Candidate Privacy Notice
Last updated: July 13, 2026
This Candidate Privacy Notice (this “Notice”) explains how SmartBear Software, Inc. and its affiliates, subsidiaries, and related entities, as applicable, collect, use, disclose, retain, and protect Personal Data about individuals who apply for employment or otherwise participate in our recruitment process (“Candidates”).
This Notice applies to job applicants, prospective Candidates, interview Candidates, referral Candidates, and individuals who participate in recruiting events or talent communities.
Data protection laws in the various jurisdictions that SmartBear has applicants may vary, and SmartBear’s policy is to comply with all applicable local laws. To the extent local law conflicts with or imposes stricter obligations than those set forth herein, local law will control and SmartBear will satisfy those stricter obligations.
Who We Are
Controller: SmartBear Software, Inc.
Address: 450 Artisan Way, 4th Floor, Somerville, MA 02145
Privacy contact: privacy@smartbear.com
Categories of Personal Data SmartBear Collects
We may collect the following categories of Personal Data, depending on the role, location, stage of the recruitment process, and information you choose to provide:
| Category | Examples |
|---|---|
| Identification and contact information | Name, address, email address, phone number, government-issued identification (where required) |
| Application information | Resume or CV, cover letter, employment history, education, qualifications, skills, certifications, portfolio, professional profiles |
| Recruitment and assessment information | Interview notes, assessment results (including behavioral assessments), references, recruiter or hiring manager feedback, compensation expectations, work authorization status |
| Communications information | Emails, messages, call notes, interview scheduling information |
| Background check information | Criminal history, sanctions screening, employment verification, education verification, or other checks where lawful and relevant to the role |
| Sensitive or special category information | Demographic information, disability or accommodation information, veteran status, health information, diversity and inclusion information, or other information protected by law, where collected lawfully |
| Technical and usage information | IP address, device information, browser type, cookies or similar technologies used on our careers website |
| Referral information | Information provided by employees, recruiters, agencies, professional contacts, or other referring parties |
Sources of Personal Data
We may collect Personal Data from:
- You directly, including through applications, interviews, forms, assessments, emails, and recruiting platforms.
- Recruiters, staffing agencies, job boards, referral sources, and professional networking platforms.
- Former employers, references, educational institutions, background check providers, and verification services, where permitted by law.
- Publicly available sources, such as professional profiles or publications.
- Our careers website and related systems.
Use of Personal Data
We may use Candidate Personal Data for the following purposes:
- Receiving, reviewing, and evaluating job applications.
- Communicating with you about your application, interviews, assessments, and potential employment.
- Assessing qualifications, skills, experience, and suitability for a role.
- Scheduling and conducting interviews.
- Conducting reference checks, background checks, and employment eligibility checks, where permitted or required by law.
- Making hiring decisions and preparing employment offer materials.
- Managing our recruiting operations, applicant tracking systems, workforce planning, and talent pipeline.
- Considering you for future opportunities, where permitted by law.
- Providing reasonable accommodations.
- Monitoring and improving our recruitment process, careers website, and Candidate experience.
- Complying with legal, regulatory, immigration, tax, employment, equal opportunity, and recordkeeping obligations.
- Establishing, exercising, or defending legal claims.
- Protecting our rights, security, systems, employees, Candidates, and business operations.
Disclosure of Personal Data
We may disclose Candidate Personal Data to:
- Affiliates, subsidiaries, and related companies.
- Recruiters, hiring managers, interviewers, People and Culture personnel, legal, compliance, security, finance, and IT teams.
- Service providers and vendors, including applicant tracking systems, recruiting platforms, background check providers, assessment providers, scheduling tools, and communication tools.
- Professional advisors, including lawyers, auditors, consultants, and insurers.
- Government authorities, regulators, courts, law enforcement, or other parties where required by law.
- Parties involved in a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction.
- Other parties with your direction or consent.
We require service providers to process Personal Data only as instructed and to protect it appropriately.
International Transfers
We may transfer Candidate Personal Data to countries other than the country where you are located, including countries that may not provide the same level of data protection. Where required, we use appropriate safeguards, such as standard contractual clauses, adequacy mechanisms, or other lawful transfer mechanisms.
We select reliable third parties and processing will be subject to written agreements between SmartBear and the third party processing the data. These agreements specify the rights and obligations of each party and will require that the third party have adequate security measures in place and will only process the Personal Data to perform the services they provide to us and otherwise on our specific written instructions.
Because we operate at a global level, we may need to transfer Personal Data to countries other than the ones in which the information was originally collected.
For job Candidates in the EU, EEA, UK or any other country that has imposed restrictions on cross-border data transfers: We may transfer Personal Data to SmartBear Software, Inc., our parent company in the United States, for management and operational purposes. We rely on European Commission’s Standard Contractual Clauses and the respective UK or Swiss Addendum for transfers of Personal Data between the SmartBear companies, which require all group companies to protect Personal Data they process from the European Economic Area in accordance with EU data protection laws. Our Standard Contractual Clauses can be provided on request.
Legal Bases for Processing
For Candidates in jurisdictions where a legal basis is required, such as the European Economic Area, United Kingdom, or Switzerland, we rely on one or more of the following legal bases:
| Purpose | Legal basis |
|---|---|
| Reviewing your application and communicating with you | Legitimate interests |
| Assessing qualifications and suitability | Legitimate interests |
| Conducting background, reference, or work authorization checks | Legal obligation; legitimate interests; consent where required |
| Providing accommodations | Legal obligation; explicit consent where required |
| Processing diversity, demographic, disability, veteran, or health-related information | Legal obligation; explicit consent; substantial public interest, where applicable |
| Compliance, recordkeeping, and legal claims | Legal obligation; legitimate interests |
| Maintaining security and preventing fraud | Legitimate interests; legal obligation |
Where we rely on legitimate interests, those interests include recruiting qualified Candidates, managing our hiring process, protecting our business, and maintaining accurate recruitment records.
Sensitive Personal Data
As a general rule, during the recruitment process, we try not to collect or process any of the following sensitive information: information that reveals your age, gender, racial or ethnic origin, religious, political or philosophical beliefs or trade union membership; genetic data; biometric data for the purposes of unique identification; or information concerning your health/sex life, and any “special category data” as that term is defined in the EU’s General Data Protection Regulation or other applicable data protection laws.
We may collect sensitive Personal Data only where permitted by law and relevant to the recruitment process. We use sensitive Personal Data only for lawful recruitment, compliance, accommodation, security, or reporting purposes.
Background Checks and References
Where permitted by law and relevant to the role, we may conduct background checks, reference checks, employment verification, education verification, criminal record checks, sanctions screening, or other pre-employment checks. We will provide any separate notices or obtain any consents required by applicable law before conducting these checks.
For Candidates in Poland, background checks are limited to verification of education, professional qualifications, and previous employment history through documents presented by the Candidate; criminal history checks and other types of background checks (such as credit history) are not permitted unless expressly required by law.
Automated Tools and Artificial Intelligence
In connection with recruitment and interviewing, SmartBear may use technology-enabled tools, including tools that leverage artificial intelligence or machine learning, to assist with interview facilitation, note-taking, evaluation support, or skills-related insights. Participation in the use of such tools is voluntary and subject to applicable notice and consent requirements, where required by applicable law.
SmartBear does not use such tools to make automated employment decisions, and any outputs, scores, summaries, or insights generated by these tools are used solely as decision-support information and are reviewed by human decision-makers as part of a broader evaluation process. While the initial screening process of finding suitable Candidates may be automatic, any employment decision will be made by our team.
Retention
We retain Candidate Personal Data only as long as reasonably necessary for the purposes described in this Notice, including to complete recruitment, consider you for future roles, comply with legal and recordkeeping requirements, resolve disputes, and enforce agreements.
If you are accepted for a role at SmartBear, the information collected during the recruitment process will form part of your ongoing employee record and will be processed in accordance with our SmartBear Employee Privacy Policy.
If you are not successful, we will keep your personal information for as long as permitted by applicable laws to allow us to consider you for other suitable openings within SmartBear in the future, unless you request that we delete your application which we will handle in accordance with applicable law.
Your Rights and Choices
The rights described below are not universally available and apply only to the extent required by applicable law based on your location. Depending on your location, you may have rights regarding your Personal Data, including the right to:
- Request access to your Personal Data.
- Request correction of inaccurate information.
- Request deletion of your information.
- Object to or restrict certain processing.
- Request portability of your information.
- Withdraw consent where processing is based on consent.
- Opt-out of certain disclosures, sales, sharing, or targeted advertising, where applicable.
- Limit the use or disclosure of sensitive Personal Data, where applicable.
- Lodge a complaint with a data protection authority or regulator.
To exercise your rights, you may contact us at privacy@smartbear.com or send a copy of your request to the address below. We may need to verify your identity before responding.
California Notice at Collection
This section applies to California residents and supplements the rest of this Notice. We may collect the categories of Personal Data listed in the “Categories of Personal Data SmartBear Collects” section above for the purposes described in the “Use of Personal Data” section above. We retain Personal Data as described in the “Retention” section above.
Sale or sharing: We do not sell or share Candidate Personal Data, including sensitive Personal Data, as those terms are defined under California law.
Sensitive Personal Data: We may use sensitive Personal Data only for recruitment, compliance, accommodation, security, legal, or other permitted business purposes.
California residents may have rights to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive Personal Data, and not be discriminated against for exercising privacy rights.
Additional Disclosures for Candidates in India
This section applies only to Candidates whose personal data is processed under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Where your personal data is subject to the DPDP Act, SmartBear acts as the data fiduciary. We process your personal data for the purposes described in the “Use of Personal Data” section of this Notice, based on your consent or under the legitimate uses permitted by the DPDP Act.
Under the DPDP Act, you have the following rights:
- Right to information about your personal data being processed;
- Right to correction and erasure of your personal data;
- Right to grievance redressal. You may raise grievances by contacting our ethics reporting hotline by phone (Toll-free; US only) at 833-670-7017 or online at smartbear.ethicspoint.com; and
- Right to nominate another individual to exercise your rights in the event of your death or incapacity.
Where we process your personal data based on consent, you may withdraw your consent at any time by contacting us at privacy@smartbear.com. If you have exhausted your grievance redressal opportunities with SmartBear, you may raise your concern to the Data Protection Board of India.
Changes to this Notice
We may update this Notice from time to time. The “Last updated” date above indicates when this Notice was last revised.
How to Contact Us
For questions about this Notice or our privacy practices, contact:
SmartBear Software, Inc.
450 Artisan Way, 4th Floor
Somerville, MA 02145
Email: privacy@smartbear.com