Snowflake Candidate Privacy Notice
Last Updated: May 2, 2024
This Candidate Privacy Notice (“Notice”) explains how Snowflake Inc. and its affiliates and subsidiaries operating under the ‘Snowflake’ brand (“Snowflake”, “we”, “our”, or “us”) collect, store  use, disclose, and otherwise process personal information about you during the application and recruitment process. This Notice also sets out more information about your privacy rights. If you become employed by Snowflake, the processing of your personal information will be subject to Snowflake’s Global Employee Privacy Notice. This Notice does not apply to use of Snowflake’s generally available software-as-a-service offering hosted by or on behalf of Snowflake or your access to or use of our websites (such as, www.snowflake.com). 

Quick Links
We recommend that you read this Notice to ensure you are fully informed. However, if you only want to access a particular section of this Notice, then you can click on the relevant link below to jump to that section. 
        1. Personal Information We Collect
        2. Use of Personal Information We Collect
        3. Sharing of Personal Information
        4. Legal Bases for Processing Personal Information
        5. Security of Your Personal Information
        6. International Data Transfers
        7. California Residents
        8. Your Privacy Rights
        9. Data Retention and Deletion
        10. Changes to This Notice
        11. How to Contact Us
        12. Supplemental Privacy Disclosures for Certain Countries
1. Information We Collect 
In connection with our recruitment and hiring activities, we generally collect personal information directly from you. We may also, to the extent permitted by law, receive information about you from third parties, for example, your references, our personnel who interview you, recruitment agencies we work with, publicly available information from websites or social media, including information you provide us via such third party in connection with your application (e.g., when you apply through LinkedIn), or third parties who help us to carry out background and reference checks and help to assess suitability for employment. This may include: 
  • Identifiers, such as your full name, address, email address, phone number, or picture;  
  • National identifiers and work eligibility information, such as country of birth, nationality, citizenship, visa or working permit status, passport data, national identification number, or driver license or other government issued identification card information;
  • Demographic information, such as your date of birth, gender, marital and family status, ethnicity, national origin, disability (e.g., in connection with accommodation requests);
  • Audio, electronic, visual or similar information, such as CCTV images (where permitted by law) and physical access records related to our physical premises; 
  • Professional or employment related information, such as the name of your employer, information contained in your letters of application, resume, CV, and/or cover letter, professional qualifications and other relevant skills, background and reference checks (where permitted by law), languages, and (if provided) historical salary, wages, compensation, or bonus data;
  • Education information, such as education history, degrees, certifications, transcripts, and similar information in support of your application; and
  • Other information, such as records of documents and emails created by or relating to you, and information you voluntarily provide us during the course of your recruiting and application process.
Some of the personal information that we collect is deemed sensitive in certain jurisdictions. For example, where allowed by law and reasonably necessary, we process sensitive personal information relating to your health, ethnicity, or gender, such as in connection with disability or accommodation requests. Where allowed by law and reasonably necessary, we also may conduct background and reference checks and collect information about any prior criminal offenses in order to assess suitability for certain of your job responsibilities.
2. Use of Information We Collect
We process your personal information for purposes related to carrying out our application and recruitment processes, and where you are successful in your application, for entering into an employer-employee relationship with you, including to: 
  • communicate with you regarding the application and recruitment process, as well as roles that may be of interest to you, including by email, phone/text, and via our applicant applications and systems; 
  • respond to your inquiries or requests;
  •  review and assess information related to your candidacy, including your suitability, skills, experience, qualifications, and interests;
  • verify your information, including via reference checks;
  • if you are successful in your application: 
    • perform background screening, education screening, and reference checks, each as permitted by applicable law;
    • communicate with you, and to send you information or equipment, regarding your new hire and employee experience prior to your start date; and
    • transfer your personal information to your employee file; and
  • if you are not successful with your application, retain your personal information for a reasonable period of time and may, as allowed by law, reach out to you regarding future roles which we determine may match your experience and skills. If you do not wish for us to reach out to you for future roles, you may always opt out of such communication by submitting a request as detailed in Section 8 (YOUR PRIVACY RIGHTS) of this Notice.  
We may also process your personal information to: 
  • detect, prevent, and respond to fraud or other potentially illegal activities, including in connection with the use of our applicant applications and systems or our physical premises;
  • secure, monitor, and protect our corporate assets, such as our networks, systems, devices, and physical premises;
  • operate, evaluate, and improve our applicant applications and systems, our application and recruitment process, including to analyze our candidate base, hiring practices or trends, to identify qualifications or skills shortages, and to match candidates and potential opportunities;
  • audit, test, maintain or troubleshoot our applicant applications and systems and our application and recruitment process;
  • comply with legal and regulatory obligations to which we are subject; and 
  • cooperate with law enforcement or regulators, where required.
3. Sharing of Personal Information 
We may disclose your personal information for the purposes listed above and where permitted by applicable law, in the following ways:
  • to Snowflake group companies and Snowflake personnel involved in the recruiting and hiring processes and other who need to know for a legitimate business purpose;
  • to service providers and vendors in connection with the provision of services to us including, but not limited to, recruitment, talent acquisition and administration, technology services, and background and employment history checks (where allowed by applicable law);
  • to contact your professional references to conduct a reference check; 
  • to comply with laws or to respond to lawful requests and legal process or to establish, defend or protection Snowflake’s rights and property or those of third parties; 
  • in connection with or during negotiation of any business transfer, merger, financing, acquisition, or dissolution transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company; 
  • in order to protect any individual’s vital interests, but only where we believe it necessary in order to protect the vital interests of any person; or
  • when you instruct us to do so or with your consent.
5. Security of Your Personal Information
We take all reasonable and appropriate steps to protect your personal information in an effort to prevent loss, misuse, and unauthorized access, disclosure, alteration and destruction. We use appropriate technical and organizational measures to protect your personal information which may include: physical access controls, encryption, internet firewalls, intrusion detection and network monitoring depending on the nature of the information and the scope of processing. Our staff and any service providers who may have access to your personal information are required to keep that information confidential.
6. International Data Transfers
Your personal information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different to the laws of your country, and in some cases, may not be as protective. Specifically, your personal information will be processed in the countries where you have applied for a job, as well as the U.S. and/or other countries where members of our group are located. Our affiliate locations can be found here. However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Notice. These safeguards include implementing applicable data transfer mechanisms, such as the E.U. standard contractual clauses, or other lawful mechanisms for transfers of personal information in accordance with applicable data protection law. Snowflake has also self-certified compliance with the EU-U.S. Data Privacy Framework, the UK extension to the EU-U.S. Data Privacy Framework, and the Swiss-US Data Privacy Framework as set forth by the U.S. Department of Commerce with respect to personal information relating to individuals from the EEA, UK, and Switzerland. Please see our Data Privacy Framework Notice  or contact us at privacy@snowflake.com to learn more.
7. California Residents
The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”), requires businesses that collect personal information of California residents to make certain disclosures regarding how they collect, use, retain and disclose such information. This section addresses those requirements. For a description of all of our data collection, use and disclosure practices, please read this Notice in its entirety.

Personal Information Collection and Disclosure: Snowflake does not sell personal information as we understand the term sale to be defined by the CCPA and its implementing regulations. The categories of personal information we collect about you and the third parties to whom we disclose that personal information for a business purpose are as follows:
Categories of personal information we collect
Snowflake does not use or disclose sensitive personal information for purposes other than those permitted purposes under the CCPA.

Snowflake does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

Retention of Personal Information: We retain personal information as described in Section 9 (DATA RETENTION AND DELETION) below.

Sources of Personal Information: The sources from which we collect personal information are described in Section 1 (INFORMATION WE COLLECT) above.

Purposes for Collecting Personal Information: We collect and disclose personal information identified in the lists above for the purposes set forth in Section 3 (USE OF INFORMATION WE COLLECT) above.

California Consumer Rights: California law gives California residents the right to make certain requests with regard to their personal information. Please see Section 8 (YOUR PRIVACY RIGHTS) for a description of those rights and how you may make a request.
8. Your Privacy Rights
Subject to any restrictions and/or exemptions under applicable laws, you may have privacy rights regarding your personal information as set forth below. 
  • You may request a copy of your personal information or request to correct, update, or delete  your personal information. 
  • You may request that we disclose what personal information we process, including the categories of personal information, the categories of sources from which the personal information is processed, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.
  • Where required by law, you can object to processing of your personal information, ask us to restrict processing of your personal information, or request portability of your personal information.
  • If we collected and processed your personal information with your consent, where required by law, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
  • Where applicable, the right to refuse the collection and use of your personal information and/or withdraw previously given consent. However, if you refuse the collection and use of your personal information and/or withdraw previously given consent, doing so could affect Snowflake’s ability to start or continue the recruitment process, depending on the context of your consent and withdrawal.
  • Where applicable, if you wish to submit a complaint to a data protection authority about our collection and use of your personal information, you can find contact details for data protection authorities in the EEA available here, in the United Kingdom here,  in Switzerland here, in Australia here, in Mexico here, in Brazil here, in Costa Rica here, and in Saudi Arabia here.
  • Californians also have the right to opt out of the sale of personal information or the sharing of personal information for cross-context behavioral advertising. They also have the right to limit the use or disclosure of sensitive personal information for purposes other than those permitted by the CCPA. As described above, we do not sell your personal information, or use or disclose sensitive personal information for purposes other than those permitted by the CCPA. 

You can submit a request online by filling out Snowflake’s Global Privacy Requests Form or by contacting us at 877-243-8061. 

Snowflake will verify that the information you submit (which may include your first name, last name, email address, company, and country/state) matches our records before we fulfill the request. You may use an authorized agent to submit a consumer rights request on your behalf using the methods above, however, Snowflake will require the authorized agent to provide signed permission to submit the request on your behalf and may still contact you to confirm your identity and that this request was submitted with your permission.

Snowflake does not discriminate against you for exercising your rights or offer you financial incentives related to the use of your personal information.
9. Data Retention and Deletion
We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to comply with applicable legal obligations). When we have no ongoing legitimate business need to process your personal information, we will either permanently delete it or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
10. Changes to this Notice
We may change this Notice from time to time. If we make any changes to this Notice, we will change the “Last Updated” date above. If such changes are material in nature, we will provide you with additional notice (such as adding a statement to the website page that published this Notice or sending you an email notification).
11. How to Contact Us
If you have any questions about this Notice or privacy-related issues, please contact us at privacy@snowflake.com or Snowflake Inc., Suite 3A, 106 East Babcock Street, Bozeman, Montana 59715. For inquiries related to our activities in the EEA, United Kingdom, and/or Switzerland, you may contact Snowflake’s Data Protection Officer (DPO) at dpo@snowflake.com and Snowflake’s representative to the EU at privacy@snowflake.com or Snowflake Computing Netherlands B.V., FOZ Building, Gustav Mahlerlaan 300-314, 1082 ME Amsterdam, Netherlands. If you are in India and have any questions/complaint relating to our data privacy policy, please contact Snowflake’s Grievance Officer, Evan Uchida, at privacy@snowflake.com or Snowflake Inc., Suite 3A, 106 East Babcock Street, Bozeman, Montana 59715.
12. Supplemental Privacy Disclosures for Certain Countries
If you reside in one of the following countries, then the section below also applies to you. To the extent there is any conflict between country-specific provisions below and the general provisions above, the country-specific provision will control to the extent of such conflict. 
12.1. Brazil
If you reside in Brazil, then the following additional information related to Lei Geral de Proteção de Dados (LGPD) applies to you:
Privacy Rights: Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out in Section 8 (YOUR PRIVACY RIGHTS) of this Notice, you have the following rights:
  • Right of confirmation and access: you may request confirmation that we process personal information about you and, if so, request a copy of that information.
  • Right to anonymization, blocking or erasure: you may request that we anonymize, block or delete your personal information if it is excessive, no longer necessary or processed in violation of the LGPD.
  • Right of rectification: you may request the rectification of incomplete, inaccurate, or out of date personal information.
  • Right of portability: you have the right to have the personal information we hold about you transferred to another company or organization.
  • Right to object and withdraw your consent: you have the right to object to the processing of your personal information, as well as the right to withdraw your consent.
  • Right to deletion: you have the right to request the deletion of your personal information that we process based on consent.
  • Right to information: you have the right to request information about the public or private entities with which we have shared your personal information.
  • Right to review automated processing, including profiling: you have the right to request the review of decisions taken solely on the basis of automated processing of your personal information that affect your interests.
  • Right to lodge a complaint: You have the right to lodge a complaint with your national data protection authority who can be contacted through its website, located here.

You may exercise any of the above rights by filling out Snowflake’s Global Privacy Requests Form, contacting us by phone at 877-243-8061, or contacting us in writing at privacy@snowflake.com.
You may contact Snowflake’s data protection officer at dpo@snowflake.com.
12.2. Canada
If you reside in Canada, then the following additional information applies to you:
Alberta: If you reside in Alberta then we may collect, use or disclose “personal employee information” (as defined in Alberta’s Personal Information Protection Act) without consent so long as we provide prior notice regarding that collection, use or disclosure and so long as those activities are reasonable for the purposes of recruiting.
British Columbia: If you reside in British Columbia then we may collect, use or disclose “employee personal information” (as defined in British Columbia’s Personal Information Protection Act) without consent so long as we provide prior notice regarding that collection, use or disclosure and so long as those activities are reasonable for the purposes of recruiting.
Quebec: If you reside in Quebec, we will only collect, use, or communicate your personal information with your consent. The purposes for which we collect your personal information are those listed in Section 2 (USE OF PERSONAL INFORMATION WE COLLECT) of this Notice. 

Your personal information may be communicated to third party service providers and business partners for the purposes identified in the Notice above. The categories of third parties and business partners are further described in Section 3 (SHARING OF PERSONAL INFORMATION) of this Notice.
Your personal information may be communicated outside of the province of Quebec. Please refer to Section 6 (INTERNATIONAL DATA TRANSFERS) of this Notice.
We may, in certain cases, use or communicate your personal information, without your consent, for certain other purposes permitted by law, such as fraud prevention or to provide a service requested by you. In certain cases, we may not be able to provide certain services to you or process an application on your behalf if you do not agree to the collection of personal information.

Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out in Section 8 (YOUR PRIVACY RIGHTS) of this Notice, you have the right to:
  • request access to your personal information;
  • request rectification or correction of your personal information;
  • request deindexation of your personal information in certain circumstances;
  • request data portability (i.e., request a copy of your personal information in a commonly used technological format); and
  • withdraw your consent to the use or communication of your personal information.

You may exercise any of the above rights by filling out Snowflake’s Global Privacy Requests Form, contacting us by phone at 877-243-8061, or contacting us in writing at privacy@snowflake.com. 

General: We may collect, use and disclose your personal information described in this Notice for the purposes described in this Notice, and as otherwise authorized or required by law. We may collect, use and disclose your personal information without your consent if authorized or required by law.
12.3. Colombia
If you reside in Colombia, the following additional information applies to you in compliance with the Colombian Data Protection Regime (“CDPR"): Law No. 1581 of 2012, Decree 1377 of 2013 and the External Circular 002 of 2015 of the Superintendency of Industry and Commerce.

Data subject rights: Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out in Section 8 (YOUR PRIVACY RIGHTS), you have the following rights:
  • Right to verification: you have the right to know, update, and amend your personal information. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data for which processing is expressly prohibited or has not been authorized.
  • Right to request consent evidence: you may request evidence of your consent granted to Snowflake.
  • Right to be informed: upon request, you have the right to be informed about the use of your personal information.
  • Right to lodge a complaint: you have the right to lodge a complaint before the Colombian local authority and the Superintendency of Industry and Commerce.
  • Right to withdraw and deletion of data: you have the right to withdraw your consent and/or request the deletion of personal information when processing is not compliant with principles, rights, and constitutional guarantees.
  • Right to access: upon request, you have the right to freely access your personal information that has been processed.

Exercising your rights: You may exercise any of the above rights by filling out Snowflake’s Global Privacy Requests Form, contacting us by phone at 877-243-8061, or contacting us in writing at privacy@snowflake.com.

Legal bases for collecting and processing personal information 
Consent: We process your personal information based on your prior, unequivocal, and informed consent, unless consent is not required under applicable law.

Sensitive personal information
We process your sensitive personal information, based on your prior, unequivocal, and informed consent as required by applicable law. You may refuse to provide consent, as providing such data is not mandatory; however, doing so could affect our ability to conduct the recruitment process.
12.4. Costa Rica
If you reside in Costa Rica, then the following rights additional information and rights under the Law on the Protection of Persons Regarding the Processing of their Personal Data No. 8968 and the Executive Decree No. 37554-JP and its amendments apply to you:

Definitions
“Sensitive Data” means personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, spiritual convictions, socioeconomic condition, biomedical or genetic information, health, sex life, and sexual orientation;”

Legal bases for collecting and processing personal information 
We process your personal information and Sensitive Data with your prior, unequivocal, and informed consent, unless consent is not required under applicable law.

Privacy rights
Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out in Section 8 (YOUR PRIVACY RIGHTS) of this Notice, you have the following additional privacy rights with respect to your personal information:
(a)    Right to access and review your personal information:  subject to applicable law, you have the right to access, your personal information, free of charge. 
(b)    Right to Know: you have the right to be informed about:
  • whether your personal information will be stored in databases, as well as the name and address of the entity responsible for managing such databases;
  • the purposes for which your personal information is being collected;
  • the third parties to whom your personal information may be disclosed;
  • whether collection of your personal information is mandatory and the consequences that can result from not providing Snowflake with such mandatory personal information; and 
  • the rights you have regarding your personal information under the law.
(c)    Right to correct and delete personal information: subject to any exceptions under applicable law, you have the right to ask us to correct or erase certain personal information that is not truthful or current. 
(d)    You may also provide us with instructions regarding the way we may continue to store, erase, and share your personal information after your death, and where applicable, the person you have designated to exercise these rights after your death.
(e)    You also have the right to lodge a complaint with the national data protection authority (the "Agencia de Protección de Datos” or “PRODHAB”), which can be contacted through its website, located here.

You may exercise any of the above rights by filling out Snowflake’s Global Privacy Requests Form, contacting us by phone at 877-243-8061, or contacting us in writing at privacy@snowflake.com.
12.5. India
If you reside in India, then the following additional information applies to you:

Sensitive personal information: the following information would be considered as “sensitive personal information”:
(i)    password;
(ii)    financial information such as bank account or credit card or debit card or other payment instrument details;
(iii)    physical, physiological and mental health condition;
(iv)    sexual orientation;
(v)    medical records and history;
(vi)    biometric information; and
(vii)    any details relating to the above categories of sensitive personal information for administering an employment relationship.

Your Privacy Rights: Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out Section 8 (YOUR PRIVACY RIGHTS) of this Notice, you have the right to:
(i)    request, review and rectify your personal information; and
(ii)    withdraw consent for the future in relation to the processing or transfer of your personal information (including sensitive personal information). However, doing so could affect our ability to conduct the recruitment process.  

You may exercise any of the above rights by filling out Snowflake’s Global Privacy Requests Form, contacting us by phone at 877-243-8061, or contacting us in writing at privacy@snowflake.com.
12.6. Indonesia
The following applies to our processing of personal information for individuals residing in Indonesia or residing outside the territory of Indonesia, but such processing has legal impact: (i) in the territory of Indonesia and/or (ii) towards data subjects being Indonesian citizens outside of the territory of Indonesia. 
With respect to the Personal Data Protection, the primary law source is Law No. 27 of 2022 on Personal Data Protection (“Law No. 27”) and along with other related regulations being: (i) Law No. 11 of 2008 regarding Electronic Information and Transactions as amended by Law No. 19 of 2016 ("EIT Law"); (ii) Government Regulation No. 71 of 2019 regarding Provisions of Electronic Systems and Transactions ("Reg. 71"); (iii) Minister of Communications and Informatics Regulation No. 20 of 2016 regarding the Protection of Personal Data in an Electronic System ("MOCI 20/2016"). For your ease of reference, we shall refer to Law No. 27, EIT Law, Reg.71 and MOCI 20/2016 jointly or separately as the “Indonesian Data Protection Laws” or “IDPL”.

ADDITIONAL INFORMATION ON THE TRANSFER OF PERSONAL INFORMATION 
In addition to the information set out in Sections 3 (SHARING OF PERSONAL INFORMATION) and Section 6 (INTERNATIONAL DATA TRANSFERS) of this Notice, for compliance with the IDPL, if personal information is transferred by the controller from an Indonesian jurisdiction to another party outside of the Indonesian jurisdiction, such transfer is subject to the following conditions:
  • the requirement to ensure that the country of domicile of the entity receiving the transfer of the data has a personal information protection level that is equal to or higher than that stipulated in Law No. 27;
  • if the condition above is not met, then to ensure that there is adequate and binding personal information protection; and
  • if the conditions above have not been met, the transfer of the additional data to a jurisdiction outside of Indonesia will require consent from the personal information subject involved.

ADDITIONAL INFORMATION ON RIGHTS OVER PERSONAL INFORMATION
Subject to any restrictions and/or exemptions under applicable law, in addition to or in substitution of Section 8 (YOUR PRIVACY RIGHTS) of this Notice, and pursuant to Law No. 27 you have the right to:
  • obtain information regarding identity clarity, basis of legal interest, purpose of requesting and using personal information, and accountability of parties that request personal information;
  • withdraw consent to the processing of your personal information;
  • object to a decision-making action that is based solely on automated processing, including profiling, which has legal consequences or has a significant impact on you;
  • delay or limit the processing of personal information proportionally based on the purpose of processing the personal information;
  • sue and receive compensation for violations of the processing of your personal information in accordance with provisions of laws and regulations;
  • obtain and/or use your personal information from the controller in a form that is in accordance with the structure and/or formats commonly used or readable by an electronic system; and
  • use and send your personal information to other controllers, as long as the system used can communicate with each other securely in accordance with the personal information protection principles based on Law No. 27.

CONTACT US
For Indonesia, in addition to the information as set out in Section 11 (HOW TO CONTACT US) of this Notice and for compliance with the IDPL, if you have questions about this Notice, you should email privacy@snowflake.com for which Snowflake’s Head of Privacy is a recipient. You may exercise any of the above rights by filling out Snowflake’s Global Privacy Requests Form, contacting us by phone at 877-243-8061, or contacting us in writing at privacy@snowflake.com.
12.7. Japan
If you reside in Japan, then the following additional information applies to you:

To whom we disclose your personal information
  • Snowflake Group Companies: your personal information mentioned in Section 1 (PERSONAL INFORMATION WE COLLECT) of this Notice above may be disclosed and jointly used within Snowflake group companies and by Snowflake personnel involved in the recruiting and hiring processes and others who need to know for a legitimate business purpose as described in Section 2 (USE OF PERSONAL INFORMATION WE COLLECT) of this Notice. Snowflake G.K., together with Snowflake Inc. are jointly responsible for the management of your personal information that is jointly used within the Snowflake group of companies.

To the extent required by the Act on the Protection of Personal Information of Japan (Act No. 57 of May 30, 2003), we will provide necessary information and obtain consent from you to transfer your personal information, including for the following disclosures:
  • Third Parties and Partners: disclosure to other companies, vendors and business partners who perform functions for us, including, but not limited to, recruitment, talent acquisition and administration, technology services, and background and employment history checks (where allowed by applicable law), as well as accountants, auditors, lawyers and other outside professional advisors.

Protection of your personal information if transferred outside of Japan
To the extent we transfer your personal information to any of the above-referenced Snowflake group companies, service providers or business partners, we require that they contractually commit to taking adequate measures to protect your personal information, including compliance with applicable data protection laws. Questions regarding the specific data protection commitments made by a particular Snowflake entity, service provider or partner can be sent to privacy@snowflake.com. A list of the Snowflake entities and their locations, including Snowflake G.K., can be found here; and a list of the data protection systems of those countries where the majority of Snowflake entities, service providers and partners are located can be found here.
 
12.8. Mexico
If you reside in Mexico, then the following additional information applies to you:

Privacy Rights: Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out in Section 8 (YOUR PRIVACY RIGHTS) of this Notice, you have the right to:
  • request access to your personal information (for example the right to be provided with certain information about our processing of personal information and access to that information (subject to exceptions) as well as the privacy notice governing the processing);
  • request rectification or correction of your personal information (such as where your home address changes);
  • object to the processing of your personal information (such as on grounds relating to your particular situation where such processing is not necessary);
  • withdraw consent (where such consent was obtained and relied on for the purposes of the processing); 
  • limit the use and disclosure of personal information for purposes which are not necessary, which may be done, for example, by registering in an advertising exclusion list (i.e., Robinson List); and
  • request deletion/cancellation of your personal information in certain circumstances including where it is no longer necessary for us to process the personal information for the purpose it was collected. A request for deletion of personal information will lead to a period of time during which such personal information may be retained only for a limited set of purposes (e.g., where Snowflake may be legally required to retain such data under other laws), following which the information will be erased (i.e., a blocking period). The data controller may retain data exclusively for purposes pertaining to responsibilities arising from processing. The blocking period will be equal to the statute of limitations period for actions arising from the legal relationship governing the processing pursuant to applicable law.

You also have the right to lodge a complaint with your local data protection authority. The data protection authority in Mexico is the National Institute of Transparency, Access to Information and Personal Data Protection (INAI for its acronym in Spanish). Its web page is: https://home.inai.org.mx/.

Employees wishing to exercise any of the above rights should file an ARCO rights request in accordance with the provisions of the Federal Law on the Protection of Personal Data held by Private Parties by emailing us at privacy@snowflake.com.
12.9. Singapore
If you reside in Singapore, then the following additional information applies to you:

Legal bases for our processing under relevant privacy laws: where we collect, use and/or disclose your personal information in Singapore, we will obtain your notified consent for such collection, use and/or disclosure in accordance with applicable law.

In some circumstances, we may also rely on some of the legal bases described in Section 4 (LEGAL BASES FOR PROCESSING PERSONAL INFORMATION) of this Notice. However, if we do so, we will notify you in accordance with the requirements of applicable law.

Privacy Rights: Subject to any restrictions and/or exemptions under applicable law, in addition to the information set out in Section 8 (YOUR PRIVACY RIGHTS) of this Notice, you have the right to request access to information about the ways in which your personal information has been or may have been used or disclosed by us within a year before the date of the request.

Fees payable for access requests: Where permitted by relevant privacy laws, we may charge you a reasonable fee to enable us to respond to your access requests.

Contact Us: You may contact our Data Protection Officer for Singapore at: dpo@snowflake.com.
12.10. South Korea
If you reside in South Korea, the following additional information applies to you:

Your consent to the processing and related purposes
You hereby consent to Snowflake Korea YH processing your personal information as outlined in this Notice for the purposes specified in Section 2 (USE OF PERSONAL INFORMATION WE COLLECT) and the types of personal information as specified in Section 1 (PERSONAL INFORMATION WE COLLECT). You also consent to the processing of sensitive personal information, if relevant and to the extent permitted by law, such as processing concerning your health, results of medical checkups, and any disability in connection with any adjustment to working arrangements that might be required for recruiting purposes. This may include medical checkups, provision of medical support, and performance of legal and administrative obligations imposed on Snowflake by applicable laws and regulations.

Disclosure and delegation
Snowflake discloses your personal information and delegates your personal information to third parties as specified in Sections 3 (SHARING OF PERSONAL INFORMATION) of this Notice. Any questions about transfers of your personal information to specific entities can be sent to privacy@snowflake.com.

Retention Period of Personal Information
Unless otherwise obligated to retain your personal information under applicable laws and regulations, Snowflake will retain and use your personal information until the purposes of collection and use have been fulfilled.

Destruction of Personal Information
We will select personal information whose retention period has expired and destroy such information in accordance with applicable laws and our policies. When deleting your personal information, we will take reasonable and technically feasible measures to ensure that the personal information is irrecoverable. For example, electronic files which contain personal information will be deleted permanently using a technical method which makes the files irrecoverable, and any other records, printouts, documents or any other recording media will be shredded or incinerated.

Additional Use and Provision of Personal Information
Notwithstanding the Notice, in accordance with the Personal Information Protection Act (“PIPA”), we may use or provide your personal information within the scope reasonably related to the initial purpose of the collection, after duly considering whether it would incur any disadvantages to you and whether necessary security measures, such as encryption, have been implemented. We will determine with due care whether to use or provide your personal information considering the overall circumstances, including the relevant laws and regulations, such as the PIPA, purpose of using or providing your personal information, how your personal information will be used or provided, types of personal information to be used or provided, matters to which you have provided consent or which were notified or informed to you, impact on you upon the use or provision of your personal information, and measures taken to protect your personal information. Specific considerations are as follows:
  • Whether the additional use/provision is related to the initial purpose of the collection;
  • Whether the additional use/provision is foreseeable in light of the circumstances under which your personal information was collected and practices regarding processing;
  • Whether the additional use/provision unfairly infringes on your interests; and
  • Whether the necessary security measures, such as pseudonymization or encryption, have been taken.

Personal information of a third party
In case you provide personal information of a third party (“Information Principal”) to Snowflake during the application and recruiting process, you shall fully explain to the Information Principal prior to such provision of the fact that his/her personal information will be provided to Snowflake, together with provided items, purpose of provision (if Snowflake transfers such information to a third party again, then such details shall be included), and the period of retention and use by Snowflake, and then obtain the Information Principal’s consent. By consenting electronically, you testify that you explained the above to the relevant Information Principal and obtained legitimate consent therefrom.

Right to refuse and/or withdraw consent
You have the right to refuse the collection and use of your personal information as set forth above. However, if you refuse the collection and use of your personal information, this will not affect the lawfulness of what we have done before you withdraw consent and doing so could affect our ability to continue the recruitment process, depending on the context of your consent and withdrawal.
12.11. Kingdom of Saudi Arabia
If you reside in the Kingdom of Saudi Arabia (KSA), then the following additional information applies to you:

Legal Basis for Processing Information
  • Contract: the processing is necessary for the performance of a contract to which you are a party;
  • Legal Obligation: the processing is necessary to comply with a legal obligation to which we are subject, including reviewing eligibility for work and avoiding unlawful discrimination; when we are required by applicable law to process certain personal information about you, your failure to provide the data may prevent, or delay, the fulfillment of those legal obligations, and may impact our ability to employ you;
  • Legitimate Interest: when sensitive data is not involved and in furtherance of our legitimate business interests balanced against your rights (where our interests are not overridden by your interests, fundamental rights or freedoms), including ensuring fair and efficient recruiting processes and improvements thereto and ensuring the security of our facilities and websites;
  • Consent: when we have obtained your consent, in accordance with applicable legal requirements; your consent must be informed, specific, and freely given, and explicit when processing involves sensitive data, credit data or decisions made solely based on automated processing of personal information. Where we rely on your consent to process your personal information, you may withdraw that consent at any time by contacting us as described in Section 8 (YOUR PRIVACY RIGHTS);
  • Data Subject’s Interest: when the processing achieves a fulfilled interest for the data subject and it is impossible or difficult to contact him/her.

You also have the right to lodge a complaint with your local supervisory authority. For the contact details of the supervisory authority, see here.

Contact Us
If you have any questions about this Notice or privacy-related issues, please contact us at privacy@snowflake.com.