Zip Co Us Inc. Applicant and Candidate Privacy Notice

Overview

Zip Co US Inc., together with Zip's U.S. affiliates (collectively, “Zip”, or “the Company”) is committed to the protection of your privacy. As part of the recruitment process, Zip collects, stores and processes Personal Data (as defined, below) relating to job applicants and/or candidates in order to evaluate candidacy for employment. This Applicant and Candidate Privacy Notice (“Notice”) has been created to promote transparency around the way in which Zip handles Personal Data in relation to all pre-employment activities, including the initial application, the hiring process and any applicable background checks.

For individuals who are also a customer of Zip or its lending partners for personal purposes (or who apply for a Zip product or facilitated loan for such purposes), and Personal Information collected in that customer-related context will be protected per the Zip Privacy Policy.

In this Notice, “Personal Data” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual in the context of that individual's role as a job applicant of Zip. It does not include aggregated or de-identified information that is maintained in a form that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain de-identified data, we will maintain and use the data in de-identified form and not attempt to re-identify the data except as required or permitted by law.

Zip is the Data Controller of the Personal Data provided to the Company and will process any such Personal Data in accordance with applicable regulations and the terms in this Notice. Kindly note that the precise Data Controller in respect of your Personal Data will typically be the Zip entity to which you are applying, although other entities in the Zip Group may access and process your information for the purposes set out in this Notice.

The term “applicant” is used in this Notice to refer to anyone who applies for a job role and/or internship opportunities, or who otherwise seeks to carry out work with or for Zip (whether on a permanent or non-permanent basis).

What Data We Collect

Personal Data

The types of Personal Data that Zip may collect and process when an individual applies for a role with the Company include (but are not limited to):

• Identification Data: Name, date of birth, picture, likeness, nationality, citizenship.
• Contact and Communication Data: Address, phone number, email address, messages sent to or from Zip.
• Education and Employment Background: Resume/CV and/or LinkedIn profile, cover letter, academic/professional qualifications, transcripts and employment references, information about criminal convictions and offenses and other information revealed during background screenings or consumer reports (if applicable).
• National Identifiers and Work Eligibility ("Right To Work") Information: National ID/passport, immigration status, work authorizations, visas, social security numbers ("SSNs").
• Demographic Information: Race/ethnic origin, sex/gender, gender identity, military or veteran status.
• Application-related Information: Position preferences, willingness to relocate, desired salary, interests and aspirations and any other information you provide to us in support of and during the recruitment process.
• Content of Interviews/ other Forms of Assessment: In-person, audio, or video interviews (live and recorded), information available online, and other forms of assessment you might provided to Zip.
• Internet or other Electronic Network Activity and Analytics: Data about the pages you access, computer IP address, device ID or unique identifier, device type, geo-location information, computer and connection information, mobile network information, statistics on page views, traffic to and from the sites, referral URL, ad data, and standard web log data and other information.

Sensitive Personal Data

As part of the recruitment process, Zip may collect certain Personal Data that is considered “Sensitive Personal Data” to support legal and business activities, and as permitted by law. This includes government issued identifiers, such as SSNs, driver’s license information and diversity information such as disabilities for the purposes of equal opportunities monitoring. Applicants may provide, on a voluntary basis, other Sensitive Personal Data during the recruitment process.

With applicant consent, Zip may use identity (“ID”) verification services from a third party vendor, Veriff, which processes applicant information in accordance with Veriff’s Privacy Notice. Zip may ask applicants to submit a valid form of photo ID and a selfie image, which are sent directly to the vendor. Using machine learning and facial recognition, the vendor compares the selfie with the photo ID to confirm the applicant’s identity. If manual ID verification is preferred, applicants should contact their Recruitment Partner.

Sources of Personal Data

Depending on an applicant's residency, Zip may collect some information from sources other than the applicant in the course of our recruitment process, including:

• Previous and current employers
• Service Providers (e.g., recruiters)
• Background check services
• Individuals who refer you
• Online sources including social networks and recruiting sites (e.g. LinkedIn)
• Open government databases and other public sources

We also may collect Personal Data through our use of cookies, web beacons, and mobile analytics sent to us by your computer, mobile phone, or another access device.

Use of Personal Data

In general, and subject to applicable law, Zip collects and uses applicant Personal Data primarily for recruitment purposes. In particular, Zip uses this information to determine qualifications for employment or a temporary assignment, and to help Zip reach a hiring decision. This means, in part, that Zip needs to:

• Assess applicants' skills, qualifications and suitability for the respective role.
• Verify applicants' information and carry out background and reference checks, where applicable.
• Communicate with applicants about the recruitment process.
• Track an application through the recruitment process.
• Evaluate applicants for current and future job opportunities.
• Where we need to comply with legal or regulatory requirements.
• Conduct internal analyses to understand the job applicants and/or candidates who apply and to improve our recruitment process.
• Potentially use the data for Zip's legitimate interests (or those of a third-party) and applicant interests and fundamental rights do not override those interests.
• Facilitate personality, ability and occupational assessments by a third-party vendor.

Zip will only use applicant Personal Data for the purposes for which it is collected unless Zip reasonably considers that it is required for another purpose and that purpose is compatible with the original purpose. If Zip needs to use applicant Personal Data for an unrelated purpose, Zip will notify the applicant and explain the legal basis that allows Zip to do so. Please note that Zip may process applicant Personal Data without applicant knowledge or consent to the extent required or permitted by law (for example for law enforcement or regulatory purposes).

If an applicant is hired, Personal Data collected in connection with their application can be incorporated into Zip's human resources systems and used to manage the new hire process. As such, any Personal Data can become part of the applicant's personnel file and used for other employment-related purposes.

Personal Data Sharing

Zip may disclose Personal Data, including sensitive Personal Data, to the following categories of recipients, for the business purposes described in this Notice and below:

Disclosures to Subsidiaries and Affiliates

Zip may share applicant Personal Data with affiliates under common ownership or control of Zip for purposes of recruiting, Human Resources administration and general business management and operations.

Disclosures to Third Party Agents and Service Providers

Zip may contract with Service Providers as part of its normal business operations to carry out certain human resources and recruitment related functions.

Zip may also disclose Personal Data to other third parties, in an effort to:

• To comply with applicable law.
• To respond to requests from public and government authorities.
• To cooperate with law enforcement.
• Sell, assign, or transfer all of or part of Zip's business.
• To protect Zip's rights, privacy, safety or property, and/or that of Zip affiliates or others.
• Establish, exercise or defend against potential, threatened or actual litigation, as needed.
• In connection with a sale or business transaction.

Data Retention of Personal Data

Personal Data will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Notice, unless a longer retention period is permitted or required by applicable law.

If applicant becomes a Zip employee, Personal Data provided will become a part of the employee's personnel file and may be used for the management of the employment relationship.

Privacy Rights & Choices

In certain U.S. states, applicants may be entitled to additional rights under state-specific legislation. These may include:

• The right to access the applicant's Personal Data that Zip stores, including details of why Zip is processing it.
• The right to request that Zip corrects inaccurate or incomplete Personal Data.
• In certain situations, the ability to ask that Zip erases Personal Data. In some circumstances, Zip may not delete Personal Data because certain exceptions could apply.
• The right to request portability or export of Personal Data to another controller.
• The right to limit the use and disclosure of Personal Data (e.g., marketing with non-affiliates)

In order to process the request, applicants may be asked to verify their identity. If Zip is unable to verify their identity, the request may be denied. Additionally, certain Personal Data may be exempt from such requests pursuant to applicable data protection laws or other laws and regulations.

Applicants can submit a privacy request here.

How We Protect Applicant Personal Data

Zip acknowledges its responsibility to safeguard applicant Personal Data and takes that responsibility seriously. Firstly, Zip limits those who have access to applicant information to individuals who have a legitimate business reason for using it. Then depending upon the type and form of Personal Data, Zip manages it according to the Company's data handling policies and procedures to ensure that it is transferred, processed, and stored with the proper safeguards in place. In addition, Zip has put in place procedures to deal with any suspected Personal Data breach and will notify applicants and any applicable regulator of a breach where we are legally required to do so.

Notice to AU Residents

If residing in Australia or New Zealand, applicants are able to review the ANZ Candidate Privacy Statement.

Changes to This Notice

This Notice may be updated periodically. When Zip updates this Notice, Zip will note the date of the update above. On some occasions, Zip may actively advise applicants of specific data handling activities or significant changes to this Notice, as required by applicable law.

Contact Us

If you have questions about this Notice or wish to contact Zip in relation to its applicant Personal Data processing, please contact privacy.usa@zip.co