pepelwerk Privacy Policy and Marketplace Data Use Notice Effective Date: July 1, 2026 This Privacy Policy and Marketplace Data Use Notice explains how pepelwerk, LLC, doing business as pepelwerk ("pepelwerk," "Company," "we," "our," or "us"), collects, uses, processes, shares, protects, retains, and deletes personal information, customer data, marketplace data, student data, sensitive data, biometric data, de-identified data, aggregated data, and related information in connection with pepelwerk websites, software, applications, accounts, portals, dashboards, AI-enabled features, predictive analytics, Talent Wallet, AI Career Assistant, marketplace, organization portal, professional services, communications, events, subscriptions, payment features, and related services. Pepelwerk provides a closed, permissioned workforce marketplace and technology platform designed to support people, employers, educators, public agencies, sponsors, workforce partners, and other organizations in making decisions about skills, jobs, learning, career pathways, hiring, funding, sponsorships, and workforce planning. This Policy applies when pepelwerk acts as a controller, business, processor, service provider, contractor, vendor, school official, or similar role, depending on the service, customer agreement, data type, jurisdiction, and purpose of processing. By accessing or using the platform, submitting information, creating an account, using AI- enabled features, participating in the marketplace, engaging with pepelwerk communications, or otherwise interacting with pepelwerk, you acknowledge that your information will be handled as described in this Policy, applicable product notices, consent flows, customer agreements, and applicable law.

1. Scope of This Policy

This Policy applies to personal information and related data processed through pepelwerk websites, applications, portals, accounts, products, services, marketplace features, AI- enabled tools, events, communications, customer programs, organization portals, and professional services. This Policy covers information collected directly from users, customers, website visitors, marketplace participants, students, parents, guardians, employers, hiring users, educators, schools, workforce agencies, sponsors, partners, vendors, service providers, and representatives of organizations. It also covers information collected automatically, received from customers or organizations, obtained from authorized third parties, or derived from platform activity. When pepelwerk controls the purpose and means of processing personal information, pepelwerk acts as a controller or business. When pepelwerk processes information on behalf of a customer, organization, school, agency, employer, sponsor, or other entity, pepelwerk acts as a processor, service provider, contractor, vendor, school official, or similar role under the applicable agreement and law. Where a customer controls the account, program, portal, or data set, that customer is responsible for providing required notices, obtaining required consents, determining lawful bases for processing, responding to end-user rights requests where legally required, configuring account permissions, and instructing pepelwerk on permitted processing.

2. Definitions

For purposes of this Policy: "Platform" means pepelwerk’s websites, software, applications, portals, dashboards, databases, AI-enabled features, marketplace, Talent Wallet, AI Career Assistant, organization portal, payment administration tools, reporting tools, communications, content, services, and related technology. "AI Career Assistant" means pepelwerk’s artificial intelligence-enabled, automated, assisted-intelligence, recommendation, planning, guidance, matching, workflow, analytics, or decision-support features that may provide prompts, suggestions, plans, insights, recommendations, responses, pathways, or other outputs. "Talent Wallet" means the user-controlled digital profile, wallet, account, credential, proof, skills, career identity, verification, sharing, access, or related data-management feature made available through the platform. "Marketplace" means the closed or controlled pepelwerk environment where users and organizations may discover, communicate, evaluate, match, sponsor, fund, purchase, sell, hire, be hired by, learn from, mentor, coach, support, or otherwise interact with other users, organizations, services, opportunities, courses, jobs, credentials, programs, funding sources, or marketplace participants. "Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identifiable person, household, account, device, or user, depending on applicable law. "Customer data" means information submitted to, processed by, or made available through the platform by or on behalf of a customer, organization, school, employer, agency, sponsor, partner, or other entity. "Student data" means information relating to students, learners, minors, education records, school program participation, learning progress, pathways, assessments, eligibility, or other education-related information processed through the platform. "Marketplace data" means profile information, opportunity information, skills, preferences, qualifications, availability, eligibility indicators, interactions, communications, matches, recommendations, transactions, and related data made available within the closed marketplace. "AI outputs" means recommendations, rankings, scores, matches, predictions, reports, insights, prompts, responses, analytics, or other outputs generated or supported by artificial intelligence, automation, machine learning, predictive analytics, scoring, ranking, matching, or decision-support tools. "User," "you," and "your" mean any visitor, registered user, customer, individual, student, parent, guardian, educator, school administrator, employer, hiring company, recruiter, workforce agency, marketplace participant, sponsor, course provider, reseller, partner, service provider, administrator, representative, or other person or entity that accesses, views, registers for, participates in, contributes to, or otherwise uses any part of the platform.

3. Information We Collect

Pepelwerk may collect information that you provide directly, information collected automatically, information received from customers or organizations, information obtained from authorized third parties, and information derived from your use of the platform. Information you provide may include name, email address, telephone number, physical address, account credentials, organization name, role, job title, work location, profile information, skills, career goals, learning goals, employment history, education history, credentials, preferences, availability, compensation expectations, job requirements, program eligibility information, marketplace activity, communications, payment-related information, support requests, survey responses, feedback, event registrations, and other information you choose to provide. Information collected automatically may include IP address, device type, browser type, operating system, unique device identifiers, general location, log data, performance data, pages or features used, referring pages, clickstream activity, security events, communication metadata, product interactions, mobile application diagnostics, and information collected through cookies, pixels, software development kits, or similar technologies. Information from customers or organizations may include account access information, administrator assignments, role permissions, school or program affiliation, employee or student identifiers, pathway goals, participation records, learning activity, assessment information, candidate feedback, hiring workflow information, job postings, opportunity criteria, sponsorship criteria, eligibility information, and other data provided by or on behalf of an organization. Information from third parties may include business contact information, publicly available information, partner-provided information, event co-sponsor information, identity or eligibility information, and other information that we are authorized or permitted by law to receive and use.

4. How We Use Information

Pepelwerk uses information to provide, operate, maintain, secure, personalize, improve, and develop the platform and related services. We may use information to create and manage accounts, authenticate users, provide customer support, deliver requested services, operate the marketplace, facilitate user- directed interactions, support job, learning, sponsorship, funding, coaching, mentoring, and workforce activities, administer subscriptions and payments, communicate with users and customers, provide notices, send service messages, support marketing where permitted, conduct events and webinars, manage research and feedback, troubleshoot issues, monitor performance, prevent fraud, protect security, enforce policies, comply with law, and support business operations. Pepelwerk may also use information for matching, recommendations, AI-enabled features, predictive analytics, workforce insights, marketplace functionality, product improvement, research, reporting, benchmarking, service quality, fraud prevention, security monitoring, compliance, and development of new or improved services. Where personal information is used to train or improve AI models, pepelwerk will rely on applicable lawful bases such as user consent, contractual necessity, or legitimate interests, subject to applicable law and user rights. Pepelwerk may use de-identified, aggregated, pseudonymized, statistical, or non- personally identifying information for product improvement, research, benchmarking, workforce insights, marketplace health, AI model evaluation, predictive analytics, community data, fraud prevention, security, service quality, and mission-aligned analytics where permitted by law.

5. Lawful Bases and Consent

Where applicable law requires a lawful basis for processing, pepelwerk may rely on consent, contract performance, steps taken before entering into a contract, legitimate interests, legal obligations, vital interests, public interest, customer instructions, or other lawful bases recognized by applicable law. Pepelwerk may request separate notice, consent, opt-in, authorization, or other legally sufficient permission before collecting, using, storing, disclosing, or processing certain sensitive information, biometric identifiers, biometric information, student data, children’s information, automated decision-making data, or other regulated information where required by law. Pepelwerk does not rely on continued use alone as consent where applicable law requires separate affirmative consent, including for certain biometric, sensitive-data, student-data, privacy, or regulated processing activities. If you provide information about another person, you represent that you have the required rights, permissions, notices, consents, authorizations, and legal authority to provide that information to pepelwerk for the applicable purpose.

6. Marketplace Data Use and Sharing

Pepelwerk operates a closed, permissioned marketplace. Users and organizations may intentionally share information within the marketplace to discover, communicate, evaluate, match, sponsor, fund, purchase, sell, hire, be hired by, learn from, mentor, coach, support, or otherwise interact with other authorized users, organizations, providers, and third parties. Pepelwerk may disclose or make accessible certain personal information, profile information, job or program information, marketplace activity, availability, qualifications, skills, preferences, eligibility indicators, and related data to other authorized users or customers within the closed marketplace when necessary to provide the product, fulfill a user-directed interaction, support a customer-sponsored program, enable a match, administer a job posting or hiring workflow, connect users to education or work opportunities, deliver coaching or guidance, support funding or sponsorship, or provide analytics and reporting. Users should assume that information intentionally shared within the marketplace may be visible to other authorized participants within that environment depending on feature settings and use case. Marketplace participants may only use marketplace information for the authorized purpose for which it was made available. Users and organizations may not scrape, resell, republish, re-identify, discriminate, harass, misuse, or otherwise use marketplace data in an unauthorized or unlawful manner. Pepelwerk does not certify, endorse, or validate users, credentials, qualifications, or opportunities unless expressly stated in a separate written agreement.

7. AI, Predictive Analytics and Automated Decision Support

Pepelwerk may use artificial intelligence, machine learning, automation, predictive analytics, scoring, ranking, matching, recommendations, generative tools, reporting, analytics, and automated workflows to support marketplace operations and platform services. These tools may help users identify career pathways, training options, job matches, employer demand, program eligibility, candidate pools, risk signals, funding opportunities, sponsorship activity, skills gaps, service recommendations, and workforce insights. These tools are designed to support human decision-making, not to unlawfully replace it. AI outputs may be inaccurate, incomplete, biased, or inconsistent and should not be relied upon as definitive or objective assessments. Scores, rankings, and predictive indicators are heuristic and probabilistic outputs and do not represent objective evaluations, certifications, or guarantees of suitability or performance. Users assume full responsibility for any reliance on AI outputs, whether in whole or in part. Users may not use AI outputs as the sole basis for decisions with legal or similarly significant effects unless they independently ensure compliance with all applicable legal, regulatory, and procedural requirements. Pepelwerk does not undertake any duty to ensure that AI outputs are fair, accurate, unbiased, or suitable for any specific decision. Pepelwerk does not guarantee that AI outputs are fully explainable, interpretable, or auditable in a user-understandable manner. Where California, the European Union, the United Kingdom, Canada, or another jurisdiction provides specific rights related to automated decision-making, profiling, meaningful information about logic involved, opt-out, appeal, or human intervention, pepelwerk will honor those rights where they apply to pepelwerk as the responsible business or controller. Where pepelwerk acts on behalf of a customer, pepelwerk will reasonably assist the customer in meeting those obligations as required by the applicable agreement and law.

8. Student Data, Children and School Use

When pepelwerk provides a portal, program, product, or service to a public K-12 school, district, education service center, workforce agency, government agency, or similar organization, pepelwerk may process student information as a service provider, contractor, school official, processor, or similar role under the applicable agreement and law. Student data may include account information, school or program affiliation, grade level, pathway goals, learning activity, skills, assessments, progress, eligibility information, career interests, program participation, communications, and other education-related information. Pepelwerk will use student data only to provide the contracted or requested service, support authorized school or program purposes, maintain security, comply with law, improve the service in privacy-protective ways, and create de-identified or aggregated insights where permitted. Pepelwerk does not use student personal information for targeted advertising, does not sell student personal information, and does not knowingly use student personal information to train general-purpose AI models unless permitted by law, authorized by the applicable customer agreement, and supported by required consent or other legal basis. Where required by the Children’s Online Privacy Protection Act, the Family Educational Rights and Privacy Act, state student privacy laws, or similar laws, pepelwerk will rely on the school, district, agency, parent, guardian, or other authorized customer to provide required notices and obtain required consent unless pepelwerk is legally required to do so directly. If pepelwerk learns that it collected personal information from a child without required authorization, pepelwerk will take reasonable steps to delete, de-identify, or otherwise handle the information as required by law and the applicable customer agreement.

9. Digital Identity and Personal Safety

Pepelwerk recognizes that users may distinguish between their real-world identity and digital identity for safety, privacy, fraud prevention, and personal comfort. Your real-world identity may include your legal name, biometric information, likeness, government-issued identification information, contact information, and other information that identifies you as a real person. Your digital identity may include usernames, creative descriptions, preferences, career identity, profile information, samples of work, alternate representations, or other information you choose to use within the platform. Users should not share information about their real-world identity or digital identity that makes them uncomfortable or that they are not authorized to share. Users remain responsible for the accuracy, lawfulness, and appropriateness of information they submit or make available through the platform.

10. Cookies, Tracking and Website Data

Pepelwerk may use cookies, pixels, software development kits, local storage, analytics tools, and similar technologies to provide, secure, measure, personalize, and improve websites, applications, content, communications, and services. These technologies may help pepelwerk remember preferences, authenticate users, understand website traffic, measure engagement, improve performance, detect fraud, maintain security, deliver content, and support advertising or marketing where permitted by law and user preferences. Certain cookie-based advertising or analytics disclosures may be considered a "sale" or "sharing" under California or other state privacy laws. Where applicable, users may use available privacy choices, cookie settings, browser controls, or legally recognized opt-out preference signals to opt out of applicable sale, sharing, or targeted advertising activities. Pepelwerk does not have actual knowledge that it sells or shares the personal information of individuals under sixteen years of age.

11. How We Share Information

Pepelwerk may share or make information available to affiliates, vendors, service providers, contractors, subprocessors, customers, organizations, marketplace participants, event sponsors, partners, payment providers, analytics providers, security providers, professional advisors, legal authorities, and other parties as described in this Policy. Pepelwerk may share information with service providers and vendors that perform services on our behalf, including hosting, infrastructure, IT services, data analytics, customer support, event services, call recording, chatbot technology, data enrichment, email delivery, payment services, security, fraud prevention, and professional services. These parties may use personal information only as instructed by pepelwerk or as permitted by the applicable agreement and law. Pepelwerk may share information with your organization, customer sponsor, school, employer, workforce agency, program administrator, or other authorized entity when necessary to provide the requested service, support account administration, respond to support requests, administer customer programs, provide reports, or comply with the applicable agreement. Pepelwerk may share information with marketplace participants as described in the Marketplace Data Use and Sharing section of this Policy. Pepelwerk may disclose information if we have a good-faith belief that disclosure is necessary to comply with law, legal process, government request, court order, subpoena, audit, investigation, or regulatory obligation; protect rights, property, safety, security, or integrity; enforce agreements or policies; prevent fraud or abuse; respond to emergencies; or protect pepelwerk, users, customers, partners, vendors, or third parties. If pepelwerk is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, personal information may be transferred as part of that transaction, subject to appropriate safeguards and applicable law.

12. Security

Pepelwerk uses technical, administrative, contractual, and organizational safeguards designed to protect personal information and related data against unauthorized access, disclosure, alteration, loss, misuse, or destruction. Safeguards may include role-based access controls, authentication measures, encryption in transit or at rest where appropriate, monitoring, logging, vulnerability management, incident response procedures, employee training, vendor review, contractual controls, and data minimization practices. No system, network, transmission, storage method, or security measure can be guaranteed to be completely secure. Users and customers are responsible for maintaining the confidentiality and security of passwords, credentials, devices, account permissions, administrator access, and account activity. Customers are responsible for configuring their accounts, assigning appropriate roles, removing access when personnel changes occur, protecting credentials, and ensuring that authorized users follow applicable policies and law.

13. International Transfers

Pepelwerk may transfer, store, access, or process personal information in the United States and other countries where pepelwerk, its affiliates, vendors, service providers, customers, or partners operate. Where information is transferred from the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with cross-border transfer requirements, pepelwerk may rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, data processing agreements, customer instructions, consent, necessity for contract performance, or other lawful transfer mechanisms. Where local law requires additional technical, contractual, or organizational safeguards, pepelwerk will implement reasonable measures appropriate to the nature of the data and services provided.

14. Data Retention

Pepelwerk retains personal information for as long as reasonably necessary to provide the services, operate the marketplace, maintain accounts, administer customer programs, comply with legal, tax, accounting, contractual, audit, and regulatory obligations, resolve disputes, enforce agreements, prevent fraud, maintain security, and support legitimate business purposes. Retention periods depend on the nature of the information, the purpose for processing, account status, customer instructions, legal obligations, contractual requirements, dispute or audit needs, security needs, and applicable law. Pepelwerk may retain de-identified, aggregated, pseudonymized, statistical, or non- identifying data for longer periods, including indefinitely, for research, analytics, service improvement, AI model evaluation, workforce insights, benchmarking, marketplace development, and mission-aligned purposes, provided that pepelwerk maintains appropriate safeguards and does not use the data to identify a person except as permitted by law. When pepelwerk has no ongoing legitimate business need or legal basis to process personal information, pepelwerk will delete, de-identify, anonymize, or securely isolate the information until deletion is possible.

15. Privacy Rights

Depending on where you live and how you interact with pepelwerk, you may have rights to know, access, confirm processing, correct, delete, obtain a portable copy of, restrict, object to, opt out of sale or sharing, opt out of targeted advertising, limit certain uses of sensitive personal information, withdraw consent, appeal certain decisions, lodge a complaint, or receive information about automated decision-making, profiling, and international transfers. Pepelwerk will respond to privacy rights requests as required by applicable law. We may need to verify your identity before processing a request. Verification may include validating your name, email address, account information, or other information reasonably necessary to confirm your identity and authority. If your information was submitted to pepelwerk by or on behalf of a customer, organization, school, employer, agency, sponsor, or other entity, you may need to contact that entity directly to exercise your rights. Where pepelwerk acts as a processor, service provider, contractor, vendor, or similar role, pepelwerk may direct you to the customer or assist the customer in responding as required by the applicable agreement and law. Pepelwerk will not discriminate against you for exercising privacy rights, but some services may require certain information to function. To exercise rights with respect to information covered by this Policy, contact pepelwerk at info@pepelwerk.com or use any available privacy request method provided by pepelwerk.

16. Customer and Organization Responsibilities

Customers, administrators, employers, schools, agencies, sponsors, partners, and organizations are responsible for their own account activity, authorized users, administrator permissions, data submissions, notices, consents, lawful bases, privacy rights responses, hiring activity, education activity, sponsorship activity, workforce activity, reporting activity, and compliance obligations. Customers and organizations must ensure that they have the right to provide data to pepelwerk and that their use of the platform complies with applicable employment, education, privacy, student data, biometric, automated decision-making, accessibility, civil rights, consumer protection, procurement, record retention, and data-security laws. Customers and organizations may not use pepelwerk data, AI outputs, recommendations, matching results, rankings, scores, analytics, Talent Wallet information, profile data, credentials, or platform reports in a discriminatory manner or as the sole basis for an adverse employment, education, funding, eligibility, benefits, admission, credentialing, or similar decision where human review or legal compliance is required. Customers and users remain responsible for their own misuse of data, inaccurate submissions, unauthorized disclosures, discriminatory use, failure to provide notices or obtain consents, violation of law, violation of rights, or use of the platform other than as permitted. Pepelwerk may suspend, restrict, disable, remove, or deny access where pepelwerk reasonably believes data or conduct is inaccurate, unauthorized, unsafe, unlawful, discriminatory, deceptive, harmful, inconsistent with marketplace integrity, inconsistent with agreements or policies, or likely to expose pepelwerk, users, customers, partners, vendors, or third parties to risk.

17. Certifications and Privacy Frameworks

Pepelwerk may participate in or rely on privacy, data transfer, certification, accountability, or dispute-resolution frameworks where applicable and where pepelwerk has made a current public commitment to such framework. Where pepelwerk relies on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, APEC Cross- Border Privacy Rules, or any similar framework, pepelwerk will provide additional notices, rights, dispute-resolution information, and compliance details as required by the applicable framework and current certification status. If any framework notice conflicts with this Policy, the more specific framework notice controls for the information and processing covered by that notice.

18. Complaints, Appeals and Contact

Questions, notices, feedback, technical support requests, privacy requests, rights requests, complaints, appeals, or other communications relating to this Policy or pepelwerk privacy practices should be directed to: info@pepelwerk.com If you have an unresolved privacy or data use concern that pepelwerk has not addressed satisfactorily, you may contact pepelwerk again to appeal or request further review. Depending on your jurisdiction, you may also have the right to lodge a complaint with a data protection authority or other regulator.

19. Changes to This Policy

Pepelwerk may revise, update, modify, or replace this Policy from time to time in its discretion. Changes may be made to reflect updates to platform functionality, AI features, marketplace activity, data practices, payment processes, legal requirements, business operations, risk controls, or other operational needs. Changes are effective when posted, made available through the platform, presented through an account interface, included in a consent flow, sent by email, or otherwise communicated through a legally valid method. If pepelwerk makes material changes involving personal information, student data, sensitive data, biometric data, marketplace data, AI-related data uses, automated decision-making, privacy rights, or other legally significant terms, pepelwerk may provide additional notice or seek additional consent where required by law. You are responsible for reviewing this Policy periodically. If you do not agree with the updated Policy, you should stop using the platform or exercise available privacy choices where applicable. These Terms supplement and are incorporated into the pepelwerk Terms of Use and related agreements. The pepelwerk Terms of Use govern in the event of any conflict.

Back to Legal Center