Job Shadowing Privacy Notice

What's the purpose of this notice?

Pipedrive (also "we" or "us") is committed to protecting personal data. This notice explains what personal data we collect for job shadowing visits, why we collect it, how we use it, and what choices and rights you have.

If you're a parent/guardian, this notice covers your data and the minor's data.

What's the scope of this notice?

This notice applies to:

• Job shadowers aged 18+

• Minors (under 18) attending a job shadowing visit, and their parents/legal guardians

• Limited information about the Pipedrive host employee (for arranging the visit)

Who is responsible for processing your personal data?

Pipedrive Inc. is the data controller for job shadowing-related processing.

DPO: [email protected]

Because we're a global company headquartered in the U.S., your data may be processed in the U.S. and other countries. We use safeguards to protect your data (see "Where do we process your data?" below).

What personal data do we collect?

We collect only what we need to run the visit safely and smoothly. Depending on whether the shadower is an adult or a minor, this may include:

For adults (18+):

• Name and email address

• Office location and visit date(s)

• Signed confidentiality/NDA and e-signature details (e.g., timestamps, audit trail)

• Optional photographs (only if you agree)

For minors (under 18):

• Minor's name and date of birth

• Parent/guardian name, relationship, email address, phone number

• Emergency contact details (and optional additional emergency contact)

• Office location and visit date(s)

• Signed parental/guardian consent and confidentiality documents (and e-signature details)

• Optional photographs (only if the parent/guardian agrees)

How do we collect the data?

Most of the time, we collect data directly from you (or from a parent/guardian for minors), for example through a consent form, email, or e-signature. We may also receive limited information from the Pipedrive host employee (e.g., host name/department, visit date, office) to arrange the visit.

Why do we process personal data (and what's the legal basis)?

We use personal data for the following purposes:

Purpose	Description	Legal Basis
Running the visit (administration and coordination)	Scheduling, confirming the visit, reception/visitor management, and communicating with you.	Legitimate interests and/or to fulfill a contract where a confidentiality/NDA is signed.
Safety, security, and safeguarding (especially for minors)	Supervision requirements, emergency contact use, and responding to incidents.	Legitimate interests and in some cases legal obligations depending on local workplace/safety requirements.
Protecting confidentiality and keeping compliance records	Executing and storing confidentiality documents and handling any disputes or legal claims.	Legitimate interests and/or to fulfill a contract.
Photos and media (optional)	Taking and using photos only if consent is given.	Consent. Consent is optional and can be withdrawn anytime.

Who do we share personal data with?

We share personal data only with people who need it to run the visit, such as:

• Office reception/security (as relevant)

• Service providers that support administration and document signing/storage (e.g., e-signature providers)

• If you consent to external use of photos and we publish them on social media platforms, those platforms will process the data as independent controllers under their own privacy policies (and any other applicable terms).

Where do we process your data (international transfers)?

Your data may be processed outside your country, including in the United States, because Pipedrive is headquartered there and some service providers may be located elsewhere. Where required, we will ensure compliance with the requirements of the applicable laws. In particular, Pipedrive uses appropriate safeguards (such as Standard Contractual Clauses and the Data Privacy Framework) to protect transfers.

How long do we keep the data?

We keep job shadowing data only as long as needed:

• Forms and visit administration records: typically up to 12 months after the visit, then deleted, unless we need longer for legal/compliance reasons.

• Photos (if any): retained for 12 months after the visit, or until consent is withdrawn, whichever is earlier. We will delete photos from Pipedrive-controlled systems. Where photos have been shared on third-party platforms (e.g., social media), we will take reasonable steps to remove them within 30 days, if feasible.

What rights do you have?

Depending on your location, you may have rights to:

• Access, correct, delete, or restrict your personal data

• Object to processing based on legitimate interests

• Receive a copy of your personal data in a portable format

• Withdraw consent at any time (for photos/media)

• Lodge a complaint with your local supervisory authority

Where a minor is of sufficient age and maturity under applicable local law, they may also exercise data subject rights on their own behalf.

To exercise rights, email [email protected] or [email protected].

To verify certain requests - for example, requests to know, access, delete, or correct - we may need to collect additional information to verify your identity and the request before providing a substantive response to the request.

Is providing data mandatory?

Some information is required to run the visit safely (e.g., contact details and, for minors, parent/guardian and emergency contact details). If you don't provide required data, we may not be able to host the visit. Photo consent is always optional.

Updates

We may update this notice if our job shadowing process changes. If the change is significant, we'll provide an updated version before future visits.

How to contact us

Please contact us with any questions or comments about this Job Shadowing Privacy Notice, your Personal Data, your rights, your consent choices, or our data processing practices by email at [email protected].

If you have any concerns or complaints about this Job Shadowing Privacy Notice or our data processing practices, you may contact Pipedrive’s Data Protection Officer by email at [email protected].