Terms and Conditions

• PayPal Candidate Privacy Notice

Name of Standard: PayPal Privacy Notice
Standard Identification: PPPriv-STD-1.2.0
Name of Policy: Data Binding Corporate Rules
Policy Identification: PPPriv-POL-1.0.0
Approval Date: 2018-05-09
Effective Date: 2018-05-09
Last Modified: 2018-05-09
I.Policy
PayPal Group (the “Company” or “we”) are committed to protecting the data privacy of candidates to vacancies posted by PayPal
Group in accordance with Applicable Law. This PayPal Candidate Privacy Notice (“Privacy Notice”) describes how the
Company collects, uses, transfers, stores and safeguards the Personal Data of Candidates to the Company’s posted
vacancies. You will find all of the definitions for the capitalized terms in Section IV below.
II.Purpose and Scope
This Privacy Notice documents the Company’s privacy and data protection practices for the Personal Data of candidates. This
Privacy Notice applies to all Candidates for vacancies posted by the Company worldwide. While this Privacy Notice explains
how the Company treats Personal Data, we may also share or use your Personal Data in accordance with your separate
instructions or consent, and to the extent allowed under Applicable Law.
1. Personal Data
What is Personal Data?
As defined in the Glossary (view below) “Personal Data” means any information relating to an identified or identifiable natural
person; an identifiable person is one who can be identified, directly or indirectly. We describe below what this means and what
categories of Personal Data PayPal collects about our Employees in the course of your employment. In a nutshell, your Personal
Data relates notably to your contact address, identity details, your bank details, your social security details.
Does the format of the Personal Data matter?
This Privacy Notice applies to Personal Data in any media or format that we obtain about you as a Candidate, whether we
obtained it directly or indirectly, manually or automatically, or otherwise through websites, applications, computers, permitted
monitoring tools, tablets and other mobile devices, and any other information from any of these sources to the extent it is
combined with, or associated with Personal Data about you.
How long does PayPal keep my Personal Data?
We use your Personal Data for as long as you remain a Candidate for the vacancy you applied for at and where the retention of
your Personal Data is necessary to meet legal requirements in accordance with Applicable Law,
2. Collection & Use
Why does PayPal collect my Personal Data?
As a Recruiter, we collect and verify Personal Data that you provide via your Recruitment application for a variety of purposes.
How does PayPal use my Personal Data?
The verification of your application for a position at the Company, by way of example:
• To carry out all pre-employment checks and checks to confirm the right to work;
• When applicable to your role, in accordance with Applicable Law, we will request your consent to allow the Company to obtain
additional information from third parties to verify your credit, criminal, or related background information
The compliance with a legal obligation to which PayPal is subject, by way of example:
• To comply with statutory, financial, regulatory and legal obligations including audits, reports and statistics;
3. Legal Basis
What is the legal basis for processing my Personal Data?
For Employees employed by the Company in the European Union (EU), the legal basis for processing your Personal Data is
Article 6.1.a, 6.1.b, 6.1.c and/or 6.1.f of the General Data Protection Regulation (EU) 2016/679[1] (GDPR), as follows:
You have given consent to the processing of your Personal Data for one or more specific purposes; or Processing is necessary for
compliance with a legal obligation to which the Data Controller is subject; or
With regard to the above-mentioned legal basis, please refer to Section 2 which provides you with categories of data processing
and illustrations.
Who is the Data controller?
The Data controller of your Personal Data is the PayPal legal entity that is your employer and the duties of the Data controller are
managed by your Human Resources Department.
Where could I know more about the GDPR?
Please note that further information on Regulation (EU) 2016/679 (GDPR) can be found at the official and dedicated European
Commission website (view here).
3. Transfer and sharing
Employee Personal Data may be stored in hard and electronic format in the United States and other countries in which the
Company, or Company affiliates, Service Providers or contractors have a physical presence or do business.
Are my data transferred and shared?
Transfers and sharing with third-party Service Providers
Personal Data also may be shared with third-party Service Providers (e.g., medical benefit providers, stock brokerages, retirement
benefit providers, travel, Salesforce, etc.) working on behalf of the Company or with whom or to which the Company has chosen
to outsource work, in order to facilitate the uses described above. In the event that Personal Data is provided to a Service
Provider, the Company will enter into contracts that ensure that the Service Provider only processes the Personal Data as
instructed, Notice and its obligations under Applicable Law, including but not limited to applicable privacy, employment,
information security and/or data protection law. In addition, all contracts with Service Providers must contain minimum
contractual safeguards, as defined or required by Applicable Law and PayPal Policies. The Company may also share Personal
Data with law enforcement, regulatory authorities or other third parties in cases where it is necessary to protect the Company’s
legitimate interests (including for example, to prevent imminent physical harm, financial loss, or to report suspected illegal
activity) as required and if permitted by Applicable Law.
4. Your Data Protection rights (Access, rectification, erasure, blocking)
What are my rights?
You have the right to obtain from PayPal confirmation as to whether or not Personal Data concerning you are being processed,
and, where that is the case, access to the Personal Data and the information relating to such processing.
You have the right to obtain from the Data controller without undue delay the rectification of inaccurate Personal Data
concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete Personal Data
completed, including by means of providing a supplementary statement. You also have the right to obtain from the Data
controller the erasure of Personal Data concerning you without undue delay and the Data controller shall have the obligation to
erase Personal Data without undue delay where, for instance, one of the following grounds applies:
a)The Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) The data subject withdraws consent.
You have the right to obtain from the Data controller restriction of processing where for instance the accuracy of the Personal
Data is contested by you. You have the right to receive your Personal Data in a structured, commonly used and machine readable
format. You have the right to object at any time to processing of Personal Data concerning you.
You have the possibility of lodging a complaint with a supervisory authority[2] and seeking a judicial remedy in cases where the
Data controller does not take action on your request.
Note that you have the ability to directly access and modify much if not all of your Personal Data through Company Systems
such as.. Upon your request, we will try to accommodate requests to remove Personal Data unless retention of Personal Data is
required by Applicable Law or necessary to defend the Company against legal claims.
5. Protection
The Company uses physical, technical and organizational security controls commensurate with the amount and sensitivity of the
Personal Data to prevent unauthorized processing, including but not limited to, unauthorized access to, acquisition and use of,
loss, destruction, or damage to Personal Data, and to protect the data’s integrity. Where appropriate, the Company uses
encryption, firewalls, access controls, standards and other procedures to protect Personal Data from unauthorized
access. Physical and logical access to electronic and hard copy files is further restricted based upon job responsibilities and
business needs, and only individuals with a legitimate business need to know the Personal Data, and for legitimate business
purposes, are authorized to access it.
6. Questions
Who can I contact if I want to know more about this notice, the processing of Personal Data or my rights?
If you have any questions about this Privacy Notice, or the collection, access, use, disclosure, sharing or safeguarding of
Employee Personal Data, or your Personal Data you may contact PayPal’s Data Protection Officer at globalprivacy@paypal.com.
III.Document Control
Key Information
Document Version: 1.0
Standard Owner: Kristie Chon
Document Storage: Local storage location of this standard
Standard Author(s): Global Privacy Team
Standard Escalation Contact: Globalprivacy@paypal.com
IV.Glossary:
“Applicable Law” means applicable laws, rules and/or regulations.
Candidate means any person replying to a published vacancy notice by Paypal
“Data controller “means the natural or legal person, public authority, agency or other body which, alone or jointly with others,
determines the purposes and means of the processing of Personal Data
“Data processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on
behalf of the Data controller;
“Employee” means employees, workers, trainees and other personnel or staff members, including contingent or temporary
workers, alternate work force, or contractors of a Group Member, whether employed or engaged on a full or part-time basis and
irrespective of the type of employment or engagement. When the context requires, “Employee” also means (a) former
Employees and/or (b) an Employee’s dependents and beneficiaries under Company benefit plans.
 “Company Devices” means all electronic devices, systems and software applications provided to you by the Company for
business use.
“Employee Personal Data” means Personal Data relating to Employees.
“Legitimate interest” means the Company’s interests or the interests of third parties, and commercial interests as well as wider
societal benefits. Legitimate interest is analyzed through a) a Purpose test: are you pursuing a legitimate interest?, b) a Necessity
test: is the processing necessary for that purpose and c) a Balancing test: do the individual’s interests override the legitimate
interest?
“Personal Data” means any information relating to an identified or identifiable natural person; an identifiable person is one who
can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to
his physical, physiological, mental, economic, cultural or social identity.
“PayPal Group” means PayPal Holdings, Inc. and any legal entity it controls directly or indirectly.
“Sensitive Personal Data” means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical
beliefs, trade-union membership, information relating to criminal offences, or information concerning health or sex life.
“Service Provider” means any entity under contract with a PayPal Group Member which processes Personal Data on behalf of a
PayPal Group Member. In some jurisdictions, Service Providers also may be referred to as Data Processors.

[1]REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation) (view here)
[2] List of EEA Data Protection Authorities : http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-
authorities/index_en.htm
• Yes, I have read and consent to the terms and conditions