Life at Spotify — Candidate Privacy Policy

Updated 17 March 2021.

1. Introduction Thanks for considering a job opportunity at Spotify. In order to apply for a job you need to provide us with some personal data about yourself.

The purpose of this Candidate Privacy Policy (“Policy”) is to explain how we collect and process your personal data in the hiring process and give you information about the rights you have in relation to your personal data.

The data controller for the processing of your personal data in the hiring process is the Spotify entity in the country where the job you apply for is located or from which you would work if you were offered a job at Spotify.

2. Your rights Privacy laws and regulations including the General Data Protection Regulation (“GDPR”) gives certain rights to individuals in relation to their personal data. Accordingly, we are happy to offer transparency and access controls to help users take advantage of those rights. As available and except as limited under applicable law, the rights afforded to individuals are:

Right of access - the right to be informed of, and request access to, the personal data we process about you;
Right to rectification - the right to request that we amend or update your personal data where it is inaccurate or incomplete;
Right to erasure - the right to request that we delete your personal data;
Right to restrict - the right to request that we temporarily or permanently stop processing all or some of your personal data;
Right to object - the right, at any time, to object to us processing your personal data on grounds relating to your particular situation;
Right to data portability - the right to request a copy of your personal data in electronic format and the right to transmit that personal data to another data controller; and
Right not to be subject to automated decision-making - the right to not be subject to a decision based solely on automated decision-making, including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.

You can easily request to access, remove or update the personal data that you have provided to us in your application by logging into our recruitment tool Lever, by following the link in the confirmation email you received from us when you submitted your application. If you require any further personal data, if you want to exercise any of your other rights, or if you have any questions about how we process your personal data, please contact our Data Protection Officer by emailing candidateprivacypolicy@spotify.com. While we hope that we can answer any questions that you may have, if you have unresolved concerns you also have the right to lodge a complaint with your local Data Protection Authority.

3. Personal data we collect from you When you apply for a job at Spotify, the types of information we collect and process may include, but are not limited to, the following categories:

Contact information – Your name, email address, phone number, city, country, and any other contact information provided by you;
Background details – Your CV or resume, including cover letter, academic qualifications, work experience, transcripts, and/or similar;
Reference information and information received from background checks, including criminal records at offer stage only (if applicable for the position you have applied for, and as permitted by applicable laws);
Information required to prepare the employment contract, such as date of birth, address, and, in some countries, personal identification number;
Interview information – Details from interviews and outcomes of any recruiting exercise you complete, including personality/reasoning ability tests;
Employment information – Information about the type of employment you are looking for or may be interested in, including targeted compensation, benefits and other job preferences;
Travel details for on-site interviews if applicable;
Publicly available information – Profile information, academic qualifications and work experience from publicly available sources relevant for the hiring process, e.g. your LinkedIn profile; and
Other information provided by you in the hiring process.

In addition, on a voluntary basis, we ask you to provide us with demographic information such as gender identity and, as permitted by applicable laws in some countries, race, ethnicity, and veteran status. This information will only be used to help us to evaluate and improve our diversity and belonging efforts. This information will be processed completely separate from your personal data and the application process and whether you choose to answer will not affect your job application. Any submitted information will be kept secure and confidential.

4. How we use your personal data We will use the information we collect about you for the following purposes:

To communicate with you throughout the hiring process;
To assess your qualifications, skills, and suitability for the considered job;
To consider you for, and inform you about other job opportunities (with your consent if required by applicable laws);
To verify your information and carry out reference checks;
To prepare your employment agreement if you are offered a job at Spotify;
To assist you with obtaining an immigration visa or work permit (if requested by you); and
To comply with applicable laws, regulations, legal processes or enforceable governmental requests.

In addition, we process your information (on an aggregated level) to perform analyses in order to understand, maintain, evaluate and improve our hiring process including our diversity and belonging efforts.

5. Automated decision-making Some of our recruitment processes may occasionally use elements of solely automated decision-making in order to confirm that we only proceed with candidates who meet the minimum requirements for a job, as set out in a job description. For example, if the job description clearly requires candidates to have previously had managerial experience and the application form asks if you have managerial experience, your application may be rejected automatically if your answer in the application form is “No”. Automated decision-making is only used as an exception when we expect a high volume of applications which we cannot handle manually. You may always request a manual review of the decision by emailing candidateprivacypolicy@spotify.com.

6. Legal basis for the processing When you apply for a role at Spotify, we process information about you in order to take steps necessary to enter into a possible employment contract with you. Further, we collect and process information about you as necessary for our legitimate interest to assess if you are suitable for the position you have applied for at Spotify and also to understand, maintain and improve our hiring process. We may also seek your consent to process your personal data for specific reasons in compliance with applicable laws, such as for the voluntary demographic survey and to consider you for future job opportunities. You have the right to withdraw such consent at any time by contacting us.

7. Sharing your personal data We share your personal data globally with other companies in the Spotify Group in order to carry out the activities specified in this Policy. We may also transfer your personal data to third party service providers such as recruiting firms and providers of recruiting tools.

Where personal data collected within the EU/EEA is transferred to and processed by third parties located in a country outside of the EU/EEA, Spotify shall ensure that the transfer of your personal data is carried out in accordance with applicable privacy laws and, in particular, that appropriate contractual, technical, and organisational measures are in place such as the Standard Contractual Clauses approved by the EU Commission.

8. Data retention and deletion If you are successful in your job application, relevant information we collect about you during the hiring process will become a part of your employment record and retained in accordance with our privacy policies for employee data.

If your application is unsuccessful, we retain your personal data for as long as necessary to comply with our legal obligations and resolve any disputes related to the hiring process. We may also, with your consent if required by applicable laws, retain your personal data for as long as allowed under applicable laws in order to consider you for future job opportunities at Spotify.

9. How to contact us Thank you for reading our Policy. If you have any questions about this Policy, please contact our Data Protection Officer by emailing candidateprivacypolicy@spotify.com.