Arctic Wolf Logo

HR Information Privacy Policy

Last Revised: April 17, 2020

PDF Version

This HR Information Privacy Policy (the “Privacy Policy”) applies to Arctic Wolf Networks, Inc. and its and its operating groups, subsidiaries, and affiliates, including specifically Arctic Wolf Networks Canada, Inc.,  (collectively, “Arctic Wolf”, “we”, “us”, or “our”). This Privacy Policy applies to the personal information of all individuals who seek to be, are, or were employed by Arctic Wolf (collectively, an “employee”), unless the personal information is collected, used or disclosed while using the Arctic Wolf website.  This personal information is dealt with in Arctic Wolf’s Privacy Policy located at https://arcticwolf.com/privacy-policy/.  This Privacy Policy also describes the choices available to you regarding our use of your personal information and how you can access and update this information.  If you have any questions regarding this Privacy Policy, or are unsure of which Privacy Policy applies to you, please send your questions to dataprotection@arcticwolf.com or see the “Contact Us” section later in this Privacy Policy.

1. Policy of Compliance

It is Arctic Wolf’s policy to comply with the privacy legislation within each jurisdiction in which we operate.  If you are a California resident, the CCPA Notice set forth in Section 17 below will apply.  Sometimes the privacy legislation and/or an individual’s right to privacy are different from one jurisdiction to another.  This Privacy Policy (located, for employee review, in Confluence and also posted on our website at www.arcticwolf.com/terms/hr-privacy-policy/) was developed to guide the activities of Arctic Wolf. In addition, specific privacy practices may be adopted to address the specific privacy requirements of particular jurisdictions.

This Privacy Policy has a limited scope and application and the rights and obligations contained in this Privacy Policy may not be available to all individuals or in all jurisdictions. If you are unsure if or how this Privacy Policy applies to you, please send your question to Arctic Wolf at dataprotection@arcticwolf.com.  General questions and inquiries related to Human Resource matters should be sent to careers@arcticwolf.com.

2. Effective

When we make changes to this Privacy Policy, we will revise the “last updated” date at the top of the Privacy Policy. Changes or updates to this Privacy Policy are effective upon the “Last Updated Date” set forth above and the updated Privacy Policy will be posted on our website located at www.arcticwolf.com/terms/hr-privacy-policy/.  If you are a current employee, we may also notify you by email (sent to your work email or the e-mail address specified in your personnel file) or by means of a notice on the “Policies” page within our Confluence system on prior to the change becoming effective.  We may update this Privacy Policy to reflect changes to our information practices and will obtain your consent for any changes where your consent is required by law. We encourage you to periodically review the Privacy Policy for the latest information on our privacy practices.

3. What is Personal Data?

For the purposes of this Privacy Policy, personal data is any information that may identify you as an individual, other than your business title or business contact information when used or disclosed for the purpose of business communications. Personal data does not include anonymous or non-personal information (i.e., information that cannot be associated with or tracked back to you).

4. What Personal Data Do We Collect?

We collect and maintain different types of personal data in respect of those individuals who seek to be, are, or were employed by us, including the personal data, including but not limited to CVs/resumes, employment applications, writing samples, technical assessments, reference and interview notes, photographs and videos, letters of offer and acceptance of employment, mandatory policy acknowledgement sign-off sheets, employment agreements, building access forms, background investigation reports, credit checks, new employee set up forms, parking contracts, and payroll and benefit information, which includes but is not limited to social security number, driver’s license number, passport number or other similar identifiers, pay check deposit information, dependent information, Employee Saving Plan (ESP) and Group Registered Retirement Savings Plan (GRRSP) information, wage and benefit information, forms relating to the application for, or in respect of changes to, employee health and welfare benefits, including, short and long term disability, vision, medical and dental care, and beneficiary and emergency contact information.

In addition to the examples listed above, personal data also includes information such as name, home address, telephone, personal email address, date of birth, employee identification number, marital status, photograph, bank account number(s), credit card information, and any other information necessary to Arctic Wolf’s business purposes, which is voluntarily disclosed in the course of an employee’s application for and employment with Arctic Wolf.

As a general rule, Arctic Wolf collects personal data directly from you.  In most circumstances where the personal data that we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you, or implied from your actions).

From time to time, we may utilize the services of third parties in our business and may also receive personal data collected by those third parties in the course of the performance of their services for us or otherwise. Where this is the case, we will take reasonable steps to ensure that such third parties have represented to us that they have the right to disclose your personal data to us.

Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.

5. Why Do We Collect Personal Data?

The personal data collected is used and disclosed for our business purposes, including establishing, managing or terminating your employment relationship with Arctic Wolf. Such uses include: determining eligibility for initial employment, including the verification of references and qualifications; administering pay and benefits; processing employee work-related claims (e.g. worker compensation, insurance claims, etc.); establishing training and/or development requirements; conducting performance reviews and determining performance requirements; assessing qualifications for a particular job or task; gathering evidence for disciplinary action, or termination; establishing a contact point in the event of an emergency (such as next of kin); complying with applicable labor or employment statutes; compiling directories; ensuring the security of company-held information; and such other purposes as are reasonably required by Arctic Wolf.

6. Monitoring

The work output of Arctic Wolf’s employees, whether in paper record, computer files, or in any other storage format belongs to us, and that work output, and the tools used to generate that work output, are always subject to review and monitoring by Arctic Wolf.  When using Arctic Wolf equipment or resources, employees should not have any expectation of privacy with respect to their use of such equipment or resources.

In the course of conducting our business, we may monitor employee activities, our premises and our property. For example, some of our locations are equipped with surveillance cameras.  Where in use, surveillance cameras are there for the protection of employees and third parties, and to protect against theft, vandalism and damage to Arctic Wolf’s goods and property, and to ensure compliance with our agreements with our customers and partners. Generally, recorded images are routinely destroyed and not shared with third parties unless there is suspicion of a crime, in which case they may be turned over to the police or other appropriate government agency or authority.  We also may monitor employees’ computer and e-mail use.  Please see our Acceptable Use Policy (located at https://arcticwolf.atlassian.net/wiki/spaces/AWD/pages/150025515/Acceptable+Use+Policy) for further information related to your use of and our monitoring of your computer and email use.

This section is not meant to suggest that employees will, in fact, be monitored or their actions subject to constant surveillance. We have no duty to so monitor. It is meant to bring to your attention the fact that such monitoring may occur and may result in the collection of personal data from employees (e.g. through their use of our resources).

7. How Do We Use Your Personal Data?

We may use your personal data for the purposes described in this Privacy Policy; or for any additional purposes for which we advise you.  If your consent to use your personal data is required by law, we will obtain your consent for such use or disclosure of your personal data.

We may use your personal data without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

8. When Do We Disclose Your Personal Data?

We may share your personal data with our employees, contractors, consultants, customers, partners, and other parties who require such data to assist us with establishing, managing or terminating our employment relationship with you, including with parties that provide products or services to us or on our behalf and parties that collaborate with us in the provision of products or services to you.  In some instances, such parties may also provide certain information technology and data processing services to us so that we may operate our business. We may share personal data with such parties both in and outside of your home jurisdiction, and as result, your personal data may be collected, used, processed, stored or disclosed in the United States of America, and in some cases, other countries.  Personal data is only transferred by us to another country if this is required or permitted under the applicable privacy legislation, in particular only in as far as a reasonable level of data protection is assured in the recipient country.

When we share personal data with such parties, we typically require that they only use or disclose such personal data in a manner consistent with the use and disclosure provisions of this Privacy Policy.

Personal data related to start date, end date and your title may be shared with third parties for purposes of verifying your employment at Arctic Wolf.  Your consent is required for Arctic Wolf to provide any additional information related to a third-party employment verification.

In addition, personal data may be disclosed or transferred to another party in the event of a change in ownership of, or a grant of a security interest in, all or a part of Arctic Wolf through, for example, an asset or share sale, or some other form of business combination, merger or joint venture, provided that such party is bound by appropriate agreements or obligations and required to use or disclose your personal data in a manner consistent with the use and disclosure provisions of this Privacy Policy, unless you consent otherwise.

Further, your personal data may be disclosed as permitted or required by applicable law or regulatory requirements.  In such a case, we will endeavor to not disclose more personal data than is required under the circumstances; to comply with valid legal processes such as search warrants, subpoenas or court orders; as part of Arctic Wolf’s regular reporting activities; to protect the rights and property of Arctic Wolf; during emergency situations or where necessary to protect the safety of a person or group of persons; where the personal data is publicly available; or with your consent where such consent is required by law.

9. Notification and Consent

Privacy laws do not generally require Arctic Wolf to obtain your consent for the collection, use or disclosure of personal data for the purpose of establishing, managing or terminating your employment relationship.  In addition, we may collect, use or disclose your personal data without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

To the extent that your consent is required, we will assume, unless you advise us otherwise, that you have consented to Arctic Wolf collecting, using and disclosing your personal data for the purposes stated above (including any other purposes stated or reasonably implied at the time such personal data was provided to us).

Where your consent was required for our collection, use or disclosure of your personal data, you may, at any time, subject to legal or contractual restrictions and reasonable notice, withdraw your consent.  All communications with respect to such withdrawal or variation of consent should be in writing and addressed to our Privacy Officer at dataprotection@arcticwolf.com.

10. How is Your Personal Data Protected?

Arctic Wolf endeavors to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal data in question. These safeguards are designed to protect your personal data from loss and unauthorized access, copying, use, modification or disclosure.

11. How Long is Your Personal Data Retained?

Except as otherwise permitted or required by applicable law or regulatory requirements, Arctic Wolf endeavors to retain your personal data only for as long as it believes is necessary to fulfill the purposes for which the personal data was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations). We may, instead of destroying or erasing your personal data, make it anonymous such that it cannot be associated with or tracked back to you.

12. Updating Your Personal Data

It is important that the information contained in our records is both accurate and current.  If your personal data happens to change during the course of your employment, please keep us informed of such changes.

In some circumstances we may not agree with your request to change your personal data and will instead append an alternative text to the record in question.

13. Access to Your Personal Data

You can ask to see the personal data that we hold about you. If you want to review, verify or correct your personal data, please contact the office of our Privacy Officer using the contact information set out below. Please note that any such communication must be in writing.

When requesting access to your personal data, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal data that we hold about you. If you require assistance in preparing your request, please contact the office of our Privacy Officer.

Your right to access the personal data that we hold about you is not absolute.  There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal data that we hold about you. In addition, the personal data may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.

In the event that we cannot provide you with access to your personal data, we will endeavor to inform you of the reasons why, subject to any legal or regulatory restrictions.

14. Questions

If you have any questions about this Privacy Policy, or if you would like further information regarding the personal data that we may maintain about you, please contact us as follows:

Arctic Wolf Networks, Inc.
111 W. Evelyn Ave., Suite 115
Sunnyvale, CA 94086
dataprotection@arcticwolf.com
(888) 286-6726

General inquiries and questions related to your application or employment with Arctic Wolf should be sent to careers@arcticwolf.com.

15. Interpretation of this Privacy Policy

Any interpretation associated with this Privacy Policy will be made by the Privacy Officer.  This Privacy Policy includes examples but is not intended to be restricted in its application to such examples, therefore where the word ‘including’ is used, it shall mean ‘including without limitation.

This Privacy Policy does not create or confer upon any individual any rights, or impose upon Arctic Wolf, any rights or obligations outside of, or in addition to, any rights or obligations imposed by the privacy laws applicable to such individual’s personal data. Should there be, in a specific case, any inconsistency between this Privacy Policy and such privacy laws, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.

16. Arbitration Agreement (U.S. only)

Any and all disputes concerning or arising out of employment at Arctic Wolf (including but not limited to your application, hiring, and termination from employment) that cannot be otherwise resolved shall be submitted to binding arbitration before a single neutral arbitrator of the American Arbitration Association (“AAA”) under the AAA’s Employment Arbitration Rules, a copy of which you may obtain from www.adr.org or by asking Arctic Wolf before signing this agreement to arbitrate. Arctic Wolf will pay the AAA administrative and arbitrator fees as to statutory claims and to the extent otherwise required by law for enforcement of the agreement to arbitrate, subject to final assessment by the arbitrator.  All arbitrations will be conducted in Santa Clara County, California.  The arbitrator shall not have the power to commit errors of law or legal reasoning, and the arbitrator’s order, decision or award may be vacated or corrected on appeal to a court of competent jurisdiction for any such error. Otherwise, the arbitrator’s order, decision or award shall be final and conclusive, in lieu of all other legal, equitable or judicial proceedings between us, and that order, decision or award may be entered as a final judgment in, and enforced by, any court of competent jurisdiction. Notwithstanding the foregoing, the parties shall have the right to seek provisional remedies provided by law, including temporary restraining orders and preliminary injunctions, from a court of competent jurisdiction pending arbitration.

With the exception of claims covered by Section 8116 of the Department of Defense Appropriations Act, 2010, which are excluded from arbitration under this agreement, this arbitration agreement specifically includes, without limitation, all disputes, under any state or federal discrimination, fair employment practices or other employment related statute, regulation or executive order (as they may have been amended) prohibiting discrimination or harassment based upon any protected status including, without limitation, race, national origin, age, gender, marital status, disability, veteran status or sexual orientation or other protected status; all claims for unlawful retaliation for exercising any right under law; all torts; all federal or state statutory claims; and all express or implied contracts. This agreement does not affect your right or obligation to exhaust administrative remedies with an applicable governmental agency before submitting applicable statutory claims to binding arbitration.

17. Supplemental Privacy Policy Terms for California Residents

This provision is effective as of January 1, 2020, shall apply only to residents of California, and may be subject to change.  The Privacy Policy shall continue to apply to the extent that it applies to you as a resident of California; however, if you are a resident of California, Arctic Wolf also is required to disclose certain uses and disclosures in a certain format, as well as to inform you of certain rights you may have.  These supplemental privacy policy terms are set forth in Exhibit A attached hereto and incorporated herein by reference.  Any capitalized terms used in the supplemental privacy policy shall have the same meaning as in this Privacy Policy.

EXHIBIT A

Supplemental Privacy Policy Terms

PRIVACY NOTICE TO CALIFORNIA EMPLOYEES, CONTRACTORS AND JOB APPLICANTS REGARDING THE COLLECTION OF PERSONAL INFORMATION

Last Updated:  04/17/2020

This Privacy Notice to California Employees, Contractors And Job Applicants Regarding The Collection Of Personal Information (this “Privacy Notice”) is part of Arctic Wolf Networks, Inc., and its operating groups, subsidiaries, and affiliates, including specifically Arctic Wolf Networks Canada, Inc.,  (collectively, the “Company” or “we”) Employee Privacy Policy and is applicable to California residents.  The Company is committed to protecting the privacy and security of personal data of our current and former employees, job applicants, officers and directors (collectively, “Employees”) and contractors and agents (together with Employees, “Personnel”) and their emergency contacts and beneficiaries.  The Company, or contractors or agents performing services on Company’s behalf, collect personal data of Personnel and their emergency contacts and beneficiaries in connection with its human resources (“HR”) activities.  The Company does not sell or otherwise disclose this personal information for monetary consideration.

The Company is committed to complying with the California Consumer Privacy Act (“CCPA”) effective January 1, 2020, and all data privacy laws in the jurisdictions in which the Company collects personal data of Personnel. Personnel, emergency contacts and beneficiaries with disabilities may access this notice in an alternative format by contacting dataprotection@arcticwolf.com or by requesting a copy by calling (888) 286-6726.

What Categories of Personnel Data Do We Collect and How Do We Use This Data?

We, and our third-party service providers performing HR services on our behalf, collect the following categories of personal data for the purposes described below:

  Category of Personal Data Personal Data Collected Purpose
A. Personal identifiers Examples: Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number or other similar identifiers, age, date of birth. The Company collects personal identifiers to recruit; process job applications; perform background and reference checks; onboard new Personnel; enroll and administer compensation and benefits; payroll processing; conduct training; resource plan; comply with regulatory requirements; enter into contracts; and perform other general HR activities.

The Company collects Personnels’ age and date of birth to onboard new Employees and contractors, enroll and administer benefits, and perform other general HR activities.

B. Records identified by state law (including the California Customer Records statute (Cal. Civ. Code § 1798.80(e))) Examples: Name, signature, Social Security number, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card information, or any other financial information, medical information or health insurance information. The Company collects this data to process job applications; onboard new Personnel; enroll and administer compensation and benefits; payroll processing; conduct training; resource plan; comply with regulatory requirements; enter into contracts; and perform general HR activities.

The Company collects pay data, such as pay rate, payroll deduction information, banking information for direct deposit, and credit card information for expense reimbursement.  In addition, the Company collects this data to pay its Personnel and comply with applicable laws.

C. Protected classification characteristics under state or federal law Examples: Race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, marital status, sex, gender, gender identity, gender expression, age, sexual orientation, or military and veteran status. The Company collects equality and diversity information, such as minority, veteran and disability status, through voluntary self-disclosure and other means to implement the Company’s diversity programs and to comply with applicable laws.

The Company collects health and safety information to maintain a safe workplace, assess working capacity, administer health and Workers’ Compensation insurance programs, and comply with applicable laws.

The Company also collects information necessary for benefits enrollment and administration purposes.

D. Commercial information Examples: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. If you are a contractor, we may collect commercial information from or about you in connection with obtaining services from you.
E. Internet or other similar network activity information Examples: Email, computer, internet, telephone, and mobile device usage; IP address; log-in information; and location information, browsing history, search history, software download history, or information regarding your interaction with a website, application or advertisement.

 

The Company collects this information to protect Company, its customers, and Personnel property, equipment and confidential information; monitor Personnel performance; and enforce the Company’s electronic communications acceptable use policies.
F. Geolocation data Examples: Physical location or movements. The Company collects geolocation data to protect Company’s and its customers’ property, equipment, and confidential information, and to enforce the Company’s commitments to its customers.
G. Sensory data Audio and visual information. The Company may collect audio and visual information of Personnel through photographs used for identification purposes, internal events and communications, and to promote the Company. The Company collects audio and video recordings of training sessions.
H. Professional or employment-related information

Examples: Current or past job history or performance evaluations.

Performance Management Information, such as employment status (full-time or part-time, regular or temporary); work schedule; job assignments; hours worked; accomplishments and awards; training and development information; performance evaluation information; discipline and counselling information; and employment termination information. The Company collects professional and employment-related information to manage its relationship with Personnel.
I. Inferences drawn from other personal information Examples: Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes. The Company may collect inferences drawn from other personal information in connection with evaluating job applicants and to manage our relationship with Personnel.
J. Personal Data about children under the age of 16 Personal information about Employees’ dependents under the age of 16. The Company collects information about Employees’ dependents under the age of 16 if Employees voluntary provide such information in connection with the enrollment and administration of benefits and other human resource purposes that involve such dependents.

The Company, and our third party services providers providing services on our behalf, also collects legal and contractual information, such as information necessary to respond to law enforcement and governmental agency requests, comply with legal and contractual obligations, exercise legal and contractual rights, and initiate or respond to legal claims.  The Company collects this information to comply with legal and contractual requirements and to establish, exercise and defend legal and contractual rights and claims.

What Categories of Emergency Contact Information Do We Collect and How Do We Use This Information?

We, and our third party services providers providing HR services on our behalf, collect the following categories of personal data for the purposes described below:

  • Name and contact information; and
  • Relationship to Employee.

The Company collects this information to contact the Employee’s designated emergency contact persons in the event of an emergency.

What Categories of Beneficiary Information Do We Collect and How Do We Use This Information?

We, and our third party services providers providing HR services on our behalf, collect the following categories of personal data for the purposes described below:

  • Name and contact information;
  • Relationship to the Employee;
  • Birth date;
  • Social Security Number; and
  • Information necessary to process benefits claims.

The Company, and our third party services providers providing HR services on our behalf, collects this information to enroll and administer benefits programs for beneficiaries of Employees.

Contact for questions

Questions regarding this policy can be directed by mail to the address below, or by emailing dataprotection@arcticwolf.com or calling (888) 286-6726:

Arctic Wolf Networks, Inc.
Attn: Information Security and Data Protection Officer
111 West Evelyn Ave., Suite 115
Sunnyvale, CA 94086  U.S.A.