U.S. Biometric Information Privacy Notice and Release

Pegasystems, including Pegasystems Inc. and its affiliates ("Pega”, “we”, “our”, or “us”), is committed to ensuring the security of your personal information, including your biometric information. We are providing this notice and release (“Notice”) to all job applicants and Pega employees in the United States whose biometric information may be collected during the application or onboarding process, or during your employment with Pega. This Notice addresses Pega’s collection, use, storage, and disclosure of your biometric information to the extent that such activities are covered by state or federal biometric privacy law(s), including but not limited to the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS Section 14/1 et seq., the Colorado Privacy Act (“CPA”), C.R.S. § 6-1-1314, and the Texas Capture Or Use Of Biometric Identifier Act (“CUBI”), Tex. Bus. & Com. Code Ann. § 503.001.

1. What Is Biometric Information?

Biometric Information is information about your physical characteristics that can be used to identify you. These physical characteristics are also called biometric identifiers, and can include retina and iris scans, fingerprints, voiceprints, scans of hand or face geometry, and related biometric data derived from these identifiers.

2. What Biometric Information We Collect and Why

As part of our hiring and onboarding process, and during the course of your employment with Pega, we may collect your biometric information, including your facial geometry. We collect this information and share it with our vendors solely for the following purposes: 

• Identity verification during the hiring and pre-employment screening process
• Prevention of unauthorized system and/or facility access 
• Protection of confidential information, including trade secrets
• Compliance with contractual obligations
• Security requirements for facility visits

Biometric information may be collected, stored and processed by our vendors, Incode Technologies, Inc. (“Incode”) and First Advantage Corporation ("First Advantage"). 

• Incode’s privacy policy is available here: link to policy. 
• Incode's biometric privacy policy is available here: link to policy. 
• First Advantage's privacy policy is available here: link to policy. 
• First Advantage's biometric privacy policy is available here: link to policy.

Incode and First Advantage process biometric information solely to verify the identity of applicants and employees for the purposes stated above. This Notice applies to the actions Incode and First Advantage take on Pega’s behalf in their respective capacities as Pega’s independent contractors responsible for the collection, storage and use of your biometric information. 

3. Data Retention

Your biometric information may be collected, stored, and used only for as long as necessary to fulfill the stated purpose(s) above, or for no more than three (3) years from the date of your last interaction with Pega, whichever occurs first. If a shorter retention period is required by applicable law or our internal retention policy, your biometric information will be deleted according to the applicable law or policy. 

We maintain a written data retention and destruction policy, which is made available to current employees through the Pega Portal here: link to Pega Data Retention Policies. In accordance with our policies, we retain biometric information and we direct our vendors to retain biometric information as follows:

• Applicants: If you are a U.S. applicant who does not become an employee of Pega, your biometric information will be destroyed within three (3) years after the purpose for collection has been fulfilled (e.g., your application is closed, withdrawn, or you are not hired), or within a shorter period if required by applicable law. In most cases, your biometric information will be destroyed immediately after it has been used to verify your identity, though your face template may be retained while your employment application is pending. 
• Employees: If you are a U.S. Pega employee, biometric information collected from you, other than your face template, is destroyed immediately after your identity has been verified. Your face template will be stored for the duration of your employment with Pega. Your face template and any other retained biometric information (if any) will be destroyed within three (3) years after your employment with Pega ends for any reason, or within a shorter period if required by applicable law. 
• Destruction of biometric information will be performed using industry-standard methods that render the data permanently unrecoverable.

4. Disclosure to Third Parties

Pega and its vendors do not sell, lease, trade, or otherwise profit from your biometric information. Your biometric information will not be disclosed to third parties except in the following limited circumstances:

• With your prior written consent;
• To a vendor or service provider that we have engaged to assist with hiring or identity verification of applicants and current employees (e.g., Incode, First Advantage, or other vendors such as background check firms, applicant tracking system providers, or identity verification platforms), provided that such disclosure is made pursuant to a data processing agreement;
• To complete financial transaction that you have requested or authorized; or
• Where required or permitted by applicable state or federal law, including pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

5. Data Security

We will store, transmit, and process biometric information using a reasonable standard of care at least as protective as the standards we apply to other categories of sensitive personal information, including appropriate technical and organizational safeguards to prevent unauthorized access, disclosure, or loss. Vendors who have access to your biometric information are subject to equivalent data security and retention requirements.

6. Voluntary Participation and Consequences of Refusal

We may require candidates in the United States to provide biometric information during the pre-employment process for the purposes described above and as a condition of your eligibility for employment. U.S. applicants who decline to provide the required biometric information may be ineligible to continue in the hiring process.

Pega employees in the United States may be required to provide biometric information on an ongoing basis for the purposes described above and as a condition of your ongoing employment. If you refuse to provide biometric information during your employment with Pega, you may be denied access to Pega’s facilities and systems, and your employment may be terminated at Pega's discretion, subject to applicable law.

7. Your Rights

Certain state laws, such as BIPA (Illinois), CPA (Colorado), and CUBI (Texas), may provide you with rights over your biometric information, including the right to:

• Receive this written Notice before your biometric information is collected;
• Review and correct information that is collected from or about you;
• Not have your biometric information collected until you provide a release authorizing the collection, storage, and use of your biometric data;
• Have your biometric information protected with a reasonable standard of care; and
• Have your biometric information destroyed in accordance with Pega’s data retention schedule and within the timelines provided by applicable law.

8. Questions and Contact Information

If you have questions about this Notice or our biometric data policies and practices, please contact: [email protected]

Release and Authorization to Collect Biometric Information

By submitting an application to Pega, you acknowledge and agree that:

1. You have received and read this Biometric Information Privacy Notice;
2. You understand the specific purpose(s) for which your biometric information will be collected and processed;
3. You understand the kinds of biometric information being collected and the length of time your biometric information will be stored and used;
4. You expressly and voluntarily authorize Pegasystems Inc. and our vendors to collect, store, and use your biometric information as described in this Notice;
5. You understand that this release and authorization may be revoked by contacting [email protected], subject to any legal or operational limitations.