1. Scope and Purpose of this Notice

This Recruitment Privacy Notice ("Notice") explains what personal data HubSpot ("we," "us," "our") collects during our recruitment and hiring process, why we collect it, and your rights in connection with it.

This Notice applies to all candidates, including applicants for open positions, individuals we contact about roles, interviewees, and those in contingent or non-permanent roles such as contractors, consultants, temporary workers, and interns ("Candidate," "you"). This Notice does not apply to individuals subject to our Privacy Policy or Hubspot employees subject to our Workplace Privacy Notice.

If you are based in the European Economic Area (EEA) or the United Kingdom (UK), the HubSpot entity to which you apply for a role will be the controller of your Personal Data.

If you need additional assistance in accessing or viewing this policy, please complete the request form here and we'll be in touch to see how we may be able to assist.

As used in this Notice:

"Personal Data" means any information relating to an identified or identifiable individual.

"Processing" means doing anything with Personal Data. For example, it includes collecting it, holding it, disclosing it or deleting it. The terms “process”, “processes”, and “processed” will be construed accordingly.

“Recruiting” or "Recruitment practices” under this Notice means identifying, selecting, verifying, and vetting Candidates.

2. Personal Data we collect and process about Candidates

We process your Personal Data for the purposes of fulfilling our Recruitment practices.

2.1 We collect and process Personal Data from you when you submit your application via our recruitment system on our website or when we receive your application through other channels.

We process the following types of Personal Data about you:

• (i) identification and contact details (such as your name, gender, age, address, telephone/email address and other contact information);
• (ii) education and employment information (such as academic/professional qualifications, job qualifications, education, CV/résumé, information relating to previous applications you have made to us and/or any previous employment history at HubSpot);
• (iii) job application information (such as the roles for which you are applying, your job application and related documentation/communications, cover letters, content and information from interviews and phone screenings, compensation/benefits requests, office and relocation information);
• (iv) nationality and right to work information (such as national ID/passport, immigration status, work authorizations, visas, social security numbers);
• (v) sensitive personal information includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation and health information (if you choose to include it as part of your application), and biometric data used to uniquely identify you for verification purposes (HubSpot will only receive the result of the verification check (i.e., pass / fail)).
• (vi) communications information, in instances when you interact with us online, by phone or mail in connection with your application which may include audio and video recordings and transcripts (where you have consented to your interview being recorded).

2.2 We may also collect Personal Data indirectly, including through automated means, via our recruitment system and careers website ("IT data"). Such information includes your IP address, information about the device used to make your application and information about how you interact with our recruitment system and careers website. Some of the information we collect indirectly is captured using cookies and other tracking technologies. For further details see our Cookie Policy.

2.3 We may also receive your Personal Data from the following third-party sources:

(i) references and third party reference check companies (such as Crosschq) may provide employment references or verify work history;

(ii) third parties representing you or who have contacted you on our behalf, including recruitment agencies such as True Search and third party recruitment platforms, may provide your Personal Data to us;

(iii) background check providers may provide background check reports and other screening checks and searches relevant to the role for which you are applying (where permitted by applicable law). Such reports may include criminal records data. This information will only be requested from you or obtained from third parties at the end of the Recruitment process, once a conditional offer of employment has been made and you have accepted the position you applied for;

(iv) information about you from social media platforms that you voluntarily provide during the application process such as from Facebook, LinkedIn, Twitter and Google; and

(v) information about you from HubSpot employees who interview you or assess your application and who may provide feedback about you.

 

3. Purpose and legal grounds for processing Personal Data

3.1 What are the grounds for processing? (EEA and UK only)

If you are based in the EEA or the UK, there are various grounds on which we can rely when processing your Personal Data. In some contexts, more than one ground applies. These include but are not limited to Legal Obligation, Legitimate Interests, Contract and Consent as outlined in examples below:

3.2 Processing sensitive personal information:

If we process sensitive personal information about you, as well as ensuring that one of the legal basis for processing mentioned above applies, we will make sure that one of the legal grounds for processing sensitive information applies, including (for example) that the processing is necessary for the purposes of your or our obligations and rights in relation to employment, the processing is necessary for substantial public interests or where we have obtained your explicit consent to the processing.

 

4. Information on the Personal Data we collect and our purposes

4.1 Examples of the data and the grounds on which we process data are explained below.

4.2 AI Tools

We use AI tools to support and standardize our Recruitment process but we are not solely reliant on such tools for reviewing applications and the Recruitment process. For example, AI helps us source prospective candidates. It also helps us match your skills and experience with open roles and the initial screening of Candidate applications. We also use AI during the interview process to help us with scheduling, generating questions and answers and recording and generating transcripts and summaries. These tools help our recruiting teams assess candidates consistently and fairly. All selection and hiring decisions are made by humans. Further information about our use of AI in the Recruitment process can be found here.

 

5. Who gets to see your Personal Data?

We take care to allow access to Personal Data only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it.  

Your Personal Data may be disclosed:

• Within the HubSpot company you are applying and within the HubSpot group of companies to managers, HR and administrators for employment, administrative and management purposes as mentioned in this Notice;
• To service providers and partners: we may also share your data with service providers, such as the platform that hosts the recruitment system (Greenhouse), recruitment agencies, background check providers, our identity verification provider (CLEAR ID), AI tools providers that help us with the Recruiting process or with partners that perform business operations for us;
  
• To law enforcement, regulatory and government agencies, and other third parties for legal, security and safety purposes; including external law firms or other professional advisors for assessment of employment matters, work permits, and visa options. We may share your Personal Data with these parties if necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, your rights or the rights of any third party;
• In connection with a corporate transaction: we may share your Personal Data with a buyer or prospective buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of the whole or any part of our business as permitted by law and/or contract;

• Any other person with your consent to the disclosure.

   

6. Securing your Personal Data

We use appropriate technical and organizational measures designed to protect your Personal Data and to provide a level of security appropriate to the risk of processing your Personal Data. Specific measures include encryption, employing malware protections and implementation of other reasonable security defenses.

Whenever we permit a third party to access Personal Data, we will implement appropriate measures to ensure the information is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

 

7. International transfers of Personal Data

We are headquartered in Cambridge, Massachusetts in the United States. We also have offices in the EEA, the UK, Australia, Canada, Colombia, Japan, India and Singapore. Therefore, in connection with our business and for employment, administrative, management and legal purposes, we may transfer your Personal Data outside of the country in which you are located to members of our group as well as to our third party service providers. We will ensure that the transfer is lawful and that there are appropriate security arrangements.

For example, where we transfer EEA / UK Personal Data outside of the EEA / UK, we have entered into contractual agreements ensuring appropriate and suitable safeguards with our group members and other service providers:

• All HubSpot global entities have executed the standard contractual clauses (‘SCCs’) and the UK Addendum to the SCCs, where applicable, as approved by the European Commission and UK authorities. If you would like a copy of the SCCs please email privacy@hubspot.com.
• All HubSpot service providers that process Personal Data are subject to the same data protection, security, and confidentiality obligations, and all service providers must sign a standard data processing agreement that contains the SCCs and UK Addendum.

 

8. Retaining your Personal Data

8.1 If you are offered and accept a role at HubSpot, the Personal Data collected during the Recruitment process will be kept on your personnel/employee file in accordance with our Workplace Privacy Notice.

8.2 If you are unsuccessful in your application, we retain the Personal Data for a reasonable period of time where we have an ongoing legitimate business need to do so. When we have no ongoing legitimate business need to process your Personal Data, we securely delete the information or anonymise it or, if this is not possible, then we will securely store your Personal Data and isolate it from any further processing until deletion is possible. Generally, this means your Personal Data will be kept for the duration of the application process plus a reasonable period of time after confirmation that your application was unsuccessful to consider you for future job opportunities that may become available. If you do not wish to be considered for future opportunities or would like to us delete your Personal Data at an earlier date, you can request to do so as described in the ‘Your data protection rights’ section.

 

9. Your data protection rights

You may have certain rights in relation to your Personal Data. We will honor these rights to the extent required by law. You can request access, correction, updates, deletion, restriction of processing of your Personal Data or you may object to the processing of your Personal Data. If you are a Candidate residing in California, please refer to the ‘California’ section for information about your data privacy rights in California.

9.1 If you make a request, please note that to protect Personal Data, we may verify your identity by a method appropriate to the type of request you are making.

9.2 If you exercise the right to access your Personal Data, and we hold Personal Data about you, we are required to provide you with information on it, including a description and copy of the Personal Data and an explanation of why we are processing it. You may also have the right to be given your Personal Data in a machine readable format for transmitting to another data controller though this right is unlikely to be relevant to you in the context of our Recruitment processes.

9.3 We are unlikely to rely on consent as a ground for processing. Where and when we do, you can withdraw your consent at any time, without affecting processing already carried out.

9.4 To exercise any of your data subject rights, please use this form (or use this URL: https://preferences.hubspot.com/privacy).

 

10. California

If you are a Candidate residing in California, the following additional information applies to you. For purposes of this section, “personal information” has the same meaning defined in the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 ("CPRA") (collectively referred to as "CCPA").

10.1 Categories of Personal Information we collect

We collect, and may have collected in the past twelve (12) months, the following statutory categories of personal information as enumerated by the CCPA about you when you apply for a position with us and during the recruitment process:

• Identifiers and contact information, such as: name, e-mail address, mailing address, phone number, date of birth, social security number, passport number, driver's license or state identification card number, and online identifiers.
• Personal information categories listed in California Civil Code §1798.80(e)) not already listed above, such as your signature, physical characteristics or description.
• Protected classification characteristics under California or federal law, such as your age, gender, racial or ethnic origin, national origin, citizenship, religion, marital status, sexual orientation, disability or veteran status.
• Biometric information, such as facial recognition scans for identity verification purposes.
• Internet or network information, such as your interactions with our careers website and job advertisements.
• Geolocation data, such as your approximate location based on your IP addresses.
• Medical information, such as health information.
• Professional and employment-related information, such as your employment history, job title, CV/résumé information, professional qualifications, certifications, background reference checks and screening checks.
• Education information, such as your education history, grades, and academic qualifications.
• Audio, electronic, and visual information which may, for example, be derived from calls and video calls of job interviews, all of which may be recorded and transcribed by AI and non-AI tools. Audiovisual information may also be derived from CCTV footage in public or common areas on or near our offices and premises.
• Inferences drawn from any of the above personal information to create a summary about you, for example regarding your skills, preferences, and abilities.
• Sensitive personal information, as defined by the CCPA, such as government identifiers (including your social security, driver’s license, state identification, or passport number, if applicable), your racial or ethnic origin, religious or philosophical beliefs, or union membership.

10.2 How we use your Personal Information and to whom do we disclose such information:

The business and commercial purposes for which we collect this information are described above in the "Information on the Personal Data we process and our purposes" section of this Notice. The categories of third parties to whom we disclose the information for a business purpose are described in the "Who gets to see your Personal Data" section of this Notice. The length of time for which we retain your personal information is described above in the "Retaining your Personal Data" section of this Notice.

As discussed above in the "Information on the Personal Data we process and our purposes" section of this Notice, we use AI tools to support and standardize our Recruitment process, including during our interview process. While these AI tools help our recruiting teams screen and assess your application, no hiring decision is made by us solely on the basis of an AI tool / Automated Decision Making Tool (ADMT). All selection and hiring decisions are made by humans. Further information about our use of AI in the Recruitment process can be found here.

10.3 "Sales" and "Shares" of Personal Information

HubSpot does not "sell" or "share" to third parties, as those terms are defined by the CCPA, the above categories of employee personal information. We also do not use or disclose your sensitive personal information other than as described in this Notice or as otherwise permitted under the CCPA.

10.4 California Privacy Rights

Candidates residing in California have the following data privacy rights:

• Know and Access: You have the right to request to know the personal information we have collected about you, and to access such personal information in a portable and commonly used format. Once we receive and confirm your verifiable request, we may disclose to you:
• the categories of personal information we have collected about you.
• the categories of sources from which your personal information was collected.
• the business or commercial purposes for collecting that personal information.
• the categories of third parties to whom we have disclosed that personal information.
• the specific pieces of personal information we have collected about you.
• Correct: You have the right to request that we correct any of your personal information that we have collected from you that is inaccurate.
• Delete: You have the right to request that we delete certain personal information we have collected from you.
• Opt out of the "Sale" and "Share" of your personal information: You have the right to request that a business not "sell" or "share" your personal information with a third party, as those terms are defined under the CCPA. However, as noted above, we do not "sell" or "share" your personal information within the meaning of the CCPA.
• Limit the use and disclosure of sensitive personal information: We do not use or disclose "sensitive personal information" other than as described in the "Information on the Personal Data we process and our purposes" section of this Notice or as otherwise permitted under the CCPA.
• Non-discrimination: You have the right to not be discriminated against: the right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

10.5 How to exercise your CCPA rights:

You can make any of these requests to exercise your CCPA rights by emailing us at privacy@hubspot.com.

Please note that the rights described above are not absolute, and where an exception under applicable law applies, we may be entitled to refuse requests in whole or in part.

We will respond to verifiable requests received as required by California law. Please note that we may request certain information from you to verify your identity in order to respond to your request. In California an authorized agent may submit a rights request on your behalf. We may also request that an authorized agent verify their identity and authority to submit a rights request on your behalf.

 

11. Questions and Complaints

11.1 If you have questions or complaints relating to our processing of your Personal Data, you should raise these with the Privacy Team by contacting this form: https://preferences.hubspot.com/privacy.

11.2 You also have the right to complain to the statutory regulator in your jurisdiction. Information about the statutory regulator in the country in which you apply for a position is available as follows:

• In Ireland, the statutory regulator is the Data Protection Commission. For contact and other details ask HR, or see: https://www.dataprotection.ie/
  
• In Germany the statutory regulators may be contacted by accessing this link: https://www.datenschutz-berlin.de//
  
• In France, the statutory regulators may be contacted by accessing this link: https://www.cnil.fr/home.
  
• In the United Kingdom, the statutory regulator is the Information Commissioner's Office who can be contacted by accessing this link: https://ico.org.uk/global/contact-us/.

We have appointed a data protection officer whose role in relation to data protection includes informing and advising us and those of our employees who are involved in processing data of their obligations under data protection legislation. The contact details of the data protection officer are as follows:

Nicholas Knoop
HubSpot, Inc.
Two Canal Park
Cambridge, MA 02141, U.S.A.
privacy@hubspot.com

12. Modification and status of this Notice

This notice does not create contractual rights or obligations. It may be amended by us at any time.