Home
Trust
Candidate Privacy Notice

Candidate Privacy Notice

At Canva, we’re on a mission to create the world’s best team. We respect your privacy and security, and want to ensure we’re living by our values of Making Complex Things Simple as well as Being a Good Human. This notice explains how we collect, use, store and otherwise process your Data, as well as your privacy rights throughout our recruitment process. In this notice, when we talk about “Data,” we mean information about you, or that could identify you, that we may collect during recruitment or talent acquisition activities.

1. Data we collect

We collect Data about you in relation to your career opportunities with us. We may collect it from you, or from third parties (such as referrals, recruiters, background check providers, or public sources like LinkedIn). The Data we collect includes:

Identifiers and contact details: your name, phone number, residential address, email address and other contact information;
Professional information: such as your resume, cover letter, employment details, position, performance, work history, notice periods and similar information
Educational background information: such as academic qualifications and details, professional admissions and similar information;
Compensation and benefits information: such as information associated with your salary/compensation, benefits, vacation and time/off entitlements and similar information
Work status information: such as your citizenship and right to work information
Publicly available information: such as your education and work experience from your LinkedIn profile
Interview details: including outcomes of any recruiting exercises you complete
Third party screening information: such as information that we receive from third party police or background checks that we obtain through our screening process, as well as information provided by your referees
Sensitive personal information: such as optional information about your preferred pronouns, race, gender identity, and veteran status where legally permissible, so that we can continue to be intentional and thoughtful about our diversity, equity and inclusion efforts in hiring; and if disclosed, any special needs or health information relating to accommodations you may request during the recruitment process
Your feedback: we may ask for your feedback on our recruitment process, to help us improve the candidate experience
Online usage information: such as when you browse our talent community platform.

Some of this Data (e.g., name, email and phone number) is essential. If we cannot collect this information, we will be unable to include you in our talent community. Other Data, such as your work history, compensation details or working rights, is required to evaluate your suitability for employment with Canva. If we cannot collect this Data, we may be unable to process your application. Sometimes during the recruitment process we rely on third-party products and services to assist us. Such products and services are provided under the terms and conditions (including privacy notices) of the vendors that provide them. Canva does not control how these vendors use the personal data they collect.

2. How we use the Data

We process your Data as set out above, for the purposes described below.

If you are based in the European Economic Area (EEA), we collect and process Data only where we have legal bases to do so. Our legal basis for processing will depend on the Data concerned, and the context in which it is processed, as shown below.

(a) To create our talent community

E.g., publicly available information such as your LinkedIn profile.
Legal Bases for individuals located in the EEA or UK: Consent and Legitimate Interest

(b) To assess your suitability for employment opportunities at Canva, and if you are successful, to enter into an employment contract with you

E.g., information provided in your application and otherwise collected by us during the recruitment process, including interview details, professional information, education and background information, compensation and benefits information and third party screening information.
Legal Bases for individuals located in the EEA or UK: Consent, Legitimate Interest and Legal Obligation

E.g., contact details such as residential address, e-mail address and phone number.
Legal Bases for individuals located in the EEA or UK: Consent and Legitimate Interest

(d) For the security and safety of you, our team members and others

E.g., CCTV images and office access records for in-person recruitment activities (e.g., onsite interviews). Where legally permissible, third-party screening information such as criminal background checks.
Legal Bases for individuals located in the EEA or UK: Consent and Legitimate Interest

(e) To comply with our legal obligations

E.g., We collect citizenship and right to work information as required by law. We may also collect other information where required for reporting purposes. Health or other information you provide so that we can make any interview or workplace adjustments.
Legal Bases for individuals located in the EEA or UK: Consent and Legal Obligation

(f) To continue to be intentional and thoughtful about our diversity, equity and inclusion efforts in hiring

E.g., Where legally permissible, some optional information such as gender identity and race. This information is not accessible to anyone involved in the hiring process.
Legal Bases for individuals located in the EEA or UK: Consent

(g) To maintain and improve our recruiting processes and candidate experience, and to prepare internal reporting on recruitment metrics

E.g., Information in your application, or otherwise provided during the recruitment process, or any feedback you provide to us
Legal Bases for individuals located in the EEA or UK: Legitimate Interest

Your Data will be seen by hiring managers, the Talent Acquisition team and relevant Canva team members. We sometimes disclose your Data to service providers (e.g., applicants tracking system providers, background check providers, candidate relationship management providers) to assist us with our recruitment process for the purposes defined above.

3. Where your Data goes internationally

We're a global company, and your Data may, in some cases, go overseas to our other offices (including Austria, Czech Republic, New Zealand, Philippines, United Kingdom and the United States), or to service providers in places with different laws and protections. We’ll use appropriate technical and organisational measures and safeguards to protect your Data during transfers and at all other times it is in our care. For candidates in the EEA, Switzerland or UK, where we transfer your Data to a third-party service provider that is not located in Europe, and is not in a country that benefits from an adequacy decision by the European Commission, UK or Swiss authorities, we will require those third-party service providers to enter into an agreement that provides appropriate safeguards for your Data, including by using the EU Model Clauses and the UK International Data Transfer Addendum.

4. How long we keep your Data

We’ll retain your Data for no longer than is necessary for achieving the purposes for which it was collected (including to stay in touch regarding future opportunities, unless you ask us not to), or for us to comply with our legal obligations, to resolve disputes or to the extent permitted by applicable law.

If you join Canva, your Data will be kept in your personnel file and handled in accordance with our internal Canvanaut Privacy Policy.

5. Your rights in respect of your Data

You may have certain rights under applicable data protection laws including the right to request information about the processing of your Data, to access your Data, to object to our processing of your Data, and to request that we correct or delete your Data. You may exercise these rights by contacting us at privacy@canva.com.

6. Additional information for candidates in the United States - California Supplement

Some U.S. state privacy laws, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act) (“CCPA”) require specific disclosures for state residents. In the sections above, we explain the categories of information Canva collects, the sources of that information, and how Canva uses your information. State laws like the CCPA also provide certain rights, which can be exercised as described above. We will not discriminate against you for exercising your rights under the CCPA or other state law. Canva has not sold any Data about you, as defined under the CCPA, in the 12 months prior to the effective date of this notice.

7. Additional information for candidates in the EEA, UK or Switzerland

In addition to the information provided in section 2 above, the controller of your Data is Canva Pty Ltd, and its registered address can be found in section 9 below. If you have any questions about this Privacy Notice, or would like to make a complaint, our contact details and local representatives can also be found in section 9.

8. Additional information for candidates in the Philippines

The controller of your Data is Canva Solutions, Inc., with its registered office at 5/F Coherco Corporate Center 116 V.A. Rufino St., Legaspi Village, Makati City, Metro Manila, Philippines. If you have any questions about this Privacy Notice, or would like to make a complaint, our DPO’s contact information can be found in section 9 below. The data protection regulator in the Philippines is the National Privacy Commission.

9. How to get in touch

If you have any questions or concerns, we’d love to help. Please contact us:

By email: privacy@canva.com⁠(opens in a new tab or window) (or dpo_csol@canva.com⁠(opens in a new tab or window) if you’re in the Philippines)

By mail: Head of Privacy

Canva Pty Ltd

110 Kippax Street

Surry Hills NSW 2010

Australia

Our local representative in the EEA is European Data Protection Office (EDPO) with registered address at Regus Block 1, Blanchardstown Corporate Park, Ballycoolen Road, Blanchardstown, Dublin, D15 AKK1, Ireland.

Our local representative in the United Kingdom is European Data Protection Office UK (EDPO UK) with registered address at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom.

The EDPO and EDPO UK can both be contacted at privacy@edpo.com. If you are in the EEA, data subject request forms can be accessed at http://edpo.com/gdpr-data-request/. If you are in the UK, data subject request forms can be accessed at https://edpo.com/uk-gdpr-data-request/⁠(opens in a new tab or window).

If we can’t resolve your concerns (we hope we can!), you may also raise your concerns to your local statutory authority.