Global Applicant Privacy Notice
Last updated: October 21, 2024
1. Introduction
1.1 Fivetran Inc. and our affiliated companies ("Company", "we", "us" and "our") hold and process data on all current and former applicants and interview candidates of Fivetran or our affiliated companies (“you” or “your”).
1.2 The Company will be the data controller of your personal data. In addition, where processing of personal data is undertaken by other affiliated companies of the Company for their own independent purposes, these affiliated companies may also be controllers of your personal data. This Global Applicant Privacy Notice (“Notice”) is provided on behalf of the Company and each of these affiliated companies.
1.3 We take your data protection rights and our legal obligations seriously. Your personal data will be treated in a secure and confidential manner, following the guidelines outlined below or as otherwise communicated to you in writing.
1.4 This Notice explains the types of personal data we collect, how we handle it, why we use it, and how we protect your privacy while working with us. It is designed to meet our legal requirements to inform you about how we handle your personal data under privacy laws.
1.5 If you have any questions about this Notice, would like to access the information it contains in a different format, believe your privacy rights have been violated, or if you are aware of an unauthorized use or disclosure of data, please contact us at privacy@Fivetran.com or at:
Fivetran Inc. Attn: Data Protection Officer, 1221 Broadway, Suite 2400, Oakland, CA 94612, United States.
We have a Data Protection Officer responsible for compliance with data protection law. Their contact details are dpo@Fivetran.com.
2. What data do we process?
2.1 Personal data refers to any information that describes or is connected to a person who can be identified, either directly or indirectly. This identification can be made through things like a name, an ID number, location data, an online identifier, or other unique details related to a person's physical, mental, genetic, economic, cultural, or social identity.
2.2 We collect various types of personal data about you for the purposes described in this Notice including but not limited to:
(a) Personal details: your name, gender, nationality, civil/marital status, date of birth, age, personal contact details (eg address, phone number, e-mail), national ID number, immigration and eligibility to work information, driving license, languages spoken, details of any disability and any reasonable adjustments required as a result;
(b) Recruitment and selection data: skills and experience, qualifications, references, CV and application, interview and assessment data, vetting and right to work verification, information related to the outcome of your application, details of any offer made to you;
(c) Claims, complaints and disclosures information: subject matter of litigation and complaints, pre-claim conciliation, communications, settlement discussions, claim proceeding records, involvement in incident reporting and disclosures;
(d) Equality and diversity data: where permitted by law or provided voluntarily, data such as gender, age, race, nationality, religious belief, and sexuality;
(e) Any other personal data which you choose to disclose to us during your engagement whether verbally or in written form (for example in emails);
Broad categories of personal data collected | Examples |
Identifiers | Name, contact information, and other personal data that can directly or indirectly identify you |
Legally Protected Characteristics | Race, religion, national origin, sexual orientation, etc. |
Internet or Network Activity | Browsing history, search history, information regarding interaction with an Internet Web site or application |
Employment Information | Role, title, and other relevant employee information |
Education Information | Education history |
Inferences Drawn from other Personal Information | Internal identifiers |
2.3 In addition to your own personal data, you may also provide personal data of third parties, like in relation to reference checks, with the Company. Before you share any personal data of third parties with the Company, you must first inform these third parties about the data you intend to provide to the Company and the processing of that data, as explained in this Notice.
2.4 Certain additional information may be collected where this is necessary and permitted by applicable law.
3. Special categories of data
To the extent permitted by applicable laws the Company collects and processes a limited amount of personal data within the data listed in clause 2.1 falling into special categories, sometimes called "sensitive personal data". This term means information relating to:
3.1 racial or ethnic origin;
3.2 political opinions;
3.3 religious or philosophical beliefs;
3.4 physical or mental health (including details of accommodations or adjustments);
3.5 trade union membership; and
3.6 sex life or sexual orientation.
4. How does the Company collect data?
4.1 The Company mainly collects and stores your personal data directly from you. You will provide this information either directly to your Human Resources contact, or you will enter it into our recruitment systems. This data can also be collected during your participation in HR processes, from emails and instant messages you send, or through verbal information that may be recorded electronically or manually.
4.2 We also obtain some information from third parties: for example, references from a previous employer, staffing agencies, professional employer organizations, medical reports from external professionals, information from tax authorities, or where we employ a third party to carry out a background check (where permitted by applicable law.)
4.3 Some data may be obtained from publicly accessible sources.
4.4 If certain information is necessary due to a contract, legal, or business requirement, we will inform you at the time of collecting that information. We will also let you know about any consequences that may arise if you do not provide the requested information. Not providing some information may result in us being unable to carry out specific HR processes. In some cases, it may even lead to us being unable to continue your engagement because we will not have the personal data we consider essential for effectively and efficiently managing our relationship with you.
5. What are the purposes for which data is processed and what is our legal basis for carrying out the processing?
5.1 We collect and process your personal data for various business reasons, including as required by law. In this Notice, we have outlined the purposes for which we might use your personal data. We may, where we think it is necessary, provide you with additional information in relevant HR policies to ensure that you understand how your personal data may be used.
5.2 The legal basis on which we process your personal data
(a) When the Company processes your personal data, we do so based on a legal justification or basis for that processing. The processing of special categories of data always requires an additional lawful condition. In most cases, processing your personal data will be justified on one of the following bases:
(i) The processing is necessary to comply with a legal obligation that the Company must follow; or
(ii) Where there is no legal obligation, we will process your data when it is necessary to fulfill a contract in which you are a participant or to take steps you have requested before entering into such a contract
(b) Where the above two grounds do not apply, we may process your personal data where the processing is necessary for the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (for example to meet the security requirements of our customers). These legitimate interests contribute to the Company continuing to meet its immediate and long-term business objectives, maintain its reputation, and attract high-caliber employees.
(c) In rare cases, we may process data based on your consent. When we rely on your consent, we will make it clear at the time.
5.3 The purposes we use personal data for and the legal basis that applies
We have identified several purposes for collecting and processing your personal data. These are set out below together with the legal basis we rely on in each case:
Purpose for processing | The lawful basis we rely on |
1. Recruitment and selection Considering your suitability to work for us in the role you have applied for, comparing you to other candidates, and making recruitment decisions | Some of this processing is necessary for the Company’s legal obligations including the requirement to make reasonable adjustments or accommodations where appropriate if you choose to disclose that you have a disability. Some of this processing is necessary for taking steps at your request to enter into a contractual relationship with you. Additional processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in fully assessing applicants to ensure that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position. The Company aims to recruit the best person for each vacancy through fair, systematic, effective recruitment and selection procedures. |
2. Pre-employment verification and screening Appropriate pre-employment screening including, where relevant, identity check, right to work verification, reference check, relevant employment history, relevant regulatory status, and professional qualifications | Some of this processing is necessary for the Company’s legal obligations including establishment of the right to work in the country in which you are employed. Screening which is not legally required is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business or its customers and considers the verification carried out necessary to prevent crime and other unlawful acts and to protect the business and customers from fraud, dishonesty, or incompetence. |
3. Offers of employment and on-boarding Making job offers, providing contracts of employment or engagement, and preparing to commence your employment or engagement where you accept an offer from us | Some of this processing is necessary for the Company’s legal obligations including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you. Additional processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us. The remainder of the processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in ensuring the effective engagement of staff on appropriate terms and conditions of employment, that there is a smooth transition into employment for successful candidates, and that information supplied in the recruitment process which is relevant to ongoing employment is maintained. |
4. Future job opportunities To contact you if you are not successful in your initial application should another potentially suitable vacancy arise | This processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment. This will potentially benefit both initially unsuccessful candidates and the Company. It will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high-caliber employees. |
5. Recruitment feedback and complaints To deal with any query, challenge or request for feedback received in relation to our recruitment decisions | This processing is necessary for the Company’s legal obligations, including ensuring that it can demonstrate its compliance with data protection and anti-discrimination laws. Processing is also necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision. This will assist the Company to avoid the risk of financial exposure or costs incurred through challenges and to maintain its reputation. |
6. Legal compliance Complying with applicable laws and regulations | This processing is necessary for the Company’s legal obligations. |
7. Ensuring equality of opportunity Monitoring programs to ensure equality of opportunity and diversity regarding personal characteristics protected under applicable anti-discrimination laws | This processing is necessary for the Company’s legal obligations. Processing is also necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in ensuring equality of opportunity or treatment between people of different age, sex, racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health, or people of different sexual orientation. Ensuring equality and diversity ensures attraction and retention of high-caliber employees, protects the Company's reputation, and avoids unlawful discrimination. |
8. Complaints, claims and litigation To enforce our legal rights and obligations, and in connection with any complaint or legal claim made by, against, or otherwise involving you | This processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in protecting its organization from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that the Company's legal rights and interests are protected appropriately, to protect the Company's reputation, and to protect the Company from other damage or loss. This is important to protect the Company and ensure its continued success and growth. |
9. Legal or regulatory disclosures To comply with lawful requests by public authorities, discovery requests, as required or permitted by applicable laws, court orders, government regulations, or regulatory authorities | This processing is necessary for the Company’s legal obligations where there is a legal obligation to disclose information or a court or other legal order to provide information. Where not legally required, processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in cooperating with relevant authorities, government bodies, or regulators for the provision of information where appropriate. The Company wishes to maintain its reputation as a good corporate citizen and to act ethically and appropriately in all the countries in which it does business. This encourages compliance, a high standard of business practice, and protects the Company's reputation. |
5.4 Additional legal basis we rely on where we process special category data
When the Company processes special categories of personal data, it is justified by one of the conditions mentioned in 5.2(a) as well as one of the following additional conditions:
(a) The processing is necessary to fulfill legal obligations and protect the rights of either you or the Company within the scope of employment law, social security and social protection law, and to the extent permissible under applicable laws;
(b) The processing is necessary for purposes authorized by applicable law;
(c) The processing is necessary for the establishment, exercise or defense of legal claims; or
(d) In rare circumstances the processing is carried out with your explicit consent (as explained below).
5.5 The purposes we use special category personal data for and the additional legal basis that applies
We have identified several purposes for collecting and processing your special category personal data. These are set out below together with the additional legal basis we rely on in each case:
Purpose for processing | Additional lawful basis for special category data processing |
10. Documentation such as work permits, details of residency, and proof of citizenship will be processed to assess and review eligibility to work for the Company in the jurisdiction in which you work | This type of processing is needed to fulfill the obligations and protect the rights of either you or the Company within the scope of employment, social security, and social protection law, to the extent permissible under applicable laws (such as the requirement to check that you are legally permitted to work in your jurisdiction.) |
11. Your racial or ethnic origin, religion, philosophical or political belief, sexual orientation or disability status may be used for the collection of statistical data subject to local laws, or where required to record such characteristics to comply with equality and diversity requirements of applicable local legislation, or to keep the Company’s commitment to equal opportunity under review | This processing is necessary for the public interest of ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained. |
12. Special category personal data of any type may be used in the event of a complaint, claim, or litigation or potential claim or litigation by, against, or involving you | This processing is necessary to establish, exercise, or defend legal claims. |
5.6 We may seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed, and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your recruitment to agree to any request for consent from the Company.
6. AI Tools
6.1 Fivetran may use AI tools, including tools which automate or recommend decisions, to assist with various HR processes. When Fivetran uses AI tools Fivetran will follow applicable law and ensure responsible use, such as employing the following types of safeguards:
- A meaningful human review of automated decisions or recommendations;
- Data minimization and the facilitation of privacy rights requests;
- Additional notice, consent, and the ability to opt out of automated decision making when required; and
- Testing automated decision-making tools for accuracy, fairness, and bias.
7. Retention of personal data
7.1 The Company aims to keep your personal data as up to date as possible. We also work to delete or anonymize data that is irrelevant or excessive as soon as reasonably practicable.
7.2 Typically, we keep personal data for as long as it is necessary to fulfill the purpose for which it was collected. Some personal data may be retained for varying time periods in order to comply with legal obligations and for other legitimate business reasons.
8. Disclosures of personal data
8.1 Within the Company, your personal data can be accessed by or may be disclosed internally on a need-to-know basis to:
(a) local, regional, and global Human Resources, including managers and team members;
(b) local, regional, and executive management responsible for managing or making decisions in connection with your relationship with the Company or when involved in an HR process concerning your relationship with the Company (including, without limitation, staff from Compliance, Legal, Human Resources and Information Security);
(c) system administrators; and
(d) where necessary for the performance of specific tasks or system maintenance by staff in the Company, teams such as the Finance, IT Department, and the Global HR information systems support team.
8.2 Certain basic personal data, such as your name, location, job title, contact information, and any published skills and experience profile may also be accessible to other employees. The security measures in place within the Company to protect your data are set out below in Section 9.
8.3 Your personal data is also accessed by third parties whom we work together with for providing us with services, such as hosting, supporting, and maintaining the framework of our HR information systems.
8.4 Personal data will also be shared with certain interconnecting systems such as our HR recruiting system. Data contained in such systems may be accessible by providers of those systems, their affiliated companies, and sub-contractors.
8.5 Examples of third parties with whom your data will be shared include regulatory authorities, IT administrators, lawyers, auditors, consultants and other professional advisors, staffing companies, and professional employer organizations. The Company expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security.
8.6 Where these third parties act as a "data processor" they carry out their tasks on our behalf and upon our instructions for the above-mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.
8.7 In addition, we may share personal data with national authorities in order to comply with a legal obligation. For example, in the case of imminent or pending legal proceedings or a statutory audit.
Broad categories of personal data we share with third parties for a business purpose | Types of third parties we share with |
| Group companies (affiliates), service providers, and national authorities when legally required |
We do not share applicant personal data with third parties for commercial purposes.
9. Security of data
9.1 The Company is committed to protecting the security of the personal data you share with us. The Company uses a variety of technical and organizational methods to secure your personal data in accordance with applicable laws.
9.2 Further, we conduct due diligence, including applicable security reviews and data protection assessments, for all third-party vendors, including HR-related vendors.
10. International transfer of personal data
10.1 Sometimes your personal data (including special categories of personal data) will be transferred to Company affiliates to process for the purposes described in this Notice. This is applicable when the relevant company or a manager within that company is responsible for conducting or approving a specific process.
10.2 Some of these affiliated companies or managers are located outside the European Union, and we ensure that we have the appropriate privacy and security safeguards for any cross-border transfers.
10.3 Personal data will also be transferred to third parties (eg service providers or regulators as set out above), who may have systems or suppliers located outside the European Union.
10.4 As a result, your personal data may be transferred to countries outside of the country in which you work or outside of the European Union to countries whose data protection laws may be less stringent.
10.5 The Company will ensure that appropriate or suitable safeguards are in place to protect your personal data and that the transfer of your personal data complies with applicable data protection laws.
10.6 Where required by applicable data protection laws, the Company has ensured that service providers (including our affiliated companies) sign standard contractual clauses as approved by the European Commission or other supervisory authority with jurisdiction over the relevant Company exporter. Our standard contractual clauses can be provided on request by contacting us at privacy@fivetran.com.
10.7 You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity. To request sight of these contact privacy@fivetran.com.
11. Your rights as a data subject
11.1 Right to access, correct and delete your personal data
(a) The Company aims to ensure that all personal data is correct. You also have a responsibility to ensure that changes in personal circumstances (for example, change of address) are notified to the Company so that we can ensure that your data is up to date.
(b) You have the right to request access to any of your personal data that the Company may hold, and to request correction of any inaccurate data relating to you. You furthermore have the right to request deletion of any irrelevant data we hold about you.
(c) To correct/update other information, you will need to contact Human Resources or privacy@fivetran.com.
11.2 Data portability
Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive personal data you have provided to the Company in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.
11.3 Right to restriction of processing
You have the right to restrict our processing of your personal data where:
(a) you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
(b) where the processing is unlawful but you do not want us to erase the data;
(c) where we no longer need the personal data for the purposes of the processing, but it is required for the establishment, exercise, or defense of legal claims; or
(d) where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether the Company has compelling legitimate grounds to continue processing.
Where personal data is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise, or defense of legal claims.
11.4 Right to withdraw consent
Where we have relied on your consent to process your personal data, you have the right to withdraw such consent at any time. You can do this by contacting your local Human Resources contact or emailing privacy@fivetran.com. We rarely rely on your consent to process personal data for your employment or engagement.
11.5 Right to object to processing justified on legitimate interest grounds
Where we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms or where we need to process the data for the establishment, exercise, or defense of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
11.6 Right to opt out of the sale of personal data
We do not sell applicant personal data, or share it for online advertising.
11.7 Right to opt out of the use of special category or sensitive personal data
We do not use or disclose special category data outside of recruitment purposes.
11.8 Right to non-discrimination
We will not discriminate against a data subject for exercising a privacy right.
11.9 Right to have an authorized agent submit a privacy request
You have the right to have your authorized agent make a data privacy request on your behalf.
11.10 Right to complain
You also have the right to lodge a complaint with a supervisory authority if you believe the processing of your personal data infringes applicable law.
11.11 Right to appeal
If you are not satisfied with our response regarding your data privacy request, you have the right to appeal our decision. If you are not satisfied with the result of the appeal, you have the right to contact your respective attorney general depending on the jurisdiction in which you reside.
How to contact us: For further information regarding your rights, or to exercise any of your rights, please contact privacy@fivetran.com.
12. Additional notices
We may undertake processing of personal data which are subject to additional notices and we shall bring these to your attention where relevant.
13. Notice of changes
13.1 The Company may change or update this Notice at any time.
13.2 Should we make material changes to this Notice, you will be informed of these changes or made aware that we have updated the Notice so that you know which information we process and how we use this information.
13.3 The date at the top of this Notice indicates when it was last updated.
Table of Contents
- introduction
- what data do we process?
- special categories of data
- how does the company collect data?
- what are the purposes for which data is processed and what is our legal basis for carrying out the processing?
- ai tools
- retention of personal data
- disclosures of personal data
- security of data
- international transfer of personal data
- your rights as a data subject
- additional notices
- notice of changes