GDPR Privacy Notice

QuinStreet, Inc. (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Recruitment Privacy Notice (“Notice”) explains how we collect, use, disclose, retain, and protect personal data about you in connection with our recruitment and hiring processes. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

For the purposes of the European Union’s (“EU’s”) General Data Protection Regulation (“EU GDPR”), all relevant EU member state laws or regulations implementing or giving effect to the EU GDPR, the United Kingdom’s (“UK’s”) implementation of the EU GDPR (“UK GDPR”) and the UK’s Data Protection Act 2018, (together, “GDPR”), the Data Controller (as defined in the GDPR) is QuinStreet, Inc., 950 Tower Lane, Floor 12, Foster City, CA 94404, United States.

Where you apply for a job opening posted by us, this Notice will apply to our processing of your personal data.

Where you apply for a role through a job board or similar online service provider ("Partner"), that Partner may also act as an independent Data Controller of your personal data. The Partner may retain your personal data and may receive information from us about the status of your application. Any use of your personal data by a Partner is governed by the Partner's own privacy notice, not this Notice.

Where you apply through a recruitment agency, the agency may also process your personal data under its own privacy notice. We may receive your personal data from the agency as part of the application process.

Information we collect about you

We collect and process some or all of the following types of personal data about you:

• Identity and contact details (such as name, email address, postal address, telephone number, and country of residence) (“Identity/Contact Data”)
• Professional and employment information (such as employment history, qualifications, skills, experience, resume/CV, cover letter, and work eligibility or immigration information, where relevant to the role) (“Employment Data”)
• Application materials and correspondence (including information submitted by email, or in person at interviews) (“Application Data”)
• Interview notes, assessments, and feedback from our staff and interviewers (“Interview Data”)
• Compensation expectations and current notice period and post-termination restrictions, where you choose to provide them (“Current Employment Data”)
• References and referee details, where you provide them (“Reference Data”)
• Records of your progress through our recruitment and assessment process (“Records Data”)
• Health information provided by you, to allow us to make reasonable adjustments (“Health Data”)
• Any other information you voluntarily include in your application or communications with us (“Other Data”)

Although most information is collected directly from you, we may also receive personal data from recruitment agencies and executive search firms, job boards and application platforms, referees and former employers, background, credential, or employment verification providers (where used), and professional networking or public sources, where relevant and lawful.

Legal basis for the use of your information

We rely on the following legal bases when collecting and using your personal data:

• As necessary to evaluate and potentially your request to enter an employment or engagement relationship with us (“Contractual Necessity”);
• With your consent, which you may withdraw at any time to the extent permitted by applicable law (“Consent”);
• To comply with our legal obligations (“Compliance with Law”);
• For our legitimate interests, including our interests in considering candidates for current and future employment opportunities and in managing and improving our recruitment and hiring processes, unless those interests are overridden by your interests or fundamental rights and freedoms (“Legitimate Interests”); and
• In respect of sensitive personal data, such as health information, to comply with our obligations under employment law, such as our obligation to make reasonable accommodations for any disabilities (“Compliance with Employment Law”).

Purposes of processing

We use information held about you in the following ways:

• To consider your application in respect of the role you have applied for.
• To consider your application in respect of other roles.
• To communicate with you in respect of the recruitment process.
• To enhance any information that we receive from you with information obtained from third party data providers, (together, “Recruitment Purposes”).

We may also use information held about you:

• For compliance and protection purposes, e.g., the establishment, exercise or defence of legal claims (“Compliance/Protection Purposes”).
• In the context of actual or prospective corporate events (“Corporate Event Purposes”).
• For further uses, in which case we will ask for your consent if the further use(s) is/are not compatible with the initial purpose for which your information was collected (“Further Purposes”).

In the table below we have set out in detail the purposes for which we may process your personal data, the categories of personal data typically used for the relevant purpose, and the legal bases we rely on in respect of each such purpose (including details of any legitimate interests pursued, where applicable).

Processing activities	Personal Data	Legal basis
Recruitment Purposes	Identity/Contact Data Employment Data Application Data Interview Data Records Data	Contractual Necessity (where necessary to take pre-contractual steps relating to your potential employment and/or contractual steps relating to your actual employment). Legitimate Interests (we have a legitimate interest in assessing your application and managing the recruitment process).
Compliance/Protection Purposes	Any and all data categories, depending on the circumstances	Compliance with Law. Compliance with Employment Law. Legitimate Interests (where Compliance with Law is not applicable, we (and any relevant third parties) have a legitimate interest in participating in, supporting and following legal process and requests, including through co-operation with authorities. We (and any relevant third parties) may also have a legitimate interest in ensuring the protection, maintenance and enforcement of our (and their) rights, property and/or safety.
Corporate Events Purposes	Any and all data categories relevant in the circumstances	Legitimate Interests. We (and any relevant third parties) have a legitimate interest in providing information to relevant third parties who are involved in an actual or prospective corporate event.
Further Purposes	Any and all data categories relevant in the circumstances	The original legal basis relied upon if the relevant further use is compatible with the initial purpose for which the personal data was collected; otherwise, Consent.

Automated decision making/profiling

We may use automated tools to help identify appropriate candidates for us to consider based on criteria expressly identified by us, or typical in relation to the role for which you have applied. This process of finding suitable candidates is therefore automated, however, any decision as to whom we will engage to fill the job opening will be made by our staff and is not automated.

Disclosure of your Information

We share personal data only as necessary for the purposes described in this Notice and subject to appropriate safeguards. Recipients may include:

• Service providers such as our recruitment platform provider and background, reference and employment verification providers, where used for a role
• QuinStreet group companies or Partners hiring on our behalf, where relevant to the role or entity posting the vacancy
• Professional advisers such as lawyers, auditors, or immigration advisers, where necessary
• IT, cloud hosting, communications, and security providers who support our systems
• Recruitment agencies and job board partners, where you applied through them or where necessary to manage the application
• Parties involved in corporate events, in the context of actual or prospective business transactions (e.g., investments in and financings of QuinStreet, public share/stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares)
• Regulators, courts, law enforcement, and other authorities, where required by law or to establish, exercise, or defend legal claims

We require service providers acting as Data Processors (as defined in the GDPR) to protect your personal data and to process it only on our instructions.

How we store your personal data

We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. We take steps to ensure that those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means.

Where we store your personal data

Your personal data will be transferred to, stored in, and processed in the United States and potentially other countries outside the UK and European Economic Area (“EEA”) where we or our service providers operate. Data protection laws in those countries may not provide the same level of protection as the laws in your country. When we transfer personal data outside the UK or EEA, we ensure that appropriate safeguards are in place by making sure that at least one of the following mechanisms is implemented:

• Transfers to territories with an adequacy decision. We may transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the EU Commission or UK government from time to time.
• Transfers to territories without an adequacy decision. We may transfer your personal data to countries that have not been deemed to provide an adequate level of protection for personal data by the EU Commission or UK government. In these cases:
  • we may use specific appropriate safeguards, which are designed to give personal data effectively the same protection it has in the EU and UK (e.g., the EU Commission’s ‘Standard Contractual Clauses’ or the UK’s International Data Transfer Agreement); or
  • in limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer your personal data to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’, e.g., reliance on your explicit consent to that transfer or because it is necessary for the establishment, exercise or defence of legal claims (including regulatory, administrative or any out-of-court procedure, and seeking advice).

You can contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK. You may have the right to receive a copy of the appropriate safeguards under which your personal data is transferred.

How long we keep your personal data

We retain recruitment data for up to 12 months from the date of our last meaningful contact with you in connection with recruitment. Unless you require deletion before that time, you will receive an email asking if you’d like us to keep your personal data for a longer period for future opportunities. If you do not reply, your personal data will be deleted.

Your rights

In certain circumstances, you may have the following rights in relation to your personal data:

• to access to your personal data and to be provided with certain other supplementary information that this Notice is already designed to address
• to us to correct any mistakes in your personal data which we hold
• to require the erasure of personal data concerning you in certain situations
• to receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to a third party in certain situations
• to object at any time to the processing of personal data concerning you for direct marketing
• to object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
• to object in certain other situations to our continued processing of your personal data
• to otherwise restrict our processing of your personal data in certain circumstances.

If you would like to exercise any of those rights, please:

• contact us using our contact details below,
• let us have enough information to identify you,
• let us have proof of your identity and address, and
• let us know the information to which your request relates.

How to complain

We hope that we can resolve any query or concern you raise about our use of your personal data. If you wish to complain to us please contact QuinStreet’s Employee Benefits and Compliance at QuinStreet_EBC@QuinStreet.com.

The GDPR also gives you right to lodge a complaint with a data protection supervisory authority. In the EU, the relevant authority is listed here: Our members | European Data Protection Board. In the UK, you can contact the Information Commission, Water Lane, Wycliffe House, Wilmslow, Cheshire, SK9 5AF, Telephone: +44 303 123 1113; Website: https://ico.org.uk/make-a-complaint/

Contact

All questions, comments and requests regarding this Notice should be addressed to QuinStreet’s Employee Benefits and Compliance at QuinStreet_EBC@QuinStreet.com.