We Process information about you in the course of our business relationship with you and in connection with career opportunities with Index Exchange. The categories of information we may Process about you include:
- Contact information: name, mailing and billing addresses, email address, telephone number, company name, job title, department or job role, and other relevant contact information;
- Website usage: online usage information when you browse our Website, including your IP address, device ID, browser type, operating system, cookie information, and traffic data;
- Physical location and security: surveillance camera footage collected at our office locations;
- Employment and education: cover letter, résumé, CV, work experience, relevant experience, educational background, and information from professional licensing and certification bodies;
- Government issued ID or similar ID: citizenship, residency, and work permit status;
- References: references from previous employers or other sources;
- Background checks: information related to a background check;
- Publicly available information: information you’ve made public, such as a public profile on a career or networking site;
- Assessments: mandatory assessment information, such as interviews and skills tests; and
- Voluntary information and sensitive voluntary information (collectively, Voluntary Information): information you choose to provide voluntarily, such as a candidate experience feedback survey. Sensitive voluntary information may include information about your racial or ethnic origin, age, gender, sexual orientation, disability, and other relevant sensitive voluntary information. We will clearly indicate which information is optional and which is required. Providing Voluntary Information is always optional, and it will not affect your consideration for a career opportunity if you choose not to provide it.
We Process your Personal Data for business-related activities (collectively, Corporate Purposes) when it is permitted by law and supported by a valid legal justification (Legal Basis). We rely on the Legal Basis of performance of a contract to Process Personal Data for Corporate Purposes when:
- you visit our Website or one of our physical offices;
- you register on the Index Exchange client user interface;
- you attend an Index Exchange sponsored event;
- you participate in a business relationship with Index Exchange. For example, negotiating your business relationship with us, providing responses to our company surveys, etc.; and
- we service accounts, respond to inquiries relates to sales or technical support requests, and for billing purposes.
We rely on the Legal Basis of legitimate interests to Process Personal Data for Corporate Purposes, such as to:
- operate and troubleshoot our Website. We may also analyze your use of our Website, such as with the use of cookies. To learn more about our use of cookies, please review Website and Corporate Cookie Notice.
- send you commercial communications, when the legislation allows us to do so based on our legitimate interest. Otherwise, we will request your consent.
- ask for your feedback about our services or about us.
We Process your Personal Data for career-related activities (collectively, Career Purposes) when we have a Legal Basis for such Processing. We rely on the Legal Basis of legitimate interests to Process Personal Data for Career Purposes, such as to:
- review and process your application;
- assess your skills, qualifications, and suitability; and
- to contact you. For example, we may contact you for a current or future opportunity, to schedule interviews, and otherwise communicate with you relating to your application;
We rely on the Legal Basis of legal obligations to Process Personal Data for Career Purposes, such as to conduct and review references, background checks, and other activities as legally required. For example, if you are offered a role, we use information to verify information you or others provide to complete background checks, verify eligibility to work in the country you applied for a role in, or check your references.
We rely on the Legal Basis of consent to Process Personal Data for other Career Purposes. For example, if you decide to provide us with Voluntary Information, we may use it to assess whether we are attracting a diverse workforce.
We may share Personal Data in the following circumstances:
- Subsidiaries: we share information with our subsidiaries for the Corporate and Career Purposes, and they are bound by this Policy;
- Vendors: we may share Personal Data with vendors who support our business activities such as email management, customer relationship management, event management, background checks, and recruiting. We ensure that our vendors have appropriate privacy and security measures to protect your information;
- Business transfers: we may transfer Personal Data as part of or in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change;
- Legal requirements: we may share Personal Data when we reasonably believe it is required by law, such as for a subpoena or other legal process, including to meet national security or law enforcement requirements;
- With your consent: we may disclose Personal Data to third parties with your prior consent; and
- Other sharing permitted by law: we may disclose Personal Data in good faith when necessary to protect our rights, your safety or the safety of others, or to investigate fraud.
We do not engage in the sale of your information to third parties for the Corporate and Career Purposes described in this Policy.
We may transfer your Personal Data internationally to any of our office locations in compliance with applicable data protection and privacy laws. When we transfer Personal Data outside of the European Economic Area, UK, or Switzerland we ensure that appropriate legal protections are in place. These protections may include a transfer mechanism such as the Standard Contractual Clauses approved by the European Commission. For example, as part of the recruitment process, your information may be transferred to a member of our talent team located in another country. In the event of any conflict between the terms of this Policy and such transfer mechanism, the terms of the transfer mechanism will govern.
We retain Personal Data only for as long as necessary to fulfill the purposes described in this Policy or as required to meet legal or regulatory requirements. At your request, we will delete your Personal Data unless we are required to retain it to meet our legal or regulatory obligations. We may also create and retain anonymized information, and continue to use this information in accordance with this Policy.
To learn more about your privacy rights and how you can exercise them, such as your right to access, correct, erase, limit, and object to the processing of your Personal Data, please visit Your privacy rights and how to exercise them.
We understand that the security, integrity, and confidentiality of Personal Data is a critical issue and we are committed to safeguarding your Personal Data. We have implemented a comprehensive security program that includes technical, administrative, and physical security measures to protect your information from unauthorized access, disclosure, use, and modification. Such measures include but are not limited to: encryption, controls that limit the access of your data, both technically and at our physical data center locations, and also by enabling information security practices such as employee training on the safe handling of Personal Data. We regularly review our security policies and procedures to ensure the protection of your information. Please keep in mind that, despite our best efforts, no security measures are perfect or impenetrable.
We may update this Policy from time to time to accommodate new technologies, industry practices, regulatory requirements, or for other purposes. The date at the top of this Policy reflects the most recent changes made. If any changes to this Policy are significant, we may take additional measures to inform you, as required by applicable data protection and privacy laws. We encourage you to review this Policy for the latest information on our privacy practices and to contact us if you have any questions or concerns.
Privacy team at Index Exchange
If you have any questions, concerns, or complaints about the above or our privacy practices, please contact us at privacy@indexexchange.com or at:
Attn: Index Exchange c/o Privacy
8 Spadina Avenue, Suite 2600, Toronto, Ontario
M5V0S8 Canada
Data Protection Officer
You can also contact our DPO at gdpr@legalarmy.net or at:
Attn: Index Exchange Data Protection Officer
Legal Army, S.L., B88103700
Calle Princesa 31, Piso 5, Puerta A1, Madrid, Spain, 28008
Data Controller
The Data Controller, as defined under applicable data protection and privacy laws, for the Processing of your Personal Data related to Career Purposes depends on the location of the job posting you applied to. The following information provides the name of the Data Controller for each location:
Australia – Index Exchange Australia PTY LTD
Canada – Index Exchange Inc.
France – Index Exchange France
Germany – Index Exchange Germany GmbH
India – Index Advertising Technology Services Private Limited
Italy – Index Exchange Italy S.R.L.
Japan – Index Exchange Japan KK
Singapore – Index Exchange Singapore PTE. LTD.
Spain – Index Exchange France – Spain RO
United Kingdom – Index Exchange Limited
United States of America – Index Exchange USA, LLC