This Job Applicant Privacy Notice (“Notice”) describes how Baker Tilly Advisory Group, LP and its affiliated entities, including Moss Adams LLP (collectively, “Baker Tilly”, “we”, “us” and “our”) collects, uses, and discloses information about current and former job applicants, candidates, prospective employees and individuals who apply for open positions at Baker Tilly (“Baker Tilly Applicants”, “you”, “your”, “yours”).

Our collection and processing of the information you provide may vary depending upon the circumstances, such as the role, responsibilities, location, and qualifications associated with a position. The information in this Notice is intended to provide an overall description of our collection and use of personal data about Applicants.

We may also provide you additional privacy notices regarding our collection, use or disclosure of information from and about you. Please read this Notice and any other privacy notices we provide to you carefully. Please note that this Notice does not form part of any employment contract or contract to provide services.

Baker Tilly operates under an alternative practice structure and is a member of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. Baker Tilly US, LLP and Moss Adams LLP are licensed CPA firms that provide assurance services to their clients. Baker Tilly Advisory Group, LP and its subsidiary entities provide tax and consulting services to their clients and are not licensed CPA firms.

1. Types of Personal Data We Handle
2. How We Use Personal Data
3. How We Disclose Personal Data
4. Data Retention
5. Personal Data Rights
6. Contact Us

1. Types of Personal Data We Handle

We collect, use, and store various types of information that identifies, relates to, or could reasonably be linked to you (“personal data”) in connection with your application for employment with us. We collect such information either directly from you or (where applicable) from another person or entity, such as professional networking websites, job posting websites, employment agencies, recruitment companies, individuals that refer you to us (which may include our own employees), academic institutions, background check providers, or your professional references. We may collect additional personal data throughout the course of your application process.

The information we collect from and about Baker Tilly Applicants includes, where applicable:

• Identifiers such as first and last name, postal address, telephone number, and email address, and, if provided an offer, identifiers related to your citizenship documents, such as Social Security Number, national or state ID card, passport, and copies of work permits and birth certificates (which include date and place of birth).
• Professional or employment-related information, including:
  • Recruitment, employment, or engagement information such as application forms and information included in a resume, cover letter, or otherwise provided through the application and recruitment process; information about your eligibility to work in the country where you are applying for a job, such as information related to citizenship and/or immigration status; references; our evaluations of your performance during the interview process; and if provided an offer, background screening results (including any criminal convictions).
  • Career information such as past employers, titles, job history, work dates and work locations, salary expectations, notice period, and information about skills, qualifications, and experience.
• Education information such as institutions attended, degrees, academic record, certifications, licenses, transcript information, and professional memberships.
• Business travel and expense information such as travel itinerary information and expenses incurred for travel during the interview process.
• Audio or visual information such as photos provided in connection with a resume, CCTV footage, as well as other information relating to the security of our premises collected during in-person interviews or other parts of the recruitment process, and video or audio recordings of events and recruitment activities.
• Internet and electronic network, and device activity and device information and related identifiers, such as information about your use of our network while you are on our premises, including IP address (which may be used to derive a general location) and device identifiers and attributes.
• Sensitive/ protected classification information to the extent required or as permitted by law and voluntarily provided such as race/ethnicity, nationality, sex/gender, gender identity, sexual orientation, citizenship, immigration status, religion, marital status, military service, disability, health, accommodation information, and other information to help us monitor compliance with laws.
• Other informationthat you may voluntarily choose to include on your resume, in connection with your application, or otherwise.

2. How We Use Personal Data

We may collect, use, disclose, and store personal data for our business purposes, which include, where applicable:

• Engaging in the recruitment process, including communicating with you, interviewing, and selecting and hiring new personnel.
• HR management and administration, including onboarding, determining compensation, scheduling, IT and informational security purposes, fraud prevention, and conducting internal analyses and audits.
• Security operations, including detecting security incidents, debugging and repairing errors, and preventing unauthorized access to our computer and electronic communications systems; monitoring and controlling access to our premises and locations (including through use of CCTV); and safeguarding Baker Tilly and its locations, services, and employees.
• M&A and other business transactions, including for planning, due diligence and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions.
• Legal compliance, such as complying with applicable laws, and responding to and cooperating with legal or regulatory requests and investigations.
• At your request, in order to fulfill your instructions.

Legal Bases for Processing. Some jurisdictions require us to state our “legal bases” for processing your personal data as described in this Notice (e.g., UK/EU). These legal bases are:

• Contract: We may process your personal data as necessary to perform a contract with you, such as to enter into an employment agreement with you.
• Legal obligation: We may process your personal data to comply with a legal obligation or request, such as to comply with employment laws.
• Legitimate interest: We may process your personal data for purposes of our or another party’s legitimate interests, such as to maintain the security of our premises, personnel, and property.
• Consent: We may process your personal data consistent with your consent to the extent permitted by applicable law.

3. How We Disclose Personal Data

We may disclose certain personal data to the following types of entities or in the following circumstances, where applicable:

• Internally: To employees within Baker Tilly who participate in the recruitment process, such as HR managers and employee interviewers, and among our affiliated entities.
• Vendors: Such as background check companies, security providers, information technology providers, travel management companies, and employment businesses (e.g., recruiting contractors or agency workers) that provide us with services relevant to recruiting and hiring.
• Recruiters: To the extent you are working with a recruiter in connection with your application for employment and your recruiter is authorized by you to obtain feedback from us regarding your application and interview process.
• Legal compliance and exercising legal rights: (i) When required to do so by law, regulation, or court order; (ii) in response to a request for assistance by a law enforcement agency; (iii) to seek legal advice from our external lawyers or in connection with litigation with you or a third party; or (iv) as otherwise necessary to exercising our legal rights or to protect Baker Tilly or its employees.
• Business transaction purposes: In connection with the sale, purchase, or merger of all or a portion of our company.
• Consent: With your consent and as permitted by law, we may disclose personal data to any other parties in any other circumstances.

The entities to which we disclose information for the purposes described in this Notice may be located in jurisdictions outside of your jurisdiction of residence, and may have different laws. We will perform appropriate diligence to determine whether the third-party recipient can process and protect such personal data in a manner at least as robust as is required under applicable law.

4. Data Retention

The personal data we collect from Baker Tilly Applicants will be retained until we determine it is no longer necessary to satisfy the purposes for which it was collected and our legal obligations. These purposes include our business operations and complying with reporting, legal and accounting obligations. In determining how long to retain information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes in other ways, the applicable legal requirements, and our legitimate interests.

5. Personal Data Rights

Depending on your jurisdiction of residence, you may have certain rights regarding your personal data (e.g., UK, EU, California). As provided in applicable law, these rights may include:

• Request access to certain of your personal data, including the right to obtain confirmation of whether we are processing your personal data, obtain a copy of that information, and know certain information about our processing of your personal data, such as our processing purposes;
• Request correction of certain of the personal data that we have about you that is inaccurate;
• Request deletion or removal of certain of your personal data; or
• Object to or request restriction of certain processing activities.

We will not discriminate against you for exercising your rights. In certain jurisdictions, you may also have the right to lodge a complaint with your local data protection authority if you believe we have processed your personal data in violation of applicable data protection law. However, we encourage you to raise any complaint with us first so we can do our best to resolve it.

Exceptions: There are certain exceptions to the above rights. For instance, we may retain your personal data if it is reasonably necessary for us or our vendors to provide a service that you have requested, to comply with law, or to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for that activity. In addition, we reserve the right not to process requests that are manifestly unfounded or excessive, as provided in applicable law, or that we are not legally obligated to process.

Exercising your rights: To exercise your rights, please contact us and specify the right(s) you want to exercise and the personal data with respect to which you want to exercise such right(s). You can submit your request by emailing us at dataprotectionofficer@bakertilly.com. We may take reasonable steps to verify your identity before responding to a request, and to do so, we may ask you for additional information.

California disclosure:California law places certain obligations on businesses that “sell” personal data to third parties or “share” personal data with third parties for “cross-context behavioral advertising” as those terms are defined under the California Consumer Privacy Act. We do not “sell” or “share” the personal data covered by this Notice and have not done so in the twelve months prior to the effective date of this Notice.

Please note that to the extent we collect sensitive/protected classification information, we do not process such information for purposes subject to the “right to limit” under California law.  Accordingly, we only use and disclose such sensitive information about California applicants as reasonably necessary and proportionate: (i) to perform our services requested by you; (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents; (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct; (iv) to verify or maintain the quality and safety of our services; and (v) for compliance with our legal obligations.

6. Contact Us

If you have questions or concerns regarding this Notice or the handling of your personal data by Baker Tilly, please contact us at dataprotectionofficer@bakertilly.com or call us at +1 (800) 362-7301.