Privacy policy

11. GDPR and Other International Considerations

GDPR and UK GDPR

In the EEA and UK, we present Site Visitors with a cookies banner asking for your affirmative consent to non-essential cookies.

If you reside in the EEA or UK, you have the right to submit a data subject access request (“DSAR”) under the General Data Protection Regulation or UK General Data Protection Regulation (“GDPR”), including requests to delete and object to certain processing of your information. You can exercise many of these rights by visiting the links described above in How can you delete information about you? In addition, you may submit a DSAR request to foundation@checkr.com.

Data Storage
Checkr uses infrastructure primarily located and operated in the United States. Checkr may also use partners or affiliates located in countries outside the US to store, process, and transmit your information. If you are located in the EEA, UK, or another region with comparable data protection laws, your personal information may be transferred to a jurisdiction that does not have the same level of legal protections.

Personal Information Disclosure: United States or Overseas
For more information on how Checkr handles cross-border transfers of personal information, please read the remainder of this section below.

Data Transfer and Standard Contractual Clauses
Checkr may transfer, store, or process your Personal Data in a country outside your jurisdiction, including countries outside the EEA and UK. We take appropriate safeguards with respect to such cross-border data transfers. For example, if we transfer Personal Data from the EEA or UK to another country, such as the United States, we will implement an appropriate data transfer solution such as entering into “standard contractual clauses” approved by the European Commission or competent UK authority (as applicable) with the data importer, or take other measures to provide an adequate level of data protection under EEA and UK law. Checkr may also rely on the active consent of EEA based data subjects. Data from EEA based data subjects is processed with consent, to fulfill our legitimate interests to produce a data subject’s requested background check, and to fulfill our contractual obligations.

Additional Information for Canadian Users
This Policy applies to Consumers and Site Visitors in Canada. However, to the extent that this Policy is inconsistent with any applicable Canadian laws, Checkr will comply with the applicable law for Consumers and Site Visitors in Canada. For example, Checkr will only send commercial electronic messages to persons located in Canada with explicit, opt-in consent, unless otherwise permitted pursuant to Canadian legislation that is applicable to such activities.

In addition, Personal Data that is collected may be transferred outside Canada. Therefore, such information may be accessible to law enforcement and national security authorities in the jurisdiction(s) where it is stored or processed.

Canadian Consumers will be notified of any material changes to this Policy, where such a change would result in use or disclosure of their personal information by Checkr in a manner not contemplated by this Policy or reasonably expected by the individual.

Privacy Shield
Checkr complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  Checkr has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  Checkr has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Checkr is accountable for Personal Data that it receives in the United States under the Privacy Shield and subsequently transfers to a third party as described in the Privacy Shield Principles.  In particular, Checkr remains liable under the Privacy Shield Principles if third-party service providers engaged by Checkr to process Personal Data on its behalf do so in a manner inconsistent with the Privacy Shield Principles, unless Checkr is not responsible for the event giving rise to the damages.

In certain situations, Checkr may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Pursuant to the Privacy Shield Frameworks, EEA and Swiss individuals have the right to obtain our confirmation of whether Checkr maintains personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under Privacy Shield, should direct their request to our support portal. If requested to remove data, we will respond within a reasonable timeframe.

Checkr is responsible for the processing of Personal Data we receive and subsequent transfers to a third party acting as an agent on our behalf, under the Privacy Shield Frameworks. Checkr complies with the Privacy Shield Principles for all onward transfers of personal data from the EEA and Switzerland, including the onward transfer liability provisions.

With respect to Personal Data received or transferred pursuant to the Privacy Shield Framework, Checkr is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission.

In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), Checkr commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF, the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact Checkr.

Checkr has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf

Our Legal Bases for Processing Your Information
Laws in certain jurisdictions, such as the GDPR in the EEA, require the controller to identify their legal bases for processing Personal Data. Checkr is sometimes a controller and sometimes a processor. When we collect and use the Personal Data of Site Visitors, we are always a controller. When we collect and use the Personal Data of Consumers, we are sometimes a controller and sometimes a processor.

In other cases, Checkr acts as a controller, and is therefore responsible for identifying a legal basis for each processing purpose. We rely on different legal bases to process your information for the various purposes described in this Privacy Policy.

For each legal basis below, we describe the purposes of our processing (why we process your information) and our processing operations (how we process your information to achieve each purpose). We also list the categories of your information that we may process for each purpose.

You also have particular rights available to you depending on which legal basis we use. No matter what legal basis applies, you always have the right to request erasure of your information. To exercise your rights, see
How can you delete information about you?.

Compliance With A Legal Obligation
We process information to comply with a legal obligation including, for example, to access, preserve or disclose certain information if there is a valid legal request. New laws may be enacted or other obligations may become binding on our processing and we will update the list of laws from time to time.

Why And How We Process Your Information	Information Categories We May Use
Sending legally mandated notices about your personal information	Identifiers Communications information
Complying with audit, retention and other obligations imposed by the third-party source of personal information	Internet or other electronic network activity information (such as user information API logs) Communications information

Legitimate Interests

We rely on our legitimate interests or the legitimate interests of a third-party, such as our users, where they are not outweighed by your interests or fundamental rights and freedoms (“legitimate interests”):

Why And How We Process Your Information	Legitimate Interests Relied On	Information Categories We May Use
Securing Checkr systems and protecting against abuse, including but not limited to security investigations, audits, and ongoing monitoring	It is in our interest and interests of users to secure Checkr systems, detect and respond to abuse, and promote safety and security of our systems.	Identifiers Communications Internet or other electronic network activity information (such as usage information, logs, and device and connection information)
Recording and reviewing communications	It is in our interests to retain personal information for investigations or regulatory inquiries and litigation or other disputes, to continuously improve and develop the customer support we provide.	Identifiers Communications information (such as call and email logs)
Responding to data subject requests (including deletion and access requests)	It is in our interest and interests of users to provide support services users.	Identifiers Communications information (such as call and email logs)
Complying with audit, retention and other obligations imposed by the third-party source of personal information	It is in our interests to retain personal information for investigations or regulatory inquiries and litigation or other disputes.	Identifiers Internet or other electronic network activity information (such as user information API logs)