1. Scope
This Workforce Privacy Notice applies to job applicants, employees, interns, and individual contractors (collectively, “Workforce”) of Habitat for Humanity International, Inc. (“HFHI”). This Notice is intended to satisfy Articles 12–14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and applies where GDPR or UK GDPR is applicable, including where Workforce personal data is processed in or from the European Economic Area (“EEA”) or the United Kingdom and with Philippine Republic Act (RA) No. 10173 or the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR), and other applicable issuances of the National Privacy Commission (NPC). It supplements the HFHI Privacy Policy and describes how personal data is collected and used in connection with recruitment, hiring, and employment. It does not form part of any employment contract.
2. Who We Are
HFHI acts as the data controller for personal data processed for workforce-related purposes, including through Human Capital Management systems such as Workday. HFHI’s address is 285 Peachtree Center Ave. NE, Suite 2700, Atlanta, GA 30303 USA.
3. EU / UK Representative
Where required under Article 27 GDPR, HFHI has appointed an EU/UK representative. Details are available upon request by contracting HFHI using details in Section 13.
4. Personal Data We Collect
Depending on your role, location, and relationship with HFHI, we may process the following categories of personal data:
- Identification and contact information (e.g., name, address, email, phone number, government ID where legally permitted);
- Recruitment and employment information (e.g., CVs, references, offer letters, job history, performance information);
- Compensation and benefits data (e.g., salary, benefits elections, tax information);
- Work authorization and compliance data;
- Systems, device, and access data;
- Workforce analytics and reporting data;
- Demographic, inclusion, or survey‑based data, where legally permitted and subject to appropriate safeguards. Sensitive Personal Information including health records, medical information, marital status, age, and other information classified as sensitive may also be collected.
5. Purposes and Legal Bases of Processing
HFHI processes workforce personal data only where a lawful basis exists under Article 6 GDPR:
Purpose of Processing | Legal Basis |
|---|---|
Recruitment, hiring, onboarding | Steps prior to entering into a contract (GDPR Art. 6(1)(b)) Philippines Republic Act (RA) No. 10173 |
Employment administration and HR management | Performance of a contract (Art. 6(1)(b)) Republic Act (RA) No. 10173 |
Payroll, tax, benefits, employment law compliance | Legal obligation (Art. 6(1)(c)) Republic Act (RA) No. 10173 |
Workforce planning, analytics, organizational development | Legitimate interests (Art. 6(1)(f)) |
Workplace safety and security | Legitimate interests or consent, depending on jurisdiction |
DEI metrics or surveys (where applicable) | Legitimate interests or consent, depending on jurisdiction |
Optional programs or initiatives | Consent, where required by law (Art. 6(1)(a)) Republic Act (RA) No. 10173 |
Where processing is based on legitimate interests, HFHI balances those interests against the rights and freedoms of individuals.
6. Automated Decision‑Making
HFHI does not make workforce decisions based solely on automated processing that produces legal or similarly significant effects.
7. Data Retention
Workforce personal data is retained only for as long as necessary for the purposes described above, including:
- the duration of recruitment or employment;
- applicable statutory limitation periods; and
- audit, tax, and employment law requirements.
Retention periods are governed by HFHI’s internal records retention schedules and applicable local law.
Workforce personal data is retained only for as long as necessary to fulfill the purposes described in this Notice, including compliance with legal, regulatory, tax, audit, and employment obligations, and in accordance with HFHI record retention schedules.
8. Data Sharing and Transfers
HFHI may share workforce personal data:
- internally within the Habitat for Humanity organization, on a need‑to‑know basis;
- with service providers (e.g., HRIS, payroll, benefits, IT support) acting as data processors under contract;
- with regulators or authorities where legally required.
Service providers are contractually required to protect personal data and process it only on HFHI’s instructions.
9. International Data Transfers
HFHI is headquartered in the United States. Where workforce personal data is transferred outside the EEA or UK, HFHI relies on appropriate safeguards, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- equivalent UK transfer mechanisms; or
- other lawful transfer mechanisms permitted by GDPR.
Copies of relevant safeguards may be requested at Data Privacy Manager, Habitat for Humanity International, 285 Peachtree Center Ave NE #2700, Atlanta, GA 30303, or [email protected].
10. Your Data Protection Rights
Subject to applicable law, you may have the right to:
- request access to your personal data;
- request correction or rectification;
- request deletion (“right to be forgotten”);
- restrict processing;
- object to processing based on legitimate interests;
- request data portability; and
- withdraw consent, where processing is based on consent.
You also have the right to lodge a complaint with your local data protection supervisory authority.
Depending on your location, you may have rights to request access, correction, deletion, restriction, or objection to processing, and to withdraw consent where consent is the legal basis.
11. No Consent Requirement for Employment
Where personal data is processed for recruitment, hiring, or employment‑related purposes, HFHI relies on lawful bases other than consent, such as performance of a contract, compliance with legal obligations, or legitimate interests. You are not required to provide consent for such processing, and refusal or withdrawal of consent will not affect your application or employment. Consent will be requested only for clearly identified, genuinely optional programs or activities, where refusal or withdrawal carries no adverse consequences.
12. Security Measures
HFHI implements appropriate organizational, physical, and technical security measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, or unauthorized access, in accordance with the privacy regulations.
13. Contact Information
Questions or requests regarding workforce personal data may be directed to the Data Privacy Manager, Habitat for Humanity International, 285 Peachtree Center Ave NE #2700, Atlanta, GA 30303, or [email protected].