Oyster Contractor Privacy Notice

At Oyster, Trust is one of our core values. Whether with Staff, Team Members, Customers, or Website Visitors, we believe that mutual trust is a key ingredient to our success. So we maintain an active flow of information and communication, and we practice transparency in all that we do.

To that end, we respect the privacy of everyone we do business with, and we are committed to protecting their Personal Data. We believe that everyone should know what information we collect, what we do with their information, who we share it with, and why it is shared. This practice allows us to comply with privacy and data-protection regulations around the globe. But more importantly, it fosters trust and builds relationships. After all, our business is bringing meaningful employment to talented people everywhere, not selling information.

Who should read this Notice, and Why?

This Oyster Contractor Privacy Notice (the “Notice”) is intended for all Oyster Contractors.  

This Notice explains everything you need to know about your Personal Data as an Oyster Contractor. It explains what information we collect, process, and share about you. It describes the information we collect, how we collect it, and why we collect it. It describes how and why we use and share that information. And it describes the rights and choices you have regarding your information. 

Important: If you are an Oyster Contractor, you may also be a Website Visitor or an Oyster Academy User (see the Definitions below for more detail). If so, please note that we may collect additional Personal Data about you in that role. For more information on our privacy practices related to each of these roles, please review the applicable Privacy Notice(s):

• Website Privacy Notice
• EOR Team Member and Staff Privacy Notice
• Payroll Team Member Privacy Notice
• Oyster Candidate Privacy Notice
• Oyster Academy Privacy Notice
• Oyster Connect Privacy Notice
• People Builders Community Privacy Notice

Summaries

Transparency only works when you understand the information. Each section of this Notice includes a Summary explaining the information in clear and concise terms. These Summaries are intended to help readers understand this document, but they do not form a part of the Notice itself.

Back to Top

Unfortunately, legal documents (like Privacy Notices) contain a lot of definitions. To make our Privacy Notices more readable (and to ensure consistency), we have created a page dedicated to Privacy Notice Definitions, which defines all of the capitalized terms used in this Notice. 

Back to Top

In general, Oyster acts as a “data controller” (or its equivalent) under Applicable Law. We control what information we collect and how and why we process that information. But Oyster Customers may also act as independent data controllers. Oyster Customers that engage Oyster Contractors through the Oyster Platform may determine what information they need to collect and process independently from Oyster.

Back to Top

While Oyster acts in accordance with Applicable Law, we follow globally accepted principles of data protection:

• Lawfulness, Fairness, and Transparency: Personal Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.

• Purpose Limitation: Personal Data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner that is incompatible with those purposes;

• Data Minimization: Personal Data collection and processing is adequate, relevant, and limited to what is necessary in relation to the purposes for the processing;

• Accuracy: Personal Data is accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that inaccurate Personal Data is erased or rectified without delay;

• Storage Limitation: Personal Data is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing; but Personal Data may be stored for longer periods for archiving purposes in the public interest, scientific or historical research purposes, statistical purposes where appropriate technical and organizational measures are in place as required by Applicable Law, or where retention is required by law;

• Integrity and Confidentiality: Personal Data is processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures;

• Accountability: The data controller is responsible for, and can demonstrate, compliance with these data protection principles.

Back to Top

We collect, store, and use the following categories of Personal Data to provide and market our services. Most of this data is collected directly from you. But in many cases, Oyster Customers provide us with Personal Data about the Team Members they wish to engage through the Oyster Platform. In some cases, the data is submitted to the Oyster Platform from a third-party service used by the Oyster Customer. We refer to these connections as “Third-Party Integrations.” And finally, we may collect information directly from Third Parties (for example, the results of background checks). Where an Oyster Customer provides Oyster with your Personal Data through a Third-Party Integration, we require the Customer to affirm that they have the right to do so under Applicable Law.

The table below sets forth the information we may collect about you and the source of the information.

Back to Top

At Oyster, data is at the heart of what we do; we cannot provide meaningful employment in compliance with local regulations if we do not collect relevant Personal Data. But certain regulations, including the EU-GDPR, require that we specify the legal basis for our processing. For that purpose, with regard to Oyster Contractors, we process data on the following legal bases:

• Contractual Necessity (CN) – Oyster needs to process the at-issue Personal Data, either to perform under a contract to which you are a party or to take steps at your request before entering a contract with you.

• Legitimate Interest (LI) – Oyster has a legitimate interest in processing the at-issue Personal Data, there is no less intrusive way to achieve the same results, and Oyster’s interests outweigh your interests, rights, and freedoms.

• Legal Obligation (LO) – Oyster is required to process the at-issue Personal Data to comply with a legal obligation.

• Consent (C) – You have the choice and control over whether or how Oyster processes your Personal Data.

Under these bases, Oyster collects the following categories of Personal Data for the following purposes (letters in parenthesis indicate the legal bases for processing related to a specific purpose):

Back to Top

We will only use the Personal Data we collect for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Back to Top

We share Personal Data about Oyster Candidates with third-party service providers to facilitate our legitimate interests (LI), or where required by law (LO). We review all third-party services providers and require them to respect the security of your data and to treat it in accordance with the law.  The services provide by these third parties may include:

• Hosting and Storage

• Payment Processing

• Billing

• Customer Support and Management

• Email Services

• Data Analytics and Predictive Analysis

• Information Security and Privacy

• Advertising and Marketing

Back to Top

Please note that Oyster may also share Personal Data with other third parties, for example in the context of the possible sale or restructuring of our business. In this situation we will, where possible, share anonymized data with the other parties before the transaction is complete. Once the transaction is complete, we will share Personal Data with the other parties if and only where required under the terms of the transaction. We may also need to share Personal Data with a regulator or to otherwise comply with the law.

Back to Top

Oyster may aggregate or otherwise strip data of all personally identifying characteristics and may share the aggregated, anonymized data with third parties. In such cases, we may use the information without further notice to you.

Back to Top

We partner with third party ad servers, ad networks, and social media platforms (like Facebook, Google, LinkedIn, X) to deliver personalized advertisements (“ads”) that may be of interest to our Website Visitors or to measure the effectiveness of our advertising. While we do not directly target Oyster Contractors for advertising, please note that if you visit the Oyster Website to interact with the Oyster platform, our Website Privacy Notice and Cookie Policy will apply.

Back to Top

Oyster cares about the security of Personal Data and has put measures in place to preserve the confidentiality, integrity, and availability of all the Personal Data we collect. We have also put in place appropriate security measures to prevent Personal Data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. We limit access to Personal Data to those employees, agents, contractors, and third parties that have a business need to know, based on the purposes and as described above. Additionally, we have put procedures in place to deal with any suspected data security incidents and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

If you suspect a security incident related to your Personal Data at Oyster, please fill out our Security Incident Reporting Form.

For more information about Oyster’s security program, please visit the Oyster Trust Center or the Oyster Security Dashboard. 

Back to Top

We will only retain your Personal Data for as long as necessary to fulfill the purposes for which we collected it and to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of the Personal Data, the purposes for which we process the Personal Data and whether we can achieve those purposes through other means, and all applicable legal requirements. In general, we retain the following record types for the following time periods in accordance with our Data Retention Policy. In general, we retain the following record types for the following time periods in accordance with our Data Retention Policy:

• Customer Records, including Contracts: 7 years following termination of a contractual relationship.

Back to Top

Information stored on the Oyster Platform is stored on Amazon AWS Servers in Ireland. In general, we try to ensure that Personal Data related to a particular Data Subject is stored on the Oyster Platform and processed using third-party providers in that Data Subject’s country of employment. Due to the nature of Oyster’s Services, though, and because Oyster is a globally distributed organization with Oyster Staff seated in more than 30 countries, Personal Data may be stored or processed on a limited basis in any of the following countries.

As a result, we may transfer your Personal Data to a country and jurisdiction that does not have the same data protection laws as your home jurisdiction. But when doing so, we always take steps to ensure that your Personal Data remains protected and that it is stored and processed in accordance with applicable law. This Notice provides notice of such transfer based on legitimate interest for each processing activity, as described above.

For any additional information on international data transfers, please fill out our Privacy Rights Request Form or contact privacy@oysterhr.com.

Back to Top

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). But we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What We May Need

In some cases, we may need to request specific information from you to help us confirm your identity and to ensure their right to access the information (or to exercise any of your other rights). This security measure is in place to ensure that Personal Data is not disclosed to any person who has no right to receive it.

RIGHT TO WITHDRAW CONSENT

In the limited circumstances where you may have provided your consent to the collection, processing, or transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent to that specific processing at any time. In most cases, a way to withdraw consent should be readily apparent; for example, you can opt out of marketing emails by unsubscribing or can change your cookie settings at any time. Any questions or requests to withdraw consent that are not apparent should be directed to privacy@oysterhr.com. Once we have received notification that you have withdrawn their consent, we will no longer process your information for the purpose or purposes to which you originally agreed, unless we have another legitimate basis under the law for doing so.

Back to Top

We may change this Notice from time to time. If we make any material changes, we’ll provide notice on the Oyster website homepage or the account portal sign-in page. We will comply with applicable law with respect to any changes we make to this Notice and will seek your consent to any material changes if required by applicable law.

Back to Top

We have appointed a Data Protection Officer to oversee compliance with this Privacy Policy. For any questions about this Policy or how we handle Personal Data, please contact our Data Protection Officer at dpo@oysterhr.com or at:

Data Protection Officer
Oyster HR, Inc.
307 W. Tremont Avenue, Suite 200
Charlotte NC 28203, USA

You may also lodge a complaint with your country’s (or State’s) proper oversight agency. We would, however, appreciate the chance to deal with any concerns directly before such a complaint is filed.

A Privacy Rights Request Form can be accessed here: Privacy Rights Request Form

Back to Top