This Privacy Notice is intended for recruitment related activities. We ask you to read this notice carefully as it is important that you understand what we are doing with your personal information, how we protect it, and what your rights are.
1. Information about us
Gossamer Bio, is a biopharmaceutical company engaged in the research and development of new medicines. Our headquarters are at 3115 Merryfield Row, Suite 120, San Diego, CA 92121.
As a Data Controller we are responsible for making decisions and setting out how your personal information is collected and used by our organization to evaluate you for employment for any current or future roles Gossamer BIO has.
Our partners, contractors and consultants may act as a Data Controller or Data Processor depending upon the specific relationship, we have with them. When they are acting as a Data Processor we ensure the privacy, security and confidentiality of your personal information through contractual agreements.
2. What is personal information?
In relation to data protection legislation in the EEA and the UK (henceforth simply referred to as the EU), personal information is any information about you that enables you to be identified. This can cover obvious information such as your name and contact details etc., but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
3. What personal information do we collect?
As a potential candidate, and depending on how you interact with us, we may collect some or all of the following personal information about you:
- General information: name, postal and/or email address, phone number, and other information such as photographs, digital imagery and sound recordings,), agreements made with CLIENT.
- Professional information: such as a job title, educational information, professional qualifications, prescribing history, work experience, medical/professional licenses, curriculum vitae (CV), networks and affiliates, programs and activities participated in, publications authored or co-authored, awards, board memberships, professional conference, attendance at events and employment status.
- Assessment information: such as internal assessments, evaluations, classifications etc.
4. The legal basis for processing your personal information
Your personal information is obtained for the purposes of your activities with us, and is necessary under one or more of the following legal bases:
- Art. 6(1)(f) of Regulation (EU) 2016/679 (General Data Protection Regulation) as necessary for the purposes of the legitimate interests pursued by the Controller, which are the solicitation, evaluation, and selection of applicants for employment.
- Art 6 (1), (a) you have provided your consent to us processing your personal information, having read and understood all the information made available to you. You may withdraw your consent at any time.
5. How do we collect your data?
This personal information was either obtained from publicly available sources (e.g. LinkedIn) or provided to Controller by someone who referred you for potential employment.
6. Why we collect your personal information
Your data will be processed for the purposes of managing Gossamer Bio’s recruitment-related activities, which include setting up and conducting interviews and tests for applicants, evaluating and assessing the results thereto, and as is otherwise needed in the recruitment and hiring processes.
7. What do we do with your personal information?
We use appropriate technical and organizational measures to protect information. When handling personal information, we take reasonable steps to protect it from loss, misuse, unauthorized access, disclosure, alteration or destruction.
We have obtained guarantees from all the organizations we use to process your personal information; we check that safeguards are in place that include technical and organizational measures to ensure the security of the processing, for example, during storage and data transfers.
8. Where is your personal information stored?
We may store in, or transfer to third countries (that are not part of the EU) some or all your personal information. These countries may not have data protection laws that are as strong as those in the EU. In this case we take the measures given in Section 9.
9. Do we share your personal information?
We disclose individual information as reasonably required to pursue our legitimate business aims and as required by law. Information will be disclosed only in accordance with applicable laws, and appropriate safeguards will be established, where possible, to protect your information. We may disclose information within Gossamer Bio and our worldwide affiliates.
Your personal data has been shared with Greenhouse Software, Inc., a cloud services provider located in the United States of America and engaged by Controller to help manage its recruitment and hiring process on Gossamer Bio’s behalf. Accordingly, if you are located outside of the United States, your personal data has been transferred to the United States. Because the European Union Commission has determined that United States data privacy laws do not ensure an adequate level of protection for personal data collected from EU data subjects, the transfer was subject to appropriate additional safeguards under [either the standard contractual clauses or the Data Privacy Framework].
10. How long will we keep your personal data?
Your personal data will be retained by Gossamer Bio as long as we determine there is a realistic prospect of your being considered for a role within our organisation.
11. How can you exercise your rights?
If you object to our processing your data for these purposes, you will find a link at the bottom of this email that enables you to notify us of your objection and we will ensure that your data is not further processed.
Under the GDPR, you also have the right to request access to your personal data and have it rectified or that the processing of your personal data be restricted and data portability. This means that, if you have provided personal information to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal information to re-use with another service or business in many cases.
If you want to know what personal information we have about you, you can ask us for details of that personal information and for a copy of it (where any such personal information is held). This is known as a “Data Subject Access Request”.
All access requests should be made in writing and sent to the Data Protection Officer. We may send you a form to help you make your request.
There is not normally any charge for a rights request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding or we may refuse your request.
We will endeavor to respond to your rights request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required – up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
12. How to Contact Us
If you would like to contact us for any reason concerning our privacy practices, please contact our DPO via email at: [email protected].
You can write to Gossamer Bio at its European Union address:
77 Sir John Rogerson’s Quay, Block C Grand Canal Docklands
Dublin 2, D02 VK60
Our Data Representative in the European Union, European Economic Area countries, and the United Kingdom can be contacted via email: [email protected]. DataRep may also be contacted via the Contact Form located at: https://www.datarep.uk/data-request/.
13. How to exercise your right to complain
If you have a complaint, we would like to have the opportunity to address it first, this does not stop you from making a complaint to the national data protection authority of your country in the EU, or the national Data Protection Authority of the country where Gossamer Bio or its Data Protection Officer is located.
In the European Union, a list of Data Protection Authorities and their contact details can be found at https://edpb.europa.eu/about-edpb/board/members_en.
In the United Kingdom, you can contact the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/data-protection-complaints/).
14. Changes to this Privacy Notice
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal information protection.
