Toast Applicant Privacy Statement

A.   Scope 

This Statement applies to personal information (i.e. information about an identified or identifiable individual) we collect and process (whether electronic all, in writing or orally) from applicants seeking employment with Toast, Inc. and its subsidiaries and affiliates (collectively “Toast”, “we”, “us” and/or “our”) during the application and recruitment stage. 

To see our California Privacy Statement, please click the link or scroll down.

This Statement is comprised of two sections – a generally applicable statement and location-specific addendums. This initial section describes the standards in relation to how Toast as a whole collects and manages information during the application and recruitment stage. To the extent there are variations within a specific market or additional information that is required to be provided under the applicable law, a local market addendum can be viewed below. Links to the pertinent sections can be found below:

• United States (California)
• European Union/European Economic Area
• United Kingdom
   

B.   Information we collect and process

Toast collects personal information during the application stage which includes: 

• personal details such as your name;
• contact information, including your email address and phone number;
• information about your location;
• professional and educational history;
• certifications and skills;
• job preferences and interests;
• information around work authorizations and sponsorship; and
• names and contact details of references. 
   

We collect certain sensitive categories of personal information to comply with the applicable law as well as if needed for legitimate business purposes with your consent (e.g. equal opportunity compliance).  This may include information about your race, ethnicity, gender, veteran status and any physical limitations or other medical or health-related workplace accommodations. 

In certain instances, Toast may also collect additional information from recruiters, referees and other third parties that assist us during the recruitment stage, including, where applicable, the results of credit and criminal background checks, drug and alcohol testing and other screening procedures from third-party background screening providers. You may also elect to have third parties, such as social media providers, share information (e.g., your resume) with us as part of the recruitment process or we may collect this information if publicly available. 

The personal information collected may vary from jurisdiction to jurisdiction in accordance with applicable law. Your provision of certain information is optional, however, your failure to provide certain information may disqualify you from employment with Toast.

C.   How we use and disclose your information 

Toast will use and share the personal information it collects from you or otherwise processes from you in order to fulfil the purposes set forth in this Statement. We maintain a number of relationships with third-party service providers as well as business partners that we use to support our business activities, including recruitment.

We use personal information to assess your qualifications for employment during the recruitment stage. This may include contacting you after you have applied, contacting references that you have provided and carrying out background checks. We also may use your information to comply with any applicable legal obligations, record-keeping or reporting obligations as well as to establish, exercise or defend against any legal claims. 

Personal information will primarily be processed by employees within our human resources, information technology and workplace experience teams in addition to stakeholders you might engage with as part of the role. In order to carry out the services and objectives contemplated in this Statement, your information will be shared with Toast’s other subsidiaries and affiliates as well as third-party service providers and vendors used as part of the recruitment process. We may also share information with third parties: 

• if we believe that the disclosure is authorized or required by applicable law, regulation legal process or governmental request (including, for example, a court order, subpoena or search warrant);  
• in the event of a merger, acquisition, asset sale or other related transaction; or
• if we believe that disclosure is required to protect the safety of our employees, the public or Toast property. 
   

Where we check references or previous employment and education, we disclose the fact that you have applied to us to educational institutions and to previous employers.

As part of our recruitment process, we may also use information you provide (on either an individual-specific or aggregated basis) to improve our application and hiring process at Toast, which may include using information to understand applicant trends and for bias reduction purposes.. If you elect to do so, we may also use your information to contact you in the future, for example, if you join our Talent Community.

 
D.   Data transfers and centralized processing 

Toast has centralized and outsourced various aspects of our business to improve how we manage and administer our recruitment process. As a result, it may be necessary to transfer your information to a country outside of the country where it was originally collected or outside of your country of residence in order to assess your qualifications for employment. These transfers may be to any Toast entity around the world as well as to third-party service providers that help Toast manage and administer its recruitment process. 

The privacy laws in other countries to which we transfer your information may or may not be as comprehensive as the privacy laws of the country where the information was originally collected or of your country of residence. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of the country to which your information is transferred may be able to obtain access to your personal information through the laws of that country. 

We use appropriate safeguards for the transfer of personal information among our affiliates and to third-party service providers in various jurisdictions, and have implemented appropriate contractual arrangements, standard contractual clauses or other measures for such purposes, including by requiring that third parties only use personal information provided for the limited purposes for which it was disclosed and apply appropriate security measures to protect the information. To obtain a current list of the countries where applicant data is collected, used, disclosed and/or stored, as well as additional information regarding the purposes for which our service providers have been authorized to collect, use, disclose and/or store personal information for or on behalf of Toast, please contact privacy@toasttab.com. 

 
E.   Security 

We have in place appropriate technical, physical and organizational security measures that are designed to protect against unauthorized access, disclosure, damage or loss of personal information. The collection, transmission and storage of information can never be guaranteed to be completely secure. However, we take steps to ensure that appropriate security safeguards are in place internally and with our third-party service providers to protect your personal information. 

 
F.   Retention 

Subject to the applicable law, Toast will only retain your personal information for the duration of time necessary to assess your qualifications for employment or otherwise in accordance with our record retention schedules. We may retain aggregated information in order to improve our recruitment and hiring practices for a longer duration, however, that information cannot be used to identify you. You may also elect to have your information remain with Toast for a longer duration, for example, if you decide to participate in Toast’s Talent Community. 

 
G.   Access to and control of your information

We want to ensure that you have the necessary tools at your disposal to control the information that you provide to us. We rely on you to ensure your information is accurate, complete, and up to date. It is therefore important that you contact us to keep your information accurate and up to date. To the extent you are not able to update your information directly through our application portal or website, please contact us at privacy@toasttab.com.  

Depending on your location, you may be entitled to request access to, erase, restrict and object to the processing of your personal information that is held by Toast or request further information regarding the use and disclosure of your personal information. These requests will be reviewed and processed in line with local law. In certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by applicable law. These requests should also be sent to privacy@toasttab.com. 

See your respective location-specific addendum for additional information on your rights in this area. 

 
H.   Cookies and other tracking technologies

We use cookies (a small text file placed and saved in your browser when you access our websites), web beacons (a graphic file place on a website to gather usage and performance data) and other tracking technologies as part of providing the services described in this Statement. In certain instances, cookies and other tracking technologies may also be used to serve you more relevant advertisements and for other personalization purposes. These technologies may be set by us or by third parties.  There are ways to control and/or reject the setting of cookies and similar technologies within your browser settings. As each browser is different, please consult the “help” menu within your browser. Depending on the services being used, restricting cookies may prevent you from accessing and using all or part of the services. 

We may use these technologies:

•  to uniquely identify you and/or your device;
• to store your preferences as part of providing the services;
• for security and fraud-prevention purposes;
• to analyze and monitor the performance of our services;
• to improve our services; and
• to understand your use of the services over time.

We also use pixels and related technologies as part of session replay services on certain websites that are used to understand and improve functionality and an individual’s experience on those sites.

For more information about Toast’s use of cookies and how you can manage them, please see Toast’s Cookie Policy found here or visit our Privacy Statement section titled "Cookies and other tracking technologies" found on https://pos.toasttab.com/privacy. 

 
I.   Questions and how to contact us

If you have any questions or concerns in relation to the collection and management of your personal information by Toast under this Statement and applicable privacy laws, please contact Toast’s Privacy Office at privacy@toasttab.com.

 
J.   Changes to this Statement

We reserve the right to update, change, modify or amend this Statement in order to comply with the evolving regulatory environment or the way we operate our business.  Outside of any applicable legal requirements to provide additional notice and/or obtain consent, we will provide you with notice when we make any substantial updates. In addition to updating this website, we may also notify you in other ways from time to time about the processing of your personal information. 

 
K.   Effective date

July 1, 2023

Addendum A – United States (California)
Privacy Statement for California Residents as required by the California Consumer Privacy Act of 2018 (including as amended by the California Privacy Rights Act of 2020)(“CCPA”)

Last updated: July 1, 2023

The provisions below supplement the information provided in the generally applicable portion of our Statement and apply solely to individuals that are residents of California and qualify as a “Consumer” under the CCPA. This California-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the CCPA. Any terms defined in the CCPA or as otherwise defined in our Statement have the same meaning as used in this addendum. 

When we use the term “personal information” in this Addendum A, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. 

 
A.   CCPA personal information table

To help you understand how Toast uses your personal information, the below table summarizes:

• The categories of personal information collected by Toast in the past 12 months;
• The sources of collection of the personal information;
• How we use your personal information; and
• The categories of personal information disclosed for a business purpose by Toast (including to third parties) in the past 12 months.
   

Please see the generally applicable section of this Privacy Statement for additional information on Toast’s information practices, including more detail on how we use and disclose your personal information. 

Please note that the actual personal information collected, used and disclosed will depend on the nature of your relationship with Toast and the services you interact with and use as part of that relationship. 

B.   Categories of personal information sold or shared

While Toast does not “sell” personal information in the traditional sense, we do, however, sell or share personal information for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual's activities across businesses or distinctly-branded websites, applications or other services (otherwise known as "targeted advertising" or "cross-context behavioral advertising"), for personalization features and for tracking and analytics purposes. The categories for personal information impacted in the preceding 12 months may include:

• Identifiers;
• Internet/Network Information; and
• Inferences.
   

Each of the above categories of information may be disclosed to third parties, which may include our business partners depending on the nature of a user’s interactions. To the extent the setting of cookies and similar technologies is interpreted to constitute a “sale” under the CCPA, Consumers can exercise their right to opt out of these sales through our cookie management tool that can be accessed by clicking on our “Do Not Sell My Personal Information” link at the bottom of https://pos.toasttab.com or other applicable websites. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our websites will recognize opt-out preference settings only on domains of our websites where any “selling” or “sharing” occurs. You may also review our Privacy Statement section titled “Cookies and other tracking technologies” found at https://pos.toasttab.com/privacy for more information on how Toast uses cookies, analytics and personalized advertising.  Toast has no actual knowledge that the “sales” or “sharing” described above include the personal information of individuals under 16 years of age. 

 
C.   Description of rights available to Consumers

If you are a resident of the state of California and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights: 

• The right to know/access: you have the right to request that an in-scope business that collects personal information from you, disclose the following in relation to the preceding 12 month period, upon verification of your identity: (i) the categories of personal information collected about you, (ii) the categories of sources where the personal information was collected, (iii) the business or commercial purposes for collecting (or where applicable, selling or sharing) the personal information, (iv) the categories of personal information that we have disclosed to third parties for a business purpose along with the corresponding recipients, (v) the categories of personal information we have sold or shared along with the corresponding recipients, and (vi) the specific pieces of personal information collected about you.
• The right of correction: you have the right to request that an in-scope business correct inaccurate personal information, subject to certain conditions.
• The right to opt out of the sale or sharing of personal information: you have the right to request that an in-scope business refrain from selling or sharing personal information it has collected about you to third parties now or in the future. If you are under the age of 16, you have the right to opt in, or to have a parent or guardian opt in on your behalf, to such sales or sharing.
• The right to limit the use and disclosure of sensitive personal information: to the extent that we use sensitive personal information for purposes beyond those set forth in subdivision (a) of Section 1798.121, you have the right to limit the use or disclosure of that sensitive personal information subject to the exceptions within the CCPA.
• The right of access to and to the ability to opt-out of automated decision-making technology: subject to further regulations being issued, you have the right to access information pertaining to automated decision-making technologies and the ability to opt out.
• The right against discrimination and retaliation: you have the right to not be discriminated or retaliated against as a result of exercising any of the above rights.
   

However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you with certain services or engage with you in the same manner. In addition, the exercise of the rights described above may result in a different quality or level of service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law. Additionally, your ability to invoke the rights above are limited pursuant to the scope and limitations of the CCPA, including any available exceptions. For example, an access request can only be made twice by a Consumer within a 12-month period. 

D.   How to invoke your rights

Toast has established an individual rights portal as well as other channels for the purposes of submitting your individual rights requests above. Individual rights requests can be submitted to Toast through the below channels:

• Web portal: Individual Rights Portal
• Mail: 
  Attn: Toast Privacy Office
  Toast, Inc.
  401 Park Drive, Suite 801 Boston, MA 02215
• Email: privacy@toasttab.com  
• Toll-free phone number: (866) 226-4484
   

Once an individual rights request has been submitted, Toast may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your engagement with Toast. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. In these instances, we will take steps to verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request. Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law in relation to individual rights submissions.   

To Exercise the Right to Opt Out of the Selling or Sharing of Personal Information

Unless you have exercised your right to opt out of the sale or sharing of personal information, we may “sell” or “share” your personal data to third parties for targeted or cross-context behavioral advertising purposes, for personalization features and for tracking and analytics purposes. The third parties to whom we sell or share personal information may use such information for their own purposes in accordance with their own privacy statements. In these instances, the right to opt out of the sale of personal information can be invoked through our cookie management tool that can be accessed by clicking on our “Do Not Sell or Share My Personal Information” link at the bottom of https://pos.toasttab.com or other applicable websites. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our websites will recognize opt-out preference settings only on domains of our websites where any “selling” or “sharing” occurs. Although Toast does not currently engage in other practices at this time that may constitute a “sale” or “sharing” beyond these instances and the methods above are the most effective methods to manage your preferences, you may also submit your right to opt out of any sales or sharing by clicking here or in instances where you would like additional support. You do not need to create an account with us to exercise your right to opt out of personal information sales or sharing. However, if applicable, we may ask you to provide additional personal information so that we can properly identify you in our dataset and to track compliance with your opt out request. We will only use personal information provided in an opt out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our systems. Once you make an opt-out request, you may change your mind and opt back in to future personal information sales at any time by contacting us at privacy@toasttab.com or by managing your preferences within the cookie management tool. 

E.   Accessibility

In the event you are a user with a disability, or are supporting an individual with a disability, and are having difficulty navigating this Statement or the information linked within this Statement, please contact us at privacy@toasttab.com for support. 

F.   Retention

We will retain your personal information for only as long as needed for the purpose of the processing activity or where we have a legitimate business need to retain it, subject to our legal and regulatory obligations to retain it longer and our applicable records retention periods. The duration of these periods will vary depending on the specific type of data and how it is used. The following are approximate retention periods, and may be subject to change:

• in general, application materials are held for 5 years after hiring decision activity on your application ceases
• at the start of employment with Toast, successful candidates will be notified of additional applicable retention periods

Our retention periods are also subject to any rights of individuals or other requirements that might dictate a shorter retention period (e.g., deletion requests). In certain cases, Toast may also maintain information for a longer period of time, such as in cases where the information is subject to a legal claim or complaint or where an individual has elected to participate in certain services, such as Toast’s Talent Community. Following those periods and other determinations on the duration of the processing of personal information by Toast, we will delete or take measures to anonymize your personal information. 

In all cases, the retention will be subject to any additional legal, regulatory, tax, accounting or other applicable obligations. 

Once retention of the personal information is no longer necessary for the purposes outlined above, we will either delete or de-identify the personal information or, if this is not possible (for example, because personal information has been stored in backup archives), then we will securely store the personal information and isolate it from further processing until deletion or deidentification is possible.

G.   Sensitive Personal Information

In the normal course of recruitment activities, we collect the following types of sensitive personal information: