At Harness, we care about your privacy and are committed to protecting your personal data. This privacy notice explains what information we collect about you when you apply for a role with us or when we contact you about an opportunity, how and why we use it, and what rights you have. It applies to job candidates worldwide.
If a section below conflicts with the Country-Specific Information that applies to you, the country-specific section prevails.
1. Who we are
Harness Inc., 55 Stockton St, San Francisco, CA 94108, USA, together with its group affiliates that participate in the recruitment process, is the Controller of your Personal Data.
You can contact our Data Protection Officer:
Via email: privacy@harness.io
Via privacy portal: https://harness-privacy.relyance.ai/
2. What Personal Data we collect
2.1 How we collect your Personal Data
We collect your Personal Data when:
You apply for a role through our careers page, our applicant tracking system (Greenhouse), or in person.
We source you proactively through professional networks and recruiting platforms such as LinkedIn, ZoomInfo TalentOS, and PeopleGPT (Juicebox), based on publicly available professional information.
You apply through third-party job boards such as LinkedIn, Glassdoor or Indeed.
A current Harness employee refers you through our employee referral programme.
A recruitment agency introduces you to us.
We receive information from references you have provided, or from background-check providers at the conditional-offer stage.
2.2 Categories of personal data
We collect and use the following categories of Personal Data in connection with recruitment:
Identification and contact details: name, postal address, phone number, email, nationality.
Professional information: CV/résumé, education, qualifications, employment history, skills, professional licences and certifications.
Technical assessment data: when applicable, code submissions, evaluator comments, and a screen-recording of the technical assignment generated by our assessment platforms (CoderPad and HackerRank). These recordings do not include your face or audio.
Referral information: if you were referred to us by a current Harness employee, the referrer's identity. If you are hired, we share the referral information with Payroll for the purpose of awarding a referral bonus to the employee.
Compensation data: collected only in India, in line with local market practice.
Onboarding / identity-verification data: at the conditional-offer stage, copies of identity documents (e.g. passport / ID, social-security or equivalent number). This is described in more detail in our separate background-check notice.
Signed employment contracts (for successful candidates).
Communications you exchange with us, and technical data when you use our careers website (e.g. IP address, browser type, access logs).
We only collect Personal Data that is relevant and necessary for the purposes described below.
2.3 Special category and sensitive Personal Data
We do not actively seek special category or sensitive Personal Data during recruitment, except in the limited situations below where local law requires it.
In a small number of countries we invite candidates to voluntarily self-identify on certain demographic characteristics, solely so that we can meet equal-opportunity and diversity-reporting obligations. You are free to disclose this information or not; it is not used in selection decisions.
Country
What we ask, and why
United States
Race / ethnicity (for EEO-1 reporting under Title VII) and disability status (OFCCP Form CC-305). Collection is mandatory for us as an employer; disclosure is voluntary for you.
Canada
Self-identification on the four designated groups under the Employment Equity Act (women, Indigenous peoples, persons with disabilities, members of visible minorities). Disclosure is voluntary.
3. Why we use your Personal Data and our legal basis
We process your personal data for the following recruitment purposes:
Purpose
Legal basis (where GDPR or similar laws apply)
Assessing your suitability for the role: reviewing your application, scheduling and conducting interviews, evaluating technical assessments, and documenting recruitment decisions.
Steps taken at your request prior to entering a contract (Art. 6(1)(b) GDPR); compliance with a legal obligation where applicable (Art. 6(1)(c)).
Proactively sourcing candidates through professional platforms (LinkedIn, ZoomInfo, PeopleGPT) on the basis of publicly available professional information.
Our legitimate interest in identifying and attracting qualified candidates, particularly passive talent for specialised technical and leadership roles (Art. 6(1)(f)).
Maintaining an internal list of profiles previously identified as spam or fraudulent applications, so that we do not re-process them.
Our legitimate interest in protecting the integrity of our recruitment process (Art. 6(1)(f)).
Recruitment analytics.
Our legitimate interest in operating our recruitment function efficiently (Art. 6(1)(f)).
Verifying the information you provide, including references and (at conditional-offer stage) background checks via Sterling and Checkr.
Compliance with a legal obligation (Art. 6(1)(c)).
Communicating with you about your application and other opportunities at Harness.
Steps taken prior to a contract (Art. 6(1)(b)); our legitimate interest in efficient recruitment (Art. 6(1)(f)).
Awarding a referral bonus to a Harness employee who referred you (only if you are hired).
Steps taken prior to a contract (Art. 6(1)(b)); our legitimate interest in operating our referral programme (Art. 6(1)(f)).
Defending or bringing legal claims and protecting Harness, its employees and candidates.
Our legitimate interest in protecting our legal rights; establishment, exercise or defence of legal claims.
Where we rely on legitimate interests, we have completed a balancing assessment of our interests against your rights and freedoms and apply appropriate safeguards.
Where local law requires a different legal basis (such as consent), the Country-Specific Information section below sets that out.
4. Who we share your Personal Data with
4.1 Internal recipients
Your Personal Data is accessed inside Harness on a need-to-know basis, in particular by:
The Talent Acquisition team (full access in Greenhouse, our applicant tracking system).
Hiring Managers and Business Leaders, on a job-specific basis.
Interviewers, on an interview-specific basis.
Finance approvers, restricted to job-approval functions and without access to candidate profiles.
People Operations, IT and Payroll (Payroll only for the referral programme), as needed.
Access within Greenhouse is governed by role-based permissions and is reviewed periodically.
4.2 External recipients (processors and service providers)
We share your Personal Data with the following categories of trusted third parties, all of whom act as our processors under written data-processing terms:
Provider
Location
Purpose
Transfer mechanism
Greenhouse
USA
Applicant tracking system
EU-US Data Privacy Framework + SCCs
LinkedIn Recruiting
USA
Sourcing and applications
SCCs
ZoomInfo TalentOS
USA
Candidate sourcing
SCCs
PeopleGPT (Juicebox)
USA
Candidate sourcing
SCCs
Glassdoor / Indeed
Ireland
Job board and applications
N/A (within EU)
CoderPad
USA
Technical assessments
SCCs
HackerRank
USA
Technical assessments
SCCs
Sterling
USA
Background checks
SCCs
Checkr
USA
Background checks
EU-US Data Privacy Framework + SCCs
DocuSign
USA
Signature of offer / contract
Determined by signatory entity
Google Workspace
USA
Email and document collaboration
SCCs
We may also disclose your Personal Data to:
Recruitment agencies that introduce candidates to us.
Professional advisers (legal, audit, accounting).
Public authorities, regulators, courts and law-enforcement agencies, where legally required.
An acquirer, successor or related party in connection with a merger, acquisition, financing, reorganisation or sale of assets.
All external providers are bound by confidentiality and data-protection obligations and process your Personal Data only on documented instructions from us.
5. International Personal Data transfers
Harness is a US-headquartered company. As the table in Section 4.2 shows, several of our recruitment service providers are based in the United States. Your Personal Data may therefore be accessed from, or transferred to, countries other than your country of residence.
Where required by applicable law, we put in place appropriate safeguards for these transfers, such as:
The EU Standard Contractual Clauses (SCCs), together with supplementary measures where required.
The UK International Data Transfer Addendum (IDTA) for transfers from the UK.
The Swiss addendum to the EU SCCs for transfers from Switzerland.
The EU-US Data Privacy Framework for transfers to certified US recipients (currently Greenhouse and Checkr).
Adequacy decisions where they apply, and other transfer mechanisms recognised under local law.
Details of the specific mechanism used for a transfer are available on request from privacy@harness.io.
6. How long we keep your Personal Data
We keep your recruitment data only for as long as necessary for the purposes described in this notice:
Category
Retention period
Unsuccessful candidates — default
12 months after you last logged into our candidate portal (unless you have an open application).
Unsuccessful candidates — France
24 months after your last login (in line with French recruitment-data guidance).
Unsuccessful candidates — United States
3 years (in line with EEOC, OFCCP and state record-keeping requirements).
Successful candidates
Application data is incorporated into your employee file and kept in accordance with our Employee Privacy Notice and applicable retention requirements.
No-go list (profiles flagged as spam or fraudulent)
Minimal identifiers (name, email, reason for flagging) retained while necessary to protect recruitment integrity. The list is reviewed annually and entries can be corrected on request.
Retention periods may be extended where required by law or to defend legal claims.
7. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you. All recruitment decisions about you are taken by a human recruiter or hiring manager.
Where we use software-assisted tools — for example, Greenhouse for application management, LinkedIn / ZoomInfo / PeopleGPT for sourcing, or CoderPad / HackerRank for technical assessments — they support, but do not replace, human decision-making.
8. Your rights
Depending on where you are located, applicable data protection laws may grant you some or all of the following rights:
Access your Personal Data and receive a copy of it.
Correct Personal Data that is inaccurate or incomplete.
Request deletion of your Personal Data in certain situations (assessed on a case-by-case basis, in particular where we have legal record-keeping obligations).
Restrict how we use your Personal Data in specific cases.
Object to processing based on our legitimate interests — including objecting to our sourcing of your profile from professional platforms.
Receive your data in a portable format, where applicable.
Withdraw your consent at any time, where we rely on consent. This does not affect the lawfulness of processing carried out before withdrawal.
Lodge a complaint with the supervisory authority in your jurisdiction (see Country-Specific Information).
These rights are not absolute. There may be situations where a right does not apply, for example, if we are legally required to keep certain information.
How to exercise your rights: use our privacy portal at https://harness-privacy.relyance.ai/. We respond within the statutory deadlines that apply (30 days under the GDPR; 45 days under the CCPA). We may need to verify your identity before responding.
9. Complaints
If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. See the Country-Specific Information section below for the authority applicable to you. You may also contact us directly first — we welcome the opportunity to resolve your concerns.
10. Changes to this notice
We may update this privacy notice from time to time. The most recent version will always be available on the Harness careers page.
11. Country-Specific Information
The following supplements apply in addition to the main body of this notice, depending on where you are located. Where a supplement conflicts with the core notice, the supplement prevails for individuals in that jurisdiction.
Legal framework: Our processing of your personal data is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and national applicable data protections laws, and, in the UK, the UK GDPR and the Data Protection Act 2018.
Legal bases: As set out in Section 3, we rely on: steps taken at your request prior to entering into a contract (Art. 6(1)(b)); compliance with a legal obligation (Art. 6(1)(c)); our legitimate interests (Art. 6(1)(f)).
Sensitive data: We do not rely on Article 9 in this jurisdiction; we do not collect special category data from EEA/UK candidates as part of the standard recruitment process.
AI in recruitment: We do not use AI systems that fall within the prohibited practices of Regulation (EU) 2024/1689 (EU AI Act) — in particular, we do not use AI to infer emotions of candidates or to categorise them on the basis of biometric data.
Legal framework: Various U.S. federal and state laws apply to our recruitment processing, depending on your location and the role applied for. These include state comprehensive privacy laws, to the extent applicable to candidate data, as well as sector-specific laws such as the Illinois Biometric Information Privacy Act (BIPA) and the Washington My Health My Data Act, where relevant.
EEO-1 and OFCCP reporting: We invite you, on a voluntary basis, to self-identify your race / ethnicity (for EEO-1 reporting), disability status (OFCCP Form CC-305), and protected veteran status. You are free not to provide this information; it is used only for equal-opportunity monitoring and reporting and is kept confidential and separate from candidate selection files.
Retention: Recruitment records of unsuccessful candidates in the US are retained for 3 years, in line with EEOC, OFCCP and state record-keeping requirements.
Background checks: Where we obtain a consumer report about you in connection with your application — typically through third-party consumer reporting agencies — we comply with the federal Fair Credit Reporting Act (FCRA) and equivalent state "mini-FCRA" laws. This includes providing separate mandatory disclosures, obtaining your written authorization, and strictly adhering to the "pre-adverse action" and "adverse action" processes if an adverse decision is contemplated based on the report.
AI in recruitment: As stated in Section 7, we do not utilize solely automated decision-making or automated employment decision tools (AEDT) without human oversight; all final hiring decisions are made by human reviewers.
Legal framework: The California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (CCPA), applies to California residents.
Categories of personal information collected (Cal. Civ. Code § 1798.140(v)): identifiers; personal information categories listed in the California Customer Records statute; protected classification characteristics (only where voluntarily disclosed); professional or employment-related information; education information; internet or other electronic network activity information.
Categories of sensitive personal information collected (Cal. Civ. Code § 1798.140(ae)): social security, driver's license, state identification card or passport number (collected only at the conditional-offer stage as part of background and right-to-work checks); racial or ethnic origin (only where voluntarily disclosed for EEO-1 purposes). We only use or disclose your sensitive personal information for purposes permitted under the CCPA (e.g., to conduct background checks, verify eligibility to work, or for compliance with legal obligations) and do not use it to infer characteristics about you.
Sources, business purposes and recipients: See Sections 2, 3 and 4 of this notice.
Retention: See Section 6 — 3 years for unsuccessful U.S. candidates.
No sale or sharing: We do not sell your personal information and we do not share it with third parties for cross-context behavioral advertising, as those terms are defined under the CCPA. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.
Your rights under the CCPA include: the right to know and access personal information collected; the right to delete; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information (where applicable); and the right to non-discrimination. We will acknowledge receipt of your request within 10 business days and respond to verifiable requests within 45 days of receipt (which may be extended under the CCPA by an additional 45 days if reasonably necessary).
Non-discrimination: We will not deny you employment opportunities, provide different terms of employment, or retaliate against you for exercising your privacy rights.
How to exercise your rights: To exercise your rights, you or your authorized agent may email privacy@harness.io or use our privacy portal.
Legal framework: The federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy legislation — such as Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Alberta's Personal Information Protection Act (PIPA Alberta), and British Columbia's Personal Information Protection Act (PIPA BC) — govern our processing of your personal data.
Employment Equity Act: If we are subject to the federal Employment Equity Act, we will invite you, on a voluntary basis, to self-identify as belonging to one or more of the four designated groups (women, Indigenous peoples, persons with disabilities, members of visible minorities). You are free not to provide this information; it is used only for equal-employment monitoring and reporting and is not seen or used by recruitment decision-makers.
Supervisory authorities: Office of the Privacy Commissioner of Canada (OPC), https://www.priv.gc.ca, 1-800-282-1376. In Quebec: Commission d'accès à l'information (CAI), https://www.cai.gouv.qc.ca. In Alberta and British Columbia, the respective Offices of the Information and Privacy Commissioner.
Legal framework: The Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13,709/2018) governs our processing of your personal data.
Legal bases: We process your personal data on the bases of contract performance (Art. 7(V)), compliance with a legal obligation (Art. 7(II)), and our legitimate interests (Art. 7(IX)), as set out in Section 3. Where Brazilian law requires consent for a specific processing activity, we will seek it separately.
Sensitive data and consent: We do not collect sensitive personal data (dados pessoais sensíveis) from Brazilian candidates as part of the standard recruitment process. Self-identification data for equal-opportunity purposes is collected on a voluntary basis only.
Your rights under the LGPD: You have the right to: confirm the existence of processing; access your personal data; correct incomplete, inaccurate or outdated data; obtain anonymisation, blocking or deletion of unnecessary or excessive data; obtain portability; obtain information about third parties with which your data has been shared; be informed about the possibility of denying consent and the consequences; and revoke consent. To exercise your rights, please use our privacy portal at https://harness-privacy.relyance.ai/.
International transfers: Where your personal data is transferred outside Brazil (in particular to the United States — see Sections 4 and 5), we implement appropriate safeguards as required by the LGPD and the guidance of the Autoridade Nacional de Proteção de Dados (ANPD).
Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD), https://www.gov.br/anpd.
Legal framework: The Personal Data Protection Law No. 25,326 (Ley de Protección de los Datos Personales) and its implementing regulations govern our processing of your personal data. Argentina has been recognised by the European Commission as providing an adequate level of data protection.
Legal bases and registration: We will maintain the required registration of our personal data databases with the Agencia de Acceso a la Información Pública (AAIP), as required by Law 25,326. Our processing purposes are as described in Section 3 of this notice.
Your rights: You have the rights of access, rectification, update, and suppression (supresión) of your personal data, free of charge. To exercise these rights, please use our privacy portal at https://harness-privacy.relyance.ai/. We will respond within the statutory deadlines.
Sensitive data: We do not collect sensitive personal data (datos personales sensibles) from Argentine candidates as part of the standard recruitment process. The collection of sensitive data is permitted only where expressly authorised by law or required for reasons of general interest.
Legal framework: The Protection of Privacy Law, 5741-1981, as amended (in particular by Amendment No. 13, which entered into force on 14 August 2025) applies to our processing of your personal data.
Your rights: You have the right to access, rectify and request deletion of your personal data held in our databases, subject to applicable exceptions. Amendment 13 also expands transparency obligations and enforcement powers of the Privacy Protection Authority.
Especially sensitive personal information: We do not collect especially sensitive information (such as biometric data, genetic data, health data, sexual orientation, criminal records, or financial details) from Israeli candidates as part of the standard recruitment process. Where any such information is collected as part of a regulated background check, we apply the additional safeguards required under the Law.
Voluntary provision: Providing your personal data as part of the recruitment process is voluntary and is not required by law. If you choose not to provide certain information, we may be unable to assess your application.
International transfers: Where we transfer personal data outside Israel, we comply with the Privacy Protection (Transfer of Data Abroad) Regulations and Amendment 13's enhanced transfer rules.
Legal framework: The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), together with the Information Technology Act, 2000 and the SPDI Rules, 2011, apply to our processing of your personal data. The DPDP Act was notified on 13 November 2025 and is being implemented in phases: the Data Protection Board of India was established immediately; consent manager provisions take effect from 13 November 2026; and all remaining substantive obligations (including notice, consent, data principal rights, and breach notification) take effect from 13 May 2027. Until that date, the SPDI Rules remain in full force. We are aligning our practices with the DPDP framework in advance of full enforcement.
Compensation data: As indicated in Section 2.2, we collect compensation data from candidates for roles based in India, in line with local market practice.
Employment-related processing: We may process your personal data without consent where it is necessary for purposes of employment or for safeguarding the employer from loss or liability, as permitted under Section 7(i) of the DPDP Act. We nonetheless provide this notice in the interest of transparency.
Your rights under the DPDP Act include: the right to obtain confirmation and a summary of your personal data and processing activities; the right to correction and erasure; the right to grievance redressal; and the right to nominate another individual to exercise your rights in the event of your death or incapacity.
Language: This notice is available in English. You may request a version in any language specified in the Eighth Schedule to the Constitution of India by contacting us at privacy@harness.io.
Grievance officer / Complaint mechanism: Our grievance officer for India can be contacted at privacy@harness.io. You may also file a complaint with the Data Protection Board of India once its procedures are operational.
Legal framework: The Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, Official Gazette No. 87/2018) (Serbian PDPL), which is closely modelled on the GDPR, governs our processing of your personal data.
Legal bases: As set out in Section 3, we rely on: performance of or steps prior to a contract (Art. 12(1)(2)); compliance with a legal obligation (Art. 12(1)(3)); and our legitimate interests (Art. 12(1)(6)).
Your rights: You have the right to access, rectify, erase, restrict processing, data portability, and to object to processing based on legitimate interests. You also have the right to lodge a complaint with the supervisory authority. To exercise your rights, please use our privacy portal at https://harness-privacy.relyance.ai.
International transfers: Where your personal data is transferred outside Serbia, we implement appropriate safeguards as required by the Serbian PDPL, including standard contractual clauses where applicable.
Supervisory authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Commissioner for Information of Public Importance and Personal Data Protection), https://www.poverenik.rs.
Legal framework: The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) govern our handling of your personal information in Australia.
Collection and use: We collect your personal information only by lawful and fair means and only if it is reasonably necessary for one or more of our recruitment functions and activities, as described in this notice.
Sensitive information: We do not collect sensitive information (as defined under the Privacy Act 1988, including health information, racial or ethnic origin, and biometric data) from Australian candidates as part of the standard recruitment process, unless you voluntarily provide it and consent to its collection, or collection is required or authorised by law.
Your rights: You have the right to access the personal information we hold about you and to request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading. To make an access or correction request, please use our privacy portal at https://harness-privacy.relyance.ai/. We will respond within a reasonable time.
Cross-border disclosure: Your personal information may be disclosed to overseas recipients, including in the United States (see Sections 4 and 5). Before disclosing your information overseas, we take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to that information.
Complaints and supervisory authority: If you believe we have breached the APPs, you may first contact us at privacy@harness.io. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.
