This Background Check Privacy Notice("Notice") explains how Harness and its group companies("Harness," "we," "us," or "our")collect, use, store, share, and protect your Personal Data in connection withbackground checks. It supplements any other privacy notice that Harness mayprovide to you separately.
This Notice applies to you if you are:
a prospective employee who has accepted an offer of employmentwith Harness;
a current employee of Harness; or
a contractor, agent, or other individual engaged or proposed to beengaged by Harness.
It applies regardless of the jurisdiction inwhich you are based. Where local law imposes specific requirements, these areaddressed in the Jurisdiction-Specific Annex (Part 2) at the end of thisNotice.
PART 1: CORE SECTIONS
The following sections apply to allindividuals covered by this Notice.
1. ABOUT THIS NOTICE
This Notice describes the Personal Data wecollect and process in connection with background checks conducted before orduring your employment or engagement with Harness. It explains the purposes forwhich we use your data, the sources from which we obtain it, the parties withwhom we share it, and your rights in relation to that data.
2. WHO IS RESPONSIBLE FOR YOUR DATA
For the activities outlined in this Notice,Harness serves as the data controller. As the controller, Harness establishesthe reasons for and the methods used to process your personal information.
Your specific controller is determined byyour geographic location; these details can be found in theJurisdiction-Specific Annex (Part 2) located at the conclusion of thisdocument. However, for all contractors, Harness Inc. acts as the primarycontroller for their Personal Data.
Contact details:
Data Protection Officer / Privacy Contact: privacy@harness.io
Postal address:55 Stockton St, San Francisco, CA 94108, United States
We have engaged Checkr, Inc.("Checkr"), One Montgomery Street, Suite 2400, San Francisco, CA94104, USA, as our background screening provider. Checkr acts as a processor(or service provider) on our behalf, processing your Personal Data inaccordance with our instructions. In the United States, Checkr also acts as aconsumer reporting agency under the Fair Credit Reporting Act (FCRA).
3. WHY WE CONDUCT BACKGROUND CHECKS
We conduct background checks for thefollowing purposes:
Pre-engagement screening: To verify information you have providedand to assess your suitability for the role before your employment orengagement begins.
Ongoing or periodic checks: To comply with customerrequirements, contractual obligations, or applicable law during your employmentor engagement. For example, a customer mayrequire current background verification as a condition of your assignment totheir project.
Role transitions: To conduct appropriate checks when youtransition from a contractor or agent role to employment with Harness, or whenyour role or responsibilities materially change.
Workplace safety and integrity: To maintain a safe, trustworthy,and secure working environment for all individuals associated with Harness.
4. WHAT PERSONAL DATA WE COLLECT
The specific data collected depends on thenature of your role, the type of check being conducted, and what is permittedby the law of the jurisdiction in which you are based. We collect only what isnecessary and proportionate for the stated purposes.
Categories of Personal Data that may becollected include:
Identityinformation: Full name, date of birth, current and former addresses (whererequired and permitted), government-issued identification numbers (whererequired and permitted).
Employmenthistory: Current and former employers, dates of employment, job titles, reasonsfor leaving.
Inaccordance with applicable US state laws, Harness does not seek or considerpast salary or compensation history.
Educationand qualifications: Educational institutions attended, degrees andcertifications obtained, dates of attendance, professional licenses.
Professionalreferences: Names and contact details of referees, and the content ofreferences provided.
Criminalrecord information: Criminal convictions, pending charges, or relatedinformation, only where permitted by applicable law, relevant to the role,and obtained through lawful means. In many jurisdictions, criminal recordchecks are restricted or must be obtained by you directly from the competentauthority (see Jurisdiction-Specific Annex).
Creditand financial information: Credit history or financial standing, only wherespecifically required by applicable law and in compliance with local laws andregulations. Credit checks are not conducted as a matter of course.
Directorshipand regulatory information: Company directorships, regulatory sanctions,disqualifications, or adverse media, where relevant to the role.
Right-to-workinformation: Immigration status or work authorization, where verification isrequired by law.
Driving record information: Motor vehiclerecords, where driving is an inherent requirement of the role.
5. LEGAL BASIS
The legal basis on which we process your Personal Data for backgroundchecks depends on the jurisdiction in which you are based and the applicablenational law. Where the Jurisdiction-Specific Annex (Part 2) specifies a basisfor your jurisdiction, the annex prevails over this section.
Otherwise, we process your Personal Data on one of the following bases:
yourconsent; or
where consent is not the appropriate basisunder applicable law, the performance of a contract to which you are a party,or the taking of steps at your request prior to entering into a contract.
Where we rely on consent, it is sought from you separately for thebackground check. Providing it is voluntary; if you decline, we may be unableto proceed with your employment or engagement. You may withdraw your consent atany time, without affecting the lawfulness of processing carried out beforewithdrawal.
6. SOURCES OF DATA
We may collect your Personal Data from thefollowing sources:
Directly from you, through information you provide during theapplication or engagement process.
From Checkr, which may obtain information from third-party sourceson our behalf, including: former employers, educational institutions,professional licensing bodies, government agencies and public records, creditreference agencies (where applicable), and criminal record authorities (whereapplicable and lawful).
From our customers, where a customerrequests a background check and provides information identifying the individualto be screened.
7. WHO WE SHARE YOUR DATA WITH
We may share your Personal Data with:
Checkr, Inc., our background screening provider, for the purposeof conducting the check.
Harness entities, as processors.
Our customers, where the background check is conducted at aclient's request and the client has a contractual right to receive confirmationof the check's completion or results, to the extent permitted by law. In thiscase, the only information that will be provided is if the check hasbeen passed or failed.
Legal advisors, auditors, or regulators, where required by law orto protect Harness's legal rights.
Third-party sources contacted during the check (for example,former employers or educational institutions), who receive limited Personal Data necessaryto verify the information.
We do not sell your Personal Data and we donot share your Personal Data for purposes unrelated to the background check.
8. INTERNATIONAL TRANSFERS
Your Personal Data may be transferred to,stored in, and processed in countries other than the country in which you arebased. In particular, your data will be transferred to Checkr in the UnitedStates for the purpose of conducting the background check.
Where your data is transferred outside yourjurisdiction, we ensure appropriate safeguards are in place, which may include:
Standard Contractual Clauses (SCCs) approved by the EuropeanCommission or the UK Information Commissioner's Office, as applicable.
Adequacy decisions, where the destination country has beenrecognized as providing an adequate level of data protection.
Contractual protections with Checkr that require it to protectyour data to a standard consistent with applicable data protection law.
Details of the specific safeguards applicableto your jurisdiction are available upon request by contacting our DataProtection Officer.
9. DATA RETENTION
We retain your Personal Data only for as longas necessary to fulfil the purposes described in this Notice, and for anyadditional period required or permitted by applicable law. Retention periodsvary depending on local legal requirements and statutes of limitations:
Detailed screening reports:
United States: Retained for up to five (5) years following the completion of the report to comply with federal and state legal defenserequirements.
International: destroyed no later than 6 months afterhire.
Outcome record:
US and International: retained for duration of employment + 7years.
Unsuccessful candidates:
United States: Retained for at least two (2) years from the date of the employment decision to comply with equal employment opportunityregulations.
International: destroyed within 6 months of rejection.
Where local law imposes shorter or longer retention periods, we comply with local requirements.
10. DATA SECURITY
We implement appropriate technical and organizational measures to protect your Personal Data against unauthorizedaccess, alteration, disclosure, or destruction. These measures include:
Encryption of data in transit and at rest.
Access controls limiting who within Harness can view backgroundcheck results.
Contractual obligations on Checkr to maintain equivalent securitystandards.
Regular review of security practices.
Checkr maintains its own security program, details of which are available at https://checkr.com/security.
11. AUTOMATED DECISION-MAKING
Harness does not make solely automateddecisions about your employment or engagement based on background checkresults. All background check results are reviewed by authorized Harnesspersonnel before any decision is made. If a check reveals adverse information, you will be given an opportunity toreview the findings and provide an explanation before any adverse action istaken.
Where automated tools are used in any part ofthe screening process (for example, automated database searches), the resultsare always subject to human review.
12. YOUR RIGHTS
Depending on the data protection lawsapplicable to you, you may have some or all of the following rights in relationto your Personal Data:
Right of access: The right to request confirmation of whether we process yourPersonal Data and, if so, to receive a copy of that data.
Right to rectification: The right to request correction of inaccurate or incompletepersonal data.
Right to restrict processing: The right to request that we limit how we use yourPersonal Data in certain circumstances.
Right to object: The right to object to processing based on legitimate interests.Where you object, we will cease processing unless we demonstrate compellinglegitimate grounds that override your interests.
Right to data portability: The right to receive your Personal Data in a structured,commonly used, machine-readable format and to transmit it to anothercontroller, where technically feasible.
Right to withdraw consent: Where consent is the legal basis for processing, the rightto withdraw your consent at any time. Withdrawal does not affect the lawfulnessof processing carried out before withdrawal.
Right to lodge a complaint: The right to lodge a complaint with the data protectionsupervisory authority in your jurisdiction (see Jurisdiction-Specific Annex forcontact details).
Right not to be subject to solely automated decisions: The right not to be subject toa decision based solely on automated processing that produces legal effects orsimilarly significant effects.
Right not to be discriminated against: Incertain jurisdictions (including under the California Consumer Privacy Act),the right not to be discriminated against for exercising your data protection rights.
You can exercise any of these rights via our Privacy Request Center[1] . We will respond within the timeframerequired by applicable law (generally 30 days, though this varies byjurisdiction).
12. UPDATES TO THIS NOTICE
We may update this Notice from time to timeto reflect changes in our practices, applicable law, or regulatory guidance.Where changes are material, we will notify you through appropriate channels(for example, by email or through the platform used for your engagement). Thedate of the most recent update is shown at the top of this Notice.
PART 2:JURISDICTION-SPECIFIC ANNEX[2]
This annex sets out additional information that applies to you based on the jurisdiction in which you are based. If your jurisdiction is not listed, the core sections of this Notice apply.
Controlling entity: Harness Inc.
Legal basis: In the U.S., background checks are governed by the Fair Credit Reporting Act (FCRA) and applicable state and local laws. Harness obtains your written authorization before procuring a consumer report. You will receive a standalone FCRA Disclosure and a Summary of Your Rights Under the Fair Credit Reporting Act before the check is conducted.
Criminal records: Criminal record checks are permitted with your authorization. Certain states and localities impose additional restrictions, including limitations on when criminal history may be inquired about (e.g., "ban-the-box" laws), lookback periods, and mandatory individualized assessment requirements. State-specific notices are provided where required, including required notices under the California Fair Chance Act.
Additional rights: Before taking any preliminary adverse action based on a consumer report, Harness will provide you with a copy of the report and a Summary of Your Rights, and will give you an opportunity to dispute the information directly with Chekr. Under the California Consumer Privacy Act (CCPA) as amended, California residents have additional rights including the right to know and assess their data, the right to delete, the right to correct inaccurate personal information, and the right not to be retaliated against for exercising these rights.
Regulator: Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB). California: California Privacy Protection Agency (CPPA) and the California Civil Rights Department (CRD).
Controlling Entity: Harness Canada Corp.
Legal basis: Informed consent, as required by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. In Quebec, the Act Respecting the Protection of Personal Information in the Private Sector (as amended by Law 25) applies and requires explicit consent for sensitive data.
Criminal records: In this jurisdiction, we do not carry out criminal records checks (except for CFO role). We only perform checks against the global watchlists database.
Additional rights: Right to access your personal data; right to correction; right to withdraw consent; right to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial commissioner. In Quebec: right to data portability; right to be informed about automated decision-making.
Regulator: Office of the Privacy Commissioner of Canada (OPC), www.priv.gc.ca. Quebec: Commission d'accès à l'information (CAI).
Controlling Entity: Harness Technologies Israel LTD
Legal basis: Informed consent, as required by the Protection of Privacy Law. Providing your data is voluntary; declining may affect Harness's ability to proceed with your employment or engagement.
Criminal records: Criminal record checks are prohibited under Israeli law and are not conducted.
Additional rights: Right to inspect your Personal Data (Section 13, in Hebrew, Arabic, or English); right to request correction (Section 14); right to review assessment results (PPA Guideline 2/2012); right not to be required to waive access to screening results.
Controlling Entity: Harnessio R&D Labs India Private Limited
Legal basis: Consent, as required by the Digital Personal Data Protection Act, 2023 (DPDPA). Harness will obtain your explicit consent before collecting or processing your personal data for background check purposes. Where consent is not applicable, processing may occur on the basis of a legitimate use as recognized under the DPDPA.
Criminal records: Criminal record checks are conducted with your consent and in accordance with applicable Indian law. Information is obtained through lawful channels, including the verification of court records where permitted. Only information directly relevant to the role may be considered.
Additional rights: Under the DPDPA, you have the right to access your personal data; the right to correction and erasure; the right to withdraw consent at any time (without affecting prior lawful processing); the right to grievance redressal; and the right to nominate a representative.
Regulator: Data Protection Board of India (once established and operational under the DPDPA).
Controlling Entity: Harness Group UK Limited
Legal basis: Processing is carried out under the UK GDPR and the Data Protection Act 2018 (DPA 2018). The legal basis is Article 6(1)(b) UK GDPR (processing necessary for the performance of a contract or pre-contractual steps), supplemented by Article 6(1)(c) (compliance with a legal obligation) where applicable. For special category data, the basis is Schedule 1, Part 1 of the DPA 2018 (employment law obligations).
Criminal records: Criminal record checks in Great Britain and Northern Ireland are subject to strict controls under the Rehabilitation of Offenders Act 1974 and the Police Act 1997. We will not seek criminal record information beyond what is permitted by law and only request basic DBS.
Additional rights: Under the UK GDPR and DPA 2018, you have the right of access (Subject Access Request); the right to rectification; the right to erasure (in limited circumstances); the right to restrict processing; the right to data portability; and the right not to be subject to solely automated decisions.
Regulator: Information Commissioner’s Office (ICO), www.ico.org.uk.
Controlling Entity: Harness Argentina SAS
Legal basis: Processing is based on your informed consent, as required by the Personal Data Protection Law No. 25,326 (Ley de Protección de los Datos Personales) and its implementing regulations. Where consent is not required by law, processing may be based on the performance of a contract.
Criminal records: In this jurisdiction, we do not carry out criminal records checks (except for CFO role). We only perform checks against the global watchlists database.
Additional rights: Under Argentine data protection law, you have the right to access, rectify, update, and suppress your personal data (habeas data rights) free of charge. You also have the right to withdraw your consent and to lodge a complaint with the Agencia de Acceso a la Información Pública (AAIP).
Regulator: Agencia de Acceso a la Información Pública (AAIP), www.argentina.gob.ar/aaip.
Controlling Entity: Harness d.o.o. Belgrade
Legal basis: Processing is carried out in accordance with the Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "ZZPL"), which closely mirrors the EU GDPR. The legal basis is the performance of a contract or pre-contractual steps (Article 12(1)(b) ZZPL, equivalent to GDPR Art. 6(1)(b)).
Criminal records: In this jurisdiction, we perform criminal record checks only for the CFO role, in accordance with the law and only in a relevant and proportionate manner to the job description.
Additional rights: Under the ZZPL, you have the right of access; the right to rectification; the right to erasure; the right to restriction of processing; the right to data portability; and the right not to be subject to solely automated decisions. You may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection. Contact: privacy@harness.io.
Regulator: Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), www.poverenik.rs.
Controlling Entity: Harness France SAS
Legal basis: Processing is governed by the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the French Data Protection Act (Loi Informatique et Libertés, as amended). The legal bases is Article 6(1)(b) GDPR (performance of a contract or pre-contractual steps).
Criminal records: In this jurisdiction, we perform criminal record checks only for the CFO role, in accordance with the law and only in a relevant and proportionate manner to the job description.
Additional rights: All those listed under section 12 of the notice, except for the right to object. Additionally, you may also lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL).
Regulator: Commission Nationale de l’Informatique et des Libertés (CNIL), www.cnil.fr.
Controlling Entity: Harness Australia PTY LTD
Legal basis: Processing is carried out in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The legal basis is your consent and, in certain circumstances, as reasonably necessary for business purposes. Harness will notify you of the collection of your personal information in accordance with APP 5.
Criminal records: In this jurisdiction, we do not carry out criminal records checks (except for CFO role). We only perform checks against the global watchlists database.
Additional rights: Under the Privacy Act 1988, you have the right to access your personal information held by Harness; the right to request correction of inaccurate or out-of-date information; the right to withdraw your consent; and the right to complain about a breach of the APPs to the Office of the Australian Information Commissioner (OAIC).
Regulator: Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au.
Controlling Entity: Harness Brasil LTDA
Legal basis: Processing is governed by the Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13,709/2018. The legal basis is the performance of a contract or pre-contractual steps (Article 7(V) LGPD).
Criminal records: In this jurisdiction, we perform criminal record checks only for the CFO role, in accordance with the law and only in a relevant and proportionate manner to the job description.
Additional rights: Under the LGPD, you have the right of confirmation and access; the right to rectification; the right to deletion (anonymisation, blocking, or erasure); the right to data portability; the right to information about sharing; and the right to petition the Autoridade Nacional de Proteção de Dados (ANPD).
Regulator: Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.
Controlling Entity: Harness Germany GmbH
Legal basis: Processing is governed by the EU GDPR and the Federal Data Protection Act (BDSG). The legal basis is Section 26 BDSG (processing for employment-related purposes).
Criminal records: In this jurisdiction, we perform criminal record checks only for the CFO role, in accordance with the law and only in a relevant and proportionate manner to the job description.
Additional rights: All those listed under section 12 of the notice, except for the right to object. Additionally, you may also lodge a complaint with the competent German supervisory authority.
Regulator: The competent supervisory authority (Datenschutzbehörde) depends on the federal state (Land) where the employing entity is established. A list of all German supervisory authorities is available at www.bfdi.bund.de.