Candidate Privacy Notice

This Privacy Notice (“Notice”) describes Jumio Corporation, and its affiliates including Jumio Software Development GmbH, Jumio UK Limited, Jumio Software Development Canada LTD, Jumio India Pvt. Ltd., and Jumio Singapore Pte Ltd (collectively “Jumio”), privacy practices concerning personal information collected in connection with Jumio’s application, recruitment, and hiring processes (“Candidate Services”).

This Notice provides information about the personal information collected from the Candidate Services we process on our own behalf.

1. Our relationship with you

Data protection laws and privacy laws in certain jurisdictions, like the European Economic Area (“EEA”), differentiate between “controllers” and “processors” of personal information. A controller decides why and how to process personal information. A processor processes personal information on behalf of a controller, based on the controller’s instructions.

Jumio processes personal information in connection with Candidate Services in the capacity of a data controller. You are not required to provide your personal information to Jumio. However, if you do not provide us with your personal information, we may not be able to provide our Candidate Services.

2. Personal information we process

Information you provide when you use Candidate Services

When you engage with Jumio for the Candidate Services, we collect the following categories of personal information you provide directly to us by submitting an application to Jumio:

• personal Identifiers (e.g., name, title, addresses, telephone numbers, and personal email addresses, Social Security Number, driver’s license, or other government issued identifier)
• professional or employment-related information (e.g., salary history, annual leave, pension and benefits information, copies of right to work documentation, references and other information included in a resume or cover letter, employment records (including job titles, work history, working hours, training records and professional memberships), location of employment or workplace)
• electronic or visual Information (e.g., photographs, CCTV footage and other information obtained through electronic means as part of the recruitment process)
• Inferences drawn from any of the preceding information or Jumio’s internal surveys to create a profile of the candidate’s characteristics, behavior, attitudes, intelligence, abilities and aptitudes
• other information you may provide to Jumio in response to questions related to Candidate Services
• certain categories of sensitive information (e.g., Jumio may request information related to gender, identity, religious, or political affiliation, sexual orientation, age, language, veteran status, race, ethnicity or other defining characteristics. This information sharing is voluntary and is not used in the hiring or selection process or to determine eligibility for any role.)
• additional Information for California Residents: We may also process characteristics of protected classifications under California or federal law such as date of birth, gender, and national origin (ethnicity), and personal information categories listed in the California Customer Records Statue

Information automatically processed when you use Candidate Services

When you use Jumio Candidate Services via a Jumio Website, we may also automatically collect certain information which enables us to provide, improve, and develop our Candidate Services. Further information is provided in our Website Privacy Notice.

We may also use cookies in connection with the Candidate Services. For information about cookies and similar tracking technologies, visit our Cookie Notice.

Information collected from third parties

To the extent permitted by applicable law, we may also collect personal information through public sources (e.g., LinkedIn, etc.), personnel consultants or recruitment agencies, or through professional reference sources.

3. How we use your personal information

Overall, Jumio processes the personal information listed in Section 2 to:

• provide the Candidate Services including but not limited to hiring, conducting background checks, managing and maintaining Jumio-candidate relations, determining compensation and benefits, keeping records, and other functions related to hiring, effectively conducting our payroll processes, and to contact you and to inform you of matters relating to the hiring process;
• establish, exercise or defend legal claims;
• investigate, prevent, or take action regarding illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property, the property or physical safety of any person or third party;
• facilitate the financing, securitization, insuring, sale, assignment, bankruptcy, or other disposal of all or part of Jumio’s business or assets;
• protect and improve the security and efficiency of the Candidate Services;
• anonymize the personal information and generate statistical or aggregated reports;
• comply with legal and/or regulatory requirements; and
• perform analytics and research concerning the Candidate Services and to improve the Candidate Services.

4. How we share personal information

Sharing for business purposes. We may provide personal information to service providers to help deliver, manage, and improve the Candidate Services. We may share all the categories of information listed in this Notice with other companies including affiliates, subsidiaries, or parent companies:

• to operate our Candidate Services or support general operations of business;
• to use third-party cloud services to process the personal information; and
• for any other legitimate business purpose.

Corporate transactions. In the event of a corporate sale, merger, reorganization, dissolution or similar event, any personal information, and data we process from you may become part of the assets we transfer or share in preparation for any such transaction. Any acquirer or successor of Jumio may continue to process personal information consistent with this Notice.

Compliance and compelled disclosures. We may share personal information:

• with public authorities to respond to valid and enforceable subpoenas, court orders, and other legal process, or as otherwise required by law;
• to protect the rights, privacy, safety, and property of Jumio, our Customers, our business partners, or others; and
• to exercise our legal rights or defend against legal claims, to enforce our contracts, to investigate, respond to and resolve problems, or to permit us to pursue available remedies or limit the damages that we may sustain.

Aggregated information. From time to time, Jumio may also share anonymized and/or aggregated information, such as by publishing a report on trends in the usage of our Candidate Services.

Information for California residents. Other than with your consent, Jumio does not sell or share your personal information. The terms “sell”, “share”, and “personal information” are defined by the California Consumer Privacy Act (the “CCPA”).

5. Storage, retention, and transfers

Storage

The personal information described in this Notice may be transferred to and processed in the United States for the purposes described above. Jumio also may subcontract the processing of your data to, or otherwise share your data with, affiliates or third parties in the United States or countries other than your country of residence. The data protection laws in these countries may be different from, or less stringent than, those in your country of residence.

Transfers of your personal information out of European Economic Area (“EEA”), United Kingdom, and Switzerland

We take measures to help protect your personal information when it is transferred from the EEA, United Kingdom, and Switzerland to third countries. We may rely on European Commission adequacy decisions about certain countries, as applicable (see here). Where applicable, we rely on standard clauses approved by the European Commission (see here) in our contracts with third parties that receive information from both inside and outside the EEA, or transfer on the basis of permissible statutory derogations.

Retention

Jumio will retain the personal information for the duration of the application process, and for a maximum of 36 months thereafter. This is so that we can consider you for further employment opportunities. You can withdraw your consent at any time.

6. Security

Jumio uses commercially reasonable physical, electronic, and procedural safeguards designed to protect your personal information against loss or unauthorized access, use, modification, or deletion. However, no security program is foolproof, and thus Jumio cannot guarantee the absolute security of your personal information or other information. For more information about our Security program, please visit our Security page.

7. Your privacy rights

You can exercise any of the rights described in this section consistent with applicable law by emailing [email protected] Please note that we may ask you to verify your identity and request, before taking further action on your request.

Data Access and Portability. In some jurisdictions, applicable law may entitle you to:

• request certain copies of your personal information or information about how we handle your personal information,
• request copies of personal information that you have provided to us in a structured, commonly used, and machine-readable format, and/or
• request that we transmit this information to another service provider (where technically feasible).

Data Deletion. In certain jurisdictions, you can request that your personal information be deleted. Please note that if you request the deletion of your personal information:

• We may retain your personal information as necessary for our legitimate business interests, such as prevention of money laundering, fraud detection and prevention, and enhancing safety.
• We may retain and use your personal information to the extent necessary to comply with our legal obligations. For example, Jumio may keep information for tax, legal reporting, and auditing obligations.
• Because we take measures to protect data from accidental or malicious loss and destruction, residual copies of your personal information may not be removed from our backup systems for a limited time.

In accordance with applicable law, you may also have the right to: (i) request confirmation of whether Jumio is processing your personal information; (ii) object to or restrict our uses of your personal information; (iii) seek correction or amendment of inaccurate, untrue, incomplete, or improperly processed personal information; and (iv) lodge a complaint with the competent supervisory authority or regulatory agency.

Where we process your personal data based on your consent, you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

We will not discriminate against you for exercising any of the above rights.

Appeals. If you are a resident of the Commonwealth of Virginia, you may request an appeal of a refusal of a request regarding your privacy rights under the Virginia Consumer Data Protection Act by sending an email to [email protected].

8. Other important information

Automated decision making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Criminal convictions

We may only use information relating to criminal convictions as part of the Candidate Services where the law allows us to do so and in line with our Notice.

Legal basis for processing

If you are an EEA resident, Jumio processes your personal information on the following legal bases under the General Data Protection Regulation (“GDPR“):

• Jumio’s and its Customers’ prevailing legitimate interest to achieve the purposes set out in Section 3 above;
• the necessity to comply with legal obligations to which Jumio is subject;
• the necessity for the establishment, exercise or defense of legal claims; and
• your consent.

9. Changes to this notice

As revisions to the Notice are made, Jumio will post any updates on the Notice at https://www.jumio.com/legal-information/privacy-notices/candidate-notice/, we recommend reviewing that page periodically. If we make a material change to the Notice, you will be provided with appropriate notice.

10. Contacting Jumio

If you have any questions or comments regarding Jumio’s Notice, please send an email to [email protected]. If you prefer to contact us by mail, please write to Jumio Corporation, ATTN: Privacy, 395 Page Mill Road, Palo Alto, CA 94306.

Jumio’s representative in the EU is Jumio Software Development GmbH, Stättermayergasse 28, 1150 Vienna, Austria. Jumio’s Data Protection Officer may be contacted at [email protected]