Global Employee Privacy

Aqua Security Software Ltd. Global Employee Privacy Notice

Last Updated/ reviewed: August 2023

This Global Employee Privacy Notice (“Notice”) describes what personal information we – Aqua Security Software Ltd. and our affiliates (“Aqua Security”, “we”, “our” or “us”) collect and process on our employees (“Employees”, “you” or “your”), how we treat this information and what we use it for. It also describes how candidates may exercise their rights to such information held with us. The information provided in this Notice is relevant to our practices currently and in the preceding 12 months.

Aqua Security is a global company with offices and employees worldwide including in Israel, the U.S., the EEA and the UK. While this Notice is intended to describe the broadest range of our data practices globally, the following practices may be more limited in some jurisdictions based on the local legal requirements. For example, the laws of a particular country may limit the types of personal data we can collect or the manner in which we may process that data; alternatively, the laws of a particular country may require us to collect a type of data that we will not seek to collect in another jurisdiction. In those instances, we will adjust our internal policies and practices to reflect such local requirements.

1.      DATA COLLECTION

We may collect and receive the following categories of personal data:

Data received from you during your job application process: throughout the application and recruitment process, you may provide us (or we may otherwise have access to) personal data about you, which in typical circumstances would contain:

• identifying information;
• contact details (e.g., phone number, personal email address);
• work history, technical skills, educational background, professional certifications, memberships and/or registrations to professional organizations;      language capabilities;
• training records;
• social media or other public activity;
• salary history and expectations.

We may collect this data directly from you, as you provide it voluntarily through your application and candidacy review process (e.g., CV/resume, cover letter, questionnaires), or from other sources such as your references, placement agencies or our Service Providers (as defined in Section 6 below).

Data received from you during your employment: once you join Aqua Security and during your employment with us, you may provide us additional personal data about you, such as:

• additional identifying and contact data (e.g., your profile picture, ID or Social Security Number, nationality, passport details, home address, gender, date of birth, marital status, employee ID number (if applicable), residency and work permit status, military status, nationality, username and hashed password for your accounts at Aqua Security);
• data concerning your immediate family members and emergency contacts you have provided (as necessary under applicable tax and benefit forms);
• data concerning your health, such as data relating to participation in employee wellness programs, your health insurance programs, sick days, special accommodations you may need, and any health data required for us to comply with official guidelines and regulations;
• your religious or philosophical beliefs (to the extent necessary for us to be able to respect your religious holidays, dietary requirements or other work-related needs);
• your bank, health and benefits providers (e.g., your bank account for depositing your salary, your selected pension or insurance providers, mobile carrier, health providers);
• data concerning your expressed preferences or requests;
• voicemails, emails, call and video recordings, correspondence, documents, and other work product and communications created, stored or transmitted using our networks, applications, devices, computers or communications tools;
• date of resignation or termination, reason for resignation or termination, information relating to administering termination of employment (e.g., references);
• meal orders and dietary preferences; and
• any other personal data you may provide us with during or concerning your employment by Aqua Security.

Data generated by Aqua Security or our Service Providers: we, or our Service Providers, may create additional data about you during your time of employment, such as:

• job offer letters;
• data regarding your role, position and team;
• salary, benefits and stock options (if applicable);
• records of work absences, vacation/paid time off;
• entitlement and requests;
• performance appraisals, letters of appreciation and commendation, personal development programs and other courses you may undertake during your time of employment;
• disciplinary and grievance procedures (including monitoring compliance with and enforcing our policies);
• work travel plans;
• video footage from Aqua’s CCTV security system;
• calendar events, participation in work events, and other data concerning your activities as a Aqua Security employee.

Data automatically collected or generated: when you use any of Aqua Security’s systems or devices, including when you connect to or use your Aqua Security email account, Human Resource Information System and/or performance review system (if applicable), we and our Service Providers may collect or generate technical data about you. Such data consists of connectivity, technical or aggregated usage data, such as IP address, non- identifying data regarding the device, operating system, browser version locale and language settings used, the cookies and pixels installed on such device, and the activity (clicks and other interactions) on such systems. We mostly use this data to have a better understanding of how our employees generally and typically use and engage with such systems and devices, or in order to investigate any suspected illegal activity, abuse or wrongdoing.

2.      DATA USES

Specifically, we collect and use your personal data as follows:

Should we wish to conduct any additional activities that may require the use of your personal data, we will notify you in advance, and if required by applicable law, request your prior specific consent.

If you reside in a territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for the processing of personal data as described herein, entering into an employment agreement with Aqua Security means that you have had the opportunity to read and that you accept this Notice and will be deemed as your consent to the processing of your personal data for all purposes detailed in this Notice.

3.      MONITORING COMPANY-ISSUED DEVICES & SYSTEMS

In the course of your employment at Aqua Security, any data that is electronically stored on or accessible via devices or systems Aqua Security made available to you, including company assigned email addresses and mailboxes, may be subject to occasional monitoring (including email account and correspondences, chats, and other means of internal and external communication made available to you during your employment), at any and all times and by any lawful automatic and/or manual means, by Aqua Security and its authorized personnel, to the extent permitted under applicable law, in order to protect the safety and confidentiality of Aqua Security’s information and to ensure our business continuity.

It is therefore your responsibility to ensure that any data that is stored on or accessible via company assigned emails, mailboxes, devices or systems Aqua Security made available to you, is work-related.

4.      DATA LOCATION

Your personal data may be maintained, processed, accessed and stored by Aqua Security, our Service Providers (as defined in section 6 below) in Israel, U.S., and other jurisdictions, as necessary for the proper operations of our company and for the proper handling of your employment with us or as may be required by law.

While privacy laws may vary between jurisdictions, Aqua Security, its affiliates and Service Providers engaged in processing hereunder are each committed to protect personal data in accordance with this Notice, customary industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

To the extent that we transfer employees’ personal data originating in the European Economic Area (EEA), UK, or Switzerland to countries that have not been recognized as offering an adequate level of data protection by the relevant competent authority, we rely on appropriate contractual undertakings and data transfer mechanisms as established under applicable law, such as the standard contractual clauses approved by the European Commission and the UK ICO. You can obtain a copy of specific standard contractual clauses used by us by contacting us at [email protected]. If we transfer employees’ personal data originating (i) from the EEA or Switzerland to Israel or the UK, or (ii) from the UK to Israel or the EEA or Switzerland, we rely on the respective adequacy findings of the relevant supervisory authority regarding the level of data protection offered by Israel, the UK, Switzerland and the EEA.

5.      DATA RETENTION

Aqua Security may retain your personal data for the duration of your employment with us, and then for an additional period, as reasonably necessary to comply with our legal obligations, to resolve disputes, prevent fraud and abuse, enforce our agreements or otherwise protect our legitimate interests.

Following such period, we may retain limited copies of your data, so to allow us to maintain a registry of everyone who ever worked at Aqua Security and to be able to contact them solely in this context (and such registry shall only contain such limited data as necessary for this purpose).

Note that except as required by applicable law, we will not be obligated to retain your data for any particular period, and are free to securely delete it for any reason and at any time.

6.      DATA SHARING

We may share your personal data with certain third parties, including law enforcement agencies, our Service Providers and our affiliates – but only in accordance with this Notice and as described below:

Compliance with Laws, Legal Orders and Authorities: we may disclose or allow government and law enforcement officials access to certain personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations, including for national security purposes. Such disclosure or access may occur with or without notice to you, if we have a good faith belief that we are legally compelled to do so, or that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing.

Service Providers: we engage selected third-party companies and individuals to perform services complementary to our operations (e.g. hosting services, human resources software and service providers, data analytics services (e.g. compensation and benefits analytics), data and cybersecurity services, background check services, fraud detection and prevention services, payroll and payment processing services, email distribution and monitoring services, and our business, legal, financial and compliance advisors – collectively, “Service Providers”). These Service Providers may have access to your personal data, depending on each of their specific roles.

Aqua Security Clients: we may disclose certain personal data to our clients, such as your name, position and contact details, and in some cases (if required for you to provide support or professional services on Aqua Security’s behalf) additional data such as your ID and existence of a background check (if any and if relevant), to those clients requiring such data for security and regulatory reasons.

Other Aqua Security Employees: your fellow employees may have access to certain personal data, such as your identity, role, profile picture and contact details, as may be available to them in the internal employee directory, and additional data depending on their specific roles and responsibilities, and need for such data (e.g., payroll data may be disclosed to HR, Finance and Legal personnel, as well as to your managers, all solely on a “need to know” basis).

Protecting Rights and Safety: we may share your personal data with others, if we believe in good faith that this will help protect the rights, property or personal safety of Aqua Security, yourself or other personnel, any of our clients or partners, or any members of the general public.

Aqua Security Group: we may share personal data internally within the group, for the purposes described in this Notice. In addition, should Aqua Security undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, personal data may be shared with the parties involved in such an event. If we believe that such an event might materially affect your personal data then stored with us, we will use reasonable efforts to notify you of this event and the choices you may have, via email or prominent notice in our internal systems typically used for such notices.

For the avoidance of doubt, Aqua Security may share your personal data in additional manners, pursuant to your explicit approval or if we are legally obligated to do so.

7.      DATA SECURITY

In order to protect your personal data held with us and our Service Providers, we are using industry-standard physical, procedural and electronic security measures, including encryption where deemed appropriate. These measures provide sound industry standard security, however, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties. We continue to regularly seek new ways and tools for further enhancing the security of our system and the integrity of the personal data that we hold.

8.      DATA SUBJECT RIGHTS

If you wish to exercise your rights under any applicable law (including the EU or UK General Data Protection Regulation (GDPR) or Israel Privacy Protection Laws) such as, to the extent applicable – the right to know/access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request rectification or erasure of your personal data held with Aqua Security, to port such personal data, or to restrict or object to such personal data’s, or any similar rights afforded to data subjects under the laws that apply to you – please contact us at [email protected]. Additionally, you have a right to lodge a complaint with a competent data protection authority, such as the UK’s Information Commissioner’s Office, or your State’s Attorney General (as applicable).

Please note that we may require additional information, including certain personal data, in order to authenticate and process your request. Such additional information, along with records pertaining to your request, its handling by us and subsequent communications between you and us, may be then retained by us for legal purposes (e.g., as proof of the identity of the person submitting the request or proof of request response), in accordance with Section 5 above.

Please also note that such rights are not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse your request or to fulfill it only partially. In the event that we cannot accommodate your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

9.      ADDITIONAL INFORMATION

Updates and amendments: We may update and amend this Notice from time to time by distributing an amended version. The amended version will be effective as of the published effective date. We will use reasonable efforts to provide an advance notice if any substantial changes are involved, via any of the communication means available to us. After this notice period, all amendments shall be deemed accepted by you.

Requirements under U.S State Privacy Laws: This Notice describes the categories of personal information we may collect and the sources of such information (in Section 1 above), and our retention (Section 5) and deletion (Section 8) practices, currently and in the preceding 12 months. We also included information about how we may process your information, which includes processing for “business purposes” under the California Consumer