Scope and Applicability
Firstup, Inc., its subsidiaries and affiliates (including Dynamic Signal) (collectively, “Firstup”), provide a digital employee engagement platform. This Privacy Notice explains how Firstup collects, uses, and discloses your personal information collected by and through your use of our websites (“Sites”) and by and through your other interactions with us, online, offline, or both, and how you may exercise your applicable privacy rights.
This Privacy Notice does not apply to Firstup’s processing of personal information in relation to the use of Firstup’s services, including end user information processed by Firstup on behalf of its customers. If you are an end user and want to learn about your employer’s privacy practices concerning their use of Firstup’s services, please refer to your employer’s relevant privacy policy.
Updates to This Privacy Notice
We may update this Privacy Notice from time-to-time. If we make any material changes, we will notify you by revising the date at the top of this Privacy Notice and, in some cases, may provide you with additional notice (such as adding a statement to our homepage or sending you a notification). We encourage you to review our Privacy Notice whenever you access the Sites or otherwise interact with us to stay informed about our privacy practices and the choices available to you.
Collection of Personal Information
We may collect or obtain the following categories of personal information through the Sites or by other means, including through any email message, webform, chat box, interaction with our sales and/or customer satisfaction teams, survey, social media page, conference, website, or networking event, or other communication or correspondence:
| Contact Data | Name (first and last), company, title, phone number, e-mail, business address, mailing address, and country |
| Message data | The object of any messages or correspondences, including email, web chat, or web form messages, and any personal data contained therein |
| Survey Data | Information you may provide in a survey, poll, or the like, including your responses |
| Meeting Data | Information captured or recorded during any web meeting, webinars, video calls, or phone/conference calls |
| Social Media Data | Information and messages shared with us through our social media pages, including your associated profile information |
| Referral Data | Information about you provided to us from other sources |
| Recruitment and Applicant Data | Information concerning your recruitment and/or application for employment, including resume data, references, education records, certificates, biodemographic information (e.g., race, gender, nationality, veteran status), trade union membership, citizenship and residency information, and reputational information, as may be provided by you or through a recruiter, staffing agency, or other referring party, and background check information, as may be provided by you or supplied by a background verification service and/or consumer reporting agencies |
Uses of Personal Information
We may use personal information collected about you for the following purposes:
- Presenting the Sites and its contents to you;
- Operating our business and administering customer accounts;
- Communicating through email and other means;
- Promoting our products through sales and marketing;
- Evaluating and processing applications for employment;
- Detecting and preventing abuse and security threats;
- Complying with legal and regulatory obligations;
- Providing you with information that you request from us;
- Fulfilling any other purpose for which you have provided us with your information;
- Notifying you about changes to the Sites, our Terms of Use, or this Privacy Notice;
- In any other way we may describe when you provide the information; and
- For any other purpose to which you intend, direct, or consent.
Collection of Interaction Data
We may also automatically collect other categories of information when you access or use the Sites or otherwise interact with us (collectively, “Interaction Data”), including:
| Log Data | Information collected by our servers when you access our website, including IP addresses, referral URLs, date and time, and crash data |
| Device Data | Information about your device, including type of device, operating system, application IDs, and unique device identifiers |
| Browser Data | Information about your browser type and settings, language preferences, and Cookie data |
| Analytics Data | Approximate location based on your IP address (e.g., geolocation), information about your time of access, session and duration, and your interactions with the Sites |
Uses of Interaction Data
We my use Interaction Data for the following purposes:
- Administering, designing, and improving the Sites;
- Website analytics, e.g., tracking and measuring movements and interactions on the Sites;
- Gaining sales and marketing insights;
- Detecting and prevent abuse and security threats;
- Operating and improving our business and services; and
- Complying with legal and regulatory obligations.
Cookies and Similar Technologies
The technologies we may use to collect Interaction Data include small data files placed on your computer or device when you visit the Sites, commonly known as “Cookies,” as well as “Pixels,” “Web Beacons,” and similar technologies. A Cookie file may contain information that can identify you each time you visit the Sites. The Sites may use Cookies as a way to measure activity and traffic patterns on the Sites in order to improve your experience, monitor usage, compile analytics, and for advertising and marketing purposes.
Your browser can be set to warn you before accepting Cookies and you can choose to refuse Cookies by turning them off in your browser. You do not need to have Cookies turned on to visit the Sites, but you may need them to use certain features of the Sites. Our Cookie Policy further explains our use of Cookies, which is available here: Cookie Statement.
Do Not Track Signals
Under the California Online Privacy Protection Act (“CalOPPA”), we want to inform you about our “Do Not Track” (“DNT”) request policy. DNT is a feature that some web browsers offer to allow users to send signals to websites so that no information about their browser session will be shared. While we take reasonable steps to protect your online privacy, we cannot promise that our current Sites will address every browser setting or honor every personal browser preference. In particular, we have not implemented the necessary programming changes to honor “DNT” browser signals. Please return to this Privacy Notice for further updates on this topic. You can learn more about DNT here: Do Not Track | Electronic Frontier Foundation.
Disclosure of Personal Information
We may disclose any category of personal information and Interaction Data to the following categories of recipients for the purposes described below:
| Subsidiaries and Affiliates | We may disclose personal information and Interaction Data within the Firstup family of companies to operate and improve our business |
| IT Providers | We may disclose personal information and Interaction Data with our IT providers as needed to operate the Sites and our business, including with software and web hosting providers |
| Business Services Providers | We may disclose personal information and Interaction Data with our business services providers, including contractors, consultants, marketing services, security vendors, auditors, information services providers, and professional advisors |
| Advertising Network Partners | We may disclose personal information and Interaction Data with our advertising network partners, including social media platforms, to target you with advertising |
| Talent Acquisition Services Providers | We disclose personal information with service providers that help facilitate the evaluation and processing of applicants for employment |
| Government and Legal | We disclose personal information and Interaction Data with public authorities and third parties as may be required by applicable law, regulation, or legal process |
| Corporate Transaction | We may disclose personal information and Interaction Data as part of a corporate transaction e.g., to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some of assets, whether as a going concern or as a part of bankruptcy, liquidation or similar proceeding |
Information that is incapable of identifying a specific individual (e.g., deidentified or anonymous information) is not considered personal information under this Privacy Notice.
International Transfer of Personal Information
Your personal information may be transferred to countries other than the country from which it originated. Such countries may have different or less protective privacy and data protection laws than the originating country. By sharing personal information with us, you consent to the transfer of your personal information to the United States and the Republic of Ireland.
California Privacy Notice
The section supplements the Privacy Notice and applies only to residents of the state of California:
Categories of personal information we collect
We may collect, and have collected in preceding 12-months, the following categories of personal information:
| Categories | Purposes | Source |
| Identifiers such as a real name, preferred name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers | Recruiting and job application processing; sales and marketing; business administration; website improvement and analytics; legal and compliance | From you, directly or indirectly, or third parties |
| Personal information described in subdivision (e) of Section 1798.80 (e.g., name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information) | Recruiting and job application processing; sales and marketing; business administration; legal and compliance | From you, directly, or third parties |
| Characteristics of protected classifications under California or federal law (e.g., age 40 years or older, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression), pregnancy or childbirth and related medical conditions, reproductive health decisions, sexual orientation, veteran or military status, genetic information (including familial genetic information) | Recruiting and job application processing; legal and compliance | From you, directly |
| Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies | Not collected | Not collected |
| Biometric information | Not collected | Not collected |
| Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement | Sales and marketing; website improvement and analytics | From you, directly or indirectly, or third parties |
| Sensory information, such as audio, electronic, visual, thermal, olfactory, or similar information (e.g., recorded meetings and phone calls) | Recruiting and job application processing; sales and marketing; business administration | From you, directly or indirectly, or third parties |
| Professional or employment-related information | Recruiting and job application processing; sales and marketing; business administration; legal and compliance | From you, directly, or third parties |
| Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99) | Recruiting and job application processing; legal and compliance | From you, directly, or third parties |
| Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes | Recruiting and job application processing; sales and marketing | From you, directly or indirectly, or third parties |
| Sensitive personal information | Recruiting and job application processing; legal and compliance | From you, directly |
Categories of sensitive personal information we collect
From you, directly or indirectly, or from third parties, we may collect, and have collected in preceding 12-months, the following categories of sensitive personal information:
| Categories | Purposes | Source |
| Sensitive identifier (e.g., social security, driver’s license, state identification card, or passport number) | Recruiting and job application processing | From you, directly |
| Account information (e.g., account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account | Not collected | Not collected |
| Precise geolocation (within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet) | Not collected | Not collected |
| Demographic information (e.g., racial or ethnic origin, religious or philosophical beliefs, or union membership) | Recruiting and job application processing | From you, directly |
| Communications content (e.g., mail, email, and text messages unless the business is the intended recipient of the communication) | Not collected | Not collected |
| Genetic data | Not collected | Not collected |
| Biometric information processed for the purpose of unique identification | Not collected | Not collected |
| Personal information collected and analyzed concerning health | Not collected | Not collected |
| Personal information collected and analyzed concerning sex life or sexual orientation | Not collected | Not collected |
Business purposes
We may use and disclose certain categories of personal information for the following business purposes:
| Business Purpose | Categories |
| Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards. | Identifiers; internet or electronic activity information |
| Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes. | Identifiers; and internet or electronic activity information |
| Debugging to identify and repair errors that impair existing intended functionality. | Internet or electronic activity information |
| Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the consumer’s personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business. | Identifiers; internet or electronic activity information |
| Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business. | Identifiers; personal information described in subdivision (e) of Section 1798.80; and internet or electronic activity information |
| Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer | Not applicable |
| Undertaking internal research for testing, research, analysis, technological and product development. | Identifiers; and internet or electronic activity information |
| Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business. | Identifiers; and internet or electronic activity information |
Categories of third parties to whom we disclose personal information
We may disclose personal information to third parties for the following purposes:
| Categories | Third Parties |
| All categories of personal information and sensitive personal information | Subsidiaries and affiliates for processing within our corporate group of companies IT providers to support our business operations Business services providers to support our business operations Talent acquisition services providers to facilitate the identification, acquisition, and retention of talent Government and legal bodies in relation to compliance and legal requirements Corporate transaction in relation to merger, acquisition, divestiture or other transactions involving our business |
| Identifiers; internet or electronic activity information | Advertising network partners to facilitate the delivery of advertising to you |
*No category of sensitive personal information is used or disclosed except for the reasonably expected purposes as described in this Privacy Notice.
Retention period or criteria
Firstup retains personal information for a period commensurate with the purposes for which the personal information was collected or obtained. The criteria used to determine the retention of personal information includes any time necessary for legal and compliance purposes. Personal information may be retained in archival format (e.g., data backups) beyond its retention period.
Opt-out of the sale and sharing of personal information
Firstup will not “sell” but may “share” your personal information as indicated in the following section: California and U.S. State Privacy Rights.
You may opt-out of the sale or sharing of your personal information using the methods provided below.
Opt-out preference signals
At this time, we do not accept opt-out preference signals, including with respect to global privacy controls, from any platform, technology, or mechanism (e.g., web browsers).
Personal information of minors
Firstup has no actual knowledge of having collected the personal information of minors under 16 years of age.
California and U.S. State Privacy Rights
Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the “CPRA”), Virginia Consumer Data Protection Act (“VCPDA”), Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CDPA”), and Utah Consumer Privacy Act (“UCPA”), and their respective implementing regulations (collectively, the “U.S. Privacy Laws”), eligible U.S. state residents may be afforded certain privacy rights subject to certain limitations, including:
- Right to Know. You may have the right to access the specific pieces of personal information collected about you, the sources from which such information was obtained, the categories of information that have been sold or disclosed for a business purpose, and the commercial purpose for which the information was collected or sold, provided to you in a reasonably portable format.
- Deletion. You may have the right to request that we delete any of the personal information we have collected or maintain about you.
- Correction. You may have the right to correct inaccuracies in your personal information.
- Opt-out of the “Sale” and “Sharing” of Personal Information, “Targeted Advertising,” and “Profiling”. You may have a right to opt-out of the “sale” and “sharing” of your personal information, and the use of personal information for “targeted advertising” and “profiling.”
- Sensitive Personal Information. You may have the right to opt-out of or to consent to the use and disclosure of your sensitive personal information.
- Restrict Profiling. You may have the right to restrict the use of your personal information for the purposes of profiling.
- Portability. You may have the right to obtain a copy of certain personal information in portable (e.g., machine readable) format.
- Opt-out of Automated Decision-making. You may have the right to opt-out to certain types of automated decision-making, subject to certain exceptions.
- Non-Discrimination. You may have the right to not be discriminated against in the event you exercise your other rights listed above. If you exercise these rights, you will not be denied goods or services, charged a higher rate, or provided with lower quality products or services.
Exercising your rights under the California and U.S. Privacy Laws
You, or an authorized agent, may exercise your rights by submitting a request to our Legal Team at Data Subject Access Requests or by calling (844) 975-2533. Unless otherwise required by law, Firstup will allow two disclosure requests per 12-month period at no cost to you. For subsequent requests, we may charge a fee if we determine that the request is excessive, repetitive, or manifestly unfounded, but will not do so without providing you with a cost estimate before processing your request.
We respond to legitimate privacy requests within 10 days of receipt and process requests within 45 days unless there is cause for an extension. We will notify you with further information if any extension is necessary. Except with respect to requests to “opt-out” of the sale or sharing of personal information, all privacy requests are subject to proper prior verification before processing. Typically, this means you will be required to verify certain pieces of information we maintain about you, such as name, phone number, date of birth, and/or resume information.
If you are the authorized agent of an individual making a request, you may have to take additional steps to verify your identity and demonstrate that you can exercise the individual’s rights on their behalf.
Do not sell or share my personal information
Firstup will not “sell” but may “share” (including in the past 12-months) personal information, such as internet or electronic activity information and unique device identifiers, for cross-context behavioral advertising, or use your personal information targeted advertising and profiling.
Opt-out of the sale and sharing of personal information, targeted advertising, and profiling
To opt-out of the sale or sharing of your personal information, targeted advertising, and profiling, please visit WebChoices or YourOnlineChoices.eu or make a request at: Data Subject Access Requests or email us at privacy@firstup.io.
Please note that your opt-out choices may apply only to this specific web browser and persist only until the opt-out Cookie is removed or “cleared” from your web browser, e.g., by clearing Cookies in your browser settings.
Privacy Rights of European Data Subjects
Under the General Data Protection Regulation (“GDPR”), UK Data Protection Act 2018 (“UK GDPR”), and Swiss Federal Act on Data Protection (“FADP”), and their respective amendments, revisions, and implementing regulations (collectively, the “European Data Protection Laws”), EU/EEA, United Kingdom, and Swiss data subjects (collectively, “European Data Subjects”) have the following rights concerning their Personal Information:
- Withdrawal of Consent. If processing is on the basis of consent, you may have the right to withdraw consent to our processing at any time.
- Access and Rectification. You may have the right to access, correct, and update your personal information.
- Deletion/Erasure. You may have the “right to be forgotten” through the erasure or deletion of your personal information.
- Portability. You may have the right to move, copy, and/or transfer certain Personal Information from our service to another service.
- Stop Processing. If processing is on the basis of legitimate interests, you may have the right to object to the processing of your personal information and to ask us to restrict the processing of your personal information, subject to certain limitations.
- Submit a Complaint. You have the right to submit a complaint to a data protection authority about our collection and use of your Personal Information. Contact details for the UK data protection authorities is located here, for the EU/EEA here, and for Switzerland here.
Lawful basis
We process the personal information of European Data Subjects on the following lawful bases:
- Legitimate Interests. Where the processing is necessary for the purposes of the legitimate interests pursued by Firstup or by a third party and not overridden by your fundamental rights and freedoms (e.g., product development and security purposes);
- Performance of a Contract. Where the processing is necessary for the performance of a contract with you (e.g., to deliver the service you have requested);
- Consent. Where you have given explicit consent to the processing of your Personal Information for one or more specific purposes (e.g., new and unexpected processing activities); and
- Legal Obligation: Where processing is necessary for compliance with a legal obligation to which Firstup is subject (e.g., compliance with laws and regulations).
Exercising your rights under the European Data Protection Laws
You, or an authorized agent, may exercise your rights by submitting a request to privacy@firstup.io.
We respond to and process requests promptly and within the timeframes required by the European Data Protection Laws. Please note that all requests are subject to proper prior verification before processing.
If you are the authorized agent of an individual making a request, you may have to take additional steps to verify your identity and demonstrate that you can exercise the individual’s rights on their behalf.
Transfer of European Data Subject personal information
Your personal information may be transferred to third countries, including the United States. By sharing personal information with us, you consent to the transfer of your personal information to such third countries. Where applicable, we have adopted appropriate transfer mechanisms to safeguard the transfer of your personal information in accordance with applicable laws, including, the EU Commission Standard Contractual Clauses.
Retention of European Data Subject personal information
Firstup retains personal information for a period commensurate with the purposes for which the personal information was collected or obtained. The criteria used to determine the retention of personal information includes any time necessary for legal and compliance purposes. Personal information may be retained in archival format (e.g., data backups) beyond its retention period.
Data protection inquiries
You may contact Firstup’s Privacy Team at the following:
General Data Protection Regulation (GDPR) – European Representative
Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Firstup has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR:
-by using EDPO’s online request form
-by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium
UK General Data Protection Regulation (GDPR) – UK Representative
Pursuant to Article 27 of the UK GDPR, Firstup has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:
– by using EDPO’s online request form
– by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom
Privacy Rights of Canadian Residents
Under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and the Provincial Privacy Acts (together, the “Canadian Privacy Laws”), and their respective amendments and implementing regulations, Canadian residents are afforded certain privacy rights. If you are a Canadian resident, subject to certain limitations, you have the following rights concerning your Personal Information:
- Openness and Transparency. You may have the right to know the personal information we collect about you and the purposes for its collection.
- Access. You may have the right to access personal information we maintain about you, subject to certain exceptions.
- Correction. You may have the right to correct inaccuracies in personal information we maintain about you.
- Right to Deletion. You may have the right to request that we delete personal information we have collected or maintain about you.
- Right to De-indexing. You may have the right to request your personal information be “de-indexed” from certain types of distribution.
- Right to Withdraw Consent. You may have the right to withdraw consent to our use of your personal information, subject to certain exceptions.
Exercising your rights under the Canadian privacy laws
You, or an authorized agent, may exercise your rights by submitting a request to privacy@firstup.io.
We respond to and process requests promptly and within the timeframes required by the Canadian Privacy Laws. Please note that all requests are subject to proper prior verification before processing.
If you are the authorized agent of an individual making a request, you may have to take additional steps to verify your identity and demonstrate that you can exercise the individual’s rights on their behalf.
If you are a resident of Quebec, then for purposes of the Act respecting Access to documents held by public bodies and the Protection of personal information, Firstup’s Person in Charge is its Head of Information Security and Technology who may be contacted at privacy@firstup.io.
Transfer of Canadian personal information
Your personal information may be transferred to third countries where an adequate level of data protection can be ensured. By sharing personal information with us, you consent to the transfer of your personal information to such third countries.
Privacy Rights of Australian Residents
Under the Australia Privacy Act (“APA”) and state and territory laws (together, the “Australia Privacy Acts”), and their respective amendments and implementing regulations, Australian residents are afforded certain privacy rights. If you are an Australian resident, subject to certain limitations, you have the following rights concerning your personal information:
- Notice. You may have the right to reasonable notice about the personal information we collect, its uses, and our privacy practices and contact information.
- Access. You may have the right to access personal information we maintain about you, subject to certain exceptions.
- Correction. You may have the right to correct inaccuracies in personal information we maintain about you.
- Pseudonymization. You may have right to not identify yourself, or to use a pseudonym, when dealing with us, subject to certain exceptions.
Exercising your rights under the Australia Privacy Acts
You, or an authorized agent, may exercise your rights by submitting a request to privacy@firstup.io.
We respond to and process requests promptly and within the timeframes required by the Australia Privacy Laws. Please note that all requests are subject to proper prior verification before processing.
If you are the authorized agent of an individual making a request, you may have to take additional steps to verify your identity and demonstrate that you can exercise the individual’s rights on their behalf.
Transfer of Australian personal information
Your personal Information may be transferred to entities outside of Australia where reasonable steps are taken to ensure the Australian Privacy Principles are applied to your personal information. Otherwise, by sharing Personal Information with us, you expressly consent to the transfer of your Personal Information to entities outside of Australia.
Third-Party Sites, Blogs, and Social Media
Our Sites include links to other websites, social media widgets, such as the Facebook “Follow Us” button, and other interactive features, blogs, and videos hosted by third parties whose privacy practices may differ from our own. When you use a link to go from our websites to an unaffiliated website, or interact with any such mini-features (e.g., those presented through “iFrames” embedded into our Site), the privacy policies of those respective third parties will apply to your personal information.
Use by Minors
Firstup does not knowingly collect personal information from or about minors who are 16 years of age or younger. Minors should not use the Sites or otherwise provide us their personal information. If we learn that we have collected or received personal information from a minor without verification of parental consent, we will delete that information. If you believe we might have inadvertently collected personal information from or about a minor, please contact us at privacy@firstup.io.
Security of Personal Information
Taking into account the nature and scope of the processing and the particular risks to personal information, Firstup utilizes reasonable technical and organizational measures to help protect the confidentiality, integrity, and availability of personal information and of our systems and services. Firstup regularly tests, assess, and evaluates the effectiveness of the technical and organizational measures for ensuring the security of the processing.
Contact Information for Privacy Inquiries
For inquiries concerning this Privacy Notice, you may contact:
Firstup, Inc.
Attn: Legal Department
1 Montgomery Street, Suite 2150
San Francisco, CA 94104
United States
(844) 975-2533
privacy@firstup.io
English (United States) 
English (United States) 
English (UK) 
English (United States) 
English (United States) 
English (UK)