Island Privacy Policy

1. When you subscribe to our distribution list(s) / newsletter(s)
2. When you contact us
3. When we process your job application

1. When you create an account, log in and make use of the Platform and/or the App

2.1. Security. We have implemented appropriate technical, organizational and security measures designed to protect your Personal Data. However, please note that we cannot guarantee that the information will not be compromised as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.

2.2. Retention of Your Personal Data. We retain Personal Data for as long as necessary or as permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. Please note that in some circumstances we may store your Personal Data for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Data or dealings.

1. 3.2.1. Cloud service providers for hosting and data storage.
2. 3.2.2. Authentication providers to verify user identity.
3. 3.2.3. Analytics companies to help us analyze and understand the data we collect, in accordance with this policy.
4. 3.2.4. Customer relationship management (CRM) platforms.
5. 3.2.5. Data and cyber security services.
6. 3.2.6. HR and recruiting platforms.
7. 3.2.7. Email and communication distribution and monitoring services.
8. 3.2.8. Social and advertising networks.

4.1. Storage: Your Personal Data may be stored and processed in any country where we have facilities or in which we engage third-party service providers. By using our services you understand that your Personal Data may be transferred to countries outside of your country of residence, including to the United States and/or Israel. We may store the Personal Data with the following service providers: Salesforce, Hubspot, Amazon Web Services, Google LLC (Google Cloud), Microsoft Corporation (Azure), and Okta. The data storage location may vary based on customer preferences.

4.2. External transfers: Where we transfer your Personal Data outside of the UK and/or EU/EEA (for example to third parties who provide us with services), we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR; or (ii) Standard Contractual Clauses: For transfers of Personal Data from the UK and/or EEA to third countries, which are not considered adequate under the UK GDPR and/or by the European Commission, we have put in place standard contractual clauses adopted under the UK GDPR and/or by the European Commission to protect your Personal Data.

5.1. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to individuals depending on their country or state of residence (some of which only apply to individuals protected by the GDPR). The rights that may be applicable to you are as follows:

• You have a right to access to Personal Data held about you. Your right to access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
• You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
• You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are permitted or required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
• You have the right to object, or to request restriction, of the processing;
• You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine‐readable format, and that you have the right to transmit that data to another controller;
• You have the right to object to profiling, if applicable;
• You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
• You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
• You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.

5.2. The following rights (which may be subject to certain exemptions or derogations) shall apply to individuals protected by applicable U.S. privacy laws (such as the California Consumer Privacy Act (“CCPA”) and comprehensive consumer privacy laws in other U.S. states):

• You have the right to know whether we process your Personal Information, and to access such Personal Information. This includes the right to information about the categories of personal data we collect, the sources from which it is collected, the business or commercial purposes for collecting or sharing your Personal Information about you, and whether we disclosed, sold or shared your Personal Information and to whom;
• You have the right to request the correction of inaccuracies in your Personal Information;
• You have the right to request the deletion of your Personal Information (e.g. from our records and the records of our service providers). Please note that there may be circumstances in which we are required to retain your Personal Information, for example for the establishment, exercise or defense of legal claims;
• You have the right to request to receive a copy of your Personal Information, including specific pieces of Personal Information, including, where applicable, to obtain a copy of the Personal Information you provided to us in a portable format;
• You have the right to opt-out of the processing of your Personal Information, including the right to opt-out of the “sale” or “sharing” (as defined under the CCPA) of your personal information or its use for targeted advertising, if applicable, where such requests are permitted by law;
• You have the right not to receive discriminatory treatment for the exercise of your privacy rights;
• You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence (e.g. the Attorney General in your State). We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.

5.3. To the extent that the privacy laws applicable to you afford you the rights referenced above, we will comply with such laws and respect your rights. You can exercise your rights by contacting us at privacy@island.io. You may use an authorized agent to submit a request on your behalf if you provide the authorized agent written permission signed by you. To protect your privacy, we may take steps to verify your identity before fulfilling your request. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfill your request. When processing your request, we may ask you for additional information to confirm or verify your identity and for security purposes, before processing and/or honoring your request. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. In the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initial requested, we will address your request to the maximum extent possible, all in accordance with applicable law.

9.1. This Privacy Policy details the categories of Personal Information we collect and process, the categories of sources from which we obtain it, the purposes for its collection and processing, the categories of Personal Information we disclose to third parties for our operational business purposes, including within the 12 months preceding the date this Privacy Policy was last updated, as well as our practices regarding data retention and deletion (Sections 1-3). We do not sell your Personal Information in exchange for monetary compensation. However, we use targeting cookies to enhance your browsing experience by providing personalized ads and analytics. Under applicable U.S. privacy laws (such as the CCPA and comprehensive consumer privacy laws in other U.S. states), you have the right to opt out of the “sale” or “sharing” (as defined under the CCPA) of your Personal Information or its use for targeted advertising. To opt-out of such uses of your Personal Information, click on the “Cookie Settings” link in the website footer and select your options in the pop-up. Please note that if you choose to enable Global Privacy Control (GPC) on your browser, we will recognize and process this signal as a request to opt out of the sale or sharing of your Personal Information or use for targeted advertising, in accordance with applicable privacy laws. We will not unlawfully discriminate against you for exercising your rights under applicable privacy law. You may have certain rights under applicable law regarding your Personal Information. These rights are set forth above in the YOUR PRIVACY RIGHTS section. If you have questions or wish to exercise your rights under applicable privacy laws, please contact us at privacy@island.io. We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request. We may need to request additional Personal Information from you, such as your account information / email address where applicable, in order to verify your identity and protect against fraudulent requests. If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information.

9.2. We will make every effort to respond to your request within 45 days from when you contacted us. If you have a complex request, applicable law may allow us up to 90 days to respond. We will still contact you within 45 days from when you contacted us to let you know we need more time to respond.

9.3. If we decline to take action on a request that you have submitted, we will inform you of our reasons for doing so, and provide instructions for how to appeal the decision. Depending on your state of residence you may have the right to appeal within a reasonable period of time after you have received our decision. If you have this appeal right, within 60 days (45 days for residents of certain states) of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, we will provide you with a method for contacting your state attorney general’s office to submit a complaint to the extent required by applicable law.

9.4. Other California Privacy Rights: Island has placed a California Notice of Rights on its website to explain how California residents may exercise their privacy rights under the CCPA. This notice is incorporated into this policy. The CCPA permits our customers who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@island.io.

9.5. Do Not Track Notice: Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals or similar mechanisms transmitted by web browsers except as required by applicable law.