Last updated: August 01, 2026.

Your privacy is important to Bentley. This Candidate Privacy Statement explains how Bentley Systems, Incorporated and its controlled affiliates relevant to the role in question (“Bentley”, “we”, “us”) collect, use, share, transfer and protect personal data about job applicants and prospective candidates (“you”), and the choices and rights you have under applicable local law.

It covers personal data we obtain about internal and external applicants, including through the Bentley online recruitment platform and careers page (the “recruitment system”), directly from you and from third parties such as agencies, recruiters, job-search sites, job fairs, recruiting events, colleague referrals and recruiting platforms.

It also covers individuals who ask to hear about future opportunities, and applications for all types of contingent and non-permanent positions. “Personal data” means information that identifies or can reasonably be linked to you; it does not include anonymised, de-identified or aggregated data, and it includes “personal information” where a particular law uses that term.

Where we link to third-party sites, those sites have their own notices. For our general privacy practices, see Bentley’s Privacy Statement.

---

Contents

1. What information do we collect about you?
2. How do we use your personal data?
3. How and why do we share your personal data?
4. Do we transfer your personal data across borders?
5. How long do we keep your personal data?
6. Do we use automated decision-making and AI?
7. How do we keep your data secure?
8. What choices and rights do you have?
9. How do you contact us, and how will we tell you about changes?

Summary

Topic	In short
What we collect	Information you give us during the application process, information we collect automatically when you use the recruitment system, and information from agencies, screening providers, referees and reputable public sources.
Why we use it	To run our recruitment process, assess and communicate with you about opportunities, verify your information, and meet our legal obligations.
Who we share with	Affiliates, service providers, legal and professional advisers, and authorities where required by law. We do not sell or share your personal data.
Transfers	We use Standard Contractual Clauses and additional safeguards for international transfers.
Retention	We keep candidate data only as long as needed, typically up to twelve (12) months after the role is filled, unless the law requires longer.
Your rights	Access, correct, delete, port, object and opt out, depending on where you live. To exercise any of these rights, you may submit a request to our Data Protection Officer.
Contact	Data Protection Officer, Dublin, Ireland (full address below)

---

1. What information do we collect about you?

We collect personal data in three ways: directly from you, automatically when you use the recruitment system, and from third parties and reputable sources. By category, this may include:

• Identifiers: your name, contact details (such as address, email address and telephone number), and your username and password for the recruitment system.
• Professional or employment information: the information in your CV or résumé, your work history, and other documents you submit during the application or recruitment process.
• Education information: your education history, qualifications and certifications, including details confirmed by educational institutions or degree-verification providers.
• Protected classifications: where the law allows it, diversity information such as race, ethnicity, gender, veteran status or disability, collected for equal-opportunity monitoring. Providing this is voluntary, and it is not used in the hiring or selection process.
• Sensitive data: some information may be treated as sensitive or special-category data in certain jurisdictions, such as your recruitment-system credentials and information about personal characteristics. If you choose to provide sensitive information (for example, racial or ethnic origin, political opinions, trade-union membership, health, sexual orientation, or criminal-record information), you authorise us to handle it in line with this statement.
• Visual information: video submissions, interview recordings and headshots, and on-premises security monitoring such as CCTV when you attend our premises for an interview.
• Internet and device activity: browser type and operating system, clickstream and search activity, access logs, the time you spend on the recruitment system, and the referring website that brought you to it. Our use of cookies is described in the Cookie Statement.
• Financial details: your tax status or financial-account information, for example to reimburse interview travel.
• Inferences: preferences, characteristics, soft skills and behaviour drawn from the information above.
• Information from third parties: employment history and conduct or performance information from screening agencies, former employers, referees, other Bentley colleagues, clients or service providers, and publicly available registers; and information from public sources such as LinkedIn or other job-search platforms, including anything you choose to submit when you apply through them.
• Other information you provide: anything you choose to volunteer in connection with your application, such as a cover letter or information disclosed during an interview.

We engage a third-party vendor for background screening; our approach is explained during the recruitment process and is governed by applicable local law. Please obtain consent from your referees before giving us their personal data. Where we collect sensitive or special-category data, we do so only to the extent necessary for the purposes in this statement and, where required by law, will ask for your consent.

2. How do we use your personal data?

We use your personal data to operate, manage and improve the recruitment system and our database of interested individuals; to communicate with you about your interest in Bentley, your application and the recruitment process; to verify your information, including through reference and, where applicable, background checks; to tell you about other roles in the Bentley group that may interest you (with your consent where the law requires it); and to comply with our legal obligations and lawful requests from public authorities, including for national-security or law-enforcement purposes.

Where the law requires a legal basis, we rely on one or more of the following: taking steps to enter into, or performing, a contract with you; our legitimate interests, balanced against your rights; your consent, which you may withdraw at any time; our legal obligations; and human-resources administration and employment-related purposes.

If the law requires us to collect certain data and you do not provide it, this may delay or prevent our handling of your application or our ability to employ you. We may also create and use anonymised or de-identified data, and will not attempt to re-identify it.

3. How and why do we share your personal data?

We do not sell or share your personal data as those terms are defined under applicable law.

We may disclose it in limited circumstances, for our business purposes, to the following recipients:

• Affiliates: other companies in the Bentley group, for recruitment, human-resources management and internal reporting.
• Service providers: vendors that support the recruitment process, such as recruitment-platform hosting, background-check, identity-verification and other pre-employment screening providers, payment processors, and interview-travel and expense-reimbursement providers.
• Legal and professional advisers: our lawyers, auditors and consultants, where needed for advice or to establish, exercise or defend legal claims.
• Authorities: law-enforcement agencies, courts, regulators, tax and other government authorities, or other third parties, where necessary to meet a legal or regulatory obligation or to protect our rights or those of others.
• Counterparties in a corporate transaction: where Bentley is, or may be, involved in a merger, acquisition, financing, reorganisation or sale of assets, including any related lenders, auditors and professional advisers.

Where the law requires it, we will give additional notice or obtain your consent before disclosing your personal data. A list of Bentley’s affiliates is in the List of Subsidiaries section of our most recent Form 10-K, available on the Annual Filings page. Contact us for information about other third parties that may process candidate personal data.

4. Do we transfer your personal data across borders?

Bentley is a global company, and your personal data may be transferred to, and stored in, the United States and other countries that may not provide the same level of protection as your own. Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum or the Swiss equivalent, as applicable), supported by a transfer impact assessment and additional safeguards where needed.

Bentley complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF”) with respect to personal data transferred from the European Union, the United Kingdom, and Switzerland to the United States. Bentley Systems, Incorporated has certified its adherence to the DPF Principles. In the event of any inconsistency between this Candidate Privacy Statement and the DPF Principles in relation to such personal data, the DPF Principles shall prevail.

If you have any inquiry or complaint concerning Bentley’s compliance with the DPF, please contact Bentley’s Data Protection Officer. Bentley will respond within forty-five (45) days.

Where Bentley is unable to resolve your complaint directly, you may refer the matter, at no cost to you, to the International Centre for Dispute Resolution division of the American Arbitration Association (“ICDR-AAA”), which Bentley has designated as its independent dispute resolution provider for DPF-related complaints. Further information regarding the ICDR-AAA DPF independent recourse mechanism is available at https://go.adr.org/dpf_irm.html.

If your complaint remains unresolved following these steps, you may be entitled to invoke binding arbitration before the DPF Panel. Further information is available in Annex I to the DPF Principles. To learn more about the DPF program and to view Bentley’s certification, please visit https://www.dataprivacyframework.gov/.

Because candidate data is human resources data collected in the context of the employment relationship, Bentley further commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (“DPAs”), the UK Information Commissioner’s Office (“ICO”) and the Gibraltar Regulatory Authority (“GRA”), and the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) with regard to unresolved DPF complaints concerning candidate personal data transferred from the European Union, the United Kingdom (including Gibraltar), and Switzerland.

If you have such an unresolved complaint, please contact the applicable DPA, the ICO, the GRA, or the FDPIC (free of charge). Under certain conditions, you may have the possibility to engage in binding arbitration to resolve residual disputes; for more information, please see Annex I of the DPF Principles.

If you reside in mainland China, we may transfer your data outside China in accordance with applicable law, as described in the China supplement below.

5. How long do we keep your personal data?

We keep your personal data on our servers and those of our service providers, which may be located in various countries. We retain it until the role you applied for has been filled, after which we keep it for as long as needed to meet our legal obligations, typically twelve (12) months. We delete your personal data when it is no longer needed for these purposes. Where, for technical reasons, we cannot fully delete data, we put appropriate measures in place to prevent its further use.

6. Do we use automated decision-making and AI?

We do not generally make recruiting or hiring decisions based solely on automated processing or profiling. If we ever rely solely on automated decision-making in a way that has a legal or similarly significant effect on you, we will apply the safeguards the law requires, including the right to human review, to express your view and to contest the decision.

Where Bentley products or recruitment tools use artificial intelligence, we do so under contracts that restrict use of your data, and we do not use your personal data to train third-party AI models.

7. How do we keep your data secure?

We use a combination of reasonable physical, administrative and technical controls, including access controls and encryption in transit and, where appropriate, at rest, to protect your personal data from unauthorised access or misuse. No method is perfectly secure. We limit access to your personal data to those who need it to perform their role. For more on our security practices, see the Trust Center.

8. What choices and rights do you have?

Depending on where you live, you may have the right to access, correct, update, delete or receive a copy of your personal data; to restrict or object to certain processing; to data portability; to opt out of any “sale” or “sharing” of personal data for cross-context behavioural advertising; and to withdraw consent where we rely on it. These rights may be limited in some circumstances, for example where we must retain data to meet a legal obligation.

We do not sell or share your personal data, and we do not sell or share the personal data of anyone under 16. We do not use or disclose sensitive personal data except as permitted by law.

To exercise a right, or if you are an authorised agent acting for an applicant, contact our Data Protection Officer. We may ask you to verify your identity, and may ask an authorised agent for proof of authorisation, before we act on a request. We honour recognised browser-based opt-out signals, including the Global Privacy Control, where the law requires. We will not discriminate against you for exercising your rights.

9. How do you contact us, and how will we tell you about changes?

We post the “Last updated” date above when we change this statement and, for material changes, give prominent notice or contact you directly. For any privacy question or request, contact our Data Protection Officer or write to: Data Protection Officer, Bentley Systems International Limited, 6th Floor, 1 Cumberland Street, Fenian Street, Dublin 2, D02 AX07, Ireland. We aim to resolve any concern with you directly; you also have the right to complain to the data protection authority where you live.

---

Jurisdiction-specific supplements

EU/EEA, the United Kingdom and Switzerland

If you are in the EEA, the controller of your personal data is Bentley Systems International Limited, Dublin, Ireland. We process candidate personal data on the bases of contract, legitimate interests, legal obligation, legal claims and, where required, consent (which you may withdraw).

You may confirm processing; access and receive a portable copy; rectify or erase; restrict or object; withdraw consent; and complain to a supervisory authority, including our lead authority, the Irish Data Protection Commission. In the United Kingdom and Switzerland, equivalent rights apply under the UK GDPR and the Swiss FADP, with complaints to the UK Information Commissioner’s Office or the Swiss Federal Data Protection and Information Commissioner.

United States

This supplement applies to applicants who are residents of US states with comprehensive privacy laws and prevails over the general statement as to your state-law rights. Subject to exceptions, you may confirm and access; correct; delete; receive a portable copy; opt out of any sale or sharing and certain profiling; and limit our use of sensitive personal information.

We do not sell or share your personal data, and we honour the Global Privacy Control. To exercise a right or appeal a decision, contact our privacy team; you may use an authorised agent and may contact your State Attorney General. California applicants, including employees, job applicants and business contacts, also have the right not to be discriminated against for exercising their rights.

China

Where we process the personal information of individuals in mainland China during recruitment, we do so under China’s Personal Information Protection Law. We obtain separate consent where required, including for cross-border transfers; we transfer personal information out of China only using a lawful mechanism or derogation, as applicable; and we maintain a local representative where required.

You may access, correct, delete and port your information, withdraw consent, and request an explanation of automated decision-making by contacting our privacy team.