General Privacy Statement
and Job Applicant Privacy Notice

Effective Date: January 1, 2021

This General Privacy Statement and Job Applicant Privacy Notice (the “Notice”) applies solely to job applicants, employees, owners, directors, officers, and contractors (collectively referred to in this Notice as “you” or “your” or “person”) who visit or use QuoteLab, LLC’s, which does business as MediaAlpha, (referred to in this Notice as “we”, “us”, “our”, or “MediaAlpha”), prospective talent and job applicants website(s) and associated services and/or who otherwise apply or respond to prospective talent or job applicant sourcing opportunities with us. MediaAlpha adopts this Notice to comply with the applicable laws, rules, and regulations (including but not limited to the General Data Protection Regulation (which we refer to as “GDPR”) for those persons who are residents of the European Economic Area (“EEA”) or the United Kingdom (“UK”)).

KINDLY NOTE, THIS NOTICE EXPLAINS, AMONG OTHER THINGS:

• WHAT INFORMATION WE COLLECT DURING OUR APPLICATION AND RECRUITMENT PROCESS AND WHY WE COLLECT IT;
• THE SOURCES OF SUCH INFORMATION;
• HOW WE USE AND SHARE YOUR INFORMATION; AND
• YOUR RIGHTS AND HOW TO EXERCISE THEM.

PLEASE READ THIS NOTICE CAREFULLY SO THAT YOU ARE FULLY INFORMED.

UPON REQUEST, THIS NOTICE CAN BE MADE AVAILABLE IN ALTERNATIVE FORMATS (E.G., LARGE PRINT, AUDIO, ETC.). PLEASE CONTACT PEOPLEOPS@MEDIAALPHA TO REQUEST AN ALTERNATIVE FORMAT IF NEEDED SO YOU CAN ACCESS THE INFORMATION IN THIS NOTICE.

This Notice does not create or form part of any contract for employment or otherwise.

COMPLIANCE WITH LOCAL LAWS: Kindly note, this Notice is a general guide for how MediaAlpha handles your information. You should be aware that applicable laws, rules, and regulations relating to the processing, privacy, and security of your information (in particular with respect to your personal information) can vary in different jurisdictions where MediaAlpha operates and has employees and contractors. Our policy is to comply with applicable local laws, rules and regulations including requirements in certain countries that requires MediaAlpha notify those persons in that country of its personal information or practices, and in some cases, obtain consent to those practices.

Where local such applicable local laws, rules, and regulations are stricter than the practices described in this Notice, we have adopted specific practices in those locations to satisfy those stricter requirements. Where applicable local laws, rules, and regulations are less strict than this Notice, the protections described in this Notice will apply.

I. Categories of Information We Collect

When a person applies to join our team or over the course of a person’s relationship with us, we may collect the following categories of information including personal information (also known n as personal data).

Providing any information to us including personal information is voluntary. If, however, you do not provide sufficient information, we may be unable to consider your application or, if you are hired, your subsequent promotion, transfer, or relocation.

In certain cases, we may ask you for additional information for purposes of complying with applicable laws, rules, and regulations.

• Contact information, such as email address, telephone or mobile phone number, and home or postal address;
• Biographical information, such as name, alias and other names, gender, date of birth, marital or domestic partner status, Social Security Number or national identifier(s)/number(s), driver’s license number or state ID card number, passport number, and other unique personal identifiers associated with you or other beneficiaries such as your spouse or child; classifications protected under state or federal Equal Employment Opportunity laws (such as race or national origin), medical condition or information, and health insurance information and policy number;
• Job application information and materials and any information provided to recruiters, such as your job application, resume or CV, cover letter, references, education history, work history, whether you are subject to prior employer obligations;
• Immigration status and other information that would allow us to verify your employment eligibility;
• Information needed to understand and assess accommodation requests regarding potential disabilities or other health conditions;
• Website use information, and sign-in and device information, such as username and password, account name or number, and other online or device identifiers, Internet or other electronic network activity information such as browsing and search history and information regarding interactions with websites and applications, our systems, and networks (to learn more about the information we collect automatically on MediaAlpha websites (like Join Our Team and Careers) read Information We Collect Automatically and Cookies and Technologies and to learn how our jobs board website partner handles your information (collectively the foregoing are referred to as our “job applicant and recruitment websites”) read our partner’s privacy policy);
• Educational, professional, and employment history, such as current employment, previous employment, educational institutions attended and rewards, certificates, and degrees achieved;
• Professional qualifications, such as licenses, permits, memberships, and certifications;
• References, such as reference name, title, and contact information, association or relationship with you, and any information that the reference provides about you;
• Job preferences, such as desired position and compensation, location preferences and willingness to relocate;
• Information from the application process, such as any phone-screens, interviews, evaluations and outcomes of any tests and other recruiting exercises;
• Geolocation data, including badge access and telematics data;
• Biometric information, including imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, or voice recordings and keystroke patterns or rhythms, gait patterns or rhythms, and other characteristics that can be used to establish identity; and
• Financial information, including bank account, billing address, and information about your income and account balances;
• Background check information, such as information necessary to complete background, credit, and/or other checks (like criminal records) when permitted by law, and information received during these checks; and
• Other information you provide to us, including any other information you make publicly available through job search or career networking sites.

II. Sources of Information

We collect the above information (including personal information) from you when you apply for a job and throughout the job application or recruitment process. We may also collect such information from other sources and combine it with the information (including personal information) you provide us. For example, we may collect your information from:

• Job board websites, such as those you use to search our job openings or that you use to apply for a job with us;
• Prior employers, who provide us with employment references;
• Professional references, that you authorize us to contact and who provide us information about you;
• Pre-employment screening services, such as background check providers (where permitted by law);
• Employment agencies and recruiters;
• Your educational institutions;
• Your public social media profile or other publicly available sources;
• Online activity, collected by us or our service providers, partners, contractors, or vendors, such as information collected using cookies and other similar technologies (to learn more about the information we collect automatically on MediaAlpha websites (like Join Our Team and Careers) read Information We Collect Automatically and Cookies and Technologies and to learn how our jobs board website partner handles your information (collectively the foregoing are referred to as our “job applicant and recruitment websites”) read our partner’s privacy policy); and
• Our personnel.

II. How We Use and Share Your Information

(a) Purposes for Which We Use Your Information.

We may use the information detailed above for the following purposes:

• Managing Recruitment, such as the following:
  • operating our job and recruitment websites which reference, link to, or post this Notice;
  • recruiting, interviewing, and evaluating your application, employment, or performance of services with us;
  • determining your eligibility for a position with the company, such as processing your application, assessing your fit with us or for a specific role, conducting interviews, and keeping records related to our hiring process;
  • conducting background checks and other pre-employment screening (where permitted by law);
  • analyzing and improving our job and recruitment websites and our application and recruitment processes and activities;
  • accommodating disabilities or health conditions;
  • communicating with you regarding your application, opportunities with MediaAlpha, or about the job and recruitment websites and any changes to applicable terms or policies;
  • responding to your inquiries; and
  • other business operations.
• Managing Employment, such as the following:
  • Managing compensation, benefits, and employment-related expenses, such as payroll processing, managing salaries and expenses, managing corporate credit cards and expense reimbursements, as well as administering equity, compensation, bonus, and insurance programs;
  • Managing professional development, performance, and conduct, such as responding to complaints of misconduct, managing conflicts of interest, conducting performance appraisals, supporting career development, and managing whistleblower programs;
  • Complying with our legal obligations, such as those related to tax and anti-discrimination laws;
  • Responding to requests, inquiries, and complaints; and
  • Other routine business purposes.
• Managing Compliance, Safety, and Fraud Prevention, such as the following:
  • Protecting the company against illegal activity and other misconduct, such as by detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
  • undertaking activities to verify and maintain the quality, safety, and performance of our products and services, including product and service testing, research, and development;
  • complying with internal policies and procedures;
  • investigating and deterring against fraudulent, harmful, unauthorized, unethical or illegal activity, or conduct in violation of our policies or procedures;
  • complying with lawful requests and legal process, such as responding to subpoenas or requests from government or supervisory authorities;
  • sharing information with government authorities, law enforcement, courts or private parties where we have a good-faith belief it is necessary for the foregoing purposes;
  • Complying with or monitoring compliance with legal obligations and other requirements, such as those related to equal opportunities, employment, safety, fraud, tax, and anti-discrimination laws;
  • protecting our, your, or others’ rights, safety, and property;
  • Responding to your inquiries; and
  • Other routine business purposes.
• Conducting Analytics, such as the following:
  • Creating anonymous, aggregated, or de-identified data that we use and share to analyze, understand, and improve the use of our job and recruitment websites, our application and recruitment activities, our business and products, and for other lawful business purposes.

(b) How We Share Your Information.

We may share you’re your information (including personal information) with other parties as necessary for the purposes described above including with:

• Affiliates, including our corporate parent, subsidiaries, and other affiliates under the control or reasonable control of our corporate parent, for purposes consistent with this Notice or to operate shared infrastructure, systems, and technology;
• Service providers, vendors, contractors, consultants, and professional advisors, such as companies that provide us with services that help us manage the recruiting process and operate our business, such as job boards, recruiters, interviewing and testing, virtual meeting software and service providers, pre-employment screening, interview travel booking and expense reimbursement (where applicable), relocation (where applicable), and recruitment analytics, and those that provide legal services (such as lawyers), immigration services and advisors, and other outside professional advisors;
• Government authorities, law enforcement, and others, such as government authorities, law enforcement, courts, and others as described in the Managing Compliance, Safety, and Fraud Prevention section above;
• Business transfers, including parties to transactions and potential transactions whereby we sell, transfer, or otherwise share some or all of our business or assets, including your personal information, such as part of a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution; and
• Customers and business partners, including our customers, other companies, and individuals with whom we do business or with which we are exploring a business relationship.

III. Retention Periods

We may retain or store your Information (including personal information) strictly and to the extent necessary for the performance of our obligations, and strictly for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable laws, rules, and regulations. This means that we may retain some information even if you request us to delete, remove, or no longer process the information if we are required by applicable law, rules, or regulations or if and as necessary to protect ourselves from legal claims. When we no longer need to use your information, we will remove it from our systems and records and/or take steps to properly render it unintelligible, so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations to which we are subject).

IV. Your Rights

If you have declared your consent regarding certain types of processing activities of your personal information, you may have the right to withdraw this consent at any time with future effect subject to certain exceptions including but not limited for us to comply with applicable laws, rules, and regulations, for legal challenges with respect to the recruitment process, a recruitment decision, or to consider you for other current or future jobs at MediaAlpha, or to help us better understand, analyze, and improve our recruitment processes. This withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. To the extent you’ve provided your consent and wish to withdraw it, you can contact us as stated in Section X below.

Pursuant to applicable laws, rules, and regulations you may also have the right to: (1) request access to the personal information we have collected about you; (2) request rectification of your personal information; (3) request erasure of your personal information; (4) request restriction of processing of your personal information; (5) request data portability of your personal information; and/or (6) object to the processing of your personal information. Please note that these rights might be limited under the applicable laws, rules, or regulations.

• Right of access: In certain circumstances, as provided by applicable law, you have the right to obtain from us confirmation as to whether or not personal information concerning you is processed, and, where that is the case, to request access to such personal information. The access information includes –among other things – the purposes of the processing, the categories of personal information concerned, the recipients or categories of recipients to whom the personal information have been or will be disclosed, the sources of the personal information, the duration of retention, and the technical security measures put in place to safeguard the personal information in case of transfer across borders. However, this is not an absolute right and the interests of other individuals may restrict your right of access. You may also have the right to obtain a copy of the personal information. For additional copies requested by you, we may charge a reasonable fee based on administrative costs.
• Right to rectification: In certain circumstances, as provided by applicable law, you have the right to obtain from us the rectification (i.e., correction) of inaccurate personal information concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal information completed, including by means of providing a supplementary statement.
• Right to erasure (right to be forgotten): In certain circumstances, as provided by applicable law, you have the right to obtain from us the erasure of personal information concerning you. In those cases, we will to erase, or render permanently unintelligible, that personal information.
• Right to restriction of processing: In certain circumstances, as provided by applicable law, you have the right to obtain from us restriction of processing of your personal information. In this case, the respective data will be marked and may only be processed by us for certain purposes. As we, however, process and use your personal information primarily for purposes of carrying out the our job, recruitment, employment, and other professional relationship with you (as applicable), we will in principle have a legitimate interest for the processing which will override your restriction request, unless the restriction request relates to marketing activities (which generally do not apply in the employment context).
• Right to data portability: In certain circumstances, as provided by applicable law, you have the right to receive the personal information about you that you have provided to us, in a structured, commonly used and machine-readable format so you can transmit this personal information to another entity.
• Right to object:
  • Under certain circumstances, as provided by applicable law, you have the right to object, on grounds relating to your specific situation, at any time to the processing of your personal information by us and we are required to no longer process your personal information.
  • If you have a right to object and if you exercise this right, your personal information will no longer be processed for such purposes by us unless we demonstrate compelling legitimate grounds or such other grounds or exceptions (as applicable) pursuant to applicable law. You may exercise this right by contacting us as stated in Section VII below.
  • This is not an absolute right and does not apply in certain situations or in every jurisdiction, such as when processing is necessary to perform the employment or services contract, to comply with applicable law, or to defend legal claims.
• Right to Lodge a Complaint: You may also have the right to lodge a complaint with the competent government or supervisory authority.

V. Protecting Your Information

We take reasonable and industry standard efforts to protect personal information (such as from unauthorized access, use, loss, and disclosures) taking into consideration the state of the art technology, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risk of processing your personal information. While we strive to protect your personal information, we cannot ensure the security of the information you transmit to us, and so we urge you to take every precaution to protect your personal data when you are on the Internet.

VI. International Transfers

MediaAlpha and its appointed service providers may collect, use, process, store, and disclose your information (including your personal information) outside of your home jurisdiction, state, country, or territory, including in the U.S., and in some cases, other countries or jurisdictions. These countries or jurisdictions may have data protection and privacy laws, rules, and regulations that are different than the laws, rules, and regulations of your home jurisdiction, country, or state. MediaAlpha only transfers your information to another jurisdiction, country, or territory in accordance with applicable data protection and privacy laws, rules, and regulations provided there are legally adequate protections in place for the transfer and processing of such information.

VIII. Persons Who Reside or are Residents of the European Economic Area or the United Kingdom

If you are a resident of or otherwise reside within the EEA or UK, (i) we collect and process your information where it is necessary in order to provide our prospective talent and job applicants website(s) and associated services and/or to process and respond to prospective talent or job applicant sourcing applications or any inquiries, or to otherwise take steps, at your request, prior to our potentially entering into a contract of employment with you, and (ii) we will process your information (as defined in the European Union’s (“EU”) GDPR when it is transferred outside of the EEA or UK by:

• Processing it in a territory which the European Commission has determined provides an adequate level of protection for personal information; or
• Otherwise implementing appropriate safeguards to protect your personal information, including through the use of Standard Contractual Clauses or another lawful transfer mechanism approved by the European Commission.

If you require further information about our international transfers of personal data, please contact us by using the contact details under Section XI, “Contact Information and Questions”, below.

Notwithstanding the foregoing, kindly note, we may also seek your consent to process your personal information in specific circumstances or process it where necessary to comply with a legal obligation, or for purposes connected to legal claims. If we use your information to improve our application or recruitment process, we do so on the basis that it is in our legitimate interests to ensure we recruit the best possible candidates.

IV. Other Important Information

• Your Obligations. You are solely responsible for (a) providing and maintaining complete and accurate information in your application, account, resume, CV, cover letters, and any other recruiting documents and processes, (b) ensuring that the information you submit does not violate any third party’s rights, (c) keeping your personal information on file with us up to date, (d) informing us of any significant changes to your information, (e) maintaining the security and confidentiality of your access and login credentials, and (f) notifying us promptly and without undue delay when you become aware of any loss or compromise to your access credentials or accounts.
• Third Party References and Services. This Notice does not address, and we are not responsible for, the practices of any third parties including any third-party websites, apps, products, or services. Such third parties and their websites, apps, products, or services have their own policies, rules, and practices for how they collect and use your personal information. Please review each such third party’s privacy policies, statements, and notices to learn more about how they handled your personal information. Any links to third party websites, apps, products, or services provided in our job and recruitment websites or any documentation or materials we provide to you are not endorsements and should not be relied upon as such.
• Changes to this Notice. We may change this Notice at any time. When we do, we’ll let you know by revising the date at the top of this Notice. We may also provide you with additional notice (such as adding a statement to our websites’ homepages or adding “Updated” to the footer links to this Notice (e.g., Updated CCPA Privacy Statement and Job Applicant Privacy Notice). The “Effective Date” heading at the top of this Notice indicates when it was last revised. Any changes will become effective when we post the revised notice on our job and recruitment websites, or any other websites that link to this Notice, or when we furnish it to you in writing (such as via email, our intranet, or mail), whichever is earlier. You are solely responsible for periodically reviewing our job and recruitment websites and any notices we send to you including any updates or changes to this Notice posted or otherwise provided to you to ensure you are aware of changes and our current privacy practices.
• Adults Only. Our job and recruitment websites and services are not intended for minors under the age of 18 or the age of majority in your place of residency.

X. Persons Who Are Residents of California

Under the California Consumer Privacy Act (“CCPA”), MediaAlpha is required to inform persons who are California residents about the categories of personal information we collect about them and the purposes for which we will use this information. For notices specific to persons who are residents of California, please also review our CCPA Privacy Statement and Job Applicant Privacy Notice.

XI Contact Information and Questions

If you have any questions or comments about this Notice and the ways in which we collect and uses your personal information as described above, please do not hesitate to contact our People Ops team at peopleops@mediaalpha.com.