Applicant and Personnel Privacy Notice

Effective Date: October 30, 2026

This Applicant and Personnel Privacy Notice (this "Privacy Notice") explains how Maplebear Inc. d/b/a Instacart and its subsidiaries and corporate affiliates (collectively, "Instacart," "we," "our," or "us") collect, use, disclose, and protect personal information collected from and about: (i) applicants for employment with Instacart and individuals we identify as potential candidates ("Applicants"); and (ii) current and former Instacart employees ("Employees"), in-store Shoppers ("Employee Shoppers"), and independent contractors who provide professional services to Instacart and are not independent contractor Full-Service Shoppers ("Contractors"). Employees, Employee Shoppers, and Contractors are collectively referred to in this Privacy Notice as "Personnel."

When we use the term "personal information" in this Privacy Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, and it includes "personal data" or similar terms as defined in applicable law.

Table of Contents:

1. Notice at Collection of Personal Information

2. Information We Collect

3. How We Use Personal Information

4. How We Disclose Personal Information

5. Transfers of Personal Information

6. How We Protect Personal Information

7. Your Rights and How to Exercise Them

8. Canada Residents

9. Australia Residents

10. EEA/UK Residents

11. Israel Residents

12. Brazil Residents

13. Columbia Residents

14. Revisions to this Privacy Notice

15. Contact Information

1. Notice at Collection of Personal Information

a. Categories We Collect

The table below lists the categories of personal information we collect, the sources from which we collect it and the categories of third parties to whom we disclose this information. Additional details on each of these activities is provided below. We do not sell or share your personal information as such terms are understood under the California Consumer Privacy Protection Act.

b. Purposes for Which We Collect and Use Your Personal Information

We use your personal information in connection with our recruitment activities and management of our relationship with you as an Employee, Employee Shopper, or Contractor, as applicable. We also use your personal information to fulfill other legitimate business purposes. In particular, we use your personal information to:

• Facilitate the recruiting and interview process, including identifying you as a potential candidate, reviewing your application for a position with us, verifying the information provided to us in connection with your application or received from other sources, determining your eligibility and suitability for the potential position or other opportunities with us, and communicating with you about the status of your application or other opportunities with us that may be of interest to you; 

• Administer onboarding, staffing, leaves of absence, personnel evaluations, promotions, performance management, training, discipline, participation in available activities or programs and any other processing in connection with work-related purposes;  

• Authorize, grant, administer, monitor (including by video surveillance), and terminate access to or use of our systems, facilities, records, property, and infrastructure;  

• Communicate with and between Personnel as well as with designated emergency contacts, dependents, and beneficiaries;  

• Support and manage Personnel, including providing resources needed for Personnel to perform their roles with us and providing resources for Personnel to attend company-sponsored or informational/educational events;  

• Facilitate compensation, Contractor payments, payroll, claims, and benefit planning and administration (e.g., salary, tax withholding, insurance, etc.);  

• Conduct performance reviews and evaluations and make decisions about promotions and job mobility; 

• Manage business travel (e.g., car service/rentals, flights, hotels, etc.) and Personnel expenses (e.g., reimbursements, corporate credit card expenses, etc.);  

• Detect and assess fraud, misrepresentation, and identity substitution in applications and video interviews through AI-assisted fraud detection tools;

• Coordinate interview scheduling through AI-assisted scheduling tools;

• Conduct organizational planning and development, including budget planning and administration; 

• Operate our business, including marketing Personnel to our customers and partners, facilitating the work of Personnel, and providing the products and services made available to our customers and partners; 

• Operate our IT systems and maintain network and information security;

• Investigate, respond to, document, and report work-related injuries, illnesses, or grievances;

• Detect and investigate fraud and other types of wrongdoing; 

• Analyze and monitor compliance with our policies and procedures (and for any other purpose included in such policies and procedures); 

• Conduct internal investigations and audits and carry out compliance, risk management, problem resolution, and security operations;  

• Conduct litigation and obtain legal and professional advice;

• Fulfill contractual obligations to you and other third parties; 

• Comply with applicable laws, rules, regulations, legal proceedings, and government investigations, including those relating to tax reporting and immigration; and

• Protect our rights, safety, property, or operations and/or those of our subsidiaries and affiliates or others. 

c. Retention

We will retain and use your personal information as long as reasonably necessary to manage your candidacy or employment, comply with our legal obligations, resolve disputes, and enforce our agreements. What this means in practice will vary between different types of information, and when we consider our approach we take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations

Interview audio and video recordings, AI-generated transcripts, AI-generated summaries and evaluation notes collected through AI-assisted recruiting tools are retained for as long as necessary to fulfill the recruiting purposes for which they were collected, unless a longer period is required or permitted by applicable law, after which they are permanently deleted.

Biometric data collected from Applicants in connection with AI-assisted video interview fraud detection is retained and destroyed as described in Section 2(c) (Biometric Information).

Employee biometric data will only remain on work devices provided by Instacart until one of the following occurs: (i) the employee deletes the biometric data via their account settings, (ii) Instacart deletes the data from the device when the employee’s employment ends or the employee returns the device to receive a replacement, or Instacart remotely deletes the data. Deletion of biometric data by Instacart shall mean physical destruction of such data. Biometric data will not be retained for more than one year after the termination of the employment relationship, absent a legal reason for retaining such data (such as if the data is subject to a legal preservation hold).

2. Information We Collect

a. Information we collect from and about Applicants

We (and our service providers) collect a variety of information from and about Applicants during the job application and recruitment process. This information may include:

• Contact information, such as your full name, email addresses (personal and business), postal addresses (home and business), and telephone number(s).

• Application and onboarding information, such as your resume, cover letter, and other supporting documentation.

• Education and training information, such as your highest level of education; the schools you attended and your dates of attendance; the degrees, certificates, or other educational qualifications you earned; and your transcripts or training records.

• Professional history and qualifications, such as your previous employers, positions, and work experience; your professional licenses, certifications, and/or other qualifications; and your professional references (and information that your references provide about you).

• Technical information, such as your IP address, browser type, device type, operating system, language, and other device information that is collected automatically when you visit instacart.careers (the "Site") or any other website where this Privacy Notice is posted or linked. This also includes usage information, such as how you interact with the Site, the pages that you navigate to, and links that you click.

• Other information you provide to us, such as your social media account handle(s), employment preferences, current salary, desired salary, and responses to equal employment opportunity surveys.

b.  Information we collect from and about Personnel

If you are offered and accept employment with Instacart, the personal information collected during the recruitment and onboarding process may become part of your employment record. If you are a Contractor, we collect personal information from you when we engage you for your services. 

Depending on your role and our relationship with you, we (and our service providers) collect a variety of information from and about you, which may include:

• Identification information, such as your photo, passport, immigration status and documentation, visa, Social Security number, government-issued identification number, driver's license number, vehicle license plate number, and other information needed to establish your eligibility to work for us.

• Employment details, such as your hire or engagement date, employment location, business unit, department, supervisor, job title, position/grade, hours and days worked, working arrangement, nature of the services provided, work restrictions or accommodations, professional licenses and certifications, attendance records, completed trainings, career goals, performance reviews, and disciplinary records.

• Financial information, such as your tax elections, salary, bonus, benefits, expenses, stock or equity grants, bank account number and routing number, and corporate credit card number.

• Benefits information, such as your eligibility for benefits; information about your marital status and any spouse, children, or other eligible dependents and beneficiaries; and claims relating to your benefits.

• Protected characteristics, such as your age, race, ethnicity, national origin, citizenship, sex, gender identity, sexual orientation, religion, or disability status (note that we will not use this information in employment-related decisions unless specifically permitted by law).

• Health and medical information, such as information about disabilities or illnesses that you voluntarily share with us and proof of vaccine status and/or other screening information that we may collect (if permitted in the country or jurisdiction in which you reside or are otherwise located) to help us prevent the spread of COVID-19 or other infectious diseases and ensure the safety of Personnel.

• IT and security information, such as your work-related account names and passwords; information about your access to and use of Instacart's systems and networks and Instacart-managed devices (e.g., internet browsing history, search history, and interaction with web-based tools); information about your personal devices (to the extent that such devices are used in connection with your employment or engagement and/or access Instacart's systems and networks); information about your access to Instacart's physical offices and facilities; audio/video recordings of meetings or events you attend; and CCTV video footage and other visual images of you captured during your time at Instacart's physical offices and facilities.

• Other information we request or receive, such as information you choose to share with us (e.g., when you complete an employee survey, raise a grievance, etc.) or information we receive from a third party in connection with your role, an agreement you enter into with us, or additional roles you take on at Instacart. This includes information collected in connection with background checks and other pre-engagement activities.

c. Special (Sensitive) Categories of Personal Information

We only use or disclose sensitive personal information such as data concerning your health, racial or ethnic origin and biometrics as necessary to manage your candidacy or our employment relationship; resist malicious, deceptive, fraudulent, or illegal actions directed at our business; ensure the physical safety of natural persons; and verify, maintain and improve the quality of our business. We do not use or disclose sensitive personal information for purposes that would give you the right to limit its use under the California Consumer Privacy Act.

Biometric Information. If you consent during a video interview, our service provider (identified in our Notice Regarding Use of AI-Assisted Screening Tools) analyzes the interview video and audio to create a faceprint and voiceprint, which we use only to confirm that the same person attends each interview and to detect AI-generated or manipulated video or audio. If you are an Applicant and choose optional identity verification through a third-party provider, that provider collects your biometric information under its own privacy policy and we receive only the verification result. If you enable fingerprint or facial recognition on an Instacart-issued device, your biometric template stays on the device as described in Section 1(c). We use biometric information only for identity verification, fraud prevention, and device security. We do not sell, lease, trade, or otherwise profit from biometric information, and we disclose it only to service providers acting on our behalf, with your consent, or as required by law or valid legal process. We retain biometric information only until the earliest of: (i) the date the purpose for collecting it has been satisfied (for Applicants, when the hiring process for the role ends); (ii) for Employees, one year after your employment ends; (iii) for everyone else, three (3) years after your last interaction with Instacart; or (iv) any shorter period required by law. We then permanently destroy it. You may withdraw your consent or request deletion at any time by contacting privacy@instacart.com.

If you are an Employee or Contractor located in the United States or Canada and you request recovery of access to an Instacart work account, we may ask you to verify your identity through a service provider acting on our behalf. The provider collects an image of your government-issued ID and a selfie or video, and may create a facial geometry template to confirm that they match and that you are present. We permanently delete the images, facial geometry, and other outputs after your verification and any related review is complete. We keep the pass or fail result and a record of your consent for as long as needed to administer account access and meet our legal obligations. We will ask for your written consent before this verification. If you prefer not to consent, you may verify your identity through a live video call with our IT team instead.

d. Sources from which We Collect Personal Information

Directly from Applicants and Personnel

We collect most of the above-listed categories of personal information directly from Applicants (when they apply for employment with Instacart and throughout the recruitment process) and Personnel (during their time as an Employee, Employee Shopper, or Contractor). 

Through Automated Means

We may also collect personal information by automated means when Applicants and Personnel: (i) access any website or mobile application where this Privacy Notice is posted or linked; or (ii) interact with Instacart's systems and networks and/or Instacart-managed devices.

From Third Parties

Additionally, we may collect personal information from other sources. For example, during the job application and recruitment process, we may collect information about Applicants from employment agencies and recruiters, prior employers and educational institutions, professional references, pre-employment screening service providers, professional data providers, fraud prevention and identity verification providers, Personnel, and publicly-available sources (e.g., social media sites/platforms).

e. Information About Other Individuals

Some of the personal information that we receive from Applicants and Personnel (e.g., a reference's contact information; an emergency contact's information; spouse, dependent, and beneficiary information; etc.) relates to other individuals ("Other Persons"). Applicants and Personnel are responsible for obtaining all necessary permissions to share the personal information of Other Persons with us. We will use and protect the personal information of Other Persons that we receive as described in this Privacy Notice.

f. AI-Assisted Recruiting Tools and Automated Decision-Making

Instacart uses AI-assisted tools as part of its applicant recruiting, screening, and scheduling processes. These tools assist human decision-makers in the evaluation of candidates and perform administrative coordination functions such as interview scheduling. They do not make final hiring decisions. A recruiter reviews the output of each evaluative tool before any decision is made to advance or decline an application. Before we use any AI-assisted tool to evaluate your application, we make available our Notice Regarding Use of AI-Assisted Screening Tools, which identifies each tool, describes how it works, and explains any applicable rights. Where the law requires your consent before a tool is used, we will ask for it separately at that time. Where required by applicable law, if we identify you as a potential candidate through AI-assisted sourcing before you apply, we will provide a link to that notice when we first contact you. For a current list of the AI-assisted tools Instacart uses in its recruiting process, together with descriptions of each tool and your applicable rights, please see Instacart’s Notice Regarding Use of AI-Assisted Screening Tools, available at instacart.careers/ai-assisted-screening-tools-notice. For more information, including summaries of independent bias audits, please contact us using the information provided in Section 15.

Jurisdictional Rights Regarding Automated Processing

New York City Residents. Instacart is required under NYC Local Law 144 to make this notice available to you at least ten (10) business days before any automated employment decision tool (AEDT) described in our Notice Regarding Use of AI-Assisted Screening Tools is used in the evaluation of your application. You may request an alternative selection process or a reasonable accommodation in lieu of AEDT evaluation by contacting CandidateQuestions@instacart.com. The results of the most recent independent bias audit for each AEDT Instacart uses, along with each tool’s distribution date, are publicly available in Instacart’s Notice Regarding Use of AI-Assisted Screening Tools, available at instacart.careers/ai-assisted-screening-tools-notice.

California residents. Beginning January 1, 2027, you have the following rights with respect to our use of automated decision making technology (ADMT) in employment decisions affecting you: (i) the right to opt out of our use of ADMT to make a significant decision concerning you, unless we instead offer you the ability to appeal the decision to a qualified human reviewer who has the authority to overturn it, or an exception applies (for example, where ADMT is used solely for security, fraud prevention, or safety); (ii) the right to access information about how ADMT was used with respect to you, including the categories of personal data used, the type of output generated, and how the output factored into the employment decision; and (iii) the right not to be retaliated against for exercising any of the foregoing rights. Opting out or requesting human review will not negatively affect your consideration for the role. To exercise any of these rights, contact CandidateQuestions@instacart.com.

Illinois Residents. You have the right to be informed before AI tools are used in your application review, including the name of each tool, its purpose, and the job characteristics it assesses. You may request a reasonable accommodation. Contact CandidateQuestions@instacart.com. Illinois law requires written consent before biometric data is collected or processed. We use tools that involve biometric data only after you provide written consent. These tools are: (i) fraud detection during video interviews, which creates a faceprint and voiceprint to confirm that the same person attends each interview and to detect AI-generated or manipulated video or audio, and for which you will be asked to provide written consent before the interview; (ii) optional third-party identity verification during hiring, for which the provider obtains your written consent directly; and (iii) identity verification to recover access to Instacart work accounts, for which we will ask for your written consent before the verification. See Section 2(c) (Biometric Information) for how we retain and destroy biometric data.

Colorado Residents. Beginning January 1, 2027, you have the following rights with respect to our use of automated decision making technology (ADMT) in consequential employment decisions affecting you under the Colorado AI Act: you have the right to: (i) receive notice before ADMT is used in a consequential decision about you; (ii) request an explanation of an adverse decision that ADMT materially influenced; (iii) correct inaccurate personal data used by the ADMT; and (iv) request meaningful human review and reconsideration of the decision. To exercise any of these rights, contact CandidateQuestions@instacart.com.

3. How We Use Personal Information

We use your personal information for the purposes described in Section 1(b)

We will not use your personal information for any purpose that is incompatible with the purposes described in Section 1(b), unless such use is required or authorized by law; authorized by you; or necessary to protect our rights, privacy, safety, or property, and/or those of others.  

In most cases, we process your personal information to assess your application for employment or to fulfill your employment contract (for example, processing your bank account details in order to pay you).

We also will process your personal information to comply with our legal obligations as your employer or where we are required to by law (for example, to comply with record keeping, auditing or tax obligations), or when it is in our legitimate interests (such as to protect the security of networks or facilities) and when these interests are not overridden by privacy and data protection rights. In rare cases, we may need to use your personal data to protect your (or someone else's) best interests or if it is in the public interest for us to do so.

Where appropriate or where required by law, we also may seek your consent to process specific personal information (for example, when asking permission to use a photograph of you in promotional material). Where we plan to rely on consent, we will request your consent in writing, and explain the purpose for doing so. You have the right not to provide consent, or to withdraw your consent at any time by contacting our privacy team via the email in Section 15 below.

We may from time to time request your consent for additional uses of your personal information during your engagement.

4. How We Disclose Personal Information

In connection with one or more of the purposes outlined above, we may disclose your personal information to the following categories of recipients:

• Our subsidiaries and affiliates: We will share personal information with our subsidiaries and corporate affiliates for purposes consistent with this Privacy Notice and/or other business and operational purposes.

• Our service providers: We will share personal information with third-party service providers that help us operate our business by providing business or technical support functions for us (e.g., recruitment, data hosting, analytics, etc.) or administer services on our behalf (e.g., identity verification, background checks, employee benefits, payroll, claims, etc.). Our service providers may also include professional advisors (e.g., lawyers, accountants, auditors, etc.) that provide services to us. Our service providers are subject to restrictions on the use of the information we share with them.

• Our Personnel: We will share personal information with Personnel who need it to perform their tasks and duties and as otherwise necessary or appropriate.

• Our customers and partners: We will share personal information with our customers and other partners with whom we do business or are exploring a business relationship, including event sponsors.

• Government and public authorities: We will share personal information with government authorities, law enforcement, courts, and others, in each case to comply with legal or regulatory obligations or requests.

• Third parties in connection with a sale or business transaction: We may sell or purchase assets during the normal course of business. If another entity acquires us or any of our assets, information that we have collected may be transferred to such entity and its advisors leading up to and/or following the transaction. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, information that we hold may be considered an asset of ours and may be sold or transferred to third parties.

• Other third parties: We will share personal information with other parties with consent or as we believe necessary or appropriate either: (a) under applicable law; (b) to protect our operations and those of any of our affiliates; (c) to protect our rights, privacy, safety, or property, and/or those of our affiliates, you, or others; or (d) to allow us to pursue available remedies or limit damages that we may sustain.

5. Transfers of Personal Information

Instacart operates a global business, and we use service providers located around the world to help us run our business. Accordingly, your personal information may be transferred outside of the country or region in which you reside. For example, the personal information of Applicants and Personnel collected by Instacart subsidiaries and affiliates operating outside of the United States will be transferred to the United States, where it will be maintained in a central database and/or accessed by Personnel based in the United States. 

Where we transfer your personal information outside of your country of residence, we do so in accordance with applicable law and take appropriate steps to ensure your information is protected. 

If you would like to learn more about the international transfer of your personal information, please contact us using the contact details in the "Contact Information" section below.

6. How We Protect Personal Information

We employ and maintain appropriate administrative, physical, and technical measures designed to safeguard and protect personal information under our control from unauthorized access, use, and disclosure. 

Additionally, we keep personal information in a form which permits your identification only for as long as necessary to fulfill the purposes for which we have collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure of the personal information; the purposes for which we use the personal information; whether we can achieve those purposes through other means; and the applicable legal requirements.

7. Your Rights and How to Exercise Them

You may be entitled to request access to your personal information, request to correct, or request to delete your personal information. In addition to the methods described below, you may submit any of these requests by emailing privacy@instacart.com. We will not retaliate against you for exercising your privacy rights.
  

We will honor any such rights and/or additional rights you may have under applicable data protection law. These rights may be limited in some circumstances, for example if fulfilling your request would reveal personal information about another employee or person, if we have compelling legitimate interests, or if you ask to delete information which we are required by law to keep.  

Identity Verification

To protect your privacy, we will require you to provide personal information with your request that we can match with information we maintain in order to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only.  

Right to Correct

You may correct inaccurate personal information that we may maintain about you, subject to appropriate verification. If you would like to correct inaccurate personal information that we maintain about you, please follow the instructions below:

• If you are an Employee or Employee Shopper (current or inactive), please log in to your internal employee portal, where you will be able to make changes to your information.

• If you are an Applicant, you may update your profile in Greenhouse.

• If you are a Contractor, please contact your Instacart point of contact.  

Note that not all types of personal information we maintain about you may be corrected.

Right to Know

In some jurisdictions, including in California, you have the right to know what personal information we have collected about you. All current Employees may log in to their internal employee portals to download their personal information via the self-service instructions provided within the portals. 

Applicants and Personnel (including Contractors who are directly engaged by Instacart) may also submit a request for information here.

If you are an active Employee Shopper, you may also separately request your Shopper Data here. If you are not an active Employee Shopper or do not have access to your Shopper account, please email shopperprivacy@instacart.com. 

Right to Delete

In some jurisdictions, including in California, you may request that we delete the personal information that we have collected from or about you. Note that there are some reasons when we will not be able to fully address your request, such as to perform a contract, to detect and protect against fraudulent and illegal activity, to maintain for internal purposes, to comply with a legal obligation or to exercise our rights. If you wish to delete your personal information, please submit your deletion request here. Please note that for so long as you are a current Employee or Employee Shopper, Instacart cannot delete employment-related information.  

Authorized Agents

If you authorize a natural person or business entity to submit a request on your behalf (an "Authorized Agent"), the Authorized Agent may use the relevant submission method noted above. As part of our verification process, we will require proof concerning their status as an Authorized Agent, which may include proof of their registration with the California Secretary of State to conduct business in California and/or proof that they have power of attorney in accordance with California probate law. We will also require you to directly confirm with us that you provided the agent with permission to submit the request.

8. Canada Residents

If you reside in Canada and would like more information about where your information is stored and processed, please see the section Transfers of Personal Information above. 

If you reside in Alberta, British Columbia, or Quebec, you may submit an access or deletion request as explained above.

If you reside in Quebec, you have the right to be informed when a hiring decision affecting you is based exclusively on automated processing of your personal information. You have the right to know which personal information was used in the automated assessment, and which factors led to the assessment. You also have the right to request that a human being review any automated assessment and confirm or change any resulting decision. To exercise these rights, contact us at CandidateQuestions@instacart.com.

9. Australia Residents

If you reside in Australia, you can correct or request access to your personal information as explained here. 

You may also contact the Office of the Australian Information Commissioner:

GPO Box 5218, Sydney NSW 2001,
Email: enquiries@oaic.gov.au
Tel: 1300 363 992
www.oaic.gov.au.

10. EEA/UK Residents

This section supplements the rest of this Privacy Notice and applies specifically to individuals located in the European Economic Area ("EEA") or the United Kingdom ("UK"). In the event of any conflict between this section and other sections of this Privacy Notice, this section prevails for EEA/UK individuals.

a. Data Controller Identity

For Personnel and Applicants engaged by or applying to Instacart's EEA-based entities, the data controller is the relevant Instacart subsidiary in your jurisdiction (for example: MB Transcorp Spain S.L. for Spain-based Personnel; MB France SAS for France-based Personnel) (the "EU Controller"). The EU Controller may share data with, or act as joint controller with, Maplebear Inc. d/b/a Instacart, 50 Beale St. Suite 600, San Francisco, California 94105, USA. You may contact the EU Controller at: dpo@instacart.com.

b. Data Protection Officer

You may contact our Data Protection Officer (DPO) at:

Bird & Bird DPO Services

Avenue Louise 235 box 1, 

1050 Brussels, Belgium

+32(0)22826000

dpo@instacart.com

c. Lawful Bases for Processing (Article 6 GDPR)

We process EEA/UK personal data on the following lawful bases under Article 6 GDPR, depending on the relevant processing activity:

Performance of a contract (Art. 6(1)(b)): Processing necessary for the performance of your employment or contractor agreement, or to take steps at your request before entering into that agreement. This covers recruiting and onboarding, administering pay and benefits, managing performance, facilitating payroll, and any other processing directly required to perform your agreement with us.

Compliance with a legal obligation (Art. 6(1)(c)): Processing necessary to comply with our legal obligations as an employer or data controller, including right-to-work verification, tax and payroll reporting, health and safety obligations, equal opportunity monitoring (where mandated), and mandatory record-keeping requirements.

Legitimate interests (Art. 6(1)(f)): Processing necessary for our legitimate interests (or those of a third party), where those interests are not overridden by your rights. Our legitimate interests include: maintaining the security and integrity of our IT systems, networks, and facilities; detecting, preventing, and investigating fraud and misconduct; conducting internal audits and managing legal risk; operating and improving our business; and protecting the rights, safety, and property of Instacart, Personnel, and third parties.

Consent (Art. 6(1)(a)): In limited circumstances (for example, use of your photograph in promotional materials, or voluntary diversity surveys), we may rely on your consent. Where we rely on consent, we will make this clear and obtain your explicit agreement. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing, by contacting privacy@instacart.com.

Vital interests (Art. 6(1)(d)): In rare circumstances, to protect your vital interests or those of another person (for example, in a medical emergency).

d. Lawful Bases for Special Category Data (Article 9 GDPR)

We may process special categories of personal data within the meaning of Article 9 GDPR, which may include data concerning your health, racial or ethnic origin and biometrics as necessary to manage your candidacy or our employment relationship; resist malicious, deceptive, fraudulent, or illegal actions directed at our business; and ensure the physical safety of natural persons.

Such processing occurs only where:

• Necessary for employment, social protection, or platform safety obligations (Article 9(2)(b)); or

• Required for reasons of substantial public interest (Article 9(2)(g))

We implement additional safeguards, including strict access controls, data minimization, limited retention, and enhanced security protections.

e. Mandatory and Voluntary Provision of Personal Data

Certain personal data is required to establish and perform your employment or contractor agreement with us, or for us to comply with legal obligations. For example: right-to-work documents, bank account information (for payroll), government-issued identification, and tax information are mandatory. Failure to provide mandatory data may mean we are unable to enter into or perform the agreement with you, or to fulfil legal requirements. Where personal data is not mandatory, we will inform you at the time of collection.

f. Additional Data Subject Rights

If you are located in the EEA or UK, you have the following additional rights regarding your personal data:

Right to Restrict Processing. You may request that we restrict processing of your personal data where: (i) you contest its accuracy; (ii) we no longer need it but you require it for legal claims; or (iii) you have objected and verification is pending. To request restriction, contact privacy@instacart.com.

Right to Data Portability. Where we process your personal data by automated means on the basis of consent or contract, you have the right to receive that data in a structured, machine-readable format and to transmit it to another controller. To exercise this right, contact privacy@instacart.com.

Right to Object. You have the right to object to processing based on our legitimate interests (Article 6(1)(f) GDPR). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing is for legal claims. To object, contact privacy@instacart.com.

Right to Lodge a Complaint. If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority in the jurisdiction where you live or work, or where you believe an issue concerning your personal data has arisen.

For EEA residents, contact details for each EU Member State's data protection authority are available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

For UK residents, complaints may be directed to the Information Commissioner's Office (ICO) at www.ico.org.uk.

g. International Data Transfers

When we transfer your personal data from the EEA or UK to countries not covered by an adequacy decision (including the United States), we implement Standard Contractual Clauses (SCCs) for EEA-origin transfers and the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs for UK-origin transfers. To request a copy of the applicable transfer mechanism, contact privacy@instacart.com.

h. Automated Decision-Making

Automated Decision-Making (EEA/UK Applicants). Instacart does not currently use the AI-assisted recruiting tools described in Section 2(g) to process the personal data of Applicants located in the EEA or UK.

11. Israel Residents

If you reside in Israel, you can request access to your personal information, and if you find that it is incorrect, incomplete, or unclear, you may have the right to correct or delete your personal information, as explained above.

If you reside in Israel, and you are an Applicant, you are not under any legal obligation to provide us with personal information, and the provision of such information is voluntary. However, if you choose not to provide certain information, we may not be able to process your application for joining our Personnel. 

If you reside in Israel, and you are an Employee or Contractor, as part of the Instacart’s operations and in order to engage you lawfully and manage our relationship with you, you are under a legal obligation to provide us with certain personal information, while other personal information is provided voluntarily, and you are under no legal obligation to provide it. If you choose not to provide us with information which is voluntary, this may affect our ability to engage you, enable your work or services, and grant you rights conferred upon you by law or under your employment or services agreement. 

12. Brazil Residents

If you are located in Brazil, this section applies to you and supplements but does not replace the information provided in this Privacy Notice, in accordance with Brazil’s Data Protection Law (Law No. 13,709/2018 “LGPD”).

Data Protection Officer. In accordance with Article 41 of the LGPD, Instacart has appointed Prado e Vidigal Sociedade de Advogados (CNPJ 38.491.410/0001-55) as its Data Protection Officer for Brazil, to serve as the point of contact between Instacart, data subjects, and Brazil’s Data Protection Agency (“ANPD”).  You may contact our Data Protection Officer through its main contact, Paulo Vidigal, at paulo@pradovidigal.com.br. 

Legal Bases for Processing. To carry out the processing activities described in this Privacy Notice with respect to Applicants and Personnel located in Brazil, we may rely on one or more of the following legal bases under Articles 7 and 11 of the LGPD, depending on the specific purpose involved: (i) execution of, or steps preliminary to, a contract to which you are a party (Article 7, V); (ii) compliance with a legal or regulatory obligation (Article 7, II); (iii) our legitimate interests or those of a third party (Article 7, IX), provided these interests are not overridden by your fundamental rights and freedoms; (iv) the regular exercise of rights in judicial, administrative, or arbitral proceedings (Article 7, VI); and (v) your consent (Article 7, I). Where we process sensitive personal information about you, such as health information, racial or ethnic origin, or biometric data, we do so only as permitted under Article 11 of the LGPD, relying on: compliance with a legal or regulatory obligation (Article 11, II, "a"); protection of life or physical safety (Article 11, II, "e"); prevention of fraud and security in processes of electronic identification and authentication (Article 11, II, "g"); or your specific and highlighted consent (Article 11, I).

Your Rights Under the LGPD. In addition to the rights described in the "Your Rights and How to Exercise Them" section above, the LGPD entitles you to request: the anonymization, blocking, or deletion of unnecessary or excessive personal information, or personal information processed in violation of the LGPD (Article 18, IV); the portability of your personal information to another service or product provider, subject to our trade secrets (Article 18, V); information about the public and private entities with which we have shared your personal information (Article 18, VII); information about the possibility of not providing consent and the consequences of doing so (Article 18, VIII); where consent is the legal basis for processing, the revocation of your consent at any time, free of charge (Article 18, IX); and the review of decisions made solely on the basis of automated processing of your personal information that affect your interests, including decisions intended to define your personal or professional profile, as well as clear and adequate information about the criteria and procedures used in any such automated decision, subject to our trade secrets (Article 20). You may exercise these rights, and any other rights available to you under the LGPD, by contacting us at privacy@instacart.com. You also have the right to lodge a complaint with the ANPD.[A3] 

Automated Decision-Making (Brazil Applicants). Instacart uses AI-assisted tools in its recruiting process as described in this Privacy Notice. Under Article 20 of the LGPD, you have the right to request the review of decisions made solely on the basis of automated processing of your personal information that affect your interests, including decisions intended to define your personal or professional profile. You also have the right to request clear and adequate information about the criteria and procedures used in any automated decision, subject to our trade secrets. To exercise these rights, contact us at CandidateQuestions@instacart.com.

International Data Transfers. As described in Section 10.g ("International Data Transfers") above, your personal information may be transferred to third countries. Where such transfers are directed outside the European Union, taking into account the adequacy decision recognizing the European Union under Article 33 of the LGPD, they are carried out in accordance with Article 33 of the LGPD and, where applicable, the standard contractual clauses approved by Brazil's Data Protection Agency. You may request additional information about the safeguards applicable to these transfers by contacting us at privacy@instacart.com.

13. Columbia Residents

Legal Framework. If you reside in Colombia, this Section 13 applies to you under Ley Estatutaria 1581 de 2012 and Decreto 1377 de 2013, as incorporated into Decreto Único 1074 de 2015.

The Data Controller responsible for processing your personal data is:

• Full Legal Name: Maplebear Inc. dba Instacart

• Address: 50 Beale St., Suite 600, San Francisco, CA 94105, United States

• Telephone Number: 1-415-830-4593

• Email Address: privacy@instacart.com

Consent (Authorization). We will obtain your prior, express, and informed authorization before processing your personal data and will retain proof of that authorization. Authorization is not required for: (i) information required by a public or administrative entity in exercise of its legal functions or by judicial order; (ii) public data; (iii) a medical or sanitary emergency; (iv) processing authorized by law for historical, statistical, or scientific purposes; or (v) civil registry data.

Sensitive Data. Colombian law generally prohibits the processing of sensitive data, including racial or ethnic origin, political orientation, religious or philosophical beliefs, trade union membership, health, sexual life, and biometrics. When we process sensitive data, we will: (i) inform you that providing it is optional and that you are not required to authorize its processing; (ii) inform you of the specific purposes requiring it; and (iii) obtain your explicit authorization. We will process sensitive data only under the principles of necessity and restricted access.

Data Subject Rights. Under Ley 1581, you have the right to: (i) know, update, and correct your personal data; (ii) request deletion of your data when applicable; (iii) revoke your authorization at any time; (iv) request proof of the authorization you granted; and (v) file complaints with the Superintendencia de Industria y Comercio (SIC) regarding violations of the data protection regime. The SIC may be contacted at Calle 24 No. 7-43, Bogotá D.C., Colombia; +57 601 587 0000; and www.sic.gov.co.

Inquiry and Complaint Procedures. Inquiries (consultas) will be answered within ten (10) business days of receipt, which may be extended by five (5) additional business days. Complaints (reclamos) will be answered within fifteen (15) business days of receipt, which may be extended by eight (8) additional business days. A complaint must include your identification, a description of the facts, supporting documentation, and your address for correspondence. While a complaint is pending, we will place a notation on the data indicating its disputed status. Direct inquiries and complaints to privacy@instacart.com.

International Transfers. Personal data of Colombia residents is transferred to the United States for the purposes described in Section 5 of this Privacy Notice. Such transfers are made under your express and unequivocal authorization and/or an applicable exception under Article 26 of Ley 1581 de 2012, including where the transfer is necessary to perform a contract between you and the data controller or is required for the public interest or the exercise or defense of a right in judicial proceedings. If we obtain a conformity declaration (declaración de conformidad) from the SIC, we will update this Section accordingly.

Data Protection Officer. Instacart has designated a data protection contact responsible for receiving and processing requests from Colombia residents at privacy@instacart.com.

National Database Registry (RNBD). To the extent required by applicable law, Instacart will register databases containing personal data of Colombia residents with the Registro Nacional de Bases de Datos (RNBD), administered by the SIC, in accordance with Chapter 26 of Decreto Único 1074 de 2015.

14. Revisions to this Privacy Notice

We may update or modify this Privacy Notice from time to time. The "Effective Date" at the top of this Privacy Notice indicates when it was last revised. Any changes will become effective when we post a revised version of this Privacy Notice. We encourage you to review this Privacy Notice periodically to remain informed about our information handling and privacy practices.

15. Contact Information

If you have any questions or concerns about this Privacy Notice or the handling of your personal information or wish to complain about our use of your personal information, please contact us at our email address privacy@instacart.com or at: 

Instacart
50 Beale St. Suite 600
San Francisco, California 94105

We will endeavor to respond to you as soon as is practicable.