CANDIDATE PRIVACY NOTICE

1. CONTENTFUL AND OUR APPROACH TO PRIVACY

The Contentful group of companies, comprising Contentful GmbH in Germany, Contentful Inc. in the United States, and all other affiliates (“Contentful”, “we”, “us” or “our”), are committed to safeguarding your data and protecting your privacy.

This Candidate Privacy Notice applies to data that identifies or is associated with you (“personal data”) when you are applying for a position with Contentful, including where you have applied directly through the Contentful careers webpage, referrals, and via agencies and recruiters on your behalf. Please refer to our Privacy Notice for any questions you may have about how we process personal data received outside of the job candidate process.

Contentful determines the purposes and means of processing your personal data as described in this Candidate Privacy Notice and therefore acts as the controller (as defined under the General Data Protection Regulation or equivalent term under applicable data protection laws) of your personal data in this context. 

2. INFORMATION YOU PROVIDE TO US AND HOW WE USE IT

We collect personal data directly from you that you choose to submit to us when you apply for a position at Contentful. The table below sets out in detail the categories of personal data we collect about you in this regard and how we use that information. 

3. INFORMATION WE RECEIVE FROM THIRD PARTIES AND HOW WE USE IT

We may receive information from third parties, for example, from recruitment agencies or companies conducting background checks on our behalf. The table below sets out in detail the categories of personal data we may receive about you as part of the candidate process and how we use that information. 

4. LEGAL BASES FOR EUROPEAN REGION RESIDENTS

If you are based in the European Economic Area (EEA), Switzerland or the UK (the “European Region”), we are required to have a “legal basis” in order to process your personal data. We use different legal bases depending on the purpose for which we process your personal data, as set out below. 

Contractual necessity

We process your personal data in order to take steps prior to entering into a contract to which you are a party. This contract would be the agreement between you and Contentful in connection with your employment. We process your personal data under this legal basis primarily to process your application and communicate with you about the application process.

Legitimate interests

We process your personal data for our legitimate interests, namely:

• To conduct our recruitment processes in a fair manner;

• To manage applications effectively; 

• To verify your professional and educational background and assess and evaluate your skills, qualifications and interests against the position applied for and/or other positions within Contentful.

Consent

We will process your personal data for specific purposes where you have provided your consent. For example, where we collect sensitive or special categories of personal data, or if we ask your permission to retain your data for longer so you can be considered for future roles for which we think you might be suitable. If we rely on your consent, you can revoke your consent at any time. 

Compliance with a legal obligation

We will process your personal data where processing is necessary for compliance with a legal obligation. For example, to comply with legal requests from government or public authorities.

5. HOW LONG WE WILL STORE YOUR INFORMATION

We will only retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of our legitimate business interests and satisfying any legal or reporting requirements. 

In general, to determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements. In the event your application is unsuccessful, we may ask your permission to retain your data for longer so you can be considered for future roles for which we think you might be suitable.

6. DISCLOSURES OF YOUR PERSONAL DATA

We may disclose your personal data to the categories of third parties and in the circumstances as set out below:

• Service providers. We may disclose your personal data with third party vendors and other service providers that perform relevant services on our behalf, which may include: hosting and provision of our recruitment system; recruitment agencies and consultants; background check service providers; other professional services providers such as legal and accounting services; and email or other communication services.

• Other affiliates within the Contentful group. We may disclose your personal data within the Contentful group of companies as reasonably necessary for our day to day business and recruitment operations.

• Third parties in the context of a corporate transaction: We may disclose your personal data to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business. Such a transaction might involve disclosing personal data to prospective or actual purchasers, sellers and their advisers. 

• Law enforcement, regulators and other parties for legal reasons: We may disclose your personal data to comply with our legal obligations, and to protect our rights. We will disclose your personal data if we are legally required to do so, such as in response to a court order or legal process, or to establish, protect, or exercise our legal rights or to defend against legal claims or demands, or to comply with requirements of mandatory applicable law. We may also disclose your personal data as necessary to protect our rights, your rights or the rights of any third party.
  

7. CALIFORNIA RESIDENTS

In accordance with the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act, we are required to disclose certain information about how we collect personal data of individuals resident in California, and how we use, retain and disclose that data. Note that the term “personal data” in this section has the meaning given to the term “personal information” in the CCPA. 

In the last 12 months, depending on whether you have applied for a position with Contentful and the stage of your application, we may have processed your personal data as follows:

The personal data we collect and the purposes for which we collect it are set out in the “Information you provide to us and how we use it” and “Information we collect from third parties and how we use it” sections of this Candidate Privacy Notice. We obtain these categories of personal data directly from you or from third parties as described in those sections. The recipients of personal data are set out in the “Disclosures of your personal data section” above. We retain your personal data as described in the “How long we store your information” section.

We do not “sell” or “share” your personal data processed as part of our recruitment process, as those terms are defined by the CCPA.

8. SECURING YOUR PERSONAL DATA

We take appropriate technical and organizational measures to protect your personal data from unauthorized access, abuse, loss and other disruption. To this end, we regularly review our security measures and adapt them to current standards. Contentful is certified according to the ISO 27001 standard and continuously invests in and improves its security practices. You can find out more by visiting Security at Contentful.

9. INTERNATIONAL DATA TRANSFERS

The personal data we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations. If you are applying from the European Region, your personal data will be processed outside of the European Region, including in the United States.

In the event of such a transfer, we ensure that: (i) the personal data is transferred to countries recognised as offering an adequate level of protection for personal data; or (ii) the transfer is made pursuant to appropriate safeguards. Such appropriate safeguards include the standard contractual clauses adopted by the European Commission or corresponding contractual clauses adopted by Swiss or UK authorities that are in place between the relevant Contentful affiliates or between Contentful and our third-party service providers. If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of this Candidate Privacy Notice.

10. CONTROL OVER YOUR INFORMATION AND PRIVACY RIGHTS

For information on managing cookies on our websites and managing marketing preferences, please refer to our Privacy Notice that applies to your use of our website generally.

Rights of European Region residents

If you reside in the European Region, in accordance with applicable privacy law, you have the following rights in respect of your personal data that we hold:

• Right of access. The right to obtain access to your personal data along with certain related information.

• Right of portability. You have the right, in certain circumstances, to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format, or to request the transfer of your personal data to another person.

• Right to rectification. You have the right to have rectified any inaccurate or incomplete personal data we hold about you without undue delay.

• Right to erasure. You have the right, in some circumstances, to require us to erase your personal data without undue delay if the continued processing of that personal data is not justified.

• Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.

• Right to withdraw consent. If you have provided consent for the processing of your personal data, you have the right to withdraw your consent. If you withdraw your consent, this will not affect the lawfulness of our use of your personal data before your withdrawal.

• You have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case.

In some cases, these rights may be available in limited circumstances or where certain grounds apply. For example, we may not be able to allow access to your personal data where that would adversely affect the rights and freedoms of others. We may also need to verify your identity before we can fulfill your request.

If you wish to exercise one of these rights, please see Your Privacy Choices. You also have the right to lodge a complaint to your local data protection authority. 

Rights of California residents

If you reside in California, you have the following rights in respect of your personal data that we hold:

• Right of information and access. You may request information about and access to your personal data that we process in accordance with the CCPA.

• Right to erasure. You may request deletion of your personal data in accordance with the CCPA.

• Right of correction: You have the right to request that any inaccuracies in your personal data be corrected, taking into account the nature of the personal data and the purposes of the processing of your personal data.

• Right to opt-out of the sale or sharing of your personal data. We do not “sell” or “share” your personal data processed as part of our recruitment process, as those terms are defined by the CCPA. 

In relation to the sharing or sale of your personal data collected via cookies on our websites for the purposes of online analytics and advertising, please refer to our Privacy Notice that applies to your use of our websites generally for information on managing cookies via our Cookie Manager and the Global Privacy Control.

• Right to non-discrimination: You have the right to receive non-discriminatory treatment if and when you exercise your rights to access, delete, or opt-out under the CCPA. This means we cannot, for example, deny goods or services to you or charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties, due to you having exercised your rights.

Rights of residents of other US States

Depending on the state in which you reside, you may have the following rights in relation to the personal data we hold about you:

• Right of access. You may have the right to obtain:

  • confirmation of whether, and where, we process your personal data;

  • information about the categories of personal data we process, the purposes for which we process your personal data and information as to how we determine applicable retention periods;

  • information about the categories of recipients with whom we may share your personal data; and

  • a copy of the personal data we hold about you.

• Right of portability. You may have the right, in certain circumstances, to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.

• Right to correction. You may have the right to obtain rectification or correction of any inaccurate or incomplete personal data we hold about you.

• Right to deletion. You may have the right, in some circumstances, to require us to delete or erase your personal data.

• Right to restriction. You may have the right, in some circumstances, to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.

• Right to opt-out. You may have the right to opt-out of certain processing activities. For example, you may have the right to opt-out of the use of your personal data for targeted advertising purposes, or to “sell” or “share” your personal data with third parties in certain contexts.

• Right to control over automated decision-making/profiling. The right to direct us not to use automated decision-making or profiling for certain purposes.

• Right to withdraw consent. If you have provided consent for the processing of your personal data, you may have the right to withdraw your consent. If you withdraw your consent, this will not affect the lawfulness of our use of your personal data before your withdrawal.

• Right to appeal. In the event that we decline to take action on a request exercising one of your rights set forth above, you have the right to appeal our decision.

Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. 

In some cases, we may be unable to honor your requests. For example, we may not be able to delete your personal data if we are prohibited by law from doing so. We may also need to verify your identity before we can fulfill your request. If you wish to exercise one of these rights, please see Your Privacy Choices.

11. LINKS TO THIRD PARTY SITES

The Contentful careers webpages may, from time to time, contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy notices and that we do not accept any responsibility or liability for their notices. Please check the individual notices before you submit any information to those websites.

12. INFORMATION ABOUT CHILDREN

The Contentful careers webpages are not directed at persons under age 16. We do not knowingly or intentionally collect or solicit personal data from anyone under the age of 16. If we learn that we have inadvertently collected personal data from a child under 16, we will delete that information as quickly as possible. If you believe that we might have any information about a child under 16, please contact us using the details set out in the “Contact Us” section below.

13. CHANGES TO THIS CANDIDATE PRIVACY NOTICE

Please read this Candidate Privacy Notice carefully and note that we may change it. We may change it specifically if our recruitment practices and how we collect and process personal data in the context of our recruitment activities evolve or if relevant laws or their application change. We recommend that you read this Candidate Privacy Notice from time to time and take a copy for your files. We will post new versions of this Candidate Privacy Notice on our website and identify new notices with the date they take effect.

14. CONTACT US

If you have any questions about our processing of your personal data please contact the Contentful recruiter handling your application. Alternatively, you may also contact us by email at privacy@contentful.com. Our data protection officer can be contacted at dpo@contentful.com.