Job Candidate Privacy Notice

Last updated: January 2024

This Job Candidate Privacy Notice (“Notice”) describes what personal data Verbit and our affiliates (“Verbit”, “we”, “our” or “us”) collect and process on our job candidates and applicants (“Candidates”, “you” or “your”) with respect to our application and recruitment process, why we collect it and how we use it. It also describes how candidates may exercise their rights to such data held with us.

We strongly urge you to read this Notice and make sure that you fully understand and agree to it. If you do not agree to this Notice, please avoid providing us with your data. 

You are not legally required to provide us with any personal data, but without it we may not be able to process your application.

1. What data do we collect, how do we collect it, and how do we use it?

Throughout the application and recruitment process, we collect or otherwise have access to personal data about you (including in the preceding 12 months), such as your identifying data, contact details, resume/CV, salary expectations, work-related data, social media activity, etc. We may collect this data directly from you, as you provide it voluntarily through your application and candidacy review process, or from other sources such as recruitment agencies, background check services (as applicable and subject to applicable law), or your references.

We may use such data to assess our Candidates’ skills, qualifications and overall to verify, consider and process their application and candidacy for any of our positions, and to communicate with them regarding such processes. We may also use it to manage risk and enhance our security and anti-fraud measures, and to create aggregated statistical or inferred data regarding our Candidates, for further development and improvement of our recruitment processes.

In addition, we may use it to act as permitted by, and to comply with, any legal or regulatory requirements. Shall we wish to conduct any additional activities that may require the use of your data, we will request your specific consent in advance.

We may collect sensitive data about your prior criminal convictions and offences as part of our background checks for specific roles if permitted or required by law. To the extent legally required, we will obtain your explicit consent prior to any such collection and use.

2. For what purposes do we use our Candidates’ data?

We use and process your personal data as part of the employment application process at Verbit for the following purposes and in reliance on the lawful bases noted below (including in the last 12 months):

Purpose	Lawful Basis for Processing
To evaluate your suitability for a role at Verbit, and manage your application	Performance of a Contract
To contact you regarding other suitable roles within Verbit in the future	Legitimate Interests Consent (where applicable)
To maintain our internal records of recruitment and employment applications	Legal Obligations Legitimate Interests
To create your employee personnel file, if hired
To comply with applicable legislation and industry codes
To manage risk and enhance our security and anti-fraud measures	Legitimate Interests
To further develop and improve our recruitment processes and hiring practices
To protect the rights and interests of Verbit, its affiliates and personnel

If you reside in a territory governed by privacy laws under which “Consent” is the only or most appropriate legal basis for the processing of personal data as described herein, your application will be deemed as your acceptance of this Notice and consent to the processing of your personal data for all purposes detailed in this Notice. If you wish to revoke such consent, you may do so at any time by contacting us at privacy@verbit.ai.

3. Where do we store our Candidates’ data?

Your personal data will be maintained, processed and stored by Verbit and our Service Providers (as defined in Section 6 below) in the applied position’s location(s), in relevant Verbit offices worldwide including Israel, the U.S., and other jurisdictions, as necessary for the proper handling of your candidacy.

While privacy laws may vary between jurisdictions, Verbit, its affiliates and Service Providers processing personal data on our behalf are each committed to protecting your personal data in accordance with this Notice, customary industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

Verbit Inc. (including on behalf of its wholly-owned subsidiaries Automatic Sync Technologies LLC and VITAC Corporation) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-US DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), as set forth by the US Department of Commerce, and will be further liable in cases of onward transfers of your personal data to third parties (including our Service Providers). Verbit Inc. (including on behalf of its wholly-owned subsidiaries Automatic Sync Technologies LLC and VITAC Corporation) has certified to the US Department of Commerce that it adheres to the EU-US DPF Principles with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-US DPF.

Verbit Inc. (including on behalf of its wholly-owned subsidiaries Automatic Sync Technologies LLC and VITAC Corporation) has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between the terms in this Notice and the EU-US DPF Principles and/or the Swiss-US DPF Principles, the Principles shall govern for personal data transferred under the DPF. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

To the extent we transfer Candidates’ personal data that is subject to transfer restrictions, we rely on appropriate contractual undertakings and data transfer mechanisms as established under applicable law.

4. For how long may we keep your data?

We may retain Candidates’ data even after the applied position has been filled or closed. This is done so we could reconsider Candidates for other positions and opportunities at Verbit; so that we may use their personal data as reference for future applications submitted by them; in case the Candidate is hired, for additional employment and business purposes related to their work; and as reasonably necessary to comply with our legal obligations, to resolve disputes, prevent fraud and abuse, enforce our agreements or otherwise protect our legitimate interests.

5. How do we secure your data?

Verbit has implemented security measures designed to protect the personal data of our candidates, including physical, procedural and electronic measures. These measures provide sound industry standard security. We also regularly seek new ways and tools for further enhancing the security of our systems and the integrity of the personal data that we hold. Please be aware that regardless of the measures we take and the efforts we make, we cannot and do not guarantee the absolute protection and security of any personal data stored with us.

6. Who will have access to your data?

Verbit will share your personal data with several selected Service Providers, whose services and solutions complement, facilitate and enhance our own. These include any recruitment firms that have referred you to us (or vice versa), candidate evaluation centers, recruitment software providers, background checks providers, data and cybersecurity services, web analytics, and our business, legal, compliance and financial advisors (collectively, “Service Providers“). Such Service Providers may receive or otherwise have limited access to our Candidates’ personal data, depending on each of their particular roles and purposes in facilitating and enhancing our recruitment process, and may only use it for such purposes.

Additionally, we may disclose or otherwise allow access to any Candidates’ personal data pursuant to a legal request, such as a subpoena, search warrant or court order, or in compliance with applicable laws, with or without notice to you, if we have a good faith belief that we are legally required to do so, or that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud or other wrongdoing. We may also share your personal data with others, with or without notice to you, if we believe in good faith that this will help protect the rights, property or personal safety of Verbit, any of our customers or employees, or any member of the general public.

Finally, we may share personal data internally within our family of companies, for the purposes described above. In addition, should Verbit undergo any change in control, including by means of merger, acquisition or purchase of all or part of its assets, your personal data may be shared with the parties involved in such event.

7. Which cookies and tracking technologies do we use?

Verbit uses certain monitoring and tracking technologies, such as “cookies” and other downloaded data files, including ones offered by our Service Providers. These technologies are used to maintain, provide and improve our processes and operations on an ongoing basis, and in order to provide a better experience to our website visitors and Candidates.

For example, these technologies enable us to better secure our website and services and detect abnormal behaviors, to identify technical issues, and to monitor and improve the overall performance of our services and processes.

To learn more about our cookie practices, please visit our Cookie Declaration.

8. How can you access your data or request to delete it?

If you wish to exercise your rights under any applicable law (including the EU or UK General Data Protection Regulation (GDPR), Israel Privacy Protection Laws, the Personal Information Protection and Electronic Documents Act (PIPEDA), the California Consumer Privacy Act (CCPA)) or other applicable US State privacy laws) such as, to the extent applicable – the right to know/access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request rectification or erasure of your personal data held with Verbit, to port such personal data, or to restrict or object to such personal data’s processing or any similar rights afforded to data subjects under the laws that apply to you – please contact us at privacy@verbit.ai. Additionally, you have a right to lodge a complaint with a competent data protection authority, such as the UK’s Information Commissioner’s Office, or your State’s Attorney General (as applicable).

Please note that we may require additional information, including certain personal data, in order to authenticate and process your request. Such additional information, along with records pertaining to your request, its handling by us and subsequent communications between you and us, may be then retained by us for legal purposes (e.g., as proof of the identity of the person submitting the request or proof of request fulfillment), in accordance with Section 4 above. We may redact from the data which we will make available to you any personal data related to others.

Please bear in mind that such rights are not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal data that we hold about you. In the event that we cannot accommodate your request, we will inform you of the reasons that hinder us from doing so, subject to any legal or regulatory restrictions.

In compliance with the EU-U.S. DPF, and the UK Extension of the EU-U.S. DPF and the Swiss-U.S. DPF Principles, Verbit Inc. (including on behalf of its wholly-owned subsidiaries Automatic Sync Technologies LLC and VITAC Corporation) commits to resolve complaints about our collection or use of your personal data. EEA, UK and Swiss individuals with inquiries or complaints regarding our Data Privacy Framework compliance should submit inquiries to privacy@verbit.ai. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, we further commit to cooperate and comply with the advice of the panel established by the EU Data Protection Authorities (DPAs), the UK Information Commissioner Office (UK ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF, the UK Extension of the EU-U.S. DPF, or the Swiss-U.S. DPF in the context of a prospective employment relationship.

Please note that under certain conditions (as described under the DPF Principles that Verbit Inc., including on behalf of its wholly-owned subsidiaries Automatic Sync Technologies LLC and VITAC Corporation, adheres to) you can invoke a binding arbitration by delivering a notice to privacy@verbit.ai. Please also note that Verbit Inc. (including its wholly-owned subsidiaries Automatic Sync Technologies LLC and VITAC Corporation), is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

9. Will this Notice be updated?

We may update this notice to reflect changes in our privacy practices. If we make any changes that we deem as “material”, we will update this page prior to the change becoming effective.

10. Requirements under U.S. State Privacy Laws

This policy describes the categories of personal information we may collect and the sources of such information (in Section ‎1 above), and our retention (Section 4) and deletion (Section ‎8) practices. We also included information about how we may process your information, which includes processing for “business purposes” under the CCPA as amended, and other applicable US State privacy laws. We do not sell or share your personal information for the intents and purposes of CCPA. We may disclose personal data with third parties or allow them to collect personal data from us as described above, if those third parties are authorized Service Providers or if you direct us to disclose your personal data to third parties. You may also designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. The authorized agent may submit a request to exercise these rights by emailing us at privacy@verbit.ai.

11. What if you have any questions?

If you have any comments or questions regarding our data practices or your privacy, or if you have any concerns regarding your personal data held with us, or if you wish to make a complaint about how your personal data is being processed by Verbit, you can contact us at privacy@verbit.ai.

UK Representative: Take Note Ltd. has been designated as Verbit’s representative in the United Kingdom for data protection matters pursuant to Article 27 of the UK GDPR. Take Note Ltd. may be contacted on matters related to the processing of personal data of residents of the UK, at privacy@verbit.ai.