Job Candidates Privacy Notice

1. Introduction

This privacy notice (“Notice”) describes how Gong.io Ltd. and its affiliates (“Company”, “Gong”, “we”, “us” and “our”) collects, uses, discloses, and otherwise process personal data about its job candidates and applicants who apply or are recruited for a job with us (“candidates”, “you”).

Gong is a global company with offices in the US, Ireland and Israel. While this Notice is intended to describe the broadest range of our data practices globally, those practices may vary based on the local legal requirements. For example, the laws of a particular country may limit the types of personal data we can collect or the manner in which we may process it. In such instances, we adjust our internal policies and practices to reflect such local requirements.

This Notice does not create or form part of any contract for employment. You are not required to provide us with any personal data, but without it, we will not be able to process your application.

If you have questions about this Notice, or otherwise about our privacy and data protection practices, please contact our Data Protection Officer at HRprivacy@gong.io.

2. Data we collect about you

2.1 Categories of personal data

The categories of personal data we may collect, store and use in connection with your application for work with us include (the purposes for which we process this are set out at paragraph 3.1 below):

Identity and contact information, such as your name, gender, date of birth, nationality, ethnicity (US only), contact details (e.g., telephone number, e-mail address and home address) and copies of documentation proving your identity and right to work (e.g., passport, visa, ID card or driving license).
Information from your job application or recruiters, such as your resume or CV, cover letter, employment and professional history, military and reserves status, your previously held directorships (if any), references, education details, desired position and compensation, location preferences and willingness to relocate, and other information reasonably necessary to process your application and candidacy.
Professional qualifications, such as licenses, permits, memberships, certifications, and other documents verifying your knowledge, skills and experience.
Nationality and immigration status and other information such as residency and work permit status, that would allow us to verify your employment eligibility;
Information you make publicly available through job search, social media, career networking sites or other public websites.
Information from the application process, including, but not limited to, any interviews; call and video recordings; transcriptions (both manual and automated); summary analyses thereof; evaluations; and outcomes of recruiting exercises, including recordings thereof (subject to your consent in accordance with paragraph ‎7 below).
Any other information you provide to us.

We may also collect, store and use the following types of more sensitive personal data (the purposes for which we process this are set out at paragraph 3.2 below):

Background check information, such as information necessary to complete background, credit, drug/alcohol and/or other checks, only where permitted by law, and information received during these checks;
Information provided in connection with accommodation requests, regarding potential disabilities or other health conditions, religious or philosophical beliefs, and/or sexual orientation; and

Providing some of the personal data listed above is voluntary (e.g., information about your ethnicity, health conditions, religious beliefs, and sexual orientation). In relation to other information that is important for our consideration of your application (such as evidence of qualifications or work history), we will not be able to process your application successfully if you do not provide that information.

For the purposes of the California Consumer Privacy Act (“CCPA”), in the last 12 months, we may have collected the following categories of Personal Information (as defined in the CCPA): identifiers; customer record information protected characteristics; internet or other electronic network activity information; professional or employment-related information; education information; geolocation data; inferences; audio, electronic, and visual information; and Sensitive Personal Information (as defined in the CCPA), for the business purposes described below.

2.2 Sources of personal data

We collect personal data from you when you apply for a job and throughout the job application or recruitment process including interviews;  including call and video recordings, transcriptions (both manual and automated), and summary analyses thereof. We may also collect your personal data from other sources and combine it with the personal data you provide us. For example, we may collect your personal data from job board and professional networking websites, your named referees, other Gong personnel, background check providers, employment agencies and recruiters, and publicly accessible sources, and through our websites and third-party service providers (please see our Privacy Policy for more details).

3. How we use personal data about you

3.1 Purposes for which we use your personal data

We may use the personal data we collect about you for the following business purposes:

Recruitment management. Managing recruitment generally, such as:
processing job applications submitted through the careers website we maintain at https://www.gong.io/careers/ or any other site or source from which we receive such applications (“Careers Site”);
assessing your skills, qualifications, and suitability for the job role. Please note that any decision regarding your suitability for the role will be made solely by individuals within Gong and not by an AI tool or any other automated process;
conducting background checks and other pre-employment screening (where applicable);
maintaining consistent practices and procedures with respect to the collection, use, disclosure, transfer and processing of HR-related personal data across Gong;
recruitment of personnel across Gong;
analyzing and improving our application, recruitment and HR processes;
communicating with you regarding the recruitment process, existing opportunities with the Company or about the Careers Site and any changes to applicable terms or policies;
to maintain contact with you in the future and notify you of relevant job vacancies with Gong that you might be interested in. Please note that if you do not want us to retain your information, or want us to update it at any stage, please contact us using the contact details at paragraph 9 of this Notice; and
other business operations related to your candidacy.

This processing is necessary for our legitimate interests, such as:

in order to contact you in relation to your application and the recruitment process;
in order to decide whether to appoint you to the role, as it would be beneficial to our business to appoint someone to that role;
in order to effectively verify your information;
in order to effectively and efficiently assess, administer and manage the operation of our business; and
in order to take a consistent approach to the recruitment of personnel to Gong worldwide.

We also need to process your personal data to decide whether to enter into a contract with you.

Compliance, safety and fraud prevention, such as:
complying with or monitoring compliance with legal and other requirements including complying with law enforcement;
complying with internal policies and procedures;
protecting our, your or others’ rights, health, safety and property; and
investigating and deterring against fraudulent, harmful, unauthorized, unethical or illegal activity, or conduct in violation of our policies or procedures.

This processing is usually necessary for our legitimate interests, the legitimate interests of external agencies and for compliance with our legal obligations.

Analytics. Creating anonymous, aggregated or de-identified data that we use and share to analyze and improve our HR, application and recruitment activities, which is in our legitimate business interests.

How we use sensitive personal data

We may use your sensitive personal data in the following ways:

We may use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview. We need to do this in order to comply with legal requirements, or in support of your legitimate interests.
If the processing is necessary for carrying out obligations and specific rights of Gong in the field of employment law, social security or social protection law (including obligations in relation to public health, health and safety and disability discrimination, the legality of personnel working in a particular jurisdiction, which will involve processing data in relation to nationality, work permits and visas and vetting (where necessary)).
We may use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
We may use information about your health or travel to conduct health screenings in order to protect the health and safety of our personnel and visitors to our premises and to comply with our legal obligations,  government guidelines, and public health advice to prevent the spread of disease, as well as results of medical examinations that are required by the law.
If the processing is necessary to protect the vital interests of you or another person where you are physically or legally incapable of giving consent.
In connection with, any actual or prospective legal proceedings, for the purpose of obtaining legal advice or otherwise for the purposes of establishing, exercising or defending legal rights subject to applicable local legislation or where courts are acting in their judicial capacity.
As otherwise permitted by law.

3.2 Sharing personal data

We may share your personal data with other parties as necessary for the purposes described above. For example, we may share your personal data with:

Affiliates. Our corporate parent, subsidiaries, and other affiliates under the control of our corporate parent, for purposes consistent with this Notice or to operate shared infrastructure, systems and technology.
Service providers. Companies that provide us with services that help us manage the recruiting process and operate our business, such as job boards, recruiters, interviewing and testing, pre-employment screening, interview travel booking and expense reimbursement (where applicable), relocation (where applicable); call and video recordings, transcriptions, and summary analyses thereof; recruitment analytics and software providers. We may also use certain AI tools in order to automate some of the process (e.g., AI auto-transcription products).
Law enforcement, government bodies, regulators and other parties for legal reasons. We may share your personal data with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or safety of Gong, our personnel or others.
Business transfers. Parties to transactions and potential transactions whereby we sell, transfer or otherwise share some or all of our business or assets, including your personal data, such as a merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.
Professional advisors. Lawyers, immigration advisors, and other outside professional advisors.

For the purposes of the CCPA, in the past 12 months, we may have disclosed identifiers; customer record information; protected characteristics; internet or other electronic network activity information; professional or employment-related information; education information; geolocation data; inferences; audio, electronic, or visual, information; and Sensitive Personal Information (as defined in the CCPA) to affiliates; service providers; for legal reasons; or to professional advisors. We do so in pursuit of the business purposes described in Section 3.1 above.

We do not sell your personal information nor do we share it with third parties for cross-contextual behavioral advertising purposes. We do not currently use or disclose Sensitive Personal Information outside of the purposes allowed by the CCPA.

4. Where we store your personal data

Your personal data may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have business operations. These international transfers of your personal data will be made pursuant to appropriate safeguards, including (where appropriate) standard data protection clauses adopted by the European Union, or the United Kingdom, and such other appropriate lawful mechanisms and contractual terms providing adequate protection. If you wish to enquire further about the safeguards we use, please contact the Data Protection Officer at HRprivacy@gong.io.

Gong.io Inc., our US subsidiary, complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF)as set forth by the U.S. Department of Commerce and will be further liable in cases of onward transfers of your personal data to third parties (including our Service Providers).

Gong.io Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) regarding the processing of personal data received from the European Union in reliance on the EU-U.S. DPF.

If there is any conflict between the terms in this notice and the EU-U.S. DPF Principles, the Principles shall govern for personal data transferred under the DPF. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

5. How long we retain your personal data for

We will retain your personal data for no longer than necessary to fulfil the purposes we collected your personal data for and in accordance with our legal obligations and legitimate business interests. We may retain your personal data so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and lawful way. Call recordings of job interviews will be retained for two (2) years, unless you request us to delete them sooner. However, if you become an employee of the Company, we may keep these recordings for a longer period for statistical analysis purposes. After this period, we will securely destroy your personal data in accordance with our data retention policy. In some instances, we may retain your information to consider you for other roles and future opportunities at the Company which may be of interest to you. If you do not want us to retain your information, or want us to update it at any stage, please contact us in accordance with paragraph 8 of this Notice. Note that, except as required by applicable law, we will not be obligated to retain your data for any particular period, and are free to securely delete it for any reason and at any time.

6. How we secure personal data

In order to protect your personal data held with us and our service providers, we are using physical, procedural and electronic security measures, including encryption, where deemed appropriate, designed to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. While we strive to implement measures that secure your data, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties.

7. Your rights in your personal data

7.1 Exercising your Rights. Under certain data protection and privacy laws, individuals have certain rights in relation to their personal data. Subject to certain restrictions, you can exercise these rights in relation to your personal data that is processed by us, each to the extent available to you under the laws that apply to you:

The right to be informed about the processing of your personal data;
The right to access your personal data;
The right to rectification of your personal data;
The right to erasure of your personal data;
The right to data portability;
The right to object to processing of your personal data;
The right to restrict processing of your personal data;
The right to lodge a complaint with your national data protection authority;
Rights in relation to automated decision making, including profiling;
Right to opt-out of the sale or sharing of your personal information;
Right to limit use and disclosure of sensitive personal information;
Right not to be subject to discrimination for the exercise of your privacy rights.

If you wish to exercise your rights under applicable law please contact our Data Protection Officer at HRprivacy@gong.io.

7.2 Data Subject Authentication. Please note that we may require additional information, including certain personal data, in order to authenticate and process your request. Such additional information may be then retained by us for legal purposes (e.g., as proof of the identity of the person submitting the request), in accordance with paragraph ‎5 above. We may redact from the data which we will make available to you, any personal data related to others. You may also designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. The authorized agent may submit a request to exercise these rights by emailing us.

7.3 Data Subject Request Refusal. Please also note that such rights are not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to accommodate requests to exercise data subject rights, with respect to some or all of the personal data that we hold about you. In the event that we cannot or will not accommodate your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

7.4. Complaints about transfers of personal data from the EU to the US: In compliance with the EU-U.S. DPF, Gong.io Inc. commits to resolve complaints about our collection or use of your personal data. EEA individuals with inquires or complaints regarding our Data Privacy Framework compliance should submit inquiries to HRprivacy@gong.io. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF principles-related complaint to your satisfaction, Gong.io Inc. further commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs)with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF in the context of the prospective employment relationship.

Please note that under certain conditions (as described under the DPF Principles Gong.io Inc. adheres to), you can invoke a binding arbitration by delivering a notice to Gong.io Inc. via HRprivacy@gong.io. Please also note that Gong.io Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

8. Consent

8.1 We are not required to obtain your consent for most of the processing activities that we undertake in respect of your personal data other than for the reasons set out below, or in other limited circumstances for some uses of certain personal data. If we need your consent, we will notify you of the personal data we intend to use and how we intend to use it.

8.2 Notwithstanding the above, if you reside in a territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for the processing of personal data as described herein, your application for a job at Gong will be deemed as your consent to the processing of your personal data for all purposes detailed in this Notice. If you wish to revoke such consent, you may do so at any time by contacting us at email HRprivacy@gong.io.

8.3 We would like to record any job interview(s) or sessions which may take place between you and Gong via video or telephone conference, or in person, and share those interview recordings with relevant Gong personnel and/or advisors. Such recordings will include any personal data which is shared at such interviews, as well as your voice and imagery as captured in the recording.

The purpose of this is to:

enable us to consider the recording(s) of your interview(s) further as part of the recruitment process;
share the recording(s) of your interview(s) with certain people within Gong who will be responsible for helping us make hiring decisions, for example, HR and management personnel;
Use analytics tools (such as AI auto-transcription products) in order to better transcribe, summarize, and gain insights from our conversations, so that our specialists, for example, can be more focused on you as opposed to taking notes (note that no automated decisions regarding your application process will be made by any AI tool);
refer to your interview(s) in the future, whether your application was successful or not, in order for us to compare and consider future applicants against your application and provide internal recruitment and hiring training to our personnel.

8.4 We will ask you for your consent in order to record and process your personal data for the purposes set out in paragraph ‎8 above. If you do not provide your consent to us processing your personal data for such purposes, this will not have an impact on our consideration of your job application to us. You will never be obliged to give us consent.

8.5 Where you have given us consent to collect, use or disclose your personal data in a certain way, you may withdraw your consent at any time. If you wish to withdraw any consent that you have given us, please contact our Data Protection Officer at HRprivacy@gong.io.

9. Other information about this Notice

9.1 Third parties

This Notice does not address, and we are not responsible for, the practices of any third parties, which have their own rules for how they collect and use your personal data. Our links to third party websites or services are not endorsements.

9.2 Changes to this Notice

We may update this Notice from time to time. The “Last updated” heading at the bottom of this Notice indicates when we changed this Notice in a material way. Any changes will become effective when we post the revised notice on our Careers Site.

9.3 Data Protection Officer

We have appointed a Data Protection Officer to monitor and advise on our ongoing privacy compliance, and to serve as a point of contact on privacy matters for data subjects and supervisory authorities. If you have any questions about this Notice or how we handle your personal data, please contact our Data Protection Officer at HRprivacy@gong.io.

9.4 EU and UK Representative

Maetzler Rechtsanwalts GmbH & Co KG (Prighter) has been designated as Gong’s representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. Prighter Ltd has been designated as Gong’s representative in the United Kingdom for data protection matters pursuant to Article 27 of the UK GDPR. Inquiries regarding our EU & UK privacy practices may be sent by e-mail to HRprivacy@gong.io or via mail. To make an inquiry by mail, please visit the following page: https://prighter.com/q/18226468565.

Last updated: March 2024