SIMPLISAFE PRIVACY NOTICE FOR CANDIDATES

The purpose of this SimpliSafe Privacy Notice for Candidates (“Notice”) is to inform individuals who apply for employment with SimpliSafe (“SimpliSafe”, “SimpliSafe LTD”, “we” or “us”) of the categories of Personal Information (also referred to as “Personal Data” or “Candidate Data”) that we may receive and the purposes for which we may process and share such Personal Information. This Notice is intended to comply with all applicable laws, such as the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and the UK General Data Protection Regulation (UK GDPR) and Data Protection Act (DPA). If any provision below conflicts with a legal requirement, then SimpliSafe will comply with the applicable law.

1. Collection and Use of Candidate Personal Information

SimpliSafe receives, uses, and discloses Personal Information about job candidates for business purposes only and consistent with applicable laws. Where SimpliSafe discloses Personal Information to third parties, it does so for the same business purposes described below and requires that such parties maintain its confidentiality and maintain appropriate systems and processes to ensure its security, integrity and protection. The categories of recipients for your Personal Information may include Service Providers such as our applicant tracking software partner and background check partners, SimpliSafe employees you choose to share your information with and those that serve a necessary business function in the application process, and law enforcement under legally justifiable circumstances.

You may provide us with the following categories of Personal Information when you inquire about or apply for employment at SimpliSafe:

Category of Personal Information	How we use it
Contact information: such as your name, home and work addresses, personal and work telephone numbers, and personal and work email addresses.	We will use this information to open and maintain candidate records and communicate with you regarding your interest in a job opportunity with us, your application for employment, or updates on your candidacy.
Job-related information and qualifications: such as position applied for, work experience, duration of previous employment, education, awards, qualifications, certificates, licenses, financial relationships, and any other information you choose to provide in your resumes or applications.	We will use this information to assess your suitability for a position at SimpliSafe and to determine any actual or potential conflict of interest. We might also send you information about other positions with SimpliSafe that may be of interest to you. Additional Sources of Personal Information: Third-party references, credit agencies for a limited group of roles, or entities verifying work authorization.
National identification information: such as your country of birth or the country where you are a registered national or citizen, and any visa or other right to work permits.	We will use this information to determine your eligibility to work, applicable benefits, financial draws/taxes, and fulfill our obligations to relevant government authorities. Additional Sources of Personal Information: Third-party entities verifying work authorization.
Travel-related records: such as frequent flyer numbers, itineraries, flight, train, rental car, car service, hotel, or other similar information.	We will use this information to arrange or reimburse travel where you require travel to interview with us or in connection with your candidacy for employment, contact you during travel, as necessary with travel service providers, or in an emergency.
Sensitive Personal Information, insofar as necessary and legally permitted, such as Social Security, national identifier, driver’s license, state identification, or passport information. Your race, ethnicity, veteran status, disability status, and gender, if you choose to provide it for voluntary self-identification purposes.	Equal opportunities monitoring information: We will use this information, such as your race, ethnicity, and gender, which you would provide only on a voluntary basis, to conduct equal opportunity and diversity monitoring where permitted or required by law. Background checks: the provision of certain identifiers is necessary in order for SimpliSafe to verify information around your work history, education and work status. Additional Sources of Personal Information: Third-party references, credit agencies for a limited group of roles, or entities verifying work authorization.

We also may process the following categories of Personal Information that you do not provide us with directly:

Category of Personal Information	How we use it
Interview Data: such as interview scorecards, results of assessments done as part of the interview process and feedback on your interview process.	We will use this information to evaluate your candidacy and assist with decision making around whether or not an offer of employment will be made.
Results of background checks and screening: such as education verification, professional licensing or certificate verification, criminal records, and driver’s license checks.	We will use this to determine your suitability for certain job roles (to the extent permitted or required by law). Additional Sources of Personal Information: Third-party entities that conduct and report on background checks and screening.
References and Referrals: such as opinions and comments of any previous employers or an internal employee who has referred you as a candidate.	We will use this to determine your suitability for certain job roles. References will only be contacted if you give us permission to do so. Additional Sources of Personal Information: Individuals who are references and referrers.
Information from Publicly Available Sources: examples include online sources such as LinkedIn or websites that you have created.	We will use this information to assess your suitability for a position at SimpliSafe.

We also collect information about you using cookies and similar technologies when you use the recruitment site. See our US Privacy Policy or UK Privacy Policy for further information about how this works.

2. Additional Purposes for Using Personal Information

In addition to the uses set forth above, SimpliSafe may use and share the categories of Personal Information identified:

To comply with applicable legal and regulatory requests and obligations (including investigations and required reporting to governmental entities).
To establish or defend legal claims and allegations.
For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, violations of company policy or rules, or other misconduct.
To seek advice from lawyers, auditors, and other professional advisers.

3. Sensitive Personal Information

Your Sensitive Personal Information will not be used for any additional purposes that are incompatible with the purposes listed above unless we provide you with notice of those additional purposes and collect consent as required by applicable law.

4. No Sale or Sharing of Personal Information

We do not “sell” or “share” your Personal Information or your Sensitive Personal Information as those concepts exist in US state privacy laws, nor do we share it with third parties for cross-context behavioral advertising.

5. Information Security and Record Retention

We implement technical and organizational measures (such as implementing security software and only allowing staff to access your information if there is a business need to do so) to ensure a level of security appropriate to the risk to the Personal Information we process. Our servers also use up-to-date encryption methods, minimum standards for passwords and physical locks to protect personal data. These measures are aimed at ensuring the ongoing integrity and confidentiality of Personal Information. We evaluate these measures on a regular basis to ensure the security of the processing.

We may retain your Personal Information for as long as necessary to fulfill the purpose(s) for which it was collected or to comply with legal or regulatory requirements. We strive to retain your Personal Information no longer than is reasonably necessary to carry out the purposes listed in this Notice or as required by law. For the data this Notice covers, we will retain it for 7 years at most.

6. For US Candidates - Your Privacy Rights

SimpliSafe complies with laws and regulations that permit certain privacy requests related to your Personal Information, including, but not limited to, the California Consumer Privacy Act (the “CCPA”). The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides California residents with the following rights regarding their Personal Information:

The right to know what Personal Information we have collected, used, disclosed, and sold about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom SimpliSafe discloses Personal Information, and the specific pieces of Personal Information SimpliSafe has collected about you.
The right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing.
The right to request deletion of Personal Information we have collected from you. Please note that this right is not absolute and we will retain parts of your Personal Information as required by law.

You may exercise these rights by contacting SimpliSafe as described in the “Questions” section below. You may also designate an authorized agent to make a request on your behalf by contacting us as described below. In order to protect your data from unauthorized access or alteration by third parties, all requests regarding your Personal Information will be subject to verification of the identity of the requesting individual. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to forty-five (45) days) or cannot comply fully with your request, we will inform you in writing. SimpliSafe will never discriminate against you for exercising these rights.

7. For UK and European Economic Area (EEA) Candidates - International Transfers, Lawful Basis, Data Subject Rights and Changes to the Notice

As required by the UK GDPR and the GDPR, we wanted to provide you with the following additional information concerning the processing of your personal data as a candidate for a role at SimpliSafe:

International Transfers - Candidate Data is transferred to, and stored on, servers located in the United States, and may be accessed by employees of SimpliSafe or affiliated companies (such as our applicant tracking software partner and background check partners) in or outside of the United States. These transfers are subject to our intragroup agreement and the Standard Contractual Clauses (SCCs). We may also use service providers acting as data processors on behalf of SimpliSafe. Where we engage data processors, we will ensure that transfers of Candidate Data will be subject to adequate safeguards, such as SCCs.
Lawful Bases - We must have a legal basis to process your Personal Data. The legal basis will be one of the following:
- To fulfill our contractual obligations to you in connection with your employment contract with us or in anticipation of entering into an employment contract.
- To comply with our legal obligations, for example obtaining proof of your identity to enable us to meet our anti-money laundering obligations or obtaining proof of your right to work status to enable us to meet relevant obligations.
- To comply with our legal obligations to you, for example health and safety obligations that we must comply with as your employer or to a third party (e.g. the taxation authorities).
- To meet our legitimate interests, for example to conduct our recruitment processes efficiently and fairly, or to manage applicants and our employees effectively and protect us against theft or other crime. When we process Personal Information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms

Please note that we may be required by law to collect certain Personal Data about you for recruitment purposes, or as a consequence of our relationship with you as an employer. Failure to provide this information may prevent or delay the fulfillment of these obligations.

We may obtain your explicit consent to collect and use certain types of Personal Information when we are required to do so by law (for example, when we process sensitive Personal Information [or information collected automatically via cookies]). If we ask for your consent to process your Personal Information, you may withdraw your consent at any time by contacting us using the details at the end of this privacy notice. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Data Subject Rights - You have certain rights regarding your Personal Information, subject to local law. These include the following rights to:
- Access your Personal Data
- Rectify the Personal Data we hold about you
- Erase your Personal Data
- Restrict our use of your Personal Data
- Object to our use of your Personal Data
- Receive your Personal Data in a usable electronic format and transmit it to a third party (right to Data Portability)
- lodge a complaint with your local data protection authority.

If you would like to discuss or exercise such rights, please email privacy@simplisafe.com. SimpliSafe does not process your personal data in an automated manner that produces legal or other similarly significant effects. To exercise your data subject rights, please email privacy@simplisafe.com. In order to protect your data from unauthorized access or alteration by third parties, all requests regarding your Personal Data will be subject to verification of the identity of the requesting individual. We endeavor to respond to a verifiable request within thirty (30) days of its receipt. If we require more time (up to thirty (30) days) or cannot comply fully with your request, we will inform you in writing. SimpliSafe will never discriminate against you for exercising these rights.

SimpliSafe, Inc. is the controller responsible for the Personal Information we collect and process as described in this Notice.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the Information Commissioner’s Office or your local data protection authority.

Changes to the Notice - We may modify or update this privacy notice from time to time. If we change this privacy notice in a material way, we will notify you of the changes. Where changes to this privacy notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).

8. Questions

If you have any questions about this Notice, or to request this Notice in another format, please contact privacy@simplisafe.com.