1.0 When does Billtrust’s Job Applicants Privacy Notice apply?
This privacy notice (also referred to as the “Privacy Policy” or “Notice”) only applies to the personal data of job applicants, potential candidates for employment, and our optional recruiting programs and events (collectively referred to as “candidates” or “you” or “your”) within the European Union (EU), the European Economic Area (EEA), Switzerland, and the United Kingdom.
Billtrust may process your personal data as data controller in connection with Billtrust recruitment processes and programs. Throughout this document the words “Billtrust” “we” “us” “our” or the “Company” may be used to refer to BTRS Holdings Inc., and its subsidiaries and/or affiliates (also referred to as the “Company” or “Billtrust” or “we” or “us”).
Personal Information (also referred to as “information”, “data” or “Personal Data”) refers to all information that relates to an identified or identifiable individual. For example, your name, address, email address, education, and employment background.
This Notice does not form part of a contract of employment and may be updated at any time. We will post a revised Notice on our website if we make any substantial updates. It is important you read this Notice, so that you are aware of how and why we are using your personal information.
2.0 What information does Billtrust collect about you and why and how do we use it?
We usually collect personal information directly from you, when you apply for a role with us or when you send us your application, or from third parties such as professional recruiting firms or previous employers.
We will only collect personal information that is necessary for the purpose for which it is processed; and we will only use such information fairly, in a way that is proportionate to the intended purposes for processing, and for specified and lawful purposes. We will not process information in a manner that is incompatible with those purposes or with local laws that may apply.
We are providing the following list of personal information we may collect, where legally permissible:
- Contact information, such as your name, email address, personal telephone or mobile number, work and/or home address, and other business contact details;
- Identification information required under applicable Immigration laws, such as your nationality, visa, right to work permit information, government-issued identification information, immigration status and other information that would allow us to verify your employment eligibility under immigration laws, photographs, or other similar identifiers;
- Biographical information, lifestyle and social circumstances, including gender, age, date of birth, professional history, type of employment desired, willingness to relocate, social media profiles and activity, information in your company biography, languages spoken, nationality;
- Employment details, including work history, previous employers, positions, dates, job title and function, work status, pre-employment screenings where permitted by law, salary and other benefits, job performance and other capabilities, and CVs;
- Education and application details, such as education/qualifications, CVs and resumes;
- Compensation, benefits and payroll information, such as current and expected salary and bonus details;
- Performance information, such as employer feedback;
- Sensitive Information, such as health information regarding disabilities and/or background screening where permitted by law;
The Legal basis for our processing of personal data, which is not a special category of personal data, are:
- to take steps at your request prior to entering into the performance of a contract with you;
- to comply with our legal and regulatory obligations;
- to protect your vital interests or the vital interests of another person or
- for our legitimate interests and that interest is not overridden by your own interests.
We process special categories of personal data only where you have provided your explicit consent or for the purposes of carrying out the legal obligations and exercising specific rights of Billtrust or yourself related to employment.
In the table below, we describe the purposes for which we collect and use information about you.
| Purpose | Description of Purpose | Categories of Personal Information | Legal basis for EU and UK employees |
|---|---|---|---|
| Candidate prospecting and further communications along the recruitment process | We process your personal data to identify potential candidates for a vacant position or for potential employment. In case your profile would match we will process the personal data to communicate with the candidates. | Contact information as described above. | Legitimate interest to carry out recruitment procedure and manage hiring process. |
| Assessment | We process your personal data in order to assess the suitability of your candidacy against our job opportunities. | Contact information, Biographical information, lifestyle and social circumstances, employment details and education and application details as listed above. | Legitimate interest to carry out recruitment procedure and manage hiring process. |
| Information verification | We process your personal data in order to verify information you provided or that we collected about you (where applicable), to prevent mistakes, fraud or/and any other consequence of incorrect information. | Contact information, Employment details, education and application details, compensation, benefits and payroll information, performance information and sensitive information as listed above. | Legitimate interest to carry out recruitment procedure and manage hiring process. Necessity to comply with a legal obligation. |
| Appointment of new staff | We process your personal data in order to appoint new staff. | Contact information, Employment details, education and application details, compensation, benefits and payroll information, performance information and sensitive information as listed above. | Legitimate interest to carry out recruitment procedure, manage hiring process and appoint workforce correctly. Necessity for performance of a contract. To protect your vital interests or the vital interests of another person. |
| Management of resources and workforce planning | We process your personal data in order to manage human resources, workforce planning and operations. | Employment details, education and application details, compensation, benefits and payroll information, performance information and sensitive information as listed above. | Legitimate interest to carry out recruitment procedure, manage hiring process and appoint workforce correctly. Necessity for performance of a contract. |
| Compliance with laws | To the extent permitted by law in the relevant country, we process your personal data to comply with diversity and inclusion requirements and practices and with a legal obligation (including obligations under employment law). | Contact information, Employment details, education and application details, compensation, benefits and payroll information, performance information Biographical information, lifestyle and social circumstances, sensitive information as listed above. | Necessity to comply with a legal obligation. |
3.0 For how long do we retain your personal information?
In general, Billtrust retains your information for no longer than is necessary for the purposes for which the information is collected. Our retention periods are based on business needs and legal requirements. In addition to using applicant data for the position for which you have applied, Billtrust may retain and use your data to consider you for other positions. Unless required for tax or other legal purposes, your data will be retained for a maximum of 12 months (or less where required by law). If you do not want to be considered for other positions or would like to have your data erased, please contact:
[email protected] If you accept an offer of employment by us, any relevant personal information collected during your pre-employment period will become part of your personnel records and will be retained in accordance with specific country requirements.
4.0 When and how do we share your personal information?
Under no circumstances does Billtrust sell your personal information.
Your information will only be shared if it is necessary to do so and will be limited to what is necessary.
As a global company, we may share your personal information within our organization with internal employees who participate in the recruitment process and with subsidiaries and affiliates under the control of our corporate parent, for purposes consistent with this Notice. Your information may be stored and processed outside of the country or region where it was originally collected including the United States.
Where necessary, your personal information may be shared with third party service providers; for example, interview and assessment services, background and employment check service providers.
In some cases, third-parties may collect information from you directly, in which case the terms of their privacy policies will apply.
Where necessary, your personal information may be shared with public and government authorities, which may include (i) mandatory requests in connection with national security or law enforcement purposes or (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.
5.0 Transfer of EU, Switzerland and UK Personal Information
The Company may disclose EU, Switzerland and UK Personal Information outside of the EU, Switzerland and UK to fulfil the purposes described above. This may include transferring EU, Switzerland and UK Personal Information to other countries (including countries other than where an EU, Switzerland and UK Employee is based and located outside the European Economic Area (“EEA”), Switzerland and UK) that have different data protection regimes and which are not deemed to provide an adequate level of protection for EU, Switzerland and UK Personal Information. To ensure that your EU, Switzerland and UK Personal Information is sufficiently protected when transferred outside the EEA, Switzerland and UK the Company has put in place appropriate safeguards in place, such as data transfer agreements incorporating the EU’s standard contractual clauses and reliance on the Data Privacy Framework.
6.0 EU – U.S. Data Privacy Framework
BTRS Holdings Inc. with its covered entity, Factor Systems LLC d/b/a Billtrust (“Billtrust”) complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Switzerland-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles with regard to the processing of job applicant Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have also certified to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles with regard to the processing of job applicant Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF (collectively, the “DPF Principles”). To learn more about the DPF, and to view our certification, please visit https://www.dataprivacyframework.gov/, and https://www.dataprivacyframework.gov/list
search, respectively. Billtrust commits to applying the DPF’s Principles to all Personal Information covered by this Notice that Billtrust receives in the U.S. from the European Economic Area member countries, the United Kingdom, and Switzerland in reliance on the respective DPF. Billtrust is subject to the investigatory and enforcement powers of the United States Federal Trade Commission.
6.1 Accountability for Onward Transfers
Billtrust may share job applicant Personal Data with our service providers and suppliers (“Agents”) as described in Section 6.0, above for the purposes described in Section 4.0 above and to support our job applicant needs. Billtrust will obtain assurances from our Agents that they will safeguard job applicant Personal Data consistent with this DPF Notice and will use and transfer of job applicant Personal Data only for limited and specific purposes. Billtrust maintains contracts with our Agents obligating the Agent to provide at least the same level of protection as is required by the relevant DPF Principles. Billtrust remains liable for the protection of your Personal Data that we transfer to our agents, except to the extent that we are not responsible for the event giving rise to any unauthorized or inappropriate processing.
6.2 Choice and Access
The information we collect under this Notice is only shared with third parties for the purposes described in this notice. We will not share data with third parties in a way that is incompatible with the purposes for which your information has been collected (as described in this Notice). If Billtrust ever intends to transfer job applicant Personal Data to non-agent third parties acting as controllers, or for a purpose not described in this notice, Billtrust will apply the Notice and Choice Principles, unless a specific exception applies under European data protection law applies, and will obtain assurance from such parties that they will provide the same level of protection as is required under the DPF Principles. Such Choice Principle will allow you to opt out of or limit any such transfer, and exercising this choice will not be used against you (e.g. to restrict employment opportunities or to take any punitive action against you). Please see Section 8, below, for more information about your right to Access.
6.3 Required Disclosure
Under certain circumstances, Billtrust may be required to disclose your Personal Data in response to lawful requests by public authorities, including to meet national security, public interest, or law enforcement requirements. Billtrust’s adherence to the DPF Principles may therefore be limited (a) to the extent necessary to meet applicable national security, public interest, or law enforcement requirements; (b) by statute, government regulation, or case law that creates conflicting obligations or explicit authorizations; or (c) if any lawful exceptions or derogations are applicable.
7.0 How is personal information protected?
Billtrust has implemented appropriate technical, physical, and organizational measures designed to protect your personal information against unlawful or accidental destruction, loss, damage, disclosure or access as well as all other forms of unlawful processing. Our internal Information Security Policy requires employees who have access to your data to comply with the standards as described therein.
Access to Personal Information within the Company will be limited to those who have a need to know the information for the purposes described above, and may include personnel in HR, IT, Compliance, Legal, and Internal Audit. All personnel will generally have access to your contact information such as name and email address.
We may engage third parties to process Personal Data for and on behalf of Billtrust. We require such third parties to process Personal Data and act strictly on our instructions and to take appropriate steps to ensure that Personal Data remains protected.
We may transfer your personal data to other group companies, IT providers and other third-parties located in other countries. The countries in the European Economic Area are considered to provide the same level of protection to personal information. Where we transfer personal information or share it with others outside the European Economic Area, we will ensure that we and those persons or companies who we transfer it to agree to protect it from improper use or disclosure, in accordance with data protection law by standard contractual clauses or other appropriate mechanisms.
The Company has put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach of your Personal Information where we are legally required to do so.
8.0 Your Rights
You may have the following rights available to you:
- Right to access data – the right to be informed of the personal data that we hold about you.
- Right to object to certain types of processing – For example in relation to direct marketing.
- Right to have personal data rectified – This means that inaccurate data must be corrected.
- Right to erasure or right to be forgotten – In limited circumstances, you have the right to have data erased.
- Right to data portability – you have the right to receive certain types of information in a format that can be transferred to another service provider.
- Right to restriction of processing – In limited circumstances, you may request that (part of) your personal information be no longer available to some users.
If you have any queries or complaints about this Notice, please contact us in writing at [email protected].
If you feel we have not sufficiently addressed your complaint or concern, you have the right to complain to a data protection authority about our collection and use of your personal information. Contact details for data protection authorities in the European Economic Area are available here); contact details for data protection authority in the United Kingdom are available here).
9.0 Recourse, Enforcement and Liability
Billtrust encourages individuals to raise any concerns they have using the contact information below. Billtrust will investigate and attempt to resolve any complaints and disputes regarding our collection, use, and disclosure of Personal Data to the extent possible within 45 days and in accordance with the DPF Principles.
If a complaint or dispute cannot be resolved through Billtrust’s internal processes, Billtrust has agreed to cooperate with the EU and UK data protection authorities and the Swiss Federal Data Protection and Information Commissioner to provide appropriate recourse free of charge to you. Billtrust will participate in the dispute resolution procedures of the panel established by such data protection authorities for this purpose.
If your dispute or complaint related to your Personal Data that we received in reliance on the EU-U.S. DPF or Swiss-U.S. DPF cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.
10.0 Questions or Complaints
Billtrust has a privacy team to oversee compliance with this Notice. Please contact [email protected] with any questions or complaints regarding this Notice or the Company’s privacy practices. If you feel we have not sufficiently addressed your complaint or concern, you have the right to complain to a data protection authority about our collection and use of your personal information. Contact details for data protection authorities in the European Economic Area are available here; contact details for data protection authority in the United Kingdom are available here; contact details for the Federal Data Protection and Information Commissioner are available here.