We at Rush Street Interactive Development Estonia OÜ (RSIE) are committed to protecting the privacy and personal data of the people applying for an open position at RSIE. To this end, we only process Your personal data to the extent that is necessary and in compliance with the European General Data Protection Regulation (GDPR).

The aim of this Privacy Notice for Job Applicants (Notice) is to make sure that You are aware of how and for what purposes Your data is being processed at RSIE during the recruitment process. Should You be selected for the position, You will be provided with RSIE’s Privacy Notice for Employees, which explains the further processing of Your data for purposes of concluding an employment contract with RSIE and processing during and after the expiration of the employment relationship.

‘Personal Data’ means any and all information related to You. We collect Personal Data from You when You provide it to us, such as when You submit a job application or communicate with us as part of the application process.  We may also collect Your Personal Data from third parties authorized to share it with us, such as recruiters that share information about potential applicants.

This means that we process the Personal Data we collect from or about You during the recruitment process, such as:

• Name, phone number, home address, e-mail address
• Birth date
• Information about professional qualifications
• Employment history
• The CV You submitted and all information therein.
• Contact details for references and references feedback

We collect Personal Data from you when you provide it to us, such as when you submit a job application or communicate with us as part of the application process.  We may also collect your Personal Data from third parties, such as recruiters that share information about potential job applicants with us.

During the recruitment process, we only process data that is necessary to assess Your suitability for the position You are applying to and, in the case of a successful candidacy, for the conclusion of the employment contract.

The legal basis for the processing of Your data during the recruitment process and, in the case of a successful candidacy, for purposes of concluding an employment contract is art. 6(1)(f) GDPR. This means that the legal basis for the processing is RSIE’s legitimate interest in finding the best and most suitable candidates for the positions for which said candidates have applied to, and RSIE’s interest in concluding an employment contract with the selected candidates.

Any other processing of Your personal data will only be undertaken if there is a legal basis for it, i.e., if processing is necessary to fulfill a legal obligation to which RSIE is subject (art. 6(1)(c) GDPR). Should such a situation occur, we will notify You of it.

Additionally, You have the possibility to give consent for RSIE to further store Your data for possible future openings. This processing will then be based on Your explicit consent (art. 6(1)(a) GDPR). You are never obligated to give consent. Consent can only be given freely, and consent can be withdrawn at any time.

Access to Your personal data within RSIE is limited to employees and staff who need to access the data for the performance of their work-related tasks and duties involving the recruitment process. This is regulated in RSIE’s Internal Data Processing Policy and secured via technical access limitations.

During the recruitment process, Your data will be accessed only by those staff members of RSIE who are involved in the recruitment and hiring-related decision-making processes at RSIE, including talent acquisition personnel and relevant department heads and Head of People Operations.

We will only transfer Your data to third parties if it is necessary and if there is a legal basis for it.

For example, we may use third party service providers, such as cloud services providers, who might have access to Your personal data. These service providers will then be data processors within the meaning of the GDPR as they can only process Your data as mandated and limited by us via contractual agreements. All such third-party service contracts include confidentiality clauses to protect Your privacy.

We may transfer Your personal data outside of the European Economic Area (EEA) only if there is a legal basis for such a transfer. Should we need to transfer Your data to any country not approved by the European Commission as providing a level of protection equivalent to the GDPR, we will have conducted a transfer impact assessment prior to it. A transfer impact assessment evaluates and describes the risk involved with the transfer of Your data to countries outside the EEA, as well as supplementary measures we have taken to safeguard Your personal data.

We may transfer Your personal data to our affiliates outside of the EEA, including to recruitment personnel and department heads in the U.S, Canada, Colombia and the United Kingdom, for review and processing in connection with Your job application. We may also transfer Your personal data to third parties in the U.S for processing (e.g. Greenhouse Software, Inc.) in connection with Your job application.

We will store Your personal data until the end of the recruitment process, i.e., until a suitable candidate has been selected and an employment agreement concluded with said candidate. Should You be selected for the position for which You applied, You will be provided with RSIE’s Privacy Notice for Employees.

Subject to Your explicit consent, we may further store Your data for purposes of possibly considering You for future job openings at RSIE for one (1) year from the date of the last hiring decision.

After the end of the lawful storage period of Your data we shall delete, destroy or anonymize Your data.

To ensure the security of Your data during the lawful storage period, we employ necessary technical and organizational security measures, taking into account (i) the current level of available technology, (ii) the cost-efficacy ratio of current technology, (iii) the extent, scope, context and purposes of processing, and (iv) the risks associated with specific processing activities. Such measures include, for example, access limitations, training of all staff and employees and confidentiality clauses in employment and service contracts.

As a data subject within the meaning of the GDPR, You have the following rights* in regard to Your personal data:

• You have the right to obtain information about the processing of Your data (arts. 13 and 14 GDPR). The Notice aims to provide You with all necessary information about the processing of Your personal data during the recruitment process at RSIE, but You are always welcome to contact us with further inquiries regarding the processing of Your data by RSIE (see contact details at the end of the Notice).
• You have the right to obtain confirmation from RSIE about whether Your data is being processed and to receive a copy of the personal data undergoing processing (art. 15 GDPR).
• You have the right to request from RSIE rectification of inaccurate personal data concerning You (art. 16 GDPR).
• You have the right to request RSIE to erase Your personal data processed by us, if any of the grounds in art. 17(1) GDPR apply.
• You have the right to request RSIE to restrict processing activities regarding Your personal data if any of the grounds in art. 18(1) GDPR apply.
• You have the right to object to the processing of Your personal data on grounds relating to Your particular situation if the processing is based on legitimate interests pursued by RSIE (i.e., on the basis of art. 6(1)(f) GDPR).
• You have the right to withdraw consent at any time, if processing is based on consent (art. 7(3) GDPR).

Please note that none of the rights listed above are absolute. This means that there are exceptions and derogations that might apply in certain circumstances where processing of Your data is necessary for certain purposes. Such exceptions and derogations are stipulated in the GDPR. For example, we will not delete Your data if the data is necessary for establishing, exercising or defending legal claims (art. 17(3)(e) GDPR).

If You have any question about Your rights as a data subject, please contact us or the supervisory authority in Estonia (contacts listed below).

If You believe there to be a breach of Your rights, please contact us immediately. You have the right to bring a claim to court or to submit a complaint to the Estonian Data Protection Inspectorate.

We have the right to unilaterally modify the Notice if this should become necessary due to changes in corporate practices regarding data processing, or changes in relevant laws and regulations, or changes in guidance and best practice documents issued by relevant authorities. You will be notified of changes in the Notice that might impact You via e-mail within a reasonable period prior to the entry into force of such changes.

The controller of Your personal data is:

Rush Street Interactive Development Estonia OÜ Estonian business registry code no 16167512

If You have any questions regarding the Notice or regarding Your rights as a data subject, or if You wish to exercise such rights, please contact us at:

E-mail address: peopleops@rushstreetinteractive.com

Address: Riia 2, Tartu, Estonia, 51004

Estonian Data Protection Inspectorate

E-mail address: info@aki.ee Phone: (+372) 627 4135 Address: Tatari 39, Tallinn 10134

Last updated: March 1, 2022