Hubstaff privacy policy

This privacy policy explains how Netsoft Holdings, LLC d/b/a as www.hubstaff.com (collectively, "Hubstaff," "we," "us," and "our") collects, uses, shares, and processes information about you. This privacy policy describes our practices concerning your personal data that we process when we provide you with Hubstaff’s services, including the services available through our website at www.hubstaff.com, our mobile, browser, and desktop applications, and other services where we link this Policy (collectively the "Services").

It also tells you about your privacy rights. Our Terms of Service at https://hubstaff.com/terms provide further terms governing your use of the Services. Together, along with this Privacy Policy, our Terms of Service, Data Processing Agreement (“DPA”), Business Associate Agreement (“BAA”), Refund Policy, Spam Guidelines, Affiliate Terms, and any other electronic or written agreement as applicable between or applicable to Hubstaff and Customer, which govern the provision of the Service to you, as may be updated from time to time, form our “Agreement.” By accessing, downloading, registering with, purchasing from, or otherwise using our Services, you agree to Agreement.

Please read this Privacy Policy and all other applicable terms of our Agreement carefully before you start to use the Services. By using the Services or signing up for an account, you accept and agree to be bound and abide by the Agreement and consent to and agree that we may collect, process, use, retain, disclose, and transfer your Personal Data as described in this Privacy Policy. If you do not agree to the full Agreement, you must not access or use the Services.

We reserve the right to change this Privacy Policy at any time. We will alert you that changes have been made by indicating the “last updated” date of the current version. We encourage you to review this Privacy Policy from time to time to make sure that you understand how any Personal Data we collect will be used.

1. Contact information

If you have any questions, comments, requests, or concerns related to this privacy policy or our privacy practices or if you would like to opt-out of future communications or exercise your other privacy-related rights, please feel free to contact us at:

General contact info:

privacy@hubstaff.com
+1 (800) 932-5330,
Hubstaff,
11650 Olio Road,
Suite #1000 – 193,
Fishers, IN 46037

Hubstaff has appointed a data protection officer (DPO). You may contact Hubstaff’s DPO Jared Brown at privacy@hubstaff.com.

Our EU representative may be reached by contacting:

Maetzler Rechtsanwalts GmbH & Co KG,
Attorneys at Law,
c/o Netsoft Holdings, LLC,
Schellinggasse 3/10, 1010 Vienna, Austria,

Please add the following subject to all correspondence:GDPR-REP ID: 19160560

2. Applicability and eligibility

We need to process your Personal Data to operate our organization and provide you with our Services. By accepting the Agreement, you are confirming that you have read and understood these policies, including how and why we use your Personal Data. If you don’t want us to collect or process your Personal Data in the ways described in this Privacy Policy, you should not use the Services. Please note we are not responsible for the content or the privacy policies or practices of any third party organization or service that interact with our Services. We encourage you to read the privacy policies of these third-party organizations before using any of the Services.

3. Personal data we collect

As used herein, the term "Personal Data" means any information relating to an identified or identifiable natural person including information that specifically identifies an individual (such as a name, address, telephone number, mobile number, e-mail address, credit card number, ACH bank information, identification number, location data, or an online identifier) and information about that individual or his or her activities that is directly linked to the individual. Personal Data does not include aggregate data, which is data we collect about the use of the Services or about a group or category of services or users, from which an individual’s identity cannot be discerned and all other Personal Data has been removed. This Privacy Policy in no way restricts or limits our use of aggregate data.

We rely on a number of legal bases to process the information we receive about you from your use of the Services, including where:

1. you have consented to the processing;

2. the processing is necessary to perform the contractual obligations in order to provide the Services to you, including those of our terms of service;

3. necessary to comply with a legal obligation, a court order, or to exercise or defend legal claims;

4. necessary to protect your vital interests, or those of others;

5. necessary in the public interest;

6. necessary for the purposes of our or a third party’s legitimate interests, such as those of visitors, users, or partners; and

7. you have expressly made the information public.

Where we process your information on the basis of consent, we will clearly obtain your opt-in consent. Where given, you may withdraw your consent at any time by contacting us at privacy@hubstaff.com. Where we process your information on the basis of legitimate interests, we do so where the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

Information we may collect about you includes:

Account Information: you may register for an account with us (a “Services Account”). We do not require you to register to use our Services. However, if you do register a Services Account, you will gain access to those areas and features of the Services that require registration. We will collect certain information about you in connection with your registration for a Services Account, which may include Personal Data and other information such as a username and password.

To register for a Services Account, we will ask you to provide the following:

1. Your first and last name, email, company size, password, phone (optional), and Skype handle (optional).

2. You may optionally upload your photo.

To register your organization for a Services Account, we will ask you to provide the following:

1. Your organization name, team size, currency, logo (optional), preferred settings, team member’s email and role.

2. Information about a job offered or desired, your skills and experience, your company or agency, and related information shared through Hubstaff Talent

Payment Transaction Information: We may collect information related to purchases made through the Services. You may provide certain information to complete payments via the Services, including your credit or debit card number, card expiration date, CVV code, billing address, and ACH bank information (collectively, “Payment Information”), along with your name and billing, delivery and shipping address, to complete payment transactions through certain services.

Please note we work with Service Providers (as defined below) to handle payment transactions. We do not collect or maintain your credit card or other financial account information; this information is handled for us by our Service Providers. You are subject to the privacy policies and terms and conditions of our Service Providers when utilizing a third party service through our Services. Please review the Service Providers’ privacy policies and terms and conditions before using their services.

Task Information: When you use the Services, we collect certain information about your inputs into the Services which could contain Personal Data, such as comments, attachments, and daily stand-ups entered by users of the Services.

Correspondence Information: If you sign up, email us, subscribe to our blog, newsletters, or mailing lists, we may keep your message, email address, and contact information to respond to your requests, provide the requested products or Services, and to provide notifications or other correspondences to you. We do not share or sell any Personal Data to other organizations for commercial purposes.

If you do not want to receive communications from us in the future, please let us know by sending us an e-mail requesting the same to privacy@hubstaff.com or by following the unsubscribe instructions found in any e-mail we send. If you supply us with your postal address, you may receive periodic mailings from us with information on new products and services or upcoming events. If you do not wish to receive such mailings, please let us know by contacting us at privacy@hubstaff.com.

Please note requests to remove your email address from our lists may take some time to fulfill. We may also still contact you as needed to provide important announcements or notifications regarding the Services.

Support Information: you may provide information to us via a support request submitted through the Services. We will use this information to assist you with your support request. Please do not submit any information to us via a support submission, including confidential or sensitive information that you do not wish for our Service Providers to have access to or use in the future.

Form Information: We may use forms to request certain information from you on the Services, such as your contact information to assist with contacts or service requests. This information may include Personal Data.

User contributions: You also may provide information to be posted on public areas of the Services, or transmitted to other users of the Services or third parties (collectively, "User Contributions"). Your User Contributions are posted on and transmitted to others at your own risk. We cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Public information: We may also collect information about you from publicly available sources. Information you make publicly available in any public or open forum, such as on a social network, may be considered public information for the purposes of this Privacy Policy, and may be accessed and collected by us. Please be aware that any content or information you share with or provide to third parties using or related to your use of the Services is neither private nor confidential. We are not responsible for any content or information you post or share with third parties. If you do not wish for certain information to be public, please do not share it publicly.

We do not collect any special categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).

4. Information collected automatically

We use automatic data collection and analytics technologies to collect aggregate and user-specific information about your equipment, domain name, patterns of use, communication data and the resources that you access and use on the Services, including your IP address, browsing and navigation patterns. This information is used to improve our Services.

We generally process information collected automatically on the legal basis of our legitimate interests in assessing the use of our Services. Where appropriate, we may rely on alternate legal bases, such as your consent to certain types of processing.

Information we collect automatically through your use of the Services includes:

Internet browser: Your Internet browser automatically transmits certain anonymous information when you use certain Services. As you navigate through our Services, we and our partners who include third-party Service Providers (as defined below) we engage to help provide our Services, may use automated means to collect various types of information about you, your computer or other device used to access our Services.

A representative, non-exhaustive list of the types of automatically collected information may include:

1. network or Internet protocol address and type of browser you are using (e.g., Chrome, Safari, Firefox, Internet Explorer);

2. the type of operating system you are using (e.g., Microsoft Windows or Mac OS), the name of your Internet service provider (e.g., Comcast, Verizon or AT&T) and domains used by such providers, mobile network, device identifiers (such as an Apple IDFA or an Android Advertising ID);

3. device settings;

4. browser settings;

5. the web pages of the Services you have visited;

6. Services visited before, and after your visit a Service, the type of handheld or mobile device used to view the Service (e.g., iOS, Android); or

7. location information, and the content and advertisements you have accessed, seen, forwarded and/or clicked on.

We may use this information to customize your experience on our Services. You may set your browser to notify you when a cookie is sent or to refuse cookies altogether, but certain features of this site may not work without cookies.

We, along with our Service Providers, may use and combine such collected anonymous information to provide better service to site visitors, tailor the site based on your preferences, compile and analyze statistics and trends, monitor website activity and performance and otherwise administer and improve the site for your use. However, such information is not combined with your Personal Data collected.

Geo-location information: If you are accessing our Services from a mobile device or through a mobile application, you may be asked to share your precise (GPS level) geo-location information with us so we can customize your experience on our Services. Such geolocation information may include physical locations visited (latitude & longitude). If you agree to such collection, in most cases, you will be able to turn off such data collection at any time by accessing the privacy settings of your mobile device and/or through the setting in the applicable mobile application.

Information collected by and from social media services and other third-party platforms: Our users can engage in content on or through social media services or other third party platforms, such as Facebook, or other third-party social media plug-ins, integrations and applications. When you engage in our content on or through social media services or other third-party platforms, plug-ins, integrations or applications, you may allow us to have access to certain information in your profile. This may include your:

1. name;

2. email address;

3. photo;

4. gender;

5. birthday;

6. location; and

7. ID associated with the applicable third party platform or social media account user files, like photos and videos, your list of friends or connections, people you follow and/or who follow you, or your posts or "likes."

For a description on how social media services and other third-party platforms, plug-ins, integrations or applications handle your information, please refer to their respective privacy policies and terms and conditions, which may permit you to modify your privacy settings.

When we interact with you through our content on third party websites, applications, integrations or platforms, we may obtain any information regarding your interaction with that content, such as content you have viewed and information about advertisements within the content you have been shown or may have clicked on.

Analytics information: We use data analytics to ensure site functionality and improve the Services. We use mobile analytics software to allow us to understand the functionality of the Services on your phone. This software may record information such as how often you use the Services, what happens within the Services, aggregated usage, performance data, app errors and debugging information, and where the Services were downloaded from. We do not link the information we store within the analytics software to any Personal Data that you submit within the mobile application.

Log file information: When you use our Services, we may receive log file information such as your

1. IP address;

2. browser type;

3. access times;

4. domain names operating system;

5. the referring web page(s);

6. pages visited;

7. location;

8. your mobile carrier;

9. device information (including device and application IDs);

10. search terms;

11. and cookie information.

We receive log file data when you interact with our Services, for example, when you visit our website, sign in to our Services, or interact with our email notifications. We use log file data to provide, understand, and improve our Services, and to customize the content we show you. We may link this log file to other information we collect about you via the Services.

Information collected by our desktop applications (Mac, Windows and Linux): We may also collect screenshots, applications currently being worked on, web URLs visited, time you are active, the operating system you are using, whether or not you have an input device such as a monitor, whether your mouse is actively moving or not, the names of projects or tasks being worked on, the amount of time worked on those tasks, the browser version you are using, and whether your keyboard is being typed on.

Note: Hubstaff is not a keylogging program. It does not know what you are typing; rather, Hubstaff merely records whether your keyboard is active or inactive. All Hubstaff screenshots are uploaded via SSL over the standard HTTPS port (443). Our input clients do all screenshot uploading directly to Amazon S3 (screenshots never pass through our server). We do not upload keystrokes. (We do not even store keystrokes locally.) We upload the total seconds within a 10 min block that there was "activity" and the total seconds "worked" roughly every 10 minutes. This is done via a separate queue within the client which uses SSL (port 443). Additionally, your screenshots are obfuscated on Amazon's servers.

Cookies: We may also capture Personal Data about you automatically through your use of the Services by utilizing background local storage and session storage technologies (“Cookies”) in order to improve the user experience. Cookies are small files or other prices of data which are downloaded or stored on your computer or other device that can be tied to information about your use of our Sites and Services (including certain third party services and features offered as part of our Services). Examples of information of this type are your IP address, the browser you are using, the operating system you are using and the pages on the Sites that you visit. Session cookies are deleted when you close your browser session. More information on how to modify your browser settings or how to block, manage or filter cookies can be found in your browser’s help file or through such websites as www.allaboutcookies.org. You may change your browser setting to decline the use of Cookies (though this may adversely affect your operation or use of the Sites or Services). Before using Hubstaff websites, you are advised to check your current browser settings to ensure that the settings reflect your consent for Hubstaff to place cookies on your devices. You do not have to accept our cookies and you may set your browser to restrict their use and you may delete them after they have been placed on your hard drive. If you do not accept or delete our cookies, some areas of our websites may take more time to work, or may not function properly. This Privacy Policy does not cover the use of Cookies by third parties over which we have no control.

Information collected by the Hubstaff mobile app (iOS and Android): Hubstaff uses the GPS device on your phone to store its location and display this on a map at Hubstaff.com and your mobile device. This data is only collected if the mobile app is being used. Your mobile device operating system may provide additional options for you to control the collection and use of this information by the Hubstaff mobile app.

Other web technologies: Our Service Providers (defined below) may also use other standard web-based technologies to analyze your movements while accessing our Services. The technologies include web "beacons," "pixel tags," and "clear gifs." These technologies help us ascertain the effectiveness of our product and service campaigns and marketing programs, allow us to customize the services offered on or through our websites, and help determine the best use for websites content, and product and service offerings. Some of this information, including the IP address, may be stored on our Service Provider’s server logs, and may be available for extended periods of time.

Advertisements: Our display advertising partner, AdRoll, enables us to present you with retargeting advertising on other sites based on your previous interaction with the Hubstaff's website. The techniques our partners employ do not collect Personal Data such as your name, email address, postal address or telephone number. You can visit this page (https://www.networkadvertising.org/choices/) to opt out of AdRoll and their partners’ targeted advertising.

5. How Hubstaff shares your personal data

We use the information we receive about you for the purposes described in this Privacy Policy. We generally process Personal Data received about you through our Services on the legal basis of our legitimate interests in providing the Services and their functionality to you where such processing is necessary for the purposes of the legitimate interests pursued by us or by our Service Providers related to the Services. Where appropriate, we may rely on alternate legal bases, such as your consent to certain types of processing or pursuant to performance of a contract. We will not share, sell, rent, or otherwise disclose your Personal Data to third parties without your consent or another valid legal basis permitted by law.

We will share your information in the following circumstances on the legal basis of the legitimate interests of providing the requested Services:

Service Providers: We use third parties to support our business and provide services such as receiving, processing and fulfilling orders, encrypting credit card data as a further measure of securing the data, processing credit card payments, processing product reviews, technical support, and providing comparative performance information relative to our site (“Service Providers”). These third parties have only limited access to your information and may use your information only to perform these tasks on our behalf. Information we share to our Service Providers may include both information you provide to us and information we collect about you, including Personal Data and information from data collection tools like cookies, web beacons, and log files.

We may disclose the personal data that you have provided to us to Service Providers that we have engaged to perform business-related functions on our behalf, but only:

1. to contractors we use to support our business (such as fulfillment services, technical support, delivery services, and financial institutions) or assist in providing the Services, in which case we will require such third parties to agree to treat your personal data in accordance with this policy and use it for the same purposes;

2. in connection about the sale, assignment, merger or other transfer of the business of this site to which the information relates, in which case we will require any such buyer to agree to treat your personal data in accordance with this privacy policy and use it for the same purposes; or

3. to respond to law enforcement requests or where required by applicable laws, court orders, or government regulations.

Business transactions: We may purchase other businesses or their assets, sell our business assets, or be involved in a bankruptcy, merger, acquisition, reorganization or sale of assets (a “Business Transaction”). Your information, including Personal Data, may be among assets sold or transferred as part of a Business Transaction. In some cases, we may choose to buy or sell assets. Such transactions may be necessary and in our legitimate interests, particularly our interest in making decisions that enables our organization to develop over the long term.

Safety and Lawful Requests: We may be required to disclose Services user information pursuant to lawful requests, such as subpoenas or court orders, or in compliance with applicable laws. We generally do not disclose user information unless we have a good faith belief that an information request by law enforcement or private litigants meets applicable legal standards. We may share your information when we believe it is necessary to comply with applicable laws, to protect our interests or property, to prevent fraud or other illegal activity perpetrated through the Services or using our name, or to protect the safety of any person. This may include sharing information with other companies, lawyers, agents, or government agencies. Nothing in this Privacy Policy is intended to limit any legal defenses or objections that you may have to a third party’s, including a government’s or request to disclose your information.Social gatherings: If you are a business or organization that has scheduled a conference, event, or meeting at one of our facilities, we may also share your Personal Data with our event organizers. We also use return e-mail addresses to answer the email we receive from you. Your e-mail address will not be used for any other purpose or shared with outside third parties for their direct marketing purposes. We may also use your IP address to help protect Hubstaff and our Service Providers from fraud.Employment opportunities: If you submit a resume or seek to fulfill other staffing requirements, we will use that information solely in connection with your application for current or future staffing requirements, and we may also share your resume or application information with our business partners or affiliates that have staffing requirements for which you may be qualified. As part of evaluating talent for potential work and employment, Hubstaff may collect certain information about you, including your profile, resume, profile asset, job postings, messages, and other information related to the talent process.Other purposes: Hubstaff may also disclose your personal data as is necessary to:

1. comply with a subpoena or court order;

2. cooperate with law enforcement or other government agencies;

3. establish or exercise our legal rights;

4. protect the property or safety of our company and employees, contractors, vendors, suppliers, and customers;

5. defend against legal claims;

6. help with internal and external investigations; or

7. as otherwise required by law or permitted by law.

We may disclose your information in connection with the sale or merger of Hubstaff or any transaction that involves the sale or assignment of some or all of our assets.

Aggregated Non-Personal Data: We may disclose aggregated, non-personal data received from providing the Services, including information that does not identify any individual, without restriction. We may share demographic information with business partners, but it will be aggregated and de-personalized, so that personal data is not revealed.

6. Your rights and choices

We seek to ensure all individuals are provided with the rights mandated by their governing jurisdiction. Not all of the rights discussed in this Privacy Policy will apply to each individual data subject and may not apply to you depending upon your jurisdiction.

You may benefit from a number of rights in relation to your information that we process. Some rights apply only in certain limited cases, depending on your location. If you would like to manage, change, limit, or delete your personal data, you can do so by contacting us at privacy@hubstaff.com. Upon request, we will provide you with information about whether we hold any of your personal data. In certain cases where we process your information, you may also have a right to restrict or limit the ways in which we use your personal data. In certain circumstances, you also have the right to request the deletion of your personal data, and to obtain a copy of your personal data in an easily accessible format.

To the extent that such rights are mandated by the laws applicable to the individual data subject, such as all data subjects residing in the European Union (“EU”), the following rights may apply:

1. the right to access (GDPR, Article 15);

2. the right to rectification (GDPR, Article16);

3. the right to erasure (GDPR, Article 17);

4. the right to restrict processing (GDPR, Articles 18);

5. the right of object (GDPR, Article 21);

6. the right to data portability (GDPR, Article 20); or

7. the right to lodge a complaint with an appropriate data privacy regulatory authority (GDPR, Article 77).

You may also have the right to make a GDPR complaint to the relevant Supervisory Authority. A list of Supervisory Authorities is available here: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm. If you need further assistance regarding your rights, please contact us using the contact information provided below and we will consider your request in accordance with applicable law. In some cases our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

If we process your information based on our legitimate interests as explained in this policy, or in the public interest, you can object to this processing in certain circumstances. In such cases, we will cease processing your information unless we have compelling legitimate grounds to continue processing or where it is needed for legal reasons. Where we use your data for direct marketing purposes, you can always object using the unsubscribe link in such communications or changing your account settings.

Where you have provided consent to certain data processing, you have the right to withdraw that consent at any time by contacting us at privacy@hubstaff.com. A withdrawal of consent will not affect the validity of our use of your personal data up until the point you have withdrawn your consent.

If you no longer wish to use the Services or receive service-related messages (except for legally required notices), then you may contact us using the information above.

If you use Hubstaff in your capacity as an employee, your employer has direct access to your data. If you are an independent contractor, the person or entity with whom you contract has direct access to your data. In addition, Hubstaff employees may have access to your data for testing or the general improvement of our software, to notify you about changes to our website or any products or services we offer or provide through it, or to fulfill the purpose for which you provided it. See our terms of service at https://hubstaff.com/terms for additional information in this regard.

Access to the information we have collected about you: We provide certain tools and settings within the Services to help you access, correct, delete, or modify your personal data associated with the Services. You may also contact us regarding the information we have collected about you, including regarding the nature and accuracy of the data that has been collected about you, to request an update, modification, or deletion of your information, to opt-out of certain Services uses of your information, or to withdraw any consent you may have granted to us. Please note that if you choose to delete your information or opt-out of the collection and use of your information, you understand that certain features, including but not limited to access to the Services, may no longer be available to you.

Data retention: We will retain your information only for as long as is necessary for the purposes set out in this policy, for as long as an account is active or as needed to provide the Services to you. We will retain and use your information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your information to comply with applicable tax/revenue laws), resolve disputes, enforce our agreements, and as otherwise described in this policy. We also retain log files for internal analysis purposes. These log files are generally retained for a brief period of time, except in cases where they are used for site safety and security, to improve site functionality, or we are legally obligated to retain them for longer time periods. We may delete your personal data from our systems as part of a data retention plan. Following termination or deactivation of a Services Account, we may retain your information and content for a commercially reasonable time for backup, archival, and audit purposes.

Opting-out of communications from us: Users may opt-out of receiving certain communications from us by following the unsubscribe process described in email communication, or by contacting us using the contact information provided above. However, please note you may not opt-out of certain Services-related communications, such as account verification, changes or updates to features of the Services, or technical and security notices.

Do Not Track: We do not currently employ a process for automatically responding to “Do Not Track” (DNT) signals sent by web browsers, mobile devices, or other mechanisms. Per industry standards, third parties may be able to collect information, including personal data, about your online activities over time and across different websites or online services when you use Services. You may opt out of online behavioral ads at https://www.aboutads.info/choices/. You also may limit certain tracking by disabling cookies in your Internet browser.

7. Data security

The security of your personal data is important to us. We take reasonable efforts to secure and protect the privacy, accuracy, and reliability of your information and to protect it from loss, misuse, unauthorized access, disclosure, alteration and destruction. We implement security measures as we deem appropriate and consistent with industry standards. As no data security protocol is impenetrable, we cannot guarantee the security of our systems or databases, nor can we guarantee that personal data we collect about you will not be breached, intercepted, destroyed, accessed, or otherwise disclosed without authorization. Accordingly, any information you transfer to or from Services is provided at your own risk.

Please do your part to help us keep your information secure. Services Account information is protected by a password. It is important that you protect against unauthorized access to your account and information by choosing your password carefully and by keeping your password and computer secure, such as by signing out after using the Services. You are responsible for maintaining the confidentiality of your password and Services Account, and are fully responsible for all activities that occur under your password or Services Account. We specifically reserve the right to terminate your access to the Services and any contract you have with us related to the Services in the event it learns or suspects you have disclosed your Services Account or password information to an unauthorized third party.

We make reasonable efforts to ensure that our other Service Providers have implemented physical, electronic, and procedural security measures to assist with safeguarding your personal data, and to help protect against unauthorized access and disclosure. Only our authorized personnel and our Service Providers who perform legitimate business functions for Hubstaff are authorized to access your personal data. Notwithstanding our efforts, the Internet has inherent security risks. Hubstaff cannot promise, and you should not expect, that your personal data, personal searches, and other communications will always remain secure. You should take care with regard to how you handle and disclose your personal data or any username or password that you are required to use to access services on our websites.

8. Data Protection Responsibilities

Where you act for a company processing Personal Data, or where you provide us the Personal Data of individuals, you are acting as a data controller, and Hubstaff is the data processor. As a data controller, you are responsible for protecting the Personal Data you process and complying with all relevant legal requirements when you use the Services. This includes applicable data protection and privacy laws that govern the ways in which you can use Personal Data. Data controllers are also responsible for protecting Personal Data they provide to their data processors and must have a written agreement in place governing the details of the processing. Hubstaff’s Data Processing Agreement is available at this link.

9. Data integrity

Hubstaff will only process personal data in a way that is compatible with and relevant for the purpose for which it was collected or authorized by you. To the extent necessary for those purposes, Hubstaff will take reasonable steps to ensure that personal data is accurate, complete, current and reliable for its intended use.

Hubstaff Operates from the United States: The United States, European Economic Area (“EEA”) Member States, and other countries all have different laws relating to privacy and data protection. When your information is moved from your home country to another country, the laws and rules that protect your personal data in the country to which your information is transferred may be different from those in the country in which you live. For example, the circumstances in which law enforcement can access personal data may vary from country to country. In particular, if your information is in the United States, it may be accessed by government authorities in accordance with U.S. law.

Please be advised information we collect about you via the Services may be transferred, processed and/or accessed by us in the United States, or another country where we, or our Service Providers operate. Please be aware that the privacy laws and standards in certain countries, including the rights of authorities to access your personal data, may differ from those that apply in the country in which you reside. If you are located outside the United States and choose to allow us to collect information about you, please be aware that we may transfer your personal data to the United States and process and store it there. We will transfer personal data only to those countries to which we are permitted by law to transfer personal data, and we will take steps to ensure that your personal data continues to enjoy appropriate protections.

EU-U.S., UK-U.S. and Swiss-US Data Privacy Framework:

Hubstaff complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Hubstaff has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Hubstaff has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/. Please see Hubstaff’s Data Privacy Framework notice for more information, including details about the rights that EU/UK/Swiss individuals may have under the Framework and how to exercise those rights.

Alternatively, where not relying on the Data Privacy Framework, Hubstaff may utilize the EU’s Standard Contractual Clauses (or similar local variations thereof) to provide an adequate level of protection under EU, UK and/or Swiss law. In the context of an onward transfer of your personal information, Hubstaff remains responsible for the processing of personal information we receive under the DPF Principles and subsequently transfers to a third party acting as an agent on our behalf. As required by law, Hubstaff remains liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless another party is responsible for the event giving rise to the damage. For purposes of enforcing compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Hubstaff is subject to the investigatory and enforcement authority of the US Federal Trade Commission.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Hubstaff commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to the BBB Data Privacy Framework Services, operated by the Council of Better Business Bureaus, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers for more information or to file a complaint. The BBB Data Privacy Framework Services are provided at no cost to you.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Hubstaff commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

Under certain conditions, you may invoke binding arbitration for complaints regarding EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms. To understand when such terms apply, please see Annex I of the DPF here: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.

10. Additional Notice for California Residents

This Additional Notice to our Privacy Policy applies to residents of California only. California law requires certain businesses that determine the purposes and means of processing personal data to make disclosures and offer data rights to consumers/individuals whose personal data the business collects. Accordingly, Hubstaff offers the disclosures below to our customers and their representatives (“Customers”) who utilize our digital platform (“Digital Platform”), and to visitors (“Visitors”) to our website, https://hubstaff.com (our “Website”). These disclosures and rights may not apply to data not processed by Hubstaff or for which Hubstaff does not determine the purposes and means of processing. For example, this Additional Notice is not addressed to employees of our Customers whose data may be provided to our Digital Platform. If you are an employee of one of our Customers wishing to know more about our Customers’ privacy practices or wishing to exercise their rights under California law pertaining to such data, please contact the relevant Customer directly.

Collection of Personal Information

We collect personal information as necessary to operate our business, to comply with our legal and regulatory obligations, and to provide our Website and Digital Platform to you. Within the last 12 months, we have collected the following types of personal information about Customers and Visitors:

• Identifiers such as a real name, alias, unique personal identifier, online identifier, Internet
  Protocol address, email address, account name.

• Personal information categories such as name.

• Internet or other similar network activity including browsing history, search history, information on a consumer’s interaction with websites, application.

• We may use physical address or IP addresses to generate aggregate geo-location data about our Visitors and/or Customers.

To learn more about the information we collect, please see our Privacy Policy.

How Personal Information Is Collected and Used

We collect personal information directly from the following sources:

• Directly from you. For example, when Customers contact us in the course of the business relationship, set up an account, or purchase our products or services, or when Visitors submit inquiries or fill out a survey.

• Indirectly from you. For example, from observing your actions on our Website and Digital Platform.

• From third parties. For example, from analytics providers and service providers.

We may use your information for the following business purposes:

• Provide our Digital Platform and Website.

• Facilitate the business relationship with our Customers, such as providing account access and facilitating communications.

• Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes.

• Debugging to identify and repair errors that impair existing intended functionality.

• Performing services on behalf of our Customers, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying Customer information, providing analytic services, providing storage, or providing similar services on behalf of the business.

• Supporting our advertising and marketing services as permitted by law.

• Undertaking internal research for technological development and analytics.

• To improve, upgrade, or enhance our products and services.

To understand more about the purposes for which we collect personal information and the sources of our collection, see the Privacy Policy.

Disclosure of Your Personal Information

The table below identifies how in the past 12 months we have disclosed information collected about individuals.

We may also share information to comply with law, to protect the interests of ourselves or others, and in connection with a merger, sale, or acquisition of all or part of our business. To learn more about how we share data, please see additional detail as set forth in the Privacy Policy.

Sales of Personal Information

In the last 12 months we have disclosed your personal information to third parties in connection with operating our Website and Digital Platform, including network identifiers and inferences about your preferences to third party analytics providers. Such disclosure for analytics and marketing / advertising purposes may constitute a “sale” of your personal information under California law. We do not sell the personal information of individuals who we know to be under 16 years of age. You can exercise the right to opt-out of the sale or sharing of your personal information by clicking this link: Do Not Sell or Share My Personal Information, or by clicking the same link posted on our internet home page.

Data Storage and Retention

We will store your personal information until the initial purpose for which we collected such data has been satisfied, including the purpose described in our Privacy Policy. If you consent to a new or additional purpose for retaining your data, your personal information may be stored for longer. We have implemented measures designed to secure your personal information against unauthorized use, loss, destruction or alteration. We cannot guarantee the security of your personal information.

We retain your data according to a set retention schedule, which can be viewed here: https://support.hubstaff.com/data-retention-comparison/.

Your California Privacy Rights

If you are a California resident, you have the following rights regarding your personal information:

1. Right to Access. You have the right to access the personal information we have collected about you. If requested, we will provide you with a copy of the personal information we have collected.

2. Right to Know. You have the right to request that we disclose the following about your personal information in the preceding 12 months:

   • The categories of personal information we collected;

   • The categories of sources from which we collected your personal information;

   • The business or commercial purposes for collecting, selling, or sharing your personal information;

   • The categories of third parties to whom we disclose your personal information; and

   • The specific pieces of personal information we have collected about you.

3. Right to Delete. You have the right to request that we delete your personal information. Upon verifying your identity and the validity of your request, we will delete your personal information from our records and instruct our service providers, affiliates, or third parties to delete your information as required by law. We may deny your deletion request if retaining the information is permitted under law.

4. Right to Correct. You have the right to correct inaccurate personal information that we maintain about you. Upon verifying your identity and the validity of your request, we will use reasonable efforts to correct your personal information as directed. In certain circumstances, we may not be able to satisfy this request depending on the nature of the personal information and purposes for maintaining it.

5. Right to Opt-out of Selling/Sharing. You have the right to direct us to not sell your personal information at any time. To exercise the right to opt out, you may submit a request to use by visiting our Do Not Sell or Share My Personal Information page. Once you make an opt-out request, we will wait at least twelve months before asking you to reauthorize personal information sales. You do not need to create an account with us to exercise your opt out rights. Your right to opt out of ‘sharing’ information is a specific right to prevent the provision of your personal information to a third party for them to target certain advertising to you.

We may not discriminate against you for exercising any of your rights under the CCPA. This means that we may not deny you services or charge you different prices or rates for services or provide you with a different level or quality of services (or suggest that we will do so), in response to a request made under the CCPA. However, we may charge different prices or rates, or provide a different level or quality of services, where that difference is reasonably related to the value provided to us by your personal information.

You may designate an authorized agent to make a request to know, request to correct, or request to delete. An agent may be an individual or a business entity. To designate an authorized agent, you must provide the agent with written permission to submit the request. We may still require you to verify your identity directly (subject to certain exceptions). We may refuse a request if the agent does not provide adequate proof of their authorization.

Our site recognizes automated opt-out signals in a frictionless manner; in particular, our site responds to the Global Privacy Control. You can configure and use these by clicking here to review your privacy options.

How to Exercise These Rights

You may request to exercise the foregoing rights by:

• Emailing us at privacy@hubstaff.com

• Calling our toll-free telephone number at (800) 932-5330

Please note that we may take steps to verify your identity before granting you access to information or acting on your request to exercise your rights. In connection with such verification, we may ask you to provide your name, email address, mailing address and mobile number, and we may utilize email to send verification codes. We may limit our response to your exercise of the above rights as permitted by law.

“Shine the Light”

Under California Civil Code Section 1798.83 (known as the “Shine the Light” law), our users and customers who are residents of California may request certain information about our disclosure of personal data during the prior calendar year to third parties for their direct marketing purposes. To make such a request, please write to us at privacy@hubstaff.com with “Request for California Privacy Information” on the subject line and in the body of your message. We will comply with your request within thirty (30) days or as otherwise required by the statute. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing will be included in our response.

Contact Us

If you have any questions or concerns about privacy at Hubstaff, please contact us by email at privacy@hubstaff.com.

11. Nevada Disclosures

If you are a Nevada resident who wishes to exercise your sale opt-out rights under Nevada Revised Statutes Chapter 603A, you may submit a request to the contact information listed at the end of this Privacy Policy. However, please know we do not currently sell Personally Identifiable Information triggering that statute’s opt-out requirements.

12. Children and data collection

Hubstaff’s websites are general audience websites. The Services are not directed toward children who are under the age of 18. You may not use the Services if you are under the age of 18. If you are under the age of 18, you should not provide any information on our Services.

We do not knowingly collect Personal Data from children or minors. If Hubstaff or its Service Providers become aware that a child or minor has provided us with Personal Data without parental consent, that information may be deleted from our databases. If you have questions about Personal Data that may have been submitted by a child, please email us at privacy@hubstaff.com.

13. Enforcement

Hubstaff uses a self-assessment approach to assure compliance with this Privacy Policy and periodically verifies that the Privacy Policy is accurate, comprehensive for the information intended to be covered, prominently displayed, completely implemented and accessible and in conformity with the EU and Swiss privacy principles. We encourage interested persons to raise any concerns using the contact information provided and we will investigate and attempt to resolve any complaints or disputes regarding the use and disclosure of Personal Data in accordance with the principles.

If a complaint or dispute cannot be resolved through our internal process, we agree to dispute resolution using (an independent resourced mechanism) as a third party resolution provider.

14. Updates

Hubstaff may update this Privacy Policy from time to time, and you should take the time to review it each time that you visit one of our Services. The most current version of this Privacy Policy will govern our use of your information and will be located at https://hubstaff.com/privacy. You may contact us to obtain prior versions. We will notify you of material changes to this Privacy Policy by posting a notice at the Services or by emailing you notifying you of the changes.