Digital Extremes Applicant Privacy Notice

Last Updated: September 20, 2023

What does this notice cover?

This notice describes how Digital Extremes Ltd. (“we”, “us” or “our”) uses and discloses your personal data as part of your relationship with us. We are a “data controller” with respect to information you provide us in connection with your application. This means we are responsible for deciding how we hold and use personal data about you.

You are being sent a copy of this Privacy Notice because you are applying for work with us. It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained. It also describes your data protection rights, including a right to object to some of the processing which we carry out. The data processing described in this notice may be limited as required by applicable law. We may also notify you in other ways from time to time about the processing of your personal data.

What Categories of Personal Data We Collect?

We collect and process the following types of personal data in connection with your application for work with us:

Identity and Contact Data: includes name, gender, nationality, email, and other identity and contact information you provide in your resume or CV.
Application Data: includes level of education, work experience, skills, qualifications, certifications, and other information submitted by the candidate.
Sensitive information: race, veteran status, disabilities, criminal record data

We collect most of this information from you directly. For example, data is collected through application forms and CVs; from correspondence with you; or through use of our technical systems including the Greenhouse platform. We also collect some information about you from other people or organisations: we collect work experience, skills, employment, and education data from your references and from social media profiles, and criminal records data from background check services.

Why we collect, use, and store this personal data

We have to have a legal basis to process your data. We explain these legal bases below. We also explain the purposes for which we process your data, and the categories of data that we use for each purpose .

Processing Activity	Categories of Personal Data	Purpose of Processing	Legal Basis
Application processing and hiring	Identity and Contact Data	We collect, process, transfer, and store this data to review applications, assess your suitability for the role, schedule and conduct interviews, communicate, and make informed decisions about the role, and reimburse you for any agreed expenses incurred in the application process.	This processing is necessary for our legitimate interest in enabling us to process and make a decision about your application
Recruitment campaigns	Identity and contact data	We collect, process, transfer, and store this information to improve our recruitment process and campaigns on social media platforms such as LinkedIn, our corporate accounts, job fairs (both virtual and in person) and email campaigns.	This processing is necessary for legitimate interest in managing our application and recruitment processes When we conduct certain email campaigns and online targeting , we do this with your consent.
Recruitment analytics	Identity and contact data Application data	We collect, process, transfer, and store this information to conduct internal analytics , keep records of our recruitment process, improve our recruitment process, and understand recruitment trends in our company.	This processing is necessary for legitimate interest in managing our application and recruitment processes.
Keeping in touch about future roles	Identity and contact data	We collect, process, transfer, and store this information to contact applicants about future roles.	This processing is necessary for legitimate interest in managing our application and recruitment processes
Background checks	Identity and contact data Application data	We collect, process, transfer, and store this information to verify employment and educational credentials, protect our business against legal claims, comply with legal, regulatory, auditing, and investigative obligations.	This processing is necessary for legitimate interest in verifying the information that is provided by candidates. Where relevant, t his processing is necessary for complying with our legal and regulatory obligations including those related to tax, anti- bribery, equal opportunity, anti-discrimination, and right to work laws.
Equality and diversity monitoring	Identity and contact data Sensitive data (race, veteran status, disabilities)	We only collect this information when you voluntarily provide it to us. We use this information to monitor our commitment to promoting diversity and inclusion in our workplace.	This processing is necessary for legitimate interest in analysing and monitoring the diversity of our workforce. Where relevant, this processing is necessary for complying with our legal and regulatory obligations relating to equal opportunity and anti-discrimination laws.

Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of the notice.

For certain positions, it will be necessary for us to verify the details you have supplied (for example, in relation to your identity, employment history, academic qualification and professional credentials) and to conduct pre-employment background checks. The level of checks will depend on your role and will be conducted at as late a stage as is practicable in the recruitment process and often only after you have been selected for the position. If your application is successful, we will provide further information about the checks involved and will obtain any necessary consent prior to completing such checks.

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully.

How we share your personal data

Digital Extremes will not disclose or give access to personal data we hold about you to any third party except in the following conditions:

Within Digital Extremes

Digital Extremes will sometimes share your information to employees in our HR, IT, finance, and facilities departments within our offices, where necessary to decide about your eligibility for the role.

Third party service providers

Your personal data will also be shared with a limited group of third-party service providers who will process it on our behalf. All third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes outside our instructions. We only permit them to process your personal data for specified purposes.

These recipients include:

Greenhouse Software Inc., our recruitment and onboarding partner that helps us process applications, conduct recruitment campaigns, and contact you regarding our decisions or future roles. This our primary recruitment platform where we retain your data. We share your identity and contact, application data, and limited sensitive data with this third party.
Ceridian Dayforce, our HR information system vendor that processes your information once we’ve made the hire. We share your identity and contact, application, and limited sensitive data for background checks.
Google Sheets, which our recruitment team uses to maintain track of recruitment process. We only share and use your name with this platform.

Government or law enforcement bodies

Personal data may be shared with government authorities and/or law enforcement officials as required to comply with the legal obligations stipulated above.

Sale of our business

If Digital Extremes is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser's adviser and will be passed to the new owners of the business as required.

Where we transfer your personal data

The personal data we collect from you may be transferred to, and stored at, a destination outside of your jurisdiction, including where our offices are headquartered, for the purposes described above. We will ensure suitable safeguards are in place to protect the privacy and integrity of your personal data in such circumstances.

Data security: how we store and protect your data

We have implemented measures to reasonably ensure the security of the personal data we collect and store about you. We will take reasonable steps to protect your personal data from unauthorised disclosure or access. The steps we will take include using appropriate physical, electronic, and administrative safeguards. For more information, please contact us using the contact details provided below.

Your choices and rights

You have the following rights regarding your personal data:

The right to access – You have the right to request copies of your personal data.
The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is incomplete.
The right to erasure – You have the right to request erasure of your personal data, where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing – You have the right to object to processing of your personal data where we rely on legitimate interests. You also have the right to object where we are processing your personal data direct marketing purposes.
The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
The right not to be subject to automated decision-making for legal or significantly similar effects.

Where we have asked for your consent, you have the right to withdraw consent at any time. The consent does not affect the lawfulness of processing based on consent before your withdrawal. These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.

You also have a right to complain to the relevant supervisory authority in your jurisdiction.

How long we retain your personal data

We will retain and process personal data relating to you for only as long as we need to fulfil the purpose(s) we collected it for. This includes retention of it to make recruitment decisions, contact you about our decision, conduct recruitment analytics and keep you informed of future roles. Your personal data is retained by Greenhouse.

We determine the appropriate retention period for your personal data, by assessing several criteria. These include: the nature and sensitivity of the personal data; the amount of personal data we hold; the risk of harm associated with the unauthorised use or disclosure of your personal data; the purpose of processing of your personal data; whether we can achieve that purpose in other ways; and the relevant legal requirements.

For applicants, we will retain the information you provide during the application process. This will become part of your file. If your application is unsuccessful, the information you have provided will be retained by us for 6 months after we have communicated our decision to you. We do this, so that we can demonstrate compliance with employment laws and that we conducted our application process in a fair and transparent manner.

After the 6 months has elapsed, we destroy personal information in a secure way, and in line with our data retention policy and our legal and regulatory obligations or hold it in a form that no longer identifies you.

Updates to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

If you are a California resident

This section contains disclosures required by the California Consumer Privacy Act (“CCPA”) . We process your personal data in accordance with the rest of this privacy notice, including

The types of information we collect,
The sources of information we collect, see the “What Categories of Personal Data We Collect?” section of this policy;
The purpose of our processing, see the “Why we collect, use, and store this personal data” section of this policy;
With whom we disclose your personal information, see the “How we share your personal data” section of this policy;
We share personal information when you direct us to do so, when required by law or to respond to legal processes, to protect our property or the safety of our employees and customers, or if we enter into a potential or actual merger, acquisition, or sale of our assets; and
How long we retain personal information, see the “How long we retain your personal data” section of this policy.

We may use and share aggregated and deidentified information to the extent permitted by applicable law. When we use deidentified information, we maintain and use the information in deidentified form and do not attempt to reidentify it, except to check whether our deidentification processes satisfy the requirements of applicable law.

Categories of Personal Information We Collect and Disclose. We collect and disclose the following categories of personal information about our job applicants who are California residents:

Personal and online identifiers (such as first and last name, Social Security number, driver’s license number, log-in credentials, email address, or unique online identifiers)
Characteristics of protected classifications under California or federal law (such as race, gender, or disability status)
Internet or other electronic network activity information (such as interactions with a website, email, or application)
Professional or employment-related information (such as your employment history and resume)
Education information (such as your education history and transcripts)
Other information about you that is linked to the personal information above

We do not sell, and have never sold, information that identifies who you are to anyone. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. Some of the information described above is also defined as “Sensitive Personal Information” under the CCPA, and we do not use or disclose Sensitive Personal Information for purposes other than those specified in the CCPA and its implementing regulations.

Your Rights Regarding Personal Information. California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you; the categories of sources from which we collected personal information about you; our purposes for collecting or selling personal information about you; the categories of personal information about you that we have either sold or disclosed for a business purpose; and the categories of third parties with which we have shared personal information.
The right to request that we correct inaccurate personal information we maintain about you.
The right to request that we delete the personal information we have collected from you.
The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

You or your authorized agent may submit a request to exercise your rights by emailing privacy@digitalextremes.com or online at https://www.digitalextremes.com/contact.

We will not discriminate against you for exercising any of the rights described in this section. For your security and to ensure unauthorized third parties do not access your personal information, we may require you to verify your identity before we can act on your request. In some cases, we may need to request additional information from you to verify your identity or understand the scope of your request. Generally, we verify your identity by matching the information provided in your request with the information we maintain in our records. We will require you to provide, at a minimum, basic contact information, such as name and email address.

Contact us

If you have questions about this privacy notice or wish to contact us for any reason in relation to our personal data processing, please contact us.

Email us at: privacy@digitalextremes.com

Or write us at: 250 York Street, London, Ontario, N6A 6K2