Fountain Privacy Center
Privacy Policy
Effective Date: January 1, 2023
Last Updated Date: January 9, 2025
For previous versions of the Fountain Privacy Policy please see our archive here. Reach out to privacy@fountain.com if you have any questions about this current version of the Fountain Privacy Policy, or any prior effective version of the Fountain Privacy Policy.
OnboardIQ, Inc. d/b/a Fountain (together with its affiliates, "Fountain", "we", "our", or "us") provides a suite of cloud-based recruiting, onboarding, worker management, and human resources software tools (the "Platform") to Customers, Applicants and other Authorized Users ("you" or "your") to open opportunities for the global workforce. Fountain understands the importance of privacy and information security to you and other visitors to our digital properties, and, as stewards of the Personal Information shared with us through use of the Services, we take these matters seriously.
This Privacy Policy (this "Policy") describes how we collect, process, use, store, share and otherwise engage with data and personal information, including personal information that is deemed "sensitive", and how you can exercise your rights with respect to such activities. This Policy applies to Fountain’s Platform, websites, mobile applications, Candidate AI Agent (which is an AI chatbot), application programming interfaces ("APIs"), and any other services offered by Fountain, its Affiliates, or its and their respective subsidiaries (collectively, the "Services"). This Policy also applies to data and personal information we collect, process, use, store, share and otherwise engage with in connection with our commercial relationships with other businesses, service providers, Customers, suppliers, and vendors, as well as our relationships with prospective, current, and former employees and contractors.
Please read this Policy carefully, as your use of any of the Services your express, voluntary and complete acceptance of the terms and conditions of this Policy and our Terms of Service.
This Policy contains the following Sections:
Policy Scope and Limitations
Information Fountain Collects
How Fountain Uses Information it Collects
Legal Bases for Fountain’s Use of Your Information
How Fountain May Disclose Your Information
Retention of Your Information
Your Choices and Rights
Additional Information for Residents of California, Virginia, Colorado, Connecticut and Utah
Additional Information for Nevada Residents
Additional Information for Non-U.S. Residents
Security
Children’s Privacy
Changes to this Policy
Data Privacy Framework
How to Contact Us
1. POLICY SCOPE AND LIMITATIONS
This Policy applies to “personal information”, “personal data”, “sensitive personal information”, or similar defined terms under applicable Data Privacy Laws. For clarity, we are going to refer to such information as “Personal Information” throughout this Policy.
Personal Information does not include, and this Policy does not apply to, information/data that has been de-identified, anonymized, cannot reasonably be used alone or in combination with other data to identify an individual person, or otherwise does not constitute Personal Information under Data Privacy Laws.
When we handle information about Applicants, we may collect information on behalf of our Customers (“Customer Records”), or directly from Applicants, Customers, and/or other users of our Services for our own account (“Fountain Records”). Fountain Records includes data and Personal Information that we collect in the course of a commercial relationship (communicating with prospective clients about our Services and other offerings, establishing accounts, responding to billing or service inquiries, etc.), and in connection with potential, current and former employment relationships (when you apply to work at Fountain or in the course of your employment).
For the purposes of the European Economic Area (“EEA”) General Data Protection Regulation (together with related directives, implementing legislation, and other regulations, rules, interpretations and guidance, the “GDPR”), the GDPR as retained and integrated into the law of the United Kingdom through Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (the “UK GDPR”), and domestic Data Privacy Laws like the California Privacy Rights Act of 2020 (“CPRA”) and the Virginia Consumer Data Protection Act (“VCDPA”), Customers act as the data controller with respect to Customer Records and we act as a service provider or data processor.
Customers determine how to engage with Applicants through the Platform and our other Services and thus act as the business that determines the purposes and means of handling Customer Records and the Personal Information of Applicants contained therein. In those circumstances, Applicants are ultimately subject to the respective privacy policies of the Customers with which they interact, and they should read those policies carefully, as they may differ from this Policy. Fountain is not responsible for the privacy practices of Customers or the third-party services they integrate with our Platform or otherwise utilize to recruit, evaluate, and onboard Applicants. Please review the relevant Customer’s privacy policy, terms of use, or employment policies to learn more about their information practices, including their use of service providers like Fountain.
The Services may contain links to, or other integrations with, third-party SaaS platforms, websites, APIs, and other third-party services, which third parties have privacy policies and other data practices that govern the collection, sharing, processing and use of your Personal Information on their platforms, websites, APIs, and services. Please review the privacy policies and other materials relevant to the use of such platforms, websites, APIs, and other third-party services to understand how your Personal Information may be collected, shared, processed, and used by these third parties and to exercise your applicable rights with respect to such Personal Information. Fountain providing links to, or other integrations with, third-party SaaS platforms, websites, APIs, and other third-party services does not signify our endorsement of these third-party properties nor their contents, functionality, or any practices of such third parties.
2. INFORMATION FOUNTAIN COLLECTS
We collect information, including Personal Information, from and about you in a number of ways, including directly from you when you provide such Personal Information to us, automatically from you when you use any of our Services, as well as information about you from third-party providers and publicly available sources.
You may choose to provide your Personal Information to us in a number of ways, including when you apply for a job with us or with a Customer, use the Platform as a Customer or Authorized User to manage aspects of the sourcing, recruiting, application, onboarding and worker management journey, or you otherwise interact with the Services.
You are not required to submit Personal Information through our Services, and no Applicant is required to start or finish an application for employment with our Customers. Please do not submit any information through the Platform or Services that you do not want either Fountain or the applicable Customer to see.
Account and Contact Information. If you create an account, we may collect account information, such as login credentials, contact and business information, and application information related to the posted positions.
Application Responses. In the event you choose to apply for a particular position, we will display the information fields Fountain requires for our roles or the Customer has requested be collected from Applicants. Such information could include your name, photo, contact information, Social Security number, driver’s license number, passport number, residence and/or business address, and other information typically found on a job application, such as your job history, education level, age, specialized skill set, and other information requested by the applicable Customer. This may also include documents you need to submit that reflect your identity, citizenship status, work authorization, or other information about you, such as your passport. While Applicants are in no way required to supply this information to us, please be advised that the applicable Customer may choose to ignore applications for positions that do not contain the requested information.
Communications With You. We collect information that you provide to us when we communicate with you such as through a web form, in an email, in a chat with our Candidate AI Agent, or other form of electronic communication. This information may include a recording or transcript of the communication/chat. Additionally, we work with one or more third parties to facilitate communications (including text messages) between Customers and Applicants, and we receive information about these communications including the date and time of the communication, the parties’ phone numbers, and the content of the communications.
Log Data and Metadata. We maintain logs of when and how you complete important steps in the application process or take certain actions using the Services, such as sending a message, completing application steps, or uploading documents. We may collect log file information about your browser or mobile device each time you access the Services, including information such as your Internet Protocol (“IP”) address, browser type, information about your mobile device, including unique device identifier, referring/exit URLs, time you visit the Services, and how you interact with links on the Services, domain names, landing pages, pages viewed, and other such information.
Information from Third Parties. We may obtain additional information about you from third parties such as our Customers, marketers, partners, researchers, social networks, data services companies (e.g., for data enhancement) and others. We may combine information that we collect from you with information about you that we obtain from such third parties and information derived from our Services.
Office Visitors and Event Participants. We collect personal data about visitors to our physical offices and events, which may include: Contact Information, such as name, email address, mailing address, and telephone number; Professional Information, such as job title, job function, company name, professional background, and nature of the relationship with us; Visit Information, such as the purpose of the visit and any restrictions or preferences while on premise (such as dietary restrictions); and/or Security Information, such as a copy of a government ID and a record of the visitor’s access to our office or event, any use by the visitor of our computer systems, and images or video recordings of the visitor while on premises (where permitted by law).
Cookies, Web Beacons, Analytics, and Similar Mechanisms. We, our Customers, and third-party partners may automatically collect certain types of usage information when you visit our Platform or use our Services. Among other things, these technologies allow us to offer you a more tailored experience while using our Services now and in the future by understanding and remembering your particular browsing and usage preferences. By clicking “Accept,” you agree to our use of cookies and tracking technologies and the sharing of information. You may revoke or change your consent at any time. For more information, please review our Cookie Statement here.
Analytics and Usage. We may also collect analytics and usage data, or use third-party analytics tools, to help us measure traffic, conversion, engagement and usage trends for the Services. These tools collect information sent by your browser or mobile device, including the pages you visit, your use of third-party applications, and other information that assists us in analyzing and improving the Services.
Global Privacy Control and Do Not Track. Global Privacy Control (“GPC”), also known as Do Not Track, is a browser and/or device setting that notifies websites or other digital services of a user’s privacy preferences, such as not to share or sell personal data without their consent, by sending a signal to each website a user visits. GPC and Do Not Track signals, protocols and processes are not yet uniform, do not have widely recognized and agreed standards domestically or internationally, and their regulation is nascent. We continue to monitor developments with respect to GPC and Do Not Track requirements and are taking commercially reasonable steps to honor such requests.
Collection Across Multiple Devices. Sometimes, Fountain and its service providers may use the information we collect—for instance, log-in credentials, IP addresses, hashed email addresses, and unique mobile device identifiers—to locate or try to locate the same unique users across multiple browsers or devices to offer the Services, better tailor content, features, and advertising, and provide you with a seamless experience across the devices you use to access the Services.
Location Information. We may collect and share information about your location, including general information (e.g., IP address, ZIP code), and, with your permission in accordance with your device settings, settings in your account or made through the Services, or otherwise, precise geolocation information, and may use that information to customize the Services with location-based information, advertising, and features. For example, if your IP address indicates an origin in downtown San Diego, the Services may recommend positions, certification programs, or other services and opportunities in the San Diego area.
Information Providers: We may from time to time obtain information from third-party information providers to correct or supplement personal data we collect. For example, we may obtain updated contact information from third-party information providers to reconnect with you.
Publicly Available Information: We may collect personal data from publicly available sources, such as information you publicly post or tag us in on social media sites or elsewhere online, and information contained in public records databases, such as government records or public review websites, to supplement the personal data identified above. We will use this information to conduct market research, verify your identity, prevent fraud, and improve our services.
3. HOW FOUNTAIN USES INFORMATION IT COLLECTS
We process your Personal Information for a variety of lawful bases and legitimate business purposes, in most instances with your express prior consent, or otherwise as a service provider relying on the consent you have provided to the Customer with whom you are applying, as outlined below.
To Provide the Services
We use information we collect, including Personal Information, to develop, operate, maintain, analyze and improve, and provide the Services and Platform. This includes posting available and relevant positions, collecting and processing responses to application questions, completing application and onboarding documents, facilitating communication on the Platform, analyzing usage and reporting Platform use and application data to Customers, and operating automation tools to enable high-volume hiring and retention.
Additionally, Fountain may use your information, including Personal Information to:
Manage accounts, create Applicant profiles, service disruptions, and to respond to questions, comments, and other requests.
Display relevant and available opportunities to Applicants.
Identify and display relevant and available Applicants to Customers.
Send communications on behalf of Applicants and Customers, including through phone, text, email, and other messaging platforms.
Provide updates and relevant communications regarding job opportunities, interview requests, application reminders, and/or jobs of interest to you.
Measure interest in Fountain Services and provide detailed analytics reporting to our prospective and current Customers, investors, directors, and potential business partners.
Measure interactions with and the success of Customer application workflows and retention methods, and provide enhancements based on interactions through the Platform and other Services.
Develop new products or Services or improve existing products and Services, including research and development efforts and to improve the features, functionality, and capabilities of our Services, including Fountain’s Candidate AI Agent.
Conduct background checks, certification and credential verification, drug screening, work authorization and eligibility verification, identity verification, tax matters, and other pre-employment screening.
Comply with legal requirements, including a court order, law or legal process, respond to government or regulatory requests.
Prevent potentially prohibited, detrimental, fraudulent, or illegal uses of the Services, to enforce our Terms of Service, and for other internal control matters.
Tailor content, offers, features, and Service capabilities (, which may include the delivery of our marketing content to you on third-party websites after you use our Services.
Monitor, prevent, and detect fraud and combat spam or other malware or security risks.
For our ordinary business operations, including human resources, recruiting, equity investments, and business research and outreach.
Establish, exercise, or defend our legal rights where it is necessary for our legitimate interests or the legitimate interests of others (e.g., to enforce compliance with our Terms of Service, Privacy Policy, or to protect our Services, Users, or others).
For other purposes disclosed at the time you provide Personal Information.
Otherwise with your consent.
To Communicate With You
We may use the information we collect, including your Personal Information, to communicate with you through email, phone, text, our Candidate AI Agent chat, or other messaging platforms (e.g., WhatsApp), or to permit Customers or other Fountain Users to send you such messages, and to follow up with you to offer information about our Services, your account, employment opportunities with Fountain or our Customers, or for such other purposes and through such other means as you may provide consent. We may also send you Services-related emails or messages (e.g., account verification, transactional communications, change or updates to features of the Services, technical and security notices).
We may also send you marketing regarding our products and services, or products and services that we market on behalf of another company. If you want to stop receiving promotional materials, you can email privacy@fountain.com, exercise applicable rights under any Data Privacy Laws and State Data Privacy Laws, follow the unsubscribe instructions at the bottom of any email from us.
To Prioritize Applicants for our Customers
If our Customer opts in, Fountain will automatically analyze Applicant data based on the hiring preferences of our Customers in order to prioritize applications for our Customers’ review. Application priority is determined by our Customers’ preferences or hiring patterns, as well as by how complete your profile or application is. They do not constitute an assessment of who the best or proper candidate is for any position; they only organize applications according to the Customers’ instructions.
For Fountain’s Candidates, Current and Former Employees, and Independent Contractors, to Administer your Labor and Employment Relationship with Us
We use information we collect, including Personal Information, in the course of the recruitment, employment and offboarding processes to administer employment and employment-related activities, including:
Establishing, administering, and terminating all aspects of your employment relationship (e.g., payroll, offering benefits, stock administration, travel, expenses, professional development, performance management, and all other human resources-related processes);
Provisioning accounts and other technology and tools for your use in the course of employment and providing services to Fountain;
Maintaining entries in various Fountain services and directories, which may contain Personal Information like your name, location, photo, job title, and other contact details;
Complying with Fountain’s internal policies and controls, applicable legal and regulatory requirements, and conducting internal investigations;
Communicating with you, your designated contacts, and other known family members or beneficiaries in the case of an emergency;
To comply with applicable legal or regulatory requirements;
Maintaining the safety of our premises, personnel, and visitors, and to prevent, deter, and if necessary, investigate, unauthorized physical access, including unauthorized access to secure premises, IT infrastructure, or theft of equipment or assets;
Assessing your suitability and eligibility for work, and your respective performance on assignments; and
Other purposes disclosed to you from time-to-time upon the collection of your Personal Information.
Anonymized, De-Identified, and Aggregate Information
Our use of anonymized, de-identified, or aggregate information is not subject to the restrictions under this Policy, and we use this data regularly in the ordinary course of our business.
4. LEGAL BASES FOR USE OF YOUR INFORMATION
If you are located in the European Economic Area (“EEA”), please note that the legal bases under the GDPR for using the information, including your Personal Information, we collect through your use of the Services are as follows:
Where use of your information is necessary to perform our obligations under a contract with you (for example, to comply with the policies and agreements (like this Policy and our Terms of Service) which you accept by using the Services)
Where use of your information is necessary for our legitimate interests or the legitimate interests of others (for example, to provide security for our Services; operate our Services; prevent fraud; analyze use of and improve our Services; and for similar purposes);
Where use of your information is necessary to comply with a legal obligation; and
Where we have your consent to process data in a certain way.
5. HOW FOUNTAIN MAY DISCLOSE YOUR INFORMATION
To Facilitate Your Job Search and Applications
We may share your Personal Information:
With the Customer who listed an opportunity relevant to you based on your account settings or past activity on our Platform and any position that you have applied for if you instruct the Services to submit the information and/or application on your behalf;
With the service providers or other representatives of a Customer with whom you are applying in accordance with their application criteria, such as a background check or identity verification service, credential verification service, unform provider, etc.;
To obtain and verify your electronic signature where appropriate to a particular position application, or where otherwise requested by a Customer in connection with a certain type of position;
To enable, effect, and facilitate messaging and conversation between Applicants and Customers;
To provide our Customers with the opportunity to leverage a learning management system, uniform and material ordering service, or other service provider to assist with onboarding an Applicant;
With an Applicant’s consent or at an Applicant or Customer’s direction.
With Third-Party Service Providers
Fountain uses third-party service providers to operate our Platform and Services (including, but not limited to, fulfilling Fountain User requests, hosting, analytics, maintenance, security, customer service, marketing, sweepstakes, survey, promotional and email services, and customer and technical support), and those third-party service providers may have access to Personal Information in the performance of such services.
Where required by applicable law, Fountain has executed appropriate contracts with the service providers that prohibit them from using or sharing personal information except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements. A sample of material service providers that may have access to Personal Information are set forth here.
With the Public
To the extent that we provide forums, blogs, or bulletins that allow you to post user-generated content, such content may become available to the public and to other members of the Services. If you remove information that you posted to the Services, copies may remain viewable in cached and archived pages of the Services, or if other Fountain Users have copied or saved that information.
To Administer the Labor and Employment Relationship with Our Candidates, Current and Former Employees, and Independent Contractors
We only disclose Personal Information to those who require access to perform reasonably necessary services and those incidental to the administration of employment-related activities, such as human resources functions (compensation, benefits, evaluations, etc.), IT services/security, recruitment, stock administration, travel management, and emergency communications, tax and accounting, and general business management. For example, we may share information about an employee and their beneficiaries and/or family members, including names, genders, dates of birth, and similar information, with an insurance company where you have enrolled in a health benefit program offered by us. Fountain does not sell Personal Information that we collect or process as part of the recruitment or employment process.
Prior to authorization third-party access to your Personal Information, we will implement appropriate measures to provide assurance that such information is used in a manner consistent with this Policy, the agreements governing your employment or contracting with us, and with applicable law. When we process Personal Information that is “sensitive” under applicable law, this information will only be transferred outside your country if permitted by applicable law, including Data Privacy Laws.
Other
Additionally, we may share information about you in these instances:
In connection with or in contemplation of a company transaction, such as a merger, sale of company assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business by another company or third party or in the event of a bankruptcy or related or similar proceedings; and
As required by law or subpoena or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement, including, but not limited to, court orders, judicial or other official government requests, subpoenas, or warrants; (b) to enforce this Policy or our Terms of Service or to protect the security or integrity of our Services; and/or (c) to exercise or protect the rights, property, or personal safety of Fountain, Fountain Users, or others.
Anonymized/De-Identified Information
We may also aggregate or otherwise strip data of all personally identifying characteristics. Such activities will result in the data no longer constituting Personal Information. Our disclosure of anonymized, de-identified, or aggregate information that no longer constitutes Personal Information is not subject to any restrictions under this Policy, and we may disclose it to others without limitation for any purpose.
6. RETENTION OF YOUR INFORMATION
Fountain retains the Personal Information it receives, as described in this Policy, for as long as you use the Services and/or Platform, as necessary to fulfill the purpose for which the Personal Information was collected, provide our Platform and Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.
For Fountain’s candidates, current and former employees, and independent contractors, your data is retained for as long as needed to fulfill the purposes described in this Policy with respect to your employment or employment-related relationship, or as otherwise required by law. Typically, this means we keep your personal data until the end of your work relationship with us plus a reasonable period of time afterwards to respond to employment- or work-related inquiries or to deal with any legal matters (such as judicial or disciplinary actions), document the proper termination of your employment or work relationship (such as to tax authorities), or to provide you with ongoing pensions or other benefits.
Upon receiving a request from you (whether directly or, where Fountain is a data processor, indirectly through the data controller entity), or where applicable, your authorized agent, Fountain will endeavor to promptly delete your Personal Information. Please note, however, that there might be latency in deleting information from Fountain’s and its subprocessors’ servers and backed-up versions might exist after deletion. Please also note that certain of your information may be shared with other users, certain information may be de-identified or otherwise augmented so that it cannot be reasonably used alone or in conjunction with other data to identity you or your household or may otherwise cease to be Personal Information.
7. YOUR CHOICES AND RIGHTS
You may have certain rights with respect to your Personal Information, in addition to any rights discussed elsewhere in this Policy. Please note your rights and choices vary depending upon factors like your location, your country/state of residence, the type of Personal information at issue, and whether the Personal Information is a Customer Record or Fountain Record, among other factors.
Candidate AI Agent
Use of Candidate AI Agent is entirely optional and you can opt-out at any time by ending the chat. Depending on where you live, you may have additional rights and choices with respect to your Personal Information collected through your use of Fountain’s Candidate AI Agent. Please refer to the other Sections of this Policy regarding such rights.
How to Control Your Communications Preferences
You can stop receiving promotional email communications from Fountain, a Customer, and/or an affiliated third party by clicking on the “unsubscribe” “do not sell my personal information” or similar link provided in such communications, by texting a reply of “STOP”, by adjusting your account settings to reflect your communications preferences, or by contacting us as described below. We make every effort to promptly process all unsubscribe requests. You can text "HELP" at any time for more information about our messaging program.
Note that you will continue to receive Service-related communications (e.g., account verification, transactional communications, changes/updates to features of the Services, technical and security notices). Removing your name from the email list may take a reasonable amount of time.
Also note that others, such as Fountain’s Customers or Fountain’s and Customers’ service providers, may contact you through or outside of Fountain’s Services and Fountain may not be able to control your preferences for those types of communications. Contact the relevant message sender directly to learn more about how to opt out of communications from them.
Rights Pursuant to Applicable Data Privacy Laws
Depending on your state/country of residency and the Personal Information at issue, you may be able to exercise certain legally mandated rights related to your Personal Information. Please refer to the other Sections of this Policy to determine your eligibility or submit a request through our privacy request form here.
Account Information
We encourage you to periodically review and update your settings and profile information to reflect your job and communication preferences. You can likely access these settings by logging in. If you would like us to close your account, you can reach out to us as described below and we will do so.
8. ADDITIONAL INFORMATION FOR RESIDENTS OF CALIFORNIA, VIRGINIA, COLORADO, CONNECTICUT, AND UTAH
California law requires us to provide California residents with certain specific information regarding how we collect, use, and share “personal information” as such term is defined in the California Privacy Rights Act and its implementing regulations (“CPRA", which amended the California Consumer Privacy Act (known as the “CCPA”)). Following California’s passage of the CCPA, other states have passed similar data privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”), effective January 1, 2023; the Colorado Privacy Act (“CPA”), effective July 1,2023; the Connecticut Data Privacy Act (“CDPA”), effective July 1, 2023; and the Utah Consumer Privacy Act (“UCPA”), effective December 31, 2023.
For clarity and ease of reference, we may refer to CPRA, VCDPA, CPA, CDPA, and UCPA collectively as “State Data Privacy Laws”. In the event that one or more State Data Privacy Laws offers more or enhanced rights, privacy, or protections than the State Data Privacy Law applicable to you, we will endeavor to provide you with those additional and/or enhanced rights, privacy, or protection, though we may not be legally obligated to do so.
Sale of Information
CPRA and other State Data Privacy Laws sets forth certain obligations for businesses that “sell” personal information, as “sell” and “sale” are defined in CPRA and the regulations issued thereunder (together with analogous State Data Privacy Laws and their implementing regulations). While Fountain does share Personal Information with certain of its service providers and subprocessors to perform the Services and maintain the Platform as described in this Privacy Policy, Fountain does not “sell” personal information as defined under CPRA and these other State Data Privacy Laws (in other words, we do not accept money or other things of value in exchange for your Personal Information).
California “Shine the Light” Disclosure
The California “Shine the Light” law (Cal. Civ. Code §1798.83) gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the “Shine the Light” law) with third parties for their direct marketing purposes. Fountain does not share your personal information (as defined in the “Shine the Light” law) with third parties for their own direct marketing purposes.
“Sensitive” Personal Information
Fountain may collect, on its own account and/or on behalf of Customers, Personal Information that may be classified as “sensitive” under certain State Date Privacy laws and other privacy laws. Personal Information that is classified as “sensitive” may be supplied as part of a job application or to facilitate consented to background checks, credential verification and/or other reporting, provided by a third-party to supplement information provided by you, or provided by various service providers, such as benefits providers or insurers and may include one or more of your:
social security, driver’s license, state identification card, or passport number.
account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
precise geolocation.
racial or ethnic origin, religious or philosophical beliefs, or union membership.
contents of mail, email, and text messages (sent through our Platform between you and the business with whom you are applying, for example).
Information concerning health, sexual orientation, or sex life (in connection with applying for and receiving health, fertility or other benefits available from an employer, for example).
How We Source, Use, Disclose and Retain Personal Information for Business Purposes
The chart below details the categories of Personal Information we collect, the sources of such Personal Information, and how we use, share and retain such information for Fountain’s business purposes.
| Categories Personal Information | Source(s) | Purposes and Uses | Disclosure and Sharing | Retention |
|---|---|---|---|---|
| Identifiers, including Account Registration Information and Contact Information, such as name, date of birth, physical and mailing address, passwords and usernames, email addresses, phone numbers, wireless device information, social networking and messaging handles and usernames, and security questions and answers | - You - Linked Social Media - Linked Wallets and other Accounts - Third-Party Service Providers - Customers |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent - Customers |
|
| Application Information., including Demographic and Statistical information, such as responses to and documents uploaded to application questions, results of background checks, work authorization and identity verification, gender, gender expression, sexual preferences, race, age, date of birth, military and veteran status, nationality, disability information, criminal history information, educational history, employment history, professional licenses and memberships, schedule and availability, access to transportation, and responses to tests and surveys | - You - Governmental Authorities - Third-Party Providers - Customers |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Customers - Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
|
| Sensitive Personal Information Identifiers and Employment Eligibility Information, such as photographs, driver’s license number, passport number, alien registration number, operator’s license number, Social Security Number, other state or federal-issued identification numbers, and information you provide on tax and other government forms | - You - Governmental Authorities - Third-Party Providers - Customers |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Customers - Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
|
| Customer Service and Other Communications Information, such asquestions, responses and other messages sent through our Platform or Services or otherwise through online forms, by email, over the phone, or by post; and summaries or recordings of your interactions with our customer support team | - You - Third-Party Providers - Customers |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Customers - Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
|
| Device Information and Identifiers, Connection and Usage Data and other internet or other electronic network activity, such asIP address; browser type and language; operating system; platform type; device type; software and hardware attributes; download and browsing activity, dates and times of access, pages viewed, forms you complete or partially complete, search terms, interaction with web and messaging content, and other similar information | - You - Customers - Third-Party Providers - Cookies, pixels, beacons, tags and other tracking technologies |
- Provide, secure, maintain, and improve the Platform and Services - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Service providers - Customers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
|
| Geolocation Information, such as city, state, country, and ZIP code associated with your IP address or derived through Wi-Fi triangulation, and, with your permission in accordance with your device settings, precise geolocation information from GPS-based functionality on your devices | - You - Customers - Third-Party Providers - Linked Social Media - Cookies, pixels, beacons, tags and other tracking technologies |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Customers - Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
|
| Other Information, e.g., any other information you choose to directly provide in connection with your use of the Platform and Services | - You - Customers |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Customers - Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
|
| Inferences, such as preferences based on your activity on the Platform and with the Services, machine learning associated with analyzing the categories of information enumerated in this table of disclosures, and automated decision-making based on the foregoing. | - You - Customers - Third-Party Providers - Linked Social Media - Cookies, pixels, beacons, tags and other tracking technologies |
- Provide, secure, maintain, and improve the Platform and Services - Recruiting, hiring, onboarding, retention, and HR-functions - Communicate with you - Fraud prevention, compliance and legal purposes - Analytics and Reporting |
- Customers - Service providers - Third parties for legal purposes - With entities in the event of a business transaction (or contemplation thereof) - With your consent |
Privacy Rights for Residents of California, Virginia, Connecticut, Colorado, Utah, and Residents subject to other State Data Privacy Laws.
If you are a resident of California, Virginia, Connecticut, Colorado, or Utah, applicable State Data Privacy Laws require us to provide you with some additional information about your rights with respect to your “personal information” (as defined in CPRA and similar State Data Privacy Laws). Specifically, CPRA, provides you with the right to:
know what personal information we collected about you during certain periods, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we collected about you;
delete personal information that we collected from you, subject to certain exceptions;
correct inaccurate personal information that we maintain about you;
opt-out of the sale or sharing of your personal information, to the extent we sell or share your personal information;
limit the use or disclosure of sensitive personal information, to the extent we use such personal information beyond certain express uses, such as in furtherance of providing you our Platform and Services and ensuring their security and integrity;
receive non-discriminatory treatment for the exercise of privacy rights conferred by CPRA, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their rights described above or otherwise provided in CPRA.
One or more of the above rights may be available, in the same or substantially the same form, under one or more of the other State Data Privacy Laws in effect from time to time. Fountain respects the privacy of its candidates, its current and former employees, its Customers and their Applicants, and other users of the Platform and Services and will endeavor to honor the above requests regardless of state of residency.
If you would like further information regarding your legal rights under CPRA or any other State Data Privacy Law or would like to exercise any of the rights available under such laws, please contact us at privacy@fountain.com or visit our self-service privacy request form here.
We will honor the requests described above and otherwise available to you under applicable Data Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why. With regard to Customer Records, Applicants should direct requests to exercise applicable rights to the Customer on whose behalf we handle the subject Personal Information. If we receive a request from an Applicant directly in relation to Customer Records, we may refer that request to the appropriate Customer(s) and await each such entity’s instructions on how to process the request.
Requests Submitted by Authorized Representatives.
You may submit a request through someone holding a valid Power of Attorney or an authorized agent acting on your behalf. Authorized agents must have, and provide us with, written permission to make a request on your behalf and must provide necessary information to verify your own identity directly with us. We will require any purported authorized agent to submit proof of authorization to make requests on your behalf.
Annual Disclosures under CPRA.
Fountain makes the following disclosure under Section 7102(a)(1)(A) of the CPRA regulations for the prior calendar year, which disclosures reflect the respective requests received by Fountain from all individuals and which were substantively responded to within five (5) business days on average (mean):
| Request Type | Received | Denied | Processed Wholly | Processed, In Part |
|---|---|---|---|---|
| Request to Delete | ||||
| Request to Correct | ||||
| Request to Know | ||||
| Request to Opt-Out | ||||
| Requests to Limit |
9. ADDITIONAL INFORMATION FOR NEVADA RESIDENTS
Under Nevada law, certain Nevada residents may opt out of the “sale” of “covered information” (as such term is defined under Nevada law) for monetary consideration to a person for that person to license or sell such information to additional persons. “Covered information” includes first and last name, address, email address, phone number, Social Security Number, or an identifier that allows a specific person to be contacted either physically or online.
We do not engage in such activity; however, if you are a Nevada resident who has purchased or leased goods or services from us, you may submit a request to opt out of the sale of your covered information under Nevada law by emailing us at privacy@fountain.com. Please note we will take reasonable steps to verify your identity and the authenticity of the request.
10. ADDITIONAL INFORMATION FOR NON-U.S. RESIDENTS
Fountain only collects, processes, stores, and retains as much Personal Information as needed for the specific, identified purposes described in this Policy and/or our respective Customer’s privacy policies that may be applicable to your use of our Services. Fountain will not use your Personal Information in any way that is incompatible with the specific, identified purposes described in this Policy.
Personal Data Transfers Outside of the EEA, the UK, and Singapore
Fountain operates globally and, to facilitate our global operations, we may transfer your Personal Information to, and store, process, and/or access your personal information in accordance with applicable law from, the various global locations in which Fountain and/or its personnel operate. This includes the United States. Non-EEA countries may not offer the same level of personal data protection as EEA countries.
If you are located in the EEA, UK, Singapore or other regions with Data Privacy Laws governing data collection and use that may differ from United States Data Privacy Law, please note that we will transfer information, including Personal Information, to a country and jurisdiction that does not have the same Data Privacy Laws and related rights and protections as your jurisdiction, and you consent to the transfer of information to the United States or any other country in which Fountain, its subprocessors and/or other service providers maintain facilities and the use and disclosure of information about you as described in this Policy.
When your Personal Information is transferred outside the EEA, we will put in place adequate safeguards to ensure that such transfer is carried out in compliance with applicable data protection rules. An adequate level of protection for your Personal Information and other data may be accomplished using various means, including, where appropriate:
notwithstanding the decision of the Court of Justice of the European Union in Case C-311/18, adhering to the EU-U.S. Data Privacy and the UK extension to the EU-US DPF and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce;
relying on a formal decision by the European Commission that a certain country ensures an adequate level of protection for personal data (a full list of such decisions may be accessed online here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm);
entering into appropriate data transfer agreements based on language approved by the European Commission, such as the Standard Contractual Clauses (2021/915/EU, 2010/87/EC and/or 2004/915/EC), or the ICO and UK Parliament, such as the international data transfer agreement (IDTA) and the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum), which are each available upon request at privacy@fountain.com;
implementing appropriate physical, technical and organizational security measures to protect personal information against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing;
taking other measures to provide an adequate level of data protection in accordance with applicable law.
By choosing to use THE PLATFORM OR ANY OF our Services, you expressly agree that any dispute over privacy or the terms contained in this Policy will be governed by the laws of the State of California without regards to its conflict of laws principles, and the adjudication of any disputes arising in connection with Fountain or its Services will be in accordance with this Policy and Fountain’s Terms of Service.
Rights of Access, Portability, Rectification, Erasure, Withdrawal, and Restriction/Limitation.
You may have the right to inquire as to whether Fountain is processing Personal Information about you, request access to that Personal Information, request your information in a portable format, restrict or limit certain processing, and ask that we correct, amend, or delete your Personal Information where it is inaccurate. You may also have the right to withdraw your consent where we previously obtained your consent for certain processing/uses without this withdrawal affecting the lawfulness of any processing that took place prior to the effectiveness of your withdrawal.
You can exercise such rights by accessing, removing, supplementing, and/or correcting the relevant information in your account, submitting a request by emailing privacy@fountain.com, or by submitting a privacy request here. Note that in some cases we may not be able to erase your Personal Information, in which case we will let you know if we are unable to do so and why.
Accessing and Modifying Your Personal Information.
You may view and modify your personal information through your account settings. You may also submit a data subject access request through our privacy request portal here.
If at any time you believe that an item of Personal Information about you is inaccurate and it cannot be updated through account settings, please contact us as described above as soon as possible with a description of the inaccuracy and the desired correction. We are committed to helping to maintain the accuracy and integrity of Personal Information we hold about you and endeavor to respond to rectification requests in a reasonable timeframe. Note that we may not be able to modify your information in all circumstances. For example, information we collect in the course of providing the Services is shared with a Customer and we do not control that information once it has been shared with the Customer.
Exercise of Rights Generally.
We will honor the requests described above and otherwise available to you under applicable Data Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We will usually, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why.
If you are not satisfied with our response to any of your requests, you have the right to make a complaint to the data protection authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen. The contact details of each Data Protection Authority can be found at the following website: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm.
11. SECURITY
Fountain cares about the security of your information and takes measures to preserve the integrity and security of all information collected through the Services. However, no security system, means of electronic or physical storage, or method of transmission over the internet is absolutely secure and we cannot guarantee the security of our systems. By using our Services, you acknowledge and accept that we cannot guarantee the security of your information and that use of our Services is at your own risk.
When you sign up for an account, you may be required to establish a username and password. If you create an account with us, you are responsible for maintaining the confidentiality of your account password and for any activity that occurs under your account. We are not responsible for any loss or damage arising from your failure to maintain the confidentiality of your password.
12. CHILDREN’S PRIVACY
Fountain does not knowingly collect, process, maintain or solicit any data, Personal Information, or other information from anyone under the age of 16 or knowingly direct the Services to such persons or otherwise knowingly allow such persons to use the Services. Any individuals under the age of 18 must have consent from their parent or legal guardian to provide Personal Information to Fountain or otherwise use the Services from their parent or guardian. If we learn that we have collected Personal Information or other data from a child under age 16, we will delete all such information promptly upon becoming aware of the same. If you believe that we might have any information from a child, please contact us as described below.
13. CHANGES TO THIS POLICY
Fountain may modify or update this Privacy Policy from time to time to, among other things, reflect changes in our or third parties’ business and practices, comply with changes in law, or otherwise. WE encourage you to visit this page periodically and review any changes to the Privacy Policy or to eternally refresh your understanding of the matters herein. When we change the Privacy Policy, we will update the ‘last updated’ date at the top of this page. If we make a material change to this Policy, we will provide you with notice in accordance with legal requirements. By continuing to use the Services, you are confirming that you have read and understood the latest version of this Policy.
14. EU-US AND THE UK EXTENSION TO THE EU-US DPF AND THE SWISS-US DATA PRIVACY FRAMEWORK
Fountain complies with the EU-U.S. Data Privacy Framework(EU-US DPF) and the UK Extension to the EU-US. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union,UK and Switzerland to the United States. Fountain has certified to the U.S. Department of Commerce that it adheres to the EU-US Data Privacy Principles with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Fountain has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Policy and the EU-U.S. DPF and the UK extension Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit the following website: https://www.dataprivacyframework.gov/ We ensure that the DPF Principles, as applicable, apply to all Personal Information about you that is subject to this Policy and is received from the European Union,UK, the European Economic Area, and Switzerland.
Under the EU-U.S. DPF and the UK Extension to the EU-US DPF, and the Swiss-U.S. DPF, we are responsible for the processing of information about you we receive from the EU,UK and Switzerland and onward transfers to a third party acting as an agent on our behalf. We comply with the DPF Principles for such onward transfers and remain liable in accordance with the DPF Principles if third-party agents that we engage to process such information about you on our behalf do so in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage. Fountain may disclose data, including Personal Information, in response to lawful requests by public authorities, and to meet national security or law enforcement requirements.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF Principles, Fountain commits to resolve complaints about our collection or use of your Personal Information. European Union, including UK and Swiss individuals with inquiries or complaints regarding our DPF policy should first contact Fountain’s DPO at:
Email: privacy@fountain.com with a copy to legal_notices@fountain.com; or
Postal Mail: OnboardIQ, Inc. d/b/a Fountain,
Attention: Data Protection Officer
275 Sacramento St, 3rd Floor
San Francisco, CA, 94111
Fountain has further committed to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.
You may seek independent dispute resolution from the appropriate body designated to address complaints and provide appropriate recourse free of charge to you. For individuals protected under the EU-U.S. DPF Framework and the UK Extension to the EU-U.S. DPF, contact the European data protection bodies listed here. For individuals protected under the Swiss-U.S. DPF, you may contact the Swiss Federal Data Protection and Information Commissioner, here. We are subject to the investigatory and enforcement powers of the US Federal Trade Commission (FTC).
Under certain conditions, if you are not satisfied with the above recourse mechanism, you may be able to invoke binding arbitration. See DPF Program Annex 1 at https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.
15. HOW TO CONTACT US
If you have any questions about this Policy, Fountain, or the Services, or you would like to exercise any of your rights under applicable Data Privacy Laws with respect to your Personal Information, please contact us by regular mail, email, or phone, at:
OnboardIQ, Inc. d/b/a Fountain
Attention: Data Protection Officer
275 Sacramento St, 3rd Floor
San Francisco, CA 94111
(415) 854-7333