Candidate Privacy Notice

What Categories of Personal Data Do We Collect?

Below details the categories of personal data we may collect and may have collected over the past twelve (12) months. Note that depending on where you are in the application stage (e.g., screening, assessment tests, interviews, background and reference checks, or decision stage), the collection, use, and disclosure of your personal data may vary.

• Personal Contact Data such as name, alias, mailing address, email address, phone number. 
• Internet or Other Electronic Network Activity Data such as information regarding your interaction with our career website, application, or advertisement (including chats and instant messaging).
• Geolocation Data such as IP-address-based location information and GPS data.
• Sensory Data such as photos, videos, and recordings of you and your environment.
• Professional or Employment-Related Data such as resume, job title, job history, performance evaluations, membership in professional organizations and unions, and job interview notes, responses to screening questions and assessment results.
• Education Data such as grades or transcripts, student financial information, and student disciplinary records.
• Special Categories of Personal Data such as genetic, biometric and health data, as well as personal data revealing racial and ethnic origin, political opinions, religious or ideological convictions or trade union membership.

Legal Basis for Processing your Personal Data

We only process your personal data where applicable law permits or requires it, including where the processing is necessary to assess your potential employment with us, where the processing is necessary to comply with our legal obligations or for our legitimate interests or the legitimate interests of third parties, or with your consent. We may process your personal data for legitimate business purposes and for the following purposes:

• Process and manage your application: We use your personal data to process your job application, establish a job applicant profile for the recruitment process, assess your qualifications for a specific role with us, schedule and conduct interviews, communicate with you, and carry out background and reference checks (see the following bullet point for additional information). We may collect audio and visual information of job applicants through photographs used for identification purposes. With your consent, we may record video of you in connection with the application process, for example through a third party screening service. 
• Process and manage your employment: If you are offered a position with us, we will use your personal data in the employee on-boarding process and managing your personnel records including enrolling and administering employee benefits, paying wages, managing workflows, carrying out job promotion processes, evaluating performance, and other related employment purposes (as authorized by you and permitted by applicable law). 
• Conduct reference and background checks (as permitted by applicable law): We use personal data we collect to conduct reference checks and to evaluate your qualifications and experience. We may also conduct background checks (as authorized by you and permitted by applicable law).
• Provide immigration support: If applicable and as permitted by applicable law, we may collect your personal data to assist with immigration support, such as applying for visas or work permits. 
• Analyze and improve our recruitment process and tools: For example, we analyze trends in our applicant pool, and use personal data to understand and improve our recruitment process and tools (including improving diversity and inclusion). 
• Record-keeping: We keep records of your personal data as required by law and in accordance with our record retention policies. 
• Meeting legal requirements and enforcing legal terms: We collect and process your personal data for purposes of: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, us or another party; enforcing any agreements with you; responding to claims; and resolving disputes. Additionally, we may use information about protected characteristics to analyze and monitor the diversity of our job applicants in accordance with applicable laws.

We will only process your personal data for the purposes we collected it for or for compatible purposes. If we need to process your personal data for an incompatible purpose, we will provide notice to you and, if required by law, seek your consent. We may process your personal data without your knowledge or consent where required by applicable law or regulation.

We may also process your personal data for our own legitimate interests, including for the following purposes:

• To prevent fraud.
• To ensure network and information security, including preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution.
• To support internal administration with our affiliated entities.
• To conduct data analytics analyses to review and better understand our recruitment process.

You will not be subject to decisions based on automated data processing without your prior consent.

Collection and Use of Special Categories of Personal data

We may collect and process certain special categories personal data about you, such as genetic, biometric and health data, as well as personal data revealing racial and ethnic origin, political opinions, religious or ideological convictions or trade union membership, to the extent such processing is necessary for us to carry out our obligations with respect to your application. Where we have a legitimate need to process special categories of personal data about you for purposes not identified above, we will only do so only after providing you with notice and, if required by law, obtaining your prior, express consent.

How We Disclose Personal data

Unless specifically noted, we disclose personal data to the categories of service providers and other parties listed in this section.

• Affiliates.  Our affiliates help us to perform business functions on our behalf.
• Service Providers.  These parties help us to perform business functions on our behalf.  They include:
  • Hosting, technology and communication providers.
  • Security and fraud prevention consultants.
  • Background and reference check screening services.
  • Hiring process and benefits management and administration tools.
  • Health and safety technology providers.

Data Security 

We seek to protect your personal data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of personal data and how we are processing that information. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism, limiting access to your computer or device and browser, and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

Data Retention

We retain personal data about you for as long as necessary to perform our business or commercial purposes, including employment-related purposes, for collecting your personal data. When establishing a retention period for specific categories of personal data, we consider who we collected the personal data from, our need for the personal data, why we collected the personal data, and the sensitivity of the personal data. In some cases we retain personal data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally. 

Note that if you are a Job Applicant that applied through a third-party such as a recruiting company or submitted your application through a recruiting software (e.g., Greenhouse, Jobvite, Linkedin, etc.), you may be subject to their separate terms of service and privacy policy.

Your Rights under the GDPR

If you are a Job Applicant located in the EEA, Switzerland, or the UK, we are required to provide you with additional information about our processing of your personal data. Please note that, except as otherwise provided by applicable law, the information in this section as well as the other sections of this Privacy Notice apply to you. 

If you are a Job Applicant located in the UK, Switzerland or EEA, the Company is the controller of your personal data. As a data controller, the Company is responsible for ensuring that the Company’s processing of your personal data complies with the GDPR. 

Rights of Access, Correction, Erasure, and Objection

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during the recruitment process. By law, you may have the right to request access to, correct, and erase the personal data that we hold about you, or object to the processing of your personal data under certain circumstances. You may also have the right to request that we transfer your personal data to another party. 

Right to Withdraw Consent

Where you have provided your consent to the collection, processing, or transfer of your personal data, you may have the legal right to withdraw your consent under certain circumstances.

We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal data that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you, or we may have destroyed, erased, or anonymized your personal data in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Cross-Border Data Transfers

Where permitted by applicable law, we may transfer the personal data we collect about you to the United States and other jurisdictions that may not be deemed to provide the same level of data protection as your home country for the purposes set out in this Privacy Notice. Where necessary, we have implemented standard contractual clauses to help secure the transfer and/or rely on the Data Privacy Framework, as described below.

Additionally, the Company and our affiliates, comply with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK-U.S. DPF”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “DPF”) as set forth by the U.S. Department of Commerce. The Company has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of all personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF (the “EU-UK DPF Principles”). The Company has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF (the EU-U.S. DPF Principles, the EU-UK DPF Principles, and the Swiss-U.S. DPF Principles, collectively, the “DPF Principles”). If there is any conflict between the terms in this Privacy Notice and the DPF Principles, the DPF Principles shall govern. To learn more about the DPF, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The Federal Trade Commission has jurisdiction over the Company’s compliance with the DPF. This Privacy Notice describes the types of Personal Data we collect, the purposes for which we collect and use your Personal Data, and the purposes for which we disclose your Personal Data to certain types of third parties in the sections above. Pursuant to the DPF, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain Personal Data relating to you in the U.S. Upon request, we will provide you with access to the Personal Data that we hold about you. You may also correct, amend, or delete the Personal Data we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the U.S. under DPF, should direct their query to legal@landfall.ai. If requested to remove data, we will respond within a reasonable timeframe.

In addition, we will provide you with the choice to opt-out from the sharing of your Personal Data with any third parties (other than our agents or those that act on our behalf or under our instruction), or before we use it for a purpose that is materially different from the purpose for which it was originally collected or subsequently authorized.

We will provide you with the choice to opt-in to sharing your sensitive Personal Data with any third parties or if we plan to process your Personal Data for a purpose other than those for which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your Personal Data, please submit a written request to legal@landfall.ai.

In addition to any other disclosures described in this Privacy Notice, in certain situations, we may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

The Company’s accountability for Personal Data that it receives in the U.S. under the DPF and subsequently transfers to a third party acting as an agent on our behalf is described in the DPF Principles. In particular, the Company remains liable under the DPF Principles if our agents process Personal Data in a manner inconsistent with the DPF Principles, unless the Company proves that we are not responsible for the event giving rise to the damage.

In compliance with the DPF, the Company commits to resolve DPF Principles-related complaints about our collection and use of your Personal Data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPF should first contact us at legal@landfall.ai.

Further, the Company commits to cooperate and comply with, respectively, the panel established by the EU data protection authorities and the Swiss Federal Data Protection and Information Commissioner with regard to unresolved complaints concerning our handling of human resources data received in reliance on the DPF in the context of the employment relationship.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Annex 1 of the DPF Principles, located at https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.

Contact for Questions

If you have any questions or comments regarding this Privacy Notice, the ways in which we collect and use your personal data or your choices and rights regarding such collection and use, please contact:

• legal@landfall.ai
• Landfall Labs Inc.
  3500 South DuPont Highway in the City of Dover
  County of Kent, 19901
  United States of America

Individuals with disabilities may access this Privacy Notice in an alternative format by contacting legal@landfall.ai