Last Updated: January 1, 2023
1. Introduction
Drift.com, Inc (”Drift” “we” or “us“) has issued this California Privacy Notice (this “Notice“) to describe how we handle Personal Information that we collect and process about our Staff Members and job applicants who are residents of California (collectively referred to as “you”) applying for a job at, or working for Drift . The term “Staff Member” includes employees and independent contractors, including contingent workers, temporary workers, and interns.
We respect the privacy rights of individuals and are committed to handling Personal Information responsibly and in accordance with applicable law. This Notice sets out the Personal Information that we collect and process about you, the purposes of the processing and the rights that you have in connection with it. The California Privacy Rights Act of 2020 and any regulations promulgated thereunder (“CRAA”), provides California residents with specific rights regarding their Information. This Notice, which applies only to California residents, describes your rights under the CPRA, explains how you may exercise your rights, and provides an overview on the types of Personal Information we collect.
2. Types of Personal Information we collect
The CPRA defines “Personal Information” as information that identifies, relates to, describes, references, or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Data that has been de-identified, anonymized, or aggregated, or that otherwise cannot reasonably be related back to a specific person, is not considered Personal Information.
In the course of your employment or when making an application with Drift, or Drift, we may process Personal Information about you and your dependents, beneficiaries and other individuals whose Personal Information has been provided to us.
The types of Personal Information we may process include, but are not limited to:
Identification Data | name, gender, photograph, date of birth, Staff Member IDs. |
Contact details | home and business address, telephone/email addresses, emergency contact details. |
Employment details | job title/position, office location, employment contract, performance and disciplinary records, grievance procedures, sickness/time-off records |
Background information | academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law). |
Government identifiers | government issued ID/passport, immigration/visa status, or social security numbers. |
Information on your spouse/partner and/or dependents | marital status, identification and contact data about them and information relevant to any Drift benefits extended to such people. |
Financial information | bank details, tax information, withholdings, salary, benefits, expenses, company allowances, stock and equity grants |
IT information | information required to provide access to company IT systems and networks (and information collected by / through those systems) such as IP addresses, log files and login information. |
We may also process Sensitive Personal Information relating to you (and your spouse/partner and/or dependents). The CPRA’s definition of Sensitive Personal information includes social security, driver’s license, state ID, or passport number; racial or ethnic origin; union membership; biometric information; and personal information concerning health, sex life, or sexual orientation (“Sensitive Personal Information“). We do not sell Sensitive Personal Information collected under this Notice.
We may need to collect, or request on a voluntary disclosure basis (or involuntarily, if required by applicable law), some Sensitive Personal Information for employment-related purposes. For example, we may collect information about your racial/ethnic origin and gender for equal employment opportunity reporting, or information about your physical or mental condition to provide work-related accommodations, health and insurance benefits to you and your dependents, or to manage absences from work.
3. Sources of Personal Information
Generally, you will have provided the information we hold about you, but there may be situations where we collect Personal Information or Sensitive Personal Information from other sources. For example, we may collect the following:
4. Purposes for Processing Personal Information
(i) Recruitment purposes
If you are applying for a role at Drift, then we collect and use your Personal Information primarily for recruitment purposes – in particular, to determine your skills and qualifications for employment in a particular role, verify your information, to carry out reference and background checks, and to communicate with you.
If you are accepted for a role at Drift, the information collected during the recruitment process may form part of your ongoing Staff Member record.
If you are not successful, we may still keep your application for internal reporting and to allow us to consider you for other suitable for future openings with Drift.
(ii) Employment or work-related purposes
Once you become a Drift Staff Member, we may collect and use your Personal Information for the purpose of managing our employment or working relationship with you, your bank account and salary details (so we can pay you), your equity grants (for stock and benefits plans administration), if any, and details of your spouse and dependents (for emergency contact, tax and benefits purposes).
We may process our Staff Members’ Personal Information through the use of a human resources system (“HR System“), which provides tools that help us administer HR and Staff Member compensation and benefits. This will involve maintaining your Personal Information in, or transferring it to, our HR System provider’s servers in the United States.
(iii) The Drift directory
We maintain a directory of Staff Members that contains your professional contact details (such as your name, location, photo, job title and contact details). This information will be available to everyone at Drift to facilitate cooperation, communication and teamwork.
(iv) Other legitimate business purposes
We may also collect and use Personal Information when it is necessary for other legitimate purposes, such as:
Drift may use video cameras and recording equipment for its premises, offices, and facilitates, and stores information captured by this equipment, in order to secure its networks, systems, and property, and may monitor access and use of its systems using this equipment.
(v) Law-related and other purposes
We also may retain and use your Personal Information where we consider it necessary for complying with laws and regulations, including collecting and disclosing Staff Member Personal Information as required by law (e.g. for tax, health and safety, anti-discrimination and other employment laws), under judicial authorization, to protect your vital interests (or those of another person), or to exercise or defend the legal rights of the Drift global group of companies.
5. Who we share your Personal Information with
We take care to allow access to Personal Information only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate business purpose or other lawful ground for accessing it. Whenever we permit a third party to access Personal Information, we will implement appropriate measures designed to ensure the information is used in a manner consistent with this Notice.
(i) Transfers to third party service providers
We may make certain Personal Information available to third parties who provide services to us. We do so on a “need to know basis” and in accordance with applicable data privacy laws.
For example, some of this information will be made available to:
(ii) Transfers to other third parties
We may also disclose Personal Information to third parties on other lawful grounds, including:
We do not sell the Personal Information we collect from and about you.
6. Summary of Personal Information Collection, Use and Disclosure
In the past 12 months, we have collected some or all of the categories of Personal Information described in the table below, which further describes the business or commercial purpose(s) for which the Personal Information was collected and the entities to whom such information has been disclosed within the last 12 months.
Category | Examples | Purposes | Disclosed to |
Identifiers | Name, alias, postal address, unique personal identifier, online identifier, internet protocol (IP) address, device, browser, email address, account name, or other similar identifiers | Recruitment; employment or work related purposes; inclusion in the Drift Global Directory; other business purposes set forth in Section 4 of the Notice | service providers; public or governmental authorities |
Staff Member or applicant records information | Name, signature, address, telephone number, insurance policy number, education, employment, employment history, or other similar information. Some personal information included in this category may overlap with other categories | Recruitment; employment or work related purposes; inclusion in the Drift Global Directory; other business purposes set forth in Section 4 of the Notice | service providers; public or governmental authorities |
Characteristics of protected classifications under California or federal law | Age, race, national origin, citizenship, marital or familial status, medical condition, physical or mental disability, sex, veteran or military status | Recruitment; employment or work related purposes; participation in affinity or business resources groups | service providers; public or governmental authorities |
Biometric information | N/A | N/A | N/A |
Internet or other similar network activity information | Browsing history, search history | Security and fraud prevention | service providers |
Sensory data | Audio, electronic, visual, or similar information | Work related purposes (Slack/Drift Video);inclusion in the Drift Global Directory | service providers |
Professional or employment-related information | Employer, employment history, resumes and CVs, background checks, and other employment-related information | Recruitment; employment or work related purposes; other business purposes set forth in Section 4 of the Notice | service providers; public or governmental authorities |
Education information | Records maintained by an educational agency or institution that pertain to a student, such as grades and transcripts | Recruitment | service providers |
Sensitive personal information | Social security, driver’s license, state ID, or passport number; racial or ethnic origin; union membership; personal information concerning health, or sexual orientation. | Recruitment; employment or work related purposes; participation in affinity or business resources groups | service providers |
The Personal Information described in the table above is collected directly from you, or from the sources set forth in the Notice at Section 3, “Sources of Personal Information.” In addition to the parties described above, we may disclose your Personal Information to other third parties for legal, security, or safety purposes; to regulatory authorities, courts, and government agencies if required by applicable law; or with a third party in the event of any contemplated or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries, or other assets.
We never sell your Personal Information (as the term “sell” is defined under the CPRA), nor do we share it with third parties for the purposes of cross-context behavioral advertising. However, we may use de-identified, anonymized, or aggregated versions of your Personal Information for any purpose. If we do de-identify Personal Information, we shall maintain and use such information in de-identified form and will not to attempt to re-identify the information, except as permitted by the CPRA.
7. Your California privacy rights
(i) Right to Know
As a California consumer, you have the right to request that we disclose certain information to you about our collection, use, disclosure, or sale of your personal information over the past 12 months, subject to a verifiable consumer request. You have the right to request any or all of the following:
(ii) Right to Data Portability
You have the right to request a copy of Personal Information we have collected and maintained about you in the past 12 months. The CPRA allows you to request this information from us up to twice during a 12-month period. We will provide our response in a readily usable (in most cases, electronic) format.
(iii) Right to Delete
You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records unless an exception applies. We may deny your deletion request if retention of the Personal Information is:
(iv) Right to Correct
You have the right to request the correction of any Personal Information we maintain about you.
(v) Right to Limit the Use or Disclosure of Sensitive Personal Information
You have the right to limit the use or disclosure of your Sensitive Personal Information (“SPI”) if we are using your SPI beyond what is reasonable and proportionate within the context of your relationship with us as an employee or job applicant. You can make a request for us to limit the use or disclosure of your SPI by emailing us at legal@drift.com.
(vi) Right to Nondiscrimination
You have the right not to receive discriminatory treatment by us for the exercise of your CPRA privacy rights.
8. Exercising your California Privacy Rights
To exercise the rights described above, please submit a request to us by contacting us at legal@drift.comor by filling out the following form.
After submitting a request, we will take steps to verify your identity in order for us to properly respond and/or confirm that it is not a fraudulent request. In order to verify your identity, we will request, at a minimum, that you provide your name, email address, and relationship to us, so that we can seek to match this information with the information existing in our systems. When providing us this information, you represent and affirm that all information provided is true and accurate. If we are unable to verify that the consumer submitting the request is the same individual about whom we have collected personal information, we may contact you for more information, or we may not be able to meet your request.
Only you, or an agent legally authorized to act on your behalf, may make a verifiable request related to your Personal Information. If you are making a request as the authorized agent of a California consumer, we will ask you also submit reliable proof that you have been authorized in writing by the consumer to act on such consumer’s behalf.
We will make every effort to respond to your request within 45 days from when you contacted us. If you have a complex request, the CPRA allows us up to 90 days to respond. We may contact you within 45 days from the date you contacted us to inform you if we need more time to respond.
9. Data retention periods
Personal Information will be stored in accordance with applicable laws and kept as long as Drift has an ongoing legitimate business need to carry out the purposes described in this Notice or as otherwise required by applicable law. Generally this means your Personal Information will be retained until the end or your employment, employment application, or work relationship with us plus a reasonable period of time thereafter to respond to employment or work-related inquiries, comply with regulatory obligations, or to deal with any legal matters (e.g. judicial or disciplinary actions), document the proper deductions during and on termination of your employment or work relationship (e.g. to tax authorities), or to provide you with ongoing pensions or other benefits.
10. Updates to this Notice
This Notice may be updated periodically to reflect changes in our privacy practices. In such cases, we will indicate at the top of the Notice when it was most recently updated, and if we make a material change, we will inform you, for example, on our intranet or by company-wide email.
11. Contact details
If you have any questions, comments, or complaints about how we use your information, or would like to exercise any rights that you may have under the CPRA, please address any questions or requests relating to this Notice to legal@drift.com or alternatively, you can raise any concerns with our Chief People Officer. If you have disabilities, you may access this notice in an alternative format by contacting legal@drift.com.