California Job Applicant Privacy Notice

Scope

This California Job Applicant Privacy Notice (“Notice”) details the Personal Information (defined below) IDEAYA Biosciences and its affiliates (together, “IDEAYA”, “Company”, “we”, “our”, “us”) receives about job applicants of the Company who are California residents (collectively, “Applicants”). This Notice also details how we process Personal Information about Applicants and your respective rights regarding such information. This Notice applies to Applicants whose Personal Information is collected by Company.

This Notice takes into account the California Consumer Privacy Act of 2018, and its implementing regulations, both as may be amended from time to time (the “CCPA”). Under the CCPA, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Applicant. For purposes of this Notice, Personal Information does not include information that is aggregated or deidentified. Company may be contacted at the below for all questions relating to this Notice:

E-mail: hr@ideayabio.com

Address: IDEAYA Biosciences, Inc.
7000 Shoreline Court, Suite 350
South San Francisco, CA 94080
Attn: Human Resources

What Personal Information Does Company Collect About Applicants and For What Purposes?

In the past 12 months, the Company has collected the following Personal Information, including Sensitive Personal Information (as that is defined in the CCPA), about you as part of your job application with IDEAYA and we may use it for the following purposes:

Identity Information. Name, contact information, gender, citizenship, nationality, date of birth, photograph, protected classification characteristics under California or federal law (including race, gender, and social security number), passport or other unique ID number, proof of eligibility to work and details of any visa or work permit application, including biometric data, personal and family details, and medical and health screening details. We use this information to determine and validate your qualifications and suitability for employment, verify your eligibility to work, obtain references, screen your educational and professional background information, conduct background checks, improve our recruiting process, create an employment record and communicate with you.
Contact Details. Home and work address, phone number(s), email address(es), emergency contacts, beneficiaries and next of kin. We use this information to contact you and for personal administration including maintaining your contact information and processing your application;
Qualification Information. Date of hire, employee category, full/part-time status, qualifications, references, resumé(s) or curriculum vitae, language(s) spoken, background checks (including education, professional licenses, civil and criminal records, regulatory matters, directorship, and credit checks) and membership of professional bodies. We use this information for employee management purposes;
Health Information. This information may regard yourself and your family, including physical and mental health or condition, vaccination status, medical and health screening details, disabilities, meal preferences and food allergies and records of benefits entitlements and utilization. We use this information to assess your qualifications for work and administer certain benefits, make certain health and safety reporting, and otherwise comply with our legal obligations;
Compliance-Related Information. Information required in relation to anti-bribery and sanctions as well as other compliance purposes, including details of political contributions, gifts and entertainment provided or received, outside business activities, and litigation or other legal matters. We use this information to comply with relevant legal, regulatory and administrative obligations;
Compensation-Related Information. Compensation, interests in funds sponsored by Company or its affiliates, benefits and other financial information, including current and past salary details, your bank, or other financial institution account details, tax/social security number, bonuses, expenses, pensions, corporate credit card details, payments to family and dependents and court judgments. We use this information to administer salaries, wages, bonuses and benefits, to reimburse expenses and to ensure compliance with relevant legal, regulatory and administrative obligations;
Travel Information. Information related to travel for the purposes of the working relationship, including driver’s license details, passport details, special meal requests and travel preferences.
Usage Data. Details of the devices used to interact with us as an Applicant, such as unique device identifier, browser type and settings, device type, and operating system information, IP address and other information associated with your IP address such as your approximate geographic region, details about the emails we send, such as when you open or click on them. We use this information to interact with you, assess your application, and to manage the application process.

Sources of Personal Information. We receive information about you directly from you, as well as from other sources including benefits providers, past employers, recruitment agencies, compliance monitoring agencies, career websites, and public searches. To the extent that Personal Information about you is processed for the purposes of equal opportunities monitoring, such Personal Information shall be provided in anonymized form.

How Does Company Use Applicant Personal Information?

Your Personal Information will be handled by Company in accordance with this Notice. Your Personal Information may be retained in accordance with the policies and procedures of Company adopted from time to time and (a) as required by law, regulation, legal or judicial process or audit, decision of a court or arbitral tribunal, decision of a governmental authority with relevant powers, or by the rules of applicable stock exchange or recognized market place, or by a regulator, or self-regulatory organization or pursuant to mandatory ethics rules applicable to Company or its affiliates (collectively, “Law”) or (b) as reasonably required in relation to any claim or investigation pursuant to any Law and/or any matter which may lead to such a claim or investigation (a “Claim or Investigation”).

Disclosure of Applicant Personal Information

We share your information with selected recipients. These categories of recipients include:

Email and other services providers, including Microsoft;
background check providers, to verify the information that you provided as part of your application;
human resources information system and payroll services providers;
medical, dental, vision, life assurance and disability insurance providers;
travel agencies for the purposes of arranging employment-related travel and travel insurance providers including Direct Travel;
visa applications advisers including Graham Adair;
corporate credit card providers, including MasterCard; and
cloud and other data management and storage providers, to store the Personal Information you provide and for disaster recovery services, as well as destruction of information;

We disclose Personal Information about you to evaluate your candidacy, process your application for employment, and further our relationship with you as an Applicant.

Where Company is under an obligation to do so by law, it will also disclose your Personal Information to regulators, courts, the police or tax authorities, or in the course of litigation or other legal or regulatory matters. We may also disclose Personal Information to third parties in the context of any sale, merger or acquisition of a company or business in which the Company is involved. In some cases, it may not be reasonably practicable or possible to notify you in advance about the details of such disclosures.

Personal Information may also be disclosed to a third party such as your bank, mortgage company, lender, credit agency, other financial institutions, landlord, prospective employer, relocation company, visa or travel agency, but only with your consent.

Company uses a number of third-party suppliers (such as for occupational health, relocation services, visa and travel, training, IT service providers, human resources, expenses, payroll, legal counsel, accounting, tax advisors, etc.) to provide services to Company.

We do not have actual knowledge that we sell or share personal information of individuals under 16 years of age. In the preceding 12 months, we have not sold or shared personal information, including sensitive personal information, to third parties in the past 12 months.

In the past 12 months, we disclosed Personal Information about you, to the following categories of recipients, for the following purposes:

Categories of Personal Information (as defined under the CCPA)	Disclosed Personal Information for a business purpose (based on the categories of personal information outlined in Section 2)	Categories of recipients
Identifiers	Identity Information Contact Details	Applicant Tracking System Background Check Vendor
Personal information categories listed in the California Customer Records statute	Identity Information – Name, telephone number	Applicant Tracking System Background Check Vendor
Protected classification characteristics under California or federal law	Identity Information – Race, color, national origin or ancestry, sex (including gender), physical or mental disability, veteran status, and citizenship]	Applicant Tracking System Immigration Counsel (citizenship – for visa applicants)
Internet or other similar network activity	Usage Data (as described above) and information regarding your electronic interactions with us	Applicant Tracking System
Professional or employment-related information	Qualification Information	Applicant Tracking System Background Check Vendor
Education information	Qualification Information	Applicant Tracking System Background Check Vendor
Inferences drawn from other Personal Information	Information reflecting your application and candidacy	Applicant Tracking System
Sensitive Personal Information	Nationality, Citizenship, and Government Identifiers Racial or ethnic origin	Applicant Tracking System Immigration Counsel (citizenship – for visa applicants)

Retention of Personal Information

We’ll retain your Personal Information for as long as is required in order to comply with applicable laws, to resolve disputes and to enforce our contractual agreements, or as necessary for the business purposes described in this Notice, such as to manage our Applicant relationship with you.

We retain the Personal Information collected during the application process, and information about your application process, as part of your Applicant records.

Exercising Your Rights

Under the CCPA, you have the following rights which you may exercise yourself or may designate an authorized agent to exercise on your behalf:

Right to Know. You have the right to request that we disclose to you the Personal Information we collect, use or disclose, and information about our data practices.
Right to Access. You have the right to access specific pieces of Personal Information or categories of Personal Information collected about you and to know the source from which it was collected, the business or commercial purpose for which it was collected or shared and the categories of third parties with whom the Personal Information was shared.
Right to Request Deletion. You have the right to request that we delete your Personal Information that we have collected from you.
Right to Correct. You have the right to request that we correct inaccurate Personal Information maintained about you.
Right to No Retaliation. We will not retaliate against you for exercising any of these rights.

To make a request in relation to the above rights, please contact us at privacy@ideayabio.com. To fulfill your request, we will need to verify your identity and residency in California and ask for additional information and documents. We may need to collect information from you to verify your identity, such as your email address, government issued ID or date of birth, before providing a substantive response to the request. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

Only you, or someone legally authorized to act on your behalf, may make a request related to personal information collected about you. To designate an authorized agent, the authorized agent must provide sufficient information that allows us to reasonably verify that they have been authorized by you to act on their behalf.

Notification of Changes

This Notice may be updated from time to time by us at our discretion to account for changes in the law or changes in our collection and/or processing of Personal Information. If we make material changes to this Notice, we will share the updated Notice on our website.

Last updated: January 1, 2023