Text, Graphics, Art

Toast Applicant Privacy Statement

A. Scope

This Statement applies to personal information (i.e. information about an identified or identifiable individual) we collect and process (whether electronically, in writing or orally) from applicants seeking employment with Toast, Inc. and its subsidiaries and affiliates (collectively "Toast", "we", "us" and/or "our") during the application and recruitment stage.

This Statement is comprised of two sections - a generally applicable statement and location-specific addendums. This initial section describes the standards in relation to how Toast as a whole collects and manages information during the application and recruitment stage. To the extent there are variations within a specific market or additional information that is required to be provided under the applicable law, a local market addendum has been attached. Links to the pertinent sections can be found below:

  • United States (California)
  • European Union
B. Information we collect and process

Toast collects personal information during the application stage which includes:

personal details such as your name;
contact information, including your email address and phone number;
professional and educational history;
certifications and skills;
job preferences and interests; and
names and contact details of references.
We collect certain sensitive categories of personal information to comply with the applicable law as well as if needed for legitimate business purposes with your consent (e.g. equal opportunity compliance). This may include information about your race, ethnicity, gender, veteran status and any physical limitations or other medial or health-related workplace accommodations.

In certain instances, Toast may also collect additional information from third parties that assist us during the recruitment stage, including, where applicable, the results of credit and criminal background checks, drug and alcohol testing and other screening procedures. You may also elect to have third parties, such as social media providers, share information with us as part of the recruitment process or we may collect this information if publicly available.

The personal information collected may vary from jurisdiction to jurisdiction in accordance with applicable law. Your provision of certain information is optional, however, your failure to provide certain information may disqualify you from employment with Toast.

C. How we use and disclose your information

We use personal information to assess your qualifications for employment during the recruitment stage. This may include contacting you after you have applied, contacting references that you have provided and carrying out background checks. We also may use your information to comply with any applicable legal obligations, record-keeping or reporting obligations as well as to establish, exercise or defend against any legal claims.

In order to carry out the services and objectives contemplated in this Statement, your information will be shared with third parties that assist us during the recruitment process. We may also share information with third parties:

  • if we believe that the disclosure is required to comply with the applicable law or the legal process;
  • in the event of a merger, acquisition, asset sale or other related transaction; and
  • if we believe that disclosure is required to protect the safety of our employees, the public or Toast property.

As part of our recruitment process, we may also use information you provide (on either an individual-specific or aggregated basis) to improve our application and hiring process at Toast. If you elect to do so, we may also use your information to contact you in the future, for example, if you join our Talent Community.

D. Data transfers and centralized processing

Toast has centralized and outsourced various aspects of our business to improve how we manage and administer our recruitment process. As a result, it may be necessary to transfer your information to a country outside of the country where it was originally collected or outside of your country of residence in order to assess your qualifications for employment. These transfers may be to any Toast entity around the world as well as to third-party service providers that help Toast manage and administer its recruitment process.

E. Security

We have in place appropriate technical, physical and organizational security measures that are designed to protect against unauthorized access, disclosure, damage or loss of personal information. The collection, transmission and storage of information can never be guaranteed to be completely secure. However, we take steps to ensure that appropriate security safeguards are in place internally and with our third-party service providers to protect your personal information.

F. Retention

Subject to the applicable law, Toast will only retain your personal information for the duration of time necessary to assess your qualifications for employment or otherwise in accordance with our record retention schedules. We may retain aggregated information in order to improve our recruitment and hiring practices for a longer duration, however, that information cannot be used to identify you. You may also elect to have your information remain with Toast for a longer duration, for example, if you decide to participate in Toast's Talent Community.

G. Access to and control of your information

We want to ensure that you have the necessary tools at your disposal to control the information that you provide to us. It is also important that you contact us to keep your information accurate and up to date. To the extent you are not able to update your information directly through our application portal or website, please contact us at privacy@toasttab.com. Depending on your location, you may be entitled to request access to, erase, restrict and object to the processing of your personal information that is held by Toast. These requests should also be sent to privacy@toasttab.com.

These requests will be reviewed and processed in line with local law. If you are located in a European Union Member State or in the State of California, please see the respective addendums for additional information on your rights in this area.

H. Cookies and other tracking technologies

We use cookies (a small text file placed and saved in your browser when you access our websites), web beacons (a graphic file place on a website to gather usage and performance data) and other tracking technologies as part of providing the services described in this Statement. In certain instances, cookies and other tracking technologies may also be used to serve you more relevant advertisements and for other personalization purposes. These technologies may be set by us or by third parties. There are ways to control and/or reject the setting of cookies and similar technologies within your browser settings. As each browser is different, please consult the "help" menu within your browser. Depending on the services being used, restricting cookies may prevent you from accessing and using all or part of the services.

I. Your choices about online ads

We support the self-regulatory principles for online advertising ("Principles") published by the Digital Advertising Alliance (DAA). This means that we allow you to exercise choice regarding the collection of information about your online activities over time and across third-party websites for online interest-based advertising purposes. More information about these Principles can be found at www.aboutads.info. If you want to opt out of receiving online interest-based advertisements on your internet browser from advertisers and third parties that participate in the DAA program and perform advertising-related services for us and our partners, please follow the instructions at www.aboutads.info/choices, or http://www.networkadvertising.org/choices/ to place an opt-out cookie on your device indicating that you do not want to receive interest-based advertisements. Opt-out cookies only work on the internet browser and device they are downloaded onto. If you want to opt out of interest-based advertisements across all your browsers and devices, you will need to opt out on each browser on each device you actively use. If you delete cookies on your device generally, you will need to opt out again. If you want to opt out of receiving online interest-based advertisements on mobile apps, please follow the instructions at http://www.aboutads.info/appchoices.

Please note that when you opt out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us or on our online services. It means that the online ads that you do see from DAA program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third-parties' opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA's Principles.

J. Questions and how to contact us

If you have any questions in relation to the collection and management of your personal information by Toast under this Statement, please contact Toast's Privacy Office at privacy@toasttab.com.

K. Changes to this Statement

From time to time we may change, modify or amend this Statement in order to comply with the evolving regulatory environment or the way we operate our business. Subject to any applicable legal requirements to provide additional notice and/or obtain consent, any changes to this Statement will be communicated to you through this website.

L. Effective date

July 14, 2020


 
Addendum A - United States (California)
Privacy Statement for California Residents as required by the California Consumer Privacy Act of 2018 ("CCPA")
Last updated : July 14, 2020

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of California and qualify as a "Consumer" under the CCPA. This California-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the CCPA. Any terms defined in the CCPA or as otherwise defined in our Privacy Statement have the same meaning as used in this addendum.

When we use the term "personal information" in this Statement, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.


A. CCPA personal information table

To help you understand how Toast uses your personal information, the below table summarizes:

  • The categories of personal information collected by Toast in the past 12 months;
  • The sources of collection of the personal information;
  • How we use your personal information; and
  • The categories of personal information disclosed for a business purposes by Toast in the past 12 months.

Please see the generally applicable section of this Privacy Statement for additional information on Toast's information practices, including more detail on how we use and disclose your personal information.

privacy_categories.png

B. Categories of personal information sold

Toast does not "sell" personal information as most individuals would typically understand that term. However, we do allow certain third-party advertising partners to collect information about consumers through our services for purposes of serving ads that are more relevant, for tracking and analytics, and for ad fraud detection and reporting. The categories of personal information impacted may include:

  • Identifiers;
  • Internet/Network Information; and
  • Inferences.

Each of the above categories of information may be disclosed to our third-party service providers or business partners depending on the nature of a user’s interaction. To the extent this practice is interpreted to constitute a “sale” under the CCPA, please see our Privacy Statement sections titled “Cookies and other tracking technologies” and “Your choices for online ads” for more information including how to exercise your rights to opt-out of cookies, analytics and personalized advertising.

To the extent that these practices qualify as “sales” under the CCPA, you may have the right to opt out as described in the “How to invoke your rights” section below. Toast has no actual knowledge that the “sales” described above include the personal information of individuals under 16 years of age.


C. Description of rights available to Consumers

A number of individual rights are available to individuals under the CCPA relating to personal information that we have collected (subject to certain limitations at law), including:

  • The right of access : you have the right to request that an in-scope business that collects personal information from you, disclose the following in relation to the preceding 12 month period, upon verification of your identity: (i) the categories of personal information collected about you, (ii) the categories of sources where the personal information was collected, (iii) the business or commercial purposes for collecting (or where applicable, selling) the personal information, (iv) the categories of personal information that we have disclosed to third parties for a business purpose along with the corresponding recipients, (v) the categories of personal information we have sold along with the corresponding recipients, and (vi) the specific pieces of personal information collected about you.
  • The right of deletion : you have the right to request that an in-scope business delete personal information that it has collected from you, subject to certain exceptions.
  • The right to opt out of personal information sales : you have the right to request that an in-scope business refrain from selling personal information it has collected about you to third parties now or in the future. If you are under the age of 16, you have the right to opt in, or to have a parent or guardian opt in on your behalf, to such sales.
  • The right against discrimination : you have the right to not be discriminated against as a result of exercising any of the above rights. However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner.

Please note that your ability to invoke the rights above are limited pursuant to the scope and limitations of the CCPA, including any available exceptions. For example, an access request can only be made twice by a Consumer within a 12 month period.


D. How to invoke your rights

Toast has established an individual rights center for the purposes of submitting your individual rights requests above. The link to Toast's individual rights center can be found here. Individual rights requests can also be submitted to Toast through the below channels:

  • Mail:   Attn: Toast Privacy Office
               Toast, Inc.
               401 Park Drive, Suite 801 Boston, MA 02215
  • Email: privacy@toasttab.com
  • Toll-free phone number: (866) 226-4484

Once an individual rights request has been submitted, Toast may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your application. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law.

As noted above, we do not “sell” personal information as traditionally defined, but certain third-party advertising practices may qualify as "sales" under the CCPA. To the extent applicable, an opt-out mechanism has been provided in the "Categories of personal information sold" section above. You may also exercise your right to opt out of any sales outside this scope by clicking here. You do not need to create an account with us to exercise your right to opt out of personal information sales. However, if applicable, we may ask you to provide additional personal information so that we can properly identify you in our dataset and to track compliance with your opt out request. We will only use personal information provided in an opt out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our systems. Once you make an opt-out request, you may change your mind and opt back in to future personal information sales at any time by contacting us at privacy@toasttab.com.


E. Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the "Last updated" date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.



Addendum B - European Union
Addendum for Individuals located within the European Union and the European Economic Area
Last updated: July 14, 2020


The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of the European Union, the European Economic Area or are otherwise afforded rights pursuant to the General Data Protection Regulation ("GDPR").


A. Data controller(s)

For the purposes of the processing pursuant to this Statement, the data controller(s) will include:

  • Toasttab Ireland Limited
    34-37 Clarendon Street
    Dublin 2
    Ireland
    D02 DE61
  • Toast, Inc.
    401 Park Drive, Suite 801
    Boston, MA 02215
    United States of America
B. Legal basis for processing

We collect and process your personal information based on the following grounds:

  • At your direction, to assess your suitability for employment with Toast during the recruitment process;
  • For the purposes of complying with legal obligations or in connection with related claims;
    Inferences.
  • For our legitimate interests and to improve our recruitment process; and
  • If applicable, with your consent.
C. International transfers

The provisions below supplement the information. We may transfer the personal information we collect about you pursuant to the purposes described in this Statement to countries that have not been found by the European Commission to provide adequate protection. In particular, we may transfer your personal information to the United States. We use appropriate safeguards for the transfer of personal information among our affiliates in various jurisdictions, and where required, we have implemented European Union controller-to-controller standard contractual clauses or other such safeguards for such purposes. To obtain a copy of theses clauses or additional information on transfers, please address these requests to privacy@toasttab.com .n provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of the European Union, the European Economic Area or are otherwise afforded rights pursuant to the General Data Protection Regulation ("GDPR").


D. Sensitive personal information

Toast collects sensitive personal information as part of the recruitment process where required under the applicable law or pursuant to local requirements. Where permitted under the applicable law, we may also collect sensitive personal information if you elect to provide it where we have a legitimate interest in collecting the information.


E. Choice and access

If you are located in the European Union, you have additional rights in relation to how your personal information is processed, including the right to:

  • Request access to and obtain a copy of your personal information;
  • Request the transfer of your personal information you have provided to us to you or another company;
  • Request rectification of your personal information when it is inaccurate or incomplete;
  • Request erasure of your personal information where permitted under the applicable law, such as where the information is no longer necessary or lawful for us to store or where your information is outdated;
  • Restrict or object to the processing of your personal information; and
  • Withdraw your consent at any time where you voluntarily participate in Toast's initiatives.

Please note that if you choose to withdraw your consent, you may not be able to participate in or benefit from the programs, services and initiatives for which you provided consent to the processing of your personal information.

You may exercise these rights free of charge by submitting your request here or to privacy@toasttab.com. However, subject to the applicable law, Toast may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive, in particular because of its repetitive character. In some situations, Toast may refuse to act or impose limitations on the information disclosed if, for instance, the disclosure is likely to adversely affect the rights and freedoms of others, prejudice the execution or enforcement of the law, or interfere with pending or future litigation.

You also have the right to lodge a complaint about our processing of your personal information with a Supervisory Authority in the Member State of your habitual residence, place of work or place of the alleged infringement.