Candidate Privacy Policy

1. Purpose & Scope

This Candidate Privacy Policy describes the privacy practices of Lusha Systems Ltd. including its subsidiaries and affiliates (collectively, “Lusha,” “we,” or “us“) that apply to our collection, use, and disclosure of personal information from our applicants (“you” and “your”) for employment, including internship opportunities with Lusha via our application portals, websites, or other recruitment channels (collectively, “Application Sites”).

For the purposes of this Candidate Privacy Policy:

“Candidate” means a current or former applicant for employment with us.
“Candidate Data” or “Candidate Personal Information” means the information we process in connection with your application and as part of the recruitment process, as further detailed below.

Your use of Lusha’s services is governed by any applicable terms and our general Privacy Policy.

2. Types of Information We Collect

As further described in the following sections, we collect several types of information from and about you that broadly fall into the categories below:

Your name, address, email address, telephone number and other contact information;
Your resume or CV, cover letter, previous and/or relevant work experience or other experience, education, transcripts, or other information you provide to us in support of an application and/or the application and recruitment process;
Information from interviews and phone-screenings you may have, if any;
Details of the type of employment you are or may be looking for, current and/or desired salary and other terms relating to compensation and benefits packages, willingness to relocate, or other job preferences;
Details of how you heard about the position you are applying for;
Any sensitive and/or demographic information provided by you during the application or recruitment process such as gender, information about your citizenship and/or nationality and immigration status, medical or health information and/or your racial or ethnic origin;
Reference information and/or information received from background checks (where applicable), including information provided by third parties;
Information relating to any previous applications you may have submitted to Lusha and/or any previous employment history with Lusha;
Information about your educational and professional background from publicly available sources, including online, that we believe is relevant to your application or a potential future application (e.g. your LinkedIn profile);
Background check and drug screening information (where permitted or required by law); and/or
Information related to any assessment you may take as part of the interview screening process.

3. How We Use the Information We Collect

Your Candidate Data will be used by Lusha for the purposes of carrying out its application and recruitment process which includes:

Carrying out and supporting human resources functions and activities, including processing and evaluating your application, assessing your eligibility to work, making hiring decisions, and managing and improving our recruiting and hiring processes.
Verifying your Candidate Data and carrying out reference checks and/or conducting background checks (where applicable);
Communications with you about the recruitment process and/or your application(s), including, in appropriate cases, informing you of other potential career opportunities at Lusha;
Creating and/or submitting reports as required under any local laws and/or regulations, where applicable;
Where requested by you, assisting you with obtaining an immigration visa or work permit where and if required;
Making improvements to Lusha’s application and/or recruitment process;
Managing workplace safety and health;
Complying with legal obligations and internal policies;
Complying with applicable laws, regulations, legal processes or enforceable governmental requests;
Proactively contacting you if we think you would be suitable for a role with us;
We will also use your Candidate Data to protect the rights and property of Lusha, our users, applicants, candidates, employees or the public as required or permitted by law;
If you are offered and accept employment with Lusha, the information collected during the application and recruitment process will become part of your employment record.

4. Who May Have Access to Your Information

We may disclose personal information contained in Applicant Data to the following categories of recipients:

We will share your Candidate Personal Information with our HR team. We may share some Candidate Personal Information with Processors engaged by us to provide services we require to use
Candidate Personal Information for permitted purposes. Such Processors operate under our instruction. We ensure that any Processor we use takes adequate measures to protect your
Candidate Personal Information, by signing a data processing agreement with it;
Because we operate our business as a corporate group of companies, we may also share your Candidate Personal Information with companies in our corporate group for the same purposes set out above;
Where required by law, we will also disclose your Candidate Personal Information to a governmental authority;
Any other person with your consent to the disclosure;
We do not sell your Candidate Personal Information to third parties.

5. International Transfers

Lusha operates globally, which means your Candidate Data may be stored and processed outside of the country or region where it was originally collected including in the United States. Lusha, and its wholly owned subsidiaries, has stated that its approach is to act in compliance with the European General Data Protection Regulation 2016/679 (the “GDPR”). Lusha remains responsible for any of your personal information that is shared under the Onward Transfer Principle with third parties for external processing on our behalf, as described above.

Lusha takes appropriate steps to protect information about you that is collected, processed, and stored as part of the application and recruitment process.

6. Security

We implement measures to reduce the risks of damage, loss of information and unauthorized access or use of Candidate Personal Information. We also request our affiliates to implement such measures in order to secure the information we provide them. However, although efforts are made to secure Candidate Personal Information, we cannot guarantee its absolute protection.

7. Retention of Candidate Data

If you apply for a job at Lusha and your application is unsuccessful (or you withdraw from the process or decline our offer), Lusha will retain your Candidate Data for a period after your application. We retain this information for various reasons, including in case we face a legal challenge in respect of a recruitment decision, to consider you for other current or future jobs at Lusha, and to help us better understand, analyze and improve our recruitment processes.

If you do not want us to retain your Candidate Data for consideration for other roles, or want us to update it, please contact Privacy@Lusha.com. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

8. Your Rights

In certain countries, you may have certain rights under data protection law as specified below. If you wish to exercise such right, we will respond to any requests in accordance with applicable law, and so there may be circumstances where we are not able to comply with your request.

You can contact Lusha’s Privacy Officer at: Privacy@Lusha.com.

Lusha is subject to the investigatory and enforcement powers of the Romanian data protection authority – Anspdcp and the Israeli data protection authority. If you have an inquiry regarding our privacy practices in relation to our Privacy, we encourage you to contact us at Privacy@Lusha.com. You may also refer a complaint to your local data protection authority and we will work with them to resolve your concern.

NOTE: In all cases where consent is the legal ground, a separate consent form may be provided to you, or as the case may be, the mere handling of data or documents for the acknowledged purpose will be deemed as consent (e.g., you send us health data via email to justify your non-compliance with internal rules).

8.1 With Whom We May Share Your Information

The Company will disclose your personal information to those described as follows:

RECIPIENT	ROLE
Third parties we engage to perform support services for us	Such as, but not limited to, security, IT and software services and technical support suppliers, archiving services suppliers, bank services providers, insurance services suppliers, labour medicine services supplier, health safety services suppliers, training and evaluation agencies, accommodation and transportation services providers / tourism agencies, marketing agencies, leasing companies, insurance companies, payroll services providers, providers of gift vouchers, accountants, email / courier services providers, medical services providers.
Lusha group	In order to manage your employment contract or for intra-group personnel movability purposes, we may disclose information to our group companies, to enable the latter to consider you for potential openings or secondments, and /or the case may be analysed, and feedback provided in the context of incidents / sensitive cases.The Company acts as a joint data controller with the other entities from Lusha Group. Lusha affiliates may ensure specific services for our employment relations, such as: organizing specific carrier meetings, providing support in the annual process of people review and talent management, being involved in training events (including evaluation of participants), managing expatriates’ relations, managing e-learning courses & test registration attendance, ensuring consultancy and support for various HR related matters, monitoring employees where conducted, providing us with specific reports needed for our activity.
Consultancy services providers and any other similar services providers	E.g. lawyers, auditors, or accountants working on various matters of interest for us
Public / Official databases	Where reporting / registration is mandatory (such as with trade registries, authorities)

8.2 Your Rights

We use reasonable efforts to ensure that your personal data is updated and accurate. In order to assist us with this, you should notify us of any changes to your personal data by contacting the local HR Manager.

Candidates may have certain rights under applicable local privacy laws. However, regardless of your location, Lusha provides the same high standard of privacy protection to all of our Candidates.

By law, you have the right to:

Access: You have the right to be provided with the Personal Information held about you by the Company.
Rectification: You can ask us to have inaccurate or incomplete personal data amended or supplemented.
Erasure (“right to be forgotten”): following termination, you can ask us to erase your personal data under the circumstances listed in Art 17 GDPR or any other applicable law, and we will take reasonable steps to comply as well as inform other controllers who are processing the data that you have requested erased of your desire to have erased any links to, copies or replication of the data.
Withdrawal of consent: You can withdraw any consents to processing that you have given us and prevent further processing if there is no other ground under which the Company can process your personal data.
Opposition: You have the right to object to the processing of your personal data when based on the Company’s legitimate business interests. We will stop processing such data information unless: (i) there are compelling legitimate grounds for the processing that override your interests, rights and freedoms; or (ii) the Company needs to continue processing your personal data to establish, exercise, or defend a legal claim.
Portability: Via automatic means or whenever we process your data based on contract/consent, you can ask us to transmit the personal data that we hold about you to you or to a third party electronically (i.e., in a structured, commonly used, and machine-readable format) and.
Raise a complaint: You can raise a complaint about our processing to the Company DPO. If you don’t receive a response within 30 days of receipt of your complaint, you may file a complaint with your local data protection authority.