Text

Toast Applicant Privacy Statement

A.   Scope 

This Statement applies to personal information (i.e. information about an identified or identifiable individual) we collect and process (whether electronic all, in writing or orally) from applicants seeking employment with Toast, Inc. and its subsidiaries and affiliates (collectively “Toast”, “we”, “us” and/or “our”) during the application and recruitment stage. 

To see our California Privacy Statement, please click the link or scroll down.

This Statement is comprised of two sections – a generally applicable statement and location-specific addendums. This initial section describes the standards in relation to how Toast as a whole collects and manages information during the application and recruitment stage. To the extent there are variations within a specific market or additional information that is required to be provided under the applicable law, a local market addendum can be viewed below. Links to the pertinent sections can be found below:

B.   Information we collect and process


Toast collects personal information during the application stage which includes: 

 

  • personal details such as your name;
  • contact information, including your email address and phone number;
  • information about your location;
  • professional and educational history;
  • certifications and skills;
  • job preferences and interests;
  • information around work authorizations and sponsorship; and
  • names and contact details of references. 
     

We collect certain sensitive categories of personal information to comply with the applicable law as well as if needed for legitimate business purposes with your consent (e.g. equal opportunity compliance).  This may include information about your race, ethnicity, gender, veteran status and any physical limitations or other medical or health-related workplace accommodations. 


In certain instances, Toast may also collect additional information from recruiters, referees and other third parties that assist us during the recruitment stage, including, where applicable, the results of credit and criminal background checks, drug and alcohol testing and other screening procedures from third-party background screening providers. You may also elect to have third parties, such as social media providers, share information (e.g., your resume) with us as part of the recruitment process or we may collect this information if publicly available. 


The personal information collected may vary from jurisdiction to jurisdiction in accordance with applicable law. Your provision of certain information is optional, however, your failure to provide certain information may disqualify you from employment with Toast.


C.   How we use and disclose your information 

Toast will use and share the personal information it collects from you or otherwise processes from you in order to fulfil the purposes set forth in this Statement. We maintain a number of relationships with third-party service providers as well as business partners that we use to support our business activities, including recruitment.

 

We use personal information to assess your qualifications for employment during the recruitment stage. This may include contacting you after you have applied, contacting references that you have provided and carrying out background checks. We also may use your information to comply with any applicable legal obligations, record-keeping or reporting obligations as well as to establish, exercise or defend against any legal claims. 

 

Personal information will primarily be processed by employees within our human resources, information technology and workplace experience teams in addition to stakeholders you might engage with as part of the role. In order to carry out the services and objectives contemplated in this Statement, your information will be shared with Toast’s other subsidiaries and affiliates as well as third-party service providers and vendors used as part of the recruitment process. We may also share information with third parties: 

  • if we believe that the disclosure is authorized or required by applicable law, regulation legal process or governmental request (including, for example, a court order, subpoena or search warrant);  
  • in the event of a merger, acquisition, asset sale or other related transaction; or
  • if we believe that disclosure is required to protect the safety of our employees, the public or Toast property. 
     

Where we check references or previous employment and education, we disclose the fact that you have applied to us to educational institutions and to previous employers.

 

As part of our recruitment process, we may also use information you provide (on either an individual-specific or aggregated basis) to improve our application and hiring process at Toast, which may include using information to understand applicant trends and for bias reduction purposes.. If you elect to do so, we may also use your information to contact you in the future, for example, if you join our Talent Community.

 
D.   Data transfers and centralized processing 

Toast has centralized and outsourced various aspects of our business to improve how we manage and administer our recruitment process. As a result, it may be necessary to transfer your information to a country outside of the country where it was originally collected or outside of your country of residence in order to assess your qualifications for employment. These transfers may be to any Toast entity around the world as well as to third-party service providers that help Toast manage and administer its recruitment process. 

 

The privacy laws in other countries to which we transfer your information may or may not be as comprehensive as the privacy laws of the country where the information was originally collected or of your country of residence. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of the country to which your information is transferred may be able to obtain access to your personal information through the laws of that country. 

 

We use appropriate safeguards for the transfer of personal information among our affiliates and to third-party service providers in various jurisdictions, and have implemented appropriate contractual arrangements, standard contractual clauses or other measures for such purposes, including by requiring that third parties only use personal information provided for the limited purposes for which it was disclosed and apply appropriate security measures to protect the information. To obtain a current list of the countries where applicant data is collected, used, disclosed and/or stored, as well as additional information regarding the purposes for which our service providers have been authorized to collect, use, disclose and/or store personal information for or on behalf of Toast, please contact privacy@toasttab.com

 
E.   Security 

We have in place appropriate technical, physical and organizational security measures that are designed to protect against unauthorized access, disclosure, damage or loss of personal information. The collection, transmission and storage of information can never be guaranteed to be completely secure. However, we take steps to ensure that appropriate security safeguards are in place internally and with our third-party service providers to protect your personal information. 

 
F.   Retention 

Subject to the applicable law, Toast will only retain your personal information for the duration of time necessary to assess your qualifications for employment or otherwise in accordance with our record retention schedules. We may retain aggregated information in order to improve our recruitment and hiring practices for a longer duration, however, that information cannot be used to identify you. You may also elect to have your information remain with Toast for a longer duration, for example, if you decide to participate in Toast’s Talent Community. 

 
G.   Access to and control of your information

We want to ensure that you have the necessary tools at your disposal to control the information that you provide to us. We rely on you to ensure your information is accurate, complete, and up to date. It is therefore important that you contact us to keep your information accurate and up to date. To the extent you are not able to update your information directly through our application portal or website, please contact us at privacy@toasttab.com.  

 

Depending on your location, you may be entitled to request access to, erase, restrict and object to the processing of your personal information that is held by Toast or request further information regarding the use and disclosure of your personal information. These requests will be reviewed and processed in line with local law. In certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by applicable law. These requests should also be sent to privacy@toasttab.com

 

See your respective location-specific addendum for additional information on your rights in this area. 

 
H.   Cookies and other tracking technologies

We use cookies (a small text file placed and saved in your browser when you access our websites), web beacons (a graphic file place on a website to gather usage and performance data) and other tracking technologies as part of providing the services described in this Statement. In certain instances, cookies and other tracking technologies may also be used to serve you more relevant advertisements and for other personalization purposes. These technologies may be set by us or by third parties.  There are ways to control and/or reject the setting of cookies and similar technologies within your browser settings. As each browser is different, please consult the “help” menu within your browser. Depending on the services being used, restricting cookies may prevent you from accessing and using all or part of the services. 

We may use these technologies:

  •  to uniquely identify you and/or your device;
  • to store your preferences as part of providing the services;
  • for security and fraud-prevention purposes;
  • to analyze and monitor the performance of our services;
  • to improve our services; and
  • to understand your use of the services over time.

 

We also use pixels and related technologies as part of session replay services on certain websites that are used to understand and improve functionality and an individual’s experience on those sites.

 

For more information about Toast’s use of cookies and how you can manage them, please see Toast’s Cookie Policy found here or visit our Privacy Statement section titled "Cookies and other tracking technologies" found on https://pos.toasttab.com/privacy. 

 
I.   Questions and how to contact us

If you have any questions or concerns in relation to the collection and management of your personal information by Toast under this Statement and applicable privacy laws, please contact Toast’s Privacy Office at privacy@toasttab.com.

 
J.   Changes to this Statement

We reserve the right to update, change, modify or amend this Statement in order to comply with the evolving regulatory environment or the way we operate our business.  Outside of any applicable legal requirements to provide additional notice and/or obtain consent, we will provide you with notice when we make any substantial updates. In addition to updating this website, we may also notify you in other ways from time to time about the processing of your personal information. 

 
K.   Effective date

July 1, 2023

 

 
 

Addendum A – United States (California)
Privacy Statement for California Residents as required by the California Consumer Privacy Act of 2018 (including as amended by the California Privacy Rights Act of 2020)(“CCPA”)

 

Last updated: July 1, 2023

The provisions below supplement the information provided in the generally applicable portion of our Statement and apply solely to individuals that are residents of California and qualify as a “Consumer” under the CCPA. This California-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the CCPA. Any terms defined in the CCPA or as otherwise defined in our Statement have the same meaning as used in this addendum. 

 

When we use the term “personal information” in this Addendum A, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. 

 
A.   CCPA personal information table

To help you understand how Toast uses your personal information, the below table summarizes:

 

  • The categories of personal information collected by Toast in the past 12 months;
  • The sources of collection of the personal information;
  • How we use your personal information; and
  • The categories of personal information disclosed for a business purpose by Toast (including to third parties) in the past 12 months.
     

Please see the generally applicable section of this Privacy Statement for additional information on Toast’s information practices, including more detail on how we use and disclose your personal information. 

 

Text, Page, Menu

Please note that the actual personal information collected, used and disclosed will depend on the nature of your relationship with Toast and the services you interact with and use as part of that relationship. 

 

B.   Categories of personal information sold or shared

While Toast does not “sell” personal information in the traditional sense, we do, however, sell or share personal information for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual's activities across businesses or distinctly-branded websites, applications or other services (otherwise known as "targeted advertising" or "cross-context behavioral advertising"), for personalization features and for tracking and analytics purposes. The categories for personal information impacted in the preceding 12 months may include:

  • Identifiers;
  • Internet/Network Information; and
  • Inferences.
     

Each of the above categories of information may be disclosed to third parties, which may include our business partners depending on the nature of a user’s interactions. To the extent the setting of cookies and similar technologies is interpreted to constitute a “sale” under the CCPA, Consumers can exercise their right to opt out of these sales through our cookie management tool that can be accessed by clicking on our “Do Not Sell My Personal Information” link at the bottom of https://pos.toasttab.com or other applicable websites. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our websites will recognize opt-out preference settings only on domains of our websites where any “selling” or “sharing” occurs. You may also review our Privacy Statement section titled “Cookies and other tracking technologies” found at https://pos.toasttab.com/privacy for more information on how Toast uses cookies, analytics and personalized advertising.  Toast has no actual knowledge that the “sales” or “sharing” described above include the personal information of individuals under 16 years of age. 

 
C.   Description of rights available to Consumers

If you are a resident of the state of California and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights: 

  • The right to know/access: you have the right to request that an in-scope business that collects personal information from you, disclose the following in relation to the preceding 12 month period, upon verification of your identity: (i) the categories of personal information collected about you, (ii) the categories of sources where the personal information was collected, (iii) the business or commercial purposes for collecting (or where applicable, selling or sharing) the personal information, (iv) the categories of personal information that we have disclosed to third parties for a business purpose along with the corresponding recipients, (v) the categories of personal information we have sold or shared along with the corresponding recipients, and (vi) the specific pieces of personal information collected about you.
  • The right of correction: you have the right to request that an in-scope business correct inaccurate personal information, subject to certain conditions.
  • The right to opt out of the sale or sharing of personal information: you have the right to request that an in-scope business refrain from selling or sharing personal information it has collected about you to third parties now or in the future. If you are under the age of 16, you have the right to opt in, or to have a parent or guardian opt in on your behalf, to such sales or sharing.
  • The right to limit the use and disclosure of sensitive personal information: to the extent that we use sensitive personal information for purposes beyond those set forth in subdivision (a) of Section 1798.121, you have the right to limit the use or disclosure of that sensitive personal information subject to the exceptions within the CCPA.
  • The right of access to and to the ability to opt-out of automated decision-making technology: subject to further regulations being issued, you have the right to access information pertaining to automated decision-making technologies and the ability to opt out.
  • The right against discrimination and retaliation: you have the right to not be discriminated or retaliated against as a result of exercising any of the above rights.
     

However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you with certain services or engage with you in the same manner. In addition, the exercise of the rights described above may result in a different quality or level of service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law. Additionally, your ability to invoke the rights above are limited pursuant to the scope and limitations of the CCPA, including any available exceptions. For example, an access request can only be made twice by a Consumer within a 12-month period. 


D.   How to invoke your rights

Toast has established an individual rights portal as well as other channels for the purposes of submitting your individual rights requests above. Individual rights requests can be submitted to Toast through the below channels:

Once an individual rights request has been submitted, Toast may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your engagement with Toast. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. In these instances, we will take steps to verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request. Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law in relation to individual rights submissions.   

 

To Exercise the Right to Opt Out of the Selling or Sharing of Personal Information

Unless you have exercised your right to opt out of the sale or sharing of personal information, we may “sell” or “share” your personal data to third parties for targeted or cross-context behavioral advertising purposes, for personalization features and for tracking and analytics purposes. The third parties to whom we sell or share personal information may use such information for their own purposes in accordance with their own privacy statements. In these instances, the right to opt out of the sale of personal information can be invoked through our cookie management tool that can be accessed by clicking on our “Do Not Sell or Share My Personal Information” link at the bottom of https://pos.toasttab.com or other applicable websites. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our websites will recognize opt-out preference settings only on domains of our websites where any “selling” or “sharing” occurs. Although Toast does not currently engage in other practices at this time that may constitute a “sale” or “sharing” beyond these instances and the methods above are the most effective methods to manage your preferences, you may also submit your right to opt out of any sales or sharing by clicking here or in instances where you would like additional support. You do not need to create an account with us to exercise your right to opt out of personal information sales or sharing. However, if applicable, we may ask you to provide additional personal information so that we can properly identify you in our dataset and to track compliance with your opt out request. We will only use personal information provided in an opt out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our systems. Once you make an opt-out request, you may change your mind and opt back in to future personal information sales at any time by contacting us at privacy@toasttab.com or by managing your preferences within the cookie management tool. 

 

E.   Accessibility

In the event you are a user with a disability, or are supporting an individual with a disability, and are having difficulty navigating this Statement or the information linked within this Statement, please contact us at privacy@toasttab.com for support. 

 

F.   Retention

We will retain your personal information for only as long as needed for the purpose of the processing activity or where we have a legitimate business need to retain it, subject to our legal and regulatory obligations to retain it longer and our applicable records retention periods. The duration of these periods will vary depending on the specific type of data and how it is used. The following are approximate retention periods, and may be subject to change:

 

  • in general, application materials are held for 5 years after hiring decision activity on your application ceases
  • at the start of employment with Toast, successful candidates will be notified of additional applicable retention periods

 

Our retention periods are also subject to any rights of individuals or other requirements that might dictate a shorter retention period (e.g., deletion requests). In certain cases, Toast may also maintain information for a longer period of time, such as in cases where the information is subject to a legal claim or complaint or where an individual has elected to participate in certain services, such as Toast’s Talent Community. Following those periods and other determinations on the duration of the processing of personal information by Toast, we will delete or take measures to anonymize your personal information. 

 

In all cases, the retention will be subject to any additional legal, regulatory, tax, accounting or other applicable obligations. 

 

Once retention of the personal information is no longer necessary for the purposes outlined above, we will either delete or de-identify the personal information or, if this is not possible (for example, because personal information has been stored in backup archives), then we will securely store the personal information and isolate it from further processing until deletion or deidentification is possible.

 

G.   Sensitive Personal Information

In the normal course of recruitment activities, we collect the following types of sensitive personal information:

Text, Paper

Presently, Toast does not use or discloses an individual’s sensitive personal information for purposes other than those specified in subdivision (a) of section 1798.121 of the CCPA  and as a result, has not included a Notice of Right to Limit.

 

H. Deidentified Information

We may at times receive, or process personal information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

 

I. Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the "Last updated" date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.

 


 

Addendum B – European Union/European Economic Area

Addendum where European Union and the European Economic Area data protection law applies


Last updated: September 1, 2022

The provisions below supplement the information provided in the generally applicable portion of our Statement and applies where the data protection laws of the European Union (“EU”) and the European Economic Area (“EEA”) apply. To the extent that there is a conflict between the provisions of this Addendum B and the provisions of the main body of the Statement, the provisions of this Addendum B shall prevail.

 

A.   Data controller(s)

For the purposes of the processing pursuant to this Statement, the data controller(s) will include:

Toasttab Ireland Limited (“Toast Ireland”)
124 St Stephen’s Green
Dublin 2
Ireland
D02 C628

 

Sling ehf. (“Sling Iceland”)
Gudrunartuni 8
105 Reykjavik
Iceland

 

Toast, Inc. (“Toast US”)
401 Park Drive, Suite 801
Boston, MA 02215
United States of America 


Toast US and Toast Ireland will manage the day-to-day responsibilities associated with the recruitment process although all parties are responsible for ensuring that personal information is collected and processed pursuant to the applicable law. These obligations include (a) the implementation of appropriate data protection policies, (b) the provision of appropriate notices and obtaining consents from data subjects (where applicable), (c) the management and notification of security incidents involving personal information, (d) the completion of data protection impact assessments (where appropriate) and (e) the implementation of appropriate technical and organizational security measures. Toast US is primarily responsible for managing any requests that you may make to exercise your rights under the GDPR or other applicable data protection legislation, on behalf of Toast Ireland or Sling Iceland. Where Toast Ireland or Sling Iceland receives a data subject request under the GDPR, those parties will promptly notify Toast US of the request. 

 

As a data controller, we are free to rely on “data processors” (as defined within the GDPR) and have engaged various third-party service providers in order to provide the services as well as for other purposes described in the main body of the Statement. For more information, see the “How we use and disclose your information” section of the Statement.


B.   Purposes and legal basis for processing

We collect and process your personal information based on the following grounds:

Text, Page, Flyer, Brochure, Poster, Advertisement, Paper, Document, Label

Where we process personal information on the basis of a legitimate interest (as identified above), as required by data protection law, we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of this Addendum.

 

Where we collect personal information to administer our contract with you or to comply with our legal obligations, this is mandatory and we will not be able to manage the application process/employment relationship without this information. In all other cases, provision of the requested personal information is optional, but this may affect your ability to participate in certain programs or systems or may disqualify you from employment with Toast, where the information is needed for those purposes. 

 

For certain positions, it will be necessary for us to verify the details you have supplied (for example, in relation to your identity, employment history, academic qualification and professional credentials) and to conduct pre-employment background checks (for example, in relation to previous criminal convictions or financial standing). The level of checks will depend on your role, in particular whether you will occupy a regulated role, and will be conducted at as late a stage as is practicable in the recruitment process and often only after you have been selected for the position. If your application is successful, we will provide further information about the checks involved and will obtain any necessary consent prior to completing such checks. 

 

C.   International transfers

We may transfer the personal information we collect about you pursuant to the purposes described in this Statement outside the EU/EEA, including to countries that have not been found by the GDPR and EU/EEA data protection law to provide adequate protection. 

 

In particular, we may transfer your personal information to third parties, including to parties located the United States. We use appropriate safeguards for the transfer of personal information to third party service providers.  Where required, we have implemented the EU/EEA approved standard contractual clauses, rely on a service provider’s processor binding corporate rules or have implemented/rely on other legally recognized safeguards for data transfer purposes.

 

We also use appropriate safeguards for the transfer of personal information among our affiliates in the United States. We have implemented the EU/EEA approved standard contractual clauses or have implemented/rely on other legally recognized safeguards for data transfer purposes. 

 

To obtain a copy of the standard contractual clauses or other transfer safeguards, please send a request to privacy@toasttab.com.

 

D.   Your rights

Where EU or EEA data protection law applies, you have additional rights in relation to how your personal information is processed, including the right to:

  • request access to and obtain a copy of your personal information;
  • request the transfer of your personal information you have provided to us to you or another company in a structured, commonly used and machine-readable format;
  • request rectification of your personal information when it is inaccurate or incomplete;
  • request erasure of your personal information where permitted under the applicable law, such as where the information is no longer necessary or lawful for us to store or where your information is outdated;
  • restrict or object to the processing of your personal information (as applicable); and
  • withdraw your consent at any time where this is the legal basis on which we are processing your personal information. If you ask to withdraw your consent, this will not affect any processing which has already taken place at that time.

 

Please note that if you choose to withdraw your consent, you may not be able to participate in or benefit from certain aspects of the recruitment process. Your rights will in each case be subject to the restrictions set out in the Irish Data Protection Law or other applicable EU/EEA law.  

 

You may exercise these rights free of charge by submitting your request here or otherwise by contacting privacy@toasttab.com.  Subject to the applicable law, Toast may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive, in particular because of its repetitive character. In some situations, Toast may refuse to act or impose limitations on the information disclosed if, for instance, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.

 

You also have the right to lodge a complaint about our processing of your personal information with a Supervisory Authority in the Member State of your habitual residence, place of work or place of the alleged infringement as defined in Section G below.

 

E.   Retention

If you are successful: we will retain your personal information only for as long as we need it for Toast's legitimate interest in accordance with applicable law, for the purposes of the recruitment process and, once this process is finished, for an appropriate period so as to be able to deal with any legal claims linked to the application process. Recruitment records for successful applicants are generally kept for five (5) years. After this period, we will take steps to delete your personal information or hold it in a form that no longer identifies you. If you become a Toast employee, relevant personal information you provide will become a part of your employee file and may be used later for the management of the employment relationship. You will be provided with further information regarding the retention of your personal information when you are an employee.

 

If you are not successful: we will retain your personal information for a period of time of five (5) years so we can keep you in mind for potential future roles and applicant-related analytics.

 

If you elect to join Toast’s Talent Community, your information will be stored pursuant to Toast's legitimate interest in accordance with applicable law, for the purposes of recruitment and communicating with you in relation to events and news at Toast. Your information will be stored until the purposes for which the information was collected ceases to exist or unless you communicate with us to unsubscribe or otherwise remove your information. 

 

F.   How to contact Toast 

If you have data protection questions specific to Toast, you can reach us at: 

Toast Ireland

Attention: Toast Ireland Data Protection Office 
Toasttab Ireland Limited
124 St Stephen’s Green
Dublin 2 
D02 C628
Ireland 
Email: privacy@toasttab.com 

 

Sling Iceland

Attention: Toast Iceland Data Protection Office
Sling ehf. 
Gudrunartuni 8
105 Reykjavik
Iceland
Email: privacy@toasttab.com 

 

G.   Lodging a complaint

If you are not satisfied with the processing of your personal information by Toast Ireland, Sling Iceland or Toast US, you have the right to lodge a complaint with the relevant Supervisory Authority in the Member State of your habitual residence, place of work or place of the alleged infringement. Details can be found below:

     


     

Addendum C – United Kingdom

Addendum where United Kingdom data protection law applies


Effective date: September 1, 2022

The provisions below supplement the information provided in the generally applicable portion of our Statement and apply where the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (together the “UK Data Protection Law”) apply, which includes where the entity you are applying to is Toasttab UK Ltd. To the extent that there is a conflict between the provisions of this Addendum C and the provisions of the main body of the Statement, the provisions of this Addendum C shall prevail.

 

A.   Data controller(s)

For the purposes of the processing pursuant to this Statement, the data controller(s) will include:

Toasttab UK Limited (“Toast UK”)
3rd Floor, 1 Ashley Road

Altrincham

Cheshire

WA14 2DT

United Kingdom


Toast, Inc. (“Toast US”)
401 Park Drive, Suite 801

Boston, MA 02215

United States of America 

 

Toast US and Toast UK will manage the day-to-day responsibilities associated with the recruitment process and both parties are responsible for ensuring that personal information is collected and processed pursuant to the applicable law. These obligations include (a) the implementation of appropriate data protection policies, (b) the provision of appropriate notices and obtaining consents from data subjects (where applicable), (c) the management and notification of security incidents involving personal information, (d) the completion of data protection impact assessments (where appropriate) and (e) the implementation of appropriate technical and organizational security measures. Toast US is primarily responsible for managing any requests that you may make to exercise your rights under the UK GDPR or other applicable data protection legislation, on behalf of Toast UK. Where Toast UK receives a data subject request under the UK GDPR, Toast UK will promptly notify Toast US of the request. 

 

As a data controller, we are free to rely on “data processors” (as defined within the UK GDPR) and have engaged various third-party service providers in order to provide the services as well as for other purposes described in the main body of the Statement. For more information, see the “How we use and disclose your information” section of the Statement. 

 

B.   Purposes and legal basis for processing

We collect and process your personal information based on the following grounds:

Text, Page, Flyer, Brochure, Poster, Advertisement, Paper, Document, Label

Where we process personal information on the basis of a legitimate interest (as identified above), as required by data protection law, we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of this Addendum.

 

Where we collect personal information to administer our contract with you or to comply with our legal obligations, this is mandatory and we will not be able to manage the application process/employment relationship without this information. In all other cases, provision of the requested personal information is optional, but this may affect your ability to participate in certain programs or systems or may disqualify you from employment with Toast, where the information is needed for those purposes. 

 

For certain positions, it will be necessary for us to verify the details you have supplied (for example, in relation to your identity, employment history, academic qualification and professional credentials) and to conduct pre-employment background checks (for example, in relation to previous criminal convictions or financial standing). The level of checks will depend on your role, in particular whether you will occupy a regulated role, and will be conducted at as late a stage as is practicable in the recruitment process and often only after you have been selected for the position. If your application is successful, we will provide further information about the checks involved and will obtain any necessary consent prior to completing such checks.

 

C.   International transfers

We may transfer the personal information we collect about you pursuant to the purposes described in this Statement outside the UK, including to countries that have not been found by UK Data Protection Law to provide adequate protection. 

 

In particular, we may transfer your personal information to third parties in such countries, including the United States. We use appropriate safeguards for the transfer of personal information to third party service providers.  Where required, we have implemented the UK approved standard contractual clauses or the UK approved addendum to the European Commission approved standard contractual clauses, rely on a service provider’s processor binding corporate rules or have implemented/rely on other legally recognized safeguards for data transfer purposes.

 

We also use appropriate safeguards for the transfer of personal information among our affiliates in the United States. We have implemented the UK approved standard contractual clauses or the UK approved addendum to the European Commission approved standard contractual clauses or have implemented/rely on other legally recognized safeguards for data transfer purposes. 

 

To obtain a copy of the standard contractual clauses or other transfer safeguards, please send a request to privacy@toasttab.com.

 

D.   Your rights

Where UK Data Protection Law applies, you have additional rights in relation to how your personal information is processed, including the right to:

  • request access to and obtain a copy of your personal information;
  • request the transfer of your personal information you have provided to us to you or another company in a structured, commonly used and machine-readable format;
  • request rectification of your personal information when it is inaccurate or incomplete;
  • request erasure of your personal information where permitted under the applicable law, such as where the information is no longer necessary or lawful for us to store or where your information is outdated;
  • restrict or object to the processing of your personal information (as applicable); and
  • withdraw your consent at any time where this is the legal basis on which we are processing your personal information. If you ask to withdraw your consent, this will not affect any processing which has already taken place at that time.

 

Please note that if you choose to withdraw your consent, you may not be able to participate in or benefit from certain aspects of the recruitment process. Your rights will in each case be subject to the restrictions set out in UK Data Protection Law.  

 

You may exercise these rights free of charge by submitting your request here or otherwise by contacting privacy@toasttab.com.  Subject to UK Data Protection Law, Toast may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive, in particular because of its repetitive character. In some situations, Toast may refuse to act or impose limitations on the information disclosed if, for instance, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.

 

You also have the right to lodge a complaint about our processing of your personal information with the UK Information Commissioner’s Office.

 

E.   Retention

If you are successful: we will retain your personal information only for as long as we need it for Toast's legitimate interest in accordance with applicable law, for the purposes of the recruitment process and, once this process is finished, for an appropriate period so as to be able to deal with any legal claims linked to the application process. Recruitment records for successful applicants are generally kept for five (5) years. After this period, we will take steps to delete your personal information or hold it in a form that no longer identifies you. If you become a Toast employee, relevant personal information you provide will become a part of your employee file and may be used later for the management of the employment relationship. You will be provided with further information regarding the retention of your personal information when you are an employee.

 

If you are not successful: we will retain your personal information with your permission for five (5) years so we can keep you in mind for future recruitment processes.

 

To the extent you elect to join Toast’s Talent Community, your information will be stored pursuant to Toast's legitimate interest in accordance with applicable law, for the purposes of recruitment and communicating with you in relation to events and news at Toast. Your information will be stored until the purposes for which the information was collected cease to exist or unless you communicate with us to unsubscribe or otherwise remove your information. 

 

F.   How to contact Toast 

If you have data protection questions specific to Toast, you can reach us at: 

Toast UK 

Attn: Toast UK Data Protection Office
3rd Floor, 1 Ashley Road
Altrincham
Cheshire
WA14 2DT
United Kingdom
Email: privacyoffice@toasttab.com

 

G.   Lodging a complaint

If you are not satisfied with the processing of your personal information, you have the right to lodge a complaint with the UK Information Commissioner’s Office. Details can be found below: