Adapted PRIVACY IMPACT ASSESSMENT (Adp-PIA)

Third-Party Website or Application Name:

Yello

DoD Component Name:

National Geospatial-Intelligence Agency

This Adapted PIA (Adp-PIA) Form 2930A is intended to support the management of risk to
privacy. If it is likely that personally identifiable information (PII) will become available via a
third-party website or application (such as Facebook and YouTube), complete this form.
Complete PIA Form 2930 for all instances of electronic collection and maintenance of PII, in
accordance with DoDI 5400.16, “DoD Privacy Impact Assessment (PIA) Guidance.” Refer to
the Appendix for the definition of third-party websites or applications.

DD Form 2930A Aug 2011 Page 1 of 7


This Adapted PIA (Adp-PIA) Form 2930A is intended to support the management of risk to
privacy. If it is likely that personally identifiable information (PII) will become available via a
third-party website or application, complete this form.

(1) Describe the specific purpose of the DoD Component’s use of the third-party
website or application.

Yello is a recruitment event management software application which offers a digital experience for job seekers,
recruiters, and hiring stakeholders. Using this software would help modernize NGA processes by focusing more
jon candidate engagement and less on resume collection. The application provides a central event repository
using the Amazon Web Services (AWS) platform to plan, schedule, advertise, and engage while capturing data to
realize return on investment.

(2) Describe any personally identifiable information (PID) that is likely to become
available to the DoD Component through public use of the third-party website or
application.

First name, last name, phone number(s) and email address(es) of prospective applicants would be collected.
|Although optional, prospective applicants may also choose to provide copies of their resume/curriculum vitae
|which may contain additional Pll. Individuals can decline to provide their information, Pll or not, via Yello and opt
to apply for an NGA position via another approved method.

(3) Describe the circumstances under which PII will likely become available on the
third-party website or application.

Yello provides prospective NGA applicants an opportunity to enter their information directly into the software
application. This includes data such as first name, last name, phone number(s) and email address(es). Although
optional, prospective applicants may also choose to provide copies of their resume/curriculum vitae which may
contain additional Pll.

Data entry could occur before, during, or after recruitment events. If Yello is used before or after events,

(4) With whom will the DoD Component share PII?

Pil (First and last name, phone number(s) and email address(es), and any other addition Pll that may reside in a
voluntarily provided resume/curriculum vitae) collected by Yello Corporation will not be released or shared with
individuals outside of NGA. Within NGA only recruiters and privileged users with the required need-to-know will
Ihave access to the information via a username/password.

(5) Will the DoD Component maintain PII? If yes, for how long, and under what
circumstances?

Yello Corporation will maintain the data in a commercial AWS cloud. The default setting is for the data to continue
being maintained with no auto-archive or auto-delete feature, however NGA will choose to auto-archive all data
ino later than two (2) years after entry.

DD Form 2930A JULY 2011 Page 2 of 7



(6) Describe the means and steps by which the DoD Component will secure PII that it
uses or maintains.

Yello will maintain Pll on their AWS platform in accordance with the Yello Privacy Policy. Per that policy, they are
committed to protecting the information they receive from NGA and our data sources. Yello's privacy policy states
that they follow reasonable technical and management practices to help protect the confidentiality, security, and

integrity of data stored on their system, site, and mobile apps, including from loss, misuse, and unauthorized
disc Utoratic dor dastrintis Euirth hn i Lic totoc that thy +

(7) Describe other privacy risks that exist and how the DoD Component will mitigate
those risks.

The only known privacy risk is access management. Yello and NGA will mitigate that risk by implementing user
laccess controls. NGA recruiters and privileged users will be required to enter a username/password to access the|
data. NGA will consistently audit the list of NGA recruiters and privileged users to control proper accesses.

(8) Will the DoD Component’s activities create or modify a “system of records” under
the Privacy Act? If yes, describe.

No "system of records" will need to be created or modified in conjunction with the use of Yello.

DD Form 2930A JULY 2011 Page 3 of 7