Colombia or abroad are subject to the authorized purposes and corresponding security measures. This includes entering into agreements with third-party recipients of your data or transmitting data to third parties in countries with an adequate level of personal data protection.

If you would like more information, please contact us by sending an email to dpo@revolut.com.

9. Person or Department Responsible for Handling Requests, Inquiries, and Claims

Revolut Bank has designated the following person/department to handle requests, inquiries, and claims from Data Subjects:

Contact Department: Regulatory Compliance
Email: dpo@revolut.com

10. Procedure for the Exercise of Data Subject Rights

To exercise your rights, you must send a request to the contact department mentioned above, specifying the following:

Your full name and identification number.
A clear and precise description of the personal data regarding which you wish to exercise your right.
The specific request you wish to make (access, update, rectify, delete, etc.).
Any documents or information you consider relevant to support your request.

10.1 Inquiry Procedure

Revolut Bank guarantees the right of Data Subjects to consult their personal information under the following terms:

Response Deadline: Inquiry requests will be addressed within a maximum term of ten (10) business days, starting from the date of receipt.

Deadline Extension: If it is not possible to address the inquiry within said term, Revolut Bank will inform the interested party before the expiration of the ten (10) days, indicating the reasons for the delay and the response date. In no case shall the extension exceed five (5) business days following the expiration of the initial deadline.

10.2 Claims Procedure

Data Subjects or their successors may file claims with Revolut Bank when they consider that the information contained in our databases should be subject to correction, update, or deletion, or when they notice an alleged breach of the duties contained in Law 1581 of 2012 or this Policy.

Correction of Errors: If the claim is incomplete, Revolut Bank will require the interested party within five (5) business days following receipt to correct the errors.

Withdrawal: If two (2) months have passed since the date of the request for additional information without the applicant providing it, it will be understood that they have withdrawn the claim.

Response Deadline: The maximum term to address the claim will be fifteen (15) business days, starting from the day following the date of receipt.

Deadline Extension: If it is not possible to address the claim within the initial term, Revolut Bank will inform the interested party of the reasons for the delay. The new term shall not exceed eight (8) business days following the expiration of the initial deadline.

10.3 Procedure for the Deletion of Personal Data

In cases where deletion is appropriate, Revolut Bank will carry out the operational deletion of the data in such a way that its recovery is not possible.

The Data Subject acknowledges that certain personal data must remain in Revolut Bank's records for the fulfillment of legal, accounting, or contractual duties inherent to the financial institution. In these scenarios, deletion will apply to the active processing of the data, retaining only those required by current regulations.

11. Effective Date and Term of the Database

Effective Date: March 1st, 2026.
Retention Period of the Database: Personal data will be retained for as long as is reasonable and necessary to fulfill the purposes for which it was collected, and will be kept until legal or contractual obligations are met. Once the purpose has been fulfilled, Revolut Bank will proceed to delete the personal data, unless a legal or contractual obligation requires its retention.

12. Updates

This policy may be updated from time to time. Any changes will be posted on the website or on the channel designated by Revolut Bank for this purpose. If we make any substantial changes to this privacy policy, we will notify you via the app, email, or another appropriate means before the change takes effect.