AppNexus Applicant and Candidate Privacy Notice

Effective Date: May 25, 2018

Revision history: Original publication date May 23, 2018

  1. Introduction
    • AppNexus Inc. and its subsidiaries (collectively, "AppNexus") value recruitment applicants and respect and protect their privacy. This recruitment privacy notice ("Notice") sets out the basis on which AppNexus processes (i.e. uses) the personal data which you provide to us in the course of your application for employment with AppNexus.
    • While AppNexus Inc. is the primary controller of your personal data, other AppNexus subsidiaries or affiliates may process their own copies of your personal data if they are involved in the recruitment decision, consistent with the purposes set out in this Notice.
    • This Notice applies to recruitment applicants, as well as any third parties whose information you provide to us in connection with your application (for example, referees or emergency contacts).
    • This Notice does not constitute an offer for employment, or confer any contractual right on you, or place any contractual obligation on us.
  2. Speed Read and Key Shortcuts
    • AppNexus collects and uses personal details which you provide as part of the recruitment process
      The personal data AppNexus collects is used primarily for recruitment and selection. The data may be stored in system based around the world, and may be processed by third party service providers acting upon AppNexus' behalf.
      You have certain rights in your personal data, which you can exercise using the contact information below.
    • How we use your personal data – Section 4
    • Who receives your personal data – Section 7
    • Your rights – Section 10
  3. Types of Personal Data Processed
    • "Personal data" is a concept defined by data protection law, and refers to information which relates to an identified or identifiable individual.
    • The types of personal data that we process will vary depending on the role applied for, your location and the conditions attached to the role (if any). Typically, the types of personal data will include, but may not be limited to, the following:
      • Your Personal Details - for example your name, date of birth, gender, nationality, second nationality, personal contact details (e.g. home address, telephone number, e-mail), current role and salary;
      • Qualifications - qualifications, professional memberships, languages spoken, competencies and skills
      • Immigration and right to work data - including national ID number, social security or national insurance number, visa or work permit;
      • Equality and Diversity Data - where permitted under local law and provided voluntarily, data regarding race and ethnic origin;
      • Data about your application - for example interview notes, assessment results;
      • Vetting and verification information - including references, birth certificate, drivers licence, background checks (including publicly available information and public social media profiles); criminal record disclosure (where authorised by law).
      • Any other personal data which you choose to disclose to AppNexus personnel during the application or interview process, whether verbally or in written form, including in particular any other information which you disclose on a CV / résumé; and
      • Informal data including opinion data generated during the application or interview process.
  4. Legal Basis and Purposes for Processing
    • We use your personal data for a number of purposes which we have listed below.
    • When you are a citizen of or resident in the European Economic Area (the "EEA"), whenever we process your personal data, we do so on the basis of a lawful "condition" for processing.
    • In the majority of cases, the processing of your personal data will be justified on one of the following bases:
      • it is necessary for us to comply with a legal obligation to which AppNexus is subject (for example, conducting immigration and right to work checks);
      • it is in our legitimate interests as a business and our interests are not overridden by your interests, fundamental rights or freedoms (for example, grading candidates' performance in interviews, carrying out background checks to verify your identity and qualifications / experience);
      • subject to your consent (for example, our consideration of a voluntarily submitted resume/CV);
      • it is necessary in order to take steps at your request prior to entering into an employment contract with you (this applies at the post-offer stage, where we need to collect further information, or process information already collected, in order to enter into and then perform the contract of employment).
    • The processing of special categories of data will be justified by a condition listed immediately above, and normally by one of the following special exemptions:
      • it is necessary for the purposes of carrying out obligations under employment law (for example, processing of ethnicity data contained in immigration or right to work documents);
      • it is necessary for reasons of substantial public interest authorised under local law (for example, carrying out equal opportunity monitoring exercises); or
      • it is necessary for the establishment, exercise or defence of legal claims.
    • The processing of data revealing criminal convictions (i.e. in the context of vetting) will only be carried out where there is a legal authorisation to do so under either European Union or local law.
    • Generally, the purposes for which we process your personal data are to assess your suitability and aptitude for employment with AppNexus. If you do not provide some or all of this data it may affect AppNexus' ability to process your application. In some cases, it may mean that we are unable to continue with your application for employment as AppNexus will not have the personal data we believe to be necessary for the effective and efficient management of the recruitment process.
    • Your information will be used by AppNexus for the purposes of carrying out its application and recruitment process which includes:
      • Assessing your skills, qualifications and interests against our career opportunities;
      • Verifying your information and carrying out reference checks and/or conducting background checks (where applicable) if you are offered a job;
      • Communications with you about the recruitment process and/or your application(s), including, in appropriate cases, informing you of other potential career opportunities at AppNexus;
      • Creating and/or submitting reports as required under any local laws and/or regulations, where applicable;
      • Where requested by you, assisting you with obtaining an immigration visa or work permit where required;
      • Making improvements to AppNexus' application and/or recruitment process including improving diversity in recruitment practices; and/or
      • Complying with applicable laws, regulations, legal processes or enforceable governmental requests.
    • Where you provide us with your consent to do so, we will continue to process unsuccessful recruitment applications for a limited period of time to consider you for future opportunities.
    • If you are offered and accept employment with AppNexus, the information collected during the application and recruitment process will become part of your employment record.
  5. Retention of Personal Data
    • Our general approach is to only retain applicants' personal data for as long as is required to satisfy the purpose for which it was collected by us or provided by you.
    • In certain cases, legal or regulatory obligations require us to retain specific records for a set period of time, including following the end of the recruitment process.
    • In other cases, we deliberately retain records in order to resolve questions or disputes which we think may arise from time to time.
  6. Sources of Personal Data
    • Primarily the personal data we process about you is provided by you in connection with your application for employment by using one of our AppNexus careers websites or by corresponding with us directly by email or mail.
    • During the recruitment process, we may request references from third parties, for example, references from a previous employer, and we also carry out screening and vetting processes using third party sources.
  7. Disclosures of Personal Data
    • We may share your personal data with other AppNexus subsidiaries and affiliates where required in order to, for example to make decisions about your recruitment decision. Within AppNexus, your personal data can be accessed by or may be disclosed internally on a need-to-know basis to the hiring manager and any other relevant business colleagues responsible for managing or making decisions in connection with your potential employment with AppNexus.
    • We may share your personal data with other AppNexus subsidiaries and affiliates where required in order to, for example to make decisions about your recruitment decision. Within AppNexus, your personal data can be accessed by or may be disclosed internally on a need-to-know basis to the hiring manager and any other relevant business colleagues responsible for managing or making decisions in connection with your potential employment with AppNexus.
    • We may use third-party suppliers to help us provide recruitment services. These third parties may have access to or merely host your personal data, support and maintain the framework of our recruitment system, but will always do so under our instruction and subject to a contractual relationship.
    • Your personal data may be shared with certain interconnecting systems (such as HR information, payroll and benefits systems) if your application for employment with AppNexus is successful. Data contained in such systems may be accessible by providers of those systems, their associated companies and sub-contractors.
    • We may be required to disclose your personal data to third parties:
      • including tax authorities, IT administrators, lawyers, auditors, investors, consultants and other professional advisors;
      • in response to orders or requests from court, regulators, government agencies, parties to a legal proceeding or public authorities; or
      • to comply with regulatory requirements or as part of a dialogue with a regulator.
    • AppNexus expects these third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security.
  8. Cross-border Transfers
    • AppNexus is a global company, which means your personal data may be stored and processed outside of the country or region where it was originally collected including in the United States. For personal data collected in the European Economic Area, for internal transfers between AppNexus and its subsidiaries and affiliates, we have entered into an Intra-Group Data Transfer Agreement to ensure your data receives an adequate level of protection.
    • Where third parties transfer your personal data outside of the EEA, we will take steps to ensure that your personal data receives an adequate level of protection, including by, for example, entering into data transfer agreements or by ensuring that third parties are certified under appropriate data protection schemes.
    • You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards we use. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity.
  9. Security of your Personal Data
    • We implement reasonable physical, technical and administrative security standards designed to protect your personal data from loss, misuse, alteration, destruction or damage and to ensure a level of security appropriate to the risk.
    • We take steps to limit access to your personal data to those AppNexus staff who need to have access to it for one of the purposes listed above under Section 4.
  10. Data Subject Rights
    • You have the following rights in respect of your personal data, where these are applicable to the processing we carry out:
      • to obtain a copy of your personal data together with information about how and on what basis that personal data is processed;
      • to rectify inaccurate personal data (including the right to have incomplete personal data completed);
      • to erase your personal data in limited circumstances where it is no longer necessary in relation to the purposes for which it was collected or processed;
      • to restrict processing of your personal data where
        • the accuracy of the personal data is contested
        • the processing is unlawful but you object to the erasure of the personal data
        • we no longer require the personal data for the purposes for which it was collected, but it is required for the establishment, exercise or defense of a legal claim
      • to challenge processing which we have justified on the basis of a legitimate interest;
      • to object to any decisions which are based solely on automated processing;
      • to obtain a portable copy of your personal data, or to have a copy transferred to a third party controller; and
      • to obtain a copy of or access to safeguards under which your personal data is transferred outside of the EEA.
    • You also have the right to lodge a complaint with the supervisory authority.
  11. Contact

    If you have any questions about the way AppNexus uses your personal data, you can send us a message here.

    If you are located in the EEA, you can confidentially contact our Data Protection Officer here.

    You can also contact us by post using the details provided below:
    AppNexus Inc.
    Attn: Chief Privacy Counsel
    28 West 23rd Street
    Floor 4
    New York, NY 10010
    USA

    Important note:The data controller of EEA residents' personal data is AppNexus Inc.