Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Greenhouse holds certifications under the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF, and states that DPF Principles supersede conflicting policy language; FTC enforcement jurisdiction applies to DPF compliance.
This analysis describes what Greenhouse's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that DPF Principles take precedence over any conflicting policy language and that FTC enforcement jurisdiction applies to Greenhouse's cross-border data transfer compliance, providing EU, UK, and Swiss individuals a formal complaint pathway to their respective data protection authorities.
Under this clause, EU, UK, and Swiss individuals may submit complaints about Greenhouse's data handling to their local data protection authority at no cost, and binding arbitration is available as a last resort under DPF Annex I. The FTC retains investigatory authority over Greenhouse's DPF compliance.
Cross-platform context
See how other platforms handle Data Privacy Framework Certification and FTC Enforcement and similar clauses.
Compare across platforms →Monitoring
Greenhouse has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Greenhouse complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Greenhouse has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. Additionally, Greenhouse is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC), and the FTC has jurisdiction over Greenhouse's compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.Excerpt from Greenhouse's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages the EU-U.S. Data Privacy Framework administered by the U.S. Department of Commerce, with FTC enforcement authority explicitly stated. The provision also implicates EU GDPR and UK GDPR as the underlying regulatory frameworks for which DPF serves as the transfer mechanism. EEA supervisory authorities, the UK ICO, and the Swiss FDPIC all retain complaint-handling authority. 2. GOVERNANCE EXPOSURE: Medium. DPF certification provides a recognized lawful transfer mechanism for EU, UK, and Swiss personal data transferred to the United States, reducing regulatory exposure for cross-border transfers. However, the DPF's long-term adequacy status remains subject to political and judicial developments in the EU, and operational reliance on DPF certification as the sole transfer mechanism warrants contingency planning. 3. JURISDICTION FLAGS: EU, UK, and Swiss users have the highest operational relevance from this provision given the DPF's geographic scope. The FTC's stated enforcement jurisdiction creates a U.S. regulatory dimension for any DPF compliance failures. Users in other jurisdictions are not covered by the DPF framework. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers relying on Greenhouse as a processor for EU, UK, or Swiss employee or candidate data should confirm that Greenhouse's DPF certification remains current and that the Data Processing Addendum referenced elsewhere in Greenhouse's legal documents is aligned with DPF Principles. Onward transfer obligations to sub-processors are explicitly stated as Greenhouse's responsibility under the policy. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should verify Greenhouse's current DPF certification status at dataprivacyframework.gov, assess whether standard contractual clauses or other transfer mechanisms are maintained as backup mechanisms, and confirm that the Data Processing Addendum incorporates onward transfer obligations consistent with DPF Principles.
This provision establishes that DPF Principles take precedence over any conflicting policy language and that FTC enforcement jurisdiction applies to Greenhouse's cross-border data transfer compliance, providing EU, UK, and Swiss individuals a formal complaint pathway to their respective data protection authorities.
Under this clause, EU, UK, and Swiss individuals may submit complaints about Greenhouse's data handling to their local data protection authority at no cost, and binding arbitration is available as a last resort under DPF Annex I. The FTC retains investigatory authority over Greenhouse's DPF compliance.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Greenhouse.