Gusto Applicant Privacy Notice

Last Updated: May 23, 2025

1. Introduction and Scope

Gusto, Inc., together with its associated companies (collectively, "Gusto", "we", "us", “our”), is committed to safeguarding your personal information and ensuring a positive experience for prospective Gusties.This Applicant Privacy Notice (“Privacy Notice”) describes how Gusto collects, uses, shares, or otherwise processes personal information when you apply for employment and go through the recruitment process (collectively, “Applicant”, "you", or “your”).

Please be aware that Gusto collects, uses, and shares personal information from other individuals, such as users of our websites, services, and content, as well as our employees.Please refer to the relevant privacy notices for these other data subjects, as this Privacy Notice specifically addresses the personal information of Applicants.

2. Personal Information We Collect

We collect personal information about you throughout your application and recruitment process with Gusto. The personal information we collect may include:

• Identifiers and contact information, such as name, email address, phone number, home address, and other contact information;
• Employment or professional related information, such as employer, job title, professional qualifications, and employment history;
• Education information, such as education history, academic degrees, and certifications;
• Communication information, such as emails you may send or receive in connection with the application or recruitment process;
• Internet or electronic usage information from your device when you visit our websites;
• Any other personal information you provide to Gusto when you apply for employment, such as information in a resume, cover letter, social media profile, photo and portfolio; and
• Inferences drawn from any of the above information.

The types of personal information we collect about you also include categories that may be classified as sensitive personal information, such as:

• Citizenship and immigration information;
• Criminal records;
• Government identifiers, such as social security number and government-issued photo ID such as a driver’s license or passport; and
• Demographic information, such as gender, date of birth, racial or ethnic origin, trade union membership, sexual orientation, disability information, and veteran status.

3. How We Collect Personal Information

We collect personal information directly from you, your device, or (where applicable) from third parties. Third party data sources may include but are not limited to employment agencies, recruitment or professional networking websites, background check providers, references, academic institutions, training and certification providers, and publicly available sources such as social media platforms.

4. How We Use Your Personal Information

We may use your personal information to:

• Provide you with access to our applicant and recruitment platform;
• Assess your skills, qualifications, and background;
• Manage and make improvements to the application and recruitment process;
• Verify your information and carry out reference checks and background checks;
• Communicate with you about the application and recruitment process and inform you of other potential career opportunities;
• Detect, prevent, and respond to fraud or potentially illegal activities;
• Ensure the security and integrity of the recruitment process; and
• Comply with applicable laws, regulations, legal and contractual obligations, and responding to and cooperating with legal requests and investigations.

If you accept a role at Gusto, the personal information collected during the applicant and recruitment process will form part of your employee file and will be processed in accordance with our Employment Privacy Notice, which will be provided to you during onboarding.

5. How We Share Your Personal Information

With affiliates and subsidiaries: We may share your personal information with our affiliates, subsidiaries, or joint ventures in the US and in other jurisdictions, in relation to the purposes described above.

With vendors and service providers: We may share your personal information with vendors and service providers acting on Gusto’s behalf to perform some of the uses described above. This includes but is not limited to Gusto’s recruitment platform, human resource support providers, background check providers, assessment and survey providers, and IT and related services.

For identity verification purposes, we partner with specialized providers. When you undergo identity verification, these providers may collect biometric and other sensitive personal information directly from you, according to their own privacy practices. We only share the minimum necessary personal information with them to initiate the process.Please be aware that Gusto will not receive or store your biometric or sensitive personal information collected by these verification providers.

Response to legal requests: We may share your personal information about you to any law enforcement body, regulatory, government agency, court, or other third party if we believe that doing so is legally required or is necessary to protect our property or other legal rights (including but not limited to enforcement of our agreements or the rights of others).

Merger or sale of business: We may share personal information with certain third parties, for example, as part of any actual or potential merger, acquisition, debt financing, sale of company assets, or similar transaction, as well as in the event of insolvency, bankruptcy, or receivership in which information could be transferred to third parties as one of our business assets.

With other third parties: We may share your personal information with other third parties if we have your consent. This could include when consent is given to contact your references.

6. Retaining and Deleting Your Personal Information

Personal information will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Privacy Notice or as otherwise required by applicable law. Generally, this means your personal information will be retained:

• In accordance with employment record retention policies in the event you obtain employment with Gusto; and
• For a reasonable time period after confirmation that your application was unsuccessful (to allow us to consider you for other suitable openings within Gusto in the future), unless you request that we delete your application by contacting us using the contact details set out at Section 9 below.

7. Security

We use administrative, physical, and technical security measures designed to reduce the risk of unauthorized access, destruction, alternation, loss, and disclosure of personal information. However, no security measures are perfect and the security of information transmitted over the internet cannot be guaranteed.

8. Your Privacy Rights

Depending on where you reside and subject to applicable laws, you may have certain rights regarding your personal information such as:

• The right to request access to the personal information we have collected about you;
• The right to request correction of personal information we process about you that is inaccurate, incomplete, or outdated;
• The right to request the erasure of your personal information;
• The right to request the withdraw consent for the processing of your personal information; and
• The right to lodge a complaint with your local data protection authority.

To exercise any of these privacy rights, please submit your request through our Privacy Request Portal or contact us using the resources in the “Contact Information” section.

If you submit a privacy right request, we must verify your identity before fulfilling your requests. If we cannot initially verify your identity, we may request additional personal information to complete the verification process. We will only use personal information provided in a request to verify the requestor’s identity. If you designate an authorized agent to submit a request on behalf, we will also need to verify your identity, which may require proof of your written authorization or evidence of a power of attorney.

9. Contact Information

If you have any questions about our privacy practices or this Privacy Notice, please contact us at:

Gusto

Attn: Privacy Program

525 20th Street

San Francisco, CA 94107

[email protected]

10. Changes to this Privacy Notice

This Privacy Notice may be modified or revised from time to time. We will notify you of any material changes to this Privacy Notice as required by law. Changes to this Privacy Notice will be posted on the website where this appears. The “Last Updated” date at the top of this webpage indicates when this Privacy Notice was last revised. We recommend you review this Privacy Notice periodically.

11. Supplemental Privacy Disclosure for Applicants in California

Sensitive Personal Information We Collect: As listed in Section 2 above, California treats certain government identification numbers, disability information, sexual orientation, racial or ethnic origin, and trade union membership as “sensitive personal information”.

How We Share Your Personal Information: Gusto does not “sell” or “share” the personal information it collects and processes as part of its application and recruitment process for “cross-context behavioral advertising” as those terms are defined under the California Consumer Privacy Act (“CCPA”).

Your California Privacy Rights: Under CCPA, California residents have the following rights:

• The right to know what categories and specific pieces of personal information we collect, the purposes for which we collect personal information, the sources from which we collect personal information, and whether personal information is disclosed, sold, or shared with third parties.
• The right to request deletion of your personal information, subject to certain exceptions.
• The right to request that we correct inaccurate or incomplete personal information.
• The right to limit the use and disclosure of your sensitive personal information.
• The right to opt out of the sale or sharing of your personal information, and the right to opt out of automated-decision making technology.
• The right not to receive discriminatory treatment for exercising your rights.

12. Exercising Your Privacy Rights

If you wish to exercise your privacy rights, please submit your request through our Privacy Request Portal. You may also use the resources provided in the “Contact Information” section above.