mParticle Employee Privacy Policy

Effective as of May 2nd, 2024

At mParticle, Inc. and its subsidiaries mParticle Limited (UK), mParticle Limited (Canada), mParticle Pty Ltd (Australia), Indicative, Inc., and Vidora, LLC (“mParticle”, “we” or “us”) we are committed to protecting all personal data within our care. We also work very hard at being transparent about the information we process.

This Employee Privacy Policy (this “Privacy Policy”) explains what types of personal data we may collect about our employees, job applicants and similar personnel (“our Personnel”). The policy also explains how that information may be used. If you want to understand our privacy practices with respect to our platform, our customers or other business partners, please visit https://www.mparticle.com/privacypolicy/.

While this Privacy Policy is intended to describe the broadest range of our data processing activities globally, those processing activities may be more limited in some jurisdictions based on the restrictions of their laws. For example, the laws of a particular country or a U.S. State may limit the types of personal data we can collect or the manner in which we process that data. In those instances, we adjust our internal policies and practices to reflect the requirements of local law.

For personal data collected under this Privacy Policy, the controller will be mParticle and the mParticle affiliates by which you are employed. For, (i) specific security questions or concerns around your data, (ii) in the event you feel that you have not received proper attention to your data request, or (iii) have any other data privacy concerns with respect to Personnel, please contact the mParticle Privacy Team by emailing privacy@mparticle.com.

Who is collecting your personal data (who is the data controller)?

The mParticle entity that is a party to your employment contract or contract for services or otherwise employs you will be the data controller of your personal data.

Third Party Service Providers / Processors

In some cases, you may provide personal data to third party service providers (“Service Providers”) that mParticle works with or that provide services to mParticle. These service providers are required by contract to only process data as instructed by mParticle and for no other purposes. They do not “sell” your data as that term is defined under California law. If you’d like to see a list of these service providers, please contact the People Team at peopleteam@mparticle.com or our data protection officer at privacy@mparticle.com.

What is Personal Data?

Personal data, also known as “personal information” or “personally identifiable information,” for purposes of this Privacy Policy means any information that (i) directly and clearly identifies an individual, or (ii) can be used in combination with other information to identify an individual. Personal data does not include such information if it is anonymous or if it has been rendered de-identified by removing personal identifiers. Examples of personal data include:

An individual’s name;
Employee ID number;
Home address;
Home phone number;
Personal email address;
Names of family members;
Date of birth; and
Pseudonymous information such as an IP address or a mobile ad ID.

What is Sensitive Personal Data?

Sensitive personal data is a subset of personal data that may be more sensitive in nature for the individual concerned.

Examples of sensitive personal data include:

Race and ethnic information;
Sexual orientation;
Political/religious beliefs;
Social security or other taxpayer/government issued identification numbers;
Financial information;
National identification number or passport information;
Health or medical information, including genetic information;
Criminal records; and
And in some regions, such as the European Union, trade union membership.

What Personal Data Do We Collect?

We collect and maintain different types of personal data about you in accordance with applicable law. This includes the following:

Name;
Gender;
Home address;
Telephone number;
Date of birth;
Marital status;
Employee identification number;
Emergency contacts;
Residency;
Work permit status;
Military status;
Nationality;
Passport information;
Social security or other taxpayer/government identification number;
Payroll information, banking details;
Wage and benefit information;
Retirement account information;
Sick pay, Paid Time Off, retirement accounts, pensions, insurance and other benefits information (including the gender, age, nationality and passport information for any spouse, minor children or other eligible dependents and beneficiaries);
Information from interviews and phone-screenings you may have had, if any;
Date of hire, date(s) of promotion(s), work history, technical skills, educational background, professional certifications and registrations, language capabilities, and training records;
Beneficiary and emergency contact information;
Forms and information relating to the application for, or in respect of changes to, employee health and welfare benefits; including, short and long-term disability, medical and dental care, etc.;
Physical limitations and special needs in order to provide reasonable accommodations (e.g., to adhere to the Americans with Disabilities Act);
Records of work absences, vacation/paid time off, entitlement and requests, salary history and expectations, performance appraisals, letters of appreciation and commendation, and disciplinary and grievance procedures (including monitoring compliance with and enforcing our policies);
Where permitted by law and applicable, we may collect the results of credit and criminal background checks, screening, health certifications, driving license number, vehicle registration, and driving history;
Information required for us to comply with laws, the requests and directions of law enforcement authorities or court orders (e.g., child support and debt payment information);
Acknowledgements regarding our policies, including employee handbooks, ethics and/or conflicts of interest policies, and computer and other corporate resource usage policies;
Information captured on security systems and key card entry systems;
Voicemails, e-mails, correspondence, documents, and other work product and communications created, stored or transmitted for professional or job related purposes using our networks, applications, devices, computers, or communications equipment;
Date of resignation or termination, reason for resignation or termination, information relating to administering termination of employment (e.g. references);
Letters of offer and acceptance of employment;
Your resume or CV, cover letter, previous and/or relevant work experience or other experience, education, transcripts, or other information you provide to us in support of an application and/or the application and recruitment process;
References and interview notes; and
Information relating to any previous applications you may have made to mParticle and/or any previous employment history with mParticle.

Apart from personal data relating to yourself, you may also provide us with personal data of related parties, notably your dependents and other family members, for purposes of your HR administration and management, including the administration of benefits and to contact your next-of-kin in an emergency. Before you provide such third-party personal data to us, you must first inform these third parties of any such data which you intend to provide and of the processing to be carried out by us. You must ensure and secure evidence that these related parties, or their legal representatives if they are minors, have given their free and express consent that their personal data may be processed by mParticle and/or its affiliates and subcontractors for the purposes described in this Privacy Policy.

How is Data Collected?

Generally, we collect personal data directly from you in circumstances where you provide personal data (during the onboarding process, for example). However, in some instances, the personal data we collect has been inferred about you based on other information you provide us, through your interactions with us, or from third parties. When we collect your personal data from third parties it is either because you have given us express consent to do so, your consent was implied by your actions (e.g., your use of a Service Provider employee service made available to you by us), or because you provided explicit consent to the Service Provider to provide the personal data to us. Where permitted or required by applicable law or regulatory requirements, we may collect personal data about you without your knowledge or consent.

We reserve the right to monitor the use of our equipment, devices, computers, network, applications, software, and similar assets and resources for the safety and protection of employees and intellectual property. In the event such monitoring occurs, it may result in the collection of personal data about you. If required by applicable law, we will notify you of such monitoring and obtain your consent.

How We Process and Use Your Personal Data

We may collect and process your personal data in our IT systems for various purposes subject to local laws, including:

Recruitment, training, development, promotion, career, and succession planning;
Appropriate vetting for recruitment and team allocation including, where relevant and appropriate, credit checks, right to work verification, identity fraud checks, relevant employment history, relevant regulatory status and professional qualifications;
Providing and administering remuneration, salary, benefits, and incentive schemes and providing relevant information to payroll;
Allocating and managing duties and responsibilities and the business activities to which they relate;
Identifying and communicating effectively with other employees and management;
Managing and operating conduct, performance, capability, absence, and grievance related reviews, allegations, complaints, investigations, and processes and other informal and formal HR processes and making related management decisions;
Consultations or negotiations with representatives of the workforce;
Conducting surveys for benchmarking and identifying improved ways of working employee relations and engagement at work (these will often be anonymous but may include profiling data such as age to support analysis of results);
Processing information about absence or medical information regarding physical or mental health or condition in order to assess eligibility for incapacity or permanent disability related remuneration or benefits, determine fitness for work, facilitate a return to work, make adjustments or reasonable accommodations to duties or the workplace and make management decisions regarding employment or engagement or continued employment or engagement or redeployment and conduct related management processes;
For planning, managing and carrying out restructuring or redundancies or other change programs including appropriate consultation, selection, alternative employment searches and related management decisions;
Operating email, IT, Internet, intranet, social media, HR related and other company policies and procedures. The company carries out monitoring of mParticle's IT systems to protect and maintain the systems, to ensure compliance with mParticle policies and to locate information through searches where needed for a legitimate business purpose;
Complying with applicable laws and regulation (for example maternity or parental leave legislation, working time and health and safety legislation, taxation rules, worker consultation requirements, other employment laws and regulation to which mParticle is subject in the conduct of its business);
Monitoring programs to ensure equality of opportunity and diversity with regard to personal characteristics protected under local anti-discrimination laws;
Planning, due diligence and implementation in relation to a commercial transaction or service transfer involving mParticle that impacts on your relationship with mParticle (for example mergers and acquisitions or a transfer of your employment under automatic transfer rules);
For business operational and reporting documentation such as the preparation of annual reports or tenders for work or client team records including the use of your personal photo;
In order to manage the relationship with Service Providers and customers, including the disclosure of relevant vetting information in line with the appropriate requirements of particular customers which might include your contact information, a summary of your qualifications and/or your personal photo for identification to customers;
Where relevant for publishing appropriate internal or external communications or publicity material including via social media in appropriate circumstances, provided that privacy rights are preserved;
To support HR administration and management and maintaining and processing general records necessary to manage the employment or worker relationship and operate the contract of employment or engagement;
To centralize HR administration and management processing operations in an efficient manner for the benefit of our employees and to change access permissions;
To provide support and maintenance for the our IT systems;
To enforce our legal rights and obligations, and for any purposes in connection with any legal claims made by, against or otherwise involving you;
To comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country; and
Other purposes permitted by applicable privacy and data protection legislation including where applicable, legitimate interests pursued by mParticle where this is not overridden by the interests or fundamental rights and freedoms of employees.

Legal Basis for processing

Where applicable data protection laws require us to process your personal data on the basis of a specific lawful justification, we generally process your personal data under one of the following bases:

Compliance with a legal obligation to which mParticle is subject;
Entering into at-will employment (for US only) or performance under an employment contract with mParticle;
For mParticle's legitimate interests being those purposes described in the section above headed "How We Process and Use Your Personal Information"; and/or
Your consent where required and a legitimate legal basis under applicable local laws.

We may on occasion process your personal data for the purpose of the legitimate interests of a Service Provider where this is not overridden by your interests.

Processing of Special Categories of Personal Data

“Special Categories of Personal Data” includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, as well as genetic and biometric data.

From time to time you may provide us with information which constitutes Special Categories of Personal Data or information from which Special Categories of Personal Data may be deduced. In such cases, where required by law, we will obtain your express written consent to our processing of Special Categories of Personal Data. If separate consent is not required by local law, by providing this information to mParticle, you give your freely given, informed, explicit consent for us to process those Special Categories of Personal Data for the purposes set out in How We Process and Use Your Personal Data section above.

You may withdraw your consent at any time by contacting mParticle's People Team. Where you have withdrawn consent but mParticle retains the personal data we will only continue to process that Special Category Personal Data where necessary for those purposes where we have another appropriate legal basis such as processing necessary to comply with legal obligations related to employment or social security. However, this may mean that we cannot (for example) administer certain benefits or contact your next-of-kin in an emergency or provide support to you above and beyond our legal obligations. You give your knowledgeable, freely given, express consent to mParticle for mParticle to use, disclose and otherwise process any personal health information about you that is provided to mParticle by any of your personal health information custodians, for the purposes set out in the How We Process and Use Your Personal Information section above.

Sharing Personal Data

Your personal data may be shared, including to our affiliates, subsidiaries, and other third-parties as follows:

Where you request us or provide your consent to us;
In order to carry out the uses of personal data described above (see, the section above titled How We Process and Use Your Personal Data), including when using or collaborating with third parties in the operation of our business, including in connection with providing many of the benefits and services we offer our employees (e.g., human resources information systems, financial investment service providers, insurance providers); provided, that when we share personal data with third parties we typically require that they only use or disclose such personal data in a manner consistent with the use and disclosure provisions of this Privacy Policy and applicable law;
We may buy or sell businesses and other assets. In such transactions, employee data is generally one of the transferred business assets and we reserve the right to include your personal data as an asset in any such transfer and, in the event that we, or substantially all of our assets, are acquired, your personal data may be one of the transferred assets;
Where required by law, by order or requirement of a court, administrative agency, or government tribunal, which includes in response to a lawful request by public authorities, including to meet national security or law enforcement requirements or in response to legal process;
If we determine it is necessary or desirable to comply with the law or to protect or defend our rights or property;
As necessary to protect the rights, privacy, safety, or property of an identifiable person or group or to detect, prevent or otherwise address fraud, security or technical issues, or to protect against harm to the rights, property or safety of mParticle, our users, applicants, candidates, employees or the public or as otherwise required by law;
Where the personal data is public and exempted from coverage under applicable data protection laws;
To seek advice from our lawyers and other professional advisors; and
To professional advisors (e.g. bankers, lawyers, accountants) and potential buyers and vendors in connection with the sale, disposal or acquisition by use of a business or assets.

Access to Personal Data We Collect

To the extent access is required by applicable law, you can request access to the personal data that we hold about you. If you want to review your personal data, please submit a request via your People Team representative or privacy@mparticle.com. If you want to correct your personal data, you may do this through the self-serve capabilities within Bamboo HR or mParticle’s then-current HR application.

When requesting access to your personal data, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal data that we hold about you.

We reserve the right not to grant access to personal data that we hold about you if access is not required by applicable law. There are also instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal data that we hold about you. In addition, the personal data may have been destroyed, erased or made anonymous. In the event that we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Correction of Collected Personal Data

We endeavor to ensure that personal data in our possession is accurate, current and complete. If an individual believes that the personal data about him or her is incorrect, incomplete or outdated, he or she may request the revision or correction of that data. We reserve the right not to change any personal data we consider to be accurate or if such correction is not required by applicable law.

Retention of Collected Data

Except as otherwise permitted or required by applicable law or regulatory requirements, we may retain your personal data only for as long as we believe it is necessary to fulfill the purposes for which the personal data was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations) and for IT archival purposes.

Personal data for data subjects in the European Union is by default deactivated by mParticle after termination of your employment, with the exception of certain types of personal data, which may be stored for an extended period of time due to administrative purposes, e.g. for payment of retirement income or for giving references to other employers, or where such personal data must be retained to comply with regulatory requirements.

Deletion of Collected Data

You may request that we delete the personal data about you that we hold, provided that we reserve the right to reject such a request if we are not required to delete personal data under applicable law. There are instances where applicable law or regulatory requirements allow or require us to refuse to delete this personal data. In the event that we cannot delete your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

To request deletion of your personal data, please submit your request via your People Team representative or via Privacy at privacy@mparticle.com.

Resolving Concerns

If you have questions or concerns regarding the handling of your personal data, please contact mParticle's People Team or the DPO. Alternatively, you may report concerns or complaints to the Legal Department.

Data portability

Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, to the extent provided under applicable law, you have the right to receive all such personal data which you have provided to mParticle in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to restriction of processing

You have the right to restrict our processing of your personal data where:

You contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
Where the processing is unlawful, but you do not want us to erase the information;
Where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or
Where you have objected to processing justified on legitimate interest grounds (see below) pending

verification as to whether mParticle has compelling legitimate grounds to continue processing.

To the extent required by applicable law, where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defense of legal claims.

Right to withdraw consent

Where we are relying upon your consent to process data, you have the right to withdraw such consent at any time. You can do this by contacting mParticle's your People Team representative or Privacy at privacy@mparticle.com.

Right to object to processing justified on legitimate interest grounds

Where we are relying upon legitimate interest to process data, then you may have the right to object to such processing, and we must stop such processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defense of legal claims. Normally, where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

Right to lodge a complaint

You also have the right to lodge a complaint with a supervisory authority, privacy regulator, State Attorney General in particular in your country or state of residence, if you consider that the processing of your personal data infringes this regulation and/or your rights.

Security of Collected Information

We are committed to protecting the security of the personal data collected, and we take reasonable physical, electronic, and administrative safeguards to help protect the data from unauthorized or inappropriate access or use.

Storage of Information - Location and Onward Transfer

mParticle is a global company with its headquarters in the U.S. This means that personal data may be used, processed, and transferred to the United States and other countries or territories and those countries or territories may not offer the same level of data protection as the country where you reside, including the European Economic Area or the United Kingdom; however, mParticle will ensure that appropriate or suitable safeguards are in place to protect your personal data and that transfer of your personal data complies with applicable law, including applicable data protection laws.

mParticle complies with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the US Department of Commerce regarding the collection, use, and retention of personal data from the European Union, United Kingdom and Switzerland. mParticle will not use the UK Extension to the EU-U.S. DPF or the Swiss-U.S. DPF as a transfer mechanism for personal data until such time as those programs receive an adequacy designation from the EU Commission.

mParticle has certified that it adheres to the DPF program principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability (“DPF Principles”). If there is any conflict between the policies of this privacy policy and the DPF Principles, the DPF Principles shall govern. To learn more about the DPF programs, and to view our certification page, please visit https://www.dataprivacyframework.gov.

As an alternative or in addition to DPF, mParticle may utilize the Standard Contractual Clauses approved by the EU Commission for the transfer of personal data from the EU, UK (along with the UK IDTA or Addendum) and Switzerland.

Where required by applicable data protection laws, mParticle has ensured that any Service Providers (including other mParticle affiliates) sign written agreements outlining their role in processing your information, including standard contractual clauses as approved by the European Commission or other supervisory authority with jurisdiction over the relevant mParticle data exporter (which typically will be your employer).

In cases of onward transfer to third parties of data of EU, UK or Swiss residents received pursuant to the EU-U.S. Data Privacy Framework (“DPF”), the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF, mParticle is responsible for the processing of personal information it receives under the above listed DPF programs and subsequently transfers to a third party acting as an agent on its behalf. mParticle shall remain liable under the above listed DPF programs if its agent processes such personal information in a manner inconsistent with the DPF program principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Changes to Privacy Policy

We may change this Privacy Policy at any time by posting notice of such a change in the revision table below. The effective date of each version of this Privacy Policy is identified at the top of the policy.

Contacting HR and Dispute Resolution

In compliance with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, you have the right to object to the disclosure of your personal data to unaffiliated third parties (i.e. organizations not acting as our vendors and agents) or to otherwise be used for purposes that are materially different from the purpose(s) for which it was originally collected or subsequently authorized by you.

You may exercise this right or other legal rights, or submit a complaint about your privacy and our collection or use of your personal data. mParticle commits to resolve valid requests and complaints in a timely manner. about your privacy and our collection or use of your personal data. European Union, UK or Swiss individuals with inquiries or complaints regarding this Policy should first contact mParticle at:

Email: privacy@mparticle.com
Postal mail: mParticle Inc., 99 Wall Street, Suite 630, New York, NY 10005, USA

If your complaint is not satisfactorily addressed, and your inquiry or complaint involves human resource data, you may contact the state or national Data Protection Authority (DPA) or labor authority in the jurisdiction where you work. Should your complaint remain fully or partially unresolved after a review by mParticle and/or the relevant national authority, you may be able to, under certain conditions, seek binding arbitration before the DPA Panel. For more information please visit https://www.dataprivacyframework.gov/s/european-individuals/.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, mParticle commits to cooperate and comply respectively with the advice of the panel established by the EU DPAs and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

mParticle is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

Contact mParticle Regarding Our Privacy Practices

If you have any questions or concerns regarding this Privacy Policy, please contact your HR representative or the mParticle Privacy Team at privacy@mparticle.com. We will make every effort to resolve your concerns. Alternatively, you may contact us at the addresses below:

mParticle, Inc.

175 Varick Street, 10th Floor

New York, NY 10014

Learn how Rokt can help make the most of the Transaction Moment™