1.Purpose and Scope
BambooHR LLC ("BambooHR") has adopted this Biometric Data Policy to comply with the Illinois Biometric Information Privacy Act (BIPA) and similar biometric privacy laws in other jurisdictions. This Policy applies to the collection, use, safeguarding, storage, retention, and destruction of biometric identifiers and biometric information (collectively, "Biometric Data") in connection with BambooHR's products and services.
This Policy applies to BambooHR's time-tracking features that may use fingerprint or facial geometry scanning to enable employee clock-in and clock-out functions, and to any other features BambooHR may introduce that involve Biometric Data. This Policy does not apply to customer-configured integrations with third-party biometric hardware or software providers.
2.Biometric Data Collection
BambooHR only collects Biometric Data with the explicit, written consent of the individual whose Biometric Data is being collected. Before collecting any Biometric Data, BambooHR or its customer (as the employer) will: (a) inform the individual in writing that Biometric Data is being collected or stored; (b) explain the specific purpose and length of time for which the Biometric Data is being collected, stored, and used; and (c) receive a written release executed by the individual.
BambooHR does not collect Biometric Data without the individual's knowledge. BambooHR does not require an individual to provide Biometric Data as a condition of providing services unrelated to the purpose for which the Biometric Data is collected.
3.Retention and Destruction Schedule
BambooHR will retain Biometric Data only for the period necessary to fulfil the purpose for which it was collected, or as required by law. In no case shall BambooHR retain Biometric Data longer than three (3) years from the date of the individual's last interaction with BambooHR, or the date the employment relationship with the customer ends, whichever is earlier, unless applicable law requires a longer retention period.
When the purpose for which Biometric Data was collected has been fulfilled, or upon expiration of the retention period, BambooHR will permanently destroy the Biometric Data using methods that render the data unrecoverable and in accordance with applicable law. BambooHR will maintain records of destruction as required by applicable law.
4.Protection and Storage
BambooHR uses the same or greater level of care to store, transmit, and protect Biometric Data as it uses to store, transmit, and protect other confidential and sensitive information. Biometric Data is encrypted in transit and at rest using industry-standard encryption. Access to Biometric Data is restricted to authorised personnel who need access to perform their job duties.
BambooHR does not store Biometric Data on-premises. All Biometric Data is processed and stored in BambooHR's secure cloud infrastructure and is subject to BambooHR's standard security controls described in the Security Exhibit.
5.Third-Party Disclosure
BambooHR will not sell, lease, trade, or otherwise profit from individuals' Biometric Data. BambooHR will not disclose or disseminate Biometric Data to any other party without first obtaining written consent from the individual or from the customer on behalf of the individual, except in the following limited circumstances: (a) when required by law; (b) when disclosure is required to complete a financial transaction requested by the individual; or (c) when ordered by a court of competent jurisdiction.
BambooHR may disclose Biometric Data to service providers who assist in operating BambooHR's platform, provided those service providers are bound by contractual obligations to protect the Biometric Data and use it only for the purposes for which it was disclosed.
6.Individual Rights
Individuals whose Biometric Data BambooHR has collected have the right to: (a) receive a copy of this Policy upon request; (b) request access to their Biometric Data; (c) request deletion of their Biometric Data, subject to applicable retention requirements; and (d) file a complaint if they believe their Biometric Data has been collected, used, or disclosed in violation of applicable law.
Requests relating to Biometric Data should be submitted to BambooHR via our contact page. BambooHR will respond to such requests within a reasonable time and in accordance with applicable law.
