Xsolla Privacy Notice for Job Applicants

Xsolla will use, process, and store Job Applicant Data solely for job recruiting and placement purposes. Access to Job Applicant Data is limited to authorized personnel in the following departments, who may process it in connection with their job responsibilities:

• Human Resources
• Finance
• IT
• Legal
• Senior hiring managers
    

These individuals may be located in the United States of America, the European Union, and other locations. All personnel with access to Job Applicant Data are bound by confidentiality obligations.

2.1 Purpose of Collection

At Xsolla, we are committed to a transparent and effective hiring process, which includes the collection of various types of information to make informed and fair employment decisions. Prior to any hiring decision, we conduct a comprehensive Background Check to ensure the safety and integrity of our workplace. This document outlines the purposes for which we collect specific types of information during the recruitment process:
  

• Email addresses and other contact information: To communicate with you regarding your application, schedule interviews, and make hiring decisions.
• Job application information:
  • Employment history: To evaluate your qualifications and experience for the role.
  • Answers to job application questions: To assess your skills, knowledge, and fit for the position.
   • Test results: To measure your aptitude and suitability for the job, if applicable.
• Device identification information: To ensure the security of our systems and prevent unauthorized access.
• Preferred language and country information: To provide you with a tailored application experience and ensure effective communication.
• Correspondence or communication sent via the Pre-Employment Websites: To track your application progress, respond to your inquiries, and facilitate the hiring process.
• Information on your interactions with the Pre-Employment Websites: To improve the functionality and user experience of our recruitment platforms.
• Other reasonably relevant information relating to your use of the Pre-Employment Websites: To maintain the security and integrity of our systems and troubleshoot any technical issues you may encounter.
  
  

2.2 Data Types Removed

The following data types have been removed as they are not relevant to job applications:
  

• Social security numbers (except for employment verification as permitted by law)
• Driver's license or passport numbers (except for employment verification as permitted by law)
• Financial account or payment card information
• Precise geolocation
• Racial, ethnic, and national origin (unless permitted by law for specific roles)
• Religious or philosophical beliefs
• Details from personal mail, emails, and text messages, except for communications directly related to job scheduling or inquiries
• Health, genetic, and biometric data
• Sexual orientation and gender
  
  

2.3 Data Collection from Third Parties

Xsolla may obtain personal data from the following third-party sources, with your consent:
  

• Recruiters
• Employment research firms
• Identity verification services
• Employment references
• Publicly available sources online (e.g., professional networking websites like LinkedIn)
• Usernames
  
  

2.4 Consent for Third-Party Data

Unless your social media profile is made public, Xsolla may obtain separate consent from you before accessing or using any personal data from third-party platforms like LinkedIn.

2.5 Background and Credit Checks

Xsolla, upon extending an offer of employment and where legally permissible, will seek your explicit consent to conduct background or credit checks through public authorities or financial institutions. This is to assess your suitability for employment or related benefits.

3.1 Purposes of Use

Xsolla will use Job Applicant Data for the following purposes:

• Job recruiting and placement: To assess your qualifications, suitability for open positions, and make hiring decisions.
• Analysis by Human Resources: To evaluate skills and experience trends for talent development and recruitment planning, measure the effectiveness of our recruitment processes, and track diversity and inclusion metrics.
• Employment purposes (for successful applicants): To onboard new employees, manage payroll and benefits, and comply with legal and regulatory requirements.
• Support for the application process: To manage application submissions, communications, and interviews.
  
  

3.2 Sharing of Data

Xsolla may share Job Applicant Data with third parties under specific circumstances, particularly when the hiring process is managed by a third-party vendor. These instances include:

• Contracted parties for essential purposes: This refers to external payroll service providers engaged to manage payroll and benefits for candidates who are successfully hired.
• Third-party vendors acting on our behalf: Limited to vendors who provide essential services to support the recruitment process and who are contractually bound to protect the confidentiality of Job Applicant Data.
  
  

3.3 Retention of Data

Xsolla will retain Job Applicant Data for different periods depending on the outcome of the application:

• Successful applicants: Data will be retained for the duration of employment and for a period of time thereafter as required by applicable laws and regulations.
• Unsuccessful applicants: Data will be retained for a maximum period of six months, in compliance with legal requirements and company policies. Following this period, it will be securely deleted or anonymized, unless the applicant has provided explicit consent for longer retention. Such consent allows Xsolla to retain the data beyond six months, particularly for considering the applicant for potential future vacancies. In these instances, documented proof of the applicant's consent is necessary for extended data storage.
  
  

Below is a breakdown of retention periods applicable to the following data protection/privacy laws:

• CCPA (California Consumer Privacy Act): 4 years from the date of last interaction with Xsolla or until instructed to delete by the applicant.
• GDPR (General Data Protection Regulation): 2 years after the application process ends, unless there is a legitimate interest to retain it longer (e.g., legal claims, diversity initiatives).
• CPA (Colorado Privacy Act): 3 years from the date of last interaction with Xsolla or until instructed to delete by the applicant.
• CTDPA (Connecticut Data Privacy Act): 4 years from the date of last interaction with Xsolla or until instructed to delete by the applicant.
• UCPA (Utah Consumer Privacy Act): 3 years from the date of last interaction with Xsolla or until instructed to delete by the applicant.
• VCDPA (Virginia Consumer Data Protection Act): 4 years from the date of last interaction with Xsolla or until instructed to delete by the applicant.
  
  

If you are hired and begin your employment with Xsolla, your Job Applicant Data will be transferred to your specific employment/personnel file and it will be processed for employment purposes by the specific Xsolla entity that hired you. Xsolla's data retention policies apply to all our affiliates and we ensure best practices are maintained across the organization.

Job Applicant Data collected from unsuccessful applicants is retained for as long as is reasonably necessary to complete the processes associated with consideration for employment. At times, Xsolla may want to keep certain job applicant’s data for consideration for future open positions. If we express interest in doing so with your information and you are not interested in hearing from us regarding new opportunities as they arise, simply inform us that we are to use your Job Applicant Data for the purpose of considering your suitability for the specific position for which you applied. This request should be sent at careers@xsolla.com with the subject matter “No further offers”.

When we no longer have a need to retain your Job Applicant Data, Xsolla will delete your personal data, or render it unidentifiable if there is a need to retain it in that form in accordance with time periods established by applicable laws in certain jurisdictions. Information regarding the applicable time periods in your jurisdiction can be obtained by contacting our privacy contact at the email address listed below. If the jurisdiction in question does not provide a time period by law, Xsolla shall store your Job Applicant Data through the term of your employment, if hired, and, for those not hired, for up to four years.

Upon request, Job applicants may access, correct, amend, or delete their Job Applicant Data stored by Xsolla. Additionally, where applicable, you may request to receive Job Applicant Data in a structured, machine-readable format. To exercise these rights, please follow the steps below:

4.1 Accessing, Correcting, Amending, or Deleting Job Applicant Data:

To access, correct, amend, or delete your Job Applicant Data, please contact our Human Resources department at Xsolla by emailing careers@xsolla.com. Provide specific details regarding your request, including your full name, contact information, and the nature of your request. We will review your request and respond in accordance with applicable privacy laws.

4.2 Objecting to Processing and Withdrawing Consent

Job applicants have the right to object to the processing of their personal data in certain circumstances. Additionally, if processing relies on consent, job applicants may withdraw their consent at any time. To exercise these rights, please contact your local Human Resources department at Xsolla by emailing careers@xsolla.com.

Please note: The ability to access or receive Job Applicant Data as described above may be limited in certain situations. Examples of such limitations include:

• When fulfilling the request would require revealing personal data about another person.
• When Xsolla has a compelling, legitimate interest in restricting your access.
• When Xsolla is not permitted by law to comply with your request.
  
  

For complaints related to data protection under local laws in the United States, you can contact the following regulators:

• California Consumer Privacy Agency (CCPA): California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General
• Colorado Division of Privacy (CPA): Colorado Privacy Act (CPA) - Colorado Attorney General | Colorado Attorney General (coag.gov)
• Connecticut Data Privacy and Protection Agency (CTDPA): The Connecticut Data Privacy Act
• Utah Division of Consumer Protection (UCPA): Home - dcp.utah.gov
• Virginia Department of Attorney General (VCDPA): File a Complaint (state.va.us)
  
  

For complaints related to General Data Protection Regulation (GDPR) in the European Union, you can contact the European Data Protection Supervisor (EDPS). More information can be found on the EDPS website About | European Data Protection Supervisor (europa.eu).

If you have any further questions or concerns regarding your Job Applicant Data or privacy, please contact the Xsolla Data Protection Officer, Valentina Chemodanova, by way of email at gdpr@xsolla.com.

We are committed to ensuring the protection and privacy of your Job Applicant Data and will address your requests and concerns promptly and in accordance with applicable data protection laws.

You can review our privacy policy for a complete list of your rights. There are differences in your rights based on where you live. We will handle your request in line with the law that applies to you, even if a region isn't included in our policy.

To exercise your rights, please contact data.protection@xsolla.com.

Xsolla will not sell your personal information to any third party.

Xsolla acts as the data controller and is responsible for the security and privacy of Job Applicant Data. Xsolla has implemented appropriate technical and organizational measures to protect Job Applicant Data from unauthorized access, use, disclosure, alteration, or destruction.

5.1 Data Controller For Personal Data

The data controller for your Job Applicant Data is the specific entity within the Xsolla organization to which you have applied. Under the arrangement between the companies of Xsolla, Xsolla (USA), Inc. is responsible for exercising the rights of the data subjects and for provision of the information to the data subjects who can use Xsolla (USA), Inc. as a contact point.

Xsolla (USA), Inc.
15260 Ventura Blvd., Suite 2230, Sherman Oaks, CA 91403 USA;
careers@xsolla.com
Ph: 877-797-6552

5.2 Data Protection Officer

You may contact the Data Protection Officer of Xsolla with regard to all issues related to processing of their personal data and to the exercise of their rights under data protection law using the following contact details:

Email: data.protection@xsolla.com
Postal address: Arch. Makariou III, 155, Proteas House, 5th floor, 3026, Limassol, Cyprus
Ph: 877-797-6552

5.3 Data Security and Data Integrity

Xsolla seeks to implement and maintain security measures that meet or exceed all applicable legal requirements and leverage relevant best practices, in order to safeguard your Job Applicant Data from loss, misuse, unauthorized access, disclosure, alteration or destruction.

We have obtained SOC 1 Type 2 and SOC 2 Type 2 certifications, demonstrating our compliance with industry-recognized standards for security, availability, and confidentiality.

Our administrative safeguards include implementing, maintaining, and training employees on company privacy and information security policies and procedures. Our physical and technical safeguards include maintaining physical security policies and standards to protect company systems and data, and a cybersecurity program overseen by our executive leadership team.

Xsolla gathers and processes specific Job Applicant Data to fulfill legal obligations mandated by various local employment laws and regulations. Transparency about these requirements is important to us, so we've outlined the legal basis for each data element we collect:

6.1 Work Eligibility and Identity Verification

• Legal Basis: In compliance with the Immigration Reform and Control Act of 1986 (IRCA) and enforced by the Department of Homeland Security (DHS), we are legally obligated to verify your eligibility for employment in the United States (US) before proceeding with your hiring. To fulfill this requirement, we utilize the E-Verify system.
• Data Required:
  • Acceptable documents for verification: You can find a list of acceptable documents for verifying work authorization and identity on the DHS website: https://www.uscis.gov/i-9-central/form-i-9-acceptable-documents.
  • Data storage and destruction: We are required to retain copies of these documents for a specific period after your hire date, as stipulated by IRCA regulations. We securely store and destroy them according to these regulations.
  
  

6.2 Employment-Related Information

• Legal Basis: Once hired, we need certain information to establish your employment relationship and comply with tax and employment reporting requirements.
• Data Required:
  • Basic personal information (name, address, date of birth)
  • Social Security Number (SSN): Required for tax reporting and payroll purposes, as mandated by the Internal Revenue Service (IRS).
  • Emergency contact information
  • Banking information for direct deposit (optional)
• Data storage and usage: We securely store and use this information only for these specified purposes, as required by the Fair Labor Standards Act (FLSA) and other relevant regulations.
  
  

6.3 Additional Information

• In some cases, additional information may be necessary to comply with specific industry regulations or licenses. We will inform you of any specific legal requirements for the role you are applying for.
• You have the right to access and rectify your collected data. Please refer to our Privacy Policy for details on exercising these rights.
  
  

6.4 Failure to Provide Accurate Information

Please note that providing inaccurate or incomplete information during the application process, including regarding your work eligibility or identity, may result in the disqualification of your candidacy.

By providing this clear and transparent explanation of our legal requirements for collecting specific data, we hope to foster trust and understanding throughout the recruitment process.

How We Use Your Job Applicant Data

Xsolla processes your Job Applicant Data in various ways, always ensuring we have a legal basis to do so. Here's how:

7.1 With Your Consent

• Reference checks: We initiate reference checks only after receiving your explicit permission. However, please be aware that if consent is withdrawn after we have already contacted a reference, we cannot retract the inquiry already made.
• Use of Backdoor References and Data Sharing: In certain circumstances, we may consult 'backdoor' references or individuals who have not been explicitly listed by you but are relevant to your professional background. This is done in addition to contacting the references you provide. Furthermore, with your express consent, we will share your data with third parties, such as background check providers. It's important to note that once shared, withdrawing consent will not affect the data already shared.
• Sharing data with third parties: We will only share your data with third parties (e.g., background check providers) with your express consent.
  
  

7.2 To Fulfill Legal Obligations

• Taxes and reporting: We collect and retain certain information, like your Social Security Number and address, to comply with tax and employment reporting requirements as mandated by law.
• Recordkeeping and audits: We may be required to retain some of your data for specific periods to comply with recordkeeping and auditing obligations.
  
  

7.3 For Legitimate Interests

• Data verification: We verify the accuracy of the information you provide, such as work eligibility, to ensure compliance with regulations and protect against fraud.
• Platform security: We may process your data to maintain the security of our online platforms and protect against unauthorized access.

Notwithstanding any other provision in this Privacy Notice, Xsolla may disclose or otherwise process Job Applicant Data in the following specific circumstances:

8.1 Business Transactions

In the context of a sale or transaction involving all or a portion of Xsolla's business, such as a merger, acquisition, or asset transfer. In such cases, Job Applicant Data may be shared with potential or actual purchasers or transferees, but only to the extent necessary to facilitate the transaction and with appropriate confidentiality safeguards in place.

8.2 Compliance with Laws and Regulations

To comply with applicable laws, regulations, court orders, or other legal obligations. This may include, but is not limited to:

• Responding to subpoenas, warrants, or other valid legal requests from law enforcement or government agencies.
• Cooperating with investigations or legal proceedings.
• Reporting suspected illegal activity or breaches of law.
• Complying with tax reporting obligations.
  
  

8.3 Public Safety and National Security

To protect public safety or national security, where disclosure is necessary to prevent imminent harm or under specific legal requirements.

8.4 Enforcement of Legal Rights

To establish, exercise, or defend Xsolla's legal rights, including in connection with litigation or potential legal claims.

Xsolla operates globally, and as part of our general business management and operations, HR management, and legal obligations, it may be necessary to transfer Job Applicant Data collected from you to one of our affiliated entities located outside the jurisdiction in which you applied to work. For example, your Job Applicant Data may be transferred to our affiliates in the Russian Federation or Malaysia.

When transferring your Personal Data outside of the jurisdiction you applied to work in, we are committed to ensuring that such transfers comply with all applicable privacy laws. We will implement appropriate and necessary measures to provide an equivalent level of data protection in accordance with the requirements of the General Data Protection Regulation (GDPR).

One of the mechanisms we use to ensure GDPR compliance is the implementation of Standard Contractual Clauses (SCCs) or other equivalent safeguards. These contractual arrangements include specific data protection obligations and rights that provide a secure framework for the transfer of personal data.

To obtain more information regarding the specific data protection measures we have enacted and to access details about our privacy code of conduct, please contact your local Human Resources department at Xsolla by emailing careers@xsolla.com. You may also reach out to our Data Protection Officer for any inquiries or concerns related to data protection.

Throughout these international data transfers, we remain dedicated to the privacy and security of your Job Applicant Data. We handle all questions or requests in line with the prevailing data protection laws. Additionally, only authorized employees may access this data through our third-party software providers, ensuring consistent management and protection of your information across our global operations.