Automattic Job Applicant & Candidate Privacy Notice

Effective Date:  August 2026

Hi there! This Job Applicant Privacy Notice (“Notice”) explains how Automattic Inc. and its group companies (together, “Automattic,” “we,” “us,” or “our”) collect, use, disclose, and retain personal information about people who apply for employment, internships, or other engagement opportunities with us (“applicants,” “candidates,” or “you”).

1. Who’s Who and What This Privacy Notice Covers 

This Notice is a standalone document specific to our recruitment and hiring process. This Privacy Notice does not apply to your use of our other products and services (that’s covered in our Privacy Policy), or information we collect when you’re a visitor to one of our user’s websites (that’s covered in our Privacy Notice for Visitors to our Users’ Sites). If you are ultimately hired, the personal information we collect about you as an employee will instead be governed by our internal employee privacy notice, provided to you separately at that time.

2. Who Is Responsible for Your Information

Automattic’s recruiting operations are global, and the Automattic company responsible for your personal information is the Automattic entity that would be responsible for your employment if you receive an offer. You can ask us which entity applies to you at any time by contacting us at talent@automattic.com. 

You should note that for individuals whose data is controlled by an entity other than Automattic Inc, Automattic Inc. also acts as controller or joint controller for certain related processing carried out centrally on a global basis, such as applicant tracking, background screening, and assessment administration.

3. Information We Collect

We strive to only ask for the  information we need to process your job application – for example, to review your background, evaluate prior work or references (such as on LinkedIn or GitHub), or to comply with applicable laws and regulations. We may collect different types of personal data about you depending on the type or seniority of the role you’ve applied for and/or your geographic location. 

We collect your information from four sources: 

  1. information you provide directly to us, 
  2. information we obtain from third parties (including, for example, our background screening vendors), 
  3. information we collected or created during our interactions with you (for example, during your job interviews), and
  4. information we collect or create automatically as you use our systems (for example, proxy and other systems access logs). 

3.1 Information You Provide Directly

The categories of personal data we may collect directly from you include:

  • Identity and contact information: your name, email address, phone number, and mailing address.
  • Application materials: your résumé/CV, cover letter, and any other materials you choose to submit.
  • References: contact and professional details for any references you provide.
  • Education information: the education history you disclose in your application.
  • Demographic information: gender, racial or ethnic origin, veteran status, and disability status, where you voluntarily provide this or where we are required to request it by law (for example, for equal opportunity monitoring). We do not request this information in jurisdictions where doing so is restricted, and we only use it to accommodate a disability, comply with legal obligations, protect employee health and safety, and support our diversity, inclusion, and anti-discrimination programs.
  • Professional online profiles: your LinkedIn profile and, where relevant to the role (for example, engineering and technical positions), your GitHub profile. We save the profile link and/or the professional information visible on these profiles to your candidate record in our ATS.
  • Communications with us: copies of your communications with our recruiting team, including emails, and application-portal messages.
  • Government identifiers and Financial information: if you receive an offer of employment from us, we may need to collect additional information such as passport copies, driver’s license, Social Security or other national identification number and financial account information in order to verify your identity your legal right to work in the location of the role, as well as set up systems to manage your compensation and benefits.

3.2 Information We Obtain From Third Parties

We may collect additional personal data from third parties:

  • Pre-employment assessments: If your application progresses to this stage, we may ask you to complete a pre-employment assessment administered by our third-party assessment provider, Criteria Corp, measuring cognitive aptitude and personality or behavioral traits. Criteria Corp processes your responses on our behalf and provides us with your results and, where applicable, a comparison against a benchmark group.
  • References: Where you provide references, we may collect and process any information these references provide to us about you. 
  • Background checks: Depending on your role and the jurisdiction in which you reside, we may also conduct some form of background screening. This may include a review of publicly available information (such as sanctions lists) or the use of a third party background check provider, currently Checkr, to conduct a more extensive background check. If a full background check is performed, this may include identity verification, criminal record checks, and verification of prior employment or education. We only conduct the level and type of background screening permitted under the law of the jurisdiction where the role is based, and, where required, we obtain your separate authorization before doing so.

3.3 Information We Collected or Created During Our Interactions With You

In the course of interviewing you, we also collect and create the following information:

  • Calendar and availability data: the dates, times, format, and attendees of any interviews, screening calls, or on-site visits.
  • Recordings: where permitted by applicable law, recordings of phone or video interviews, including any accompanying transcripts or automatically generated notes.
  • Interview notes and evaluations: notes, scorecards, ratings, and written feedback prepared by interviewers and the hiring panel assessing your candidacy.
  • Work-sample and exercise submissions: where applicable, any coding exercises, presentations, whiteboard exercises, or other work product you complete as part of the interview process, together with any evaluation of that work.
  • Hiring recommendations: internal recommendations, deliberations, and the rationale for hiring decisions made by the interview panel.

3.4 Information We Collect Automatically

When you visit our careers site or use our application portal, we automatically collect log and device information (such as your IP address, browser type, and access times), consistent with the practices described in Automattic’s general Privacy Policy.

4. How and Why We Use Your Information

We use information about you to:

  • Evaluate your application, including your qualifications, experience, assessment results, and professional history;
  • Verify your identity and the accuracy of information you have submitted, including through reference checks, background screening, and review of your professional online profiles;
  • Conduct legally required or risk-based screening, including sanctions/watchlist screening and/or enhanced background checks;
  • Communicate with you about your application, by phone, email, or, where you have engaged with us that way, social media platforms;
  • Comply with our legal obligations, including equal opportunity, immigration, and statutory reporting requirements;
  • If your application is successful, verify your ability to legally work in the relevant location, set up payroll, and take the other steps necessary to initiate your employment;
  • Maintain records of our hiring process and establish, exercise, or defend legal claims relating to recruitment (see Section 8); and
  • Ensure the security, integrity, and proper functioning of our recruitment systems, including detecting fraudulent applications.

5. Our Legal Bases for Processing (EU/UK GDPR)

Where the GDPR or UK GDPR applies to our processing of your information, we rely on the following legal bases:

  • Steps taken at your request prior to entering into a contract, and performance of a contract if you are hired (Article 6(1)(b));
  • Compliance with our legal obligations, such as right-to-work verification, sanctions screening, and equal opportunity record-keeping (Article 6(1)(c));
  • Our legitimate interests in running an effective, secure, and fair recruitment process, including assessing candidate suitability, preventing fraud, and establishing, exercising, or defending legal claims (Article 6(1)(f)), which we have balanced against your interests and rights; and
  • Your consent, where we ask for it, for example, for voluntary demographic/equal opportunity information (Article 9(2)(a), or, where applicable, our employment law obligations (Article 9(2)(b)). You may withdraw your consent at any time without affecting processing already carried out.

Where we process information about criminal convictions or offences as part of background screening, we do so only to the extent permitted by, and subject to the safeguards required by, the law of the relevant jurisdiction.

6. Sharing Your Information

We share your information with:

  • Our subsidiaries and group companies involved in the hiring process;
  • Our vendors who assist with the applicant vetting process, such as Checkr, Inc (background checks) and Criteria Corp (pre-employment assessments);
  • Our applicant tracking system provider and other recruitment technology vendors, who process your information on our behalf and are contractually required to protect it;
  • Regulators, law enforcement, or other parties, where required by law or to establish, exercise, or defend legal claims; and
  • A successor entity, in the event of a merger, acquisition, or similar corporate transaction, on the terms described in Automattic’s general Privacy Policy.

We do not “sell” or “share” your personal information as those terms are generally defined under applicable U.S. state  laws.  We also do not have any knowledge of any “sales” or “sharing” of the personal information of minors under 16 years of age.

7. International Data Transfers

Because our recruitment operations and vendors are based in and/or process data in the United States, your information may be transferred outside the country or region where you are located, including outside the European Economic Area (EEA) and the UK. Where this occurs, we put appropriate safeguards in place, such as the European Commission’s or UK government’s approved Standard Contractual Clauses, consistent with the approach described in Automattic’s general Privacy Policy.

8. How Long We Keep Your Information

We retain your personal information for as long as necessary to fulfil the purposes described in this Notice. To determine the appropriate retention period, we consider factors such as: the length of our recruitment process for the relevant role; our legal and regulatory obligations, including equal employment opportunity and immigration record-keeping requirements, which vary by jurisdiction; and whether we may need the information to establish, exercise, or defend a legal claim. If you are not selected for a role, we may keep your information for a further period to consider you for other opportunities, unless you ask us not to. If you accept a role with us, the information collected during your application becomes part of your employee record and is retained in accordance with our internal employee privacy notice. Once we no longer have a reason to retain it, we securely delete or anonymize your information.

9. Your Rights

If you are located in the UK, EU, or another jurisdiction with similar protections, you have the right to: request access to your personal data; request correction or deletion of your personal data; object to, or request that we restrict, our use of your personal data; request a portable copy of your personal data; and lodge a complaint with your local data protection supervisory authority.

If you are located in certain US states, you have the right to: request a copy of the specific pieces of information we hold about you and, in some states, the categories of information, sources, purposes, and third parties involved; request deletion or correction of your information; opt out of the sale or sharing of your information (we do not sell your information, as noted in Section 6); receive a portable copy of your information; and not be discriminated against for exercising these rights.

Where a hiring decision is based solely on automated processing of your assessment results without human involvement, you have the right to request human review of, and to contest, that decision. To exercise any of these rights, contact us using the details in Section 12. Please note that, consistent with Automattic’s general Privacy Policy, the appeals process for a denied rights request does not apply to job applicants.

10. Security

We take reasonable technical and organizational measures designed to protect your information against unauthorized access, use, alteration, or destruction, consistent with the practices described in Automattic’s general Privacy Policy.

11. Changes to This Notice

We may update this Notice from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice.

12. How to Contact Us

If you have questions about this Notice or would like to exercise any of your rights, please contact us via privacypolicyupdates@automattic.com.