Job Applicant Privacy Notice
Updated: January 24, 2025
Note: This Job Applicant Privacy Notice (“Job Applicant Notice”) applies to the processing of Personal Data
(as defined below) of job applicants of Klaviyo, Inc. and its affiliates and subsidiaries (collectively, “Klaviyo”)
TABLE OF CONTENTS
1. GENERAL INFORMATION – OUR APPROACH TO PRIVACY
2. REGION-SPECIFIC DISCLOSURES
4. PERSONAL DATA WE COLLECT ABOUT YOU AND HOW WE USE IT
5. HOW LONG WE KEEP YOUR PERSONAL DATA
6. RECIPIENTS OF PERSONAL DATA
8. STORING AND TRANSFERRING YOUR PERSONAL DATA
9. YOUR RIGHTS IN RESPECT OF YOUR PERSONAL DATA
B. ADDITIONAL EUROPE-SPECIFIC PRIVACY DISCLOSURES
C. ADDITIONAL AUSTRALIA-SPECIFIC PRIVACY DISCLOSURES
D. ADDITIONAL CALIFORNIA-SPECIFIC PRIVACY DISCLOSURES
E. ADDITIONAL SINGAPORE-SPECIFIC PRIVACY DISCLOSURES
A. GENERAL PROVISIONS
1. GENERAL INFORMATION – OUR APPROACH TO PRIVACY
1.1 Please ensure that you have read and understood this Job Applicant Notice. If you have any questions about it, please contact hr@klaviyo.com.
1.2 Note that this Job Applicant Notice only applies for as long as you are not engaged as an employee (or similar position such as contractor, consultant or temporary agency staff) by Klaviyo. Once we establish an employer-employee relationship (or similar relationship in the case of contractors, consultants, temporary agency staff etc), you will receive a separate Employee Privacy Notice. Information we receive during an application process might subsequently fall and be processed within the scope of the Employee Privacy Notice.
2. REGION-SPECIFIC DISCLOSURES
We may choose or be required by law to provide different or additional disclosures relating to the processing of Personal Data about residents of certain countries, regions, or states. Please refer below for disclosures that may be applicable to you:
(a) If you are based in the European Economic Area (“EEA”), the United Kingdom (the “UK”) or Switzerland, please refer to section B, Additional Europe-Specific Privacy Disclosures, for more information.
(b) If you are based in Australia, please refer to section C, Additional Australia-Specific Privacy Disclosures, for more information.
(c) If you are based in California, United States, please refer to section D, Additional California-Specific Privacy Disclosures, for more information.
(d) If you are based in Singapore, please refer to section E, Additional Singapore-Specific Privacy Disclosures, for more information.
3. DATA CONTROLLER
3.1 Klaviyo is the data controller of your Personal Data, and references to “Klaviyo”, “we”, “our” or “us” in this Job Applicant Notice are references to the Klaviyo entity to which you submit your application. As the controller of your Personal Data, Klaviyo is responsible for determining the purposes and means of data processing as described in this Job Applicant Notice and in accordance with applicable laws, rules, regulations and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including where relevant, the General Data Protection Regulation (EU 2016/679) (“GDPR”), the UK GDPR (the GDPR as applicable as part of UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (as amended)), The California Consumer Privacy Act of 2018
(as amended by the as amended by the California Privacy Rights Act (CPRA)), the Australian Privacy Act 1988, and the Singapore Personal Data Protection Act 2012 (“PDPA”) (all collectively, “Applicable Data Protection Laws”).
3.2 The table in Annex 1 sets out the Klaviyo entities to which this Job Applicant Notice applies.
4. PERSONAL DATA WE COLLECT ABOUT YOU AND HOW WE USE IT
4.1 The table in Annex 2 sets out in detail the categories of Personal Data we may collect about you when you apply for a role at Klaviyo and how we use that information.
Personal Data we collect
4.2 “Personal Data” means any information relating to an identified or identifiable individual or device, or is otherwise “personal data,” “personal information,” “personally identifiable information” and similar terms, and such terms shall have the same meaning as defined by Applicable Data Protection Laws. When we refer to “processing”, this means any operation which we perform on your Personal Data, such as collecting, using, storing, transferring, disclosing, altering or erasing your Personal Data.
4.3 We collect Personal Data that you provide to us when you submit your application to us or communicate with us in respect of your application. This Personal Data may include, for example, your name, address, phone number, emergency contacts, education and qualification details, and previous employment history.
4.4 The types of Personal Data we collect will vary depending on the nature of the position and role you are applying for.
4.5 When we ask you to provide such information, we will inform you whether the information requested is optional/voluntary to our consideration of your application. If you decline to provide information which is not optional/voluntary, you may limit our options in response to your application.
4.6 We may also create and maintain internal records with Personal Data about you, such as interview notes and evaluations. We may also collect Personal Data about you from other parties, such as recruiters and referees.
4.7 If you visit our premises, we may collect health and safety screening information, such as symptoms and vaccination information. We collect this information to protect the health and safety of our personnel and other visitors to our premises, and to comply with our legal and regulatory obligations, including any reporting obligations we may have under applicable law.
Special Category Personal Data
4.8 We may process Personal Data about you that is sensitive in nature and is subject to special protection under applicable law, and which may also include certain equal opportunities information, including health data, gender, ethnicity, disability, religion and sexual orientation (“Special Category Personal Data”). We may anonymize and aggregate this information and store it in such form that does not identify you. Annex 2 also sets out which Special Category Personal Data we collect. In many cases, we may request your consent before processing such Special Category Personal Data (please see Section 7 for further information on consent).
How we use it
4.9 We may use the Personal Data we collect about you to manage our relationship with you, such as opening and maintaining your applicant record, communicating with you, conducting identity checks, assessing your suitability or qualification for a role and improving our application process.
4.10 We may also use the information we collect to analyze our hiring habits to improve it and ensure diversity and also in other situations where such use is legally required.
Pre-employment vetting
4.11 If we decide to offer you employment or engage you as a consultant, we may also collect the results of any pre-employment screening checks against public or government databases before we make a formal offer to you (subject to, and to the extent permitted by, Applicable Data Protection Laws).
4.12 Depending on the nature of your role, such pre-employment screening information may include:
(a) Employment history and professional qualification verification. We may contact your professional and academic referees to confirm the employment, professional and academic information that you have provided to us. You should ensure that you have any referees’ consent to disclose information about you to us when you submit your application.
(b) Directorship searches, such as current and former directorships and any disqualifications from acting as a director;
(c) Adverse media searches, conducted using adverse key words relating to crime, terror, fraud or other illicit activities subject to, and to the extent permitted by, Applicable Data Protection Laws;
(d) Basic criminal records checks, subject to, and to the extent permitted by, Applicable Data Protection Laws.
4.13 We use the above information to assess your suitability and eligibility for the role for which you have applied.
4.14 We will inform you if we obtain any information through pre-employment screening that could affect our decision to offer you employment or appointment as a consultant. We will give you the opportunity to respond to the information obtained and will take your response into account when deciding whether to proceed with your appointment.
5. HOW LONG WE KEEP YOUR PERSONAL DATA
5.1 We will store your Personal Data for no longer than necessary for the purposes set out in Annex 2 and in accordance with our legal obligations and legitimate business interests. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
5.2 If your application is successful and you become an employee, consultant or contractor of Klaviyo, or are engaged as temporary or agency staff by Klaviyo, the Personal Data we collect during the application process will be transferred to your personnel file and stored in accordance with our Employee Privacy Notice (we will give you a copy of this notice at the start of your employment or other engagement with Klaviyo).
5.3 We will retain unsuccessful applications pursuant to Klaviyo’s data retention policies.
5.4 Subject to and in accordance with the Applicable Data Protection Laws, we may keep your Personal Data for purposes of considering you for employment with other Klaviyo companies or for other positions with Klaviyo.
5.5 Otherwise, if you do not wish to be considered for other roles at Klaviyo, we will keep your Personal Data subject to and in accordance with our records retention policy.
5.6 In all cases, we will only use data in a manner consistent with the Applicable Data Protection Laws.
5.7 For further information concerning our data retention policy see ‘CONTACTING US’ section below.
6. RECIPIENTS OF PERSONAL DATA
We may share, transmit, disclose, grant access to, make available, and provide your Personal Data with the following third parties (as required in accordance with the uses set out in the Annex 2):
| Third Party Recipient | Personal Data shared by us | Purposes for which the data is shared |
| Other Klaviyo group companies | The Personal Data identified in Annex 2 | If you apply for a position with a Klaviyo subsidiary or affiliate, we may share your Personal Data with our parent company, Klaviyo, Inc. (Klaviyo U.S.) or another Klaviyo subsidiary or affiliate for: – group-level compliance and associated risk management, including, for example, providing legal advice and in connection with potential or actual litigation or regulatory action; – the decision to hire, and – the provision of health and safety screenings. |
| Service providers and advisors | Personal contact details; Job application information; and Results of reference checks and screening. | We may share your Personal Data with third party service providers that provide services to us or on our behalf, which may include without limitation providing mailing, email, recruitment and pre-employment vetting services. |
| Law enforcement, regulators, government bodies and other third parties as required under applicable laws or regulations | The Personal Data identified in Annex 2 | We may share your Personal Data with third parties as required by law or if we reasonably believe that such action is necessary to: (i) comply with the law and the reasonable requests of law enforcement; (ii) detect investigate and respond to potential civil or criminal violations, such as breaches of agreements or laws, respectively; and/or (iii) otherwise exercise or protect the rights, property, or personal safety of Klaviyo, our team members or others. |
| Third parties at your request | The Personal Data as requested by you | We may share your Personal data with third parties if you request us to do so and in accordance with your instructions. |
7. CONSENT
7.1 We may need your consent for some uses of certain Personal Data. For instance, in certain circumstances, we may need your consent to collect and use certain Special Category Personal Data, such as information about your health or ethnicity, for the purposes set out in Annex 2, or as otherwise identified by us to you.
7.2 If we need your explicit consent, we will notify you of the Personal Data we intend to use and how we intend to use it before or at the time we ask for such consent.
7.3 You will never be obliged to provide consent. Where you have consented to our collection, disclosure or other use of your Personal Data, you may withdraw your consent at any time. This will not affect the lawfulness of any processing based on your consent before its withdrawal. If you wish to withdraw any consent that you have given us, please submit a request by filling out our Privacy Rights Request Form.
8. STORING AND TRANSFERRING YOUR PERSONAL DATA
8.1 Security. We implement appropriate technical and organizational measures designed to protect your Personal Data against accidental or unlawful destruction, loss, change or damage. All Personal Data we collect will be stored securely.
8.2 International transfers of your Personal Data. Klaviyo is committed to protecting the privacy and confidentiality of your Personal Data when it is accessed by or transmitted to other Klaviyo entities or any other third party. Please see section B, Additional Europe-Specific Privacy Disclosures, section C, Additional Australia-Specific Privacy Disclosures, and section E, Additional Singapore-Specific Privacy Disclosures, for more information in respect of international transfers.
9. YOUR RIGHTS IN RESPECT OF YOUR PERSONAL DATA
9.1 In accordance with Applicable Data Protection Laws, you may have the following rights in respect of your Personal Data that we hold:
(a) Right of access. You have the right to obtain certain information regarding the Personal Data we collect and process.
(b) Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete Personal Data we hold about You without undue delay.
(c) Right to erasure. You have the right, in some circumstances, to require us to erase your Personal Data if the continued processing of that Personal Data is not justified.
(d) Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your Personal Data if the continued processing of the Personal Data in this way is not justified.
(e) Right to object. You have the right, in some circumstances, to object to the processing of your Personal Data.
9.2 Please see section B, Additional Europe-Specific Privacy Disclosures, section C, Additional Australia-Specific Privacy Disclosures, Section D, Additional California-Specific Privacy Disclosures, and section E, Additional Singapore-Specific Privacy Disclosures for more information relating to your rights.
9.3 If You wish to exercise one of these rights, please submit a request by filling out our Privacy Rights Request Form. Your rights will in each case be subject to the restrictions set out in Applicable Data Protection Laws.
10. CHANGES TO THIS NOTICE
WE MAY UPDATE THIS JOB APPLICANT NOTICE FROM TIME TO TIME AND SO YOU SHOULD REVIEW THIS PAGE PERIODICALLY. IF AND WHEN WE MAKE MATERIAL CHANGES THIS JOB APPLICANT NOTICE, WE WILL UPDATE THE “LAST MODIFIED” DATE DISPLAYED AT THE END OF THE DOCUMENT. CHANGES TO THIS JOB APPLICANT NOTICE ARE EFFECTIVE WHEN THEY ARE PUBLISHED ON THIS PAGE.
11. CONTACTING US
Please contact hr@klaviyo.com if you have any questions, comments, concerns and requests regarding this Job Applicant Notice.
B. ADDITIONAL EUROPE-SPECIFIC PRIVACY DISCLOSURES
12. The following information may apply to you if you are located in the EEA, the UK or Switzerland.
12.1 Additional Information on Controllership. If you apply for a position with a Klaviyo subsidiary or affiliate located in the EU, UK or Switzerland, We, together with Klaviyo, Inc., act as a “joint controller” (i.e., we jointly decide on the “why” (purpose) and “how” (means) of the processing) with respect to the Personal Data that is collected and shared with Klaviyo, Inc. as set out above under Section 6.1(a)(i) of this Job Applicant Notice. Note, however, that Klaviyo, Inc., will act as a data processor for us in connection with providing IT infrastructure, in respect of which we and Klaviyo, Inc. have entered into a separate data processing agreement in accordance with the Applicable Data Protection Laws.
12.2 Legal Basis. The table in Annex 2 lists the legal bases under the GDPR on which we base the processing of your Personal Data. Note that the legal bases set out in Annex 2 refers to the legal bases in the GDPR. Depending on the country in which you are employed, there may be country-specific legal bases that apply, in which case we may notify you separately and in addition to this Job Applicant Notice to the extent required by Applicable Data Protection Laws.
12.3 In relation to the Personal Data that is shared with others, the legal bases are the following:
(a) Klaviyo, Inc.: Taking steps prior to entering into a contract with you and our legitimate interests, namely the interests set out in Section 6.1(a).
(b) Service providers and advisors: The legal basis is the balancing of legitimate interests, namely our interest in managing our resources and pursuing our business as set out above and, in this context, evaluating your application. Note that service providers that act on our behalf will process your Personal Data only according to our instructions and will be bound by adequate data processing agreements. Advisors will often provide their advice more independently and thus qualify as data controller.
(c) Third parties at your request: The legal basis is consent according to the GDPR.
(d) Law enforcement, regulators and other third parties for legal reasons: The legal bases are legal obligation and a balancing of legitimate interests as specified above as well as compliance with legal obligations.
12.4 International Transfers of your Personal Data. We may transfer your Personal Data outside the EEA and the UK, including to the U.S. and Australia. We rely on appropriate safeguards, such as Standard Contractual Clauses under Article 46.2 of the GDPR, as approved by the European Commission or an adequacy decision in respect of a certain jurisdiction by the European Commission under Article 45 of the GDPR, to secure the transfer of your Personal Data to protect the privacy and integrity of any personal data transferred. In particular, we have implemented an intra-group data transfer agreement which includes the Standard Contractual Clauses, to ensure an adequate level of protection when transferring data within the company group. If you would like to obtain further Data on the transfer of your Personal Data to countries located outside the EEA and the UK which do not provide for an adequate level of protection, please contact us using the contact details provided above (see ‘CONTACTING US’).
12.5 Data Subject Rights. In accordance with applicable privacy law, you may have the following rights in respect of your Personal Data that we hold:
(a) Right of access. You have the right to obtain:
(i) confirmation of whether, and where, we are processing your Personal Data;
(ii) information about the categories of Personal Data we are processing, the purposes for which we process your Personal Data and information as to how we determine applicable retention periods;
(iii) information about the categories of recipients with whom we may share your Personal Data; and
(iv) a copy of the Personal Data we hold about you.
(b) Right of portability. You have the right, in certain circumstances, to receive a copy of the Personal Data you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your Personal Data to another person.
(c) Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete Personal Data we hold about you without undue delay.
(d) Right to erasure. You have the right, in some circumstances, to require us to erase your Personal Data without undue delay if the continued processing of that Personal Data is not justified.
(e) Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your Personal Data if the continued processing of the Personal Data in this way is not justified, such as where the accuracy of the Personal Data is contested by you.
(f) Right to object.
(i) YOU HAVE THE RIGHT TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, AT ANY TIME, TO PROCESSING OF PERSONAL DATA CONCERNING YOU, WHICH IS BASED ON OUR LEGITIMATE INTERESTS, INCLUDING PROFILING (E.G., CREDIT RATING). WE SHALL NO LONGER PROCESS THE PERSONAL DATA UNLESS WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE THE INTERESTS, RIGHTS AND FREEDOMS OF YOU, OR FOR THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS (SUBJECT TO, AND TO THE EXTENT PERMITTED BY, APPLICABLE DATA PROTECTION LAWS).
(ii) YOU HAVE THE RIGHT TO OBJECT TO AT ANY TIME TO PROCESSING OF PERSONAL DATA CONCERNING YOU FOR PURPOSES OF DIRECT MARKETING, WHICH INCLUDES PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT TO THE PROCESSING FOR DIRECT MARKETING PURPOSES, YOUR PERSONAL DATA WILL NO LONGER BE PROCESSED FOR SUCH PURPOSES.
12.6 Exercising Your rights. If you wish to exercise one of these rights, please submit a request by filling out our Privacy Rights Request Form. Your rights will in each case be subject to the restrictions set out in Applicable Data Protection Laws.
You also have the right to lodge a complaint to the supervisory authority in your country of residence, place of work or place of an alleged infringement (if you consider that the processing of your Personal Data infringes the Applicable Data Protection Laws). Further information about how to contact your local data protection authority is available at https://ec.europa.eu/newsroom/article29/items/612080.
- For the UK, please contact the Data Commissioner’s Office (ICO) at https://ico.org.uk/.
- For Ireland, please contact the Data Protection Commission (DPC) at info@dataprotection.ie or +353 1 7650100.
You may also reach out to Klaviyo’s Privacy Officer at Privacy@klaviyo.com.
C. ADDITIONAL AUSTRALIA-SPECIFIC PRIVACY DISCLOSURES
13. The following information may apply to you if you are located in Australia.
13.1 Additional information on Sensitive Information: In Australia, ‘Sensitive Information’ under the Privacy Act 1988 (Cth) includes, but is not limited to, information about your ethnic origins, criminal record, political opinions, religion, sexual orientation and membership of a professional / trade association or a trade union. Sensitive Information also includes your health information and biometric information. Klaviyo will only ordinarily collect your Sensitive Information with your consent.
13.2 Additional information on pre-employment vetting: Depending on the nature of the position for which you are applying, we may conduct a criminal record check. This involves collecting your Personal Data from (or disclosing your Personal Data to) the police. We will only conduct a criminal record check with your consent.
13.3 Additional information on recipients of Personal Data: The locations where your Personal Data will be transferred for the purposes outlined above in section 6 (and for the uses set out in Annex 2 below) include to Klaviyo, Inc. in the U.S and Klaviyo LTD in the U.K.
13.4 Additional information on your rights:
(a) Rights of access and correction: Under the Australian Privacy Principles, you (as a job applicant or prospective consultant) have a right to request access to your Personal Data and to request the correction of your Personal Data. If you would like to exercise these rights, please submit a request by filling out our Privacy Rights Request Form.
(b) We will only decline an access or correction request in circumstances prescribed by the Privacy Act. If we do refuse your access or correction request, we will provide you with written reasons for our decision and, in the case of a request for correction, we will include a statement with your Personal Data about the requested correction (if you ask us to do so).
(c) Right to complain: Under the Australian Privacy Principles, you (as a job applicant or prospective consultant) have a right to make a privacy complaint. If you would like to make a privacy complaint, please contact hr@klaviyo.com.
(d) We will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. Your complaint will then be investigated. In most cases, we will investigate and respond to a complaint within a reasonable time, usually within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.
(e) If you are not satisfied with our response to your complaint, you may make a complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the website www.oaic.gov.au.
(f) Please note that the following rights are not available under the Privacy Act and the Australian Privacy Principles: the right to erase, restrict, object (except for opting out of receiving marketing messages) and portability.
D. ADDITIONAL CALIFORNIA-SPECIFIC PRIVACY DISCLOSURES
14. The following information may apply to you if you are located in California, United States.
14.1 No Sales, Sharing or Targeted Advertising. Except as otherwise described in our Privacy Notice in connection with job applicants acting in their capacity as website visitors, we do not sell personal information about individuals acting in their capacity as job applicants, and we do not share or otherwise disclose personal information about individuals acting in their capacity as job applicants to third parties for the purpose of displaying advertisements that are selected based on Personal Information obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”).
14.2 Sensitive Information: The following Personal Information elements we collect may be classified as “sensitive” under the California Consumer Privacy Act (“sensitive information“): (1) Social Security number, driver’s license number, and passport number; (2) citizenship or immigration status; and (3) to the extent you provide this information to us, information relating to racial and ethnic origin, religious beliefs, health, disabilities, sexual orientation, or gender identity.
We use this sensitive information for the purposes set forth in the Personal Data We Collect About You and How We Use It section of this Job Applicant Privacy Notice.
We do not sell sensitive information about individuals acting in their capacity as a job applicant, and we do not share or otherwise disclose sensitive information about individuals acting in their capacity as job applicant for the purpose of targeted advertising, nor use such information for the purpose of inferring characteristics about our job applicants.
14.3 California Privacy Rights: As a California resident, you may be able to exercise the following rights in relation to the Personal Information that we have collected about you (subject to certain limitations at law):
- The Right to Access/Know. You have the right to request any or all of the following information relating to your Personal Information we have collected and disclosed, upon verification of your identity:
- The specific pieces of Personal Information we have collected about you;
- The categories of Personal Information we have collected about you;
- The categories of sources of the Personal Information;
- The categories of Personal Information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
- The categories of Personal Information we have sold or shared about you (if any), and the categories of third parties to whom the information was sold or shared; and
- The business or commercial purposes for collecting or, if applicable, selling or sharing the Personal Information.
- The Right to Request Deletion. You have the right to request the deletion of Personal Information we have collected from you, subject to certain exceptions.
- The Right to Correction. You have the right to request that any inaccuracies in your Personal Information be corrected, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information.
You also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, please note that if the exercise of these rights limits our ability to process Personal Information, we may no longer be able to engage with you in the same manner.
14.4 Submitting Privacy Rights Requests: To submit a request to exercise one of the privacy rights identified above, please submit a request by filling out our Privacy Rights Request Form.
Before processing your request, we will need to verify your identity and confirm you are a resident of the State of California. In order to verify your identity, we will generally either require the successful authentication of your work-related account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. We may at times need to request additional Personal Information from you, taking into consideration our relationship with you and the sensitivity of your request.
In certain circumstances, we may decline a privacy rights request, particularly where you are not a resident of the State of California or where we are unable to verify your identity.
14.5 Authorized Agents: In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.
E. ADDITIONAL SINGAPORE-SPECIFIC PRIVACY DISCLOSURES
15. The following information may apply to you if you are located in Singapore.
15.1 Legal Basis: We will obtain your consent before collecting, using, processing and/or disclosing your Personal Data for any purpose (see Annex 2), subject to certain limitations/exceptions under the law. If you do not agree with any term of this Job Applicant Privacy Notice, you should not provide any data to Klaviyo. Please note that the legal bases set out in Annex 2 refers to the legal bases under the GDPR and do not apply to Singapore.
15.2 Retention of your Personal Data: We may retain your Personal Data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws. We will cease to retain your Personal Data or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the Personal Data was collected, and is no longer necessary for legal or business purposes.
15.3 Additional information for overseas transfers of your Personal Data: Your Personal Data may be transferred to, stored and/or processed within and outside Singapore (including but not limited to the United States), consistent with this Privacy Notice.
In the event of a transfer of your Personal Data by Klaviyo to a location outside Singapore, we will take reasonable and appropriate measures, in compliance with the applicable law, designed to ensure that your transferred Personal Data is accorded a standard of protection that is comparable to that under the PDPA.
15.4 Your rights under the PDPA
Data Subject Rights. In accordance with the PDPA, you may have the following rights in respect of your Personal Data in our possession or under our control, subject to certain limitations/exceptions under the law:
- Right to Access: You have the right to access Personal Data about you that is in the possession or under the control of Klaviyo, and information about how the Personal Data was used or disclosed by Klaviyo within a year prior to the date of your request.
- Right to Correction: You have the right to request for Klaviyo to correct an error or omission in your Personal Data that is in the possession or under the control of Klaviyo.
- Right to Withdraw Consent: You have the right to withdraw any consent given, or deemed to have been given to Klaviyo, in respect of the collection, use or disclosure by Klaviyo of your Personal Data for any purpose.
Whilst we respect your decision to withdraw your consent, please note that if you withdraw your consent to the use of your Personal Data, you may limit our options in response to your application. We will, in such circumstances, notify you before completing the processing of your request.
Please note that withdrawing consent does not affect our right to continue to collect, use, disclose or process your Personal Data where such collection, use, disclosure, and processing without consent is permitted or required under applicable laws.
If you wish to exercise one of these rights, please submit a request by filling out our Privacy Rights Request.
15.5 Data Protection Officer
If you have any complaints, queries, requests or clarifications regarding how we are handling your Personal Data or about how we are complying with the PDPA, please contact our data protection officer at privacy@klaviyo.com.
Annex 1
KLAVIYO ENTITIES AND CONTACT
| Entity | Country | Contact |
| Klaviyo, Inc. 125 Summer Street, Floor 6 Boston, MA, 02110 | United States | If you have any questions or requests in connection with this Job Applicant Notice or other privacy-related matters, please contact us at Privacy@klaviyo.com |
| Klaviyo LTD 49 Southwark Bridge Rd London SE1 9HH, UK | United Kingdom | |
| Klaviyo Australia Pty Ltd ACN 654 057 495 Level 40, 2-26 Park Street Sydney NSW 2000, Australia | Australia | |
| Klaviyo Ireland Limited 70 Sir John Rogerson’s Quay Dublin 2, D02 R296 Ireland | Ireland | |
| Klaviyo Singapore Pte. Ltd. 9 Raffles Place #26-01, Republic Plaza Singapore 048619 Singapore | Singapore |
Annex 2
PERSONAL DATA WE COLLECT
| Category of Personal Data | How we use it | Legal basis for the processing under the GDPR Please note that these lawful bases are only applicable to our use of your Personal Data if you are located in the UK or EU |
| Personal contact details, such as your title, name, phone number, date of birth, home address and personal e-mail address. | We use this information to open and maintain applicant records. | The processing is necessary in order to take steps prior to entering into a contract with you. The processing is necessary for our legitimate interests, namely to manage the application process. |
| We use this information to communicate with you as part of the recruitment process. | The processing is necessary in order to take steps prior to entering into a contract with you. | |
| We use this information to confirm your identity. | The processing is necessary in order to take steps prior to entering into a contract with you. | |
| We use this information to provide marketing communications to you. | Consent (which you can withdraw at any time without affecting the lawfulness of any processing based on consent before its withdrawal). | |
| Job application information, such as position applied for, previous roles, job description, responsibilities and assignments, years of service, qualifications and experience, compensation and salary data, eligibility for and participation in benefit schemes and other information contained in your CV. | We use this information to process and assess your application, including assessing your suitability for a role. | The processing is necessary in order to take steps prior to entering into a contract with you. |
| We use this information to calculate proposed salary and assessing eligibility for certain benefits. | The processing is necessary in order to take steps prior to entering into a contract with you. | |
| We use this information to monitor and improve our application process. | The processing is necessary for our legitimate interests, namely reviewing and updating our applications process. | |
| Online presence, such as your LinkedIn or personal website. | We use this information to process and assess your application, including assessing your suitability for a role. | The processing is necessary in order to take steps prior to entering into a contract with you. |
| Results of reference checks and screening, such as verification of identity, education, employment history, credit check (if required for the position) and driving record (if required for the position). | We use this information to process and assess your application, including assessing your suitability for a role. | The processing is necessary in order to take steps prior to entering into a contract with you. |
| We use this information to fulfill our obligations under applicable law, regulations, legal processes or enforceable government requests. | The processing is necessary for compliance with a legal obligation to which we are subject. | |
| Basic criminal records check (if required and/or permitted to be carried out under the Applicable Data Protection Laws), such as criminal convictions and probations, and, in the UK, basic Disclosure and Barring Service (DBS) basic check in relation to unspent convictions and conditional cautions. | We use this information to: – identify and manage our risk exposure in accordance with data security commitments to our customers and employee and customer safety and financial risk; and – verify information you have provided in connection with your application. | We will only process your Personal Data in this way to the extent permitted by Applicable Data Protection Law |
| Results of checks against directorship and disqualification registers, including current and former directorships held, details of the companies, industry type and date of appointment of the relevant directorships, and any disqualifications from acting as a director. | We use this information to verify your suitability for a role and to assess potential conflicts of interest which may arise from current and past directorships or shareholdings. | The processing is necessary for our legitimate interests, namely to assess your suitability for the role and to assess potential conflicts of interest which may arise from current and past directorships or shareholdings. |
| Nationality, citizenship andright to work information, such as country of birth, government identification documents (including passports, social security number, and residency permits) and, where relevant, visa information. | We use this information to determine your eligibility to work. | The processing is necessary for compliance with a legal obligation to which we are subject. |
| We use this information to fulfill our obligations to relevant government authorities. | The processing is necessary for compliance with a legal obligation to which we are subject. | |
| Interview evaluation and appraisal information, such as comments and notes made by interviewers or other Klaviyo employees in connection with your application, and in some cases recordings and transcripts of the interview. | We use this information o process and assess your application, including assessing your suitability for a role. | The processing is necessary in order to take steps prior to entering into a contract with you. |
| We use this information to calculate proposed salary and assessing eligibility for certain benefits. | The processing is necessary in order to take steps prior to entering into a contract with you. | |
| We use this information to monitor and improve our application process. | The processing is necessary for our legitimate interests, namely assessing and managing applications for positions with Klaviyo and improving the hiring process. | |
| Your feedback about the application process. | We use this information to monitor and improve our application process. | The processing is necessary for our legitimate interests, namely improving the hiring process. |
| Any other data provided by you in the course of the application process, including electronic communications with you in relation to the application process. | We use this information to process and assess your application, including assessing your suitability for a role. | The processing is necessary in order to take steps prior to entering into a contract with you. |
| We use this information to respond to your enquiries and to monitor and improve our application process. | The processing is necessary for our legitimate interests, namely managing applications and improving the application process. | |
| Equal opportunities monitoring information, such as information relating to your gender, ethnicity, disability, religion and sexual orientation. | We may anonymize and aggregate this information to monitor and improve our application process. | Your consent. |
| Health and safety screening information, such as information regarding any symptoms you may be experiencing or vaccination status. | We use this information to protect the health and safety of our personnel and other visitors to our premises, and to comply with our legal and regulatory obligations, including any reporting obligations we may have. | The processing is necessary: (i) in pursuit of our legitimate interests and for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health; or (ii) for compliance with a legal obligation in the field of employment or social protection law (including to provide a safe place to work and/or to provide reasonable accommodation in respect of any disability you may have); |
Previous Versions: