Applicant Privacy Notice
Last Updated: September 30, 2026
1. Introduction
PURPOSE OF THIS NOTICE: In this Applicant Privacy Notice ("Notice"), we describe our collection, use, disclosure, and retention of Personal Data relating to your (referred to as "you", "Applicant", or "Applicants") application for employment with us. If you are a California resident, this Notice is also intended to satisfy our obligation to provide notice under the California Consumer Privacy Act ("CCPA").
SCOPE OF THIS NOTICE: This Notice applies to the Personal Data (as defined below) that the following entities collect about you when you apply for employment, jobs and other positions with us: Woven by Toyota U.K. Limited, Woven by Toyota, U.S., Inc., and Woven by Toyota, Inc. (collectively, "the Company", "Woven Group", "we", or "us").
This Notice does not apply to our collection of Personal Data such as consumer credit reports and background checks, publicly available data lawfully made available from state or federal government records, or other information that is exempt under the CCPA. This Applicant Notice also does not apply to the Personal Data we collect from employees (which is subject to a separate privacy notice).
The controllers of your Personal Data are:
- Woven by Toyota U.K. Limited
- 114-116 Curtain Road, London, United Kingdom, EC2A 3AH
- Woven by Toyota, U.S., Inc.
- 900 Arastradero Rd, Palo Alto, CA, USA 94304
- Woven by Toyota, Inc.
- Nihonbashi Muromachi Mitsui Tower, 3-2-1 Nihonbashimuromachi, Chuo-ku, Tokyo, JAPAN 103-0022
We may provide Applicants additional notices about our data collection practices that are covered by other laws (e.g., if we conduct a background check, extend an employment offer, or implement new business elements that involve new uses of your Personal Data), and we encourage you to carefully read this Notice together with any such other privacy notice or policy we provide on specific occasions.
2. Personal Data about you that we collect and use
In this Notice, "Personal Data" is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. For Applicants residing in the United States, references in this Notice to "Personal Data" also include "personal information" and similar terms as defined under applicable U.S. state privacy laws (e.g., the California Consumer Privacy Act and comparable state laws). Personal Data does not include de-identified information.
The categories of Personal Data we collect and use may vary depending on the position(s) or location, as well as the associated qualifications and responsibilities. The information in this Notice is intended to provide an overall description of our collection and use of Personal Data about Applicants.
| Categories of Personal Data Collected | Description / Examples |
|---|---|
| Personal details and identifiers | Name, alias, postal address, physical address, email address, phone number or other contact information, degree/title, date of birth, gender, unique personal identifier, online identifier, IP address, account name, and similar identifiers. |
| Government identifiers and other statutory data | Social security number, passport number, driver's license or state identification card number, and other government-issued identifiers. |
| Professional qualifications, employment history and management records | Professional certifications, special skills (including driver's licenses), language skills, memberships of committees or other bodies, shareholdings and directorships, education history, prior job titles, employers, work history, and other previous job experience and references. |
| Recruitment or selection data | Any Personal Data contained in your CV/resume and application form, references, records of interviews or interview notes, selection and verification records, and other information used to assess your suitability for a role. |
| Training and development data | Information relating to training and development needs or training received as part of or in connection with the application process. |
| Financial and benefits-related data (where applicable) | Bank account number, credit card number, debit card number, or other financial information, and health insurance information, to the extent collected in connection with recruitment (e.g., for reimbursement, relocation, or onboarding-related processes). |
| Education information | Information about education history or background that is not publicly available personally identifiable information, as defined in the U.S. Family Educational Rights and Privacy Act (e.g., school(s) attended, degrees obtained, dates of attendance). |
| Protected classifications (where voluntarily provided and permitted by law) | Characteristics of protected classifications such as race, color, sex, sexual orientation, gender identity, age, religion, national origin, disability, citizenship or immigration status, military/veteran status, marital status, medical condition, pregnancy, and similar attributes, some of which may be considered Sensitive Personal Data. |
| Audio, visual, and similar electronic data (where applicable) | Audio, electronic, visual, or similar information such as CCTV footage or photographs collected at Company premises, and information from interviews conducted by phone, video, or other electronic means (e.g., Google Meet). |
| Profiles, assessments, and inferences (where applicable) | Information and inferences derived from assessments (e.g., coding tasks or other role-related assessments) about your abilities, aptitudes, characteristics, preferences, predispositions, behavior, and intelligence, used to evaluate suitability for a role. |
| Special categories of Personal Data (criminal-related data) | Information relating to the commission or alleged commission by you of any offence; any proceedings for any offence committed or alleged to have been committed by you, the disposal of those proceedings, or the sentence of any court in those proceedings, collected where permitted or required by law. |
| Sensitive Personal Data (other than criminal-related, where permitted and applicable) | Selected types of Sensitive Personal Data collected to support legal or business activities, such as: (i) government-issued identifiers (e.g., social security information, driver's license, state ID, passport); (ii) account log-in details in combination with security or access codes, passwords, or credentials that allow access to an account; (iii) sensitive demographic information such as racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs; (iv) health information (e.g., information you provide in connection with a request for health-related accommodations); and (v) information relating to sex life or sexual orientation (e.g., in connection with applicable benefits or diversity, equity, and inclusion programs), in each case only to the extent permitted by law. |
| Other information you choose to disclose | Any other Personal Data you voluntarily provide to the Company during the application process (e.g., information shared in free-text fields, communications with recruiters, or additional documents you submit). |
Sources of Personal Data
We collect Personal Data from a variety of sources, including directly or automatically collected from you, inferences we may generate or derive from information we have collected from you, references provided by you, including former and current employer, service providers (e.g., recruiters, skills assessment providers, telecommunications providers, etc.), insurance and benefits providers, background check services, online sources including social networks and recruiting sites (e.g., LinkedIn), and open government databases and other public sources.
3. Legal bases for Personal Data collection and use
We collect and use your Personal Data in accordance with applicable data protection laws. This means that we collect and use Personal Data only on one of the following legal bases:
- to take steps to enter into a contract with you
- to comply with a legal obligation to which we are subject
- where it is necessary to serve our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests
- where we have your free and explicit consent
"Legitimate interests" means our interest in evaluating your application to determine your suitability for a position with us and to compare you with other Applicants in order to make a hiring decision. Where required, we will inform you about other legitimate interests as applicable.
When we rely on your consent for the collection and use of Personal data, we will provide you with full details of the Personal Data that we would like to process and the reasons we need it, so that you can carefully consider whether you wish to freely consent. We will also inform you about the fact that you can revoke your consent at any time and how you can do that.
4. Purposes for using your Personal Data
The Company collects and uses your Personal Data for the purposes described in the table below, to the extent permitted by applicable law. If you do not provide us with your Personal Data, we will not be able to process your application.
| Categories of Purposes of Use | Description / Examples |
|---|---|
| Recruiting and hiring | Evaluating and processing your application, making hiring decisions, taking steps to prepare your offer letter and contract of employment (where applicable), and preparing for your onboarding (including assessing salary and compensation matters and managing and improving recruiting and hiring efficiency and effectiveness). |
| Communication and talent pooling | Communicating and collaborating with you regarding your application and about other similar positions that may be of interest to you (including with affiliated entities, where permitted by law), and maintaining your Personal Data for future consideration, as permitted by law. |
| Legal and regulatory compliance | Complying with applicable laws and regulations (e.g., hiring eligibility requirements, employment and labor laws, social security and tax laws, workplace and health and safety laws), and related assessments, reviews, reporting, and audits. |
| Background checks and vetting | Conducting and evaluating the results of background checks and obtaining and reviewing criminal record disclosures where required for your role or client contract and authorized by law. |
| Security and monitoring | Monitoring for, preventing, investigating, and responding to security and privacy incidents or suspected or alleged misconduct or violations of work rules; providing and managing access to physical and technical systems; monitoring activities, access, and use to help ensure the security and functioning of our systems and assets; and securing our offices, premises, and physical assets (which may include the use of electronic access systems and video monitoring). |
| Auditing and corporate governance | Supporting financial, tax, and accounting audits; audits and assessments of our business operations, security controls, and financial controls; and other internal business purposes, such as administration of our records retention program. |
| Business Transactions | Planning, conducting due diligence for, and implementing commercial transactions, such as mergers, acquisitions, asset sales or transfers, bankruptcies or reorganizations, or other similar business transactions. |
| Protection of rights and interests | Protecting and defending our rights and interests and those of third parties, including managing and responding to legal claims or disputes and otherwise establishing, defending, or protecting our rights or interests or the rights, interests, health, or safety of others. |
| Applicant experience and related activities | Conducting surveys to understand your experience during the application process. |
| Use of de-identified data | Using de-identified information derived from Personal Data, in accordance with applicable law. |
5. Retention of your Personal Data
We retain your Personal Data for as long as necessary to fulfil the purposes for which it was collected, unless a longer period is necessary to comply with our legal obligations or to defend a legal claim. If you do not become an employee with us, we usually retain your application-related Personal Data for up to 2 years, unless a shorter period is required by law. If your application is unsuccessful, we may retain your application-related data for the purpose of considering you for other roles that become available in the future. If you form an employment relationship with us, we typically maintain your Personal Data for the duration of your employment, and thereafter for as long as necessary to comply with applicable legal obligations or for other legitimate business purposes. Certain records may be subject to longer statutory retention periods; for example, tax laws may require us to retain payroll-related information for a fixed period of time to meet our tax obligations.
6. Security
We take reasonable steps to ensure that your Personal Data is properly secured, using appropriate technical, physical and organizational measures, so that it is protected against unauthorised or unlawful use, alteration, unauthorised access or disclosure, accidental or wrongful destruction, and loss.
We also limit access to your Personal Data to those persons who need to have access to it for one of the purposes listed in this Notice. Furthermore, we contractually require any third party processing your Personal Data to provide for the confidentiality and integrity of your Personal Data in a secure way.
7. Disclosure and transfer of your Personal Data
For the purposes listed in Section 4 above, we disclose your Personal Data on a need-to-know basis to the following categories of recipients, to the extent permitted by applicable law:
| Categories of recipients | Description / Examples |
|---|---|
| Woven by Toyota Group entities and colleagues | Colleagues and teams within the Company (both in the country where you applied for a position and in other countries in which we have operations), who need access to your Personal Data to carry out their role in the recruitment and hiring process (e.g., recruiting, hiring managers, HR, IT, security, and legal). |
| Vendors and other service providers | Third-party vendors and suppliers that process Personal Data on our behalf, such as providers that host or support our application portal and recruitment systems, deliver recruiting or administrative services, provide skills assessments, communications, analytics, security and fraud prevention services, or otherwise help us improve and manage our recruiting and hiring processes. |
| Affiliated entities (with your consent where required) | With your consent, we may share your Personal Data with our affiliated entities so they can evaluate your suitability for other roles for which you may be qualified, where permitted by law. |
| Parties to corporate transactions | Actual or potential buyers, investors, or other parties (and their advisors) in connection with mergers, acquisitions, asset sales or transfers, financing, restructurings, bankruptcies or reorganizations, or other similar business transactions involving the Company. |
| Public authorities and those with a legal necessity | Government authorities and public bodies (including competent regulatory authorities, law enforcement authorities, other governmental agencies, and tax authorities), courts, and external advisors (such as lawyers, auditors, and consultants), where we are required or permitted to do so by law, or where disclosure is necessary to: (i) comply with applicable law or respond to valid legal process; (ii) operate and maintain the security of our systems (including preventing or stopping attacks on our systems or networks); (iii) protect the rights, property, or safety of the Company, our Applicants, employees, or others; or (iv) respond to emergencies or incidents involving health or safety. |
| Use and sharing of de-identified information | We may disclose de-identified information derived from Personal Data, in accordance with applicable law. |
When we transfer your Personal Data to recipients located in countries outside the EEA or the United Kingdom that are not deemed to provide an adequate level of data protection, we implement appropriate safeguards, such as entering into Standard Contractual Clauses approved by the European Commission and/or other appropriate safeguards, as required by applicable law. You are entitled to receive a copy of any documentation showing the suitable safeguards that have been taken by making a request via AskHR@woven.toyota.
8. Your rights
You may have certain rights in relation to your Personal Data under applicable data protection and privacy laws. The availability of these rights and the ways in which you can exercise them may vary depending on your country or state of residence.
Rights available to Applicants
Right to access, correct and delete your Personal Data
You have the right to request access to any of your Personal Data that the Company may hold and to request correction of any inaccurate or incomplete Personal Data relating to you. You furthermore have the right to request deletion of any Personal Data that is no longer necessary for the purposes for which it was collected or otherwise processed, subject to applicable legal obligations and retention requirements.
Right to withdraw consent
Where your Personal Data is processed on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to Data portability
To the extent that we process your Personal Data on the basis of your consent or for the performance of a contract with you, and that Personal Data is processed by automated means, you have the right to receive such Personal Data in a structured, commonly used and machine-readable format, and to require us to transmit it to another data controller where technically feasible.
Right to restrict the use of your Personal Data
You have the right to restrict our use of your Personal Data in certain circumstances, for example where you contest the accuracy of the Personal Data or where you have objected to our use and we are verifying whether we have compelling legitimate grounds to continue.
Right to object
To the extent that we rely on our legitimate interests to use your Personal Data, you have the right to object to such use, and we must stop such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where we need to process the Personal Data for the establishment, exercise or defense of legal claims.
Right to lodge a complaint
You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, place of work or place of the alleged infringement, if you consider that the collection and use of your Personal Data infringes applicable law.
California Privacy Rights
If you apply from California, you may have additional rights regarding Personal Data (referred to as "personal information" or similar terms under the California Consumer Privacy Act (CCPA)). These rights include:
Right to Know
You have a right to request that we disclose the Personal Data we have collected about you. You also have a right to request additional information about our collection, use, disclosure, sale, or sharing of Personal Data. Note that we have provided much of this information in this Applicant Notice.
Right to Request Correction
You have the right to request that we correct inaccurate Personal Data.
Right to Request Deletion
You have a right to request that we delete Personal Data under certain circumstances, subject to lawful exceptions.
Right to Opt-Out
Where our data practices constitute a "sale" or "sharing" of Personal Data under the CCPA, you have the right to direct us not to "sell" or "share" your Personal Data. We do not knowingly sell or share the Personal Data of minors under 16 years of age.
Right to Limit Use and Disclosure of Sensitive Personal Data
Where we use or disclose Sensitive Personal Data to infer individual characteristics or for purposes other than those permitted by CCPA, you have a right to request that we limit our use and disclosure of such Sensitive Personal Data.
We do not use or disclose Sensitive Personal Data to infer individual characteristics or for additional purposes.Right to Notice
You have a right to receive notice of our Personal Data collection, use, retention, and disclosure practices at or before the collection of such data.
Right to Non-Discrimination
You have a right not to be discriminated against for exercising these rights set out in the CCPA.
Exercising Your Rights
For further information regarding your rights, or to exercise any of your rights, please email us at AskHR@woven.toyota or call 1-844-870-2833 (for California residents).
You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under applicable law.
We may need to verify your identity (and the identity and authority of any authorised agent) before fulfilling your request, which may include asking you to provide certain information or to submit the request from the email address associated with your application.
9. Cookies & Similar Technologies
For information regarding the use of cookies and similar technologies on our websites, please see our Cookie Notice.
10. Contact us
If you have any questions or concerns regarding our use of your Personal Data, please contact AskHR@woven.toyota.
11. Changes to this Notice
We may occasionally update this Notice to reflect changes required by law or our practices or procedures. If we make material changes to this Notice, or in how we use Personal Data, we will provide notice (or obtain consent) regarding such modifications as may be required by law.