Global Applicant and Job Candidate Privacy Notice

The Personal Information We Collect

We collect personal information about you when you apply for a job with us and/or during the recruitment process.  Personal information is typically data that identifies an individual or relates to an identifiable individual. This includes information you provide to us, information which is collected about you automatically, and information we obtain from third parties. The definition of personal information depends on the applicable law based on your physical location. Only the definition that applies to your physical location will apply to you under this Privacy Policy. 

The types of personal information we may collect, use, or process about you will depend upon the nature of the job to which you have applied or are being recruited for and the location of the job. 

• Personal Identifiers & Contact Information: such as your title, name, phone number, date of birth, home address and personal email address.

• Job Application Information & Professional or Employment Related Information: such as position applied for, previous roles, job description, responsibilities and assignments, years of service, qualifications and experience, compensation and salary data,  membership in professional organizations and professional certifications, eligibility for and participation in benefit schemes and other information contained in your CV/resume.  

• Educational Information & Qualifications: such as your highest level of education, the schools you attended and when you attended them, degrees, certificates or other educational qualifications, your academic transcripts and educational references.

• Financial Information: such as your desired salary, bonus, benefits and stock or equity grants. You may volunteer your previous salary and/or financial and benefit package as part of the recruitment process but we will not ask for this information.

• Background Check Information: when permitted by applicable law, we may choose to conduct a background check in connection with your application such as to verify professional and educational history and qualifications, credit worthiness or identify criminal history that may be relevant for a position with us. The results of the background check may include personal information we do not already have about you.

• Nationality, Citizenship and Right to Work Information: such as country of birth, government identification documents (including passports and residency permits) and, where relevant, visa information.

• Other Application and Interview Information: any personal information you choose to share with us in your interview or application, CV, resume, transcripts or other supporting documentation or to help us coordinate travel for an interview.

• Equal Opportunity Information & Protected Classifications Under California and U.S. Federal Law: as part of our diversity and inclusion strategy depending on jurisdiction we will monitor and report on gender/gender identity, race, ethnicity and veteran status when you choose to provide it and where this is applicable. As part of the standard recruitment process outside of the equal opportunity monitoring, we may also collection information related to age, national origin, citizenship, sex, gender identity, gender expression, sexual orientation, religion, disability or accommodation request, or marital status. When you choose to provide any such information it will not be used in the hiring decision, unless specifically permitted by law.

• Travel-related Expenses:  to the extent incurred during the recruitment process your banking details so that we can reimburse you for such expenses. 

Although we often collect the personal information described above directly from you (for example, from the application forms that you submit to us), we may also collect certain information from references, recruiters, social media sites, and publicly available sources.

In addition, we may also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers, scheduling providers and application providers.

Finally, we may collect personal information about you through background check and credit reference agencies where permitted or required by law. 

When you visit the Coinbase Careers site, we may use cookies, web beacons, tags, and scripts to measure traffic data,enable you to sign-in; and to combat fraud. For information about how you can control the data collected by cookies and similar technologies on our site, please see our Cookie Policy.  

How Your Personal Information is Used

We use and process your personal information for certain purposes that align with applicable data protection law in the jurisdiction in which you are located. We use your information:

• to communicate with you about the recruitment process and/or your application(s), including, in appropriate cases, informing you of other potential career opportunities at CB.

• where necessary for making hiring decisions;

• to comply with our legal obligations (such as to carry our checks in relation to your right to work);

• to allow us to carry out our legitimate business interests, including: 

• business planning and restructuring exercises;

• dealing with legal claims made against us;

• preventing fraud; and

• ensuring our administrative and IT systems are secure and robust against unauthorized access except where such interests are overridden by your interests in not having your personal information processed;

• to make improvements to our application and/or recruitment process including improving diversity in recruitment practices; and  

• to protect your interests.

If you are offered and accept employment with CB, the information collected during the application and recruitment process will become part of your employment record.

Further details regarding the use of your personal information may be found in the table in the Legal Bases for Processing Your Personal Information section below.  

Legal Bases for Processing Your Personal Information 

Certain jurisdictions in which we operate require us to provide you with information regarding our legal grounds or “legal basis” for processing your personal information. If you are located in any such jurisdiction, our legal basis for the collection and processing of your personal information is explained in the chart below: 

Sharing your Personal Information

We take care to allow your personal information to be accessed only by those who require access to perform their tasks and duties, and to share only with third parties who have a legitimate purpose for accessing it. CB will never sell or rent Applicant personal information to third parties. We will only share your information in the following circumstances:

• Your personal information will be shared with CB employees where it is necessary for them to undertake their duties with respect to our hiring process. This includes, for example, CB’s People Ops departments, which facilitate CB’s recruitment efforts and maintain personnel records.

• We may share your personal information with the other Coinbase Group entities identified in this policy as may be necessary to administer our relationship with you or operate our business.

• We may also disclose your personal information for the purposes described previously to:

• • references as part of the recruitment process (provided we obtained your consent);

  • third party service providers who assist us in administering our hiring process; 

  • credit and criminal background check companies (where this is our legal obligation or necessary for our legitimate interest); 

  • professional service providers and advisors who perform functions on our behalf, such as lawyers; and

  • government, regulatory authorities and other organizations (such as the police or other law enforcement agents) as required or authorized by law or other regulatory requirements in jurisdictions in which we operate.

• We may also disclose your personal information to third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets in circumstances which may require the use or transfer of such personal information. This may also include, without limitation, in connection with any bankruptcy or insolvency event. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this privacy notice.

• Finally, we may collect, use and disclose your personal information for other purposes not listed in this Privacy Policy. If we do so, we will make it known to you at the time we collect, use or disclose your personal information, and, where required, obtain your consent for doing so.

Your Rights in Relation to Your Personal Information

Depending on applicable law where you are located, you may be able to assert certain rights related to your personal information identified below. If any of the rights listed below are not provided under law for your operating entity or jurisdiction, CB has absolute discretion in providing you with those rights. The rights you may have include: 

• Access and portability. You may request that we provide you a copy of your personal information held by us. This information will be provided without undue delay subject to a potential fee associated with gathering of the information (as permitted by law), unless such provision adversely affects the rights and freedoms of others. In certain circumstances, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another data controller.

• Rectification of incomplete or inaccurate personal information. You may request us to rectify or update any of your personal information held by CB that is inaccurate. You may do this at any time by logging in to your account and clicking the Profile or My Account tab.

• Erasure. You may request to erase your personal information, subject to applicable law. Please note that we may be required by law to retain your information. 

• Withdraw consent. To the extent the processing of your personal information is based on your consent, you may withdraw your consent at any time. Your withdrawal will not affect the lawfulness of CB's processing based on consent before your withdrawal.

• Restriction of processing. In some jurisdictions, applicable law may give you the right to restrict or object to us processing your personal information under certain circumstances. We may continue to process your personal information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.

• Objection to the inclusion of information. In some jurisdictions, you may have the right to object to the way we use your personal information where the legal basis of our use is our legitimate interest. 

• Automated individual decision-making. In some jurisdictions, you have the right not to be subject to a decision based solely on automated processing of your personal information, including profiling, which produces legal or similarly significant effects on you, save for the exceptions applicable under relevant data protection laws.  

We may process your personal information in relation to your application for data and statistical analysis. We may deploy specific technologies for the purposes of enabling certain global-level recruiting analysis and diversity monitoring with your consent where permitted by applicable law, to comply with legal requirements or in CB’s legitimate interests. We do not make any automated decisions in relation to your application without human involvement.

We will not discriminate against you for exercising your rights. 

If you are located in a jurisdiction that grants you some or all of the rights above, you should note that your rights with regard to your personal information are not absolute. Depending upon the applicable law, requests may be denied: (a) when denial of the request is required or authorized by law; (b) when granting the request would have a negative impact on another's privacy; (c) to protect our rights and properties; (d) where the request is frivolous or vexatious, or (e) for other reasons

References

CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time which will be indicated by changing the date at the top of this page. If we make any material changes, we will notify you using the email address or contact information that you provide during the hiring process, or as otherwise required by law.

CONTROLLER INFORMATION

Coinbase operates entities around the world (collectively “Coinbase,” “CB”, “we”, “us” and “our”).  For purposes of this Privacy Policy, the Coinbase entity to which you applied for employment determines the means and purposes of processing your personal information in relation (typically referred to as a “data controller”). This Privacy Policy applies to Applicants who apply or are recruited for employment at the following Coinbase entities, and to any other Coinbase entity that links to this Privacy Policy.  

• Coinbase Custody International, Coinbase Europe, Limited or Coinbase Ireland, Limited,   70 Sir John Rogerson's Quay, Grand Canal Dock, Dublin 2, Ireland 

• Coinbase Germany GmbH, c/o Simmons & Simmons LLP,  Friedrich-Ebert-Anlage 49, 60308 Frankfurt am Main, Deutschland 

• Coinbase India Services Private Limited, c/o Kiran Sharma & Co, R-4, 3rd floor Greater Kailash -1, New Delhi, 110048 India; 

• Coinbase 株式会社 (Coinbase KK), Finolab, Otemachi Building 4F, 1-6-1 Otemachi, Chiyoda-ku, Tokyo

• Coinbase Philippines, Inc., 9F WeWork Uptown Bonifacio Tower Three, 36th Street Corner 11th Avenue, Taguig City, National Capital Region, 1634 Philippines

• Coinbase Singapore Pte Ltd.,  One Marina Boulevard, #28-00, Singapore 018989 

• Coinbase Canada, Inc., c/o MLT Aitkins, 2600 - 1066 West Hastings Street, Vancouver BC V6E 3X1, Canada

• CB Payments Ltd.,   5 Fleet Place, London, United Kingdom EC4M 7RD  

• Coinbase, Inc., Coinbase Crypto Services, LLC 100 Pine Street, Suite 1250, San Francisco, CA 94111

• Coinbase Custody Trust Company, LLC, 200 Park Avenue South, Suite 1208 New York, New York 10003

CONSENT 

We are not required to obtain your consent for most of the processing activities that we undertake in respect of your personal information in relation to your job application.

In certain circumstances and in certain jurisdictions, we may need your consent to use certain "sensitive" information, such as information about your health or ethnicity, in particular ways. You will never be obliged to give us this consent. Where you have given us consent to collect, use or disclose your personal information in a certain way you may withdraw your consent at any time by contacting us using the Data Protection Lead contact information below. 

INTERNATIONAL TRANSFERS

Coinbase has entities and offices in countries around the globe. As part of our global operations, we transmit information between and among these entities and their service providers. As a result of the global nature of our business, your personal information may be shared with entities and processed in a foreign country where privacy laws may be less stringent than the laws in your country.   For instance, your personal information may be disclosed as outlined in the paragraph “Sharing Your Personal Information”with persons in other countries, including Ireland, Germany, Singapore, Japan, the UK, the US, the Philippines, and possibly other countries.  Nonetheless, where required by the applicable privacy law, we take steps to treat personal information using the same privacy principles that apply pursuant to the law of the country in which we first received your information. Your personal information will be accessible only to other employees on a need-to-know basis in each case, or  if it is needed for the performance of their duties.

EU, UK and Swiss Personal Information Transfers

We rely on Model Contractual Clauses approved by the European Commission to facilitate the international transfer of personal information collected in the EEA, the United Kingdom and Switzerland (“European personal information”), and any onward transfer of such information to the extent the recipients of the European personal information are located in a country that the EU considers to not provide an adequate level of data protection. This includes transfers from our EU-based CB operating entities to our US-based operating entity, Coinbase, Inc. We may also rely on an adequacy decision of the European Commission confirming an adequate level of data protection in the jurisdiction of the party receiving the information.

Before we share your information with any third party, CB will enter into a written agreement that requires that the third party provide at least the same level of protection for the personal information as required under applicable data protection law.

Coinbase, Inc., also participates in and has certified its compliance with the EU-US Privacy Shield Framework. Under the Privacy Shield Framework, Coinbase, Inc. is subject to the authority of the Federal Trade Commission. To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce's Privacy Shield List at https://www.privacyshield.gov. 

European data subjects with inquiries or complaints relating to our Privacy Shield certifications should first contact CB via our Support Portal or by emailing dpo[at]coinbase.com. If we are unable to resolve your complaint or dispute, you may refer your complaint to our designated independent dispute resolution mechanism, the International Centre for Dispute Resolution ("ICDR"), operated by the American Arbitration Association ("AAA"). For more information and to file a complaint, you may contact the International Centre for Dispute Resolution by phone at +1.212.484.4181, or by visiting the website https://go.adr.org/privacyshield.html.

If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-ntroduction.

SECURITY OF YOUR PERSONAL INFORMATION

We understand how important your privacy is, which is why CB maintains (and contractually requires third parties it shares your information with to maintain) appropriate physical, technical, organizational and administrative safeguards to protect the security and confidentiality of the personal information you entrust to us. 

We protect your personal information by maintaining physical, electronic, and procedural safeguards in compliance with the applicable laws and regulations. For example, we use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorize access to personal information only for those employees who require it to fulfill their job responsibilities. 

However, we cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your data will not occur. Furthermore, we cannot ensure or warrant the security or confidentiality of information you transmit to us or receive from us by Internet or wireless connection, including email, phone, or SMS, since we have no way of protecting that information once it leaves and until it reaches us. If you have reason to believe that your data is no longer secure, please contact us using the contact information provided in this Privacy Policy.

Where we share your data with third parties, we provide written instructions to them to ensure that your data is held securely and in line with the requirements of applicable data protection law. Third parties must implement appropriate technical and organizational measures to ensure the security of your data.

DATA RETENTION

We will store the personal information we collect about you for no longer than necessary and in accordance with our legal obligations and legitimate business interests.

If your application is successful and you become an employee of Coinbase, where permitted by local law, the personal information we collect during the application process may be transferred to your personnel file and stored in accordance with our internal policies, which you will receive access to at the start of your employment.

If your application is not successful, we will retain your personal  information for a period after your application. We retain this information for various reasons, including in case we face a legal challenge in respect of a recruitment decision and to help us better understand, analyze and improve our recruitment processes. To the extent that you give us consent to do so, we may also keep your personal information for the purpose of considering your application for employment with other CB entities or for other positions with CB.

Where you have given us your consent to process certain Equal Opportunities Information we may anonymize and aggregate this information, and store it in a form that does not personally identify you, for the purpose of monitoring and improving the application and recruitment process. 

HOW TO MAKE A PRIVACY REQUEST 

You, or an authorized individual who we can verify is acting on your behalf, can exercise the applicable rights by contacting us using the contact details at the bottom of this Privacy Statement.

MAKING A COMPLAINT 

If you believe that we have infringed your rights, we encourage you to contact the CB Data Protection Officer at dpo[at]coinbase.com.  

In certain jurisdictions, you have the right to submit a complaint to your local data protection regulator: 

• If you reside in the EU, you can file a complaint with the International Centre for Dispute Resolution by phone at +1.212.484.4181, or by visiting the website http://info.adr.org/safeharbor, or your relevant data protection authority. 

• In the UK, the relevant data protection authority is Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, casework[at]ico.org.uk. 

• In Ireland, the relevant data protection authority is the Data Protection Commission, Canal House, Station Road, Portarlington, R32 AP23 Co. Laois; phone: +353 (0761) 104 800; LoCall: 1890 25 22 31; Fax: +353 57 868 4757; email: info[at]dataprotection.ie. 

• In Canada, you may be able to file a complaint to the applicable commissioner listed below.

• Ontario: Information and Privacy Commissioner of Ontario (https://www.ipc.on.ca/)

• British Columbia: Office of the Information & Privacy Commissioner (https://www.oipc.bc.ca/)

• Quebec:  Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca/)

• Alberta: Office of the Information and Privacy Commissioner of Alberta (https://www.oipc.ab.ca/)

• Federal: Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/en/)

• If you are resident in a province without a provincial privacy commissioner, you can make a complaint to the contact at the bottom of this policy.

CHILDREN.  Please note that CB does not knowingly collect the personal information of children for purposes of employment. Applicants are required to affirm they are over the age of majority in their country to continue in CB’s hiring process.

ADDITIONAL INFORMATION FOR SPECIFIC JURISDICTIONS

Additional Provisions for Canada

If you apply to a position with Coinbase Canada, in line with data protection principles, we only keep your personal information for as long as we are legally obligated to keep your information after your application has been considered.  We keep education and interview notes 12 months for unsuccessful candidates and generally until the end of (extended) trial period for successful candidates. Any criminal disclosure information about you will be deleted immediately after an employment decision has been made, and neutral information that any such check has been made may be stored for three months. 

Additional Provisions for Germany 

If you apply to a position with a Coinbase Group entity in Germany, note that we maintain personal information, including identification information, contact details, education, qualifications and interview notes for 4 months if your candidacy for employment is not successful. If we collect information about your criminal records, we will delete such records immediately after we make our employment decision, but will maintain neutral information (for example, the fact that we performed a criminal background search) for up to 3 months.

Additional Provisions for India 

You expressly consent to the collection, storing, processing, dealing in, handling of, disclosure and transfer of the personal information collected from you per this Privacy Policy. Under the Information Technology Act (2000), with respect to your sensitive personal  information, you may decline to provide us with such information and you may request to withdraw such information from our processing.

Additional Provisions for Japan

If you are a Japanese resident, in handling your personal information, we will comply with the Act on the Protection of Personal Information (Act No. 57 of 2003; hereinafter the "APPI"), as well as laws and regulations applicable to personal information, guidelines established by the Personal Information Protection Commission, and other rules and regulations. 

Some of your personal information may be disclosed, transferred, stored, processed or used overseas by us, or by third party service providers for the purposes described in this Privacy Policy. This may happen if:

• our offices or related entities are overseas;

• we outsource certain activities overseas;

• transactions, information, services or products have an overseas connection; or

• our computer systems including IT servers are located overseas.

In particular, your personal information may be disclosed to persons in Australia, Hong Kong, the European Economic Area, the United Kingdom, Singapore, Malaysia, the U.S.A and/or such other countries in which: (i) those parties or their, or our, computer systems may be located from time to time, or (ii) any member of the Coinbase Group becomes licensed or establishes a place of business, in each case where it may be used for the purposes described in this Privacy Notice.

Where we transfer data to other jurisdictions outside Japan, we will do so in accordance with applicable privacy law.  In particular we will provide suitable safeguards (such as standard data protection clauses). You may obtain a copy of such safeguards via the following email: myprivacy[at]coinbase.com.

Additional Provisions for USA

In states where residents are allowed additional individual rights, Coinbase is committed to honoring those rights for such residents, including requests that may limit how we use and share your data, consistent with applicable law. Note that the applicable law may exempt certain personal information from such requests. To submit a request based on local law, please contact us as indicated below in the Data Protection Lead Contact Information section. We will respond to your request consistent with applicable law, and if any circumstances cause delay in our response, you will be promptly notified.

California Residents. Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), in the section above entitled “The Personal Information We Collect” we identify the personal information, as that term is defined in the CCPA, that we collect.  In the sections above entitled “How We Use Your Personal  Information” and “Legal Basis for Processing Your Personal Information” we explain how we use your personal information. If you are an Applicant located in California, please note that CB does not “sell” personal information collected from Applicants, as that term is defined under California Civil Code Section 1798.140. 

CONTACT INFORMATION

If you have questions or concerns regarding this Privacy Policy, please contact us at myprivacy[at]coinbase.com, or dpo[at]coinbase.com, or at the address for the relevant CB entity listed at the beginning of this Privacy Policy.  Because email communications are not always secure, please do not include sensitive information in your emails to us.