FAQ: Indeed’s Approach to Privacy
Please be advised that this FAQ is for your convenience only. It is not an exhaustive explanation or legal advice, and does not supplement or replace the applicable Terms of Service, which constitute a legally binding agreement between you and Indeed. We advise to read applicable terms in full.
- How does Indeed view privacy?
- How does Indeed process user data?
- How does Indeed share user data with its affiliates?
- What is the GDPR?
- What is Indeed doing to comply with GDPR?
- What is the CCPA?
- What is Indeed doing to comply with the CCPA?
- Does Indeed transfer data in any way that may be a “sale” under the CCPA?
- What is the LGPD?
- What is Indeed doing to comply with the LGPD?
- How does Indeed manage transfers of personal data from Europe?
- How does the recent court judgment on EU-US Privacy Shield affect Indeed?
- What information does Indeed transfer to third parties?
- What information is shared with third parties when the Indeed App is installed?
- What is the conversion tracker?
- How do individuals make a personal data access request?
- How do individuals make a personal data deletion request?
- How can individuals avail of the other rights provided under GDPR?
- How do I unsubscribe from any marketing messages from Indeed?
- How long does Indeed retain personal data?
- What is the difference between closing an account and deleting my personal information?
- What security measures are adopted by Indeed?
- Does the GDPR impact my current use of Indeed Resume?
- What is a private resume?
- What is a public resume?
- How do I change my resume privacy settings?
- What are resume review services?
- Does Indeed comply with international privacy rules?
- Where is Indeed’s main establishment for GDPR purposes?
- What has Indeed done from a privacy perspective to prepare for Brexit?
How does Indeed view privacy?
Indeed values each of its users’ privacy. We’ve invested significant resources into building a global privacy framework that bakes privacy-by-design into our product development lifecycle and affords all of our users the same rights to access and delete their personal data.
How does Indeed process user data?
How does Indeed share user data with its affiliates?
- help the job search and recruitment process by connecting more job seekers with more job listings and employers;
- improve our services to you; and
- facilitate better security for users.
What is the GDPR?
On May 25, 2018, the European Union (EU) introduced the General Data Protection Regulation (GDPR) . The GDPR established a comprehensive framework for protecting individual’s personal data by defining individual rights and the obligations for businesses around transparency, security and accountability in all processing of personal data.
What is Indeed doing to comply with GDPR?
The GDPR introduced stronger rights and protections for individuals, and created new obligations for businesses in terms of how they process individuals’ personal data. We are excited about doing what is best for our users, and have introduced changes in accordance with the GDPR and its principles.
Indeed also employs applicable privacy principles, and has introduced certain changes to support additional user rights and satisfy all of our obligations. Some examples of those changes are set out below.
- We will continue to increase transparency and communication with our users to provide you with as clear an understanding as possible about how your personal data is processed.
- We will facilitate the rights of individuals introduced by GDPR, including the rights of individuals to access and/or delete their personal data upon request.
- Those rights are available to all of Indeed’s users on a global basis.
- We will remain dedicated to the approach of “privacy by design and default” through the consistent application of the privacy principles in the GDPR, and the adoption of a privacy-friendly approach in how we build and operate our products and services.
What is the CCPA?
On January 1, 2020, the California legislature introduced the California Consumer Privacy Act (CCPA). The CCPA is a first-of-its-kind privacy framework in the United States (US), delivering a new standard of transparency for businesses collecting California residents’ personal data. Among other things, the CCPA offers California residents new consumer rights around accessing and deleting their personal data collected by businesses, and redefines how businesses must account for certain transfers of California residents’ personal data.
What is Indeed doing to comply with the CCPA?
Indeed has taken a number of measures to satisfy this new law, and other laws, by building on Indeed’s existing privacy framework. A few examples include:
- launching a new Privacy Center, helping users further understand the relationships between Indeed and its affiliated entities and brands;
- expanding Indeed’s consumer rights request infrastructure with a new request form and toll-free telephone number for submitting requests, and enhanced data mapping; and
- integrating new links on Indeed’s Site to reflect the CCPA’s approach to defining and regulating the “sale” of users’ data.
Does Indeed transfer data in any way that may be a “sale” under the CCPA?
Please see our explanation here.
What is the LGPD?
The LGPD (Lei Geral de Proteção de Dados, “LGPD”) is a Brazilian privacy law that is designed to regulate the processing of personal information by providing a framework for businesses to follow. The law is applicable to data that is collected or processed within Brazil or the data in question is processed for the purpose of offering goods or services to individuals in Brazil.
What is Indeed doing to comply with the LGPD?
Indeed takes a global approach to protect the privacy of our users and the rights they are afforded by laws such as the LGPD. Indeed and its associated sites provide an accessible way for our users to avail of the rights they are afforded by the LGPD, including the rights to access and delete personal information. Indeed has also taken measures to comply with the other requirements of the LGPD such as appointing a DPO (Data Protection Officer), ensuring proper transparency, and more.
How does Indeed manage transfers of personal data from Europe?
Indeed helps people get jobs using a system designed and developed in the United States. So helping people get the jobs they want inevitably involves the transfer of our users’ personal data from the EU and Switzerland to the US and to other countries. Indeed uses various mandated legal mechanisms to ensure that adequate protections are applied to such personal data when it is transferred outside the EU.
Where necessary, Indeed relies on the use of data transfer and processing agreements that employ both the European Commission’s standard contractual clauses and the protections provided for under Chapter V (and Article 28, where appropriate) of the GDPR. This incorporates EU data protection requirements to ensure adequate protection of such personal data transfers.
How does the recent court judgment on EU-US Privacy Shield affect Indeed?
Indeed takes the privacy of our users very seriously. This includes ensuring there are adequate protections in place with respect to transfers of our European users’ personal data to the United States, which was the focus of the recent court judgment.
In order to do this Indeed has employed the overlapping protections of both the European Commission’s standard contractual clauses, and the EU-US and Swiss-US Privacy Shield frameworks, to govern such transfers. In the wake of the court judgment those transfers continue to be subject to European Commission standard contractual clauses, which the court confirmed remain a valid transfer method.
What information does Indeed transfer to third parties?
We do this for a number of reasons, for example: to improve our services to you; to maintain quality and protect users; to facilitate payments (where applicable); to permit user log-in through third party accounts; or to understand and optimize our users’ customer journey.
What information is shared with third parties when the Indeed App is installed?
In order to provide you with certain services and support ad attribution, limited user data may be shared with certain service providers when you install, download or use the Indeed App. This may include your IP address or other unique identifier, and event data related to the installation of the Indeed App.
This may be done for a variety of purposes, including facilitating user log-in through third party accounts. It may also assist Indeed to understand and optimize our users’ complete customer journey by helping us: (i) understand how users arrive to Indeed; (ii) better measure the performance of our ads; and (iii) understand where a user has accessed Indeed through different devices.
What is the conversion tracker?
Indeed may provide an employer with code for a Conversion Tracker to place on its website that pings the job seeker web beacon and tracks whenever a job seeker has applied to a job on that employer’s website. This Conversion Tracker will attribute an application to Indeed any time the job seeker started their search on Indeed, despite any intervening activity, and a conversion count will be displayed on the employer dashboard. Data may be shared from the employer to Indeed for the purposes of displaying unique applications. The Conversion Tracker is simply a counter that notifies Indeed that a job seeker has applied, and also has the ability to count applications across devices if a job seeker is logged in to the employer’s website.
How do individuals make a personal data access request?
How do individuals make a personal data deletion request?
How can individuals avail of the other rights provided under GDPR?
How do I unsubscribe from any marketing messages from Indeed?
If you wish to opt out of a particular marketing email from Indeed, you may do so by clicking “unsubscribe from this email” (or an equivalent action) where applicable. Please note that this will only opt you out of that particular marketing message.
If you wish to adjust all your job alerts, you can click on “manage my subscriptions” (or an equivalent action) to adjust your subscriptions. You can also access and adjust your subscriptions (for job alerts, recommended jobs, and other notifications) from your account dashboard, or contact Indeed Customer Support to do so.
In addition, you may opt out of all marketing messages or withdraw your consent from any consent-based processing by sending an email to privacy-dept @ indeed.com (remove spaces when sending email). In your message, please detail which activities from which you wish to opt out or withdraw your consent. We will comply with your request as soon as reasonably practicable, and in accordance with applicable laws.
Finally, please note that we may still send other messages to you, such as administrative messages.
How long does Indeed retain personal data?
What is the difference between closing an account and deleting my personal information?
Job seekers may close their account or permanently delete their account, depending on whether they wish to continue using their email address. When you close an account you are able to maintain use of your email address, but your data will be removed from the account. Please note that some data may be retained in Indeed’s systems, subject to the retention periods outlined above. Permanently deleting an account removes data from both the account and Indeed’s systems, but due to Indeed’s system set up, you will no longer be able to use your email address.
Please note that a deletion request only affects your personal data. If you submit a deletion request against your employer account, we will only delete your personal data, and any non-personal data such as information about your company will not be deleted. You will not be able to use your email address again, regardless of if you have a job seeker or employer account.
What security measures are adopted by Indeed?
Indeed seeks to use reasonable security measures to help protect against unauthorized access, disclosure, and destruction and accidental loss of Personal Data under Indeed’s control, although no method of transmission over the Internet, or method of electronic storage, is 100% secure. The practices Indeed follows vary depending on the nature of the data, the context of the processing, and the risks involved, as well as available technology.
With respect to data transfers, Indeed relies on the use of data transfer and processing agreements that employ both the European Commission’s standard contractual clauses and the protections provided for under Chapter V (and Article 28, where appropriate) of the GDPR. Indeed Inc. is also certified under EU-US Privacy Shield, and adheres to applicable Privacy Shield principles, including those relating to security.
For more information on some of the steps we take and advice on steps you can take to help keep your information safe during your job seeking journey, please visit our Security page.
Does the GDPR impact my current use of Indeed Resume?
Resumes set to ‘public’ will continue to be available in their current capacity as outlined in our terms. Indeed has made necessary changes, as detailed above, to ensure lawful processing in compliance with GDPR and the rights of our users.
What is a private resume?
Private resumes are only made available to those to whom the job seeker has submitted an application or provided their resume. Where this occurs, you make your resume, your name and other personal data that you place on your resume available to third parties. Those third parties may be interested in you as an employee, and may forward your resume to other third parties.
Resumes set to “Public”, including yours, can be copied by search engines and other third parties accessing the site, who can then make those resumes publicly available elsewhere. Indeed does not control such third parties. If your resume is copied in this manner, then setting it to “Private” on Indeed will not affect those third parties or the copies they have made of your resume. Changes to your resume on the site may or may not be reflected on copies made by third parties. If you do not want your resume to ever be publicly visible or copyable, you must keep it set to “Private”. Applying to jobs or otherwise sharing your resume with employers may result in your resume being copied and published even if it is set to “Private”. Indeed assumes no responsibility and disclaims all liability for your resume or application information that you share with employers or otherwise make public.
What is a public resume?
Public resumes may be available to anyone accessing our site. This includes users of Indeed’s Resume Search product, employers whose Company Page you may be following, and anyone with access to the URL associated with your public resume, such as search engines and other third parties that may crawl our Site. We offer you this visibility to help you find a job.
When your resume is public on our site, you authorize Indeed to share the contents of your resume, including your name and any other personal data that you may include in it, publicly on the site.
Indeed may also offer you the ability to include additional information in your Indeed Profile about your desired job preferences, such as your desired job schedule and salary, your willingness to relocate, licenses, certifications, skills, and other information you choose to include about your job search. We use this information to help you find a job. Our Resume Search product allows employers to find great candidates by searching public resumes. By posting a public resume, you authorize Indeed to make the entirety of your resume available to any user who searches for you on our sites, to associate your desired job preferences with your resume and share this information with employers who search for resumes on our sites, to share your resume with employers who post job listings that may be a relevant match, and to allow employers to see if you were recently active on the sites, your readiness to work, and your available contact methods. For example, employers using Indeed’s Resume Search product are able to search for candidates based upon the information in your resume and any of your desired job preferences associated with it. As another example, employers may invite job seekers with public resumes to take action on their job listings when the resume is relevant to their hiring needs. If you do not want Indeed to share this information with employers, you can remove it from your resume and Indeed Profile, or change your resume privacy settings to “private”.
If you upload a file as your resume, you authorize Indeed to extract the contents of this file and share them on our site, including within our Resume Search product.
We may remove your name and contact information from your public resume in certain instances, such as for users of our Resume Search product without a subscription. Employers who have subscribed to our Resume Search product will be able to see your name and any other contents of your public resume, except that we reserve the right to remove your contact information (such as your email and telephone number) until you express interest in an employer. In either case, employers may still contact you through our site using our relay service. You also authorize Indeed to share any file you upload as a public resume on our site with employers where you express interest in them by applying to a job or responding positively to an invitation to apply.
Indeed expressly prohibits all scraping of its site, although some third parties may use our site in violation of these terms to obtain your public resume information.
Please note that Resume Search has not launched in all markets. If you are located in a market where Resume Search has not yet launched, setting your resume to public may make it available to anyone who visits the associated URL but it may not be searchable on our site. Resumes set to public in markets where Resume Search is not yet available may become searchable upon our launch of Resume Search in that market.
Indeed may also provide browser extensions and other tools to help employers better interact with job seekers and their resume information, including tools that allow employers to download your resume information and enhance and transfer it to third parties engaged to process information on their behalf, such as applicant tracking systems and other recruitment management tools. Employers are solely responsible for complying with all applicable laws that relate to their use of information obtained from Indeed and other sources, including any obligations employers may have to restrict how others interact with resume information downloaded from our site. Employers are also responsible for the activities of any third-party service provider they engage to facilitate their sourcing activities through the Indeed Resume Search program, such as an applicant tracking system.
How do I change my resume privacy settings?
When you place your resume on Indeed, it will be set to public by default. You may adjust this at any point by editing your privacy settings on Indeed. Where you adjust your resume from public to private, Indeed does not warrant how often third-party search engines will update their caches, which may continue to contain your resume information. Additionally, employers who have saved your resume while it was public may continue to have access to your resume even after you have adjusted it to private.
Changes made to your resume privacy settings may take a few days to complete, during which time a resume set to public, for example, may remain visible to employers and other users searching on Indeed.
If you do not want Indeed to make your Indeed Profile available to third parties or if you do not want employers to contact you, set your resume to private in your resume privacy settings or remove your resume. Your response to an Indeed Assessment will be associated with your Indeed Profile and is only made public at your request. If you take an Indeed Assessment as part of an application, the results are only visible to the employer who requested the assessment from you or employers you choose to share your Indeed Assessment score with on our site.
What are resume review services?
We may also offer additional resume review services to help job seekers build and improve their resumes. For example, this can include helping you understand how your resume may be parsed by applicant tracking system software, feedback on ways to build a more effective resume, or a personalized resume review video. In providing these services, Indeed may give you feedback, including questions and comments on the contents of your resume, about your resume or other materials you submit through the services. We provide this feedback directly to you, and may give you the ability to access it within your account. It is not made available to employers.
Does Indeed comply with international privacy rules?
Where is Indeed’s main establishment for GDPR purposes?
What has Indeed done from a privacy perspective to prepare for Brexit?
Indeed has taken measures to ensure the personal data of its users continues to be protected. For example, Indeed has introduced data transfer and processing agreements where appropriate to protect personal data transfers to the United Kingdom in the event of that jurisdiction departing from the European data protection regime.