Privacy Policy for California Candidates

California recently passed a law that requires us to give you this notice about how we collect and use your personal information. We encourage you to read it carefully.

Effective date: January 1, 2023

This privacy policy (“Policy”) applies to eShares, Inc. DBA Carta, Inc.’s, and its related and/or affiliated companies (“Company” or “Carta”) online tools and platform(s), including the associated Carta mobile and desktop applications (collectively, the “Services”), www.carta.com and other Carta websites (collectively, the “Websites”) and other interactions (e.g., customer service inquiries, user conferences, etc.) you may have with Carta. The Policy describes how Carta collects, uses, discloses, and shares your personal information.

What we collect

1. Introduction

This notice (“Notice”) describes the categories of personal information that eShares, Inc. dba Carta, Inc. (“Company”, “we”, “us” and “our”) collects about California residents who apply or are recruited for a job with us or one of our affiliates (“candidates”), and the purposes for which we use that information.

For purposes of this Notice, “personal information” has the meaning given in the California Privacy Rights Act of 2020 (the “CPRA”) but excludes information exempted from the CPRA’s scope.

This Notice is separate from an employment contract and does not create or form part of any contract for employment or otherwise.

If you have questions about this Notice, please contact legal@carta.com.

2. Information we collect about candidates

2.1. Categories of personal information

The categories of personal information we may collect and process during the application and recruitment process include:

• Contact information, such as home address, telephone number, and email address;
• Information from job application materials or recruiters, such as your job application, resume or CV, cover letter, writing samples, references, work history, education transcripts, whether you are subject to prior employer obligations, and information that referrers provide about you;
• Professional qualifications, such as licenses, permits, memberships, and certifications;
• Information from the application process, such as any phone-screens, interviews, evaluations and outcomes of recruiting exercises;
• Immigration status and other information that would allow us to verify your employment eligibility;
• Biographical information, such as name, gender, date of birth, professional history, references, language proficiencies, education details, and information you make publicly available through job search or career networking sites;
• Job preferences, such as desired position and compensation, location preferences and willingness to relocate;
• Employment history;
• Identification information, such as government-issued identification information (e.g., driver’s license), or other similar identifiers;
• Background check information, such as information necessary to complete background, credit, drug/alcohol and/or other checks when permitted by law, and information received during these checks;
• Genetic data, such as fingerprints-check
• Information needed to understand and assess accommodation requests regarding potential disabilities or other health conditions; and
• Other information you provide to us.

Providing personal information to us is voluntary. However, if you do not provide sufficient information, we may be unable to consider your application or, if you are hired, your subsequent promotion, transfer or relocation.

In certain cases we may ask you for additional information for purposes of complying with applicable laws. We may also inquire about criminal records. We will do so only where permitted by applicable law.

2.2. Sources of personal information

We collect personal information from you when you apply for a job and throughout the job application or recruitment process. We may also collect your personal information from other sources and combine it with the personal information you provide us. For example, we may collect your personal information from:

• Job board websites you may use to apply for a job with us;
• Prior employers that provide us with employment references;
• Professional references that you authorize us to contact;
• Pre-employment screening services, such as background check providers, credit check, or other screen providers (where permitted by law);
• Employment agencies and recruiters;
• Your educational institutions;
• Your public social media profile or other publicly-available sources;
• Online activity information that we and our service providers collect using server logs, “cookies” and similar technologies on the Careers Site. Please see our Privacy Policy for more information.
• Other Company personnel.

3. How we use personal information about candidates

3.1. Purposes for which we use personal information

We may use the categories of personal information above for the following purposes:

• Recruitment management. Managing recruitment generally, such as:
  • operating the careers website we maintain at www.carta.com/careers/ or any other site to which this Notice is posted (“Careers Site”);
  • recruiting, interviewing and evaluating job candidates;
  • conducting background checks and other pre-employment screening (where permitted by law);
  • analyzing and improving our application and recruitment processes;
  • accommodating disabilities or health conditions;
  • communicating with you regarding your candidacy, opportunities with the Company or about the Careers Site and any changes to applicable terms or policies; and
  • other business operations.
• Compliance, safety and fraud prevention, such as:
  • complying with or monitoring compliance with legal and other requirements, such as reporting and equal opportunities monitoring requirements, where applicable;
  • complying with internal policies and procedures;
  • complying with lawful requests and legal process, such as to respond to subpoenas or requests from government authorities;
  • protecting our, your or others’ rights, safety and property;
  • investigating and deterring against fraudulent, harmful, unauthorized, unethical or illegal activity, or conduct in violation of our policies or procedures; and
  • sharing information with government authorities, law enforcement, courts or private parties where we have a good-faith belief it is necessary for the foregoing purposes.
• Analytics. Creating anonymous, aggregated or de-identified data that we use and share to analyze our application and recruitment activities, business and for other lawful business purposes.

3.2. Sharing personal information

We may share your personal information with other parties as necessary for the purposes described above. While it’s not an exhaustive list, here are some ways we may share your personal information:

• Affiliates. Our corporate parent, subsidiaries, and other affiliates under the control of our corporate parent, for purposes consistent with this Notice or to operate shared infrastructure, systems and technology.
• Company service providers. Companies that provide us with services that help us manage the recruiting process and operate our business, such as job boards, recruiters, interviewing and testing, pre-employment screening, interview travel booking and expense reimbursement (where applicable), relocation (where applicable), and recruitment analytics.
• Government authorities, law enforcement and others. Government authorities, law enforcement, courts, and others as described in the compliance, safety and fraud prevention section above.
• Business transfers. Parties to transactions and potential transactions whereby we sell, transfer or otherwise share some or all of our business or assets, including your personal information, such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.
• Professional advisors. Lawyers, immigration advisors, and other outside professional advisors.
• Customers and business partners. Customers, other companies and individuals with whom the Company does business or is exploring a business relationship.

4. Other information about this Notice

4.1. Third parties

This Notice does not address, and we are not responsible for, the practices of any third parties, which have their own rules for how they collect and use your personal information. Our links to third party websites or services are not endorsements.

4.2. Changes to this Notice

We reserve the right to change this Notice at any time. The “Effective Date” heading at the top of this Notice indicates when it was last revised. Any changes will become effective when we post the revised notice on our Careers Site.

4.3. Right to know

You have the right to know the personal information we collect about you. We already provide this access, to there is no substantial change here. If you do submit a request to receive the information we have collected about you, where technically feasible, we will respond by confirming receipt within 10 days and will respond to you within 45 days. This timeline also applies for the other rights listed below.

4.4. Right to delete

You have a right to have us delete the personal information we collect about you, except when we need to comply with a legal obligation.

4.5. Right to opt-out of sale or sharing

You have a right to opt-out of the sale of your personal information (as defined under the CPRA) to third parties or sharing of your information that is determined not to be necessary for Carta business purposes.

4.6. Right to correct inaccurate information

You have a right to correct the inaccurate personal information we collect about you. We will use commercially reasonable efforts to correct your information upon your request.

4.7. Right to limit use and disclosure of sensitive personal information

You have a right to have us limit our use and disclosure of your sensitive personal information. We may still collect information about race and ethnic origin as we continue to further our commitment to Diversity, Equity, and Inclusion and Equity for All.

4.8. Right to Anti-Retaliation

You have a right not to be discriminated against for exercising any of the CPRA’s data rights. Any adverse employment action resulting from your efforts to exercise your rights may be deemed “retaliation.”

4.9. Children

The Careers Site is not intended for minors under the age of 18.

5. Your obligations

Among other obligations, including without limitation the obligation to provide complete and accurate information in recruiting documents and processes, it is your responsibility to ensure that information you submit does not violate any third party’s rights.

You should keep your personal information on file with the Company up to date and inform us of any significant changes to it.