Recruitment Privacy Statement

Effective: August 18, 2023

Introduction and Statement Scope

We are Workday, a group of companies with offices all over the world. We are committed to protecting the personal information of all prospective Workday personnel and handling information fairly, responsibly, and in accordance with applicable law.

This Recruitment Privacy Statement (“Privacy Statement”) describes how Workday uses personal information as part of our recruitment practices for companies in the Workday group.

In addition to this Privacy Statement, Workday or authorized third parties may provide further supplementary transparency information to keep you informed (for example, during relevant touch points, or within emails, FAQs, briefings with you, or within the tools made available).

This Privacy Statement applies to all prospects or potential employees, applicants or candidates, including in relation to any work, employee, engagement, contractor, intern, and other opportunities with Workday. It also provides details on your personal information rights and how to exercise your Privacy Rights with us.

“Personal information” is information that relates to an identifiable individual processed by automatic means or potentially forming part of a structured manual filing system.

“Processing” or “Process” includes various personal information-based activities (for example, when Workday collects, uses, discloses, deletes, transfers, and stores personal information).

Quick Links

We recommend that you read this Privacy Statement completely to ensure you are fully informed; however, if you only want to access a particular section, you can click on the relevant link below to jump to that section:

Personal Information We Collect and Our Purposes

Who We Share Your Personal Information With

Legal Basis for Processing

International Data Transfers

Data Retention

Your Privacy Rights

Security

Third-Party Certifications

Updates to This Privacy Statement

How to Contact Us

Personal Information We Collect and Our Purposes.

Personal information we collect directly from you.

In connection with prospective personnel and our recruitment activities, Workday may collect and process certain personal information. This may be collected directly from you when you apply for a role with Workday or during in-person or online meetings.

You can apply for a role at Workday using a number of third-party career sites, tools or applications; for example, SEEK and LinkedIn. Doing so will connect your profile from these systems with the Workday job application(s).

Third party sources.

We typically collect personal information directly from you (for example, when entering your personal information within any applications), but there may be situations where we collect personal information from other sources. Other personal information is generated in the course of your applications for example, by recruiting teams and Workday systems.

We may also collect the following information from third-parties and information sources:

Information provided by entities you have asked to support you in finding a job, including recruiting agencies, educational institutions, professional organizations, or alumni résumé sharing platforms
Information provided by Workday personnel who have referred you for a job
Information provided by background checking agencies, including (where permitted under applicable law) criminal background checks, and security clearance checks (to the extent applicable to relevant government work) to verify the accuracy of information you have provided
Information provided by referees in response to reference requests
Information collected from publicly available sources, including any business, professional, or social media platforms you use or other relevant information available online
Information provided in connection with potential target companies that may join the Workday group through a merger, acquisition, or purchase of assets

The table below provides a summary of the typical recruitment purposes, examples of the personal information and the Lawful Bases for the processing under applicable law. You can read more on “Lawful Bases” in the sections below.

Purpose(s)	Examples of personal information that may be processed	Lawful Bases for processing
Prospect and applicant recruitment and job application(s)	Careers site and account registration details: email and password for our sites Contact details: full and known names, address, email address, phone number and other contact information Information concerning your job application(s): letters, details included in your CV, résumé, education records, languages, experience and background information, employment history/previous employers, job titles/positions, reasons for moving roles and notice periods, your skills, academic/professional qualifications/certifications, details of any memberships or professional and private interests, hobbies (which may include information revealing “Sensitive Personal Information” described further below), transcripts, and employment references Role interests: including the role you have expressed an interest in and future jobs and professional goals Details of your immigration/visa status: regarding nationality, citizenship, work eligibility and authorizations	Legitimate interests
Facilitate our recruitment processes, facilitate and manage in-person and online meetings and assessments	Information includes: - Your availability, geographic mobility, expectations and goals - Compensation: current and future package and benefits aspirations - Data concerning your health, any disability, and in connection with any adjustments to working arrangements - Travel-related expenses: to the extent incurred during the recruitment process and banking details so that Workday can reimburse you if you have claimed applicable expenses - The results of a candidate assessment with a third-party provider if we asked you to complete one during the recruitment process - Details of your reference providers: their name and contact details, employer, job role, and their views about your previous roles and suitability - CCTV: images if you attend an interview or assessment at a Workday office, including images captured by video surveillance cameras used for safety and crime prevention purposes; for more information, see our CCTV Privacy Statement	Legitimate interests
Make a hiring decision for current or future employment opportunities	Our assessment of your application, interview notes, opinions, references, and suitability Any checks we may make to verify any information provided, including your identity, academic and professional qualifications, background checks in respect of information connected with your right to work, and other relevant public information Records of our decision-making process	Legal obligation Contract/pre-contract steps Legitimate interests
Verify your information and carry out necessary checks	If relevant, and to the extent required or permitted by local law, we process information: - To carry out reference checks, security clearance checks, or background checks that are applicable to certain roles, Workday or customer projects, assignments or secondments - To assist you with obtaining an immigrant visa or work permit, or verify your eligibility to work within your work location as needed. This includes: national identifiers, government identification numbers, photographs, codes and documentation, residency information, citizenship, work permit status, visa number, nationality and passport information, date of birth, age or your generation, social security or taxpayer number(s)/codes	Legal obligation Contract/pre-contract steps Legitimate interests
Comply with applicable laws or requests and protect our business from security or similar threats	The information depends on the nature of the request, but as an example, may include information about your role and activities if a regulator makes enquiries	Legal obligation
Provide reports on the diversity of our recruitment talent pools and will need to send reports to the relevant authorities covering a particular time period in certain Workday locations required by law.	To the extent required or permitted by local law, information on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability and age (see more on this below)	Legal obligation Legitimate interests Consent (where required by law)
Defend Workday against potential complaints on enquiries	The information depends on the nature of the complaint or enquiry and who raises this; the data may include your own and third-party views about you or the concern raised, comments regarding suitability, and other responses in connection with your application and our handling of this	Legitimate interests
Improve Workday processes and services as well as statistical and security analysis	Feedback: any information on the Workday recruitment process provided to Workday personnel or via voluntary surveys initiated by Workday	Legitimate interests
Contacting you about future Workday opportunities	If you are not appointed to a role initially, we would like to add your details to our internal talent and candidate pool to consider and contact you for future opportunities that might be a match, and share interesting recruitment events and news. We will keep your personal information in our talent pool for a reasonable period under applicable law. You can advise your talent acquisition Workmate if you would prefer not to be contacted about future roles or recruitment events and news. You can also update your contact preferences with Workday at any time. See “Your Privacy Rights” below.	Legitimate interests Consent (where required)

Sensitive Personal Information

The definition of sensitive personal information varies based on your jurisdiction, but may include any information that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs; and data concerning your health, sexual orientation, trade-union membership, biometric data, and criminal history; and the contents of your communications where Workday is not an intended recipient, precise geolocation (“Sensitive Personal Information”). We do not collect or process any Sensitive Personal Information about you unless it’s to operate our business, for legitimate employment-related purposes, or where otherwise permitted by, or necessary to comply with, applicable laws.

For example, information about your racial or ethnic origin, gender (including gender identity), sexual orientation, and disabilities may be collected for the purposes of assessing, creating, and cultivating a diverse and inclusive work environment such as Workday VIBE™ initiatives, compliance with equal employment opportunity obligations or goals, or complying with anti-discrimination laws and government or associated reporting obligations.

Information that we collect automatically.

When you visit the Workday Recruitment site, we use cookies, tracking pixels, and scripts. For more information about the technologies we use and how you can control these technologies, please review the Workday Recruitment Site Cookie Notice.

Aggregating and analyzing personal information.

Workday may de-identify, aggregate, or anonymize your personal information for privacy and security purposes. This may include using information in de-identified reports, analyzing and presenting summaries for you in tools and/or for Workday management in order to consider trends and people strategies for the workforce, or third-party learning opportunities. Aggregation may involve the de-identified information from other Workday applicants or personnel and where relevant, comparing aggregated and pooled data with past or future personnel information, responses, industry benchmarks, and comparisons as well as relevant advice or research.

Successful applicants.

If you accept a role at Workday, the information collected during the recruitment process may form part of your personnel file or profile, to the fullest extent allowable, and will be processed in accordance with our Employment Privacy Statement, which will be provided to you.

Who we share your personal information with.

Workday takes care to only access or disclose personal information to those teams or individuals internally and externally who require access to perform their legitimate tasks and duties and in line with the purposes outlined above.

We will disclose your personal information to the following categories of recipients:

Workday Group members around the world in order to administer the recruitment processes, including managers, administrators, and our People & Purpose teams.
Background-checking or other screening providers and third parties that verify employment history, academic and professional achievements, and assist with the collection and preparation of applications for security clearances for relevant projects (when necessary).
Third-party service providers that support the Workday Recruitment process (such as recruitment or executive search agencies involved in your recruitment, professional service providers that support with immigration and right to work matters, or third-party survey tool providers designated by Workday).
Third parties such as courts, regulators, tribunals, or professional advisers to comply with our legal and regulatory obligations or address legal matters, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative, or judicial process.
Third parties as necessary to establish, exercise, or defend against potential, threatened, or actual litigation.
Public authorities and their authorized agents in response to lawful requests.
Third parties where you have consented or otherwise instructed Workday to share your personal information.

Workday personnel authorized to access or discuss personal information must comply with confidentiality, privacy and security policy requirements.

We will implement appropriate measures to provide assurance that third-party organizations that we use to process data on our behalf use information in a manner consistent with this Privacy Statement and with applicable law, and that the security and confidentiality of the information is maintained. This is in addition to the privacy and security obligations applicable to the third party in connection with their processing. Third-party recipients may have their own privacy statements outlining their approach, which you may wish to consult.

Workday does not “sell” to third parties, or “share” with third parties for targeted advertising purposes, the personal information that it collects or processes as part of the recruitment, employment, or personnel management process or any related processes (including as those terms are defined under the California Privacy Rights Act).

Legal Basis for Processing

If you or the Workday role are located in Europe, our legal basis or grounds for collecting and using your personal information as described in this Privacy Statement falls into the following categories under applicable law. The ground will depend on the information concerned and the specific context and purposes for which we collect it.

Legitimate Interest: We process certain data for recruitment, employment, and corporate legitimate interests of Workday and third parties and consider individual privacy impacts. Legitimate interests for Workday and third parties include administering an efficient recruitment process now, managing and assessing applicants effectively, and Workday’s future interests to reconnect talented individuals with future opportunities. We will not rely on this ground where your interests and fundamental rights outbalance and override in our reasonable view.
Performance of a Contract: We process personal information to perform our obligations under an agreement we have with you or to take steps prior to entering an employment contract with you, where you are considered for employment. For example, we use your personal information to make you a job offer or complete a contract of employment or services with you.
Other Legal Bases: In some cases, we may have a legal obligation to process your personal information, such as in response to a court or regulator order. We also may need to process your personal information to protect vital interests, or to exercise, establish, or defend legal claims.
Consent: In some cases, we ask you for your consent to process your personal information for specific activities/initiatives. You can withdraw your consent at any time, which will not affect the lawfulness of the processing before your consent was withdrawn. If you would like to withdraw your consent, you can do so by contacting us as provided in the “How to contact us” section below.

In some cases, such as background checks, you may also advise the third-party service provider of a consent withdrawal.

When personal information is required.

Workday will inform you if there is a legal or recruitment business requirement to provide personal information. Generally, we will ask for what is reasonably necessary. If you are unable to provide the requisite information we will explain any consequences or delays in respect of your applications. Workday considers the various lawful bases available and the most suitable under applicable law.

Where Workday or a third party seeks consent for certain processing purposes in accordance with applicable law, you should not feel obliged to provide this information. Consent is a voluntary ground. You will have a choice in respect of the specific processing initiative and whether to provide the information.

We may have additional lawful bases and grounds where Sensitive Personal Information is processed.

International Data Transfers

Workday operates as a global business and may process prospect and candidate personal information in countries where:

We are recruiting for certain talent and roles
You have applied for a job
Workday, its recruiters, managers, or Workday subcontractors, customers, or relevant third-party recipients have operations

As Workday is headquartered and conducts global business from the United States (“U.S.”), we process personal information in the U.S. and other countries outside the European Economic Area, United Kingdom (“UK”), and Switzerland (together “Europe”).

Local privacy laws may be different in your home location. For such transfers, we take appropriate safeguards to protect your personal information, fundamental rights and freedoms, and the exercise of your rights in accordance with applicable law by ensuring:

That the recipient country or commercial organization provides an adequate level of data protection based on the European Commission’s (and associated) Adequacy Decisions pursuant to Article 45 of the GDPR; or
We enter into “standard contractual clauses” approved by the European Commission (and similar competent authorities) in any Implementing Decisions as referred to in Article 46 of the GDPR or with the data importer (you have a right to request a copy of these standard contractual clauses by contacting us using the contact details set out below in the “How to Contact Us” section).

Where necessary, we implement additional contractual, technical, and organizational measures to ensure that personal information which is transferred outside of Europe is subject to an essentially equivalent level of protection.

Third-party organizations processing personal information for Workday must comply with applicable privacy laws and the approved transfer safeguards in order to protect your personal information in any country where they undertake processing. This may include certification to local data importing frameworks approved for cross-border data sharing.

Data Retention

Workday securely stores and retains your personal information as long as needed to fulfill legitimate business purposes, including those described in this Privacy Statement and in accordance with applicable laws. As a summary indication, we keep personal information for a reasonable period:

Following a recruitment process and our hiring decision in order to respond to potential legal, compliance, or complaints involving Workday operations; and
To keep you informed of future vacancies and maintain accurate records of your preferences.

You can update your contact preference regarding future contact at any time, but please be aware that we may need to retain wider data for prevailing lawful purposes that apply at that point if you later enquire about deletion.

Your Rights Over Your Personal Information

Depending where you are located, you may have certain legal rights over personal information we hold about you. These include the right to:

Obtain access to your personal information that is being processed by us, have inaccurate personal information corrected, and request the deletion of some of your personal information.
Object to the processing of your personal information carried out on the basis of our legitimate interests.
Ask us to restrict the processing of your personal information.
Request the portability of your personal information in a structured, commonly used and machine-readable format if the processing is carried out on the basis of consent or a personal contract.
Withdraw your consent at any time, if we have collected and processed your personal information for a specific activity with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Lodge a complaint with a data protection supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence, your place of work, or the registered office of the controller. You may also request the details of your competent supervisory authority by using the contact details below in the “How to Contact Us” section.

We may require you to provide information from which we can satisfy ourselves as to your identity.

Workday will not discriminate against you for exercising your Privacy Rights. We will explain how the rights mentioned above operate in a given situation, including:

If the right and its availability differ in your location or because of the legal basis for the processing activity or Workday’s prevailing processing needs
How the rights of others interact with a specific request.

Workday does not make decisions based solely on automated processing that produce legal or similarly significant effects as part of the recruitment processing activities covered by this Privacy Statement.

You, or an authorized individual who we can verify is acting on your behalf, can exercise the applicable rights by contacting us using the contact details at the bottom of this Privacy Statement or by submitting your request through our Request Portal. If you are able to provide details of your concern, this may assist Workday expedite the response. In any event, we will respond without undue delay and keep you updated. In Europe, this is usually within one month of your request.

Additional Information for California Residents

For California residents, if you are submitting a request to access, please specify whether you would like to access personal information categories or specific pieces of personal information. In addition to many of the rights described above, California residents have the right to opt out of a business’s sale of your personal information or sharing of your personal information to third parties for targeted advertising. Workday does not sell your personal information or share your personal information with third parties for targeted advertising. Workday also does not use your Sensitive Personal Information for any purpose other than to operate our business, for legitimate recruitment-related purposes, or where otherwise permitted by, or necessary to comply with, applicable laws, and therefore does not provide a right to limit the use of Sensitive Personal Information.

When you submit a request, we will first acknowledge receipt of your request within 10 business days after receipt of your request. We will provide a substantive response to your request within 45 calendar days after its receipt. If we require more time (up to 90 days or the permitted time frame), we will inform you of the reason and extension period in writing.

Only you or an authorized agent (as described below) may make a verifiable consumer request related to your personal information.

How to Authorize an Agent. You may designate an authorized agent to submit your verifiable consumer request on your behalf only if the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.
How We Verify Your Request. To respond to your request, we must verify your identity and/or the authority of your authorized agent. We will only use the personal information provided to us in that context to verify your identity or the authority of your authorized agent to make the request. Making a verifiable consumer request does not require you to create an account with us. To allow us to verify your request, we may require that you provide at least two pieces of personal information that we already have in our possession, if we cannot already verify you. We will verify your consumer request by comparing the information you provide to information already in our possession, and take additional steps to minimize the risk of fraud.

Security

We maintain appropriate security arrangements. We use technical, organizational, and contractual measures to provide a level of security aiming to protect the information against incidents and the risks involved.

Please note security of information transmitted through the internet can never be guaranteed. You are responsible for maintaining the security of your password or other form of authentication involved in accessing password-protected or secured areas of any Workday recruitment web page. Access to and use of password-protected and/or secure areas of any Workday recruitment web pages is restricted to authorized users only.

Third-Party Certifications

U.S. Data Privacy Framework
Workday adheres to the principles of the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Workday relies on the EU-U.S. DPF as a legal basis for transfers of personal information. To learn more, visit our Data Privacy Framework Notice here.

Workday will rely on the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF as a legal basis to transfer personal information from the UK and Switzerland once the applicable local authorities approve Adequacy Decisions. In the meantime, Workday continues to rely on the SCCs for the purposes of UK and Swiss data protection law. See more in International Data Transfers above.

APEC Cross-Border Privacy Rules System
The Workday privacy practices, described in this Privacy Statement, comply with the APEC Cross-Border Privacy Rules (CBPR) system. The APEC CBPR system provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework can be found here.

Updates to This Privacy Statement

We may update this Privacy Statement from time to time in response to changing legal, technical, or business developments. When we update this Privacy Statement, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Privacy Statement.

How to Contact Us

If you have any questions about this Privacy Statement, wish to exercise your rights or to contact our Data Protection Officer, please submit your request through our Request Portal. You may also contact us at one of the mailing addresses below:

Workday, Inc.
Attn.: Privacy
6110 Stoneridge Mall Road
Pleasanton, CA 94588
USA

Workday Limited
Attn.: Privacy
Kings Building
May Lane
Dublin 7 Ireland

For European prospects and candidates, the Workday affiliate in the country you applied for a role or conducting the recruitment search process will be the “data controller” in relation to your personal information. For a list of Workday affiliates and their contact details, please see here.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at: https://feedback-form.truste.com/watchdog/request.