Overwolf Candidate Data Privacy Notice

Last updated: May 01, 2024

This Candidate Data Privacy Notice (“Notice”) describes how Overwolf (and its company group, as explained below) collects and processes your Personal Data (as defined below) when you apply for a position at Overwolf (whether for an employee, worker or contractor position, and collectively “Candidate” or “you”), upon submission of your application, as well as during the recruitment process and thereafter.

This Notice applies to Candidates in the territory in which we offer job opportunities and is subject to applicable data protection laws (“Applicable Data Protection Laws”). This Notice provides Candidates with information about the Personal Data we collect, how and why your Personal Data will be used, how long we will retain it, with whom we share it, our international data transfer practices, and your rights related to the Personal Data we process. It also provides you with certain information that we are required to provide you under Applicable Data Protection Laws, and for example (as applicable to you), information required under the EU and UK Data Protection Regulation (“GDPR”), including our lawful basis for processing your Personal Data; information required under the Israeli Protection of Privacy Law (“IPPL”); information required under the California Privacy Protection Act (“CCPA”), including the categories of “personal information” we process (please see the “Additional Information for California Residents” paragraph below).

The applicable entity of the Overwolf company group offering the job position you apply to is considered the “data controller” of the Personal Data collected from Candidates (or any equivalent definition under Applicable Data Protection Laws, such as “database owner” under the IPPL and “business” under the CCPA). This means that such an entity under the Overwolf company group is responsible for deciding how your Personal Data is processed, as well as to implement applicable measures in order to secure the Personal Data we store, and where applicable, enable you to exercise your rights. At Overwolf, we respect privacy rights and we are committed to ensure your Personal Data will be processed in compliance with Applicable Data Protection Laws and principles, which means that each such company under the Overwolf group is obligated to adhere to privacy protection and cross organization standards and policies, and among others, that your Personal Data will be used lawfully, fairly and in a transparent way; will be collected only for valid purposes that we have clearly explained to you; relevant to the purposes we have told you about and limited only to those purposes; retained only as necessary for the purposes we have told you about and - kept securely.

Please note that this Notice is in addition to the applicable provisions of the Privacy Policy governing the use of our website from which you submit your application. For clarification, this Notice does not apply to our data processing and privacy practices in the context of your other uses of Overwolf services (for example, this Notice shall not apply to our data processing practices with regards to your use of our platforms as an app developer), and for information regarding any other interactions with Overwolf, you should review the applicable privacy policy and notices for such services, as posted in such platforms.

You are not obliged by law to provide us with Personal Data. However, we must obtain certain types of Personal Data to process and examine your job application. In addition, if following the recruitment process a Candidate is hired or otherwise engaged by Overwolf, the Personal Data collected through the course of the recruitment process will be subject to our internal privacy policies, as provided to our employees and staff members.

It is important that you read this Notice, together with any other notices that might be provided on specific occasions when we are collecting Personal Data about you, so that you are aware of how and why we are collecting and using such Personal Data. For any questions or concerns you might have regarding your Personal Data please contact us at: support@overwolf.com or dpo@overwolf.com.

Under this Notice:

By using the term “Overwolf” (and “we” or “us”) we refer, collectively, to Overwolf Ltd and its wholly owned (directly or indirectly) affiliated companies and subsidiaries (including Tebex company group.

By using the term “Personal Data” we refer to information that identify, relate to, or could reasonably be linked with an individual by reasonable means (which can be further defined under Applicable Data Protection Laws as “personal information”, “personally identifying information”, etc.). Personal Data may further include types of information defined under Applicable Data Protection Laws as "Sensitive Data" which may include information such as governmental identification number or certificate, professional qualifications, financial information, and health related information, etc. (and can be further defined under Applicable Data Protection laws as “special categories of personal data”, “sensitive personal information”, etc.).

THE TYPES OF PERSONAL DATA WE COLLECT, PURPOSE OF COLLECTION AND USE & LAWFUL BASIS

We will collect, store, and use various types and categories of Personal Data about Candidates, which may further include Sensitive Data. The table below details the categories of Personal Data we collect and process.

Please note that the specific categories or types of Personal Data collected may vary depending on the position you apply to and legal requirements under Applicable Data Protection Laws. Overwolf will not process your Personal Data to perform automated decision-making.

Which types of Personal Data are collected?	Why is Overwolf collecting it for?	Overwolf lawful basis for processing the Personal Data
Personal identification information: such as full name, date of birth, and photos, Contact information: such as email address, phone number, and home address. Education, qualifications, Skills, abilities, and expertise: such as educational institutions you studied (and applicable dates/years), degrees or certifications obtained, fields of study, competencies, skills, language proficiency, and any other expertise which may be applicable to the position. Employment history: such as previous employers and job titles, dates of employment, responsibilities, etc. Eligibility to work: information regarding legal right to work in the territory or country relevant to the position, such as citizenship or visa status. Background check information: information obtained through background checks, subject to applicable laws, such as verification of employment and education history. Assessment results, communication, and internal records: information collected and gathered as part of the interview process, including tests and assessments conducted by Overwolf (directly or by outsource providers) to evaluate the suitability for the position, and any summary and internal notes, as well as and correspondence, and records or recording (subject to your consent) of phone calls, video interview or other interactions between the Candidate and Overwolf. Additional information provided voluntarily by the Candidate: such as information included in their resume (CV) and supporting documents submitted by the Candidate. We do not collect do no copy government-issued identification numbers and/or copies of of identification certificate (e.g., ID, passport, SSN) unless you voluntarily provide such within your application	To process and evaluate your job application, decision making process: to assess the experience, qualifications, skills, etc., and determine your eligibility for the role you have applied for, to facilitate our decision-making process, as well as, subject to applicable laws, identify potential matches with other open positions offered by Overwolf. To communicate with you: to facilitate our communications with you during the recruitment process, including scheduling interviews, providing updates and our decision regarding your application, etc. To verify the information provided and to conduct reference checks: we may need to verify the accuracy of the information you have provided, for example regarding your employment history, education, and professional references. To the extent permitted or required by applicable law, we may conduct background checks. To ensure eligibility to work: to confirm the Candidate's legal right to work in the country or territory relevant to the job position, and comply with immigration requirements, if applicable. To comply with legal requirements: to ensure we adhere to relevant laws and regulations, including labor, privacy laws, etc. For record-keeping and internal documentation purposes: to maintain records of the recruitment process, including Candidate evaluations, assessments, and decisions, which may be used for future reference or to address potential disputes or legal claims. For administration and human resources duties, obligations, and procedures performance and improvement: such as to track an application through the recruitment process analyze and refine our recruitment strategies, practices, and processes.	Our lawful basis to process Personal Data depends on the purpose for which we collect, use, and retain it, and as follows: We mainly collect and use the Personal Data under our legitimate interest, as needed for our assessment, decision-making and selection process, meaning to determine if a Candidate is suitable for a certain job position. We may further retain certain types of Personal Data, even after we have decided not to engage with a Candidate, under our legitimate interest, for the purpose of record keeping, compliance with applicable laws, evaluating our recruiting processes, and to be able to address and defend against potential disputes or legal claims. In addition, Personal Data will be retained by us where we are required to do so in order to comply with our legal obligations. Where required under Applicable Data Protection Laws, we will obtain the Candidate’s consent in order to further retain and use Personal Data for job opportunities in any other Overwolf company or otherwise future job. You have the right to withdraw consent at any time.
Sensitive Data: We collect this information solely where there is a specific need or requirement to obtain it, and solely where provided voluntarily by the Candidate or otherwise where the Candidate provided consent, and such may include information related to race, ethnicity, national origin and citizenship, disability and medical or health condition, veteran or military status, criminal history.	To monitor equal opportunity: We may ask for such information for the purpose of monitoring equal opportunity and ensuring diversity and inclusion. To ensure compliance with security standards or applicable laws: to the extent permitted or required by applicable law, we may conduct background checks that may include criminal record information. For record-keeping and internal documentation purposes: to maintain a record of the recruitment process, which may be used for internal and external reporting responsibilities (e.g., legal, and regulatory requirements), which may be further used for future reference or to address potential disputes or legal claims. For administration and human resources duties, obligations, and procedures performance. Note that, Overwolf does not discriminate, either directly or indirectly, on the grounds of gender, ethnic origin, religion, belief, marital status, nationality, national origin, color, age, sex, sexual orientation, or similar protected characteristics.	These types of Personal Data will be initially collected subject to obtaining your consent. You have the right to withdraw consent at any time. We may further retain certain types of Personal Data, under our legitimate interest, for the purpose of record keeping, compliance with applicable laws, evaluating our recruiting processes (e.g., for diversity and ensuring our process is not discriminating or biased), and addressing potential future disputes or legal claims. In addition, Personal Data will be retained by us where we are required to do so in order to comply with our legal obligations.

SOURCE OF PERSONAL DATA

We collect Personal Data directly from you (e.g. when you voluntarily provide it as part of your CV, etc.) or (where applicable) from another person or entity, such as an employment agency, recruitment or professional networking website, background check provider, or reference.

WHO DO WE SHARE YOUR PERSONAL DATA WITH?

Overwolf discloses your Personal Data internally with personnel involved in the recruiting and hiring processes (i.e., Human Resources, managers, affiliates) or externally with relevant third parties who support our employment processes and other third parties to comply with legal obligations or to exercise and defend our rights. The categories of such third-party recipients with whom we share Personal Data are as follows:

• Overwolf company group: we will share Personal Data within our company group to allow us to manage our recruitment process as a business, at the organizational level, and for human resources management. The categories of Personal Data that will be shared can include any of the types of Personal Data detailed under this Notice, as needed to fulfill such purposes. This will include information shared with a third party by way of merger, acquisition, or purchase of all or part of our assets, your Personal Data may be shared with the parties involved in such corporate events.
• Service providers and contractors: we will share Personal Data with our trusted vendors and service providers in order for such to provide perform certain services requested on our behalf, for example, service providers and vendors related to recruitment, talent acquisition and administration, technology services (e.g., SaaS recruitment management providers and cloud providers), background checks, where allowed by applicable law, and employment history checks, legal counsels, etc. We have contracts with our service providers that address safeguarding and properly using your Personal Data, including restriction from using your Personal Data for any purposes other than providing us with requested services (unless they are otherwise required under applicable laws).
• Governmental agencies authorized third parties or disclosure due to a legal process: we may also disclose your Personal Data to other third parties to comply with legal obligations (including court orders and subpoenas), defend against potential, threatened, or actual litigation, or when we are legally obliged to share information with law enforcement.

The categories of Personal Data that will be shared can include any of the types of Personal Data detailed under this Notice, however solely to the extent necessary to comply with such purpose. In addition, we may disclose Personal Data to third parties if you request us to do so, and in such event, the provision of your Personal Data will be subject to such third parties' policies and practices only.

HOW LONG DOES OVERWOLF STORE YOUR PERSONAL DATA?

As a principal, we will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, administrative, record keeping, or reporting requirements.

The criteria used by us to determine the retention periods are as follows:

• The type of Personal Data and purpose of the collection: meaning, we take into consideration the and the purposes for which we process your Personal Data (i.e. for how long we need to retain the Personal Data in order to achieve those purposes), as well as the scope, nature, and sensitivity of the Personal Data and the potential risk of harm from unauthorized use or disclosure.
• The process: meaning, we take into consideration the stage in which we have decided regarding your application (i.e., not to process with employment or engagement process). This stage may further affect the potential of legal claims and disputes and thus, is taken as a factor.
• Our legal obligations: the period for which we will retain your Personal Data further depends on the laws of the applicable territory, as under such laws, we are required to retain certain types of Personal Data (for different retention periods). In addition, we may retain certain types of Personal Data in the event we are required to do so subject to a binding legal request or a court order.
• Dispute, claims, and legal proceedings: we may retain certain types of Personal Data as we find reasonably necessary to defend against a threatened or potential legal claim. The periods of retention are determined mainly according to statutory limitation periods. We may further retain your Personal Data if you have a dispute with us, including any legal proceedings between you and us until such dispute is resolved, and following, if we find it necessary, in accordance with applicable statutory limitation periods. In addition, if you request to exercise your rights related to your Personal Data, we will maintain the applicable records for as long as needed to demonstrate compliance, usually also in accordance with applicable statutory limitation periods.

Your reasonable expectations or consent: depending on the Applicable Data Protection Laws, we may further retain your Personal Data for as long as we consider can be applicable to examine your application as per new or future job position. This is based also on what we believe to be a reasonable expectation of Candidates, or otherwise, if required, based on Candidates consent we will obtain for such use.

According to the criteria set forth above – we determine when we no longer have a legal justification for retaining Personal Data, and at such instances we will delete it or de-identify it so it can no longer be associated with you by reasonable means. In addition, we may retain limited Personal Data as a reference for any future applications submitted. If you are hired, Overwolf will store your Personal Data submitted or collected through the recruitment process for the term of your employment and thereafter, according to our data practices and policies related to our employees and staff members’ data.

Please note that except as required by applicable law, we will not be obligated to retain your Personal Data for any particular period, and we may delete it for any reason and at any time, without providing you with prior notice if our intention to do so.

HOW DOES OVERWOLF PROTECT YOUR PERSONAL DATA?

To maintain the security of your Personal Data, we have implemented technical and organizational security measures designed to prevent unauthorized use, disclosure, change or destruction of information and to further detect and manage suspected or actual security breaches. These measures, in compliance with Applicable Data Protection Laws, include access controls (only on a need-to-know basis), firewalls, network intrusion detection, and more. Although we take reasonable steps to safeguard information, we cannot always be able to prevent unauthorized actions or abuse our systems and network. Subject to Applicable Data Protection Laws requirements, we will notify you and the appropriate authorities in the event that we discover a security incident or breach related to your Personal Data.

INTERNATIONAL DATA TRANSFERS

Due to our global operation and company groups located or operating in various territories, your Personal Data may need to be processed or accessed in countries other than your jurisdiction, including, for example, when shared or accessed by our service providers or other affiliates. This may include the transfer of Personal Data from and to the State of Israel, the US, or the EU and UK. We only transfer Personal Data to another country in accordance with Applicable Data Protection Laws. We take appropriate measures to ensure that your Personal Data receives an adequate level of protection, including by using contractual obligations or other data transfer mechanisms that were pre-approved by applicable data protection authorities to ensure your Personal Data is protected (such as the Standard Contractual Clauses or the EU-US data transfer framework).

YOUR RIGHTS RELATED TO YOUR PERSONAL DATA AND HOW YOU CAN EXERCISE THEM

We acknowledge that different people have different privacy concerns and preferences. Our goal is to be clear about what information we collect so that you can make meaningful choices about how it is used. We allow you to exercise certain choices, rights, and controls in connection with your Personal Data. Depending on your relationship with us, your jurisdiction and the Applicable Data Protection Laws that apply to you, you have the right to control and request certain limitations or rights to be executed. These rights may include one or more of the following principal rights:

• The right to know what Personal Data we collect about you, the purpose of collection, with whom we share it, etc. – all as provided under this Notice;
• The right to request access and inspect your Personal Data, which entitles you to review or receive a copy of certain Personal Data we hold about you;
• The right to correct (“rectify”) inaccuracies, which entitles you to have any incomplete or inaccurate Personal Data corrected;
• The right to request, which entitles you to request us to delete Personal Data (subject to Applicable Data Protection Laws, which permits or requires the retention of certain Personal under certain circumstances);
• The right to request to restrict processing, which entitles you to request to limit the purposes for which we process your Personal Data (subject to certain conditions under Data Protection Laws);
• The right to object, which entitles you to object to our processing of your Personal Data (subject to certain conditions under Data Protection Laws);
• The right to data portability, which entitles you to receive the Personal Data you have provided, in a structured, commonly used and machine-readable format and transmit it to another controller;
• The right to withdraw consent, where we are processing your Personal based on your consent**;**

You further have the right to appeal or lodge a complaint. If we decline to take action on your request, we will inform you without undue delay as required under Applicable Data Protection Laws. For EU/UK Candidates*, you have the right to lodge a complaint with the applicable Data Protection Authority in the EU or the Information Commissioner in the UK.

You may exercise any or all of your above rights in relation to your Personal Data by filling out the Data Subject Request (“DSR”) by using the following link: https://support.overwolf.com/en/support/tickets/new or by sending us an e-mail to dpo@overwolf.com.

You may have additional rights as described in this Notice or applicable laws. Please note that we may be required to ask you for further information to confirm your identity before we provide the requested information. Specifically, we may send a separate email to verify your email address on file.

Representative for data subjects in the EU and UK Contact Information:

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact in the EU and UK. Prighter gives you an easy way to exercise your privacy-related rights (e.g., requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website. https://prighter.com/q/13682628040.

ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

The below provides further information and disclosures required under the CCPA with regards to our data collection and privacy practices of Candidates’ “personal information”, in our capacity as the “business”. This section is an integral part of this Notice and supplements the information provided under the Notice.

Categories of Personal Information We Collect

Under these Notice we have provided comprehensive information regarding the Personal Data we collect and process. The table further provides details regarding the CCPA categories of personal information under which the Personal Data we process is classified (and that we have collected in the previous 12 months). Please note that under the CCPA, personal information does not include: publicly available information that is lawfully made available from government records, that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; information excluded from the CCPA’s scope, such as: Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 and the California Confidentiality of Medical Information Act or clinical trial data; personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or California Financial Information Privacy Act and the Driver’s Privacy Protection Act of 1994.

Category	Example	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, Social Security number, driver's license number, passport number, or other similar identifiers.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example, name, address,).
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, education, employment, employment history, medical information. Some personal information included in this category may overlap with other categories.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example name, address, telephone number, employment history).
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, sexual orientation, veteran or military status.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example citizenship and disabilities).
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	No
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information.	No
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	No
G. Geolocation data.	Physical location, approximate location derived from IP address or movements.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example, address).
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example, video interviews recorded with your approval).
I. Professional or employment-related information.	Current or past job history or performance evaluations.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example, previous job positions)
J. Non-public education information (per the Family Educational Rights and Privacy Act).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes.	No
K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	No
L. Sensitive personal information.	Government-issued identifying numbers, financial account details, genetic data, precise geolocation, race or ethnicity, religious or philosophical beliefs, union membership, mail, email, text messages, biometric data, health data, and sexual orientation or sex life.	Yes (as elaborated under the "Types of personal data we collect, purpose of collection and use & lawful basis" paragraph of this Notice, and for example, needed to comply with our legal obligations under applicable laws)

Categories of Sources of Personal Information & Use of Personal Information: The source from which we obtain personal information is mainly for you (i.e., you directly provide it to us), or third parties (for example a previous employer you have provided as reference) – as further detailed under the “Source of Personal Data” paragraph of this Notice. The purpose for which we collect personal information and how we use it is mainly to manage the recruitment process and assess your application for decision making, as well as, to comply with applicable laws and defend our rights – as further detailed under the “Types of personal data we collect, purpose of collection and use & lawful basis” paragraph of this Notice. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice.

Disclosures of Personal Information for a “Business Purpose”: We may disclose your personal information for a business purpose, and mainly with relevant third parties who support our employment processes and other third parties to comply with legal obligations or to exercise and defend our rights. The categories of such third-party recipients with whom we share personal information are detailed under the “Who do we share personal data with” paragraph of the Notice, and include: Overwolf company group, to allow us to manage our recruitment process as a business; Service providers and contractors, to perform certain services requested on our behalf, for example, service providers and vendors related to recruitment, talent acquisition and administration, technology services, background checks, where allowed by applicable law, etc. The categories of personal information we disclose include any of the categories detailed under the table above (A, B, C, G, H, and I) - as needed to fulfill the purposes. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. We further restrict the contractor and service provider from selling or sharing your Personal Information.

Sale or share of personal information: We do not “sell” your personal information to any third party nor “share” it, as defined under the CCPA, meaning, we do not disclose or share your personal information in exchange for money or some other form of consideration.

Data Retention: The retention periods are determined according to the criteria broadly explained under the “How long Overwolf store your personal data” paragraph of this Notice, and mainly: for as long as it remains necessary in order to achieve the purpose for which the personal information was initially processed; to comply with our regulatory obligations; to resolve a claim or a dispute with you.

Your Rights Under The CCPA: Please see the “Your Rights” paragraph under this Notice which details your principal rights as for your personal information, including under the CCPA and how you may exercise them. In addition to those rights, under the CCPA you further have the right to: limit the use or disclosure of your “sensitive personal information”; not to receive not to be discriminated against for exercising your rights.

You can designate an authorized agent to submit requests to exercise rights on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

AMENDMENTS

We reserve the right to periodically revise this Notice, which will have immediate effect upon posting of the revised version, provided that in the event we will make changes that may affect your rights, or where required under Applicable Data Protection Laws, we will make reasonable efforts to notify Candidates or otherwise obtain consent. We recommend you review this Notice periodically to ensure that you understand our privacy practices and to check for any amendments.

OVERWOLF CONTACT DETAILS

If you have questions about our collection, use, or disclosure of Personal Data or to exercise one of the rights above, or any other question related to your candidacy, you can contact us by email at overwolf-talent@overwolf.com or dpo@overwolf.com.