BlueSnap HR Privacy Notice for Job Applicants

v1.1 April 2024

Introduction

As a Job Applicant within the BlueSnap global group of companies (BlueSnap Inc.), we recognize that privacy is part of your expectation, and this policy sets out how BlueSnap Inc. and its subsidiaries treat your personal data.

BlueSnap is committed to maintaining the principles of transparency, accountability and choice regarding the collection and use of your personal information.

Depending on your place of job application and/or employment legislation such as the GDPR, Data Protection Act 2018 (Ireland), Data Protection Act 2018 (UK), California Consumer Privacy Act 2020 as amended may apply.

Categories of Information Collected

BlueSnap may collect, process and store to the extent that it is relevant and permitted under your local law “Personal Information” on you, and as required, your relevant family/dependents, such as:

Identification data: name, marital name, first name, gender, date and place of birth, nationalities, contact information, emergency contact details, passport/ID card numbers, driving license details, photos;

Labor data: work permit number, social security/national insurance number, disability information, special benefit rights (if relevant);

Family status: marital status, names and dates of birth of spouse/partner, children, dependents, insurance and pension information;

Transportation data: relevant information relating to means of transport for reimbursement or contribution to travelling expenses, transportation cards, vehicle expenses, pertinent driving record information, etc.;

Extracts of police/military records, credit checks: where necessary and local law permits for relevant security clearances, fiduciary checks;

Career and education: diplomas, degrees, training certificates, foreign languages, CVs, continuing education programs, educational courses ;

Job records: employment agreement details, hire date, termination date, division, department, reporting structure, employee number, job titles, work information, job description, work phone and email, work hour records, absence records (sick leave, special leave, maternity/parental leave, vacation records, overtime hours, annual performance evaluations, etc.);

Use of information systems: BlueSnap monitors use of its computer devices and networks to prevent data leaks and threats from third parties.

Video surveillance and access card control data: in accordance with industry and PCI standards, BlueSnap is required to provide video surveillance systems in certain BlueSnap premises;

Any other personal information that BlueSnap requires to manage the employment relationship or that you have supplied to us or agreed to have BlueSnap check or be provided with when applying for a position or change of position, including assessment reports from previous employers, employment agencies, background checks and reports. Certain senior positions and international appointments and directorships may involve the disclosure, review and storage of employee and family financial records and interests, shareholdings, etc., both within and outside the local jurisdiction of employment. When required by local law, collection and storage of such Personal Information is subject to your express prior consent.

Purposes of Collection

Personal Information is collected, processed, and stored by BlueSnap including, without limitation, for the following purposes:

To check qualifications, suitability for employment
Job application management and review
For international mobility – visa requirements, etc.
To provide services to employees – meal programs, transportation payments, etc.
Stock unit plans/employee share allocations
Performance management
Security management, surveillance and access monitoring
Resources management
Staff training programs
Staff award and recognition programs
Services to customers – customer service solutions
Disclosure to authorities – in accordance with requests by judicial authorities and/or law enforcement agencies in the context of legal investigations, disclosure subject to local law in respect of BlueSnap’s protection of its legal rights or support of any claim, defense or declaration in a matter or before any administrative authority, arbitration or mediation panel, in the context of disciplinary actions/investigations, data breach claims, or of internal or external audit inquiries.

Categories of Third Parties Where Personal Information May Be Shared

BlueSnap may share relevant Personal Information within the BlueSnap group of companies or external recipients such as:

Service and benefit providers involved in various Human Resources data processing as described above
Local or other authorities including in connection with public health and safety requirements
Financial advisers
Outside counsel, auditors to establish BlueSnap’s legal rights and defend against legal claims
Business investors in the event of planned company merger or acquisition
Customers in the course of business activities

International Transfers

BlueSnap may transfer Personal Information within the BlueSnap group to its appropriate data management centers and servers including central processing and storage in the USA, Israel and also BlueSnap’s bona fide service providers for processing and storage of such data.

Certain countries may have levels of protection that differ to those in force in the country where the Personal Information is collected.

Data Security

BlueSnap may take appropriate technical and organizational measures in accordance with local law requirements to protect Personal Information against accidental or unlawful destruction or loss, alteration, unauthorized access, or disclosure.

Personal Information shall be stored only for the time necessary for the purposes stated in this policy or as permitted by applicable law.

Access and Modification

You have the right to access, update, and correct your Personal Information that BlueSnap has collected subject to requirements of applicable law. For this purpose, you may exercise such rights by contacting your HR Privacy Contact:

Head of Human Resources

[email protected]

Specific Provisions for EU, UK and Israel-Based Applicants

The European Union, UK and Israel have established certain standards of protection regarding the handling of Personal Information relating to persons based in those countries.

BlueSnap’s central Human Resources department is located in the USA with additional resources based in our Israel office. We therefore need to transfer Human Resources data relating to employees based in other countries to the US and Israel. Transfers of data shall be subject to the legal requirements of such countries.

EU-U.S. Data Privacy Framework program and UK Extension

BlueSnap complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. BlueSnap has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program, and to view BlueSnap’s certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the EU-US Data Privacy Framework Principles, BlueSnap commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union and United Kingdom individuals with DPF inquiries or complaints should first contact BlueSnap at:

Head of Human Resources

[email protected]

BlueSnap Corporate HQ, 800 South St., Suite 640, Waltham, MA
Tel: +1 (781) 790-5013

If your complaint involves human resources data transferred to the United States from the European Union, the United Kingdom in the context of the employment relationship, and BlueSnap does not address it satisfactorily, BlueSnap commits to cooperate with the panel established by the EU data protection authorities (DPA Panel), and the UK Information Commissioner’s Office (ICO), and to comply with the advice given by the DPA panel or ICO, with regard to such human resources data. To pursue an unresolved human resources complaint, you should contact the state or national data protection or labor authority in the appropriate jurisdiction. Contact details for the EU data protection authorities can be found at https:// edpb.europa.eu/about-edpb/board/members_en.

Cross-Border and Onwards Transfer

BlueSnap shall ensure that when there are cross-border transfers of Personal Information to third parties, such parties shall be compliant with the applicable legal requirements.

Sensitive Information

Except when required by local data privacy law or if provided voluntarily, BlueSnap does not collect or process Personal Information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, data concerning health or sexual preferences.

Sharing of Personal Information

Internal: BlueSnap may share Personal Information only when relevant with the following BlueSnap authorized personnel who need access in the context of their work roles with BlueSnap for the purposes described above:

Supervisors and line managers, HR department, IT personnel, legal department, financial controllers, and accounting personnel.

External service providers and contractors: BlueSnap may share Personal Information when relevant with third-party providers, such as:

Payroll administrators, benefits providers and administrators, IT systems providers, financial institutions, pension/retirement plan institutions, insurance agents and insurance companies, consultants and professional advisors;
Employment or recruitment agencies and placement services;
Other service providers involved in the provision of services to Job Applicants;
Training services, customer support services

Local & National Authorities, Regulators, Internal Investigations

BlueSnap may share information with local and national authorities, regulators and law enforcement
Tax authorities, social security/national insurance/welfare authorities, judicial authorities, employment/labor or other authorities;
Independent accountants, auditors, attorneys, corporate security and legal firms;

Choice

BlueSnap will obtain your express consent before we use your personal information for a purpose other than which it was originally collected or subsequently authorized.

Access and Modification

You have a right to access your Personal Information in accordance with your local laws wherever the data is processed or stored, and you may modify or delete Personal Information that has not been processed in accordance with the SCCs. You can also object to the processing of your Personal Information as described in this Policy provided that you have legitimate reasons to do so.

Additional Statutory Rights – GDPR & UK Data Protection Act

EEA- and UK-based Employees have a number of statutory rights under the General Data Protection Regulation, , Data Protection Act 2018 (Ireland) or Data Protection Act 2018 (UK). You can:

Access and obtain a copy of your data on request;
Require the organisation to change incorrect or incomplete data;
Require the organisation to delete or stop processing your data, for example, where the data is no longer necessary for the purposes of processing; and
Object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing

Additional Statutory Rights – California Privacy Rights Act (CPRA) and California Consumer Privacy Act (CCPA)

The above legislation provides the additional rights and protections for Applicants based in California as follows as from 1^st January 2023;

Right to know what information is held relating to you
Right to correct and also the right to delete personal information held by BlueSnap or a BlueSnap service provider (subject to exceptions)
Right to request that personal data not be sold to third parties (not relevant for BlueSnap at present as data is not sold or transferred for value)
Right not to be discriminated against for actioning such rights

You may exercise your rights by contacting your HR Privacy Contact:

Head of Human Resources

[email protected]

Prior Version:

v1.0 June 2023