(Internal) Gem Software Privacy Policy

This Privacy Policy (“Privacy Policy”) covers our treatment of information that we gather when you are accessing or using our websites and services offered at www.gem.com or on any website, online service, mobile application or other location where this Privacy Policy is presented (collectively, “Services”).

This Privacy Policy does not apply to the practices of companies we don’t own or control, or people that we don’t manage. We may also share some information with third parties, but only as described below.

Our Services are not directed to persons under the age of 18. We do not knowingly collect information from anyone under the age of 18 nor knowingly allow such persons to user or register for our Services. If we learn that we have collected the information from a minor under the age of 18, we will delete that information as soon as possible. If a parent or guardian becomes aware that their child has provided us with information without the parent’s consent, they should contact us at support@gem.com.

For the purposes of any applicable data protection law (“Data Protection Law”), Gem Software, Inc. (“Gem Software”, “we”, “us” or “our”) is the data controller (i.e., the company who is responsible for, and controls the processing of information relating to our business customers, visitors to our website, and any other users of our Services (collectively, “you” or “yours”). This Privacy Policy does not apply to other information that Gem processes on behalf of its business customers as their processor/service provider and you will need to consult the relevant privacy notice of our business customers with whom you have a direct relationship. This Privacy Policy also doesn’t cover our treatment of information about candidates and other individuals that we receive from our partners and other third parties (“Business Data”). For information on how we process Business Data received from third parties, please view our Non-B2B Customer Privacy Notice here.

In addition, this Privacy Policy does not apply to information that we collect from our employees and contractors or those persons who apply for a job at Gem.

This Privacy Policy outlines your data subject rights, including the right to object to certain types of processing we carry out, for more information see the “Your rights and choices” section below.

What information do we collect and for what purpose?

We gather various types of Personal Information from our customers and website visitors, including, but not limited to, the following types of data:

Information You Provide to Us

Business Customers

When our business customers create a new account to use the Services, we may collect information in order to provide these customers with our Services, including personal contact information regarding our business customers’ end users (e.g., their employees) of the Services and financial information for billing purposes. We also may solicit our business customers’ consent to connect their email account to their new Gem account (using the OAuth authentication method), thereby providing us with access to their email account, including but not limited to email, contacts, and calendar. Gem accesses and stores a limited subset of data from our business customers’ account, including name and email address, to provide our Services.

For users authenticating via Google accounts; Gem Software’s use of information received, and Gem Software’s transfer of information to any other app, from Google APIs will adhere to Google’s Limited Use Requirements.

We receive and store any information that you provide to us during your use the Services. For example, for our business customers, through their account settings, sending Creating Sequences and InMail Activity Tracking, creating lists of contacts, inputting contact information, requests for support through customer care, and otherwise using the Services, we may collect Personal Information such as your name, email address, location, phone number, payment information, and third-party account credentials (for example, your log-in credentials for Google Mail or other third party sites). Certain information may be required to register with us or to take advantage of some of our features.

Business Customers and Other Users.

We may also collect Personal Information you submit to us, for example by completing a form on our website or participating in a Gem event.

When you submit a job application via the Services and agree to save your information with Gem, we may collect certain information you provide us, such as your contact information (including your name, phone number, and email address), educational and work history and compensation, date of birth, skills, interests, citizenship status and U.S. work eligibility, references, job and career preferences, location and postal address information (including city, state, and ZIP code), other profile information (such as your bio and picture), application question responses, schedule and availability, access to transportation, responses to tests and surveys, documents uploaded for job applications, such as CVs and any information in such documents.

We may collect audio or visual information such as audio recordings if you call our customer service.

If you decide to participate in any surveys, promotions, events, or sweepstakes, you may provide certain information, such as basic contact information and other information relevant to those activities.

We may collect sensitive information (for example, your race, gender, or sexual orientation) for our diversity, equity and inclusion reporting and as part of your application but only where you voluntarily provide it, including in documents supporting your application – e.g. your CV.

Information Collected Automatically

Whenever you use our Services, we may automatically receive and record information in our server logs from your browser, which may include your IP address, information about your web cookies, and the page or feature you were interacting with. Cookies are web identifiers we, and other services, transfer to your browser to allow us to recognize your browser when you visit our site. To learn more about how we use cookies and related technologies, including how you can limit the use of these technologies when using the Services, please see our separate Cookies Policy.

In connection with your use of the Services, we may also collect information created or provided by you, or that we otherwise receive, in connection therewith. For example, if your contacts send messages to you, we may collect and maintain the message data, which may include Personal Information.

How we use your information

We use your information to provide, support, and develop our Services. In particular, we may use your information to:

• Provide our Services. We may use your information to provide our Services, including to enable you to submit applications and to be considered for job opportunities, and to help business customers identify candidates and obtain job market insights. We may use your information to analyze activity on our Services and use that to develop and improve our Services, including with the help of artificial intelligence and machine learning. We may also use your information to surface potential job opportunities that we think might be of interest to you. Applicant submissions may be included as part of our applicant tracking system database so that other companies (e.g., recruiters or other potential employers) can query the database or receive suggestions from our Services that will help them identify good candidates for their positions. You may opt out of being included in this database through the Your Rights and Choices section below or by choosing to not participate when you submit a job application that uses our Services.
• To Communicate with you.
• Operate our Services. We also may use your information to analyze use of the Services and improve the content, functionality and usability of the Services; secure the Services and investigate and help prevent fraud, security issues, and abuse; and understand and resolve Services crashes and other issues.
• Other Internal Purposes. We may use your information to comply with any procedures, laws, and regulations where necessary for our legitimate interests or legitimate interests of others; and establish, exercise, or defend our legal rights where necessary for our legitimate interests or the legitimate interests of others, including the enforcement of our agreements with you or other usage policies, and other legal terms or controls, or to engage in other legal matters.
• Other Purposes. We may use your information for any other purpose with your consent.
• Combine Information. For the purposes discussed in this Privacy Policy, we may combine the information that we collect through the Services with information we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.
• Aggregate/De-Identified Information. We may aggregate and/or de-identify any information collected through the Services so that it can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also disclose such data with any third parties at our discretion.

What is our legal basis for processing in the EU?

When you access or use our Services, we process your information for the purposes described in this Privacy Policy. We rely on a number of legal bases to collect, use, store, share and otherwise process your information as described below.

Providing your information may be a requirement necessary to enable your use of the Services, including for the performance of certain services and functionalities, such as replying to and managing requests for information, questions, communication, or feedback. In these circumstances, refusal to provide your information means that we cannot provide the requested services. However, providing your information for survey, marketing and other profiling purposes is optional; refusal to provide your information for these purposes will not have any impact on your use of the Services

Where we process your information on the basis of legitimate interests as described in the table above, you have the right to object to, and seek restriction of, this processing.

Information We Disclose

In certain circumstances we work with third parties to help us provide our Services and this can require us to disclose your information to these third parties. We disclose your information with the following different categories of third-party service providers:

• Analytics Service Providers. We use third party analytics services in order to better understand how our users are engaging with our Services. When you browse our website or use the Services, these services may collect your IP address, browser type, and approximate location (based on the IP address). They may also set and access cookies on your computer or other device. In order to refine our understanding of user engagement, we also share your email address (which we collected as part of the user’s account registration process) with these service providers. For example:
• FullStory. We use FullStory for recording your interactions with our site which helps us deliver a better user experience. For more information on the privacy practices of FullStory, please visit https://www.fullstory.com/legal/privacy/.
• Google Analytics. We use Google Analytics to track website traffic. Google Analytics is a web analytics service offered by Google. Google uses the data collected to track and monitor the use of our websites. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en. We also encourage you to review Google’s policy for safeguarding your data: https://support.google.com/analytics/answer/6004245.
• Affiliated Companies, Business Units and Employees : Information that we process and collect may be transferred between companies, business units and employees that become affiliated with us.
• Asset Transfer or Company Acquisition. We may choose to buy or sell assets and may share and/or transfer customer and other user information in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, you acknowledge that information could be one of the assets transferred to or acquired by a third party.
• Service Providers. We employ other companies and people to perform tasks on our behalf and need to share your information with them to provide products or services to you; for example:
• data storage services,
• marketing and advertising services, and
• payment processing companies to receive and process your financial transactions for us.
• Compliance with our legal obligations and protecting our rights. As explained in more detail in the Legal basis section above, we may need to share your information with third parties, including law enforcement authorities, to comply with law, legal obligations, regulations, law enforcement, governmental and other legal requests, or court order; enforce or apply our Terms of Use and other agreements; address fraud, security or technical issues; or protect the rights, property, or safety of Gem Software, our employees, our users, or others.
• At your direction. We may share information with third parties when you direct us to do so.
• Information you make public. We may disclose information you make public through the Services. Please think carefully before making information public as you are solely responsible for any information you make public. Once you have posted information, you may not be able to edit or delete such information, subject to additional rights in the “Your Rights and Choices” section below.

Data storage and transfer

If you are habitually resident in the European Economic Area (“EEA”), Switzerland or the United Kingdom, we will transfer or transmit Personal Information that you submit or otherwise share with us through your use of the Services to the United States and other countries outside of where you live for storage, processing and the other purposes described in this Privacy Policy.

For example, we currently use datacenter facilities located in the United States. Countries which are outside the EEA, Switzerland or United Kingdom may not offer the same level of data protection as in your home country; for example there is currently no adequacy decision in respect of the United States. Where the European Commission has recognized a country as providing an adequate level of data protection, Gem may rely on the Commission’s adequacy decision, as applicable, to transfer data.

When transferring data to vendors outside the EEA, Switzerland or the UK, Gem Software relies upon a variety of legal mechanisms including Standard Contractual Clauses. For a copy of the Standard Contractual Clauses, please contact legal@gem.com.

In certain limited circumstances, we may use derogations, such as the contractual necessity derogation, where appropriate to process personal data, when there are no other data transfer mechanisms applicable. For example, where the transfer of information is necessary to provide our Services as set out in the Terms of Service.

Your Rights and Choices

Your Privacy Legal Rights

1. Customer Account Data – Business customers provide us with instructions on what to do with Business Customer Account Data. A Customer has many choices and control over Business Customer Account Data. Since these choices and instructions may result in the access, use, disclosure, modification or deletion of certain or all Business Customer Account Data, please review the Help Center pages for more information about these choices and instructions.
2. Individual rights –You may have certain rights regarding your information that we hold. While some of these rights apply generally, certain rights apply only in limited cases based on your location. These rights apply to “personal information” as defined by applicable laws:
1. Right of access - You can request more information about some of the information we hold about you and request a copy of some of that information, which includes the categories of “personal information”, the categories of sources from which the “personal information” was collected, what the business or commercial purpose is for the collecting or selling of the “personal information” and the categories of third parties that we share your “personal information” with.
2. Right to rectification - If you believe that any “personal information” we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
3. Right to erasure - In certain circumstances, you have the right to obtain the erasure/deletion of your “personal information” without undue delay.
4. Right to restriction - The right to obtain the restriction of the processing undertaken by us on your “personal information” in certain circumstances, such as where the accuracy of the data is contested by you, for a period enabling us to verify the accuracy of that data.
5. Right to portability - You can ask for a copy of your “personal information” which you have provided to us in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
6. Right to object - You have a right to object to processing of your “personal information” based on legitimate interests or in the public interest, and for direct marketing.
7. Right to file a complaint - You have the right to lodge a complaint about our practices with respect to your “personal information” with the supervisory authority of your country or state.

You can contact Gem to exercise your rights by emailing support@gem.com.

Depending on where you live, you may be able to designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

If we deny your request in whole or in part, you may have the right to appeal the decision depending on where you live by contacting support@gem.com.

Your Privacy Choices.

Opt Out of Sale or Share or Processing of Personal Information for Targeted Advertising.

Residents of certain states such as California, Colorado, Connecticut, Utah, and Virginia may opt out of the “sale” of their personal information. Such residents may also opt out of the sharing or processing of their personal information for targeted advertising. Applicable law broadly defines “sale” or “share” in a way that may include allowing third parties to receive certain information such as cookies, IP address, device identifiers, browsing behavior, contact information and/or other activity to enable targeted advertising to you. We may share or process such information to deliver targeted advertising to you about our Services.

If you or your authorized agent (e.g., in California, Virginia, Colorado and Connecticut) would like to opt out of the processing of your information for such purposes, you may submit a request by clicking on the Your Privacy Choices link in the footer of our website and following the instructions. For non-cookie based information, you may also use our online request portal or by email at support@gem.com.

You may still receive advertising; it just may not be tailored to your interests. Please note, if you use different browsers, devices, or services you will need to make your choice on each browser or device where you want to opt out. You should also complete the form above so we may add your information to an appropriate suppression list.

Please note that if you have a legally recognized browser-based opt out preference signal turned on via your device browser (such as Global Privacy Control), we recognize such preference in accordance and to the extent required by applicable law.

Communications

With your consent (to the extent required by law), we may send marketing communication to you through various channels, including by email, SMS and MMS message and physical mail.

You can opt out of receiving marketing emails from us at any time by clicking the “Unsubscribe” link at the bottom of each email or emailing us at [insert applicable email] with the word UNSUBSCRIBE in the subject field of the email. Please note that even if you unsubscribe or opt-out, we may still send you transactional, order, or Services related communications.

You can opt out of receiving SMS or MMS messages from us by texting the keyword STOP in response to any text message you receive from us.

You can also opt out of receiving physical mail marketing communications by emailing us at support@gem.com.

After you opt-out or update your marketing preferences, please allow us sufficient time to process your marketing preferences. Unless otherwise required to process your requests earlier by law, it may take up to 5 business days to process your opt out requests in relation to receipt of electronic marketing materials such as emails, and up to 30 days for all other marketing-related requests.

Tracking Technology Choices.

Most browsers accept cookies by default. You can instruct your browser, by changing its settings, to decline or delete non-essential cookies. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations. If you disable or remove tracking technologies some parts of the Site may not function correctly.

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Because there is no industry consensus as to what website operators should do with regard to these signals, we do not take action with respect to “Do Not Track” signals or other mechanisms, except as otherwise provided herein. For more information on “Do Not Track,” visit http://www.allaboutdnt.com.

Analytics and Targeted Advertising.

You can opt out of the processing of certain data collected by Google Analytics, by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout. For targeted advertising, in addition to the opt outs described in Your Rights and Choices above, some of the companies we work with to provide you with targeted ads are required by us to give you the choice to opt out of receiving targeted ads. Most of these companies are participants of the Digital Advertising Alliance (” DAA”) and/or the Network Advertising Initiative (” NAI”). For more information about Interest-based Advertising and to understand your options, including how you can opt-out of receiving behavioral ads from participating companies, please visit the DAA website opt-out at http://www.aboutads.info/choices, or the NAI opt-out at https://www.networkadvertising.org/choices/. Even if you opt-out of interest-based advertising by a participant, tracking technologies used on the Services may still collect data for other purposes including analytics. You may still see ads from us, but the ads from the participants with whom you opted out will not be targeted based on behavioral information about you and may therefore be less relevant to you and your interests.

Please note that your opt out only applies to the specific web browser you use so you must opt out of each web browser on each device you use. To successfully opt out, you must have cookies enabled in your web browser (see your browser’s instructions for information on cookies and how to enable them). Once you opt out, if you delete your browser’s saved cookies, you will need to opt out again.

To opt out of us using your data for Matched Ads, you may submit a request through our online form available through our online request portal. We will request that the applicable technology service not serve you Matched ads based on information we provide to it. Alternatively, you may directly contact the applicable technology service to opt out.

We are not responsible for the effectiveness of, or compliance with, any opt out options or programs, or the accuracy of any company statements regarding their opt out options or programs.

Retention period

We retain information for as long as you have an open account with us and for 7 years after you close your account. In some cases we retain information for longer, if doing so is necessary to comply with any legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. Afterwards, we retain some information in a depersonalized or aggregated form but not in a way that would identify any individual personally.

An example of the retention period that applies to certain types of data that we collect is set out below:

• Mailing lists: we retain the information you used to sign up for our blog alerts for as long as you remain subscribed (i.e., if you do not unsubscribe) or if we decide to remove our blog service, whichever occurs first.

Data security

We maintain a variety of administrative, technical, and physical safeguards that are designed to protect the privacy and security of your Information. However, the Internet is not a fully secure environment, and we cannot ensure or warranty the security of any Information transmitted to or generated by Gem in connection with the Services. You play a critical role in protecting your Information by maintaining up-to-date computer security protections. Steps you take to ensure the security of your computer, computer passwords, or other personal identifier authentication mechanisms are key components of the protection of your Information. You agree that you are responsible for any additional verification procedures and security you deem necessary.

Additional disclosures for California residents (THE “CALIFORNIA PRIVACY NOTICE”)

These additional disclosures apply only to California residents. The California Consumer Privacy Act of 2018, as amended (“CCPA”), provides certain rights as described herein and in this Privacy Policy. The terms in this section have the definitions set forth in the CCPA.

California Notice at Collection.

In the past 12 months, we have collected the following categories of personal information enumerated in the CCPA:

• Identifiers and contact information, including name, address, email address, account name, phone number, billing address.
• Device information and device identifiers , including IP address, browser type and language, operating system, platform type, device type, software and hardware attributes, and unique device and advertising identifiers.
• Employment or education information , such as job title, job history and other information provided on CVs.
• Demographic information , such as your gender. This category includes pieces of personal information that also qualify as protected classification characteristics under other pre-existing California or federal laws.
• Commercial information , including purchases, payment and transaction information.
• Internet or other electronic network activity , including history of visiting and interacting with our Services, and other information collected automatically.
• Inferences , including information about your interests, preferences and favorites.
• Sensitive personal information , including race, gender, or sexual orientation.
• Audio or Visual Information , such as audio recordings if you call our customer service.

For more information on information we collect, including the sources we receive information from, review the “What information do we collect and for what purpose?” section above.

We use the Information we collect from you for the following business and commercial purposes:

• Operating, providing and managing our Services.
• Processing and fulfilling transactions and purchases.
• Performing services requested by you, such as responding to your comments, questions, and requests, and providing customer service.
• Sending you technical notices, updates, security alerts, information regarding changes to our policies, and support and administrative messages.
• Preventing and addressing fraud, breach of policies or terms, and threats or harm.
• Monitoring and analyzing trends, usage, and activities.
• Conducting research, including focus groups and surveys.
• Improving and customizing the Services.
• Developing and sending you direct marketing, including advertisements and communications about our and other party products, offers, promotions, rewards, events, and services.
• Administering your participation in the contest or promotion, including to deliver a prize to you if you are the winner.
• Providing you advertising.
• Fulfilling any other business or commercial purposes at your direction or with your consent.

For information on your rights and choices regarding how we use Information about you, please see the “How We Use Your Information” and “Your Privacy Choices” sections of the Privacy Policy.

How We Disclose Your Information.

Like most online businesses, we disclose some Information with contracted third parties to provide better services and advertising to you.

We may disclose all the categories of personal information identified in this California Notice at Collection or elsewhere in this Privacy Policy for our operational or business purposes to the following categories of entities and third parties:

• Service providers.
• Third parties designated by you.
• An entity that is part of corporate restructuring, including a successor-in-interest or assign.
• Governmental entities.
• Third parties who are involved in a legal investigation or in protecting or defending the rights or property of Gem or its customers; and/or investigating or assisting in preventing any violation or potential violation of the law, this Privacy Policy, or our Terms of Use.
• Our Customers

Your Privacy Choices: Opt out of Sale or Sharing of Your Personal Information.

Like most online businesses, we do share some Information with contracted third parties in order to provide better services and advertising to you. This may be considered a “sale” of personal information under the CCPA or a share for cross-context behavioral advertising.

The categories of personal information that we “share” or “sell” for advertising purposes are:

• Online identifiers and contact information;
• Device information;
• Usage activity; and
• Any other information collected through automated technologies.

We may “sell” or “share” this personal information with the following types of third parties: online advertising partners and providers of analytics services.

We may also sell to or share your personal information, including but not limited to your sensitive personal information, in order to provide you with more opportunities to seek employment with other companies, to help potential employers identify you as a good candidate for their roles, and/or to work with employers in their diversity, equity and inclusion efforts. The categories of personal information that we sell or share with our Customers or other companies includes:

• Identifiers and contact information.
• Employment or education information.
• Demographic information.
• Inferences.

Sensitive personal information.

We may “sell” or “share” this information with the following types of third parties: Gem Customers, such as recruiters and companies seeking job applicants.

You or your authorized agent have the option to opt-out of sharing this Information. You may submit a request to opt-out for selling/sharing with online advertisers through the Your Privacy Choices link in the footer, and for non-cookie based information and information shared with Customers through our online request portal. You may also submit a request to opt-out by emailing us at support@gem.com.

We do not knowingly “sell” or “share” the personal information of children under 16.

Retention.

We will retain and process your Information only for as long as is necessary for the purposes for which it is collected, and to the extent necessary to comply with our legal obligations under applicable law. In determining how long to retain Information, we consider the nature and sensitivity of the Information, the purposes for which we process the Information, and applicable legal requirements. The purposes for which we process Information (as well as the other factors) may dictate different retention periods for the same types of Information. For example, we may retain your email address as an authentication credential (where applicable) as long as you have an account with us and an additional period of time after that for our fraud and legal compliance purposes. We may delete or de-identify your Information sooner if we receive a verifiable deletion request, subject to exemptions or requirements under applicable law, or when it is no longer needed to fulfill these purposes.

Right to Non-Discrimination.

You have the right not to receive discriminatory treatment by us for the exercise of any of your rights.

Shine the Light.

Customers who are residents of California may request (i) a list of the categories of personal information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. We do not provide such personal information to third parties for their own marketing purposes.

Nevada residents

If you are a resident of the State of Nevada, Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. To submit such a request, please contact us at support@gem.com.

Will we change the Privacy Policy?

We’re constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time as well. We post any changes we make to our Privacy Policy on this page and, where appropriate, we will provide you with reasonable notice of any changes before they take effect. The date the Privacy Policy was last updated is identified at the bottom of this page. Use of information we collect now is subject to the Privacy Policy in effect at the time such information is used.

How should you contact Gem?

If you have any questions about our privacy policy or wish to exercise your rights as an individual, please do so by emailing us at support@gem.com.

Our main office address is 1 Post Street, 18th Floor, San Francisco, CA 94104, USA.

Last Modified: January 9, 2024

• What information do we collect and for what purpose?
• How we use your information
• Your Rights and Choices
• Your Privacy Choices.
• Additional disclosures for California residents (THE “CALIFORNIA PRIVACY NOTICE”)