Stripe takes data privacy seriously. We ensure the highest level of protection and diligence around collecting, using and retaining the Personal Data of all applicants applying for a position at Stripe. Bottom line: we care about your Personal Data and want you to be informed about how it’s collected, used and retained. This EU Applicant Personal Information Notice (“Notice”) is intended to provide you – EU-based applicants – with that information.
This Notice applies to the Personal Data (as defined below) collected about EU individuals who apply to work with a Stripe company, which includes Stripe Payments Europe Limited,. and any subsidiaries (collectively, “Stripe”). The controller of your Personal Data is Stripe Payments Europe Limited.
If you have any questions about this Notice or your Personal Data, please reach out to email@example.com.
2. What Personal Data is collected?
Personal Data is any information that relates to an identified or identifiable individual. We collect and use the following information about you, to the extent provided by you and permitted under applicable law:
- Contact information (such as name, address, email address, and phone number);
- Experience information (such as education, skills, work experience and/or CVs, photograph, references, employee records and appraisals);
- Demographic information (such as age, date of birth, gender),
- Psychometric and ability test results;
- Interview records;
- Data from public profiles; and
- Other information necessary for making a recruitment decision or otherwise voluntarily provided by you.
If you are an applicant in Germany, the special categories of Personal Data that may be collected and used about you include only information on whether you are (i) physically or mentally fit for your role; (ii) the commission or alleged commission by you of any offence, and (iii) any proceedings for any offence committed or alleged to have been committed by you, the disposal of those proceedings or the sentence of any court in those proceedings to the extent relevant for your role.
Special categories of Personal Data will only be collected and used in so far as such is necessary for the purposes of carrying out an obligation under applicable law or when the use is authorized by European Union or Member State law, providing appropriate safeguards for the rights and freedoms of applicants.
3. How and why is my Personal Data used?
Stripe collects and uses Personal Data for reasons related to your application, and always in accordance with applicable data protection laws. Specifically, we collect and use Personal Data
- to take steps to assess your suitability for the vacancy prior to entering into an employment contract (necessity for hiring decisions);
- to comply with a legal obligation;
- to serve Stripe’s legitimate interests (or the interests of a third party) if your interests and fundamental rights don’t override those interests, i.e., Stripe’s interests to hire qualified and appropriate people, to find the right candidate for future vacancies and to secure, defend and develop its business.
In certain narrow circumstances, Stripe processes Personal Data with your voluntarily and freely given and explicit consent.
This chart gives some more detail:
|To administer and manage your application process.||
|To assess your skills, qualifications and your suitability for our career opportunities.||
|To take measures to verify that the information you have provided is true and accurate, e.g. by means of reference checks.||
|To conduct (criminal) background checks to the extent applicable law permits and as required for your role.||
|To keep your record for future hiring needs, including for the purpose of communicating with you and providing you with information regarding potential career opportunities that suit your profile.||
|To deal with legal disputes and to establish, exercise and defend (potential) legal claims.||
|To comply with applicable (employment) laws and regulations.||
The Personal Data requested in the application process is required by Stripe to assess your application for employment. If you do not provide some or all of this Personal Data, it may affect our ability to process your application and therefore to enter into an employment agreement with you.
4. Does Stripe retain my Personal Data?
Yes, but only as long as necessary to satisfy the purpose for which it was collected and used, unless a longer period is needed because of legal obligations or to defend a legal claim. If we wish to retain your Personal Data for a further job opportunity, we will inform you following the closure of the recruitment process. If you do not wish Stripe to use your Personal Data to consider you for potential future roles, please let us know by reaching out to us at firstname.lastname@example.org. If you object to future processing, we will delete your Personal Data. In certain cases, legal or regulatory obligations require us to retain specific records for a set period of time.
If you accept employment with Stripe, your Personal Data will be held on the basis set out in our EU Personal Information Notice, which is provided to all employees. This will generally be for the duration of your employment relationship plus any applicable statutory retention periods.
5. What security is in place to protect my Personal Data?
Stripe takes technical, physical, and organizational measures to ensure that your Personal Data is properly secured against unauthorised or unlawful use, alteration, unauthorised access or disclosure, accidental or wrongful destruction, and loss.
Stripe also takes steps to limit access to your Personal Data to those persons who need to fulfill the purposes listed in the chart above. And, we contractually ensure that any third parties are processing your Personal Data in a secure way that provides for confidentiality and integrity of your Personal Data.
6. How is my Personal Data disclosed and transferred?
Stripe shares your Personal Data only on a need to know basis, only for the reasons listed above, and only with individuals in certain roles who need access to this information (both in the country where you work and in other countries where we have operations, including countries outside the European Economic Area (“EEA”)).
Stripe also shares your Personal Data with service providers who process data on Stripe’s behalf; these service providers include: recruiting and HR tools, and successors in title.Most of these service providers are located in the EU and the United States of America. Stripe may also need to share Personal Data with government authorities (e.g. regulatory authorities, enforcement authorities, and other governmental agencies, including taxing authorities.
Stripe takes measures to ensure that your Personal Data is shared and treated securely, in accordance with this Notice and applicable legislation. And we didn’t stop within the EEA – any transfer of your Personal Data outside of the EEA will be covered by contractual agreements with the recipients of the data, including Standard Contractual Clauses, as approved by the European Commission, or equivalent means.
You can request a copy of any documentation showing the data transfer safeguards that have been taken by making a request to email@example.com.
7. What are my rights?
Subject to some legal conditions, you have the following rights related to the processing of your Personal Data:
- Right to access, correct and delete your Personal Data. Stripe will ensure that all Personal Data is correct, but we can only do so if you give us correct information. So, it’s your responsibility to notify Stripe of any changes in personal circumstances (for example, change of contact details) as soon as possible. You may request access to your Personal Data and request correction of any inaccurate Personal Data. You may also request deletion of any irrelevant Personal Data.
- Right to withdraw consent. If your Personal Data is processed on the basis of your consent, you may withdraw consent at any time by sending an email to firstname.lastname@example.org. This will not affect the lawfulness of processing that was based on consent before its withdrawal.
- Data portability. To the extent Stripe uses your Personal Data for the preparation of or performance of the employment/engagement contract or on the basis of your consent, and that Personal Data is processed by automatic means, you have the right to receive it in a structured, commonly used and machine-readable format. You can also requests for it to be transmitted to another data controller, if technically feasible and required.
- Right to restrict Personal Data use. You may restrict Stripe’s use of your Personal Data if you contest the accuracy or legitimate legal basis of the use and you don’t want Stripe to erase the Personal Data. You may also request restriction of Personal Data use if Stripe no longer needs the Personal Data for the relevant purposes, but you require it for the establishment, exercise or defense of legal claims; or if you have objected to Stripe’s Personal Data use justified on legitimate interests pending verification as to whether Stripe has compelling interests to continue use.
- Right to object. To the extent that Stripe is relying on its legitimate interests to use your Personal Data, you may object to the use, and Stripe will stop processing unless Stripe demonstrates either compelling legitimate grounds for the use that override your interests, rights and freedoms or where Stripe needs to process the Personal Data for the establishment, exercise or defense of legal claims.
- Digital Legacy - If you are an applicant in France, you also may issue directives relating to the disposition of your Personal Data after your death.
- Lodge a complaint. You may lodge a complaint with a supervisory authority in your country of residence if you believe the collection and use of your Personal Data infringes this Notice or applicable law.
8. Who should I contact with questions?
For further information regarding your rights or have questions about the use of your Personal Data, please contact email@example.com.
For applicants based in Germany, you can also reach out to our data protection officer at firstname.lastname@example.org.
If you require a German or French translation of this policy, please contact email@example.com.