Applicant and Employee Privacy Policy and Notice of Collection

Effective Date: December 28, 2022 

Salsify, Inc., our subsidiaries and affiliated companies ("Salsify," "we," "us," and "our") are committed to protecting your privacy. This Applicant and Employee Privacy Policy and Notice of Collection ("Policy") describes the privacy practices that apply to our collection, use and disclosure of information relating to you as an identified or identifiable applicant or employee ("Personal Data" or “Personal Information” as defined by applicable Privacy Laws) when you ("you") engage with us for employment or internship opportunities, via any method (collectively, the "Sites"), as well as how we use and share that information.

If you have any questions about this Policy, please contact us at privacy@salsify.com.

Personal Data We Collect

To process your application, we ask you to provide Personal Data about yourself. You provide your information voluntarily, and you determine the extent of information you provide to Salsify. However, some information may be necessary to complete an evaluation of your application and without it our ability to consider you as a candidate may be limited.  If you're successful in your application for a position at Salsify, we retain the information that you provide during the application process, and information about your application process, as part of your employee records.   
The sources and type of information we may collect as part of your application or retain as part of your employee record depends on your role with us and may include the following sources and types of information:

• Identifiers such as full name, home and business addresses, telephone numbers, email addresses, and such information about your beneficiaries or emergency contacts. Government identification information such as Social Security number, birth certificate number, and driver’s license number.
• Recruitment, employment, or engagement information such as application forms and information included in a resume, cover letter, or otherwise provided through; and copies of identification documents, such as driver’s licenses, passports, and visas; and background screening results and reference checks, and our evaluations of your performance during the interview process.
• Career information such as job titles; work history; work dates and work locations; employment, service, or engagement agreements; appraisal and performance information; information about skills, qualifications, experience, publications, speaking engagements, survey responses, and preferences (e.g., mobility); absence and leave records; professional memberships; disciplinary and grievance information; and termination information.
• Financial information such as salary, payroll, equity grants or retirement contribution information; and bank account and tax information, and business travel and expense information.
• Medical information about you, and, if applicable, your beneficiaries, such as medical conditions and other information provided in health forms; disability status; health and safety incidents or accidents; sickness records; and health issues requiring adaptations to your working environment or working practices.
• Education Information such as institutions attended, degrees, certifications, training courses, publications, and transcript information.
• Internet, electronic network, and device activity and device information and related identifiers such as information about your use of the Salsify network, information, and communication systems, including user IDs, IP addresses, device IDs, web logs, metadata, and audit trails of system access, as may be further detailed in our acceptable use policies and related policies regarding the security of our network.
• Audio or visual information such as CCTV footage, as well as other information relating to the security of our premises; recorded teleconferences, videoconferences and presentations in which you participate; and photographs and video taken at Salsify functions or for marketing.  
• Legally protected classification information such as race, sex/gender, gender identity/expression, sexual orientation, marital status, military service, nationality, ethnicity, request for family care leave, and criminal history.
• Personal Data from third parties: Salsify may also collect information from third parties who are lawfully entitled to share your information with us, for example, in connection with a background or employment check or an employment reference. Other examples include social media sites, such as LinkedIn.
• Personal Data collected automatically: We automatically gather Personal Data from our Sites, for example, from our "Salsify Careers" page where you can visit and search for open positions. For more details about the Personal Data we collect through our Sites, please see our general Privacy Policy (https://www.salsify.com/privacy-policy).

How We Use and Share Your Personal Data

We take care to limit access to your Personal Data to only those who need access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. We may disclose Personal Data about you with the following types of third parties in the following circumstances:

• With our subsidiaries and affiliated companies: We may share your Personal Data with our affiliated companies and its employees, to carry out the purposes described in this Policy, including managers, human resources, and executive leadership, as well as payroll, IT, legal, information security, and finance.
• With Vendors, consultants and other service providers: We may share your Personal Data internally and with service providers, agents and other third parties; for example, recruiters, consultants, attorneys and background checking services as necessary in connection with recruiting, employment, corporate governance, acquisitions, and legal or regulatory requirements. We require these third parties to protect the information they receive with appropriate security measures and prohibit them from using the information for their own purposes or outside what is necessary to provide the service.
• In order to comply with laws or any competent law enforcement body, regulatory body, government agency, court or third party: We may disclose information where we believe disclosure is necessary or required by law or regulation, to comply with legal process or government requests (including in response to public authorities to meet equal opportunity laws, national security or law enforcement requirements); or to exercise, establish or defend our legal rights.
• Business transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, acquisition, dissolution, corporate reorganization or similar event. We will inform any buyer that your information shall only be used in accordance with this Policy.
• With your consent: We may disclose your Personal Data for any purpose with your consent.

International Transfers of Your Personal Data

Salsify operates globally, which means personal data may be stored and processed in any country where we have facilities or in which we engage service providers, including where we have data centers.  By using Salsify or providing personal data for any of the purposes stated above, you acknowledge that your personal data may be transferred to, or stored in the United States, or in other countries around the world as indicated above.  Such countries may have data protection rules that are different from those of your country. In certain limited circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal data.

Salsify processes personal data in (i) any country where we have facilities, (ii) any country in which we engage service providers; or (iii) any country where events are held.   Salsify will comply with applicable laws for any such international transfers as further described in this Policy.

Security

We take security seriously and use appropriate technical and organizational security measures to safeguard your information. But we also encourage you to take care when disclosing Personal Data online and to use tools, such as endpoint security, Internet firewalls, anti-virus and anti-spyware software, and similar technologies to protect yourself online.

Our Retention of Your Personal Data

We'll retain your Personal Data for as long as required to comply with our legal obligations, resolve disputes, and to enforce our contractual agreements, or as necessary for our legitimate interests, such as to consider you for other current and future employment opportunities at Salsify, or will otherwise dispose of such information in accordance with our records retention policy.

As mentioned above, If you're successful in your application for a position at Salsify, we retain the information that you provide during the application process, and information about your application process, as part of your employee records.

If you are not successful, we may also retain your resume and application details to enable consideration for future opportunities at Salsify.  If you do not want us to retain your information for consideration for other roles, or want us to update it, please contact privacy@salsify.com.  Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

Your Responsibilities

You are responsible for the information you make available to Salsify, and you must ensure it is honest, truthful, accurate, and not misleading in any way. You must ensure that the information does not contain material that is obscene, defamatory, or infringing on any rights of any third party; does not contain malicious code; and is not otherwise legally actionable. Further, if you provide any information concerning any other person, such as individuals you provide as references ("referee"), you are responsible for providing any notices and obtaining any consents necessary for Salsify to collect and use that information as described in this Policy before you provide the referee's Personal Data to Salsify.

Privacy Notice for California Residents

Privacy Rights for California Residents

California residents have certain rights regarding their Personal Data. Subject to certain exceptions, if you are a California resident, you may request:  

• access to your Personal Data including the right to know the categories of Personal Data we have or will collect about you and the reason we will or have collected such information;
• correction of the Personal Data that we have or will hold about you that is inaccurate; and
• deletion or removal of your Personal Data. 

You also have the right not to be discriminated against (as provided for in California law) for exercising your rights.

Exceptions to Your Rights: There are certain exceptions to these above rights. For instance, we may retain your Personal Data if it is reasonably necessary for us or our service providers to provide a service that you have requested or to comply with law or to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for that activity.

Exercising Your Rights: To exercise one of the rights above, you may contact us as provided below.

We will take reasonable steps to verify your identity before responding to a request. In doing so, we may ask you for verification information so that we can match at least two verification points with information we maintain in our files about you. If we are unable to verify you through this method, we shall have the right, but not the obligation, to request additional information from you.

California law places certain obligations on businesses that “sell” Personal Data to third parties or “share” Personal Data with third parties for “cross-context behavioral advertising” as those terms are defined under the CCPA. We do not “sell” or “share” the Personal Data covered by this Policy and have not done so in the twelve months prior to the effective date of this Policy.

Sensitive personal data

Some Personal Data may be considered sensitive personal information under certain privacy laws, including the California Consumer Privacy Act (“CCPA”). Sensitive personal information may include, for example, government-issued identification number, information relating to a person's race or ethnic origin, political opinions or religious beliefs, physical or mental health or condition, sexual orientation, or trade union membership. It may include information about an individual's criminal offenses or convictions, as well as any other information deemed sensitive under applicable data protection laws.

Salsify does not request sensitive Personal Data in connection with recruiting and your application unless permitted or required by local law (for example, for equal opportunity monitoring or internal policies related to diversity and anti-discrimination). Where required by applicable data protection or privacy law, we will obtain your consent to our use of your sensitive Personal Data.

When Sensitive Personal Data is collected for the employment relationship between you and Salsify, we only collect such information for the purposes disclosed in this Notice, and not for any purposes for which California law provides a "right to limit" such use. Pursuant to the forgoing, we use such information only as necessary to conduct our employment relationship with you, in the following ways:

• Social Security number or passport information for legal compliance, payroll, benefits, tax, and immigration purposes.
• Health information, which may include disability status, to provide reasonable workplace accommodations and manage absences, for workplace health and safety purposes, and for compliance with applicable law and contracts or to exercise rights thereunder.
• Racial/ethnic origin, citizenship/immigration status, sexual orientation, religious beliefs, and/or disability status for equal opportunity and diversity, equity and inclusion purposes and compliance with applicable law or to exercise rights thereunder.

Residents of the European Economic Area and United Kingdom

You may have legal rights under applicable law, including the General Data Protection Regulation (GDPR) applicable to EU residents' personal data or UK General Data Protection Regulation (UK GDPR) if you are a resident of the United Kingdom.  This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the GDPR and UK GDPR.  

Our Legal Bases for Storing and Processing Your Personal Data

Our legal bases for processing your Personal Data, in the ways described in this Policy, include:

• As necessary to prepare and enter into an employment contract with you.
• Consistent with specific consents, which you may revoke at any time.
• As necessary to comply with our legal obligations.
• To protect your vital interests or those of others.
• As necessary for legitimate interests, including interests in considering candidates for current and future employment opportunities, and in managing and improving our recruitment and hiring processes, unless those interests are overridden by your interests or fundamental rights and freedoms, which require protection of personal data.

International Transfers

We will protect your personal information when it is transferred outside of the EEA by:

• Processing it in a territory which the European Commission has determined provides an adequate level of protection for personal information; or
• Otherwise implementing appropriate safeguards to protect your personal information, including implementing the European Commission's standard contractual clauses.

Data with special protections 

Information such as health information is subject to special protections. We may process such data where necessary to carry out our obligations or for the establishment, exercise or defense of a legal claim by us, or with your explicit consent, or for the exercising of our rights or your rights in the context of employment or social security law. For example, we may need to process information about your health to accommodate any special needs you have if you are selected for an interview.

Your Privacy Rights: access, correction, erasure, and restriction

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a data subject access request). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party. If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact privacy@salsify.com.

Changes to this Policy

Salsify will review and update this Policy periodically in response to changing legal, technical, and business developments. When we update this Policy, we will note the date of its most recent revision above. If we make material changes to this Policy, we may take appropriate measures to inform you in a manner that is consistent with the significance of the changes we make. We encourage you to review this Policy frequently for information on how Salsify is processing your information.

How to Contact Us

If you have any questions or concerns regarding this Policy or wish to exercise your privacy rights under applicable data protection laws, you may email us at privacy@salsify.com. You can also contact us by writing to this address:
Salsify, Inc.
Attention: 
Data Privacy Officer
101 Federal Street, Suite 2600
Boston, MA 02110