Applicant Privacy
Statement

Effective Date: January 24, 2024

Elasticsearch, Inc., our subsidiaries and affiliated companies ("Elastic," "we," "us," and "our") are committed to protecting your privacy. This Applicant Privacy Statement ("Statement") describes the privacy practices that apply to our collection, use and disclosure of information relating to you as an identified or identifiable applicant ("Personal Data" also referred to as “Personal Information” in some regions) when you ("you," "your" or "the Applicant") engage with us for employment or internship opportunities, via any method (collectively, the "Sites"), as well as how we use and share that information. We appreciate your interest in Elastic and take care to process and use your Personal Data responsibly.

If you have any questions about this Statement, please contact us by submitting your question via this form.

EEA, United Kingdom and California Residents

If you are resident in the European Economic Area ("EEA"), United Kingdom (“UK”) or Switzerland, please also refer to "Your Privacy Rights" below for additional information.

If you are a California resident, the California Privacy Rights Statement supplements this Applicant Privacy Statement with specific rights in California and provides an explanation of how Elastic “discloses” for “business purposes,” but does not “sell” or “share” your “personal information,” as those terms are defined under California law.

Personal Data We Collect
How We Use Your Personal Data
Personal Data Sharing
Legal Bases for Processing Your Personal Data
Your Privacy Rights
International Transfers of Your Personal Data
Security
Our Retention of Your Personal Data
Your Responsibilities
Changes to this Statement
How to Contact Us

Personal Data We Collect

To process your application, we ask you to voluntarily provide us with some of your Personal Data that may be necessary to complete an evaluation of your application, and without it, our ability to consider you as a candidate may be limited.

From You

As an Applicant, you provide Elastic with certain personal data, including educational and employment background, contact information and preferences, job qualifications, work permit or visa information, and jobs or other career opportunities for which you would like to submit an application. You also may choose to provide Elastic with additional information, such as your resume, academic transcripts, employment references and related information, compensation requests, information about special needs or health conditions and information relating to accommodations that you may request during the recruiting process.

Sensitive personal data

Some Personal Data may be considered sensitive personal data under certain privacy laws. Sensitive personal data includes, for example, government-issued identification number, information relating to a person's race or ethnic origin, political opinions or religious beliefs, physical or mental health or condition, sexual orientation, or trade union membership. It may include information about an individual's criminal offenses or convictions, as well as any other information deemed sensitive under applicable data protection laws.

Elastic does not request sensitive Personal Data in connection with recruiting unless permitted or required by local law (for example, for equal opportunity monitoring or internal policies related to diversity and anti-discrimination). Where required by applicable data protection or privacy law, we will obtain your consent to our use of your sensitive Personal Data.

From Third Parties

Elastic may also collect information from third parties who are lawfully entitled to share your information with us, for example, in connection with a background or pre-employment screening or an employment reference. Other examples include social media sites (such as LinkedIn) and third-party partners who help us manage and improve our recruiting process (such as recruitment service providers, vendors facilitating interviews, data brokers/aggregators, and reporting and analytics service providers).

Where permitted by law and to the extent applicable, Elastic may also need to carry out background or criminal checks to determine your suitability for an open position or opportunity.

Automated Data Collection

We automatically gather Personal Data from our Sites, for example, from our "Careers" page where you can visit and search for open positions. For more details about the Personal Data we collect through our Sites, please see our Cookie Statement.

How We Use Your Personal Data

We use your Personal Data (as set out above) in our application and recruitment process for purposes including:

• Assessing your qualifications, skills, and interests against our career opportunities;
• Verifying the information you or others provide and carrying out reference checks or conducting background checks (where applicable);
• Facilitating the recruiting and interview process;
• Preparing an offer letter, if your application is successful;
• Managing and improving our recruiting processes;
• Producing management reports containing analysis related to recruiting metrics, such as length of the recruiting process;
• Complying with applicable laws, regulations, legal processes or enforceable governmental requests;
• Proactively researching your educational and professional background and skills and contacting you if we think you would be suitable for a role with us; or
• Where we have identified you as a potential candidate from information that we've collected from public sources, in order to suggest suitable opportunities for you at Elastic.

We will also use your information to protect the rights and property of Elastic, our users, applicants, candidates, employees or the public as required or permitted by law.

If you are offered and accept employment with Elastic, the information collected during the application and recruitment process will become part of your employment record.

Personal Data Sharing

Elastic will not sell your Personal Data. We take care to limit access to your Personal Data to only those who need access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. We may share Personal Data about you with third parties pursuant to appropriate contractual terms in the following circumstances:

• Our subsidiaries and affiliated companies, in relation to the purposes described above.
• Vendors, consultants and other service providers: We may share your Personal Data internally and with service providers, agents and other third parties (for example, recruiters, consultants, vendors facilitating interviews, reporting and analytics service providers, attorneys and pre-employment screening services as necessary in connection with recruiting, employment, corporate governance, acquisitions, and legal or regulatory requirements). We require these third parties to protect the information they receive with appropriate security measures and prohibit them from using the information for their own purposes or outside what is necessary to provide the service.
• Compliance with laws or any competent law enforcement body, regulatory body, government agency, court or third party: We may disclose information where we believe disclosure is necessary or required by law or regulation, to comply with legal process or government requests (including in response to public authorities to meet equal opportunity laws, national security or law enforcement requirements); or to exercise, establish or defend our legal rights.
• Business transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, acquisition, dissolution, corporate reorganization or similar event. We will inform any buyer that your information shall only be used in accordance with this Statement.
• With your consent: We may disclose your Personal Data for any purpose to which you consent.

Legal Bases for Processing Your Personal Data

Our legal bases for processing your Personal Data in the United Kingdom, EEA and Switzerland, in the ways described in this Statement, include:

• As necessary to prepare and enter into an employment contract with you.
• Consistent with specific consents, which you may revoke at any time.
• As necessary to comply with our legal obligations.
• To protect your vital interests or those of others.
• As necessary for our (or others’) legitimate interests, including our interests in considering candidates for current and future employment opportunities, and in managing and improving our recruitment and hiring processes, unless those interests are overridden by your interests or fundamental rights and freedoms, which require protection of personal data.

Special categories of Personal Data: Information such as health information is subject to special protections under EU and UK law. We may process such data where necessary to carry out our obligations or for the establishment, exercise or defense of a legal claim by us, or with your explicit consent, or for the exercising of our rights or your rights in the context of employment or social security law. For example, we may need to process information about your health to accommodate any special needs you have when you come on site for an interview.

Your Privacy Rights

You may have certain legal rights under applicable law depending on your location. For example, the European Union's ("EU") General Data Protection Regulation applicable to EU residents' personal data, or the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2021 (“CCPA”)).

For example, you may have the right to access, rectify, port and erase your personal data. You also have the right to object to and restrict certain processing of your personal data. This includes the right to object to our processing of your personal data where we are pursuing our legitimate interests or those of a third party.

To exercise your rights, you may raise a request by submitting this form. We will try to respond to your request(s) as soon as reasonably practicable, consistent with applicable law. Where legally permitted, we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, or jeopardize the privacy of others.

If you are a UK or EEA resident, you also have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority.

International Transfers of Your Personal Data

Elastic operates globally, which means your Personal Data, including Personal Data collected in the United Kingdom, European Economic Area ("EEA") or Switzerland, may be stored and processed outside of the country or region where it was originally collected. We will protect your Personal Data in accordance with this Statement wherever it is processed and will take contractual or other appropriate safeguards to protect it in accordance with applicable laws. These steps include implementing the European Commission's standard contractual clauses for data transfers from the United Kingdom, EEA or Switzerland to the United States and other countries. We may also rely on the European Commission's adequacy decisions about certain countries, as applicable. We have implemented similar appropriate safeguards with our service providers, partners and affiliates.

Security

We take security seriously and use appropriate technical and organizational security measures to safeguard your information. But no security procedures are guaranteed to be 100% secure so we encourage you to take care when disclosing Personal Data online and to use tools, such as endpoint security, Internet firewalls, anti-virus and anti-spyware software, and similar technologies to protect yourself online. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us (see the "How to Contact Us" section below).

Our Retention of Your Personal Data

We'll retain your Personal Data for as long as required to comply with our legal obligations, resolve disputes, and to enforce our contractual agreements, or as necessary for our legitimate interests, such as to consider you for other current and future employment opportunities at Elastic.

If you're successful in your application for a position at Elastic, we retain the information that you provide during the application process, and information about your application process, as part of your employee records.

If you do not want us to retain your information for consideration for other roles, or want us to update it, please submit your request through our form. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

Your Responsibilities

You are responsible for the information you make available to Elastic, and you must ensure it is truthful, accurate, and not misleading in any way. You must ensure that the information does not contain material that is obscene, defamatory, or infringing on any rights of any third party; does not contain malicious code; and is not otherwise legally actionable. Further, if you provide any information concerning any other person, such as individuals you provide as references ("referee"), you are responsible for providing any notices and obtaining any consents necessary for Elastic to collect and use that information as described in this Statement before you provide the referee's Personal Data to Elastic.

Changes to this Statement

Elastic will review and update this Statement periodically in response to changing legal, technical, and business developments. When we update this Statement, we will note the date of its most recent revision above. If we make material changes to this Statement, we may take appropriate measures to inform you in a manner that is consistent with the significance of the changes we make. We encourage you to review this Statement frequently for information on how Elastic is processing your information.

How to Contact Us

If you have any questions or concerns regarding this Statement, you may call us at +1.650.458.2620, or submit your request through our form, or send your request by postal mail to:

Elasticsearch, Inc.
Attn: Privacy Team
88 Kearny Street

Floor 19
San Francisco, CA 94108 USA

or

Elasticsearch B.V.
Attn: Privacy Team
Keizersgracht 281
1016 ED Amsterdam
The Netherlands

Data Protection Officer. Elastic has appointed an external Data Protection Officer for German data subjects. For questions about how information is gathered, stored, shared, used, or to exercise any data subject rights, please contact our Data Protection Officers here.

If we are unable to resolve your concerns, you have the right to contact your local data privacy supervisory authority or seek a remedy through the courts if you believe your requests to exercise your rights have not been honored.

*******

Elastic Prospect Privacy Notice

Effective Date: September 27, 2023

This Prospect Privacy Notice (“Notice”) describes the privacy practices that apply to our collection, use and disclosure of your personal data that we have collected from public or third-party sources for the purpose of sharing Elastic career opportunities with you.

Data Controller

Your personal data has been collected by Elastic N.V., who will act as the Data Controller located at Keizersgracht 281, 1016 ED Amsterdam, the Netherlands, and can be contacted by emailing [email protected].

We obtained your personal data from a public or third-party source (the “Source”) whilst looking to fill a number of positions within our organization. You were informed of the identity of the Source in our first communication to you.

Categories of Personal Data

The personal data may include your resume/CV, contact details (name, address, email, etc.), educational background, qualifications, employment history and any other information available through the Source’s database.

Purpose and Legal Basis for Processing

We process this information for the purpose of identifying, evaluating and selecting suitable applicants for employment at Elastic. Where legally applicable, we use legitimate interest as our legal basis for this purpose.

Data Recipients and Data Transfers

Your personal data may be shared internally at Elastic with individuals involved in Elastic's recruitment process. We may also share your personal data with third-party service providers who assist us in managing the recruitment and hiring process. Some service providers we engage with for this purpose may operate internationally. In such cases they may transfer your personal data to other jurisdictions, like the United States. All such transfers will be subject to appropriate additional safeguards.

Your personal data will not be disclosed to any other third party for purposes other than those related to the recruitment process without your explicit consent, unless required by law.

Data Retention

Your personal data will be retained for as long as necessary to fulfill the purpose outlined in this Notice, as well as to comply with any legal obligations. If you are not selected for employment with Elastic, your personal data will be deleted from our systems after a reasonable period, unless you provide your consent to retain your personal data for future opportunities.

Your Rights

Your right to access and control your personal data may vary depending on your location and applicable law. These rights may include the right to request: (1) access to and rectification or erasure (under certain circumstances) of your personal data; (2) restrict the processing of your personal data; and (3) object to the processing. You may also have the right to data portability and to lodge a complaint with your supervisory authority. To see which rights, if any, apply to you and how to exercise applicable rights, see Elastic’s General Privacy Statement.