Effective Date: February 1, 2021
iCIMS, Inc. and its subsidiaries, iCIMS International, LLC, Jibe, Inc., TextRecruit, Inc., Opening HR Limited, EasyRecrue S.A.S., and Altru Labs, Inc. (collectively, “iCIMS,” “we,” or “us”), respects the privacy of its employees (collectively, “employee(s) or “you”), and we are committed to protecting their respective personal data. To that end, we have put together this Employee Privacy Notice to give you a better understanding of what personal data we collect about you as an employee, what we use that personal data for, and to whom we disclose that data (“Employee Privacy Notice”).
To see information about iCIMS’ collection of job applicants’ personal data, please visit the iCIMS’ Job Applicant Privacy Notice.
For purposes of this Privacy Notice:
Please take the time to read this Employee Privacy Notice and the related statements in their entirety to ensure you are fully informed. If you have any questions or concerns about our processing of your personal data, please contact us by using the contact details under the “Contact Information” heading below.
This Employee Privacy Notice is a general guide on how iCIMS processes its employees’ personal data. As such, employees should be aware that data protection and privacy laws can vary in different jurisdictions where iCIMS operates and has employees. iCIMS’ policy is to comply with applicable laws, including requirements in certain countries that iCIMS notify its employees in that country of its personal data practices, and in some cases, obtain consent to those practices.
Where applicable laws are stricter than the practices described in this Employee Privacy Notice, iCIMS has adopted specific privacy practices in those locations to satisfy those stricter requirements.
As further described below, we collect several types of personal data from employees, such as the following:
We may also collect certain demographic data that qualifies as sensitive personal data, such as race, ethnicity, sexual orientation, and disability to help us understand the diversity of our workforce. When collected, this sensitive personal data is generally done so on a voluntary consensual basis.
Most often, the personal data we collect from employees is collected from them directly. In some cases, we may collect personal data about employees from third parties; for example, when we perform background screening checks that are necessary for the role to be performed by the employee. In most circumstances, we will get your permission before we collect personal data about you from a third party.
If we ask you to provide any other personal data not described above, then the personal data we will ask you to provide, and the reasons why we ask you to provide it, will be made clear to you at the point we collect it. If we ask you to provide personal data that we consider to be mandatory for us to administer your employment relationship, we will inform you of such at the time of collection. In addition, we will also inform you of the consequences for not providing us with the mandatory personal data.
iCIMS uses employees’ personal data that it collects primarily for the purposes of managing its employment relationship with its employees, along with other legitimate, business purposes. Such uses include:
If we need to process your personal data for an incompatible purpose not discussed in this Employee Privacy Notice, we will provide notice to you and, if required by law, seek your consent. We may process your personal data without your knowledge or consent only where required by applicable law. Lastly, iCIMS does not subject its employees to automated decision-making.
If you are an employee in the European Economic Area (“EEA”) or United Kingdom (“UK”), our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the context in which we collect it. However, we will normally collect personal data from you only where we need the personal data to carry out our employment contract with you, where we need the personal data to comply with our legal obligations or exercise rights in the field of employment, where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or where we have your consent to do so. In some limited cases, we may need the personal data to protect your vital interests or those of another person; for example, we may need to share your personal data with third parties in the event of an emergency at work.
If we ask you to provide personal data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and let you know whether the provision of your personal data is mandatory or not (as well as the possible consequences if you do not provide it). Similarly, if we collect and use your personal data in reliance on our legitimate interests (or those of a third party) that are not listed above, we will make clear to you at the relevant time what those legitimate interests are. If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided in the “Contact Information” section below.
iCIMS physically and electronically monitors its offices, information technology systems, and corporate network for specific, lawful purposes. Where permitted by applicable law, iCIMS may monitor or record activities that involve employee personal data. For example, we may monitor employees’ activity and presence in our offices with badge readers, sign-in technology, and surveillance cameras, or we may monitor or record employees’ activity on our information technology systems and corporate network, such as internet traffic, website filtering, email communications, or systems accessed. We generally conduct monitoring to protect our employees, authorized visitors, and property, and to prevent unauthorized access to our offices.
In addition, iCIMS may carry out monitoring for other purposes such as:
iCIMS’ monitoring activities will be done in a manner that is proportionate to the underlying purpose and only as required or permitted by applicable law.
iCIMS or its appointed service providers may collect, use, process, store and disclose employees’ personal data outside of their home jurisdiction, including in the U.S., and in some cases, other countries. These countries may have data protection and privacy laws that are different than the laws of the respective employee’s home country. iCIMS only transfers personal data to another country in accordance with applicable data protection and privacy laws, provided there are legally adequate protections in place for the personal data.
If an iCIMS’ employee’s personal data is processed within the EEA, or UK, we will protect that personal data (as defined in the European Union’s (“EU”) General Data Protection Regulation (“GDPR”)) when it is transferred outside of the EEA or UK by:
If you require further information about our international transfers of personal data, please contact us by using the contact details under the “Contact Information” heading below.
iCIMS, Inc. and certain of its subsidiaries participate in and have certified their compliance with the EU-U.S. Privacy Shield Framework. iCIMS is committed to subjecting all personal data received from the EEA and UK in reliance on the Privacy Shield Framework to the Privacy Shield Principles. To learn more about the Privacy Shield Framework and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List.
iCIMS is responsible for the processing of personal data it receives, under GDPR and the Privacy Shield Framework, and subsequent transfers to a third party acting as an agent on its behalf. iCIMS complies with GDPR and the Privacy Shield Principles for all onward transfers of personal data from the EEA and UK, including the onward transfer liability provisions.
With respect to personal data received or transferred pursuant to GDPR, iCIMS is subject to the regulatory enforcement powers of the EU in conjunction with the U.S. Federal Trade Commission. For the Privacy Shield Framework, iCIMS is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain circumstances, iCIMS may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
In compliance with GDPR and the Privacy Shield Principles, iCIMS commits to resolve complaints about our collection and use of your personal data. EEA and UK individuals with inquiries or complaints regarding our privacy practices should first contact iCIMS as provided in the “Contact Information” section below. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, you have the right to file a complaint with a competent data protection authority, if you are a resident of an EEA member state. As such, iCIMS commits to cooperate with the panel established by the EU Data Protection authorities (“DPAs”) and comply with the advice given by the panel with regard to human resources data transferred from the EU and/or the UK in the context of the employment relationship..
Under certain conditions, more fully described on the Privacy Shield website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
iCIMS maintains appropriate technical and organizational measures, including, but not limited to, reasonably designed administrative, physical, and technical safeguards, designed to protect the personal data obtained as discussed in this Employee Privacy Notice from accidental or unlawful destruction, loss, alteration, unauthorized disclosure and access. iCIMS personnel and service providers with access to personal data collected as discussed in this Employee Privacy Notice are required to keep such personal data confidential and secure.
We will retain your personal data if we have a business need to do so or for as long as is needed to fulfill the purposes outlined in this Employee Privacy Notice, unless a longer retention period is required by law. Generally, this means we will keep your personal data until the end of your employment with us, plus a reasonable period of time after that where necessary to respond to any employment inquiries; to any legal, tax, accounting or administrative matters; or to provide you with ongoing benefits. When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize it or, if this is not possible (e.g., because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. As such, we reserve the right to use such anonymous data for any legitimate business purpose without further notice to you or your consent
Certain jurisdictions may provide you with privacy rights under applicable data protection or privacy law regarding your personal data. In particular, you may have the right to:
h
These rights may be limited, for example, if fulfilling your request would reveal personal data about another individual, or if you ask us to delete personal data which we are required by law to keep or which we need to defend claims against us.
If you are a California resident, please see our Privacy Notice for California Residents for additional disclosures and information about the personal data we have collected about you over the last 12 months and rights you may have regarding your personal data.
If we process your personal data in reliance upon your consent, you can contact us at any time to withdraw your consent.
To exercise any of these rights, please contact us by using the contact details under the “Contact Information” heading below.
We will respond to such requests in accordance with the requirements of applicable data protection and privacy laws. Please note that in order to fulfil your request, we may need you to provide certain personal data to verify your identity. Depending upon applicable data protection and privacy law, individuals may also designate an authorized agent to exercise these rights on their behalf.
iCIMS reserves the right to update or change this Employee Privacy Notice from time to time. If we make material changes to this Employee Privacy Notice, we will post it to our Employee Handbook prior to or at the time of the change becoming effective. We ask that you review the Employee Privacy Notice periodically to stay informed about any updates or changes that we may have made.
You can see when this Employee Privacy Notice was last updated by checking the “Effective Date” displayed at the top of this Employee Privacy Notice.
To ask questions or comment about this Employee Privacy Notice and our privacy practices or if you need to update, change, or remove your personal data or exercise any other rights,