icims Services Privacy Notice

Effective Date: August 11, 2020

Please note, this Services Privacy Notice is available at www.icims.com/legal/privacy-notice-services. Please refer to www.icims.com and its related domains and subdomains, including, but not limited to, www.textrecruit.com, www.icims.co.uk and www.icims.ca (each the “Website” as applicable) for the iCIMS Website Privacy Notice.

Introduction

iCIMS, Inc. and its subsidiaries, iCIMS International, LLC, Jibe, Inc., and TextRecruit, Inc. (collectively, “iCIMS,” “we,” or “us”), respects the privacy of its Subscribers, their Subscriber Data, and their respective Users and Candidates, and we are committed to protecting their respective personal data. All capitalized terms used in the immediately preceding sentence shall be defined in accordance with the iCIMS Subscription Agreement.

This Services Privacy Notice (“Services Notice”) explains who we are and covers our privacy practices with respect to the collection, use, and disclosure of personal data obtained in connection with the use of our Subscription. This Services Notice also covers personal data processed by iCIMS for Subscriber account, contract, and billing management purposes (e.g., the processing of Subscriber address and billing information). This Services Notice does not cover a Subscriber’s collection, use, or disclosure of any information it stores as part of the Subscription.

For purposes of this Services Notice:

The term “personal data” means any information which relates to an identified or identifiable, living individual that directly or indirectly references one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity. Personal data excludes anonymous data.

Please take the time to read this Services Notice and the related statements in their entirety to ensure you are fully informed. If you have any questions or concerns about our processing of personal data, please contact us by using the contact details under the “Contact Information” heading below.

About Us

Driven by a passion to help companies build their winning workforce, iCIMS is proud to offer leading software solutions and tools that unify all aspects of talent acquisition. With iCIMS, organizations can manage their entire talent acquisition lifecycle within one unified platform. Our focus on user-friendly technology and an exceptional customer experience has made us the leading HR cloud platform for recruiting. iCIMS offers the only true enterprise end-to-end talent acquisition platform.

For more information about iCIMS, please see the About Us section of our Website.

How We Obtain Personal Data

As further described below, we collect several types of personal data from and about our Subscribers in the course of providing and supporting the Subscription.

Subscribers process Subscriber Data in the normal course of using the Subscription. Our collection, use, and disclosure of Subscriber Data processed is limited to providing and supporting the Subscription on behalf of our Subscribers, and it is done in accordance with the Subscription Agreement executed between Subscriber and iCIMS. Likewise, we process Subscriber Data at the direction of and pursuant to the instructions of our Subscribers.

As a result, under applicable data protection or privacy law, we are our Subscribers’ data processor or service provider. To that end, we also collect several types of other personal data from our Subscribers, including:

Personal data and correspondence from Subscribers and Users submitted to us in connection with our services.
Personal data we receive from our partners and service providers in connection with use of the Subscription.
Personal data collected via our mobile applications.

Lastly, we collect several types of personal data from our Subscribers as a data controller or business (as defined under applicable data protection or privacy law), including:

Personal data collected as part of our accounting, contracting, and billing operations, including, but not limited to, a Subscriber’s company name and address, credit card information, and business representative’s contact information (“Customer Personal Data”).

How We Use Personal data

We may use Subscriber Data to provide and support the Subscription, including updating and maintaining the Subscription and providing services. We will not use, disclose, sell, review, share, distribute, transfer, or reference any Subscriber Data except as permitted in the Subscription Agreement or as required by law.

We may use Customer Personal Data for account, contracting, and billing management purposes.

If we need to process personal data for an incompatible purpose not discussed in this Services Notice, we will provide notice to Subscribers or Users, as applicable, and, if required by law, seek their consent. We may process personal data without Subscribers’ or Users’ knowledge or consent only where required by applicable law. Lastly, iCIMS does not subject personal data to automated decision-making.

How We Share Personal Data

iCIMS takes care to allow personal data to be accessed only by those who need to know to perform their tasks and duties, and to third parties who have a legitimate purpose for processing or accessing it. As such, we may share personal data as described in this Services Notice to the following categories of recipients:

To our subsidiaries, affiliates, or their or our successors or assigns (including those located outside the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland) as necessary to support provision of the Subscription.
To our private equity investor, Vista Equity Partners, and its affiliates, contractors, service providers, and other third parties, including Vista Consulting Group, which will process the personal data on the basis of its legitimate interests in overseeing the administration, research, and business operations of iCIMS.
To our contractors, business partners, and service providers who require the data to assist us in supporting our Subscription and to assist with providing services on behalf of our Subscribers, provided such parties provide at least the same level of privacy protection as is required of iCIMS. These companies are authorized to use personal data only as necessary to provide these services to us.
To a potential buyer (and its agents and advisors) in connection with any proposed merger, acquisition, or any form of sale or transfer of some or all of our assets (including in the event of a reorganization, dissolution or liquidation), in which case Subscriber Data and personal data held by us about our Subscribers and Users will be among the assets transferred to the buyer or acquirer.
To a third party under the following circumstances where we, in good faith,: (i) believe we are compelled by applicable law or regulation, judicial request from a court of competent jurisdiction, or another legal process or government authority; (ii) find it necessary to exercise, establish or defend our legal rights; (iii) seek to enforce or apply the terms of the Subscription Agreement; (iv) seek to protect iCIMS’ rights or property; (v) seek to protect iCIMS, our other customers, or the public from harm or illegal activities; (vi) seek to respond to an emergency which we believe, in good faith requires us to disclose data to prevent harm; or (vii) rely on your consent.
In accordance with a Subscriber’s instructions.

Legal Basis for Processing Personal Data

If you are a resident of the EEA, the UK, or Switzerland, our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the context in which we collect it. However, we will normally collect and/or process your personal data pursuant to one or more of the following legal bases:

The processing is in our legitimate interests which do not override your data protection interests or fundamental rights and freedoms.
The processing is necessary to perform a contract with you.
The processing is necessary to comply with our legal obligations.
We may also seek your consent to process or retain your personal data in certain, limited circumstances that we clearly identify to you.
In some limited cases, we may need the personal data to protect your vital interests or those of another person; for example, we may need to share your personal data with third parties in the event of an emergency.

If we ask you to provide personal data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and let you know whether the provision of your personal data is mandatory or not (as well as the possible consequences if you do not provide it). Similarly, if we collect and use your personal data in reliance on our legitimate interests (or those of a third party) that are not listed above, we will make clear to you at the relevant time what those legitimate interests are. If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided in the “Contact Information” section below.

International Transfers

Subject to the Subscription Agreement, iCIMS or its appointed service providers may collect, use, process, store and disclose personal data outside of our Subscribers’ home jurisdictions, including in the U.S., and in some cases, other countries. These countries may have data protection and privacy laws that are different than the laws of our Subscribers’ home countries. iCIMS only transfers personal data to another country in accordance with applicable data protection and privacy laws, provided there are legally adequate protections in place for the personal data. A list of iCIMS’ global offices is available here.

For Subscriber Data transferred from the EEA, UK, or Switzerland to iCIMS in the U.S., iCIMS, Inc. and its subsidiaries participate in and have certified their compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. iCIMS will protect Subscriber Data when it is transferred from the EEA, UK, or Switzerland to the U.S. by:

Subjecting all Subscriber Data received from the EEA, the UK, and Switzerland in reliance on each Privacy Shield Framework to the Privacy Shield Principles. To learn more about the Privacy Shield Frameworks and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List
Processing Subscriber Data in a territory which the European Commission has determined provides an adequate level of protection for personal data; or
Otherwise implementing appropriate safeguards to protect Subscriber Data, including through the use of Standard Contractual Clauses or another lawful transfer mechanism approved by the European Commission.

For other international transfers of personal data from the EEA, the UK, and Switzerland, we will implement such measures as are necessary to ensure we provide appropriate safeguards for the transferred Subscriber Data, as agreed with our Subscribers. For Customer Personal Data collected, used, and disclosed by iCIMS that is subject to international transfer restrictions of EU data protection law, please see the “Legal Basis for Processing,” “International Transfers,” and “EU-U.S. and Swiss-U.S. Privacy Shield Framework” sections of the iCIMS Privacy Notice.

If you require further information about our international transfers of personal data, please contact us by using the contact details under the “Contact Information” heading below.

EU-U.S. and Swiss-U.S. Privacy Shield Framework

iCIMS, Inc. and its subsidiaries participate in and have certified their compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. iCIMS is committed to subjecting all personal data received from the EEA, the UK, and Switzerland in reliance on each Privacy Shield Framework to the Privacy Shield Principles. To learn more about the Privacy Shield Frameworks and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List.

iCIMS is responsible for the processing of personal data it receives, under GDPR and each Privacy Shield Framework, and subsequent transfers to a third party acting as an agent on its behalf. iCIMS complies with GDPR and the Privacy Shield Principles for all onward transfers of personal data from the EEA, the UK, and Switzerland, including the onward transfer liability provisions.

With respect to personal data received or transferred pursuant to GDPR, iCIMS is subject to the regulatory enforcement powers of the EU in conjunction with the U.S. Federal Trade Commission. For each Privacy Shield Framework, iCIMS is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain circumstances, iCIMS may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with GDPR and the Privacy Shield Principles, iCIMS commits to resolve complaints about our collection and use of your personal data. EEA, UK, and Swiss individuals with inquiries or complaints regarding our privacy practices should first contact iCIMS as provided in the “Contact Information” section below. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Under certain conditions, more fully described on the Privacy Shield website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

Security and Breach Notification

iCIMS maintains appropriate technical and organizational measures, including, but not limited to, reasonably designed administrative, physical, and technical safeguards, designed to protect Subscriber Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. The Subscription allows Subscribers to implement and configure their use of the platform and enforce some security requirements, including user access controls. iCIMS has a dedicated team responsible for monitoring and responding to security events, and it notifies Subscribers of security incidents and data breaches in accordance with its Incident Response Policy

Data Retention

We retain Subscriber Data according to the timeframes set forth in the Subscription Agreement. We retain Customer Personal Data where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements).

Mobile Applications Disclosure

If you (as a Subscriber or User) download and use any of our mobile applications (each an “App”), iCIMS will automatically collect information on the type of device you use, operating system version, and the device identifier (“UDID”).

iCIMS may send you push notifications from time-to-time in order to update you about any events or promotions that iCIMS may be running. If you no longer wish to receive these types of communications, you may turn them off at the device level. To ensure you receive proper notifications, iCIMS will need to collect certain information about your device such as operating system and user identification information.

iCIMS does not ask for, access, or track any location-based information from your mobile device at any time while downloading or using our App.

iCIMS uses mobile analytics software to allow us to better understand the functionality of our App software on your phone. This software may record information such as how often you use the App, the events that occur within the App, aggregated usage, performance data, and where the App was downloaded from. iCIMS does not link the information iCIMS stores within the analytics software to any personal data you submit within the App.

Privacy Rights

Since each Subscriber is in control of what information, including any personal data, it collects from its Users and Candidates, how that information is used and disclosed, and how that information can be changed, Users and Candidates of the Subscription must contact the applicable Subscriber with any inquiries about how the Subscriber collects, uses, and discloses personal data, including any privacy rights or data subject access requests, including, but not limited to, how to access, rectify, correct, delete, and port personal data contained in Subscriber Data.

Where iCIMS is a data controller or business under applicable data protection or privacy law, certain jurisdictions may provide you with privacy rights regarding your personal data. In particular, you may have the right to:

be informed about your personal data;
access your personal data;
correct any personal data that is inaccurate;
have your personal data erased;
restrict or suppress your personal data;
obtain and reuse your personal data;
object to the processing of your personal data; and
object to how your personal data is used in automated decision making, if applicable.

These rights may be limited, for example, if fulfilling your request would reveal personal data about another individual, or if you ask us to delete personal data which we are required by law to keep or which we need to defend claims against us.

If you are a California resident, please see our Privacy Notice for California Residents for additional disclosures and information about the personal data we have collected about you over the last 12 months and rights you may have regarding your personal data.

If you do not wish to receive our email marketing communication for promotional purposes, you may opt out by clicking on the “unsubscribe” or “opt out” link in the marketing e mails we send you.

If we process your personal data in reliance upon your consent, you can contact us at any time to withdraw your consent.

To exercise any of these rights, please contact us by using the contact details under the “Contact Information” heading below.

We will respond to such requests in accordance with the requirements of applicable data protection laws. Please note that in order to fulfil your request, we may need you to provide certain personal data to verify your identity. Depending upon applicable data protection and privacy law, individuals may also designate an authorized agent to exercise these rights on their behalf.

How We Treat Do Not Track Signals

Various browsers allow a “do not track” (DNT) setting, which sends a signal to websites visited by an individual about their browser DNT setting. At this time, there is no general agreement on how companies, like iCIMS, should interpret DNT signals. Therefore, we do not currently commit to respond to DNT signals. We will continue to monitor developments around DNT browser technology and the implementation of a standard.

Third-Party Applications, Integrations, and Websites

We may also connect to applications or integrations hosted by third parties for mutual Subscribers. These applications and integrations will interact with the Subscription and our processing of Subscriber Data will be in accordance with this Services Notice and our Subscription Agreement.

For clarity, this Services Notice does not apply to personal data collected, used, or disclosed by Subscribers as part of those third party applications, integrations, or websites. The use of any data you make available to a third-party is subject to that third-party’s privacy policy or notice and your agreements, if any, with the third-party.

Changes to this Notice

iCIMS reserves the right to update or change this Services Notice from time to time. If we make material changes to this Services Notice, we will post it to the applicable sections of our Website prior to or at the time of the change becoming effective. We ask that you review the Services Notice periodically to stay informed about any updates or changes that we may have made.

You can see when this Services Notice was last updated by checking the “Effective Date” displayed at the top of this Services Notice.

Contact Information

Via Webportal: Click here
Via Email: privacy@icims.com
Via Mail: iCIMS, Inc., Attn: Privacy, Legal Department, 101 Crawfords Corner Road, Suite 3-100, Holmdel, NJ 07733 USA