Candidate Privacy Statement

Effective Date: July 13, 2023

I. Overview

This Privacy Statement describes how personal data is processed for applicants who apply for employment at any of the affiliates or subsidiaries of PayPal Inc. (“PayPal”, “us”, “we”, “our”), including the PayPal entity to which you are applying (each a “PayPal Entity”). In this Privacy Statement, we refer to job applicants as “Candidates”.

The data controller responsible for your personal data is the PayPal Entity to which you apply for a job. For example, if you are applying for a job in Australia, the PayPal Entity will be PayPal Australia Pty, Ltd, and if you are applying for a job in Canada, the PayPal Entity will be PayPal Canada Co. PayPal is committed to protecting the privacy and security of your personal information, handling personal data in accordance with data protection laws and ensuring the privacy rights of all Candidates.

It is important that you read and retain this Privacy Statement, together with any other privacy statement or similar document we may provide, so that you are aware of how and why we are using such information and what your rights are under data protection legislation.

Nothing is this Privacy Statement is intended to reduce or take away any rights or protections that you may have under applicable law in your country or jurisdiction. In the event that anything in this Privacy Statement is inconsistent with any such law, the relevant right and/or protection shall prevail.This means that some of the processing activities described may not be performed in certain countries. Please contact us if you would like further information in this respect.

If your application is successful and you accept a position at PayPal, we may use your Candidate data to continue to process background checks. You will be provided with the PayPal Employee Privacy Statement which will include more information on any such continued use and will describe how PayPal will process your data as a PayPal employee. 

II. Personal data we collect

We collect personal data that you provide during the application process. We may also, to the extent needed for the purposes specified in the section “Why we collect personal data”, collect information about you from other sources or third parties, such as LinkedIn, other social media sites, recruitment agencies, credit reference agencies or other background check agencies, the company you currently work for or companies that you worked at prior to your current employment, or PayPal employees that refer or interview you.

We rely on selected lawful grounds to collect, use and process your personal data, which vary according to the particular use of the personal data. These include the following (always to the extent permitted by applicable laws):

• the performance of a contract and the necessity of the processing prior to entering into a contract with you (“Contract”);
• for our legitimate business purposes and interests (provided your interests and fundamental rights do not override those purposes) (“Legitimate Interests”);
• where required by lawor otherwise to comply with our legal rights and obligations or exercise rights in connection with your employment or engagement (“Legal Requirements”); 
• with your consent, where you have provided us with your declaration of consent (“Consent”); 
• where it is needed in the public interest, such as for equal opportunities monitoring (“Public Interest”); or
• where applicable, according to other lawful grounds provided by applicable laws or regulations.

We provide more context of when we rely on each of these grounds in the table in the section “Why we collect personal data”.

Our obligations and the type of personal data we collect and process may vary depending on your region. It is important to note that failure to provide PayPal with personal data in the circumstances outlined in the Privacy Statement may result in you or PayPal being unable to comply with legal obligations or being found to be in violation with applicable laws, rules, regulations or the orders of courts or competent authorites. In addition, if you fail to provide us with the personal data necessary for us to consider your application (such as evidence of qualifications or work history), it may mean we are unable able to take your application further.

Where required, we may approach you for your written consent to allow us to process certain personal data (including special categories of personal data). Any such consent is subject to the laws of the country in which you are located and therefore consents may differ for Candidates in their scope and consequences. Where we do ask for your consent, we will seek to ensure your consent is specific, informed, unambiguous, truly voluntary and freely given, and that, subject to applicable laws, you suffer no adverse consequence from any decision to revoke your consent or if you choose not to grant it.

If you do give us your consent, any personal data provided under that consent will only be accessible by those who need to know. You may revoke this consent at any time. Please note, however, that this will not affect the lawfulness of processing of personal data before the withdrawal of your consent.

III. Categories of personal data we may collect about you:

1. Information that identifies you or provides information about your identity, for example:

• Name, including preferred name
• Contact information (such as address, phone number and email address)
• Social Security Number (SNS), National ID, tax ID or equivalent number/identifier
• IP address
• Usernames
• Passport number and related details

2. Records of your personal information or information you submit to us, for example:

• Information you provide in your application, resume and cover letter
• Education information and qualifications, such as degrees, obtained or currently pursuing, along with actual or anticipated graduation dates
• Employment history, including suspensions or bans of any type, compensatory information such as salary and benefits information
• Background check information (including credit checks, OFAC screening and criminal and related background information) 
• Tax information related to your employment
• Payment information
• Recruitment information (including right to work documentation, references)
• Leaving date, if known, and reason for leaving 
• Religious belief (for candidates in Thailand)

3. Personal characteristics, for example:

• Age
• Gender/gender identity
• National origin
• Disability information
• Caregiver status
• Marital status
• Parental and pregnancy status
• Military and/or Veteran status
• Health data, including any medical condition, health and sickness records, information associated with, vaccinations against or immunity from, transmissible diseases
• Citizenship
• LGBTQ+ status
• Race
• Ethnicity
• Physical characteristics or description

4. Internet or other electronic network activity, for example: 

• Interactions with our websites, apps, devices or other digital properties, emails sent and received
• Geolocation data 
• Social media information

5. Audio, voice, electronic, visual, or similar information, for example:

• Photographs and videos
• Call recordings (interviews)

6. Information we infer based on your personal data, and information you provide in-person, for example:

• Interview assessments
• Competency evaluations
• Aptitude test 
• Interests
• Productiveness
• Fraud and risk assessments
• Suitability for roles & development potential

CCPA Disclosure

If you are a resident of California, for purposes of the California Consumer Privacy Act as amended and supplemented by the California Privacy Rights Act of (CCPA) only, please see below a summary of the categories of personal data collected about you, as applicable and as such categories are stated within the CCPA:

Categories of Personal Data	Examples
Identifiers	Name, IP address, unique personal identifiers, social security number, usernames
Categories of personal data under Cal. Civ. Code 1798.80(e)	Name, address, social security number, phone number, employment history, passport number, physical characteristics or description
Characteristics of protected classifications under California or federal law	Gender, marital status, race, physical disability, medical condition, sex, age
Sensitive personal information	Social security number, passport number, personal PayPal and Venmo account information, including mail, email and text messages regarding these accounts, race, health information, sexual orientation information, biometric information
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Only to the extent gathered as part of “Internet or other electronic network activity information”
Internet or other electronic network activity information	Interactions with our websites, apps, devices or other digital properties
Geolocation data	Precise location of a device
Audio, electronic, visual, thermal, olfactory, or similar information	See “Internet or other electronic network activity information”
Professional or employment-related information	Resume, CV, aptitude tests, employment history, references
Education information	Education history, degrees obtained, actual or anticipated graduation dates
Inferences drawn from the categories of personal data above	Aptitudes, interests, productiveness

IV. Why we collect personal data

PayPal collects and uses Candidate personal data only when it is lawful for us to do so. As such, PayPal collects and uses Candidate personal data only to the extent necessary to recruit new PayPal employees and successfully manage the recruitment system at PayPal.Specifically, we collect, use and process personal data for Candidates for the following purposes described below based on the listed lawful ground.

 

Purpose	Lawful Ground	Legitimate Interest (if applicable)
Assessing whether you are eligible for the position you have applied for at PayPal	Contract Legitimate Interest	It is within our interests to ensure you are suitable for the position you have applied for so you can perform the tasks and responsibilities expected as part of the role
Verifying your identity	Contract Legal Requirement
Confirming you have the right to work in the country in which you are applying for employment	Contract Legal Requirement
Confirming any previous employment positions you have held	Contract Legitimate Interests	It is within our interests to confirm your previous employment positions so we can confirm you are suitable and have the appropriate experiences for the role applied for at PayPal
Obtaining references from former employers	Contract Legitimate Interests	It is within our interests to obtain references from your previous employers so we can confirm you held your previous employment positions and that you are suitable and have the appropriate experiences for the role applied for at PayPal
Confirming your education and any professional memberships and qualifications and ensuring you are in good standing with any professional bodies	Contract Legal Requirement Legitimate Interests	It is within our interests to confirm your education, professional memberships and qualifications, and ensure you are in good standing with any professional bodies, so we can confirm you are suitable and have the appropriate experiences for the role applied for at PayPal
Completion of any necessary credit checks	Contract  Legal Requirement
Background checks for any criminal history, such as financial crimes or related background information, including using the Global Sanctions database(s) (if applicable)	Contract  Legal Requirement
Managing the recruitment process, which may include providing you with information about other positions within PayPal if you consent to receiving these	Contract  Legitimate Interests	It is within our interests to ensure we employ the most suitable people for roles at PayPal and we may, as part of the recruitment process, consider your experience and abilities to be better suited to and utilised in a different role from that which you applied for
Investigate any fraud or potentially illegal activities on the PayPal systems we use to process your personal data	Legal Requirement Legitimate Interests	It is within our interests to investigate potential or actual violations of law, or to prevent fraud, as we must ensure a lawful and safe environment and we may be held accountable for the wrongful acts of our personnel
Compliance with legal obligations, for example responding to law enforcement and regulator inquiries as well as satisfying any legal, regulatory, tax, accounting or reporting requirements	Legal Requirement
For diversity and inclusion analysis, initiatives and insights	Public Interest	It is within our interests to collect personal data related to diversity and inclusion to ensure PayPal is adhering to its diversity and inclusion principles
To provide equal rights and opportunities	Legal Requirement

 

Some of the purposes listed in the table above will require that we process your sensitive personal data (also known as “special category of data”). We will use particularly sensitive personal data in the following ways and for the following purposes (always to the extent permitted or as required by applicable laws):

• we will use information about your physical or mental health, or disability status, to ensure your, our staff, partners’ and clients’ health and safety in the workplace and to assess your fitness to work, to provide appropriate interview accommodations, 
• we will use information about your race, sex or any other protected characteristic to assist with efforts and initiatives concerning diversity and inclusion and meaningful equal opportunity monitoring and reporting.

We do not need your consent if we use special categories of your personal data in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law or as otherwise permitted by applicable data protection laws. In limited circumstances, we may approach you for your express written consent to allow us to collect and process certain particularly sensitive or financial personal data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

V. Information about criminal convictions and sanction listings

You may be subject to a global sanctions list screening where we (or one of our third-party service providers) search for information about you in database sources covering Sanctions, Financial Compliance & Enforcement, Terrorism & Corruption, Criminal Enforcement and Sexual Offense Registries (at all times in accordance with applicable laws).

We will only collect and process information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so or if you have explicitly consented to the same. This will usually be where such processing is necessary to carry out our obligations as part of the recruitment process. All such processing will be carried out in line with this Privacy Statement. Criminal conviction and sanction listings information will be deleted after the screening process, unless we are legally required to store the information for a longer period.

VI. Using artificial intelligence to make decisions about your candidacy

We may process your personal data using artificial intelligence and automated tools to help us make decisions about your candidacy and to identify other job opportunities for you within PayPal. Sources of data will be your resume and other publicly available personal data that you have authorized us to review on your candidate profile. For example, if you have included a link to your LinkedIn profile on your candidate profile, our tools will pull the information you have agreed to share via your settings on LinkedIn. Our tools may have effects for you, namely that they may contribute to a decision rejecting you for a position for which you have applied. Human intervention will always be a part of any such decision. You may contact us using the details below to request further information about how our artificial intelligence tools work and how our recruiters make decisions about your application. You may also request that your application be solely reviewed by a human being.

VII. Why we share personal data

PayPal operates globally which may require us to share the personal data listed in Section II above with other PayPal affiliates, subsidiaries, employees, service providers, and third parties in other countries as described below, for the purposes described in this Privacy Statement. We require third parties to respect the security of your data and to treat it in accordance with applicable law. PayPal does not “sell” or “share” your your personal data as defined under applicable data protection alws. For those who are residents of China, Japan and South Korea, your personal data may be transferred to our background check service provider, Sterling and our recruitment tool provider, Eightfold.

PayPal may also transfer your personal data to other entities in the PayPal group in order to offer you more suitable jobs in other entities in the PayPal group and to manage your application.

We may share personal data:

• in order to carry out the uses of personal data described in this Privacy Statement;
• with our service providers that perform services for us and other functions at our direction and on our behalf. Third party data recipients include financial investment service providers, insurance providers, financial and accounting support providers, background check companies, relocation, tax and travel management services, health and safety experts, facility management, and security services;
• to comply with our legal obligations, regulations or contracts or to respond to lawful requests by public authorities (e.g., law enforcement), court orders, government audits, subpoenas and warrants;
• when seeking legal advice from our lawyers and other professional advisors;
• to exercise or defend against a potential or actual legal claim;
• as necessary to protect our interests, your vital interests, and those of other individuals, such as preventing financial loss, ensuring safety, and security;
• in connection with a sale, divestment or transfer of all or part of our business (such as to the potential purchaser and its professional advisors); and
• otherwise in accordance with your consent.

VIII. How and where we transfer and store your personal data

PayPal transfers personal data in the normal course of business and such personal data may be transferred outside of the country where it was originally collected for purposes described in this Privacy Statement or, if applicable, any specific notice or document related to data protection in your jurisdiction. As we are headquartered in the United States, information collected in other countries is routinely transferred to the United States for processing to the extent necessary and as permitted for the uses described in this Privacy Statement. We have taken specific steps, in accordance with applicable data protection law, to protect your personal data in connection with such transfers. In particular, we rely on Binding Corporate Rules approved by competent supervisory authorities (available here) for transfers of your personal data to other PayPal group companies or we may obtain your explicit consent for such transfer if this is required under applicable laws. For transfers of EU and UK personal data to third parties located outside of the EU or EEA or UK, we rely on Standard Contractual Clauses, a copy of which you can request from PayPal’s Data Protection Officer using the contact details provided below. We will provide you with more detailed information about the countries to which your personal data is transferred upon request.

IX. How do we protect your information?

PayPal is committed to protecting the security and confidentiality of your personal data. We do this by implementing necessary controls that vary depending on the sensitivity of the personal data we process. Such controls include encryption, access restrictions and other technical and organizational measures to ensure the protection of your personal data and to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way. 

In addition, we limit access to your personal data to those employees, agents, contractors, sub-processors and other third parties who have a business need to know. 

In the event that we or one of our service providers are involved in a suspected data security breach, we will inform you and any applicable regulator if we are legally required to do so.

X. How long do we keep your personal data?

We process your data for the duration of your time as a Candidate. Whether your application for the role is successful or not, PayPal will retain your data afterwards. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, HR, regulatory, tax, accounting or reporting requirements, or for as long as your declaration of consent (if applicable) allows us to retain it. We may retain your personal data in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. We will destroy your personal data in a way that does not allow us to recover the information and/or take steps to properly anonymize it so that you can no longer be identified from it.

XI. How do we use cookies and tracking technologies?

When you interact with our sites and, for example, apply for a job, sign into use our job site or visit a third-party website for which we provide our services, we and our partners use cookies and other tracking technologies such as pixel tags, web beacons, and widgets (collectively, “Cookies”) to recognize you as a user, customize your online experiences and online content, including to serve you interest-based advertising, perform analytics; mitigate risk and prevent potential fraud, and promote trust and safety across our sites.

We use Cookies to collect your device information, internet activity information, and inferences as described above.

You can disable or decline some cookies for our sites. But, since some parts of our service rely on cookies to work, those services could become difficult or impossible to use.

Some web browsers have an optional setting called “Do Not Track” (DNT) that lets you opt-out of being tracked by advertisers and some third parties. Because many of our services won’t function without tracking data, we do not respond to DNT settings.

If you want to know more about how we use cookies, please review our Statement on Cookies and Tracking Technologies to learn more about our use of Cookies. To learn how to opt-out of this kind of tracking technology, visit About Ads.

XII. Your privacy rights

Candidates can make certain requests with respect to their personal. In particular, you may have the right to:

• request access to and obtain a copy of your personal data we have about you. 
• request correction of your personal data. 
• request deletion of your personal data. When processing your deletion requests, we assess your request against our corporate policies, whether the purposes for which the information was initially collected have been fulfilled, and whether the data is no longer required. For example, we may deny a deletion request if personal data is necessary, in our legitimate interests, to comply with legal requirements, or to help manage risks and security of our PayPal personnel. 
• restrict processing of your personal data. 
• object to the processing of your personal data.
• request to port your personal data to another company. 
• file a complaint with a supervisory authority and seek a judicial remedy, where permitted.

In the event we processed personal data by relying on your consent, you have the right to withdraw your consent at any time. Please note, however, that this will not affect the lawfulness of the processing before the withdrawal of your consent.

We will respond to any requests in accordance with applicable law, and there may be circumstances where we are not able to comply with your request. Please refer to the "Contact Us" section below for how to get in touch with us to exercise your privacy rights or make a complaint.

Please note that not all of these rights will apply all of the time. Whether you are entitled to additional rights, whether or not you have a specific right and whether a specific right you have would apply will depend on your circumstances, such as your jurisdiction.

XIII. Changes to this statement

We will make changes to this Privacy Statement from time to time to ensure we stay up to date with changes to our practices and laws, and we will provide you with 21 days' notice of any material changesand, if required by applicable law, we will seek your consent prior to such changes becoming effective. We may also notify you in other ways from time to time about the processing of your personal data. We encourage you to review this Privacy Statement periodically to understand PayPal's privacy practices and the rights you may have. 

XIV. Language

This Privacy Statement is written in several languages, with the English version being the original. In the event of any inconsistency or discrepancy between the original English version and any translation into any other language, the local language version shall prevail.

XV. Contact us

The data controller responsible for your personal data is the PayPal Entity to which you apply for a job. If you wish to exercise your privacy rights please email employeecentralcases@paypal.com or contact +1-855-489-0343 option 6.If you have any questions about this Candidate Privacy Statement or you would like to make a complaint please contact PayPal’s Data Protection Officer, Gareth Jones at 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg globalprivacy@paypal.com, or the local PayPal entity that is processing your application.