[Last Updated: January 30th, 2025]
(1) INTRODUCTION AND SCOPE OF THIS NOTICE
This Candidates Privacy Notice (“Notice”) describes how Panaya Ltd., and its affiliates and subsidiaries (collectively “Panaya”, “we” or “us”) collect and process Personal Data (as defined below) when you apply for a position at Panaya (whether for an employee, worker or contractor position, and collectively “Candidates”, “you” or “your”) upon submission of your application, as well as during the recruitment process and thereafter.
As a global company, this Notice applies to Candidates in the territories in which we offer job positions and is subject to applicable data protection laws, including the Israeli Protection of Privacy Law 5741-1981 (“IPPL”), the EU and UK General Data Protection Regulation (collectively “GDPR”), and the California Consumer Privacy Act (“CCPA”) (collectively the above “Data Protection Laws”).
This Notice provides Candidates with the needed disclosure and information about the types of Personal Data collected, why we collect your Personal Data and the purposes for which we will use it, how long we will retain it, with whom we share it, what are your applicable right regarding your Personal Data, and how you can exercise them. For additional information required under the CCPA, please see Section 10 of this Notice – “Additional Information for California Residents”.
This Notice is an integral part of Panaya Privacy Policy governing the use of Panaya’s website (in the event your application is submitted from the website), and supplements the information provided therein. Please also note, if, following the recruitment process you are hired by or otherwise engaged with Panaya, your Personal Data collected through the course of your recruitment will be subject to Panaya’s internal policies governing its processing of employees and other staff members Personal Data.
ANY PERSONAL DATA YOU PROVIDE IS MADE AT YOUR FREE WILL AND CONSENT (WHERE REQUIRED UNDER APPLICABLE DATA PROTECTION LAWS), AND YOU ACKNOWLEDGE THAT YOU ARE NOT UNDER ANY STATUTORY OBLIGATION TO PANAYA WITH PERSONAL DATA. however, we must collect or
receive some Personal Data to examine your application (initially or in later stages), and if you will not provide us with such Personal Data, we will not be able to fulfill certain purposes, for example, decide whether you qualify for a certain position, decide if you are legally entitled to work in certain territories, etc., all as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use“ which details the purposes for which each Personal Data set is collected.
It is important that you read this Notice, together with any other notices that might be provided on specific occasions when we are collecting Personal Data about you, so that you are aware of how and why we are collecting and using such Personal Data.
(2) CONTACT INFORMATION AND DATA CONTROLLER INFORMATION
Under applicable Data Protection Laws, Panaya Ltd, and its affiliate or subsidiary which offers the job position you applied to, are considered as the “data controller” (or the “business” under the CCPA) of your Personal Data. This means that Panaya Ltd and such entity of its company group are responsible for deciding how we hold and use your Personal Data (as shall be described herein), as well as to enable you to exercise your rights.
For any questions you might have regarding this Notice or our processing of your Personal Data you may contact us as follows:
By Email: [email protected]
Panaya is a part of Infosys global corporation. You may contact Infosys DPO, as follows:
Contact Peron: Srinivas P
By Email: [email protected]
By Mail: Infosys Limited, Electronics City, Hosur Road, Bangalore 560 100, India (Attn: Panaya DPO).
Panaya Germany GmbH
By Email: [email protected]
By Mail: Panaya Germany GmbH c/o RPI Roehm, Elsenheimerstr. 7, 80687 München, Germany (Attn: Panaya Data Protection Representative).
(3) THE TYPES OF PERSONAL DATA WE COLLECT
For the purpose of this Notice, the term “Personal Data” means individually identifiable information, namely information that identifies an individual or may with reasonable effort identify an individual (which can be further defined under Data Protection Laws as “personal information”, “personally identifying information”, etc.). Personal Data may further include types of information defined under applicable Data Protection Laws as “Sensitive Data” (and can be further defined under applicable Data Protection Law as “highly sensitive information”, “special categories of personal data”, “sensitive personal information“, etc.).
Panaya collect, store, and use various types and categories of Personal Data about Candidates, which may further include Sensitive Data. The table below details the categories of Personal Data we collect and process and the purpose for which we collect and use each such category (as well as our lawful basis for processing where the GDPR applies to your Personal Data).
Please note that the specific categories or types of Personal Data collected may vary depending on the position you apply to and legal requirements under applicable Data Protection Legislation.
Panaya will not process your Personal Data to perform automated decision-making.
| Categories and Types of Personal Data | Purpose of Collection and Use | Lawful Basis (under the GDPR, where applicable) |
| • Personal identification information: your full name and identifying information such as date of birth, your photo, government-issued identification number and copy of such identification certificates (e.g., ID, passport number). • Contact information: such as email address, phone number, and residence address. • Employment history: such as previous employers, job positions, dates of employment, responsibilities, achievements, etc. • Education and qualifications: such as information on educational institutions attendance and dates, degrees or certifications obtained, fields of study, etc. • Skills, abilities, and expertise: such as information related to the Candidate’s relevant competencies, skills, language proficiency, and any other expertise that may be pertinent to the position being applied for. • Assessment results: information gathered from tests, interviews, or assessments conducted during the recruitment process, to evaluate the Candidate’s suitability for the position. • Background check information (to the extent applicable): information obtained through background checks, such as, subject to applicable laws (i.e., where required or permitted under such laws) verification of employment and education history. • Eligibility to work: information regarding the Candidate’s legal right to work in the relevant country, such as citizenship or visa status. • Communication and internal records: such as correspondence, and records or recording of phone calls, interviews or other interactions between the Candidate and Panaya during the recruitment process. • Any additional information voluntarily included by the Candidate in its application or resume (CV), and supporting documents submitted by the Candidate. | • Job Application processing and evaluation: to assess the Candidate’s qualifications, experience, skills, and suitability for the position applied for and in addition, subject to applicable laws, to identify potential matches with other open positions within Panaya. • Communication with you: to facilitate our correspondence with the Candidate during the recruitment process, including scheduling interviews, providing updates, and addressing inquiries. • Verification and reference checks: to verify the accuracy of the information provided by the Candidate, including employment history, education, and professional references, as well as conducting background checks where necessary and subject to applicable laws. • Compliance with legal requirements: to ensure adherence to relevant employment laws, regulations, and industry standards. • Eligibility to work: to confirm the Candidate’s legal right to work in the relevant country and comply with immigration requirements, if applicable. • Decision-making and selection: to facilitate the decision-making process, compare Candidates, and ultimately select the most suitable individual for the position. • Record-keeping and documentation: to maintain a record of the recruitment process, including Candidate evaluations, assessments, and decisions, which may be used for future reference or to address potential disputes or legal claims. • Administration and performance of human resources related duties, obligations and procedures. • Continuous improvement: to analyze and refine our recruitment strategies, practices, and processes. | Our lawful basis to process Personal Data depend on the purpose for which we collect, use, and retain it, and as follows: Personal Data is mainly processed under our legitimate interest, as needed for our assessment, selection process and decisions making. Meaning we mainly process all types of Personal Data to determine if a Candidate is suitable to a certain job position. We may further retain certain types of Personal Data, even after we have decided not to engage with a Candidate, under our legitimate interest, for the purpose of record keeping, compliance with applicable laws, evaluating our recruiting processes, and to address and defend against potential legal claims. In addition, we retain Personal Data where we are required to do so in order to comply with our legal obligations. Where required under applicable Data Protection Laws, we will obtain the Candidate’s consent to process Personal Data – for example for certain background checks, or to further retain and use Personal Data for future job opportunities or other offered positions at Panaya. You have the right to withdraw consent at any time. |
| • Sensitive Data: we collect certain information that, depending on the applicable Data Protection Law, might be considered as Sensitive Data. Sensitive Data will be collected solely where there is a specific law requirement or necessity to obtain it, and solely in the event provided voluntarily by the Candidate or otherwise where the Candidate provided its consent. Such information may include Personal Data on about the privacy of a Candidate’s family life or personality, a personality assessment (conducted by a professional entity to evaluate significant personality characteristics) race, ethnicity, national origin, disability and medical or health condition, veteran or military status, or other protected characteristics, and certain data that might be gathered as part of background checks (such as criminal records). | • Equal opportunity monitoring: Panaya is committed to equal opportunity in the workplace. We do not discriminate, either directly or indirectly, on the grounds of sex, sexual orientation, gender identity, race, ethnic origin, religion, belief, disability, marital status, creed, nationality, national origin, color, or age. We may ask for information on the ethnic origin, gender, and disability of a Candidate for the purpose of monitoring equal opportunity and ensuring Panaya diversity and inclusion as required and permitted under applicable laws. • To ensure compliance with applicable laws or security standards: to the extent required or permitted by applicable law, we may conduct background checks that may involve criminal record information. • Record-keeping and documentation: to maintain a record of the recruitment process, which may be used for internal and external reporting responsibilities (e.g., legal and regulatory requirements), future reference or to address potential disputes or legal claims. • Administration and performance of human resources related duties, obligations and procedures. | These types of Personal Data will be initially collected subject to obtaining your consent. You have the right to withdraw consent at any time. We may further retain certain types of Personal Data, under our legitimate interest, for the purpose of record keeping, compliance with applicable laws, evaluating our recruiting processes (e.g., for diversity and ensure our process is not discriminating or bias), and addressing potential future disputes or legal claims. |
(4) CATEGORIES OF SOURCES OF PERSONAL DATA
We typically collect Personal Data about Candidates, as follows:
(5) WITH WHOM WE SHARE YOUR PERSONAL DATA
We disclose your Personal Data internally with our personnel involved in the recruitment and hiring process (i.e., human resources, managers, affiliates). We share further your Personal Data with third parties, including within our corporate group, contractors, consultants and service providers that help us with our recruitment process and operation as well as administration and performance of human resources related duties, obligations and procedures, and where needed to comply with our legal obligations or to exercise and defend our rights. We take applicable measures to ensure your Personal Data will be accessed only by those who really need to in order to perform their tasks and duties, and to third parties who need such access in order to provide their services as required by Panaya and in accordance with our instructions.
Below you can find information about the categories of such third-party recipients.
| Category Of Recipient | Category of Personal Data | Purpose of Sharing |
| Panaya Company Group | All types of Personal Data | We may share Personal Data within our affiliates or company group to allow us to manage our recruitment process as a global group at the organizational level, and for human resources management. This will include information shared with third party including by way of merger, acquisition or purchase of all or part of its assets, your Personal Data may be shared with the parties involved in such corporate event. |
| Contractors and Service Providers | All types of Personal Data | We may disclose Personal Data to our trusted agents, vendors and service providers so that they can perform the requested services on our behalf. These third parties may include, service providers and vendors related to recruitment, talent acquisition and administration, technology services (e.g., SaaS recruitment management providers and cloud providers), background checks providers, legal counsels, etc. We contractually obligate these third parties not to use your Personal Data for any purposes other than providing us with requested services. |
| Third Parties You Have Requested Us to Share Your Personal Data With | The types of Personal Data you request us to share | To the extent permitted under applicable laws, we will share your Personal Data as you request us to share. In such event, the provision of your Personal Data will be subject to such third parties’ policies and practices only. |
| Governmental Agencies, Authorized Third Parties, or Disclosure due to a Legal Process | Subject to law enforcement or authority request, or as necessary for a legal process. | In the event of legal and law enforcement inquiry or requirement, we may disclose certain Personal Data, such as in response to verified requests relating to criminal investigations or alleged illegal activity. We may further disclose Personal Data in the event of any activity that may expose us, you, or any other third party to legal liability, as well as to defend against potential, threatened, or actual litigation, and solely to the extent necessary to comply with such purpose. |
(6) INFORMATION SECURITY
We take great care in implementing and maintaining the security of your Personal Data. We employ industry standard procedures and policies to ensure the confidentiality of Personal Data and prevent unauthorized disclosure or use of any such. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have the “need to know”. They will only process your Personal Data on our instructions. We have implemented technical, physical and administrative security measures to protect the Personal Data we collect and store, including procedures to detect and manage suspected or actual security breach.
Although we take reasonable steps to safeguard information, to the maximum extent permitted under applicable laws, we cannot be responsible for the acts of those who gain unauthorized access or abuse our systems and network and will not always be able to prevent such access.
Subject to applicable Data Protection Laws requirements, we will notify you and the appropriate authorities if we discover a security incident or breach related to your Personal Data.
(7) DATA RETENTION
Your Personal Data will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Notice, including for the purposes of satisfying any legal, administrative, record keeping, or reporting requirements. The criteria according to which we determine the retention periods are as follows:
According to the criteria set forth above – we determine when we no longer have a legal justification for retaining Personal Data, and at such instances we will delete or de-identify the Personal Data so it can no longer be associated with you by reasonable means. In addition, we may retain limited Personal Data as a reference for any future applications submitted. If you are hired, we will store your Personal Data collected through the recruitment process for the term of your employment and thereafter, according to our practices and policies related to our employees and staff members’ Personal Data.
Except as we are required by applicable law, we will not be obligated to retain your Personal Data for any specific period, and we may delete it for any reason and at any time, without providing you with prior notice if our intention to do so.
(8) CROSS BORDER DATA TRANSFERS
Due to our global operation, your Personal Data may need to be processed or accessed in countries other than your jurisdiction, including, for example, when shared or accessed by our service providers or other affiliates. This may include transfer of Personal Data to, or from, the State of Israel, the US and the EEA.
Panaya only transfers Personal Data to another country, including within its corporate group, in accordance with applicable Data Protection Laws. We take appropriate measures to ensure that your Personal Data receives an adequate level of protection, including by using contractual obligations or other data transfer mechanisms that were per-approved by applicable data protection authorities to ensure your Personal Data is protected. Where you consent is required under applicable Data Protection Laws for the transfer of your Personal Data, by submitting your application you are deemed to have consented to the transfer of your Personal Data, as described herein
(9) YOUR RIGHTS RELATED TO YOUR PERSONAL DATA AND HOW TO EXERCISE THEM
You have the right to exercise certain choices, rights, and controls in connection with your Personal Data. Depending on your relationship with us, your jurisdiction and the applicable Data Protection Laws, these rights may include one or more of the following principal rights:
You further have the right to appeal or lodge a complaint. If we decline to take action on your request, we will inform you without undue delay as required under applicable Data Protection Laws. For EU/UK Candidates, you have the right to lodge a complaint with the applicable Data Protection Authority in the EU or the Information Commissioner in the UK.
You may have additional rights as described in this Notice or applicable laws.
If you wish to exercise your rights, directly or through an agent, please contact us at: [email protected]; our DPO at [email protected]; or as detailed under our Data Subject Request form available here.
We sometimes need to request specific information from you to help us confirm your identity and ensure the requested rights apply to you. This is another appropriate security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. Information provided in connection with such request will be processed only for the purpose of processing and responding to your request, and it may be shared with our legal and administrative teams.
(10) ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS
The below provides further information and disclosures required under the CCPA with regards to our data collection and privacy practices of Candidates’ “personal information”, in Panaya’s capacity as the “business”. This section is an integral part of this Notice and supplements the information provided under the Notice.
Categories of Personal Information We Collect
Under this Notice we have provided comprehensive information regarding the Personal Data we collect and process. The table below further provides details regarding the CCPA categories of personal information under which the Personal Data we process is classified (and that we have collected in the previous 12 months). Please note that under the CCPA, personal information does not include: publicly available information that is lawfully made available from government records, that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; information excluded from the CCPA’s scope, such as: Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 and the California Confidentiality of Medical Information Act or clinical trial data; personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or California Financial Information Privacy Act and the Driver’s Privacy Protection Act of 1994.
| A. Identifiers. | A real name, alias, postal address, unique personal identifier, Social Security number, driver’s license number, passport number, or other similar identifiers. | Yes – as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use“, and for example, name and address. |
| B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, medical information. Some personal information included in this category may overlap with other categories. | Yes- as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use“, and for example name, address, telephone number, employment history. |
| C. Protected classification characteristics under California or federal law. | Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, sexual orientation, veteran or military status. | Yes – as described under Section 3 of this Notice – “The Types of Personal Data We Collect Purpose of Collection and Use“, and for example citizenship . |
| D. Commercial information. | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | No |
| E. Biometric information. | Genetic, physiological, behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information. | No |
| F. Internet or other similar network activity. | Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. | No |
| G. Geolocation data. | Physical location, approximate location derived from IP address or movements. | No |
| H. Sensory data. | Audio, electronic, visual, thermal, olfactory, or similar information. | Yes – as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use“, and for example, video interviews recorded with your approval. |
| I. Professional or employment-related information. | Current or past job history or performance evaluations. | Yes – as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use“, and for example, previous job positions. |
| J. Non-public education information (per the Family Educational Rights and Privacy Act). | Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes. | No |
| K. Inferences drawn from other personal information. | Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | No |
| L. Sensitive personal information. | Government-issued identifying numbers, financial account details, genetic data, precise geolocation, race or ethnicity, religious or philosophical beliefs, union membership, mail, email, text messages, biometric data, health data, and sexual orientation or sex life. | Yes – as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use“, and for example, government-issued identifying numbers if needed. |
Categories of Sources of Personal Information & Use of Personal Information
The source from which we obtain personal information is mainly from you (i.e., you directly provide it to us), or third parties (for example a previous employer you have provided as reference) – is as described under Section 4 of this Notice – “Categories of Sources of Personal Data”. The purpose for which we collect personal information and how we use it is mainly to manage the recruitment process and asses your application for decisions making, as well as, to comply with applicable laws and defend our rights – as described under Section 3 of this Notice – “The Types of Personal Data We Collect & Purpose of Collection and Use”. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice.
Disclosures of Personal Information for a “Business Purpose”
We may disclose your personal information for a business purpose, and mainly with relevant third parties who support our employment processes and other third parties to comply with legal obligations or to exercise and defend our rights. The categories of such third-party recipients with whom we share personal information is as described under Section 5 of this Notice – “With Whom We Share Your Personal Data” and includes: Panaya company group, to allow us to manage our recruitment process as a business; Service providers and contractors, to perform certain services requested on our behalf, for example, service providers and vendors related to recruitment, talent acquisition and administration, technology services, background checks, where allowed by applicable law, etc.
The categories of personal information we disclose, include any of the categories detailed under the table above (A, B, C, H, I and L) – as needed to fulfill the purposes. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract, we further restrict the contractor and service provider from selling or sharing your personal information.
Sale or Share of Personal Information
We do not “sell” your personal information to any third party nor “share” it, as defined under the CCPA, meaning, we do not disclose or share your personal information in exchange for money or some other form of consideration.
Data Retention
The retention periods are determined according to the criteria broadly explained under Section 7 of this Notice – “Data Retention”, and mainly for as long as it remains necessary in order to achieve the purpose for which the personal information was initially processed; to comply with our regulatory obligations; to resolve a claim or a dispute with you.
Your Rights Under the CCPA:
Please see Section 9 of this Notice – “Your Rights Related to Your Personal Data and How to Exercise Them”, which details your principal rights as for your personal information, including under the CCPA and how you may exercise them. In addition to those rights, under the CCPA you further have the right to: limit the use or disclosure of your “sensitive personal information”; not to receive not to be discriminated against for exercising your rights.
You can designate an authorized agent to submit requests to exercise rights on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.
(11) AMENDMENTS
We reserve the right to periodically revise this Notice, which will have immediate effect upon posting of the revised Notice on our website. The last revision date will be reflected in the “Last Updated” heading at the top of the Notice. We will make a reasonable effort to provide a notice if we implement any changes that substantially change our privacy practices or your rights, and where required under applicable Data Protection Laws, obtain your consent. We recommend you review this Notice periodically to ensure that you understand our privacy practices and to check for any amendments.
