Last updated January 1, 2023
1. Introduction Thank you for considering a job opportunity at Spotify!
The data controller for the processing of your personal data is the Spotify entity in the country from which you would work if you were offered a job at Spotify. If you are unsure which country or entity this would be, please contact us.
2. Your rights Privacy laws, including the General Data Protection Regulation, give rights to individuals over their personal data. As available and except as limited under applicable law, the rights afforded to individuals are detailed in the table below:
There are situations where Spotify is unable to delete your data, for example when:
You can request that we stop this processing temporarily or permanently.
To exercise any of the rights above, please email us. Whether you choose to exercise any privacy right will not affect your recruitment process and you will not be discriminated against in any way. To honor a request, we may need to verify your identity and ask you to provide certain details related to you.
Please note, if you were referred to the application process by someone else, you may have received a confirmation email when your referral was submitted. By following a link in this email you may log into our recruitment tool Lever, where you can access, rectify, and request erasure of certain Application Data. Please note, however, that you need to email us if you would like to exercise a full data subject access request as explained above.
You may designate, in writing or through a power of attorney (in accordance with local law), an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.
For purposes of the CCPA, we do not “sell” or “share” personal data as defined by the CCPA. We also do not process any data that is sensitive as defined by the CCPA for secondary purposes as defined by the CCPA’s accompanying regulations.
3. Personal data we processThe table below sets out the categories of personal data we collect and use.
Professional or employment-related information,
Education information, and other data you provide us
Contact information, such as your name, email address, phone number, city, country, and any other contact information;
Details related to your work experience, such as your CV or resume, cover letter, academic qualifications, transcripts;
Information about the type of employment you are looking for or may be interested in, including targeted compensation, benefits and other job preferences;
Publicly available information from publicly available sources relevant for the hiring process, e.g. your LinkedIn or GitHub profile;
Other information provided by you in the hiring process.
Professional or employment-related information,
Education information, and
other data taken down during the recruitment process
And other data about you provided via background checks and other similar records
Characteristics and other data you provided us
4. Our purpose for processing your personal dataThe table below sets out:
Here is a general explanation of each ‘legal basis’ to help you understand the table:
5. Automated decision-makingIn limited circumstances our recruitment processes use elements of solely automated decision-making in order to confirm that we only proceed with candidates who meet the minimum requirements for a job, as set out in a job description. For example, if the job description clearly requires candidates to have previously had managerial experience and the application form asks if you have managerial experience, your application may be rejected automatically if your answer in the application form is “No”. Automated decision-making is only used as an exception when we expect a high volume of applications which we cannot handle manually. You may always request a manual review of the decision by emailing firstname.lastname@example.org.
6. Sharing your personal dataWe may share any of your personal data described above to third party service providers such as providers of recruiting tools to organize and facilitate our recruitment process.
We may also share your personal data globally with other companies in the Spotify Group in order to carry out the activities specified in this Policy. Because of the global nature of our business, we share personal data internationally with Spotify group companies, subcontractors and partners when carrying out the activities described in this Policy. They may process your data in countries whose data protection laws are not considered to be as strong as EU laws or the laws which apply where you live. For example, the laws of these countries may not guarantee the same rights over your data.
Whenever we transfer personal data internationally, we use tools to:
make sure the data transfer complies with applicable law
To ensure each data transfer complies with applicable EU legislation, we use the following legal mechanisms:
We also identify and use additional protections as appropriate for all data transfers. For example, we use:
7. Data retention and deletionIf your application leads to you becoming a Spotify band member, relevant information we collect about you during the hiring process will become a part of your employment record and retained in accordance with our privacy policies for employee data.
If you did not become a Spotify band member, and you do not want to be considered for future job opportunities, we retain your personal data for 6 months or as long as necessary:
to comply with our legal obligations such as immigration and visa requirements, or
If you have consented to being considered for future job opportunities, we retain your personal data for three years. After this period, you will be asked to renew your consent.
All personal data retained by Spotify will be stored in a secure and confidential manner with limited access rights.
8. How to contact us For any questions or concerns about this Policy, or if you would like to exercise any of your rights explained under Section 2 above, please contact our Data Protection Officer by emailing email@example.com.