Job Applicant Data Protection Notice

Nasdaq, Inc., and its global subsidiaries and affiliates worldwide (referred to as “Nasdaq,” “we,” or “us” throughout this notice) provide this Applicant Data Protection Notice to explain how we handle your personal data when you apply for a role with us.

Nasdaq is committed to handling your personal data responsibly and in accordance with applicable data protection laws. We process your personal data only for the purposes described in this notice. If you have any questions about how we process your personal data, please contact our Privacy Team by submitting the online form available here or sending an email to privacy@nasdaq.com.

I. DATA CATEGORIES

Nasdaq processes the following categories of personal data as part of evaluating your application and managing our recruitment activities:

• Contact data, such as personal and business addresses, and personal and business phone/fax numbers and email addresses;
• Personal identification data, such as full name, date of birth, nationality, gender, and country of birth;
• Application data, such as your CV or resume, cover letter, employment history, relevant professional experience, education, qualifications, certifications, language proficiency, technical skills, professional memberships, desired salary and other job-related preferences, and links to professional profiles or personal websites you choose to share, background check data to the extent permitted by and conducted in accordance with applicable law;
• Communication data, such as email correspondence, messages exchanged with us, and any attachments you provide during the recruitment process; and
• Referral and recruitment source data, such as the name of the person who referred you, the nature of your relationship with the referrer, any notes or assessments provided about your suitability, and the source through which your application was received.

We may also collect information from cookies or other tags placed on your device from other websites (e.g., job boards) in order to identify the effectiveness of our recruiting campaigns. This information is not used at the individually identifiable level to track individual job applicants or create profiles, but is used in aggregate to understand how best to reach potential job applicants. We may also collect information related to whether emails sent to you have been opened, in order to better understand the effectiveness of our communications, but this information is not used at the individually identifiable level to track individual job applicants or create profiles. We refer to these types of data collectively as "Tag Information" in this Applicant Data Protection Notice.

Generally, we collect all data directly from you. However, subject to applicable law, we may also collect certain information from authorized third parties (e.g., people you have named as your references, previous employers, schools, or public authorities) or public resources.

The provision of this Applicant Data Protection Notice is partly a statutory requirement, partly a contractual requirement under the terms of our recruiting website, and partly a requirement to carry out the recruitment and hiring process with you. In general, you are required to provide your personal data, except in limited instances when we indicate that certain information is voluntary. Not providing your data may prevent Nasdaq from carrying out recruiting and hiring activities that impact your potential employment with us.

II. PURPOSES AND BASIS FOR PROCESSING APPLICANT DATA

Nasdaq will process your personal data for the following purposes:

Nasdaq relies on the following legal grounds for the collection, use, and other processing of your personal data:

• Taking steps at your request (i.e., administering your application, prior to entering into a potential employment contract with you);
• Performance of the contract with you for the usage of our recruiting website;
• Compliance with legal obligations, in particular in the area of labor and employment law, social security and social protection law, data protection law, tax law, and corporate compliance law;
• Consent, as permitted by applicable law; and

Legitimate interest of Nasdaq or other third parties (e.g., existing or potential suppliers, customers, governmental bodies, or courts) where the legitimate interest could be in particular internal information sharing, and customer relationship management activities, or potential merger and acquisition activities.

III. CATEGORIES OF RECIPIENTS

Nasdaq may transfer your personal data as necessary to third parties for the processing purposes described above as follows:

• Within the affiliated group: We share your data with our ultimate parent company, Nasdaq, Inc. in the United States and its subsidiaries as necessary for the purposes identified above, and in particular to conduct recruiting and hiring activities, and to respond to and comply with requests and legal demands;
• With certain acquiring or acquired entities: If the Nasdaq business for which you submitted your personal data, in relation to your interest in an employment position, is sold or transferred in whole or in part or if Nasdaq is acquiring and integrating another entity into the Nasdaq entity or business for which you applied for an employment position, your data may be transferred to the other entity prior to the transaction (e.g., during the diligence phase) or after the transaction, subject to any rights provided by applicable law, including the laws of the jurisdictions where the other entity is located; and
• With certain Data Processors: Certain third-party service providers such as IT support or HR support providers, whether affiliated or unaffiliated, will receive your personal data to process such data under appropriate instructions ("Data Processors") as necessary for the processing purposes, in particular to conduct recruiting and hiring activities, comply with applicable laws and employment-related requirements, and other activities. These Data Processors will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard your personal data, and to process it only as instructed.

The recipients identified above may be located inside or outside the European Economic Area ("EEA"). Recipients outside the EEA might be located in countries that are not deemed by the European Commission to provide an adequate level of protection for personal data from an EEA data protection law perspective. Nasdaq takes all necessary measures to ensure that transfers out of the EEA are adequately protected as required by applicable data protection law. With respect to transfers to recipients located in countries not deemed by the European Commission to provide an adequate level of data protection, Nasdaq bases the transfer on appropriate safeguards under Article 46 of the General Data Protection Regulation (GDPR), such as the European standard contractual clauses, approved codes of conduct together with binding and enforceable commitments of the recipient, or approved certification mechanisms together with binding and enforceable commitments of the recipient.

Any access to your personal data is restricted to those individuals who have a need to receive or access it to fulfill their job responsibilities. Nasdaq may also disclose your personal data as required or permitted by applicable law to professional advisors, government authorities and courts, external advisors, and similar third parties.

IV. RETENTION PERIOD

Your personal data is stored by Nasdaq, and/or our service providers, strictly to the extent necessary for the performance of our obligations and strictly for the time necessary to achieve the purposes for which your data is collected, in accordance with applicable data protection laws. Nasdaq will generally retain your personal data in accordance with applicable retention policies and procedures, the periods of retention under which are determined by taking into account the time necessary to achieve the purposes for which the personal data is processed, unless retention for a longer period is warranted due to a legal requirement, including the need to support or defend a legal claim that is not yet barred by the applicable statute of limitations.

If you accept an offer from Nasdaq, your personal data will be retained for the duration of your employment with Nasdaq and as necessary in accordance with applicable law and applicable retention policies and procedures.

Where you consent to Nasdaq being able to consider you for employment against future opportunities other than the one(s) for which you originally applied and/or were being considered for, we will keep your data on file for such purposes. You may withdraw this consent at any time by submitting the online form available here.  

V. YOUR RIGHTS

If you have declared your consent regarding certain types of processing activities (for example, via a separate specific consent form), you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

Pursuant to applicable data protection law, you also have the right to: (1) request access to your personal data; (2) request rectification of your personal data; (3) request erasure of your personal data; (4) request restriction of processing of your personal data; (5) request data portability of your personal data; and/or (6) object to the processing of your personal data. Please note that aforementioned rights might be limited under the applicable national data protection law.

(i) Right of access: Under certain circumstances, you have the right to obtain confirmation from us as to whether or not data about you is processed, and, where that is the case, to request access to such personal data. The access information includes, inter alia, the purposes of the processing, the categories of your personal data, the recipients or categories of recipients to whom your personal data has been or will be disclosed, the sources of the data, the duration of retention of your personal data, and the technical security measures put in place to safeguard your personal data in case of transfer outside the EEA. However, this is not an absolute right, and the interests of other individuals may restrict your right of access. Most information is set out in this Applicant Data Protection Notice, but supplementary information will be provided where necessary. In addition to access, you have the right to obtain a copy of your personal data. Note that, for additional copies requested by you, we may charge a reasonable fee based on administrative costs.

(ii) Right to rectification: Under certain circumstances, you have the right to obtain from us the rectification (i.e., correction) of inaccurate personal data about you. Depending on the purposes of the processing, you have the right to have your incomplete personal data completed, including by means of providing a supplementary statement.

(iii) Right to erasure (right to be forgotten): Under certain circumstances, you have the right to obtain from us the erasure of your personal data. In such cases, we will erase, or render permanently unintelligible, such personal data.

(iv) Right to restriction of processing: Under certain circumstances, you have the right to obtain from us the restriction of processing of your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes. However, as Nasdaq processes and uses your personal data primarily for purposes of carrying out a contractual employment relationship with you, Nasdaq will in principle have a legitimate interest for the processing which will override your restriction request, unless the restriction request relates to marketing activities (which generally do not apply in the employment context).

(v) Right to data portability: Under certain circumstances, you have the right to receive the personal data that you have provided to us, in a structured, commonly used and machine-readable format so that you can transmit this personal data to another entity.

(vi) Right to objection: Under certain circumstances, you have the right to object, on grounds relating to your particular situation, to the processing of your personal data by us. Where such a right applies, we will no longer process the relevant personal data. This is not an absolute right and does not apply in certain situations, such as when processing is necessary to perform the employment contract, to comply with applicable EU or member state law, or to defend legal claims.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

VI. QUESTIONS

If you have any questions about this Applicant Data Protection Notice, or if you would like to request rights or a copy of the appropriate safeguards concerning your personal data, you should contact our Privacy Team by submitting the online form available here or by postal mail at:

Office of General Counsel – Privacy Team

Nasdaq
2929 Walnut Street
8th floor, Suite 800
Philadelphia, PA 19104

or

Office of General Counsel – Stockholm Office

Mäster Samuelsgatan 56,
111 21 Stockholm
Sweden

In addition, Nasdaq's Nordic and Baltic Regulated Entities* have appointed Caroline Olstedt Carlström as their Data Protection Officer. If you are an applicant for employment with any such entity, you may also contact the Data Protection Officer at Caroline.Olstedt.Carlstrom@cirio.se or by postal mail at:

Cirio Advokatbyrå,
Biblioteksgatan 9,
111 46 Stockholm
Sweden
Attn: Caroline Olstedt Carlström – Nasdaq Data Protection Officer

* Regulated Entities that have appointed a Data Protection Officer are European exchanges (Nasdaq Copenhagen A/S, Nasdaq Helsinki Ltd, Nasdaq Iceland hf., Nasdaq Oslo A/S, Nasdaq Riga AS, Nasdaq Stockholm AB, Nasdaq Tallinn AS and AB Nasdaq Vilnius), clearinghouses (Nasdaq Clearing AB and Nasdaq Clearing AB Vilnius branch), central shares depositories (Nasdaq CSD SE and Nasdaq CSD SE Iceland, Estonia and Lithuania branches), our Estonian pension administrator company (AS Pensionikeskus) and Nasdaq Investment Firm B.V.

With respect to Personal Information processing subject to European Union jurisdiction, in addition to contacting our business contacts and Data Protection Officer (for our EEA Regulated Businesses), you may also contact a data protection supervisory authority. Within Europe, Nasdaq's headquarters is located in Sweden, making the responsible data protection supervisory authority:

The Swedish Data Protection Authority

Contact Details:

Telefon: +46 (0)8-657 61 00

E-post: imy@imy.se
Postadress:
Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm
Sweden