Legal Stuff

1. Introduction, definitions and scope

This Recruitment Privacy Notice (“Notice”) focuses on the recruitment and/or hiring process and explains the type of information HubSpot (“we”, “us” “our”) processes, why we are processing it and how that processing may affect you. This notice applies to individuals who apply to open positions with us, who we contact for or express interest in employment with us, or who undergo an interview or assessment with us (“Candidate”). This notice also applies to individuals in contingent and non-permanent positions, such as agents, independent contractors, consultants, temporary contract workers, professional advisors, and interns. This notice describes the rights that you may have in relation to the personal data that we process about you. It does not apply to individuals who interact with other HubSpot content and are subject to our Privacy Policy or employees, who are subject to our Workplace Privacy Policy.

If you are unable to access this Recruiting Privacy Notice due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access.

As used in this notice:

"Personal Data" means any information relating to an identified or identifiable individual. "Processing" means doing anything with personal data.  For example, it includes collecting it, holding it, disclosing it or deleting it. The terms “Process”, “Processes”, and “Processed” will be construed accordingly. 

“Sensitive Information” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sexual orientation, sex life, trade union membership, genetic and biometric data, and other personal data subject to special protection and considered by applicable data protection law to be "sensitive information".

Your personal data:
We process your personal data for the purposes of fulfilling our recruitment practices.  Most of the personal data that we process about you comes from you. For example, you tell us your contact details, like your first and last name, email address, and phone number. Other personal data about you is generated from references and third party companies such as recruitment agencies, and information about you that is available on the internet, such as from Facebook, LinkedIn, Twitter and Google. Your personal data will be seen internally by managers, administrators and HR. We may also share your data with external law firms for assessment of employment permits and visa options.

We may process the following types of personal data about you:

•  identification and contact details (such as your name, address, telephone/email address and other contact information);
• educational and employment background (such as academic/professional qualifications, job qualifications, education, CV/résumé, transcripts and employment references);
• job application information (such as the roles for which you are applying, your job application and related documentation/communications, cover letters, information from interviews and phone screenings, compensation/benefits requests, office and relocation information);
• national identifiers (such as national ID/passport, immigration status, work authorizations, visas, social security numbers);
• race/ethnicity information in certain jurisdictions or gender identity information (this is optional and is anonymized);
• inferences about you (which could include assessments or conclusions made about your qualifications based on data collected during the application process or from other sources);
• previous applications/roles (information relating to previous applications you have made to us and/or any previous employment history at HubSpot); and
• other personal data, in instances when you interact with us online, by phone or mail in the context of receiving help through our help desks or other support channels, if applicable. 

2. Retention of your personal data

(a) If you are offered and accept a role at HubSpot, the personal data collected during the recruitment process will be kept on your personnel/employee file in accordance with our Workplace Privacy Notice.  

(b) If you are unsuccessful in your application, we retain the personal data that you provided to us to comply with the law and for a reasonable period of time where we have an ongoing legitimate business need to do so. When we have no ongoing legitimate business need to process your personal data, we securely delete the information or anonymise it or, if this is not possible, then we will securely store your personal data and isolate it from any further processing until deletion is possible. Generally, this means your personal data will be kept for the duration of the application process plus a reasonable period of time after confirmation that your application was unsuccessful to consider you for future job opportunities that may become available. If you do not wish to be considered for future opportunities or would like to delete this information from the servers at an earlier date, you can request to do so as described below in Section 6.

3. International Transfers 

(a) As a global organization headquartered in Cambridge, Massachusetts in the United States, we also have offices, affiliates, subsidiaries, and employees located around the world. Therefore, in connection with our business and for employment, administrative, management and legal purposes, we may transfer your personal data outside of your country of residence which may include transfers outside the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”) to members of our group and to service providers or sub-processors Where necessary, these transfers are covered by an agreement ensuring appropriate and suitable safeguards with our group members. 

(b) We rely upon the Standard Contractual Clauses (approved by the European Commission and Swiss authorities) and UK Addendum to the Standard Contractual Clauses (approved by the UK authorities), as well as additional safeguards where appropriate. We may also utilize addendums and other data transfer agreements specific to certain countries as required. If you have further questions, please contact HubSpot by emailing privacy@hubspot.com. 

4. Purpose and legal grounds for processing personal data

(a) What are the grounds for processing? Under applicable data protection law, there are various grounds on which we can rely when processing your personal data. In some contexts more than one ground applies. These include but are not limited to Legal Obligation, Legitimate Interests, Contract and Consent as outlined in examples below:

(b) Processing sensitive information: 

During the recruitment process, we try not to collect or process any Sensitive Information unless authorized by law or where necessary to comply with applicable laws. If we process sensitive information about you, as well as ensuring that one of the grounds for processing mentioned above applies,we will make sure that one of the grounds for processing sensitive information applies, including (for example) that the processing is for equality and diversity purposes to the extent permitted by law.

5. Candidate personal data we collect and our purposes

Examples of the data and the grounds on which we process data are explained below.  

Who gets to see your data?

Your personal data may be disclosed to managers, HR and administrators for employment, administrative and management purposes as mentioned in this document. We may also share your data with service providers, such as platform providers; law enforcement, government agencies and other recipients for legal, security and safety purposes; external law firms or other professional advisors for assessment of employment matters, permits, and visa options; or in connection with a corporate transaction.  

6. Access to your personal data and other rights

Your Data Subject Rights: You may have certain rights in relation to your personal data. We will honor these rights to the extent required by law. You can request access, correction, updates, deletion, restriction of processing of your personal data or you may object to the processing of your personal data.

If you make a request, please note that to protect personal data, we may verify your identity by a method appropriate to the type of request you are making.  

If you exercise the right of an access request, and we hold personal data about you, we are required to provide you with information on it, including a description and copy of the personal data and an explanation of why we are processing it. You may also have the right to be given your data in a machine readable format for transmitting to another data controller though this right is unlikely to be relevant to you in the context of our recruitment processes.

We are unlikely to rely on consent as a ground for processing.  However, if we do, you may withdraw consent at any time — though if you do so that will not affect the lawfulness of what we have done before you withdraw consent.

To exercise any of these data subject rights, please use this form (or use this URL: https://preferences.hubspot.com/privacy).  

7. California privacy rights 

Applicability

This section applies only to California candidates. For purposes of this section "Personal Information" has the meaning given in the California Consumer Privacy Act (“CCPA”). It describes how we collect, use, and share California candidates' Personal Information in our role as a prospective employer and the rights applicable to such residents. HubSpot is a business and does not sell Personal Information. We may share Personal Information with third parties if those third parties are authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Information. 

Your California rights

You have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.

The right of access means that you have the right to request that we disclose what Personal Information we have collected, used and disclosed about you in the past 12 months.

The right of deletion means that you have the right to request that we delete Personal Information collected or maintained by us, subject to certain exceptions.

The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

You also have the right to request correction of your Personal Information and limit the use and disclosure of your Sensitive Personal Information.

HubSpot does not sell Personal Information to third parties (pursuant to California Civil Code §§ 1798.100–1798.199, also known as the California Consumer Privacy Act of 2018). 

How to exercise your California rights

You can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your Personal Information, we will verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Information.

Please use the contact details below, if you would like to: 

• Access this policy in an alternate format;
• Exercise your rights;
• Learn more about your rights or our privacy practices; or
• Designate an authorized agent to make a request on your behalf.

8. Complaints

If you have questions or complaints regarding this notice, please use this form (or use this URL: https://preferences.hubspot.com/privacy).  

You have the right to complain to a data protection authority or regulator in your jurisdiction about our collection and use of your personal data.

9. Contact details

The HubSpot entity to which you applied for a job is the controller of your personal data. Please contact us by emailing privacy@hubspot.com or by postal mail at:

Data Protection Officer: 
Nicholas Knoop
HubSpot, Inc.
2 Canal Street
Cambridge, MA 02141, U.S.A.

10. Modification and status of this Notice

This notice does not form part of your contract of employment and does not create contractual rights or obligations. It may be amended by us at any time.