Oyster Candidate Privacy Notice

At Oyster, Trust is one of our core values. Whether with Staff, Team Members, Customers, or Website Visitors, we believe that mutual trust is a key ingredient to our success. So we maintain an active flow of information and communication, and we practice transparency in all that we do.

To that end, we respect the privacy of everyone we do business with, and we are committed to protecting their Personal Data. We believe that everyone should know what information we collect, what we do with their information, who we share it with, and why it is shared. This practice allows us to comply with privacy and data-protection regulations around the globe. But more importantly, it fosters trust and builds relationships. After all, our business is bringing meaningful employment to talented people everywhere, not selling information.

Who should read this Notice, and Why?

This Oyster Candidate Privacy Notice (the “Notice”) is intended for all Oyster Candidates.  

This Notice explains everything you need to know about your Personal Data as an Oyster Candidate. It explains what information we collect, process, and share about you. It describes the information we collect, how we collect it, and why we collect it. It describes how and why we use and share that information. And it describes the rights and choices you have regarding your information. 

Important: If you are an Oyster Candidate, you may also be a Website Visitor or an Oyster Academy User (see the Definitions below for more detail). If so, please note that we may collect additional Personal Data about you in that role. For more information on our privacy practices related to each of these roles, please review the applicable Privacy Notice(s):

• Website Privacy Notice
• EOR Team Member and Staff Privacy Notice
• Payroll Team Member Privacy Notice
• Contractor Privacy Notice
• Oyster Academy Privacy Notice
• Oyster Connect Privacy Notice
• People Builders Community Privacy Notice

Summaries

Transparency only works when you understand the information. Each section of this Notice includes a Summary explaining the information in clear and concise terms. These Summaries are intended to help readers understand this document, but they do not form a part of the Notice itself.

Back to Top

Unfortunately, legal documents (like Privacy Notices) contain a lot of definitions. To make our Privacy Notices more readable (and to ensure consistency), we have created a page dedicated to Privacy Notice Definitions, which defines all of the capitalized terms used in this Notice. 

Back to Top

In general, Oyster acts as a “data controller” (or its equivalent) under Applicable Law. We control what information we collect and how and why we process that information.

Back to Top

While Oyster acts in accordance with Applicable Law, we follow globally accepted principles of data protection:

• Lawfulness, Fairness, and Transparency: Personal Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.

• Purpose Limitation: Personal Data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner that is incompatible with those purposes;

• Data Minimization: Personal Data collection and processing is adequate, relevant, and limited to what is necessary in relation to the purposes for the processing;

• Accuracy: Personal Data is accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that inaccurate Personal Data is erased or rectified without delay;

• Storage Limitation: Personal Data is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing; but Personal Data may be stored for longer periods for archiving purposes in the public interest, scientific or historical research purposes, statistical purposes where appropriate technical and organizational measures are in place as required by Applicable Law, or where retention is required by law;

• Integrity and Confidentiality: Personal Data is processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures;

• Accountability: The data controller is responsible for, and can demonstrate, compliance with these data protection principles.

Back to Top

We collect, store, and use the following categories of Personal Data to provide and market our services. Most of this data is collected directly from you. But in some cases, we collect data from a third-party service. We refer to these connections as “Third-Party Integrations.” And finally, we may collect information directly from Third Parties (for example, the results of background checks).

The table below sets forth the information we may collect about you and the source of the information.

Back to Top

At Oyster, data is at the heart of what we do; we cannot provide meaningful employment in compliance with local regulations if we do not collect relevant Personal Data. But certain regulations, including the EU-GDPR, require that we specify the legal basis for our processing. For that purpose, with regard to Payroll Team Members, we process data on the following legal bases:

• Legitimate Interest (LI) – Oyster has a legitimate interest in processing the at-issue Personal Data, there is no less intrusive way to achieve the same results, and Oyster’s interests outweigh your interests, rights, and freedoms.

• Legal Obligation (LO) – Oyster is required to process the at-issue Personal Data to comply with a legal obligation.

Under these bases, Oyster collects the following categories of Personal Data for the following purposes (letters in parenthesis indicate the legal bases for processing related to a specific purpose):

Back to Top

We will only use the Personal Data we collect for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Back to Top

“Special categories” of particularly sensitive personal information, such as information about a Data Subject’s health, racial or ethnic origin, sexual orientation, or trade union membership, require higher levels of protection. That means we need to have further justification for collecting, storing, and using this type of Personal Data. We may process the special categories of Personal Data described above in the following circumstances:

• In limited circumstances, with explicit, written consent;

• Without consent, where we need to carry out our legal obligations or exercise rights in connection with employment; or 

• Without consent, where it is needed in the public interest, such as for equal opportunities monitoring or in relation to our occupational pension scheme.

Less commonly, we may process this type of information where it is needed in relation to legal claims; where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving consent; or where you have already made the information public.

Examples of situations in which we may process particularly sensitive Personal Data are listed below:

• We will use information about a Data Subject’s physical or mental health, or disability status, to ensure their health and safety in the workplace and to assess their fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits including statutory maternity pay, statutory sick pay, pensions, and permanent health insurance.

• If a Data Subject leaves their employment and under any share plan operated by a group company the reason for leaving is determined to be ill-health, injury, or disability, we will use information about their physical or mental health or disability status in reaching a decision about their entitlements under the share plan.

• If a Data Subject applies for an ill-health pension under a pension arrangement operated by a group company, we will use information about their physical or mental health in reaching a decision about their entitlement.

• We will use information about a Data Subject’s race or national or ethnic origin, religious, philosophical or moral beliefs, sexual life or sexual orientation, or disability status to ensure meaningful equal opportunity monitoring and reporting and to comply with legal obligations.

• We will use trade union membership information to pay trade union premiums, register the status of a protected employee, and to comply with employment law obligations.

Back to Top

We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and only where we do so in line with our privacy standard.

We will only collect information about criminal convictions if it is appropriate given the nature of the Data Subject’s role and where we are legally able to do so. We have in place an appropriate policy and safeguards, which we are required by law to maintain when processing such data.

Back to Top

We share Personal Data about Oyster Candidates with third-party service providers to facilitate our legitimate interests (LI), or where required by law (LO). We review all third-party services providers and require them to respect the security of your data and to treat it in accordance with the law.  The services provide by these third parties may include:

• Hosting and Storage

• Human Resources Management

• Email Services

• Data Analytics and Predictive Analysis

• Information Security and Privacy

Back to Top

Please note that Oyster may also share Personal Data with other third parties, for example in the context of the possible sale or restructuring of our business. In this situation we will, where possible, share anonymized data with the other parties before the transaction is complete. Once the transaction is complete, we will share Personal Data with the other parties if and only where required under the terms of the transaction. We may also need to share Personal Data with a regulator or to otherwise comply with the law.

Back to Top

Oyster may aggregate or otherwise strip data of all personally identifying characteristics and may share the aggregated, anonymized data with third parties. In such cases, we may use the information without further notice to you.

Back to Top

We partner with third party ad servers, ad networks, and social media platforms (like Facebook, Google, LinkedIn, X) to deliver personalized advertisements (“ads”) that may be of interest to our Website Visitors or to measure the effectiveness of our advertising. While we do not directly target Oyster Candidates for advertising, please note that if you visit the Oyster Website to interact with the Oyster platform, our Website Privacy Notice and Cookie Policy will apply.

Back to Top

Oyster cares about the security of Personal Data and has put measures in place to preserve the confidentiality, integrity, and availability of all the Personal Data we collect. We have also put in place appropriate security measures to prevent Personal Data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. We limit access to Personal Data to those employees, agents, contractors, and third parties that have a business need to know, based on the purposes and as described above. Additionally, we have put procedures in place to deal with any suspected data security incidents and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

If you suspect a security incident related to your Personal Data at Oyster, please fill out our Security Incident Reporting Form.

For more information about Oyster’s security program, please visit the Oyster Trust Center or the Oyster Security Dashboard. 

Back to Top

We will only retain your Personal Data for as long as necessary to fulfill the purposes for which we collected it and to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of the Personal Data, the purposes for which we process the Personal Data and whether we can achieve those purposes through other means, and all applicable legal requirements. In general, we retain the following record types for the following time periods in accordance with our Data Retention Policy. In general, we retain the following record types for the following time periods in accordance with our Data Retention Policy.

Back to Top

Information stored on the Oyster Platform is stored on Amazon AWS Servers in Ireland. In general, we try to ensure that Personal Data related to a particular Data Subject is stored on the Oyster Platform and processed using third-party providers in that Data Subject’s country of employment. Due to the nature of Oyster’s Services, though, and because Oyster is a globally distributed organization with Oyster Staff seated in more than 30 countries, Personal Data may be stored or processed on a limited basis in any of the following countries.

As a result, we may transfer your Personal Data to a country and jurisdiction that does not have the same data protection laws as your home jurisdiction. But when doing so, we always take steps to ensure that your Personal Data remains protected and that it is stored and processed in accordance with applicable law. This Notice provides notice of such transfer based on legitimate interest for each processing activity, as described above.

For any additional information on international data transfers, please fill out our Privacy Rights Request Form or contact privacy@oysterhr.com.

Back to Top

Under certain circumstances, and under Applicable Law, Data Subjects have individualized rights based on certain factors, such as their location, citizenship, or residence. At Oyster, we’re a global company, and Trust is one of our core values, so we believe that all users should be given the broadest privacy rights possible, regardless of where they are based or where they are from. For that reason, regardless of where you are located, you have the right to:  

• Request Access to your Personal Data (commonly known as a “data subject access request” or “DSAR”). This allows you to receive a copy of your Personal Data and to ensure that we are lawfully processing it.

• Request Correction of your Personal Data. This allows you to have any incomplete or inaccurate records completed or corrected.

• Request Erasure of your Personal Data (commonly known as a “deletion request”). This allows you to ask us to delete or remove Personal Data where there is no reason for us to retain or continue processing it.

• Object to Processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is some reason you object to our processing on that basis. You can also object to our processing of your Personal Data where we are doing so for direct marketing purposes.

• Request the Restriction of processing of your Personal Data. This allows you to ask us to suspend the processing of your Personal Data, for example if you want us to establish its accuracy or our reason for processing it.

• Request the Portability of your Personal Data in a machine readable format and the transfer to another party.

If you want to review, verify, correct, or request erasure of your Personal Data, object to the processing of your Personal Data, or request that we transfer a copy of your Personal Data to another party, you can do so by filling out our Privacy Rights Request Form.

No Fee (Usually) Required

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). But we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What We May Need

In some cases, we may need to request specific information from you to help us confirm your identity and to ensure their right to access the information (or to exercise any of your other rights). This security measure is in place to ensure that Personal Data is not disclosed to any person who has no right to receive it.

RIGHT TO WITHDRAW CONSENT

In the limited circumstances where you may have provided your consent to the collection, processing, or transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent to that specific processing at any time. In most cases, a way to withdraw consent should be readily apparent; for example, you can opt out of marketing emails by unsubscribing or can change your cookie settings at any time. Any questions or requests to withdraw consent that are not apparent should be directed to privacy@oysterhr.com. Once we have received notification that you have withdrawn their consent, we will no longer process your information for the purpose or purposes to which you originally agreed, unless we have another legitimate basis under the law for doing so.

Back to Top

We may change this Notice from time to time. If we make any material changes, we’ll provide notice on the Oyster website homepage or the account portal sign-in page. We will comply with applicable law with respect to any changes we make to this Notice and will seek your consent to any material changes if required by applicable law.

Back to Top

We have appointed a Data Protection Officer to oversee compliance with this Privacy Policy. For any questions about this Policy or how we handle Personal Data, please contact our Data Protection Officer at dpo@oysterhr.com or at:

Data Protection Officer
Oyster HR, Inc.
307 W. Tremont Avenue, Suite 200
Charlotte NC 28203, USA

You may also lodge a complaint with your country’s (or State’s) proper oversight agency. We would, however, appreciate the chance to deal with any concerns directly before such a complaint is filed.

A Privacy Rights Request Form can be accessed here: Privacy Rights Request Form

Back to Top