This Privacy Policy (“Privacy Policy”) covers our treatment of information that we gather when you are accessing or using our websites and services offered at www.gem.com or on any website, online service, mobile application or other location where this Privacy Policy is presented (collectively, "Services").

This Privacy Policy does not apply to the practices of companies we don’t own or control, or people that we don’t manage. We may also share some information with third parties, but only as described below.5

Our Services are not directed to persons under the age of 18. We do not knowingly collect information from anyone under the age of 18 nor knowingly allow such persons to user or register for our Services. If we learn that we have collected the information from a minor under the age of 18, we will delete that information as soon as possible. If a parent or guardian becomes aware that their child has provided us with information without the parent’s consent, they should contact us at support@gem.com.

For the purposes of any applicable data protection law ("Data Protection Law"), Gem Software, Inc. (“Gem Software”, “we”, “us” or “our”) is the data controller (i.e., the company who is responsible for, and controls the processing of information relating to our business customers, visitors to our website, and any other users of our Services (collectively, “you” or “yours”). This Privacy Policy does not apply to other information that Gem processes on behalf of its business customers as their processor/service provider and you will need to consult the relevant privacy notice of our business customers with whom you have a direct relationship. This Privacy Policy also doesn’t cover our treatment of information about candidates and other individuals that we receive from our partners and other third parties (“Business Data”). For information on how we process Business Data received from third parties, please view our Non-B2B Customer Privacy Notice here.

In addition, this Privacy Policy does not apply to information that we collect from our employees and contractors or those persons who apply for a job at Gem.

This Privacy Policy outlines your data subject rights, including the right to object to certain types of processing we carry out, for more information see the “Your rights and choices” section below.

What information do we collect and for what purpose?

We gather various types of Personal Information from our customers and website visitors, including, but not limited to, the following types of data:

Information You Provide To Us

When you create an account with us

• Name
• Email address
• Access to your email account

When you use our Services

• Name
• Email address
• Location
• Phone number
• Payment information
• Third-party account credentials (for example, our business customers’ log-in credentials for Google Mail or other third-party sites)
• Career information, including your company name and job title
• Application history
• Education history; and
• Any information that you choose to include on a CV or similar materials and that you provide to Gem.

Additional information you submit to us

• Information you submit when completing a form on our website
• Information you submit by attending a Gem event
• Information you submit when registering for job application account with Gem.

Information Collected Automatically

Browser information

• Your IP address and server logs
• Information about your cookies and web browsing

Communications information

• Information about communications sent and received using our Services (including messages data)

Information You Provide to Us

Business Customers

When our business customers create a new account to use the Services, we may collect information in order to provide these customers with our Services, including personal contact information regarding our business customers’ end users (e.g., their employees) of the Services and financial information for billing purposes. We also may solicit our business customers’ consent to connect their email account to their new Gem account (using the OAuth authentication method), thereby providing us with access to their email account, including but not limited to email, contacts, and calendar. Gem accesses and stores a limited subset of data from our business customers’ account, including name and email address, to provide our Services.

For users authenticating via Google accounts; Gem Software’s use of information received, and Gem Software's transfer of information to any other app, from Google APIs will adhere to Google's Limited Use Requirements.

We receive and store any information that you provide to us during your use the Services. For example, for our business customers, through their account settings, sending emails and InMail, creating lists of contacts, inputting contact information, requests for support through customer care, and otherwise using the Services, we may collect Personal Information such as your name, email address, location, phone number, payment information, and third-party account credentials (for example, your log-in credentials for Google Mail or other third party sites). Certain information may be required to register with us or to take advantage of some of our features.

Business Customers and Other Users.

We may also collect Personal Information you submit to us, for example by completing a form on our website or participating in a Gem event.

When you submit a job application via the Services and agree to save your information with Gem, we may collect certain information you provide us, such as your contact information (including your name, phone number, and email address), educational and work history and compensation, date of birth, skills, interests, citizenship status and U.S. work eligibility, references, job and career preferences, location and postal address information (including city, state, and ZIP code), other profile information (such as your bio and picture), application question responses, schedule and availability, access to transportation, responses to tests and surveys, documents uploaded for job applications, such as CVs and any information in such documents.

We may collect audio or visual information such as audio recordings if you call our customer service.

If you decide to participate in any surveys, promotions, events, or sweepstakes, you may provide certain information, such as basic contact information and other information relevant to those activities.

We may collect sensitive information (for example, your race, gender, or sexual orientation) for our diversity, equity and inclusion reporting and as part of your application but only where you voluntarily provide it, including in documents supporting your application – e.g. your CV.

Information Collected Automatically

Whenever you use our Services, we may automatically receive and record information in our server logs from your browser, which may include your IP address, information about your web cookies, and the page or feature you were interacting with. Cookies are web identifiers we, and other services, transfer to your browser to allow us to recognize your browser when you visit our site. To learn more about how we use cookies and related technologies, including how you can limit the use of these technologies when using the Services, please see our separate Cookies Policy.

In connection with your use of the Services, we may also collect information created or provided by you, or that we otherwise receive, in connection therewith. For example, if your contacts send messages to you, we may collect and maintain the message data, which may include Personal Information.

How we use your information

We use your information to provide, support, and develop our Services. In particular, we may use your information to:

• Provide our Services. We may use your information to provide our Services, including to enable you to submit applications and to be considered for job opportunities, and to help business customers identify candidates and obtain job market insights. We may use your information to analyze activity on our Services and use that to develop and improve our Services, including with the help of artificial intelligence and machine learning. We may also use your information to surface potential job opportunities that we think might be of interest to you. Applicant submissions may be included as part of our applicant tracking system database so that other companies (e.g., recruiters or other potential employers) can query the database or receive suggestions from our Services that will help them identify good candidates for their positions. You may opt out of being included in this database through the Your Rights and Choices section below or by choosing to not participate when you submit a job application that uses our Services.
• To Communicate with you.
• Operate our Services. We also may use your information to analyze use of the Services and improve the content, functionality and usability of the Services; secure the Services and investigate and help prevent fraud, security issues, and abuse; and understand and resolve Services crashes and other issues.
• Other Internal Purposes. We may use your information to comply with any procedures, laws, and regulations where necessary for our legitimate interests or legitimate interests of others; and establish, exercise, or defend our legal rights where necessary for our legitimate interests or the legitimate interests of others, including the enforcement of our agreements with you or other usage policies, and other legal terms or controls, or to engage in other legal matters.
• Other Purposes. We may use your information for any other purpose with your consent.
• Combine Information. For the purposes discussed in this Privacy Policy, we may combine the information that we collect through the Services with information we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.
• Aggregate/De-Identified Information. We may aggregate and/or de-identify any information collected through the Services so that it can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also disclose such data with any third parties at our discretion.

Google API Services Usage Disclosure

Our app strictly complies with all applicable conditions specified in the limited use policy of Google, which includes but is not limited to:

• Limit data usage to enhancing user-facing features visible in the application's interface.
• Data transfers allowed only for user-facing features with consent, security, and legal compliance
• Human access to data requires user consent, security needs, legal compliance, or internal operations.
• Prohibited actions include selling data to third parties, using data for ads, and assessing creditworthiness or lending based on user data.
• Restrictions on use of personal data collected from Google Workspace APIs to develop, improve, or train generalized AI and/or ML models.

What is our legal basis for processing in the EU?

When you access or use our Services, we process your information for the purposes described in this Privacy Policy. We rely on a number of legal bases to collect, use, store, share and otherwise process your information as described below.

Purpose and Relevant Personal Information and Applicable Legal Basis

Using our Services

In order to provide you with our Services, and to allow you to set up a user account and profile, we process the following information:

• name
• company name
• position
• email address
• phone number
• billing details such as credit card information, banking information and/or a billing address

We rely on contractual necessity for this processing

Connecting your email account to your Gem account.

If you connect your email account to your Gem account, we process the following information:

• name
• email address
• emails
• contacts
• calendar

We rely on contractual necessity for this processing

To process and fulfill your requests for certain products and services

We rely on contractual necessity for this processing

Customizing your experience with our Services and otherwise improving our website and Services

In order to customize your experience with our Services and to generally improve our website and services, we use cookies to collect information about your online activity both while you are using the Services and after you leave our Services. For example, when and how often pages on our site and part of our Services are visited. We process the following information for these purposes:

• IP address
• Information about your web cookies
• Your online activity (e.g. the page or feature you were interacting with)

We rely on our legitimate interests and those of our customers for this processing

Monitoring our services/ to analyze how you use the Services

We rely on our legitimate interests for this processing

To provide customer support, and to respond to customer care and other inquiries

We rely on legitimate interests for this processing

To contact you

We rely on legitimate interests for this processing

To allow others to contact you, and allow you to contact others through the Services

We rely on legitimate interests for this processing

To comply with a legal or regulatory obligation within the EEA

We may access, read, preserve, and disclose any information that we believe is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental and other legal requests, or court order within the EEA

We rely on our legal obligations for this processing where it is required by law. In cases where the processing is not required by law, but may nonetheless be appropriate, we rely on legitimate interests.

To comply with a legal or regulatory obligation outside of the EEA

We may access, read, preserve, and disclose any information that we believe is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental and other legal requests, or court order outside of the EEA

We rely on our legal obligations for this processing where it is required by law

To enforce or apply our Terms of Use and other agreements

We rely on legitimate interests for this processing

To address fraud, security or technical issues

We rely on legitimate interests for this processing

To protect the rights, property, or safety of Gem Software, our employees, our users, or others

We rely on legitimate interests for this processing

Providing your information may be a requirement necessary to enable your use of the Services, including for the performance of certain services and functionalities, such as replying to and managing requests for information, questions, communication, or feedback. In these circumstances, refusal to provide your information means that we cannot provide the requested services. However, providing your information for survey, marketing and other profiling purposes is optional; refusal to provide your information for these purposes will not have any impact on your use of the Services

Where we process your information on the basis of legitimate interests as described in the table above, you have the right to object to, and seek restriction of, this processing.

Information We Disclose

In certain circumstances we work with third parties to help us provide our Services and this can require us to disclose your information to these third parties. We disclose your information with the following different categories of third-party service providers:

• Analytics Service Providers. We use third party analytics services in order to better understand how our users are engaging with our Services. When you browse our website or use the Services, these services may collect your IP address, browser type, and approximate location (based on the IP address). They may also set and access cookies on your computer or other device. In order to refine our understanding of user engagement, we also share your email address (which we collected as part of the user’s account registration process) with these service providers. For example:
  • FullStory. We use FullStory for recording your interactions with our site which helps us deliver a better user experience. For more information on the privacy practices of FullStory, please visit https://www.fullstory.com/legal/privacy/.
  • Google Analytics. We use Google Analytics to track website traffic. Google Analytics is a web analytics service offered by Google. Google uses the data collected to track and monitor the use of our websites. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en. We also encourage you to review Google’s policy for safeguarding your data: https://support.google.com/analytics/answer/6004245.
• Affiliated Companies, Business Units and Employees: Information that we process and collect may be transferred between companies, business units and employees that become affiliated with us.
• Asset Transfer or Company Acquisition. We may choose to buy or sell assets and may share and/or transfer customer and other user information in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, you acknowledge that information could be one of the assets transferred to or acquired by a third party.
• Service Providers. We employ other companies and people to perform tasks on our behalf and need to share your information with them to provide products or services to you; for example: 
  • data storage services,
  • marketing and advertising services, and
  • payment processing companies to receive and process your financial transactions for us.
• Compliance with our legal obligations and protecting our rights. As explained in more detail in the Legal basis section above, we may need to share your information with third parties, including law enforcement authorities, to comply with law, legal obligations, regulations, law enforcement, governmental and other legal requests, or court order; enforce or apply our Terms of Use and other agreements; address fraud, security or technical issues; or protect the rights, property, or safety of Gem Software, our employees, our users, or others. 
• At your direction. We may share information with third parties when you direct us to do so. 
• Information you make public. We may disclose information you make public through the Services. Please think carefully before making information public as you are solely responsible for any information you make public. Once you have posted information, you may not be able to edit or delete such information, subject to additional rights in the “Your Rights and Choices” section below.

Data storage and transfer

If you are habitually resident in the European Economic Area (“EEA”), Switzerland or the United Kingdom, we will transfer or transmit Personal Information that you submit or otherwise share with us through your use of the Services to the United States and other countries outside of where you live for storage, processing and the other purposes described in this Privacy Policy.

For example, we currently use datacenter facilities located in the United States. Countries which are outside the EEA, Switzerland or United Kingdom may not offer the same level of data protection as in your home country; for example there is currently no adequacy decision in respect of the United States. Where the European Commission has recognized a country as providing an adequate level of data protection, Gem may rely on the Commission’s adequacy decision, as applicable, to transfer data.

When transferring data to vendors outside the EEA, Switzerland or the UK, Gem Software relies upon a variety of legal mechanisms including Standard Contractual Clauses. For a copy of the Standard Contractual Clauses, please contact legal@gem.com.

In certain limited circumstances, we may use derogations, such as the contractual necessity derogation, where appropriate to process personal data, when there are no other data transfer mechanisms applicable. For example, where the transfer of information is necessary to provide our Services as set out in the Terms of Service.

Gem Software, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Gem Software, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Gem Software, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Gem Software, Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

The Federal Trade Commission has jurisdiction over Gem Software, Inc.’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Under certain conditions, individuals for whom Gem Software, Inc. is processing personal data has the possibility to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. Please visit ANNEX-I-introduction for more information.

If Gem Software, Inc. does transfer personal information to a third party acting as an agent on its behalf, Gem Software, Inc. shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless Gem Software, Inc. proves that it is not responsible for the event giving rise to the damage.

Your Rights and Choices

Your Privacy Legal Rights

1. Customer Account Data – Business customers provide us with instructions on what to do with Business Customer Account Data. A Customer has many choices and control over Business Customer Account Data. Since these choices and instructions may result in the access, use, disclosure, modification or deletion of certain or all Business Customer Account Data, please review the Help Center pages for more information about these choices and instructions.
   
2. Individual rights –You may have certain rights regarding your information that we hold. While some of these rights apply generally, certain rights apply only in limited cases based on your location. These rights apply to “personal information” as defined by applicable laws:
   1. Right of access - You can request more information about some of the information we hold about you and request a copy of some of that information, which includes the categories of “personal information”, the categories of sources from which the “personal information” was collected, what the business or commercial purpose is for the collecting or selling of the “personal information” and the categories of third parties that we share your “personal information” with.
   2. Right to rectification - If you believe that any “personal information” we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
   3. Right to erasure - In certain circumstances, you have the right to obtain the erasure/deletion of your “personal information” without undue delay.
   4. Right to restriction - The right to obtain the restriction of the processing undertaken by us on your “personal information” in certain circumstances, such as where the accuracy of the data is contested by you, for a period enabling us to verify the accuracy of that data.
   5. Right to portability - You can ask for a copy of your “personal information” which you have provided to us in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
   6. Right to object - You have a right to object to processing of your “personal information” based on legitimate interests or in the public interest, and for direct marketing.
   7. Right to file a complaint - You have the right to lodge a complaint about our practices with respect to your “personal information” with the supervisory authority of your country or state.

You can contact Gem to exercise your rights by emailing support@gem.com.

Depending on where you live, you may be able to designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent's permission to do so and verify your identity directly.

If we deny your request in whole or in part, you may have the right to appeal the decision depending on where you live by contacting support@gem.com.

Your Privacy Choices.

Opt Out of Sale or Share or Processing of Personal Information for Targeted Advertising.

Residents of certain states such as California, Colorado, Connecticut, Utah, and Virginia may opt out of the "sale" of their personal information. Such residents may also opt out of the sharing or processing of their personal information for targeted advertising. Applicable law broadly defines "sale" or "share" in a way that may include allowing third parties to receive certain information such as cookies, IP address, device identifiers, browsing behavior, contact information and/or other activity to enable targeted advertising to you. We may share or process such information to deliver targeted advertising to you about our Services.

If you or your authorized agent (e.g., in California, Virginia, Colorado and Connecticut) would like to opt out of the processing of your information for such purposes, you may submit a request by clicking on the Your Privacy Choices link in the footer of our website and following the instructions. For non-cookie based information, you may also use our online request portal or by email at support@gem.com.

You may still receive advertising; it just may not be tailored to your interests. Please note, if you use different browsers, devices, or services you will need to make your choice on each browser or device where you want to opt out. You should also complete the form above so we may add your information to an appropriate suppression list.

Please note that if you have a legally recognized browser-based opt out preference signal turned on via your device browser (such as Global Privacy Control), we recognize such preference in accordance and to the extent required by applicable law.

Communications

With your consent (to the extent required by law), we may send marketing communication to you through various channels, including by email, SMS and MMS message and physical mail.

You can opt out of receiving marketing emails from us at any time by clicking the "Unsubscribe" link at the bottom of each email or emailing us at [insert applicable email] with the word UNSUBSCRIBE in the subject field of the email. Please note that even if you unsubscribe or opt-out, we may still send you transactional, order, or Services related communications.

You can opt out of receiving SMS or MMS messages from us by texting the keyword STOP in response to any text message you receive from us.

You can also opt out of receiving physical mail marketing communications by emailing us at support@gem.com.

After you opt-out or update your marketing preferences, please allow us sufficient time to process your marketing preferences. Unless otherwise required to process your requests earlier by law, it may take up to 5 business days to process your opt out requests in relation to receipt of electronic marketing materials such as emails, and up to 30 days for all other marketing-related requests.

Tracking Technology Choices.

Most browsers accept cookies by default. You can instruct your browser, by changing its settings, to decline or delete non-essential cookies. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations. If you disable or remove tracking technologies some parts of the Site may not function correctly.

Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. Because there is no industry consensus as to what website operators should do with regard to these signals, we do not take action with respect to "Do Not Track" signals or other mechanisms, except as otherwise provided herein. For more information on "Do Not Track," visit http://www.allaboutdnt.com.

Analytics and Targeted Advertising.

You can opt out of the processing of certain data collected by Google Analytics, by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout. For targeted advertising, in addition to the opt outs described in Your Rights and Choices above, some of the companies we work with to provide you with targeted ads are required by us to give you the choice to opt out of receiving targeted ads. Most of these companies are participants of the Digital Advertising Alliance (" DAA") and/or the Network Advertising Initiative (" NAI"). For more information about Interest-based Advertising and to understand your options, including how you can opt-out of receiving behavioral ads from participating companies, please visit the DAA website opt-out at http://www.aboutads.info/choices , or the NAI opt-out at https://www.networkadvertising.org/choices/ . Even if you opt-out of interest-based advertising by a participant, tracking technologies used on the Services may still collect data for other purposes including analytics. You may still see ads from us, but the ads from the participants with whom you opted out will not be targeted based on behavioral information about you and may therefore be less relevant to you and your interests.

Please note that your opt out only applies to the specific web browser you use so you must opt out of each web browser on each device you use. To successfully opt out, you must have cookies enabled in your web browser (see your browser's instructions for information on cookies and how to enable them). Once you opt out, if you delete your browser's saved cookies, you will need to opt out again.

To opt out of us using your data for Matched Ads, you may submit a request through our online form available through our online request portal. We will request that the applicable technology service not serve you Matched ads based on information we provide to it. Alternatively, you may directly contact the applicable technology service to opt out.

We are not responsible for the effectiveness of, or compliance with, any opt out options or programs, or the accuracy of any company statements regarding their opt out options or programs.

Retention period

We retain information for as long as you have an open account with us and for 7 years after you close your account. In some cases we retain information for longer, if doing so is necessary to comply with any legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. Afterwards, we retain some information in a depersonalized or aggregated form but not in a way that would identify any individual personally.

An example of the retention period that applies to certain types of data that we collect is set out below:

• Mailing lists: we retain the information you used to sign up for our blog alerts for as long as you remain subscribed (i.e., if you do not unsubscribe) or if we decide to remove our blog service, whichever occurs first.

Data security

We maintain a variety of administrative, technical, and physical safeguards that are designed to protect the privacy and security of your Information. However, the Internet is not a fully secure environment, and we cannot ensure or warranty the security of any Information transmitted to or generated by Gem in connection with the Services. You play a critical role in protecting your Information by maintaining up-to-date computer security protections. Steps you take to ensure the security of your computer, computer passwords, or other personal identifier authentication mechanisms are key components of the protection of your Information. You agree that you are responsible for any additional verification procedures and security you deem necessary.