Legal – Privacy policy

Privacy policy

Date last updated: June 27, 2024

Introduction

Greenhouse Software, Inc. ("Greenhouse") respects your privacy and is committed to protecting it in accordance with applicable laws and using generally-accepted industry practices. This Privacy Policy explains who we are, how we collect, share, and use personal information about you, and how you can exercise your privacy rights. For purposes of this Privacy Policy, “Personal Information” means any information that is available to Greenhouse and that is protected explicitly by the European Union General Data Protection Regulation of 2016 (the “EU GDPR”); the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (the "UK GDPR"); and the California Consumer Protection Act “CCPA”), to the extent applicable.

If you have any questions or concerns about Greenhouse’s collection and use of your Personal Information, please contact us using the contact details provided below. If however, your questions or concerns are related to a Greenhouse customer’s collection and use of your Personal Information, please contact that customer directly.

Scope of this policy

Greenhouse is a leading provider of cloud-based software services that help companies manage and optimize their recruiting and hiring processes.

Our websites, products and services are designed for businesses and their representatives. We do not offer products or services for use by individuals for their personal, family or household purposes. Accordingly, we treat all Personal Information we collect as pertaining to individuals in their capacities as business representatives and not as individual consumers.

Our customers are the controllers of the Personal Information they collect through Greenhouse’s Services to manage their own recruiting and onboarding processes (e.g., names, contact information, and other data collected as part of job applications), and each customer manages that Personal Information in accordance with its own privacy policies. Greenhouse’s privacy commitments to our customers are governed by a separate customer agreement that authorizes us to collect, process, and store Personal Information on their behalf, as a processor under the EU GDPR and the UK GDPR, and a service provider under the CCPA. Greenhouse processes Personal Information relating to our customers’ employees and job applicants within our Services only according to our customers’ instructions (as defined in our customer agreements), and we have no direct relationship with the individuals whose Personal Information we process in connection with our customers’ use of our Services. For example, if you apply to a job posted on a career page of a Greenhouse customer, your Personal Information will be automatically processed by Greenhouse on behalf of that customer. However, the company you applied to is the data controller (or business, as that term is defined in the CCPA) with respect to your Personal Information, and you should contact that entity directly with any questions you may have regarding its privacy policies or data processing practices, or if you wish to modify or access your Personal Information, restrict its processing, or delete it from our Services. Greenhouse’s customer contracts require us to redirect any inquiries relating to the Personal Information we process on behalf of a customer back to that customer without taking any action on the request.

However, Greenhouse is the controller of Personal Information that we collect directly from visitors to our marketing website, www.greenhouse.io (the “Website”); from our own job applicants; and from our customers and vendors to help us manage our business relationships with them. This Privacy Policy describes the type of Personal Information that Greenhouse collects; Greenhouse’s policies around the use, disclosure, and retention of that Personal Information; and the choices available to you regarding your rights in relation to your Personal Information generally.

This Privacy Policy does not apply to any third-party applications or software that can be accessed through our Website or that our customers independently elect to integrate with our Services (“Third-Party Services”). Third-Party Services are governed by the terms and privacy policies applicable to your relationship with the third party, and Greenhouse accepts no responsibility or liability with respect to Third-Party Services.

Personal information we collect

Greenhouse may collect the following information, including Personal Information from and about you:

From your interaction with Sales, Marketing, and Customer Support
We collect Personal Information such as your name, company name, email address, phone number, and billing information when you request a demo of our Services, or request sales information or customer service.

Third-party sources
We may combine Personal Information we receive from you with personal information we obtain from other sources, such as:

Public sources, such as government agencies, public records, social media platforms, and other publicly available sources.
Data providers, such as information services and data licensors that provide other information, such as your business contact information.

Cookies, Scripts and Related Technologies
When you visit our website, www.greenhouse.io, we and our third-party service providers receive Personal Information that you may have provided, such as your IP address. The technologies we use to track your movements around our website include cookies, tracking scripts and pixels, and tagging technologies, which we may employ to understand your preferences, improve your experience on our website, etc. You can control the use of cookies at the individual browser level. If you want to learn more about cookies, or how to control, disable, or delete them, please visit aboutcookies.org for detailed guidance.

Collection of Data by Advertisers
We may also use third parties to manage our advertising on other sites. Certain third-party partners may automatically collect information about your visits to this and other websites, your IP address, your ISP, the browser you use to visit our website (but not your name, address, e-mail address or telephone number). They do this by using cookies, pixel tags or other technologies. Information collected may be used, among other things, to deliver advertising targeted to your interests and to better understand the usage and visitation of our website and the other sites tracked by these third parties. This policy does not apply to, and we are not responsible for, cookies or pixel tags in third party ads, and we encourage you to check the privacy policies of advertisers and/or ad services to learn about their use of cookies and other technologies. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here: aboutads.info/choices or networkadvertising.org.

How Greenhouse uses your personal information

We may use the information that we collect about you and from you, including Personal Information, for the following purposes:

To provide, operate, improve, and customize our Website
We seek to improve your experience with our Website. As a result, we will analyze data we collect about your use of the Website.

To communicate with you
If you request more information about our products, we will contact you using the information you provide us. We may also send you information about products and services that may be of interest to you, with your prior opt-in consent where required by applicable law.

To aggregate data
We may anonymize and/or aggregate data collected through our Website and to create statistics that may be used for any purpose, provided that such statistics do not identify any customers or individuals or contain any Personal Information.

To process your job application
If you apply to work at Greenhouse, Greenhouse will use the Personal Information provided in the context of your application for the purposes of processing and evaluating the application.

For marketing and advertising
We, our service providers, and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes:

Direct marketing. We may send you direct marketing communications. You may opt-out of our marketing communications as described in the Opt-out of marketing section below.
Interest-based advertising. Our third-party advertising partners may use cookies and similar technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. You can learn more about your choices for limiting interest-based advertising in the Your choices section of our Cookie Notice.
Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
Audit our internal processes for compliance with legal and contractual requirements or our internal policies;
Enforce the terms and conditions that govern the Service; and
Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

How Greenhouse may disclose or share your information

We do not sell or otherwise disclose Personal Information we collect about you, except as described in this Privacy Policy or as we disclose to you at the time this information is collected. As described in more detail below, we may share your Personal Information:

With our partners and third-party service providers. We authorize these service providers to use or disclose the information only as necessary to perform services on behalf of Greenhouse (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Website). We require these service providers by contract to safeguard the privacy and security of Personal Information that they process on our behalf;
To third-party advertising companies for the marketing and advertising purposes described above;
To any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, (iii) to protect your vital interests or those of any other person or (iv) for any of the compliance and protection purposes outlined above;
To professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us;
To an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, or in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets, provided that we inform such third parties that they must use your Personal Information only for the purposes disclosed in this Privacy Policy; and
To any other person with your consent to the disclosure.

Your choices

Opt-out of marketing communications
You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.

Cookies
For information about cookies employed by the Service and how to control them, see our Cookie Notice.

Mobile location data
You can disable our access to your device’s precise geolocation in your mobile device settings.

Do Not Track
Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit allaboutdnt.com.

Declining to provide information
We need to collect Personal Information to provide certain marketing materials or other information that you may want. If you do not provide the information we identify as required or mandatory, we may not be able to provide those materials or information.

How Greenhouse secures your information

We care about the security of your Personal Information, and take steps including implementing appropriate technical and organizational measures to ensure that your Personal Information is treated securely and in accordance with this Privacy Policy. The measures we use are designed to provide a level of security appropriate to the risk of processing your Personal Information.

International data transfers

Your Personal Information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our primary offices are located in the United States, and our third-party service providers and partners operate around the world. This means that when we collect your Personal Information, it may be processed in any of these countries.

Notice to European, Swiss and UK users

The information provided in this “Notice to European, Swiss, and UK Users” section applies only to individuals in the European Economic Area (the “EEA”), Switzerland, or the UK.

If you are a visitor from the EEA, Switzerland, or the UK, our legal basis for collecting and using the Personal Information described above will depend on the Personal Information concerned and the specific context in which we collect it.

However, we will normally collect Personal Information from you only where we have your consent to do so, where we need the Personal Information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Information from you or may otherwise need the Personal Information to protect your vital interests or those of another person.

If we ask you to provide Personal Information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

Similarly, if we collect and use your Personal Information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Information, please contact us at privacy@greenhouse.io.

Data Protection Rights
As an EEA, Swiss, or UK data subject, you have the following data protection rights:

If you wish to access, correct, update or request deletion of your Personal Information, you can do so at any time by contacting us at privacy@greenhouse.io.
If you wish to opt out of (i) the disclosure of your Personal Information to a third party, or (ii) the use of your Personal Information for a purpose materially different from the purpose(s) for which it was originally collected or subsequently authorized by you, you can exercise these rights at any time by contacting us at privacy@greenhouse.io. In any event, unless Greenhouse has affirmative express consent from you, Greenhouse will not (i) disclose sensitive information (i.e., personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual), or (ii) use sensitive personal information for a purpose other than those for which it was originally collected or subsequently authorized by you through the exercise of opt-in-choice. Greenhouse will treat as sensitive any Personal Information received from a third party where the third party identifies and treats it as sensitive.
You can object to processing of your Personal Information, ask us to restrict processing of your Personal Information or request portability of your Personal Information. Again, you can exercise these rights by contacting us at privacy@greenhouse.io.
Similarly, if we have collected and process your Personal Information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.
You have the right to complain to a data protection authority about our collection and use of your Personal Information. For more information, please contact your local data protection authority.
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

How long Greenhouse retains your personal information

We retain Personal Information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.

Children’s privacy

We do not knowingly collect, maintain, or use Personal Information from children under 13 years of age, and no part of our website is directed to children under the age of 13. If you learn that your child has provided us with Personal Information without your consent, you may alert us at privacy@greenhouse.io. If we learn that we have collected any Personal Information from children under 13, we will promptly take steps to delete such information and terminate the child’s account.

Third-party certifications: Data Privacy Framework

Greenhouse complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Greenhouse has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Greenhouse has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Greenhouse commits to resolve DPF Principles-related complaints about our collection and use of your personal data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Greenhouse at: privacy@greenhouse.io

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Greenhouse further commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Complaints may be submitted to the EU DPAs, the UK ICO, and/or the FDPIC, as appropriate, at no cost to you.

Please note that if your complaint is not resolved through these methods above, a binding arbitration option may be available under limited circumstances. Additional information can be found here: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2. Additionally, Greenhouse is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC), and the FTC has jurisdiction over Greenhouse’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

With regard to onward transfers of personal data to third parties, Greenhouse is responsible for ensuring that the third parties comply with applicable data protection principles, including ensuring that the third parties do not process such personal data in a manner inconsistent with the DPF Principles.

Interseller

This “Interseller” section is applicable only to Interseller, and excludes all other Greenhouse products and services, including, but not limited to, Greenhouse Recruiting, Greenhouse Onboarding and Greenhouse Sourcing Automation. For information on the privacy practices related to Interseller, please refer to the Interseller privacy page and the Interseller privacy ccpa page.

2023 Data Broker Requests

	Number of requests	Requests granted	Requests denied	Median number of days for substantive response	Mean number of days for substantive response
Requests to delete personal information	26	26	0	1	1.5
Requests to know or access what personal information the data broker was collecting	4	4	0	1	1
Requests to know what personal information the data broker was selling or sharing and to whom	0	0	0	N/A	N/A
Requests to opt out of sale or sharing of personal information	19	19	0	1	1.63
Requests to limit the data broker’s use and disclosure of sensitive personal information	0	0	0	N/A	N/A

*Please note that Interseller is no longer a data broker

Updates to this privacy policy

We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

Contact information

If you have any comments or questions about our Privacy Policy, or to exercise your rights, feel free to contact us at privacy@greenhouse.io, or at the mailing address below.

Greenhouse Software, Inc.
228 Park Avenue S. PMB 14744
Attn: Privacy
New York, New York
10003-1502 USA

Archived versions

Greenhouse Privacy Policy- 5/25/2018