EU Recruiting Privacy Notice

·Front EU Recruiting Privacy Notice

·Last Updated: July 1, 2026. View the prior version here.

11. Introduction

·This notice ("Notice") describes our practices regarding the collection, use, and disclosure of personal data about individuals in the European Union (EU) who apply or are recruited for a job with us ("candidates"), as well as their rights with respect to that data.

·If you have questions about this Notice, please contact [email protected].

1.11.1 Scope

·This Notice applies to personal data collected about you in your capacity as a job candidate. See the Front Privacy Notice and Front Cookie Notice for information about our practices regarding when you use our website or otherwise interact with us in the same manner as a website visitor or someone who is not a job candidate.

·This Notice does not create or form part of any contract for employment or otherwise.

1.21.2 Who we are

·For purposes of this Notice, "Front", "we", "us" and "our" refer collectively to each member of the Front group of companies that acts as a controller of your personal data for purposes of data protection laws. Specifically, the controller of your personal data is FrontApp Ireland Limited if you are an employment candidate in Ireland, and FrontApp SARL if you are an employment candidate in France. In addition, FrontApp, Inc., the parent company of the employing entities in Ireland and France, is a controller of your personal data with respect to certain centralised human resources processes.

·You may contact the relevant controller by email at [email protected] or by mail at:

·FrontApp Ireland Limited, 21-23 City Quay, 4th Floor, Dublin 2, D02 FP21, Ireland

·FrontApp SARL, 32 Rue René Boulanger, 75010 Paris, France

·FrontApp, Inc., 1 Montgomery Street, 13th Floor, San Francisco, California 94104, USA

22. Information we collect about candidates

2.12.1. Categories of personal data

·We may collect and process the following categories of personal data during the application and recruitment process:

• ·Contact information. Home address, telephone number, email address; and professional social media handles.
• ·Job qualification materials. Your job application, resume or CV, cover letter, writing samples, references, work history, education transcripts, and prior employer obligations, which we receive from candidates and from recruiters.
• ·Professional qualifications. Licences, permits, memberships, and certifications.
• ·Information from the application process. Notes or transcripts of, and information shared during, phone-screens, interviews, and evaluations, as well as outcomes of recruiting exercises.
• ·Immigration information. Immigration status and other information that would allow us to verify your employment eligibility, if applicable.
• ·Biographical information. Name, gender/gender identity, pronouns, date of birth, professional history, references, language proficiencies, education details, and information you make publicly available through job search or career networking sites.
• ·Job preferences. Desired position and compensation, location preferences and willingness to relocate.
• ·Employment history. Your prior employers, how long you worked with each of your prior employers, and your prior positions.
• ·Background check information. Information necessary to complete background checks, which may include, to the extent permitted by law, identity verification, CV/employment verification, certification/education verification, compliance/sanctions screens, legal regulatory screens, criminal background checks, credit checks, drug/alcohol testing, reviews of professional social media activity, and/or other checks, and information received during these checks.
• ·Accommodation information. Information needed to understand and assess accommodation requests regarding potential disabilities or other health conditions.
• ·Sensitive personal data
• ·Medical screening information. If you meet with us in-person, your body temperature, health symptoms, vaccination status and other screening information in connection with our health and safety plans and protocols, including screening required to access our offices/facilities and other measures designed to prevent the transmission of infectious diseases.
• ·Equal opportunities monitoring information. We may inquire about your gender, race or ethnicity or disability status for equal opportunities monitoring purposes, where permitted by law. You do not have to provide this information and your refusal to provide it will not impact our hiring decisions.
• ·Criminal history. Background check providers may provide us with information regarding criminal convictions or offences, where permitted by law.

·Providing personal data to us is voluntary. However, if you do not provide sufficient information, we may be unable to consider your application.

·In any case, we only collect the data we need for the purposes described in this Notice, and only when that need arises.

2.22.2. Sources of personal data

·We collect personal data from you when you apply for a job and throughout the job application or recruitment process. We may also collect your personal data from other sources and combine it with the personal data you provide us. For example, we may collect your personal data from:

• ·Job board websites you may use to apply for a job with us;
• ·Prior employers that provide us with employment references;
• ·Professional references that you authorise us to contact;
• ·Background check providers (where applicable and permitted by law);
• ·Employment agencies and recruiters;
• ·Your educational institutions and professional certification organisations;
• ·Third party providers of contact details for recruiting targets; and
• ·Publicly-available sources of your professional information, such as professional social media profiles.

33. How we use and disclose personal data about candidates

3.13.1. Purposes for which we use personal data

·We use the categories of personal data above for the following purposes:

• ·Recruitment management, including:
• ·recruiting, interviewing and evaluating job candidates;
• ·conducting background checks (where permitted by law);
• ·accommodating disabilities or health conditions;
• ·communicating with you regarding your candidacy or work opportunities with us and any changes to applicable terms or policies.
• ·Compliance, safety and protection, including:
• ·complying with or monitoring compliance with legal and other requirements, such as tax, audit, recordkeeping, reporting, verifying identity and eligibility to work, and equal opportunities monitoring requirements, where applicable;
• ·complying with internal policies and procedures;
• ·complying with lawful requests and legal process, such as to respond to subpoenas or requests from government authorities;
• ·protecting our, your or others rights, safety and property, including by complying with applicable public health guidelines and requirements;
• ·investigating and deterring against fraudulent, harmful, unauthorised, unethical or illegal activity, or conduct in violation of our policies or procedures;
• ·controlling access to and monitoring our physical premises (e.g., by requiring health screenings to access offices/facilities);
• ·pursuing legal rights and remedies, including investigating, making and defending complaints or legal claims;
• ·administering and enforcing internal policies and procedures; and
• ·providing information to government authorities, law enforcement, courts or private parties where we have a good-faith belief it is necessary for the foregoing purposes.
• ·Analysis and improvement. Analysing and improving our application and recruitment processes. This may include creating anonymous, aggregated or de-identified data that we use and disclose to analyse our application and recruitment activities and for other lawful business purposes.

3.23.2. Disclosing personal data

·We disclose personal data to the following parties to facilitate the purposes for which we process personal data:

• ·Affiliates. Our corporate parent, subsidiaries, and other affiliates under the control of our corporate parent, for purposes consistent with this Notice or to operate shared infrastructure, systems and technology.
• ·Service providers. Companies that provide us with services that help us manage the recruiting process and operate our business, such as job boards, recruiters, interviewing and testing, background check providers, providers of sanctions and other lists used to conduct legally required screens, interview travel booking and expense reimbursement (where applicable), relocation (where applicable), and recruitment analytics.
• ·Your affiliated organisations. Previous employers, educational institutions, or professional certification bodies identified in your application materials.
• ·Government authorities, law enforcement and others. Government authorities, law enforcement, courts, and others for the purposes described in the Compliance, safety and protection section above.
• ·Business transaction transferees. Parties (and their advisors) to transactions and potential transactions pursuant to which we sell or transfer some or all of our business or assets, including your personal data, such as a corporate divestiture, merger, consolidation, acquisition, reorganisation or sale of assets, or in the event of bankruptcy or dissolution.
• ·Professional advisors. Lawyers, immigration advisors, and other outside professional advisors who require your information in the course of providing their services.

·Front maintains contracts with these third parties restricting their access, use and disclosure of personal data in compliance with our EU-U.S. Data Privacy Framework ("EU-U.S. DPF") obligations, including the onward transfer provisions, and Front may be liable if they fail to meet those obligations and responsible for the event giving rise to damage.

·We may transfer personal data throughout the world to fulfill the purposes described above. This may include transferring personal data to the United States or other countries outside the European Economic Area ("EEA") that have different data protection regimes and which are not deemed to provide an adequate level of protection for personal data by European authorities. Where a transfer takes place in a country not deemed to provide an adequate level of protection, we take appropriate safeguards to ensure your personal data remains protected in accordance with this Notice and applicable laws by entering into appropriate data transfer mechanism permitted under Article 46 of the GDPR (as applicable). With respect to data transfers to the United States, FrontApp, Inc. relies on its certification to the United States Department of Commerce that we adhere to the Data Privacy Framework Principles ("Principles") of the EU-U.S. DPF, as further described in the HR Data Privacy Framework Certification Notice section below. Other relevant mechanisms include the European Commission's Standard Contractual Clauses. Further information regarding such measures and safeguards is available upon request to [email protected].

3.33.3. HR Data Privacy Framework Certification Notice

·FrontApp, Inc. complies with the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Front has certified to the U.S. Department of Commerce that it adheres to the Principles with regard to the collection, use and retention of personal data received from the European Union in reliance on the EU-U.S. DPF. If there is any conflict between the terms in this HR Data Privacy Framework Certification Notice and the EU-U.S. DPF Principles, the relevant Principles shall govern. You can learn more about the Data Privacy Framework ("DPF") program at www.dataprivacyframework.gov, and view our certification here.

·Front is committed to complying with the EU-U.S. DPF Principles for all personal data received from the European Union in reliance on the relevant part(s) of the DPF program. This HR Data Privacy Framework Notice supplements the Front EU Recruiting Privacy Notice for personal data Front collects, uses or discloses as an employer:

·Personal Data Processed. Please review the section of the Front EU Recruiting Privacy Notice entitled Information we collect about candidates for details on the types of personal data we collect for processing as an employer.

·Purposes of Personal Data Processing. Please review the section of the Front EU Recruiting Privacy Notice entitled How we use and disclose personal data about candidates for details on the purposes of processing personal data where Front is an employer.

·Third Parties Who May Receive Personal Data. Please review the section of the Front EU Recruiting Privacy Notice entitled Disclosing personal data for details on the third parties who may receive personal data where Front is an employer and the purposes for which we disclose it to them.

·Rights to Access, Limit Use, and to Limit Disclosure of Personal Data. Individuals in the EU have rights to access personal data about them, and to limit use and disclosure of their personal data. You may submit requests to exercise your rights by emailing to [email protected], completing our Contact Us webform, or calling Front at +1 (415) 680-3048.

·Inquiries and Dispute Resolution. EU individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF should first contact Front at: [email protected]. In compliance with the EU-U.S. DPF, Front commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF in the context of the employment relationship. If neither Front nor the panel established by the EU DPAs resolve your complaint, you may have the possibility to engage in binding arbitration through the Data Privacy Framework Panel. If neither Front nor our dispute resolution provider resolves your complaint, you may have the possibility to engage in binding arbitration through the Data Privacy Framework Panel. For more information on this option, please see Annex I of the EU-U.S. Data Privacy Framework Principles.

·U.S. Federal Trade Commission Enforcement. Front's commitments under the EU-U.S. DPF are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

·Compelled Disclosure. Front may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

3.43.4. Retention

·We retain personal data for the period necessary to fulfill the purposes outlined in this Notice unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods are:

• ·the duration of the recruitment process;
• ·the period of time that we have an ongoing relationship with you; our legal obligations; and
• ·our legal position as in regard to applicable statutes of limitations, litigation, or regulatory investigations.

·Subject to any applicable legal or regulatory obligations, we may delete personal data from our database at any time and without providing any reason. You should retain your own copy of the personal data provided to us.

3.53.5. Legal basis

·Data protection law allows us to use personal data only when we have a legal basis to do so. Most commonly, we use personal data where we or a third party have a legitimate interest in the use and your fundamental rights do not override those interests ("legitimate interests"), or where the use is necessary to comply with law ("compliance with law"). Our uses of personal data as described in Section 3.1 rely on the following legal bases:

• ·Recruitment management: Our legitimate interests in recruitment management.
• ·Compliance, safety and protection: Compliance with law, where the activities are required to fulfil a legal obligation. Vital interests, where the activities protect public health. Otherwise, our legitimate interests in compliance, safety and protection.
• ·Analysis and improvement: Our legitimate interests in the analysis and improvement of our recruitment processes.

·When we process sensitive personal data classified by data protection law as a special category of data, we may do so only on grounds permitted by data protection law. The grounds on which we process special categories of data will depend on the circumstances and purposes of the processing. However, as examples, we may process such data:

• ·to carry out our legal obligations or exercise rights in connection with employment and our role as an employer;
• ·as necessary for reasons of substantial public interest (e.g., where we request race or ethnicity for equal opportunities monitoring and reporting);
• ·as necessary to protect the vital interests of the data subject or of another natural person (e.g., where medical screening information is requested); or
• ·to establish, exercise or defend legal claims (including regulatory, administrative or any out-of-court procedure, and seeking advice).

44. Your data protection rights

4.14.1. Your rights

·You have the right under data protection law to access your personal data, to correct inaccurate personal data, to have your personal data erased, to object to the processing of your personal data, to restrict the processing of your personal data, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format for onward transmission, and to object to any automated decision-making. Please note that data protection law subjects such rights to certain limitations and exemptions.

·If you are not satisfied with our response to a request you make, or how we process your personal data, you can make a complaint to the data protection regulator in your habitual place of residence. The contact information for the data protection regulator in your place of residence can be found here: https://edpb.europa.eu/about-e...

4.24.2 How to exercise your data protection rights

·You may submit requests to exercise your rights by email to [email protected], completing our Contact Us webform, or calling Front at +1 (415) 680-3048. In your request, please make clear what personal data you would like to access or have changed, or otherwise let us know what limitations you would like to put on our use of your personal data. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it. We may need to verify your identity to process your requests.

55. Third parties

·This Notice does not address, and we are not responsible for, the practices of any third parties, which have their own rules for how they collect and use your personal data. Our links to third party websites or services are not endorsements.

66. Changes to this Notice

·We reserve the right to change this Notice at any time. The "Effective Date" heading at the top of this Notice indicates when it was last revised. Any changes will become effective when we post the revised notice on our Careers Site.