Sauce Labs Applicant Privacy Notice
Last updated: August 2026
Sauce Labs Inc and its subsidiaries (collectively "Sauce Labs", "we", "us", or "our") are committed to protecting the privacy of job applicants globally. This Global Applicant Privacy Notice ("Notice") explains how Sauce Labs collects, uses, stores, transfers, and processes personal data when you apply for a position in any of our global locations with any of our operating entities (including Sauce Labs Inc, Sauce Labs Canada Inc., Sauce Labs Europe GmbH, Sauce Labs Europe Services GmbH, Sauce Labs India Pvt Ltd, Sauce Labs Poland Sp. z o.o., and Sauce Labs Software UK Ltd).
1. Data Controller
Sauce Labs Inc. (headquartered in San Francisco, CA, USA) acts as the primary Data Controller responsible for the processing of your personal data for global recruitment, applicant evaluation, and workforce planning.
Primary Data Controller: Sauce Labs Inc., 450 Sansome Street, 9th Floor, San Francisco, CA 94111, USA
EU / German Operating Entity: Sauce Labs Europe GmbH (where applicable as joint or local recruiting entity)
Data Protection Contact: privacy@saucelabs.com
2. Categories of Personal Data We Collect
We collect data directly from you when you submit an application, via automated recruitment platforms (e.g., Greenhouse), or from authorized third parties (e.g., professional networks like LinkedIn or recruitment agencies):
Identity & Contact Data: Name, home address, email address, phone number, work authorization status, and country of residence.
Professional & Educational Background: Resume/CV, cover letter, employment history, education, diplomas, professional certifications, portfolio links, and references.
Interview & Evaluation Records: Interviewer feedback, assessment/technical test scores, compensation expectations, and email correspondence.
Sensitive Personal Information (where strictly permitted/required by local law): Disability status (for workplace accommodations), diversity monitoring details (where legally required or voluntarily provided), or background check findings (subject to applicable regional statutes).
3. Purposes & Legal Bases for Processing
We process applicant personal data to manage our recruitment pipeline, assess qualifications for open positions, conduct interviews, perform pre-employment background screening where lawful, and execute employment contracts.
European Economic Area (EEA) & UK: Processing is necessary for pre-contractual steps (Art. 6(1)(b) GDPR) and employment decision-making under local member-state law (Sec. 26 of the German Federal Data Protection Act - BDSG). Where data is retained beyond the initial recruitment cycle for future consideration, processing relies on your explicit consent (Art. 6(1)(a) GDPR) or legitimate interests (Art. 6(1)(f) GDPR).
United States: Data is processed pursuant to legitimate operational requirements for recruitment, legal compliance, onboarding, and EEOC/statutory reporting.
India: Data is processed for evaluating candidate suitability and establishing pre-employment arrangements under the Digital Personal Data Protection Act (DPDP Act).
4. Cross-Border Data Transfers: DPF Framework & SCCs
Because Sauce Labs Inc. is located in the United States, personal data collected from applicants outside the US (including Canada, the EEA, UK, and India) will be transferred to and processed by Sauce Labs Inc. in the US and stored within our global cloud tools (e.g., ATS processors).
To protect cross-border applicant data, Sauce Labs relies on the following legal transfer mechanisms:
EU-U.S. Data Privacy Framework (DPF): Sauce Labs Inc. complies with and certifies adherence to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as administered by the U.S. Department of Commerce regarding the transfer of personal data from the EEA, UK, and Switzerland to the United States.
Standard Contractual Clauses (SCCs): To ensure full coverage across all international transfers, including third-party processors, subprocessors, or regional support operations outside adequacy zones (such as India), Sauce Labs Inc. utilizes the European Commission’s Standard Contractual Clauses (EU SCCs) and the UK International Data Transfer Addendum, supplemented by technical, organizational, and encryption standards.
5. Retention Periods
Applicant data is retained only as long as necessary to complete the hiring process or satisfy applicable legal obligations:
Canada: Applicant records are retained for 1 to 2 years following a hiring decision to satisfy statutory obligations and defend against potential claims under federal and provincial employment and human rights legislation (e.g., Canadian Human Rights Act), unless you consent to a longer retention period in our Talent Pool or earlier deletion is required by applicable provincial law.
Germany / EEA / UK Rules: Unsuccessful candidate records are deleted within 180 days after notice of rejection to satisfy legal defense requirements under equal treatment legislation (e.g., German AGG under Sec. 15 BDSG / Art. 6(1)(f) GDPR), unless you explicitly opt in to remain in our Talent Pool.
United States: Applicant records are preserved in accordance with federal (e.g., EEOC 1-year mandate / OFCCP regulations) and state requirements (specifically California Fair Employment and Housing Act / Cal. Gov. Code § 12946 via SB 807, requiring a 4-year retention period).
India: Retained only for the duration necessary to satisfy the specified evaluation purpose or applicable legal retention mandates under the DPDP Act.
6. Jurisdiction-Specific Addendums
A. European Union (EEA), United Kingdom & Germany Addendum
Talent Pool Consent: Storing your materials for future opportunities beyond 6 months requires voluntary, explicit opt-in consent, which can be withdrawn at any time.
Data Subject Rights: EEA/UK candidates have the right to request access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21).
Supervisory Authority: You have the right to file a complaint with a competent Data Protection Authority in your jurisdiction (e.g., the Berlin Commissioner for Data Protection and Freedom of Information).
B. United States & California Resident Addendum (CCPA / CPRA)
For California residents pursuant to the California Consumer Privacy Act:
Categories Collected: Identifiers, employment history, education data, protected classifications (if disclosed), and sensitive personal information (e.g., SSN for onboarding).
No Sale or Cross-Context Sharing: Sauce Labs does not sell applicant personal data and does not share applicant personal data for cross-context behavioral advertising.
Candidate Rights: You have the Right to Know/Access, Request Deletion, Correct Inaccurate Data, and Non-Discrimination for exercising your privacy rights.
FCRA Notice: Background checks conducted in the US are governed separately under the Fair Credit Reporting Act (FCRA) and require a standalone written disclosure prior to execution.
C. India Resident Addendum (DPDP Act)
For candidates residing in India:
Purpose Limit: Data is processed exclusively for pre-employment evaluation and recruitment for Sauce Labs open roles.
Consent & Withdrawal: Where processing relies on consent, you maintain the right to withdraw consent at any time.
Grievance Officer: Questions or grievances under Indian data protection law may be directed to our designated Privacy Office at privacy@saucelabs.com.
D. Canada Resident Addendum (PIPEDA, BC PIPA, AB PIPA & Quebec Law 25)
This section applies specifically to applicants residing in Canada:
Scope & Consent: Your personal data is collected and processed solely for evaluating your suitability for open roles at Sauce Labs, establishing an employment relationship, and fulfilling lawful operational requirements. By submitting your application, you acknowledge and consent to the collection, use, and disclosure of your personal data as described in this Notice, pursuant to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation (British Columbia PIPA, Alberta PIPA, and Quebec Law 25).
Cross-Border Transfers & SCCs: Personal data collected in Canada is transferred to and processed by Sauce Labs Inc. in the United States and stored within global cloud infrastructure (including ATS platforms). To ensure your personal data receives an equivalent level of protection when transferred internationally, Sauce Labs relies on Standard Contractual Clauses (SCCs), data transfer impact assessments, and strict technical, organizational, and encryption safeguards in accordance with PIPEDA’s accountability principles and Quebec Law 25.
Applicant Privacy Rights: Canadian applicants have the right to request access to their personal information, request correction of inaccurate records, and withdraw consent for processing (subject to legal or contractual limitations).
Quebec Residents: For applicants in Quebec, your personal information is managed in compliance with Quebec Law 25. You may exercise your rights to access, rectify, or request the restriction/cessation of dissemination of your personal data by contacting our Privacy Office at privacy@saucelabs.com.
7. Contact Information
To exercise your privacy rights, submit a data subject request, or ask questions regarding Sauce Labs Inc.'s DPF certification or transfer safeguards, contact:
Email: privacy@saucelabs.com
Mail: Sauce Labs Inc Attn: Legal Department 450 Sansome Street, 9th Floor San Francisco, CA 94111, USA