Privacy Notice for Staff and Job Applicants

1. Introduction

Homeless Alliance ("Homeless Alliance", "we" or "us") has issued this Privacy Notice (this "Notice") to describe how we handle Personal Data that we collect and process about our staff members and job applicants (collectively referred to as "you") applying for a job at or working for Homeless Alliance in the United States. The term "staff member" includes those who work on a permanent and non-permanent basis, including contingent workers, temporary workers, and interns. This categorization is for convenience and does not demonstrate any particular employee, worker, or other status.

We respect the privacy rights of individuals and are committed to handling Personal Data responsibly and in accordance with applicable law. This Notice sets out the Personal Data that we collect and process about you, the purposes of the processing, and the rights that you have in connection with it.

Please take the time to read and understand this Notice, which should be read in conjunction with our other corporate policies and procedures.

If you have any comments or questions about this Notice, please contact us at the contact details below.

2. Types of Personal Data we collect

In the course of your employment at Homeless Alliance, or when making an application for employment, we may process Personal Data about you and your dependents, beneficiaries, and other individuals whose Personal Data has been provided to us.

We use the term "Personal Data" (also called "personal information" or "personally identifiable information”) to refer to information that reasonably identifies, relates to, describes, or can be associated with you. Data that has been de–identified, anonymized, or aggregated, or that otherwise cannot reasonably be related back to a specific person is not considered Personal Data. The precise definition of Personal Data may vary depending on your state, province, or country of residence, but we take the same approach to protecting your privacy.

The types of Personal Data we may process include, but are not limited to:

• Identification data – such as your name, gender, photograph, date of birth.
• Contact details – such as home address, telephone number, email addresses, emergency contact details.
• Employment details – such as job title/position, office location, employment contract, performance and disciplinary records, grievance procedures, sickness/time-off records.
• Background information – such as academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law).
• Government identifiers – such as government issued ID/passport, immigration/visa status, social security or national insurance numbers.
• Information on your spouse/partner and/or dependents – such as your marital status, identification and contact data about them, and information relevant to any Homeless Alliance benefits extended to such people.
• Financial information – such as bank details, tax information, withholdings, salary, benefits, expenses.
• IT information – information required to provide access to company IT systems and networks (and information collected by / through those systems) such as IP addresses, log files and login information.

We may also process Sensitive Personal Data relating to you (and your spouse/partner and/or dependents). Sensitive Personal Data includes any information that reveals your racial or ethnic origin, religious, political or philosophical beliefs, sexual orientation, trade union membership, criminal convictions, genetic data, biometric data for the purposes of unique identification, information about your health ("Sensitive Personal Data") In the United States, Sensitive Personal Data also includes government identifiers (including social security, driver's license, state identification card, or passport number), citizenship or immigration status, and precise geolocation data. Generally, we try not to collect or process any Sensitive Personal Data about you, unless authorized by law or where necessary to comply with applicable laws or to provide benefits. We do not sell Sensitive Personal Data collected under this Notice.

However, in some circumstances, we may need to collect, or request on a voluntary disclosure basis, some Sensitive Personal Data for legitimate employment-related purposes. For example, information about your racial/ethnic origin, gender, and/or disabilities for the purposes of equal opportunities (on the basis that it is in the public interest and in accordance with applicable law), monitoring, or to comply with anti-discrimination laws and for government reporting obligations. Further, we may process information about your physical or mental condition to provide work-related accommodations, health and insurance benefits to you and your dependents, or to manage absences from work.

3. Sources of Personal Data

Usually, you will have provided the information we hold about you, but there may be situations where we collect Personal Data or Sensitive Personal Data from other sources. For example, we may collect the following:

• Certain background and other information from recruitment agencies, academic institutions, background checking agencies, and other third parties during your recruitment.
• Certain information on your performance, conduct, or other information relevant to formal internal procedures (e.g., disciplinary or whistleblowing procedures) from customers or other organizations you routinely work with.
• Information on your training and development from external training partners and information about your experience and impressions of Homeless Alliance through external survey providers.
• Information from your doctor or other specialist medical adviser about your health, including your fitness, related to your ability to carry out your duties and/or any accommodations or adjustments to be considered.
• Information on accidents or incidents from Homeless Alliance’s insurance brokers, insurers, and their appointed agents, where they are involved.
• Information on tax payable from local tax authorities and Homeless Alliance’s appointed payroll agents and tax/financial advisers.
• Information collected through Homeless Alliance’s IT systems and other devices as set out above in Section 2.
• Information from the relevant benefit provider or its appointed agent about your entitlement to participate in, or receive payments or benefits from, any insurance or retirement planner provided by Homeless Alliance.
• Information from publicly available sources (e.g., news sources and/or from social media platforms) in connection with any investigation or formal procedure concerning the same (for instance, for the investigation of an allegation that a staff member has breached our rules on social media use or conduct generally).

4. Purposes for processing Personal Data

4.1 Recruitment purposes

If you are applying for a role at Homeless Alliance, then we collect and use your Personal Data primarily for recruitment purposes – in particular, to determine your qualifications for employment and to reach a hiring decision. This includes assessing your skills, qualifications, and background for a particular role, verifying your information, carrying out reference checks or background checks (where applicable), and to generally manage the hiring process and communicate with you about it.

If you are accepted for a role at Homeless Alliance, the information collected during the recruitment process will form part of your ongoing staff member record.

If you are not successful, we may retain your application information for internal reporting, and to allow us to consider you for other suitable openings within Homeless Alliance in the future.

4.2 Employment or work-related purposes

Once you become a staff member at the Homeless Alliance, we collect and use your Personal Data for the purpose of managing our employment or working relationship with you – for example, your employment records and contract information if you have a contract (so we can manage our employment relationship with you), your bank account and salary details (so we can pay you), and details of your spouse and dependents (for emergency contact and benefits purposes).

We process our staff members' Personal Data through a human resources system ("HR System"), which provides tools that help us to administer HR and staff member compensation and benefits, and which allows staff members to manage their own Personal Data in some cases.

4.3 The Homeless Alliance employee directory

We maintain an employee directory of staff members which contain your professional contact details (such as your name, location, photo, job title and contact details). This information will be available to everyone in the Homeless Alliance employee group of companies to facilitate cooperation, communication, and teamwork.

4.4 Other legitimate business purposes

We may also collect and use Personal Data when it is necessary for other legitimate purposes, such as:

• to help us conduct our business more effectively and efficiently – for example, for general HR resourcing, reporting or analytics, IT security/management, business continuity purposes, accounting purposes, or financial planning.
• to investigate violations of law or breaches of our own internal policies, and more generally to protect the rights and interests of Homeless Alliance employees, applicants, and others. For instance, we may monitor your browsing or communications activity or location when using our devices or systems, if we suspect that you have been involved in phishing scams, fraudulent activity, or activities in competition with or inconsistent with your work for Homeless Alliance.
• to help secure our networks and systems from unauthorized access, scams, and malicious code. For instance, we may monitor and review electronic mail communications sent or received using Homeless Alliance issued devices or accounts, or stored on or using such a device or account. We may also monitor and record each website visit, each chat session, online post, e-mail message, and each file transfer into and out of our systems and networks. Homeless Alliance may monitor this activity at any time, and, to the extent permitted by laws, users of our networks and systems should not expect privacy when using these systems and devices.
• to foster diversity, inclusion, and a welcoming work culture.

Homeless Alliance also uses video cameras and recording equipment for its premises, offices, and facilities, and stores information captured by this equipment, to secure its networks, systems, and property, and may monitor access and use of its systems and facilities using this equipment.

Homeless Alliance may also request or require you to enable your device used for work, whether personal or issued by Homeless Alliance, to recognize facial or fingerprint IDs. Your biometric information will be stored on the device itself, and Homeless Alliance will never transfer this data to its servers or to any third party. With respect to your personal device, this means that Homeless Alliance will never collect or possess your biometric information. For company–issued devices, we will only store biometric information on the device itself and only on the basis of your explicit consent, and only for the period of time that such device is issued to you. Homeless Alliance will adhere to any obligation it has under law to notify and bargain with the applicable bargaining representative before imposing such a requirement on represented employees.

4.5 Law-related and other purposes

We also may retain and use your Personal Data where we consider it necessary for complying with laws and regulations, including collecting and disclosing staff member Personal Data as required by law (e.g., for tax, health and safety, anti-discrimination, and other employment laws), under judicial authorization, to protect your vital interests (or those of another person), or to exercise or defend the legal rights of the Homeless Alliance.

5. Who we share your Personal Data with

We take care to allow access to Personal Data only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate business purpose or other lawful ground for accessing it. Whenever we permit a third party to access Personal Data, we will implement appropriate measures to ensure the information is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

5.1 Transfers to other group companies

As mentioned above, we will share your Personal Data with select staff to administer human resources, staff member compensation and benefit level on the HR System, as well as for other legitimate business purposes such as IT services/security, tax and accounting, and general business management.

5.2 Transfers to third party service providers

In addition, we make certain Personal Data available to third parties who provide services to us. We do so on a "need to know basis" and in accordance with applicable data privacy laws.

For example, some of this information will be made available to:

• our benefit/reward plans service providers (including retirement plan and medical insurance providers)
• service providers who provide us with payroll, tax and expense administration support services
• providers of our HR Platform, including our recruitment platform
• service providers who provide support and maintain our IT, security, and communications infrastructure (including for data storage purposes), and/or provide business continuity services
• service providers who assist in the coordination and provision of relocation, travel and/or travel permit services (in connection with work-related travel)
• service providers who provide services in relation to staff training and/or qualifications and staff surveys
• auditors, advisors, legal representatives, and similar agents in connection with the advisory services they provide to us for legitimate business purposes and under a contractual prohibition of using the Personal Data for any other purpose.

5.3 Transfers to other third parties

We may also disclose Personal Data to third parties on other lawful grounds, including:

• Where you have provided your consent
• To comply with our legal obligations, including where necessary to abide by law, regulation, or contract, or to respond to a court order, administrative or judicial process, including, but not limited to, a subpoena, government audit or search warrant
• In response to lawful requests by public authorities (including for tax, immigration, health and safety, national security or law enforcement purposes)
• As necessary to establish, exercise or defend against potential, threatened or actual legal claims
• Where necessary to protect your vital interests or those of another person
• In connection with the sale, assignment or other transfer of all or part of our business.

We do not sell the Personal Data we collect from and about you as described in Sections 2-4.

6. Data retention periods

Personal Data will be stored in accordance with applicable laws and kept as long as Homeless Alliance has an ongoing legitimate business need to carry out the purposes described in this Notice or as otherwise required by applicable law. Generally this means your Personal Data will be retained until the end or your employment, employment application, or work relationship with us plus a reasonable period of time thereafter to respond to employment or work-related inquiries, comply with regulatory obligations, or to deal with any legal matters (e.g. judicial or disciplinary actions), document the proper deductions during and on termination of your employment or work relationship (e.g. to tax authorities), or to provide you with ongoing benefits.

7. Updates to this Notice

This Notice may be updated periodically to reflect changes in our privacy practices. In such cases, if we make a material change, we will inform you, for example, on our intranet or by company-wide email. We encourage you to check back periodically to ensure you are aware of the most recent version of this Notice. Please note that Homeless Alliance does not discriminate against those who exercise their rights under applicable data protection laws.

8. Contact details

Please address any questions or requests relating to this Notice to aburns@homelessalliance.org or alternatively, you can raise any concerns with your supervisor. If you have disabilities, you may contact aburns@homelessalliance.org for additional assistance.