Legal: Candidate Privacy Notice

Summary of Key Points

To help you understand how we handle your personal data, here are the key highlights:

1. Your personal data is collected to evaluate your job application and includes resume details, interview recordings, and assessment results.

2. The hiring process may include a recorded interview. From the interview recordings, we may extract audio and video data that does not reveal what was said or shown, cannot be reverse-engineered to recover original content, and is not used to uniquely identify you; this data may constitute “biometric information” under certain privacy and/or biometric laws (“Deepfake Data”).

3. Resumes, interview recordings, Deepfake Data, and assessment results may be used for fraud prevention and security verification. Resumes, interview recordings and assessment results may also be used to evaluate your qualifications for the role. We will not use your interview audio or video content to train AI models. Pindrop may use resumes and Deepfake Data to improve the accuracy of our fraud detection systems.

4. We may use AI-assisted and other technology tools to support our application and interview process. During your interviews, we may use one ormore such tools, such as a security assistant or a notetaker. You will be informed about tools being used and will have the opportunity to decline the tool(s) you are not comfortable with. Declining a tool turns off only that specific tool and stops it from processing any data.Other tools you have not declined will continue to operate. See Section 10, Pindrop’s Use of AI and Technology in Hiring, for details.

5. Your data is stored primarily in the U.S., with safeguards for international transfers where required.

6. We retain interview recordings and Deepfake Data for up to 90 days, and standard application-related data for up to four years (US applicants) or one year (non-US applicants). See Section 7, Data Retention, for details.

7. You have choices about your data, including the ability to access, correct, and delete your data. Contact [email protected] for requests.

For full details, please continue reading below:

1. Introduction

Pindrop Security, Inc. and our affiliated companies (i.e., entities that control, are controlled by, or are under common control with Pindrop Security, Inc.) (together, “Pindrop”, “we”, “our” or “us”) value your privacy and are committed to protecting your personal data. When you apply for a job with us, we collect and process certain information about you to manage the hiring process. This notice explains what data we collect, how we use it, who we share it with, and the rights you have regarding your information. This notice supplements, and should be read together with, our general Privacy Policy available at https://www.pindrop.com/privacy/. In the event of any inconsistency between this Candidate Privacy Notice and the general Privacy Policy, this Candidate Privacy Notice governs with respect to applicant data.

This notice applies to all candidates regardless of location.

If you are a California resident, Section 12, Additional Privacy Information for California Residents, describes additional rights you have under applicable California privacy laws.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, Section 13, Additional Information for Applicants in the EEA,UK, and Switzerland, describes additional rights you have and othere details specific to those locations.

2. Personal Data We Collect

During the hiring process, we may collect the following types of personal data:

Basic Details/Identifiers: Your name, alias, or unique personal identifier, email address, phone number, address and other personal contact information, nationality, and work eligibility; IP address and other online identifiers.
Professional or Employment-Related Information: Your CV, cover letters and work history, references, professional membership records, qualifications, performance information, attendance records, conduct information (including disciplinary and grievance records), assessment records, termination data and any additional information you provide.
Education Information: Your degrees earned, educational institutions attended, transcripts, training records, and other information about your educational history or background.
Assessments and Interview data: Results from skills assessments, including those conducted by external service providers, and interview notes. Some tests may include video, audio, screen activity, and data monitoring, recording, and verification to ensure fairness and prevent fraud.
Internet or Other Electronic Network Activity Information Your browsing history, search history, and information regarding your interaction with an internet website or application, as well as physical and network access logs and other network activity information related to your use of any company device, network, or other information resource.
Recorded Interviews and Biometric Information: Your interview may be recorded, including all video, audio, and other recordable data. Certain voice-or video-derived technical features (like the Deepfake Data (as defined under the Summary of Key Points above) that, while not capable of uniquely identifying an individual; may be considered ‘biometric data’ or ‘biometric information' under certain privacy and biometric laws.
- Pindrop processesDeepfake Data for security verification and fraud prevention purposes, not to establish or verify a candidate’s identity. Pindrop requires security verification aspart of the interview process; candidates who are unable to complete security verification may not be able to proceed with the interview.
- Effect of declining or withdrawing consent for a tool: If you decline or withdraw consent for a particular tool (see Section 10, Pindrop's Use of AI in Hiring), we will stop that tool from furtherprocessing your data. Data already collected by the tool prior to your withdrawal remains subject to the applicable retention schedule in Section 6. We will not attempt to reidentify you from aggregated or deidentified data.
Audio, Electronic, Visual, Thermal, or Similar Information. The video and audio recordings of interviews, as well as screen activity collected during assessments. From these recordings, we may extract Deepfake Data (as defined in the Summary of Key Points section above).
Location Data. Your general location information (such as country or region) inferred from IP address; does not include precise geolocation.
Inferences drawn from the information identified above to evaluate a candidate’s qualifications, such as skills, competencies, aptitude, or fraud risk determinations generated through interview processes or skills assessment tools.
Characteristics of Protected Classiﬁcations. Your race/ethnicity, gender, sex, veteran status, disability, and other characteristics of protected classiﬁcations under applicable law. Generally, this information is collected on a voluntary basis and is used in support of our anti-discrimination efforts, reporting obligations, or where otherwise required by law.
Sensitive Personal Information. Certain government identifiers, immigration or citizenship information, and health information about you (e.g., as necessary to provide reasonable accommodations).

Background checks: Conducted after a job offer is made, where required by law or applicable to the role.

In some cases (such as where required by law), we may ask for your consent or give you certain choices prior to collecting or using certain personal information.

3. Sources of Personal Information

In general, we may collect the personal information identified in this notice from the following categories of sources:

Directly from you
Through third-party recruiters and recruiting platforms
Through third-party service providers (e.g. background screeners, skills assessors, etc.)
From publicly available sources
From referrals and references
From affiliates and subsidiaries

4. Why We Process Your Personal Data

We process your personal data only for the purposes disclosed in this notice and for no other purpose. We process your personal data to:

Assess your qualifications and suitability for the role.
Communicate with you about your application and interview process.
Verify the information you provide, including references and work eligibility.
Conduct pre-employment assessments where applicable.
Ensure a fair, secure, and efficient recruitment process.
Comply with legal and regulatory obligations.
Secure our resources, networks, premises, and assets, including to detect, prevent, investigate, and respond to suspected or alleged misconduct, use of synthetic, AI-generated or other manipulated content, violations of company policies, and fraudulent activity.
Improve the accuracy of our AI-powered fraud detection systems, including but not limited to analyzing your CV and Deepfake Data.
Protect and defend our rights and interests and those of third parties, including to manage and respond to legal claims or disputes, and to otherwise establish, defend, or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties.
Make hiring decisions with appropriate human oversight (see Section 10, Pindrop's Use of AI in Hiring, for information about our use of AI in hiring).

5. How We Share Your Personal Data

We limit access to your personal data to those involved in the hiring process. This may include:

Internal teams: Recruiters, hiring managers, and relevant team members.
Service providers: External vendors supporting our recruitment efforts, such as background check providers, assessment platforms, HR systems, and fraud detection service providers who provide services or perform functions on our behalf, as described in this notice.
Affiliated companies: If relevant to your hiring process, we may share data within our corporate group.

Your personal data will not be sold or shared with unauthorized third parties. If we engage a service provider to process data on our behalf, they are required to handle it securely and in compliance with applicable laws.

6. International Data Transfers

Because Pindrop is a global company, your personal data may be transferred outside of your home country, including to the United States, where our primary data storage is located. For candidates applying from the European Economic Area (EEA) or United Kingdom (UK), we use Standard Contractual Clauses (SCCs) or similar safeguards to ensure compliance with data protection laws. If you would like more details on these safeguards, you may contact us.

7. Data Retention

We retain candidate data as follows:

Interview recordings and Deepfake Data are retained for up to 90 days from the date of each interview and permanently destroyed thereafter, unless a shorter retention period applies or longer retention is required by law.
For applicants located in the United States, standard application data (such as resumes, cover letters, interview notes, and assessment results) is retained for up to four years following the conclusion of the hiring process.
For applicants located outside the United States, standard application data is retained for up to one year following the conclusion of the hiring process.

If required by law, we may retain data for a longer period. If you are not selected for a position, we may retain your application materials for the periods above so that we may consider you for other roles, unless you explicitly request deletion or opt out of consideration for future openings. If you request deletion of your data or withdraw your application, we will delete your data, subject to legal or contractual obligations, system backups, and a reasonable administrative period to complete deletion. You may also opt out of consideration for future openings without requesting full deletion of your data.

8. Your Privacy Choices

You may choose to take the following action over your personal data:

Access – You can request a copy of the data we hold about you.
Correct – If any of your data is incorrect, you can request that we update it.
Delete – You may request that we delete your data, subject to legal requirements.
Portability – If processing is based on a contract or consent, you can request a transferable copy of your data.

To exercise these rights, contact us at [email protected], submit a request through our webform, or write to us at Pindrop Security, Inc., 1115 Howell Mill Rd, Ste 700, Atlanta, GA 30318. We will respond in accordance with applicable laws.

To respond, we will take steps to verify your request by matching the information provided by you with the information we have in our records. Your request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative (i.e., by completing all required fields on our webform if you choose to submit a request in that manner).
Describe your request with sufficient details that allows us to properly understand, evaluate, and respond to it.

In some cases, we may request additional information to verify your request or where necessary to process your request.

‍Authorized Agents. Authorized agents may initiate a request on behalf of another individual through one of the above methods; authorized agents will be required to provide proof of their authorization, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

9. Data Security

We implement security measures designed to protect your personal data from unauthorized access, loss, or misuse. However, no system is completely secure, and online data transmission carries inherent risks. We encourage you to use strong passwords and avoid sharing sensitive information over unsecure channels.

10. Pindrop’s Use of AI in Hiring

We may use AI-assisted and other technology tools to support our application and interview process, including to administer skills assessments, prioritize applications for human review, take notes during interviews, and assess the integrity of candidate submissions and interviews.

For application prioritization, our tools may analyze your work experience and skills to assess fit for a role, but do not consider your name or contact details. Applications with the strongest match to job requirements are prioritized for human review; not all applications may be individually reviewed.

If you are invited to complete a skills assessment, our assessment provider may use AI and other tools to administer the assessment and help ensure assessment integrity.

To help assess the integrity of candidate submissions and interviews, our tools may analyze information associated with your application, assessment, or interview, including contact information, resume content, technical signals associated with your submission, and interview recordings.

11. Updates to This Notice

We may update this notice from time to time. If changes are significant, we will notify you in advance where required. Otherwise, we encourage you to check back periodically to stay informed.

For any questions, please contact us at [email protected], submit a request through our webform, or write to us at Pindrop Security, Inc., 1115 Howell Mill Rd, Ste 700, Atlanta, GA 30318. We will respond in accordance with applicable laws.

12. Additional Privacy Information for California Residents

This section of the notice provides additional information for California that, together with the prior sections of this notice, are intended to satisfy our notice and privacy policy requirements under the California Consumer Privacy Act and related regulations as amended (collectively, the “CCPA”). This section applies to “personal information” as defined in the CCPA, whether collected online or offline. This section does not address or apply to our handling of publicly available information or personal information that is otherwise exempt under the CCPA.

Categories of Personal Information Collected. The list in Section 2, Personal Data We Collect above and the additional list below generally identify the categories of personal information relevant for California that we may collect and may have collected in the prior twelve (12) months.

Categories of Personal Information Described in Cal. Civ. Code § 1798.80. Such as records containing personal information, such as name, signature, photo, contact information, education and employment history, or certain government identiﬁers.
Education Information. We collect the education information described in Section 2, Personal Data We Collect above. For California residents, this category doesnot include education details that are publicly available personallyidentiﬁable information as deﬁned under the Family Educational Rights and Privacy Act.
Inferences drawn from the information identified above to evaluate a candidate’s qualifications, such as skills, competencies, aptitude, or fraud risk determinations generated through interview processes or skills assessment tools.
Sensitive Personal Information. Such as certain government identifiers, racial/ethnic origin or sexual orientation (e.g., on a voluntary basis to support of our anti-discrimination efforts, reporting obligations, or where otherwise required by law), immigration or citizenship information, and health information (e.g., as necessary to provide reasonable accommodations).

Sales and Sharing of Personal Information. California privacy laws define a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. We do not sell or share (as defined by the CCPA) personal information or sensitive personal information related to candidates, including those we know who are under sixteen (16) years of age.

Sensitive Personal Information. Notwithstanding the purposes described in Section 4, Why We Process Your Personal Information, we do not collect, use or disclose sensitive personal information about candidates beyond the purposes authorized by the CCPA. Accordingly, we only use and disclose sensitive personal information about candidates as reasonably necessary and proportionate: (i) to perform our services requested by you; (ii) to help ensure security and integrity, including to detect, prevent, and respond to malicious, fraudulent, deceptive, or illegal conduct, including the use of synthetic, AI-generated, or manipulated content and impersonation attempts; (iii) to verify or maintain the quality and safety of our services; (iv) for compliance with our legal obligations; (v) to our service providers who perform services on our behalf; and (vi) for purposes other than inferring characteristics about you.

Your CCPA Rights. California candidates have certain rights under the CCPA with respect to their personal information, subject to certain limitations and exceptions:

Know/Access. The right to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
Deletion. The right to request deletion of their personal information that we have collected from them.
Correction. The right to request correction of inaccurate personal information we maintain about them.
Opt-Out of Sales and Sharing. The right to opt-out of the sale and sharing of their personal information. However, as discussed above, we do not sell or share candidate personal information.
Limit Use and Disclosure. The right to request to limit certain uses and disclosures of sensitive personal information. However,
as discussed above, we do not use or disclose candidate personal information beyond the purpose authorized by the CCPA.
Non-Retaliation. The right not to be subject to retaliatory treatment for exercising their rights under the CCPA.

Submitting CCPA Requests. Candidates may submit a request to us to exercise their CCPA rights to know/access, limit, delete, and to correct their personal information held by us by submitting a privacy request to us online through our webform located at or via an email to [email protected]. See Section 8, Your Privacy Choices, for more details on the submission process.

13. Additional Information for Applicants in the EEA, UK, and Switzerland

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, the following additional information applies to our processing of your personal data:

Data Controller

The data controller for your personal data is Pindrop Security, Inc., 1115 Howell Mill Rd, Ste 700, Atlanta, GA 30318, USA. You may contact our Data Protection Officer at [email protected].

Legal Basis for Processing

We rely on the following legal bases to process your personal data:

Contractual Necessity: To take steps at your request prior to entering into an employment contract (e.g., evaluating your application).
Legal Obligation: To comply with applicable laws (e.g., verifying eligibility to work).
Legitimate Interests: To protect our business interests, including fraud prevention, network security, and improving our hiring processes, provided these interests are not overridden by your rights and interests. For fraud prevention, we rely on Article 6(1)(f) and, where processing may involve special category data, Article 9(2)(f). Pindrop requires security verification as part of the interview process; candidates who are unable to complete security verification may not be able to proceed with the interview.
Consent: For the processing of interview recordings and related special categories of data, including where such processing may constitute biometric data collection under applicable law.

Your GDPR Rights

In addition to the choices described in Section 8, Your Privacy Choices, you have the following rights:

Restriction: You may request that we restrict the processing of your data in certain circumstances.
Objection: You may object to processing based on legitimate interests.
Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.
Erasure (Deletion): You may request that we erase your personal data in certain circumstances, as provided under Article 17 of the GDPR, subject to applicable legal exceptions.
Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

See Section 8, Your Privacy Choices, for details on how to submit your request.

International Transfers

Your personal data will be transferred to the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and UK Information Commissioner’s Office to ensure your data remains protected during such transfers. See Section 6, International Data Transfers, for more details.

‍

Archived versions

No items found.