Applicant and Employee Privacy Notice
Effective Date: October 5, 2022
SCOPE
This Privacy Notice applies to personal information of applicants and employees (including contractors) that
Qumulo, Inc. (“Qumulo”) collects and processes in the course of our People Operations, from submission
of an application, throughout the course of an individual’s employment, and following employment
(collectively, the “People Operations”).
The terms “Qumulo,” “we,” “us,” and “our” include Qumulo and our affiliates and subsidiaries. This Privacy
Notice explains the kinds of information we may collect, how we intend to use and share that information,
and how you may be able to opt-out of a use or correct or change such information.
CONTROLLERS
Qumulo is the controller of your personal information, which means we determine and are responsible to
you for how your personal information is used.
PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
Qumulo directly collects personal information from job applicants and current and former employees.
Qumulo may also collect personal information from its applicants and employees as follows:
Communications with Us. We may collect personal information such as personal contact information
when an applicant or employee communicates with us, for example to inquire about employee benefits.
Posting on Intra-Qumulo Sites. Qumulo may offer intra-company accessible sites, pages, messaging
channels, blogs, or forums (“Intra-Qumulo Sites”). Qumulo and other individuals who use the Intra-Qumulo
Sites may collect the information you submit or make available through these sites. If you choose to submit
content to any public area of the Intra-Qumulo Sites, such content will be considered “public” and will not
be subject to the privacy protections set forth herein.
Use of Qumulo Information Technology Systems and Networks. Qumulo may collect certain
information automatically through the course of your employment, such as your Internet protocol (IP)
address, inferred location based on your IP address or activities, device identifiers associated with your
computer or device, mobile carrier and related information, activity logs, and other information about
activities you engage in on Qumulo property, equipment, accounts, systems and networks. Qumulo may
monitor and review employees’ uses of Qumulo equipment, accounts, information technology systems and
networks, including its phone networks, computer networks, including those used to access the Internet,
videoconferencing systems and other company-provided electronic communications tools. Qumulo may
access and review electronic files, messages, and emails sent or stored on its information technology
systems, including accounts, computers and devices provided to employees.
Please note that your activity on company resources, including devices, networks, and systems may be
monitored by the company.
CCTV Footage. Qumulo may monitor its premises using CCTV cameras.
Surveys. From time to time, we may ask you to participate in surveys. If you decide to participate, you may
be asked to provide certain information which may include personal information. All information collected
Rev. 100522from your participation in our surveys is provided by you voluntarily. We may use such information
consistent with this Privacy Notice.
Contests. Occasionally, Qumulo may run contests. We ask those who participate to provide information
relevant to the contest.
Information from Other Sources. We may collect or receive information about you from other sources,
including through third party services and organizations, public sources, and referees you provide to
supplement information provided by you. Where permitted by law, we may also conduct background checks
on you prior to your employment with Qumulo. This supplemental information allows us to verify information
that you have provided to Qumulo.
Miscellaneous Information. We may receive or collect other miscellaneous information (for example,
information you choose to disclose during the interview process, whether in verbal or written form, opinions
generated during the interview process, and information provided to us during performance reviews).
The table in Annex 1 sets out the categories of personal information we collect about you and how we use
that information. The table also lists the legal basis which we rely on to process your personal information.
HOW WE DISCLOSE YOUR INFORMATION
We may share your information as described in this Privacy Notice (e.g., with our third-party service
providers; to comply with legal obligations; to protect and defend our rights and property) or with your
permission.
Vendors, Partners, and Service Providers. We may share any information we receive with vendors,
partners, and service providers. The types of service providers to whom we entrust personal information
include service providers for: (i) provision of IT and related services; and (ii) processing to maintain our
People Operations.
Customers. We may share information we receive with end user customers if there is a legitimate business
purpose, such as sharing employee contact information.
Affiliates and Subsidiaries. Qumulo may share personal information with our affiliates and subsidiaries
for our and our affiliates’ and subsidiaries’ internal business purposes.
Displaying to Other Individuals. When you post content to the Intra-Qumulo Site(s), other individuals may
be able to see some information about you, such as your name and/or picture in addition to the content you
post. We are not responsible for practices of the individuals who view and use your information.
Disclosures to Protect Us or Others. We may access, preserve, and disclose your personal information
if we believe doing so is required or appropriate to: (i) comply with law enforcement or national security
requests and legal process, such as a court order or subpoena; (ii) protect your, our or others’ rights,
property, or safety; (iii) to enforce Qumulo policies and contracts; (iv) to collect amounts owed to us; (v)
when we believe disclosure is necessary or appropriate to prevent financial loss or in connection with an
investigation or prosecution of suspected or actual illegal activity; or (vi) if we, in good faith, believe that
disclosure is otherwise necessary or advisable.
Merger, Sale, or Other Asset Transfers. If we are involved in a merger, acquisition, financing due
diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to
another entity, then your information may be transferred as part of such a transaction as permitted by law
and/or contract.
INTERNATIONAL DATA TRANSFERS
All information collected via or by Qumulo may be transferred, processed, and stored anywhere in the world,
including but not limited to, the United States, in order to carry out our People Operations. In the event of
such a transfer, we ensure that: (i) the personal data is transferred to countries recognized as offering an
equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as standard
Rev. 100522contractual clauses adopted by the European Commission (including additional safeguards as recommended
by the European data Protection Board).
- Adequacy Decisions pursuant to Article 45 of the GDPR: we may transfer personal data about you to
countries that the European Commission has deemed to adequately safeguard personal data.
- Standard Contractual Clauses pursuant to Article 46 of the GDPR: the European Commission has
adopted Standard Contractual Clauses, which provide safeguards for personal data transferred
outside of the EEA. We may use these Standard Contractual Clauses when transferring personal data
from a country in the EEA to a country outside the EEA that has not been deemed to adequately
safeguard personal data. You can request a copy of our Standard Contractual Clauses by contacting
us as set forth in the Contact Us section below.
If you wish to enquire further about these safeguards used, please contact us using the details set out at the
end of these Privacy Disclosures.
CONSENT
We may need your consent for some uses of certain personal information. For instance, in certain
circumstances, we may need your consent to use certain "sensitive" information.
If we need your consent, we will notify you of the personal information we intend to use and how we intend
to use it.
You do not have to give us consent. Where you have given us consent to collect, use or disclose your
personal information in a certain way, you may withdraw your consent at any time. If you wish to withdraw
any consent that you have given us, please contact us using the details below.
Note that we may also process such sensitive data if the processing is necessary for the purposes of
carrying out the obligations and exercising specific rights of the controller or of the data subject as required
by law.
INDIVIDUAL RIGHTS IN PERSONAL INFORMATION
In accordance with applicable law, you may have the following rights with respect to your personal
information:
(a) Right of access. You have the right to obtain:
(i) (ii) (iii) (iv) (v) confirmation of whether or not we are processing your personal information; and
where that is the case
information about the categories of personal information we are processing, the
purposes for which we process your personal information and information as to
how we determine applicable retention periods;
information about the categories of recipients with whom we may share your
personal information;
information on the source of the personal information if we have not obtained that
data from you;
information on the existence of automated decision-making and – if applicable –
the logic involved; and
Rev. 100522(b) (c) (d) (e) (f) (vi) a copy of the personal information we hold about you.
Right of portability. You have the right, in certain circumstances, to receive a copy of the personal
information you have provided to us in a structured, commonly used, machine-readable format that
supports re-use, or to request the transfer of your personal information to another person.
Right to rectification. You have the right to obtain rectification of any inaccurate or – in some cases
– the completion of incomplete personal information we hold about you without undue delay.
Right to erasure. You have the right, in some circumstances, to require us to erase your personal
information without undue delay if the continued processing of that personal information is not
justified, such as where you have withdrawn your consent or where the personal data is no longer
necessary in relation to the purposes for which they were collected or otherwise processed.
Right to restriction. You have the right, in some circumstances, to require us to limit the purposes
for which we process your personal information if the continued processing of the personal
information in this way is not justified, such as where the accuracy of the personal information is
contested by you.
Right to object. You have a right, in some circumstances, to object to any processing based on our
legitimate interests. There may, however, be compelling reasons for continuing to process your
personal information, and we will assess and inform you if that is the case.
For more information on the choices you may have and how to exercise them, please contact us as set
forth below or fill out our Privacy Rights Requests Form available at
https://privacyportal.onetrust.com/webform/59740c49-7a4d-40cc-846a-e946fd833aab/42c6e2c0-58b1-
4c62-b74b-71874f8a2292.
We will process such requests in accordance with applicable laws. To protect your privacy, Qumulo will
take steps to verify your identity before fulfilling your request.
Depending on where you are located, you have the right to provide instructions regarding the retention,
deletion and disclosure of your personal data after your death. In the absence of instructions from you, it is
possible for your heirs to request the disclosure or deletion of your personal data by sending an email to us
as provided under the Contact Us section.
DATA RETENTION
Qumulo retains the personal information we receive as described in this Privacy Notice for as long as
necessary to fulfill the purpose(s) for which it was collected, carry out our People Operations, resolve
disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our
agreements, and comply with applicable laws.
Data collected through the use of CCTV will not be retained for more than (1) month.
SECURITY OF YOUR INFORMATION
We take steps to ensure that your information is treated securely and in accordance with this Privacy Notice.
Unfortunately, we cannot ensure or warrant the security of any information you provide to us. To the fullest
extent permitted by applicable law, we do not accept liability for unauthorized disclosure.
THIRD PARTY WEBSITES/APPLICATIONS.
Rev. 100522Various resources and sites at Qumulo may contain links to third party websites/applications and other
websites/applications may reference or link to Qumulo. These third-party services are not controlled by us.
We encourage our applicants and employees to read the privacy policies of each website and application
with which they interact. We do not endorse, screen or approve, and are not responsible for the privacy
practices or content of such other websites or applications. Visiting these other websites or applications is
at your own risk.
SUPERVISORY AUTHORITY
If you are an applicant or employee located in the European Economic Area, you have the right to lodge a
complaint with a supervisory authority if you believe our processing of your personal information violates
applicable law.
CHANGES TO OUR PRIVACY NOTICE AND PRACTICES
We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes
to this Privacy Notice, we will notify you by email to your registered email address, by prominent posting on
our online Services, or through other appropriate communication channels. All changes shall be effective from
the date of publication unless otherwise provided in the notification.
CONTACT US
If you have any questions about our privacy practices or this Privacy Notice, please contact Qumulo by
email at dataprivacyoffice@qumulo.com.