Website Visitor Privacy Notice

At Oyster, Trust is one of our core values. Whether with Staff, Team Members, Customers, or Website Visitors, we believe that mutual trust is a key ingredient to our success. So we maintain an active flow of information and communication, and we practice transparency in all that we do.

To that end, we respect the privacy of everyone we do business with, and we are committed to protecting their Personal Data. We believe that everyone should know what information we collect, what we do with their information, who we share it with, and why it is shared. This practice allows us to comply with privacy and data-protection regulations around the globe. But more importantly, it fosters trust and builds relationships. After all, our business is bringing meaningful employment to talented people everywhere, not selling information.

Who should read this Notice, and Why?

This Website Privacy Notice (the “Notice”) is intended for all visitors to the Oyster Website(s), which includes all sites and subdomains located at oysterhr.com, including but not limited to www.oysterhr.com and app.oysterhr.com. If you’re visiting one of these sites, we refer to you as a “Website Visitor.”  Please note that Oyster Customer Administrators and Authorized Users,  Oyster Intelligence Data Subjects, and those sending submissions as part of our Responsible Disclosure Program are considered Website Visitors.

This Notice explains everything you need to know about your Personal Data as a Website Visitor. It explains what information we collect, process, and share about you. It describes the information we collect, how we collect it, and why we collect it. It describes how and why we use and share that information. And it describes the rights and choices you have regarding your information. 

Important: If you are a Website Visitor, you may also be an Oyster EOR Team Member or Staff Member, an Oyster Contractor, a Payroll Team Member, an Oyster Candidate, an Oyster Academy User, or an Oyster Connect Community Member (see the Definitions below for more detail). If so, please note that we may collect additional Personal Data about you in that role. For more information on our privacy practices related to each of these roles, please review the applicable Privacy Notice(s):

• EOR Team Member and Staff Privacy Notice
• Payroll Team Member Privacy Notice
• Contractor Privacy Notice
• Oyster Candidate Privacy Notice
• Oyster Academy Privacy Notice
• Oyster Connect Privacy Notice
• People Builders Community Privacy Notice

Summaries

Transparency only works when you understand the information. Each section of this Notice includes a Summary explaining the information in clear and concise terms. These Summaries are intended to help readers understand this document, but they do not form a part of the Notice itself.

Back to Top

Unfortunately, legal documents (like Privacy Notices) contain a lot of definitions. To make our Privacy Notices more readable (and to ensure consistency), we have created a page dedicated to Privacy Notice Definitions, which defines all of the capitalized terms used in this Notice. 

Back to Top

For Website Visitors, we generally act as a data controller because we determine what information we need to collect and how we will process that information. Oyster is the sole data controller for this information. However, for Oyster Intelligence Data Subjects, Oyster acts as a data processor. Oyster will collect and process Oyster Intelligence Data Subject Personal Data only as instructed or permitted by the Oyster Customer with whom the Oyster Intelligence Data Subject is employed.

Back to Top

While Oyster acts in accordance with Applicable Law, we follow globally accepted principles of data protection:

• Lawfulness, Fairness, and Transparency: Personal Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose Limitation: Personal Data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner that is incompatible with those purposes;
• Data Minimization: Personal Data collection and processing is adequate, relevant, and limited to what is necessary in relation to the purposes for the processing;
• Accuracy: Personal Data is accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that inaccurate Personal Data is erased or rectified without delay;
• Storage Limitation: Personal Data is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing; but Personal Data may be stored for longer periods for archiving purposes in the public interest, scientific or historical research purposes, statistical purposes where appropriate technical and organizational measures are in place as required by Applicable Law, or where retention is required by law;
• Integrity and Confidentiality: Personal Data is processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures;
• Accountability: The data controller is responsible for, and can demonstrate, compliance with these data protection principles.

Back to Top

We collect, store, and use the following categories of Personal Data to provide and market our services. Most of this data is collected directly from you. But in some cases, for example, if you sent us a message using our support system, we may collect information about you from Customers or through Third-Party Integrations.

All Website Visitors

The table below sets forth the information we may collect about you and the source of the information.

Oyster Intelligence Data Subjects

For Oyster Intelligence Data Subjects, the table below sets forth the following additional information about you and the source of the information.

Back to Top

At Oyster, data is at the heart of what we do; we cannot provide meaningful employment in compliance with local regulations if we do not collect relevant Personal Data. But certain regulations, including the EU-GDPR, require that we specify the legal basis for our processing. For that purpose, with regard to Website Visitors, we process data on the following legal bases:

• Contractual Necessity (CN) – Oyster needs to process the at-issue Personal Data, either to perform under a contract to which you are a party or to take steps at your request before entering a contract with you.
• Legitimate Interest (LI) – Oyster has a legitimate interest in processing the at-issue Personal Data, there is no less intrusive way to achieve the same results, and Oyster’s interests outweigh your interests, rights, and freedoms.
• Legal Obligation (LO) – Oyster is required to process the at-issue Personal Data to comply with a legal obligation.
• Consent (C) – You have the choice and control over whether or how Oyster processes your Personal Data.

Under these bases, Oyster collects the following categories of Personal Data for the following purposes (letters in parenthesis indicate the legal bases for processing related to a specific purpose):

Back to Top

We will only use the Personal Data we collect for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Back to Top

We share Personal Data about Website Visitors with third-party service providers and with Oyster subsidiaries in accordance with our contractual obligations (CN) for the purpose of providing our Services to facilitate our legitimate interests (LI), or where required by law (LO). We review all third-party services providers and require them to respect the security of your data and to treat it in accordance with the law.  The services provide by these third parties may include:

• Hosting and Storage
• Customer Support and Management
• Email Services
• Data Analytics and Predictive Analysis
• Information Security and Privacy
• Advertising and Marketing

Where we are a data controller, these third parties are our processors. Where we are a data processor, these third parties are our sub-processors. We require all third parties that may have access to Personal Data to enter Data Processing Agreements with us that only permit them to process such Personal Data for the specified purpose and in accordance with our instructions.

Back to Top

Please note that Oyster may also share Personal Data with other third parties, for example in the context of the possible sale or restructuring of our business. In this situation we will, where possible, share anonymized data with the other parties before the transaction is complete. Once the transaction is complete, we will share Personal Data with the other parties if and only where required under the terms of the transaction. We may also need to share Personal Data with a regulator or to otherwise comply with the law.

Back to Top

Oyster may aggregate or otherwise strip data of all personally identifying characteristics and may share the aggregated, anonymized data with third parties. In such cases, we may use the information without further notice to you.

Back to Top

We partner with third party ad servers, ad networks, and social media platforms (like Facebook, Google, LinkedIn, X) to deliver personalized advertisements (“ads”) that may be of interest to our Website Visitors or to measure the effectiveness of our advertising. 

Oyster may share your Personal Data with our third-party advertising partners, including the information listed in the Website Usage and Technical Data categories listed above. This allows our advertising partners to perform a match of information against information from other third-party networks or sites to serve ads on third party sites (including, but not limited to Facebook and Google) and to measure the effectiveness of these ads. 

In addition, these third-party ad servers or ad networks may use technology to send these personalized ads and ad links directly to your browser or mobile device and will automatically receive your IP address when you do so. They may also use other technologies (such as cookies, JavaScript, and device identifiers) to compile information about your browser’s or device’s visits and usage patterns on the Oyster website and to measure the effectiveness of ads and to personalize the advertising content. Please see our Cookie Policy for more information about how we and our third-party partners use cookies and other technologies to deliver ads or to change Cookie Options.

Back to Top

Oyster cares about the security of Personal Data and has put measures in place to preserve the confidentiality, integrity, and availability of all the Personal Data we collect. We have also put in place appropriate security measures to prevent Personal Data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. We limit access to Personal Data to those employees, agents, contractors, and third parties that have a business need to know, based on the purposes and as described above. Additionally, we have put procedures in place to deal with any suspected data security incidents and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

If you suspect a security incident related to your Personal Data at Oyster, please fill out our Security Incident Reporting Form.

For more information about Oyster’s security program, please visit the Oyster Trust Center or the Oyster Security Dashboard. 

Back to Top

We will only retain your Personal Data for as long as necessary to fulfill the purposes for which we collected it and to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of the Personal Data, the purposes for which we process the Personal Data and whether we can achieve those purposes through other means, and all applicable legal requirements.

Back to Top

Information stored on the Oyster Platform is stored on Amazon AWS Servers in Ireland. In general, we try to ensure that Personal Data related to a particular Data Subject is stored on the Oyster Platform and processed using third-party providers in that Data Subject’s country of employment. Due to the nature of Oyster’s Services, though, and because Oyster is a globally distributed organization with Oyster Staff seated in more than 30 countries, Personal Data may be stored or processed on a limited basis in any of the following countries.

As a result, we may transfer your Personal Data to a country and jurisdiction that does not have the same data protection laws as your home jurisdiction. But when doing so, we always take steps to ensure that your Personal Data remains protected and that it is stored and processed in accordance with applicable law. This Notice provides notice of such transfer based on legitimate interest for each processing activity, as described above.

For any additional information on international data transfers, please fill out our Privacy Rights Request Form or contact privacy@oysterhr.com.

Back to Top

Under certain circumstances, and under Applicable Law, Data Subjects have individualized rights based on certain factors, such as their location, citizenship, or residence. At Oyster, we’re a global company, and Trust is one of our core values, so we believe that all users should be given the broadest privacy rights possible, regardless of where they are based or where they are from. For that reason, regardless of where you are located, you have the right to:  

• Request Access to your Personal Data (commonly known as a “data subject access request” or “DSAR”). This allows you to receive a copy of your Personal Data and to ensure that we are lawfully processing it.
• Request Correction of your Personal Data. This allows you to have any incomplete or inaccurate records completed or corrected.
• Request Erasure of your Personal Data (commonly known as a “deletion request”). This allows you to ask us to delete or remove Personal Data where there is no reason for us to retain or continue processing it.
• Object to Processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is some reason you object to our processing on that basis. You can also object to our processing of your Personal Data where we are doing so for direct marketing purposes.
• Request the Restriction of processing of your Personal Data. This allows you to ask us to suspend the processing of your Personal Data, for example if you want us to establish its accuracy or our reason for processing it.
• Request the Portability of your Personal Data in a machine readable format and the transfer to another party.

If you want to review, verify, correct, or request erasure of your Personal Data, object to the processing of your Personal Data, or request that we transfer a copy of your Personal Data to another party, you can do so by filling out our Privacy Rights Request Form.

No Fee (Usually) Required

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). But we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What We May Need

In some cases, we may need to request specific information from you to help us confirm your identity and to ensure their right to access the information (or to exercise any of your other rights). This security measure is in place to ensure that Personal Data is not disclosed to any person who has no right to receive it.

RIGHT TO WITHDRAW CONSENT

In the limited circumstances where you may have provided your consent to the collection, processing, or transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent to that specific processing at any time. In most cases, a way to withdraw consent should be readily apparent; for example, you can opt out of marketing emails by unsubscribing or can change your cookie settings at any time. Any questions or requests to withdraw consent that are not apparent should be directed to privacy@oysterhr.com. Once we have received notification that you have withdrawn their consent, we will no longer process your information for the purpose or purposes to which you originally agreed, unless we have another legitimate basis under the law for doing so.

Back to Top

We may change this Notice from time to time. If we make any material changes, we’ll provide notice on the Oyster website homepage or the account portal sign-in page. We will comply with applicable law with respect to any changes we make to this Notice and will seek your consent to any material changes if required by applicable law.

Back to Top

We have appointed a Data Protection Officer to oversee compliance with this Privacy Policy. For any questions about this Policy or how we handle Personal Data, please contact our Data Protection Officer at dpo@oysterhr.com or at:

Data Protection Officer
Oyster HR, Inc.
307 W. Tremont Avenue, Suite 200
Charlotte NC 28203, USA

You may also lodge a complaint with your country’s (or State’s) proper oversight agency. We would, however, appreciate the chance to deal with any concerns directly before such a complaint is filed.

A Privacy Rights Request Form can be accessed here: Privacy Rights Request Form