Global Recruitment Privacy Notice

Last Updated: July 2026

This Global Recruitment Privacy Notice (“Notice”) will provide you with information about how we collect, use, and store (collectively “process”) certain Personal Information about prospects, and applicants (herein “you” or “yours”) for employment opportunities at Unity Technologies1(herein “we”, “us”, “our”, or “Unity”). When we say “Personal Information” we mean information that identifies you as an individual or relates to an identifiable individual. Personal Information does not include aggregated, de-identified, and/ or anonymized information, i.e., when the information has been transformed so that it no longer relates back to a person’s identity. Personal Information is inclusive of personal data. If your application is successful, the processing of your Personal Information will be governed by our Privacy Notice to Workforce which will be available to you prior to beginning your employment.

We respect your privacy and are committed to protecting your Personal Information.

Information We Process

Depending on your employment and geographical location, we may process the below categories of Personal Information.

Background Information
Such as criminal history and other data from background screenings (where legally permissible); education and employment history; information gathered from references; organizational affiliations; professional licenses and certifications; resumes; social media profiles (e.g., LinkedIn, professional websites); and data voluntarily provided during the application process such as through a resume or CV, cover letter, or other supporting documentation, including testing information like online coding tests.
Contact Information
Such as email address; emergency contact information; name; physical address; and telephone number.
Demographic Information
Such as gender; health information (including disability); marital status; nationality; place of birth; political, philosophical, or religious beliefs; race or ethnicity; sexual orientation; trade union membership; and veteran status.
Employment Information
Such as employment documents (such as contract, offer letter, and termination letter); hire date; job title and level; work status; and working location.
Financial Information
Such as debts and expenses; financial account details (including bank and retirement accounts); financial reimbursements; grants under equity plans; salary; tax information; and variable compensation (such as overtime, financial reimbursements, and all details related to grants under the equity plans).
National Identifiers
Such as national ID, passport number, social security number, and tax identification numbers.
Travel and Immigration Information
Such as government IDs (including passports), immigration information, nationality information, travel information, and visa details.
Image, Video, and Location Information
Such as biometric data (for example, for onboarding, travel, or immigration purposes); geographic location information; photographs; and video footage (including CCTV and interview recordings), as well as transcripts or summaries generated from such recordings (including via Artificial Intelligence).
Device, Usage, and Content Information
Such as email account login credentials and passwords; content produced using Unity’s systems.

Aggregated, De-Identified, and/ or Anonymized Information:

We may aggregate, de-identify, and/ or anonymize Personal Information, i.e., transform the information so it no longer relates back to a person's identity so that it will no longer be considered Personal Information.

Sensitive Information:

Unless we request it or we offer you to provide it, we ask that you not send us, and you not disclose, any Sensitive Personal Information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, criminal background, or trade union membership) to us.

Purpose of Processing Personal Information

Below, you will find how we use the information we may process as a result of your work with Unity. Please note, the processing specifics may vary based on your interactions with Unity and your geographical location.

Human Resources and Personnel Management

Processing activities
Recruitment and onboarding; HR operations; business applications administration; general HR administration; global diversity and inclusion initiatives.

Personal data

All categories — see Personal Information table
Legal basis (GDPR)
  • Contract performance (employment contract or share option agreement)
  • Legitimate interests: sourcing prospective candidates, workforce management, business management, optimizing workforce engagement and experience, responding to inquiries/providing recruitment support, processing/transfer for group company internal business purposes
  • Consent: such as when you apply to a role at Unity
  • Legal obligation*
Third-party sources

Employment agencies and recruiters; previous employers and professional contacts; background screening providers.

Business Reporting

Processing activities

Analytics and disclosures for auditing and reporting purposes; general business management and operations including the identification of trends; global diversity and inclusion initiatives; improve business operations, efficiencies, and the recruitment experience; measuring sentiment; organizational and individual analytics and data insights; conducting internal audits.

Personal data

All categories — see Personal Information table

Legal basis (GDPR)

  • Contract performance (employment contract or share option agreement)
  • Legitimate interests: analyzing, managing, and optimizing our recruitment process; reporting on company progress to key stakeholders and making decisions on such reporting; analyzing compliance with internal policies
  • Legal obligation*
  • Consent: such as when you opt-in to a voluntary program or experience

Third-party sources

Authorities; providers we engage with for workforce management.

Business Transactions

Processing activities
In connection with a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). You will be notified of any such business transaction and possible changes to the processing of your Personal Information in accordance with applicable law.
Personal data
All categories — see Personal Information table
Legal basis (GDPR)
• Legitimate interests: pursuing a business transaction; corporate restructuring
Third-party sources
Providers we engage with for workforce management.

Emergency & Incident Response

Processing activities
Responding to, handling, and documenting incidents and emergencies; actively monitoring to ensure adequate incident prevention, response, and documentation; sending notifications and alerts in the event of incidents or emergencies.
Personal data
All categories — see Personal Information table
Legal basis (GDPR)
  • Legitimate interests: investigating, monitoring, reacting to, and documenting an emergency and/or incident
  • Consent: such as when you have opted-in to the use of your precise geolocation for real time security alerts
  • Legal obligation*
  • Vital interests (of you or another person)
  • Public interest (task carried out in the public interests)
Third-party sources
Law enforcement; incident reporter; security providers.

Investigation and Security Purposes

Processing activities
Managing company assets; physical security and cybersecurity; device management; ensuring proprietary information is kept secure; conducting internal audits and investigations; legal or business consulting; preparing for or engaging in dispute resolution; building management; fraud and security purposes (e.g., monitoring to detect and prevent cyberattacks or identity theft attempts); prevention of criminal activity or harm to Users; all purposes outlined in our Security and Acceptable Use policies.
Personal data
All categories — see Personal Information table
Legal basis (GDPR)
  • Contract performance (employment contract or share option agreement)
  • Legitimate interests: prevention of security risks; investigating, monitoring, reacting to, and documenting an investigation and security risks; protection of proprietary information; fraud and security purposes; prevention of criminal activity or harm to Users
  • Legal obligation*
  • Vital interests (of you or another person)
  • Public interest (task carried out in the public interests)
Third-party sources
Law enforcement; incident reporter; security providers.

Law Enforcement Requests

Processing activities
Cooperating with public and government authorities, including law enforcement outside of your country of residence; fulfilling legal and compliance obligations, responding to legal processes, meeting national security or law enforcement requirements.
Personal data

All categories — see Personal Information table

Legal basis (GDPR)
  • Legal obligation*
  • Legitimate interests: monitoring, reacting to, and documenting an emergency and/or incident
Third-party sources
Law enforcement.

Legal Purposes

Processing activities
Reporting to our Board of Directors as required by the SEC; audits to verify internal processes function as intended and are compliant with legal, regulatory, and contractual requirements; financial & accounting purposes; complying with laws and regulations; enforcing terms and conditions, protecting operations, rights, privacy, safety, or property; pursuing available legal remedies, defending claims and limiting the damages that we may sustain.
Personal data
All categories — see Personal Information table
Legal basis (GDPR)
  • Legal obligation*
  • Legitimate interests: securing our services, investigating cyber intrusions, fraud, and abuse; reporting on company progress to key stakeholders and making decisions on such reporting; protecting our operations, rights, safety, or property; pursuing all available legal remedies, defending claims, and limiting damages we may sustain
Third-party sources
Law enforcement; regulatory authorities.

Travel and Global Mobility

Processing activities
Travel administration, support, and management; relocation administration, support, and management; immigration administration, support, and management.
Personal data
Background Information; Contact Information; Demographic Information; Financial Information; National Identifiers; Travel and Immigration Information; Image, Video, and Location Information.
Legal basis (GDPR)
  • Contract performance (employment contract or any share option agreement)
  • Legitimate interests: enabling the travel and mobility of our workforce
  • Legal obligation*
  • Consent: such as when you voluntarily decide to travel while utilizing support or services provided by Unity
Third-party sources
Immigration authorities; travel and mobility providers.

*For more information on our legal obligations, please see section ‘Other Disclosures’ below.

*For more information on disclosure of Personal Information in connection with a sale or business transaction, please see ‘Other Disclosures’ below.

Sharing Personal Information

Below, you will find an outline of scenarios in which information may be shared.

Our Affiliates, including ironSource
All purposes described in this Notice
Vendors & Service Providers

We share Personal Information with select vendors and service providers to help us manage the workforce relationship such as:

  • Recruitment and Personnel Management
    • These provide us with the services to hire and manage our workforce
  • Professional Services
    • These provide a variety of services to us such as audit, legal, and financial.
  • Information Technology
    • These assist us with infrastructure provision
  • Artificial Intelligence and Automation Services
    • We may use third-party services that utilize artificial intelligence or other advanced technologies to help us operate our business and support internal functions.
Law Enforcement or other similar parties

For safety, security, and legal compliance, including:

  • When we are required to disclose the information in response to legal process (e.g., if we receive a court order, search warrant, subpoena, or similar legal process);
  • If we believe that the commission of a crime is occurring, including to report such criminal activity or to exchange information with other companies and organizations for the purposes of fraud protection and credit risk reduction;
  • To protect the vital interests of you, another person or the public, for example when there is a meaningful risk that poses a threat to the safety of you, another person or the public generally; and
  • In order to protect the rights or property of Unity, including to enforce terms of the contract, including the employment contract or any share option agreement.
To third parties in the event of a business transaction
Business Transactions
With your consent
We may share your information for other purposes if (i) you direct us to do so or (ii) you consent to such sharing.
Due to your actions

Sharing can happen when you take certain actions. For example:

  • When you share on a social network – depending on your privacy settings at the relevant social network – some users of the relevant social network will be able to see what was shared;
  • When you post comments on our forums, visitors and other forum users will be able to see your username, photo, and comments;

Other Disclosures

Additional information for those located in the European Economic Area

We also disclose your Personal Information as necessary or appropriate, in particular when we have a legal obligation or legitimate interest to do so, as set out in further detail below.

To comply with applicable law and regulations

This may include laws outside your country of residence, which could give rise to a legal obligation requiring us to process your Personal Information, including:

  • Civil and commercial matters:
    • Where we are in receipt of a court order to disclose information for the purposes of court proceedings, such as under Regulation (EU) No 1215/2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters.
    • To comply with Council Regulation (EC) No 1206/2001 of 28 May 2001 on cooperation between the courts of the Member States in the taking of evidence in civil or commercial matters.
  • Criminal matters: to comply with requests and orders from EU and EU Member State law enforcement to provide information in relation to a criminal investigation in compliance with applicable local laws, or to take steps to report information we believe is important to law enforcement where so required or advisable under applicable local laws.
  • Employment matters: to comply with requests from competent authorities under EU or EU Member State and labour protection law, such as under Directive (EU) 2003/88 and its implementing laws in EU Member States and Council Framework Decision 2008/675/JHA .
  • Corporate and taxation matters: to comply with our obligations under applicable EU Member State corporate and tax legislation, such as where a national tax law of an EU Member State requires collection of specific transactional Personal Information for tax purposes.
  • Regulatory matters: to respond to a request or to provide information we believe is necessary or appropriate to comply with our obligations to engage with regulators, such as when relevant EU Member State data protection supervisory authorities initiate investigation under the General Data Protection Regulation into Unity. These can include authorities outside of your country of residence.
  • Compliance and internal investigations: to comply with whistleblowing requirements under Directive (EU) 2019/1937 and its implementing laws in EU Member States.
  • Health and safety regulations: to comply with health and safety reporting obligations in accordance with applicable local laws, such as in relation to accidents involving members of the public on our premises.
For other legal reasons
  • For dispute resolution purposes;
  • To protect our rights, privacy, safety or property, and/or that of our affiliates, you or others

Privacy Rights

Depending on the country or state in which you reside, you may have various privacy rights. For example, you may have the right in certain circumstances and locations to:

  • Request access to your Personal Information.
  • Request that your Personal Information be rectified or erased. \
  • Request that processing of your Personal Information be restricted.
  • Request to receive Personal Information you have provided to Unity in a structured, commonly used, and machine-readable format for onward transmission (e.g. a PDF or other electronic file).
  • Object to the processing of your Personal Information.
  • To appoint a third-party representative to assist you with exercising your rights.
  • To limit the use or disclosure of sensitive Personal Information
  • Not to be discriminated against for exercising your rights.
  • Please note that Unity does not discriminate based on you exercising your rights.

Please note that Unity does not expect that you will be subject to decisions that will have a significant impact on you based solely on automated decision-making. We will notify you in writing if this position changes.

To exercise any of the above rights, please contact us using one of the methods listed below. We will consider and act upon all requests in accordance with applicable laws. Please note that certain Personal Information may be exempt from such access, correction, erasure, restriction, and portability requests in accordance with applicable laws.

In addition, where our processing activities in respect of your Personal Information are subject to the GDPR, you may lodge a complaint with a European Union supervisory authority. If you do have a complaint, we would appreciate the chance to deal with your concerns before approaching your supervisory body, so please contact us at dpo@unity3d.com if you wish to discuss any complaint. You can find your supervisory authority here.

Transfers Out of Country of Collection

Unity has implemented and maintains a framework consistent with applicable law for transfers of data outside of the country of collection, including for transfers out of the UK and/orEuropean Economic Area (“EEA”).

Your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers such as Workday, LinkedIn, and authorized background screening vendors.. You understand that your Personal Information will be transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.

Retention

We retain Personal Information for as long as is necessary or as permitted in light of the purpose(s) for which it was obtained and consistent with applicable law, for example, for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. The criteria to determine our retention periods include:

  1. The length of time we have an ongoing relationship with you;
  2. Whether there is a legal obligation to which we are subject .
    1. For example certain laws require us to keep personnel records for a successful period of time before we can delete them. For most countries, this is 10 years post-termination, with 6 years for the U.K., and 75 years for Lithuania.
  3. Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Where a legal obligation arises or retention is advisable in light of our legal position, in some circumstances, we will retain certain Personal Information, even after your account has been deleted and/or we no longer provide the Services to you; for example:

  • To cooperate with law enforcement or public, regulatory and government authorities: If we receive a preservation order or search warrant, related to your Personal Information, we will preserve Personal Information subject to such order or warrant after the retention period has otherwise passed.
  • To comply with legal provisions on tax and accounting: We may retain your Personal Information after you delete your Personal Information, as required by tax law and to comply with bookkeeping requirements. Please note the length of time may vary by country.
  • For fraud and security purposes: We may retain your Personal Information for fraud/ security purposes to investigate incidents.
  • To pursue or defend a legal action: We may retain relevant Personal Information in the event of a legal claim or complaint, including regulatory investigations or legal proceedings about a claim related to your Personal Information, or if we reasonably believe there is a prospect of litigation (whether in respect of our relationship with you or otherwise) after the dispute has been settled or decided by a court or tribunal from which there is no further right of appeal. The criteria for determining the length of time we will retain this information include:
    • Whether there is a legal obligation to which we are subject (for example, if the settlement or decision requires us to keep the records for a certain period of time before we can delete them); or
    • Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

If you have further questions about retention, please reach out to dpo@unity3d.com.

Security

We employ a variety of measures to safeguard the collection, transmission, and storage of the information we collect. These measures vary based on the sensitivity of the information that we collect, process, and store, and the current state of technology. Please note that no system can be guaranteed to be 100% secure. Therefore, while we strive to employ reasonable protections for your information that are appropriate to its sensitivity, we cannot guarantee or warrant the security of the information you share with us and we cannot be responsible for the theft, destruction, loss or inadvertent disclosure of your information. Where we have given you (or where you have chosen) a password which enables you to access certain systems, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. We have put in place procedures to deal with any suspected Personal Information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact Us” section below

How to Contact Us

Unity Technologies S.F., located at 116 New Montgomery Street, Suite 200, San Francisco, CA 94105 (United States contact), is the organization responsible for collection, use, and disclosure of your Personal Information under this Notice.

If you have any questions about this Notice, please contact us at DPO@unity3d.com.

Because email communications are not always secure, please do not include credit card or other sensitive information in your emails to us.

You can contact us as follows:

  1. DPO@unity3d.com
  2. Unity Technologies, 116 New Montgomery Street, Suite 200, San Francisco, CA 94105 (United States contact)
  3. Unity Technologies ApS, Niels Hemmingsens Gade 24, 1153 Copenhagen, Denmark (European Union contact)
  4. Unity Technologies, GINZA SIX 8F, 6-10-1 Ginza, Chuo-ku, Tokyo Japan 104-0061 (Japan Contact)

Status of this Notice

This Notice does not form or replace any part of your contract of employment with Unity. Unity may issue further guidance or amendments to this Notice from time to time and/or in line with legal developments.

The “LAST UPDATED” legend at the top of this Privacy Notice indicates when this Privacy Notice was last revised. Any changes will become effective when we post the revised Privacy Notice.

We reserve the right to change our practices and this Notice at any time. We may also provide notice when this Notice changes. We encourage you to check this page regularly so that you know what our current practices are.

Supplemental Regional Information

The below information supplements the above Global Recruitment Privacy Notice and provides additional information about processing Personal Information as required by the regionally applicable law.

China

The above Notice and this supplemental information contains the procedures for collecting and processing Personal Information in accordance with the provisions of China's Personal Information Protection Law (PIPL).

Personal Information We Process

In addition to the types of Personal Information described under the “Personal Information that We Process” section in the Notice above, we may also process the following Personal Information:

  • Household registration information, and if applicable, social relations of family members;
  • Current or former employment status;
  • Social benefits information, including information needed for social insurance and housing provident fund contributions;
  • Business travel information, including payment information of Unity’s corporate credit card, and other information related to business trips and reimbursement, etc.

Under applicable law, the following non-exhaustive types of Personal Information that we collect from you, as necessary, may be considered sensitive Personal Information under applicable law :

  • Demographic and biometric data, including your health information; and
  • Financial information.

Why We Process Personal Information

We process your Personal Information under a lawful basis of processing as provided by applicable law . Additionally, we process your Personal Information for the purposes described under the “Purpose of Process Personal Information” section in the Notice above and for HR and workplace management, including investigations and disciplinary actions.

We process and use sensitive Personal Information for the following purposes:

  • The processing is necessary for us to conclude or perform any contract (including labour contract) with you;
  • The processing is necessary for us to implement human resources management in accordance with labour management rules and regulations;
  • The processing is necessary for us to comply with legal obligations;
  • The processing is necessary to respond to a public health emergency, or for protecting the life, health or property safety of the natural persons in case of an emergency;
  • Your Personal Information is already legally disclosed by yourselves or otherwise to the public; or
  • We have obtained your consent to the processing.

In addition, as required by the applicable law , we may need to obtain your separate consent (as applicable) to the processing of your sensitive Personal Information, the sharing of your Personal Information with separate controllers, the transfer of your Personal Information overseas, the public disclosure of your personal information and the processing of your Personal Information via devices installed in public areas for purposes other than public security. 

Where our lawful basis for the processing is consent or where your separate consent is required for the processing, you have the discretion of not giving the consent or separate consent or withdrawing it. In that case, we will not be able to carry out the relevant processing activities, which may prevent you from participating in certain human resources management activities or enjoying certain benefits.

We will adopt strict security measures when processing sensitive Personal Information.

Rights

You may have the following rights to your Personal Information:

  • Right to request access to or obtain a copy of your Personal Information;
  • Right to correct or rectify inaccurate Personal Information;
  • Right to request details of our processing of your Personal Information;
  • Right to request us to restrict certain processing of your Personal Information;
  • Right to request us to provide your Personal Information to other controllers;
  • Right to withdraw your consent to our processing of your Personal Information; and
  • Right to request us to delete your Personal Information.

Please note that the exercise of the rights mentioned above may be subject to certain legal conditions and may only be available under certain circumstances. If you would like to exercise any of these rights or ask any questions in this regard, please contact via legal_china@unity3d.com or DPO@unity3d.com.

Sharing of Your Personal Information with Third Parties

Some of the third parties do not have any independent purposes or means of processing your Personal Information and only do so on our behalf as outlined in the Notice above.

Other third parties have their independent purposes and means of processing your Personal Information. They are responsible for their own processing activities. As required by the data protection law, below you will find information about these third parties in the Notice above.

Cross-Border Transfer of Personal Information

Unity operates globally. In order to perform general business management and operations, carry out HR management, fulfill legal obligations, and for other lawful purposes, Unity may transfer Personal Information collected from you in China to our affiliated entities outside of China, for example, the U.S. where Unity is headquartered. When your Personal Information is transferred outside of China, we will ensure that the transfer complies with applicable law and will implement appropriate and necessary measures to provide an equivalent level of data protection in accordance with applicable law. We may transfer under one of the below legal bases.

  • Where necessary for enteresting into and performing a contract to which you are a party;
  • Where necessary for implementing cross-border HR management;
  • To protect the vital interests of persons in emergencies;
  • Where we are transferring Personal Information belonging to less than 100,000 individuals (excluding sensitive Personal Information); or
  • With your consent.

If you have any questions about cross-border transfers, please contact via legal_china@unity3d.com or DPO@unity3d.com.

Colombia

The above Notice and this supplemental information contains the procedures for collecting and processing Personal Information in accordance with the provisions of Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014, as well as the other complementary regulations and the different decisions issued by the Superintendence of Industry and Commerce on the topic. This document is in compliance with articles 15 and 20 of the Colombian National Constitution, Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014. This regulation applies to the policies hereby described, along with the regulations that complement or replace them.

Legal Bases for Processing (Authorization)

The collection, storage, use, circulation and suppression of Personal Information by Unity requires your free, prior, express and informed consent.

Unity, as the Data Controller, has provided in the Employment Agreement, the authorization for processing its applicants Personal Information.

The authorization procedure guarantees that you have been informed about: (i) the processing of your Personal Information, (ii) the purposes we pursue and (iii) the right you have to access, update, rectify and delete your Personal Information at any time, throughout the mechanisms determined by Unity. The above mentioned ensures that you can take informed decisions about the data being processed and controls the use of your personal information.

Rights

According to the provisions of article 8 of Law 1581 of 2012 and articles 21 and 22 of Decree 1377 of 2013, you may have the following rights:

  • To know, update and rectify your Personal Information;
  • Request evidence of the authorization granted to Unity;
  • To be informed by Unity, upon request, about the use that has been given to your Personal Information
  • Present complaints before the Superintendence of Industry and Commerce, for infringements to the provisions of Law 1581 of 2012 or any other regulation that modifies, adds or complements it, after a previous consultation process or complaint has been exhausted before Unity;
  • To revoke the authorization and/or to request the suppression of your data when the principles, rights, constitutional or legal guarantees are not complied with by the Unity; and
  • Access to your Personal Information.

Please note that the exercise of the rights mentioned above may be subject to certain legal conditions and may only be available under certain circumstances. If you would like to exercise any of these rights or ask any questions in this regard, please contact via DPO@unity3d.com.

In addition, you have the right to lodge a complaint with a supervisory authority about how we process your personal information. However, we would encourage you to first contact us via DPO@unity3d.com for solutions before you lodge any complaint.

European Union, United Kingdom, and Switzerland

The above Notice and this supplemental information contains the procedures for collecting and processing Personal Information in accordance with the provisions of EU and UK General Data Protection Regulations (collectively, the “GDPR”) and local laws implementing or supplementing the GDPR and the Swiss Federal Act on Data Protection.

Rights

The GDPR and the Swiss Federal Act on Data Protection provide certain rights (should they apply to you) in relation to the way in which Unity processes your Personal Information as a data controller. You have the following rights:

Right
Right to Access
Description
You have the right to request Unity provide you with a copy of your Personal Information.
Right to Rectification (Correction)
Description
You have the right to request Unity to correct any information about you that you believe is incorrect. You also have the right to request Unity to complete information about you that you believe is incorrect.
Right to Erasure (Deletion)
Description
You have the right to request Unity to erase your Personal Information, under certain conditions.
Right to Restrict Processing
Description
You have the right to request Unity to restrict the processing of your Personal Information, under certain conditions.
Right to Object to Processing
Description
You have the right to object to Unity’s processing of your Personal Information, under certain conditions.
Right to Data Portability
Description
You have the right to request Unity to transfer your Personal Information that we have collected to another organization, or directly to you, under certain conditions.
Right to Lodge a Complaint
Description
You may lodge a complaint with an EEA data protection authority for your country or region where you have your habitual residence or place of work or where an alleged infringement of applicable data protection law occurs. A list of data protection authorities is available at https://ec.europa.eu/newsroom/article29/items/612080. In the UK, you may lodge a complaint with the Information Commissioner’s Office (“ICO”).

If you do have a complaint, we would appreciate the chance to deal with your concerns before approaching your supervisory body, so please contact us at dpo@unity3d.com if you wish to discuss any complaint.

Transfers Out of Country of Collection

Where this will involve transferring your Personal Information outside the UK and/or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

Adequacy Decisions: Some non-EEA countries are recognized under the UK GDPR and by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). For example, we may transfer to our affiliates who are located around the world, including Canada, Japan, New Zealand, Republic of Korea, Switzerland, and the United Kingdom.

Standard Contractual Clauses: For transfers of Personal Information from the UK and/or EEA to third countries, which are not considered adequate under the UK GDPR and/or by the European Commission, we have put in place standard contractual clauses adopted under the UK GDPR and/or by the European Commission to protect your Personal Information. For example, we use Google Workspace and its data centers are located around the world, including the United States. We rely on both controller-controller and controller-processor Standard Contractual Clauses. You may obtain a copy of these measures by contacting us in accordance with the “Contacting Us” section below. “UK GDPR” has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.

Processing of Special Category (Sensitive) Personal Information

Where we process special category Personal Information, our additional legal basis under Article 9 GDPR is one or more of the following:

  • Explicit consent;
  • Carrying out obligations and exercising rights in the field of employment, social security and social protection law;
  • Protecting the vital interests of the data subject or another person where the data subject is incapable of giving consent;
  • Personal Information that has been manifestly made public by the data subject;
  • Establishment, exercise or defence of legal claims; reasons of substantial public interest; or
  • Preventive or occupational medicine, assessment of working capacity, medical diagnosis, or the provision of health or social care.

For Travel and Global Mobility purposes only, the applicable bases are: explicit consent; establishment, exercise or defence of legal claims; and preventive or occupational medicine

Japan

The above Notice and this supplemental information contains the procedures for collecting and processing Personal Information in accordance with the provisions of Act on the Protection of the Personal Information of Japan (APPI).

Rights

The Act on the Protection of the Personal Information of Japan provides certain rights with respect to your Personal Information, such as:

  • The right to request a notification of the purposes of use of your Personal Information
  • The right to request the disclosure, correction, addition, or deletion of your Personal Information
  • The right to request the discontinuation of use or provision to any third-party
  • The right to request the disclosure of the record of provision of your Personal Information
  • If you are a resident of Japan and wish to exercise any of the above rights, please email us at DPO@unity3d.com (or contact us at the address indicated in the “Contact Us” section listed below)
  • Unity Technologies, GINZA SIX 8F, 6-10-1 Ginza, Chuo-ku, Tokyo Japan 104-0061

Please note that the exercise of the rights mentioned above may be subject to certain legal conditions and may only be available under certain circumstances. If you would like to exercise any of these rights or ask any questions in this regard, please contact via DPO@unity3d.com.

Transfers Out of Country of Collection

For transfers from Japan to countries other than the EEA/UK, we have put adequate measures in place to protect your Personal Information.

The transferees are obligated to comply with equivalent or comparable rules to those under the Act on the Protection of Personal Information of Japan (APPI) on a continuous basis, and we periodically confirm their compliance. We also periodically confirm any changes to the data privacy regulations of other countries that may affect the compliance measures taken by our overseas affiliates and third-party service providers and take measures such as requesting that they take corrective measures or suspending the provision of Personal Information if any issues arise in the implementation of such compliance measures. We will provide you with further information on the measures we take in this regard upon your request.

Korea

The above Notice and this supplemental information contains the procedures for collecting and processing Personal Information in accordance with the provisions of the Personal Information Protection Act (PIPA).

Personal Information mentioned above will not be processed, if such processing is prohibited under applicable laws and regulations.

Purpose of Processing Personal Information

The purposes for which Personal Information is processed are described in the main body of this Notice. For individuals in Korea, the corresponding legal bases under the PIPA for such processing are as follows:

  • Contract performance corresponds to PIPA Article 15(1)(4).
  • Legitimate interests corresponds to PIPA Article 15(1)(6).
  • Legal obligation corresponds to PIPA Article 15(1)(2) and, where applicable, the relevant statutory provision imposing such obligation.
  • Consent corresponds to PIPA Article 15(1)(1).
  • Vital interests corresponds to PIPA Article 15(1)(5).
  • Public interest corresponds to PIPA Article 15(1)(7)

Where Personal Information is processed based on consent, such processing will be conducted in accordance with the applicable consent requirements under the PIPA.

Rights of Legal Representative and Method of Exercising the Rights

A legal representative may request at any time to view, correct/delete, suspend the processing of, and withdraw consent to your Personal Information on your behalf. The legal representative should prepare a Power of Attorney signed by you and contact us at the contact information provided above.

Please note that the exercise of the rights mentioned above may be subject to certain legal conditions and may only be available under certain circumstances. If you would like to exercise any of these rights or ask any questions in this regard, please contact via DPO@unity3d.com.

For inquiries regarding the processing of Personal Information in Korea, please contact the Chief Privacy Officer below:

  • Name and Department/Title: Boyoung Kim, Marketing Team Manager
  • Email: marketing_kr@unity3d.com

Period of Retention and Use of Personal Information; Destruction of Personal Information

In principle, we immediately destroy relevant Personal Information after the purpose of collection and use are achieved. However, if applicable laws and regulations require us to retain the data, we will store it for a certain period as prescribed in the applicable laws and regulations. In this case, we will transfer the relevant data to a separate database or store in another storage place.

Type of Record
Records on contract or subscription withdrawal
Retention Period
5 years
Legal Basis
Act on the Consumer Protection in Electronic Commerce, Etc.
Records on price settlement and supply of goods
Retention Period
5 years
Legal Basis
Act on the Consumer Protection in Electronic Commerce, Etc.
Records on consumer complaints or dispute settlement
Retention Period
3 years
Legal Basis
Act on the Consumer Protection in Electronic Commerce, Etc.
Records on collection/processing and use of credit information
Retention Period
3 years
Legal Basis
Use and Protection of Credit Information Act
Records on labelling/advertising
Retention Period
6 months
Legal Basis
Act on the Consumer Protection in Electronic Commerce, Etc.
Your internet log records / your location of access tracking data
Retention Period
3 months
Legal Basis
Protection of Communications Secrets Act
Other data verifying that communication took place
Retention Period
12 months
Legal Basis
Protection of Communications Secrets Act
Application Documents & Applicant Info
Retention Period
180 days or until the company's return deadline
Legal Basis
Fair Recruitment Procedure Act

Destruction Process and Destruction Method of Personal Information

In principle, we immediately destroy your Personal Information after the purpose of collection and use are achieved. The process and method of destruction are as follows:

Item
Destruction process
Description
Once the purpose is achieved, your Personal Information is moved to a separate database (or a document box in the case of papers) and is destroyed after storage for a certain period under our internal data protection policy and other applicable laws and regulations (refer to the period of retention and use of Personal Information). The Personal Information moved to a separate database will not be used for a purpose other than the purpose of retention, unless otherwise provided by laws and regulations.
Destruction method
Description
We delete electronically stored Personal Information by using the technical means that make it impossible to restore the data. For paper-based Personal Information, we shred them via paper shredder or incinerate them.

Security Measures for Protection of Personal Information

Type of Measure
Administrative measures
Description
Establishment and implementation of internal management plan, and regular education and training of personnel regarding the protection of Personal Information
Technical measures
Description
Management of right to access to Personal Information processing system, installation of access control system, encryption and installation of security programs, etc.
Physical measures
Description
Access control to the computer room or server room where Personal Information is stored.

Matters Concerning Cross-border Transfer of Personal Information Cross-border Provision

Unity may transfer Personal Information to overseas Unity group companies as follows, based on the data subjects’ consent under PIPA Article 17(1) and 28-8(1)(1). Data subjects may refuse to consent to such transfer; however, if consent is refused, Unity may be unable to proceed with the relevant recruitment, onboarding, employment administration, or other applicable processes.

Name and Contact of Recipient
Unity Technologies S.F., Unity Technologies Canada Company, Unity Software Limited, ironSource Ltd., ironSource Mobile Ltd., Unity Technologies ApS, Unity Technologies Finland Oy, Uzork Software Innovations Private Limited, Unity Technologies LT, UAB, Unity Technologies Japan, K.K., Unity Technologies Korea Limited, Supersonic Studios Ltd., Unity Technologies SARL, Unity Technologies GmbH, Unity Technologies Singapore Pte. Ltd, Unity Software (Shanghai) Co., Ltd. Beijing Branch, c Codice Software S.L., Artomatix Limited, Unity Technologies Sweden AB, Unity Technologies ABD FZ LLC, Graphine NV, ironSource India Private Limited, Unity Technologies ABD FZ LLC, IronSource, ironSource Neon Ltd., Tapjoy Inc. (Contact: DPO@unity3d.com, or Legal_China@unity3d.com for Chinese entities)
Country of Transfer Destination

United States and Belgium

Canada

China

Denmark

Finland

France

Germany

India

Ireland

Israel

Japan

Lithuania

Singapore

Spain

Sweden

United Arab Emirates

United Kingdom

Date and Method of Transfer
Transferred through HR/recruitment systems or internal networks when necessary for recruitment
Personal Information Items to be Transferred
Personal Information described in the “Information We Process” section of this Notice
Purpose of Use and Period of Retention and Use of Recipient
For global recruitment management, onboarding, workforce administration, reporting, compliance, audit, legal, security, business management, and other purposes described in this Notice; retained until the purpose of transfer is achieved or as required by applicable law

Cross-border Entrustment The cross-border entrustment arrangements set out below are pursuant to PIPA Article 28-8(1)(3), as the relevant transfers are necessary for the entrustment or storage of Personal Information in connection with entering into or performing a contract with the data subject.

Name and Contact of Outsourcee

Workday, Inc. (privacy@workday.com)

Country of Transfer Destination
US
Date and Method of Transfer
Automatically stored by connected system
Personal Information Items to be Transferred
Name, email, address, phone number, birth date, passport number
Purpose of Use and Period of Retention and Use of Transferee
Managing employee DB necessary for HR services during the retention period of Personal Information

Atlassian Corporation
(eudatarep@atlassian.com)

Country of Transfer Destination
US
Date and Method of Transfer
Automatically stored by connected system
Personal Information Items to be Transferred
Name, email
Purpose of Use and Period of Retention and Use of Transferee
Ticketing employees’ requests for HR functions during the retention biometric period of Personal Information

DocuSign, Inc. (privacy@docusign.com)

Country of Transfer Destination
US
Date and Method of Transfer
Automatically stored by connected system
Personal Information Items to be Transferred
Name, email, address
Purpose of Use and Period of Retention and Use of Transferee
Signing of employment contracts during the retention period of Personal Information
Google LLC (Google Workspace) data-access-requests@google.com;
Country of Transfer Destination
US
Date and Method of Transfer
Automatically stored by connected system
Personal Information Items to be Transferred
Candidate name (and email) on interview calendar invites
Purpose of Use and Period of Retention and Use of Transferee
Scheduling interviews during the retention period
Zoom Communications, Inc. (Zoom) — privacy@zoom.us
Country of Transfer Destination
US
Date and Method of Transfer
Automatically stored by connected system
Personal Information Items to be Transferred
Name, email, meeting metadata
Purpose of Use and Period of Retention and Use of Transferee
Conducting interviews during the retention period

United States of America, including California

United States of America

The following Section contains legal information which is only applicable under U.S. Law.

Your use of certain services may result in the collection of biometric information, for example when required due to travel or other global mobility. Biometric information is any information based on an individual's biometric identifier used to identify an individual.

To the extent Unity processes this information, we shall use commercially reasonable organizational, technical, and administrative methods designed to protect biometric information within our organization.

To the extent Unity processes this information, we will retain biometric information for as long as needed or permitted in light of the purposes stated in this Notice, unless a longer retention period is permitted or required by applicable law. For more information on the criteria used to determine our retention periods, please see the "Retention" section in this Notice.

We will destroy or dispose of your biometric information as required by applicable law. For example, we may destroy electronic records of biometric information through such processes as overwriting magnetic media, degaussing, or physical destruction, and we may dispose of paper records by such processes as shredding or incineration.

California

The above Notice and this supplemental information contains the procedures for collecting and processing Personal Information in accordance with the provisions of California's Consumer Privacy Act (CCPA).

If you are a California resident, you may make the following requests:

Request / Right
Request for disclosure
Description

You may request that we disclose to you the following information covering the 12 months preceding your request:

  • The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information;
  • The business or commercial purpose for collecting or sharing Personal Information about you;
  • The categories of Personal Information about you that we shared (as defined under the applicable privacy law) and the categories of third parties to whom we shared such Personal Information; and
  • The categories of Personal Information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such Personal Information (if applicable).
Request to correct
Description
You may request to correct inaccuracies in your Personal Information.
Request to delete
Description
You may request to have your Personal Information deleted.
Request for specific pieces / portable format
Description
You may request to receive specific pieces of Personal Information, including, where applicable, to obtain a copy of the Personal Information you provided to us in a portable format.

If we decline to take action on your request, you may appeal our decision within a reasonable period after you have received notice of the refusal. You may file an appeal by contacting us at DPO@unity3d.com or at Unity Technologies, 116 New Montgomery, Suite 200, San Francisco, CA 94105, United States.

Please note that the exercise of the rights mentioned above may be subject to certain legal conditions and may only be available under certain circumstances. If you would like to exercise any of these rights or ask any questions in this regard, please contact via DPO@unity3d.com.

We will not unlawfully discriminate against you for exercising your rights under applicable privacy law. To make a privacy request, please contact us at DPO@unity3d.com or Unity Technologies, 116 New Montgomery Street, Suite 200, San Francisco, CA 94105. We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request. We may need to request additional Personal Information from you, such as email address/ username/ country associated with the account where applicable, in order to verify your identity and protect against fraudulent requests. If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information.

Sale of Personal Information

We do not sell or “share” the Personal Information of our Workforce, and we have not engaged in such activities in the preceding 12 months.

Without limiting the foregoing, Unity does not provide your Personal Information in direct exchange for money. Therefore, in the literal sense, Unity does not sell your data. However, the California Consumer Privacy Act (“CCPA”) requires Unity to disclose if it sells Personal Information of California residents and under the CCPA’s expansive definition of “sell”. If this occurs, we will update you accordingly as required.

Authorized Agents

If an agent would like to make a request on your behalf as permitted under applicable law, the agent may use the submission methods noted in the section entitled “Individual Requests.” As part of our verification process, we may request that the agent provide, as applicable, proof concerning his or her status as an authorized agent. In addition, we may require that you verify your identity as described in the section entitled “Individual Requests” or confirm that you provided the agent permission to submit the request.

  • For third-party representatives writing in on behalf of Unity account holders, please provide the name and any signed documentation you may have to act on behalf of the workforce member, or you may ask the workforce member to write to us from their account email to provide us permission to transact with you directly. Unity reserves the right to take reasonable steps to verify the authenticity of identities and authorizations in compliance with applicable laws prior to making any disclosures.

De-Identified Information

Where we maintain or use de-identified information, we will continue to maintain and use the de-identified information only in a de-identified fashion and will not attempt to re-identify the information.

Alternative Translations

1“Unity Technologies” is inclusive of: Unity Technologies SF, Unity Technologies Canada Company, Unity Software Limited, ironSource Ltd., ironSource Mobile Ltd., Unity Technologies ApS, Unity Technologies Finland Oy, Uzork Software Innovations Private Limited, Unity Technologies LT, UAB, Unity Technologies Japan, K.K., Unity Technologies Korea Limited, Supersonic Studios Ltd., Unity Technologies SARL, Unity Technologies GmbH, Unity Technologies Singapore Pte. Ltd, Unity Software (Shanghai) Co., Ltd. Beijing Branch, Unity Software (Shanghai) Co., Ltd, Codice Software S.L., Artomatix Limited, Unity Technologies Sweden AB, Unity Technologies ABD FZ LLC, Graphine NV, ironSource India Private Limited, Unity Technologies ABD FZ LLC, ironSource Neon Ltd., Tapjoy Inc