Job Applicant Privacy Notice

Information We Collect

We collect and process personal information for recruitment, interviewing, and hiring purposes as described in this Notice (collectively, “Recruitment Activities”).

Information We Collect from Third Parties

We collect or reference information from publicly available sources (e.g., LinkedIn) or from third parties (e.g., recruiting agencies, former employers, background check providers) to engage in and support our Recruitment Activities. We only use information about you that we receive from third parties for the purposes described in this Notice.

Personal information that third parties disclose to us may include:

• Contact information;
• Candidate salary expectations (if provided to them by you);
• Academic and professional background information, such as referrals from current and former employees, contractors, and recruiting agencies;
• Public information, such as public social media posts; and
• Special or sensitive categories of information, such as your criminal background if we conduct a background check (consistent with applicable law).

How We Use Information

When you interact with us during our Recruitment Activities, we use your information to carry out our Recruitment Activities, such as in the following ways:

• Communicate with you – We use your information to engage with you, including contacting you during the screening and interviewing process and communicating with you through our Recruitment Activities.
• Engage in our Recruitment Activities – We use your information to engage with you in providing, operating, monitoring, and maintaining our Recruitment Activities. For example, we need your information to evaluate and verify your application and qualifications for employment, define job roles and responsibilities, conduct interviews and screenings, conduct background and criminal checks (in accordance with applicable laws), check references, prepare and negotiate offers, salaries, and benefits, arrange travel where applicable, or reimburse you for travel expenses, where agreed upon by us.
• Provide and improve our Recruitment Activities – We use your information to internally evaluate our recruitment process, analyze how you interact with us during our Recruitment Activities (e.g., if you have previously visited our Careers page to determine the effectiveness of our job postings), gather survey feedback, conduct analytics, and improve your experience and the quality of our Recruitment Activities.
• Promote the security of our Recruitment Activities – We use your information to investigate and prevent fraudulent behavior, unauthorized access related to our Recruitment Activities, and other illegal activities by verifying that the information we collect about you is true and accurate, such as for reference checks.
• Legal, regulatory, safety and compliance purposes – We use your information to comply with laws or regulations, respond to regulatory, court, or government authority requests when necessary for enforcement or protection against harm, submit reports as required by law, resolve legal disputes, and review compliance with applicable usage terms, such as work eligibility in the country of employment.
• Other purposes – If we need to use your personal information for other purposes not described above, we will notify you in advance and ask for your consent.

How We Disclose Information

We disclose your personal information to outside parties as required by law and as part of our business practices, as described below.

New Owner and Other Corporate Transactions

We provide your information to our affiliates. We may also transfer your personal information to a party unaffiliated with Vercel as part of a merger, acquisition, or sale of all or a portion of our assets.

Third-Party Service Providers

We work with service providers, such as skills evaluation providers, software providers, recruiting agencies, background check providers, advisors, and consultants to help us with our Recruitment Activities. Under contract with Vercel, these third parties are authorized to use your personal information only as necessary to provide these services or perform them on our behalf.

We do not sell or share your personal information to third parties as defined by applicable data protection laws.

We require third-party service providers acting on our behalf or with whom we disclose your personal information to provide appropriate security measures in accordance with industry standards and in compliance with contractual obligations, their privacy and security obligations, and any other appropriate confidentiality and security measures. However, we are not responsible for the privacy and data security practices of third parties outside of the personal information we transfer to them.

Certain third-party service provider services used by you may have separate terms and privacy notices that are independent of this Notice. We recommend carefully reviewing the terms and privacy notices of each third-party service, website, and/or application prior to use.

Public Authorities, Officials, or Others

We disclose your personal information when disclosure is:

• Reasonably necessary to comply with any applicable law, regulation, subpoena, legal process, or enforceable governmental request;
• Necessary to enforce this Notice;
• Required to enforce our contractual obligations, including investigation of potential violations; or
• Necessary to protect against harm to the rights, property, or safety of Vercel, you, or the public as required or permitted by law.

Categories of Personal Information Collected and Disclosed

The table below describes the categories of information we have disclosed to third parties for business purposes in the last twelve months.

Legal Bases for Processing

If you are an individual from the United Kingdom (“UK”), European Economic Area (“EEA”), or Switzerland, we collect, use, and store your personal information only where we have a legal basis for doing so under applicable laws. The legal basis depends on Vercel’s relationship with you and how you choose to interact with us. This means that we collect and use your personal information only:

• To fulfill our contractual obligations to you, to the extent such obligations arise in connection with our Recruitment Activities;
• On the basis of our legitimate interests in operating our business, including improving and developing our Recruitment Activities, for fraud prevention purposes, and improving your experience;
• On the basis of your consent, such as collecting your personal information related to a position for which you are interested in applying; or
• As otherwise in compliance with law such as mandatory record keeping obligations.

When we receive your personal information in the context of a contractual relationship, we will process it only to the extent that we must do so in order to carry out the contract. It will be necessary for us to process your personal information for the purposes of executing a contract if we would not be able to fulfill our contractual obligations without engaging in such processing.

When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis, and you have the right to object to processing on this basis. To do so, please contact us using the email address in the “Contact Us” section below.

If we process your personal information based on your consent, the purpose of the processing can be found in the declaration of consent.

In similar fashion, we often need to process certain personal information in order to meet our legal obligations.

If you have any questions about the relevant legal basis for processing, please refer to “Your Privacy Choices and Rights” or contact us using the email address in the “Contact Us” section below.

International Transfers

If you provide us with your personal information, we may transfer your personal information to other countries. These countries may not have equivalent privacy and data protection laws to the laws of your country. To the extent required by law, we will take measures to protect the cross-border transfer of your information.

Some of the entities we send your personal information to are located outside of the European Economic Area and the United Kingdom (“UK”). The European Commission (and the UK Secretary of State) have determined that the data protection laws of some countries provide a level of protection equivalent to EU or UK law. You can see here the list of countries that the European Commission has recognized as providing an adequate level of protection to personal data.

When the GDPR applies to the processing of your personal information, we will only transfer it out of the European Economic Area or the UK to countries that have not been recognized as providing an adequate level of protection to personal information by using appropriate transfer mechanisms such as certification to the Data Privacy Framework or the European Commission approved standard contractual data protection clauses under Article 46.2 of the GDPR.

Data Privacy Framework

Vercel complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce (collectively, the “Data Privacy Framework”). Vercel has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal information received from the European Union and the United Kingdom in reliance on the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework. Vercel has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (together with the EU-U.S. Data Privacy Framework Principles, the “Principles”) with regard to the processing of personal information received from Switzerland in reliance on the Swiss-U.S. Data Privacy Framework. If there is any conflict between the terms in this Notice and the Principles, the Principles shall govern. To learn more about the Data Privacy Framework Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

In compliance with the Data Privacy Framework, Vercel commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the Data Privacy Framework in the context of the employment relationship.

For transfers of personal information to a third party acting as a controller, Vercel complies with the Data Privacy Framework Notice Principle and Choice Principle. For onward transfers, Vercel is responsible for the processing of personal information it receives under the Principles and subsequently transfers to a third party acting as an agent on its behalf. Vercel remains liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless Vercel proves that it is not responsible for the event giving rise to the damage.

The Federal Trade Commission has jurisdiction over Vercel’s compliance with the Data Privacy Framework.

In compliance with the Data Privacy Framework, Vercel is obligated to arbitrate claims and follow the terms as set forth in Annex I of the Principles. Job applicants have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding Data Privacy Framework compliance not resolved by any of the other Data Privacy Framework mechanisms. For additional information see Annex I.

How We Store and Protect Information

We retain your personal information for as long as necessary for us to perform our Recruitment Activities, comply with legal obligations, resolve disputes, enforce rights, or as necessary for our business purposes, such as updating you on future opportunities or answering any queries in connection with your application.

We use reasonable and appropriate physical, technical, and administrative safeguards designed to protect your information from unauthorized use, access, loss, misuse, alteration, or destruction. We also require that third-party service providers acting on our behalf or with whom we share your information also provide certain security measures under industry standards.

Although we have security safeguards in place to protect your information, we cannot guarantee absolute security in all situations. If you have questions about our information security practices, please contact us using the email address in the “Contact Us” section below.

Your Privacy Choices and Rights

Changes to This Notice

This Notice may be modified at any time and for any reason. You can determine when this Notice was last revised by referring to the “Updated” date at the top of this Notice. We encourage you to review the Notice whenever you interact with our Recruitment Activities to stay informed about our privacy practices and the ways that you can help protect your privacy.

If we make significant changes to this Notice, we will notify you through our websites or via the email address associated with your application. If you do not agree with the privacy practices disclosed in the Notice, we recommend you stop engaging in our Recruitment Activities.

Contact Us

If you have questions or concerns about this Notice, please contact us at privacy@vercel.com.

Appendix A — Supplemental Notice for Job Applicants in Japan

This Appendix applies to job applicants in Japan and to personal information subject to Japan’s Act on the Protection of Personal Information (“APPI”). To the extent this Appendix conflicts with the main Notice, this Appendix controls.