Candidate Privacy Notice
This Candidate Privacy Notice ("Candidate Notice") applies to personal data we collect from applicants for employment and internships via our application forms, website, referrals, and other recruitment channels. This Candidate Notice gives you details on how we process and use your personal data as a candidate for a position with Smartsheet or its affiliates.
This Candidate Notice applies to candidates globally, including in the United States and other jurisdictions where we operate.
Automated Decision-Making and AI
Personal Data We Collect
Data Collected From You
Using third party service providers, acting on our behalf, we collect the following types of information directly from you.
- Identification and contact details. This includes information such as your name, address, email address, phone number, and other contact information, as well as your gender, date of birth, nationality or nationalities, and national identifiers (for example, national ID, passport, or social security number).
- Employment history. This includes information about your previous employer(s) and job title(s).
- Background information. This includes information such as your academic and professional qualifications, education, details included in your CV or résumé (some of which could include details about memberships or interests that reveal sensitive personal information about you), transcripts, and employment references.
- Reference information. This includes information about your professional references that you share with us (including their name, contact information, and job title), information we receive from background checks (when we have them completed for a role), and information provided by other third parties (e.g., identification verification services). It is your responsibility to get your references' consent to share their personal data with us.
- Previous applications and roles with us. This includes information about any prior applications you have submitted for a position with us or any previous employment history with us.
- Your immigration or visa status. This includes information that would let us know if you are authorized, or able to become authorized, to work for us or one of our affiliates.
- Other information you voluntarily provide. This includes information that you provide throughout the recruitment process, including, for example, through assessment exercises and interviews.
If you fail to provide personal data requested by us which we consider to be necessary for us to consider your application, we will not be able to move forward with your recruitment process.
Sensitive Personal Data Collection
Personal data is considered "sensitive" when it includes information that reveals race or ethnicity; religious, political or philosophical beliefs, or trade union membership; genetic or biometric data; information concerning your health/sex life; your gender identity; or criminal convictions or offenses. You may choose to voluntarily disclose sensitive personal data during the recruitment process.
We will request limited sensitive personal data from you for legitimate recruitment and employment-related purposes, including: meeting compliance obligations; providing accommodations for disabilities; equal opportunity monitoring; anti-discrimination purposes; and to satisfy reporting obligations. We share this data with third parties who evaluate Smartsheet's recruiting process for our diversity and equity initiatives. In any case, any sensitive personal data will be treated in strictest confidence and used only for the purposes outlined in this Candidate Notice. Your decision to disclose or not to disclose any sensitive personal data will not affect your candidacy for a role at Smartsheet.
California Consumer Privacy Act ("CCPA"). During the preceding 12-month period, we have obtained the various forms of personal data from candidates as detailed above. These data points correspond to specific CCPA categories, including: Identifiers; Professional and Employment-Related Data; Electronic, Audio, or Visual Information; Protected Classification Characteristics (encompassing Sensitive Personal Information); and Inferences derived from the collected data.
Smartsheet does not "sell" or "share" your personal data as those terms are defined under the CCPA. Furthermore, our use and disclosure of data qualifying as Sensitive Personal Information under the CCPA is strictly limited to the purposes required to facilitate your recruitment and application process.
Data Collected From Third Parties
We will gather personal data about you from third parties, such as:
- Professional references
- Academic institutions and training or certification providers
- Background checking agencies and other external database holders
- Recruitment or executive search agencies
- Publicly available sources, including social media such as LinkedIn or other information available online (as part of this, we may contact any mutual connections that are evident from publicly available information)
Automatically
The Careers page is available for you to visit and search for open positions. We automatically gather personal data on this Site directly from you through the use of technologies such as electronic communication protocols, cookies, widget buttons, or tools. For more details about the personal data we collect through our Site, please see our Cookie Notice.
Background Checks
In some countries and for some roles, we will need to conduct criminal background checks, but only where this is required or permitted by applicable laws. You will be notified before background checks are conducted and, where required, asked to provide written authorization and/or consent. You may have the right to review, dispute, or request correction of background check results depending on your jurisdiction.
How We Use Personal Data
Protecting Legal Rights and Preventing or Addressing Misconduct. To protect Smartsheet employees and other individuals; prevent unauthorized access to our offices; and where we believe reasonably necessary to investigate, prevent, or take action against actual or suspected illegal activities, fraud, or situations involving potential threats to the safety of any person.
Assessing Your Skills. To assess your skills, qualifications, and suitability for the role which you have applied for, the role you are being considered for, or other relevant roles that are open or will be open in the future that might fit your skillset.
Communicating with You. To communicate with you about the recruiting process, your candidacy for the position you applied for, to respond to your enquiries and requests, and, if appropriate, about other potential positions or employment opportunities with us.
Improving the Recruitment Process. To operate, evaluate, and improve the recruitment system, our application tracking, and recruitment activities, including, but not limited to, analyzing our hiring practices or trends; identifying qualification or skill shortages; and using information to match candidates with potential employment opportunities.
Administering General Business Operations. Where necessary to the administration of our general business, accounting, recordkeeping, employment, and legal functions.
Complying with Legal Obligations. To comply with the law or legal proceedings. For example, we disclose information in response to lawful requests by public authorities, including responding to national security or law enforcement disclosure requirements and providing information as required to comply with Smartsheet's legal obligations.
Automated Decision-Making and AI
We use automated technologies and artificial intelligence (AI) in our recruitment process to support, but not replace, human judgment. These tools include resume and application screening, candidate ranking, assessment platforms, video interview analysis (where permitted by law), and natural language processing of written submissions.
How AI is Used. These systems help us reduce initial screening time for high-volume roles, avoid security threats to and abuse of our recruiting platform, evaluate candidates objectively against standardized criteria, and provide initial recommendations to human recruiters. Final hiring decisions are always made by human recruiters and hiring managers who review AI recommendations in context. We do not rely solely on automated decision-making to reject candidates for employment.
Bias and Fairness. Our AI tools are regularly audited for bias and fairness, and we monitor demographic representation in hiring outcomes. We maintain human oversight of all automated scoring and update our tools to address identified biases.
Your Rights. Depending on your jurisdiction, you may have the right to request human review of automated decisions, an explanation of the logic involved, and the right to object to automated processing. To exercise these rights or to request alternatives to AI-based screening, please contact us using this form or using the contact details provided below. Please note that opting out could affect the timeline or scope of our evaluation.
Training Data. Your personal data will not be used to train, improve, or develop AI models without your explicit consent, except where data is aggregated and anonymized such that you cannot be identified, or where required by law.
How We Share Personal Data
To Our Service Providers. We use third party service providers to process your personal data to assist us in business and technical operations, including applicant tracking systems, assessment platforms, background check providers, video interviewing software, and recruitment communication tools. Smartsheet has data processing agreements with such service providers that limit their use of and access to personal data to specific purposes. Our service providers provide services relating to, but not limited to, performing services on our behalf and only in accordance with our instructions, or to comply with legal requirements. For internship opportunities we also use a third party service provider to facilitate and manage the relationship between you and Smartsheet (including any relevant affiliates). In connection with the recruitment process, your personal data will be transferred to vendors including Greenhouse and Criteria Corp., which provide applicant tracking and evaluation services.
To Affiliates. We share your personal data with our affiliates for employment opportunities and for purposes otherwise described in this Candidate Notice.
To External Recruiting Partners. We engage external recruiting partners (including recruitment agencies, executive search firms, and staffing companies) to assist in identifying and evaluating candidates. These partners review your application materials, contact you about opportunities, conduct preliminary interviews, and retain your data in their systems. They are contractually required to process your data only as instructed, maintain confidentiality and security, and comply with applicable data protection laws. You may request information about which external partners are handling your application by contacting us at the address below.
As Required by Law. We will release information about you if we believe we must do so to comply with the law or a subpoena, bankruptcy proceeding, or similar legal process. In certain situations, we will be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. For internship opportunities we will also share your personal data with relevant educational entities to comply with applicable law (including labor laws) and regulations.
To Protect Rights. We will disclose information about you, such as your name and contact information, to enforce our agreements with you or to protect the rights and safety of Smartsheet (including any relevant affiliates), our customers and users, and the general public, or as evidence in litigation in which we are involved.
In a Business Transaction. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets, your information could be transferred to the acquiring entity as part of the transaction (provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Candidate Notice), and will also be reviewed as part of the due diligence review for the transaction. We may also disclose your personal data we collect and receive about you to providers, advisors, accountants, attorneys, and other third parties worldwide to the extent reasonably necessary to proceed with the negotiation or completion of a merger, acquisition, financing, public offering of securities, reorganization, or sale of all or a portion of our assets.
Legal Bases
For EU or UK candidates, we rely on different lawful bases for collecting and processing personal data about you, for example, as necessary to manage our recruiting relationship, operate our business, meet our contractual and legal obligations, protect the security of our systems and our data, or fulfil other legitimate interests.
Where we process your personal data based on legitimate interests, you can object to this processing in certain circumstances. In such cases, we will cease processing your personal data unless we have compelling legitimate grounds to continue processing or where it is required for legal reasons.
International Data Transfers
Personal data we collect will be transferred to, used, and stored in the United States or other jurisdictions in which Smartsheet, our affiliates, or service providers are located; these locations (including the United States) may not guarantee the same level of protection of personal data as the one in which you live. By providing us with your personal data, you agree to such transfer and/or processing. Smartsheet assesses the circumstances involving all cross-border data transfers and has suitable safeguards in place to require that your personal data will remain protected in accordance with this notice. In the event of such a transfer, we ensure that: (i) the personal data is transferred to countries recognized as offering an equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as the applicable standard contractual clauses.
For more information about how your personal data may be transferred internationally, please contact us using this form or using the contact details provided below.
Safeguards for EEA, UK, and Swiss Transfers. For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision (including the United States), we implement appropriate safeguards consistent with the Schrems II decision, including:
- EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum
- Transfer Impact Assessments (TIAs) evaluating the legal landscape in destination countries
- Technical measures such as encryption in transit and at rest, pseudonymization where feasible, and data minimization
- Contractual commitments requiring vendors to notify us of government access requests and to challenge unlawful requests through available legal remedies
- Preference for vendors offering EEA/UK data residency where feasible
Other Jurisdictions. Transfers from Singapore comply with PDPA Section 26, including notification, consent, and contractual protections requiring PDPA-equivalent standards. Transfers from Australia, India, Japan, and Costa Rica comply with the overseas disclosure requirements of each jurisdiction's data protection law.
Data Retention and Security
Retention. We retain your personal data for the period necessary to fulfill the purposes described in this notice and to comply with Smartsheet’s applicable legal requirements. Retention periods vary by jurisdiction to comply with local employment, tax, and anti-discrimination laws:
- Rejected candidates: Generally retained for 6 months to 3 years depending on jurisdiction
- Successful candidates: Transferred to employee records upon hire and retained per our employee data retention policies
- Diversity monitoring data: Retained separately and anonymized where possible
- Background check information: Retained as required by applicable law
If you are offered and accept employment with Smartsheet, the information collected during the application and recruitment process will become part of your employment record. Where retention is no longer required, we will securely delete or render your data inaccessible.
Security. We implement appropriate technical, organizational, and physical measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls, regular security assessments, employee training, incident response procedures, and contractual security obligations for third-party processors. While we maintain standard security practices, no system is completely secure.
Breach Notification. In the event of a confirmed data breach affecting your personal data, we will notify you and relevant authorities as required by applicable law.
Your Privacy Rights
Your rights regarding your personal data vary depending on where you reside. To exercise any of these rights, please contact us using the information at the end of this notice. We will respond within the timeframe required by applicable law and will ask you to verify your identity before fulfilling your request.
- You have the right to ascertain whether we hold your personal data and what data we hold;
- You have the right to request from us access to, and rectification of, your personal data, subject to certain employment exceptions;
- You have the right to be informed of the purposes for collection of each data type;
- You have the right to know the retention periods for the data Smartsheet collects;
- You have the right to escalate complaints to the appropriate supervisory authority, as outlined below, if you feel that Smartsheet is not addressing your concerns;
- You have the right to exercise these rights without retaliation.
We will refuse requests that are manifestly unfounded, excessive, or that we are otherwise permitted to refuse under applicable law, and will explain our reasons where required.
Children's Personal Data
Our recruitment process is not directed to individuals under 18 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected such data inappropriately, we will delete it promptly.
Changes to This Notice
We will update this Candidate Notice from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by updating the date below. Your continued participation in the recruitment process following any updates constitutes acceptance of the updated notice.
How to Contact Us
For information on how to contact our Privacy Office or Data Protection Officer, please see the How to Contact Us section of our Privacy Notice.
Last Updated: August 3, 2026