We may collect your personal data at different stages of the recruitment process, including when we proactively source you as a potential candidate, when you submit an application, create a candidate profile, participate in interviews or assessments, attend a recruiting event, or communicate with us about potential opportunities. This information may be provided directly by you (for example, through your resume/CV, cover letter, application materials, or communications with our recruiters and hiring managers) as well as, where permitted by law, obtained from other sources such as recruitment agencies, professional networking platforms, background check providers, and references you choose to provide. Certain personal data is necessary for us to evaluate your candidacy, comply with legal and regulatory requirements, and manage our recruitment processes; if you do not provide this information, we may be unable to process your application or proceed with your consideration for a role.

If we process sensitive personal data about you, we will make sure that such processing is only as strictly required for satisfying our obligations under the applicable local laws, or to establish, defend or exercise legal claims, and/or for the provision of workplace accommodations. For more information on the categories of sensitive data we may process, see "Personal Data We Collect".

We do not share your Personal Data with third parties except with Anaplan affiliates, internal personnel on a need-to-know basis, and trusted partners or service providers acting on our behalf under strict security and confidentiality agreements. We may also share limited details, such as your name, role, and department, through our secure internal collaboration tools and workplace applications (e.g., Outlook, people management systems) to facilitate the recruitment process. Any other external disclosures will only occur where we have a valid lawful basis or a legal obligation to do so. Specifically, we may disclose your personal data to the following types of third parties:

• Recruitment agencies and job boards. To source potential candidates, manage job applications, and coordinate parts of the hiring process.
• Background check and verification providers. To conduct legally permissible screenings, including criminal history records, verification of prior education and employment, and right-to-work or work authorization verification.
• Professional networking platforms and online portals (e.g. LinkedIn). To view public career profile information, portfolio links, or professional identifiers associated with your candidacy.
• Former employers, educational institutions, and reference contacts. To verify your qualifications, degrees, certifications, and prior employment history, as well as to collect recommendations and performance feedback.
• Service providers and IT vendors. Such as third-party providers for applicant tracking systems (ATS), assessments and technical testing, video interviewing hosting, and general IT or security support.
• Authorized referrals. To process applications or prior history details shared via internal referral mechanisms.
• Government entities, regulatory bodies, or public authorities. To comply with legal obligations, verify identity documents (e.g., passports, visas, or work permits), submit mandatory regulatory reporting (such as diversity, racial/ethnic, or disability statistics where required by law), or respond to lawful requests.

Personal data may also be shared in the context of a corporate transaction (e.g., merger or acquisition)  or as required by law. We do not sell your personal data.

Depending on your location and applicable data protection laws, you may be entitled to certain rights regarding your personal data as a job candidate. You can exercise these rights by submitting a request through a Data Subject Rights request form.

• Right to access. You may request confirmation of whether we process your personal data and access it, including receiving a copy in a commonly used, machine-readable format.
• Right to rectification. You may request correction or completion of inaccurate or incomplete personal data we hold about you.
• Right to erasure. You may request deletion of your personal data, subject to exceptions like legal obligations, retention for future opportunities (unless you specifically request otherwise), or defense of claims.
• Right to data portability. You may obtain a copy of your personal data in a portable format and transmit it to another organization, where technically feasible.
• Right to restrict processing. You may request we restrict processing of your personal data in certain circumstances, such as when you contest its accuracy.
• Right to object. You may object to processing of your personal data, including for recruitment analytics or profiling.
• Right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time without affecting prior lawful processing.
• Right to object to decisions based on automated decision-making. You may object to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects and request human intervention or contest the decision.

In addition to the rights described in "Your Rights Regarding Your Personal Data", California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia permit their respective residents to request us to stop selling or sharing their personal data with third parties or for those purposes allowed by local law. If you are a resident of such states, this section applies to any personal data that we collect about you in accordance with your respective state's privacy laws.

You may request additional information about the categories of third parties to whom your personal data has been disclosed, sold, or shared (if any, and as defined under applicable law), the purposes for such activities, and the categories of personal data involved. To submit such a request, please contact us using the Data Subject Rights request form.

You have the right to Opt-out or direct Anaplan to not sell or share personal data about you to third parties, as defined by local law, or to stop doing so for the following purposes:

• Targeted advertising, cross-context behavioral advertising, or personalized advertising as defined by law in your jurisdiction;
• The sale or sharing of personal data as defined by law in your jurisdiction, or 
• If applicable, profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you

As a California, Colorado, Connecticut, Virginia, Utah, Florida, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky or Rhode Island resident, you can exercise your right to Opt-Out at any time by using the Data Subject Rights request form or updating your preferences using our Preference Center.

In Cookie Preferences, you may opt-in or out by toggling on the Sell or Share my Personal Data option. You may also opt in or out of individual categories of cookies by toggling the individual cookie categories.

As a California, Colorado, Connecticut, Virginia, Utah, Florida, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky or Rhode Island resident, you can exercise your right to Opt-Out at any time by using the Data Subject Rights request form or updating your preferences using our Preference Center.

In Cookie Preferences, you may opt-in or out by toggling on the Sell or Share my Personal Data option. You may also opt in or out of individual categories of cookies by toggling the individual cookie categories.

If you enable a universal opt-out mechanism or opt-out preference signal (as defined under applicable law), such as Global Privacy Control via your web browser or extension, we will treat it as your request to opt out of the sale or sharing of your personal data with third parties covered by "Do Not Sell or Share" laws.

Anaplan applies an opt-out by default standard for all website visitors which means no personal data is sold or shared unless you affirmatively choose to opt in through our cookie preferences. You can update your preferences anytime via Cookie Preferences by toggling off relevant settings.

We apply opt-out preferences (including for personalized advertising) to the specific device and browser sending the signal, tied to its device/browser ID. To opt out on other devices/browsers, repeat the process there. We recommend clearing cookies first, then adjusting preferences via the Cookie Preferences. If you wish to Opt-out, we recommend that you clear your cookies from your browser first and then select your cookie preferences above. Even when opted out, contextual ads (based on page content/topics) may still appear. Most browsers accept cookies by default (including from our analytics providers), but you can manage this in your browser settings.

We aim to ensure that your concerns are resolved in a timely and appropriate manner. If we fail to take any action regarding your request to exercise rights or decline to respond, you have the right to appeal, as permitted in local law. You can appeal directly or through an authorized agent by using this form. The appeal must describe your request with a detailed summary that allows us to properly understand, evaluate, and respond to it and provide the former case ticket number. Similarly, in case an appeal is denied, you have the right to contact your local Attorney General or dedicated Agency, where applicable, if you have concerns about the result of the appeal, as prescribed by applicable law. A full list of state attorneys general is available here, and the contact details of the California Privacy Protection Agency are available here.

Anaplan may use artificial intelligence, machine learning, or other automated technologies ("AI Tools") to assist our talent acquisition team with sourcing candidates and analyzing applicant data. AI Tools may review candidate details, such as skills, experience, location, and education, to determine how closely candidates match job criteria. In certain situations, AI Tools perform an initial screening based on administrative, procedural, and objective criteria. While these preliminary checks help us maintain consistency and accelerate the review process, they remain under the active supervision of our recruitment staff.

We deploy AI Tools strictly as supportive aids, not as replacements for human judgment. Anaplan does not rely solely on AI Tools to make significant employment determinations, such as final hiring choices or application dismissals. Instead, our recruiters weigh insights generated by AI Tools alongside traditional evaluation methods, including interviews and hiring manager feedback, ensuring that all final decisions involve meaningful human review. We will notify you if your application is subject to AI-assisted screening, and depending on your location, you may contact us to request an alternative evaluation process or appeal a decision you believe was made in error.

If we use third-party AI tools, we conduct due diligence and obtain assurances to ensure our vendors comply with applicable local, national, and international laws before implementation.

We have taken steps intended to maintain the security of your data and follow generally accepted standards to protect the personal data submitted to us, both during transmission and once we receive it. However, no method of transmission over the internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee its absolute security. You should understand that the open nature of the internet is such that data may flow over networks without security measures and may be accessed and used by people other than those for whom the data is intended. If you have any questions about security or any reason to believe that your interaction with us is no longer secure, please contact us at security@anaplan.com.

We retain your personal data as needed to fulfill recruitment purposes and other permitted, compatible uses, determining periods based on collection purposes, legal requirements (including employment regulations), dispute resolution, and statutory limits. If hired, your candidate data becomes part of your employment record under our employee policies and applicable laws. If you are not hired, we may retain limited personal data to consider you for future opportunities at Anaplan. You may request deletion or opt out of this practice at any time by exercising your rights by submitting a request through our Data Subject Rights request form.

In accordance with applicable laws, your personal data as a job candidate may be transferred to and processed outside your country of residence, including to Anaplan entities, affiliates, or vendors. These destinations may lack data protection laws equivalent to those in your region. We will protect your personal data in accordance with this Notice wherever it is processed. By submitting your data, you consent to these transfers and global processing.

Certain recipients (vendors and/or Anaplan related entities) who process your personal data on our behalf may also transfer personal data outside the country in which you reside. Where such transfers occur, we will implement a transfer agreement to protect your personal data. For more information on our international data transfers, agreements, and certifications, please see our Privacy Statement.

EU-U.S. transfer of personal data

When we transfer personal data out of the European Economic Area (“EEA”), Switzerland, and the UK to countries that do not benefit from an adequacy decision, as determined by the European Commission, we will rely on Standard Contractual Clauses approved by the European Commission and other contractual measures to ensure that adequate safeguards are in place with respect to the data. In addition to these measures, Anaplan complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) for transfers of personal data from the EEA, UK, and Switzerland.

Data Privacy Framework

Anaplan Inc. (hereafter “Anaplan-U.S.”) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Anaplan-U.S. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF as well as from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Anaplan-U.S. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Notice and the EU-U.S. DPF Principles or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program and to view our certification, please visit the Data Privacy Framework Program.

In compliance with the DPF, if we use your personal data for a materially different purpose than originally disclosed, or if we share it with third parties not previously identified in this Notice, we will offer you the opportunity to opt out (or opt in if required for sensitive data) before such use or disclosure.

In the context of onward transfers, Anaplan-U.S. is accountable for the processing of personal data it receives, under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. Anaplan-U.S. remains liable under the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles if Anaplan-U.S.’s agent processes personal data in a manner inconsistent with the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF Principles, unless Anaplan-U.S. proves that it is not responsible for the event giving rise to damage.

The Federal Trade Commission has jurisdiction over Anaplan-U.S.’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, Anaplan-U.S. may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Anaplan-U.S. commits to resolve DPF Principles-related complaints about our collection and use of your personal data. EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Anaplan at: privacy@anaplan.com

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Anaplan-U.S. commits to refer unresolved complaints concerning its handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States (free of charge). If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.trustarc.com/watchdog/request for more information or to file a complaint. For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S DPF, and Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website.

APEC CBPR Privacy Certification

Anaplan’s global privacy practices, described in this Notice, comply with the Asia Pacific Economic Cooperation (“APEC”) Cross Border Privacy Rules system (“CBPRs”). The APEC CBPR system provides a framework for organizations to ensure protection of personal data transferred among participating APEC economies. More information about the APEC framework can be found on the CBPR site. Our certification applies to our business processes across our global operations that process and transfer personal data to/from our affiliates around the world. To view our certification, please see the CBPRs system Compliance Directory.

If you have an unresolved privacy or data concern related to Anaplan’s APEC Certification that we have not addressed satisfactorily, please contact our U.S. based third-party dispute resolution provider (free of charge).

Global CBPR Privacy Certification

Anaplan’s global privacy practices, described in this Notice, also comply with the Global Cross-Border Privacy Rules (“Global CBPR”) System. The Global CBPR System provides an international framework for organizations to ensure the secure and compliant protection of personal data transferred among participating global economies. Our Global CBPR certification applies to our business processes across our global operations that process and transfer personal data to and from our affiliates around the world. To view our active certification, please see the TrustArc Validation Page or check our listing in the Global CBPR System Directory.

If you have an unresolved privacy or data concern related to Anaplan’s Global Certification that we have not addressed satisfactorily, please contact our U.S. based third-party dispute resolution provider (free of charge).

This Notice supplements information contained in Anaplan’s Privacy Statement and applies solely to California residents (“consumers” or “you”). Anaplan adopts this Notice to comply with the California Consumer Privacy Act of 2018 and its regulations (“CCPA”) and the subsequent California Privacy Rights Act of 2020 “CPRA”. Any terms defined in the CCPA and/or CPRA have the same meaning when used in this Notice. This Notice does not reflect our collection, use, or disclosure of California residents’ personal information where an exception under the CCPA and/or CPRA applies.

Collection of personal information

Please see the “What personal information we collect and how we collect it” section earlier in this Notice to understand the sources from which we get personal information.

We listed below categories of personal information we collect about California residents and that we have collected in the preceding 12 months. These categories correspond with the following categories listed in the CCPA’s definition of personal information:

• Identifiers: First and last name, address/billing address, telephone number, email address, user name, and IP address.
• Personal information categories listed in the California Customer Records Act (Cal. Civ. Code § 1798.80(e)): First and last name, date of birth, address, telephone number, bank account number, and other financial information.
•  Characteristics of protected classifications under California or federal law: Age, gender, diversity, and inclusion information.
• Audio, electronic, visual, thermal, olfactory, or similar information: Video and voice recordings.
• Internet or network information: Browser type, internet service provider (ISP), referring/exit pages, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system, date/time stamp, and/or clickstream data, the approximate physical location associated with your IP address.
• Professional or employment information: Your job title and organizational affiliation, professional certification details, and employment history.

Sharing of personal information

Please see the “To whom do we disclose your personal data” section earlier in this Notice to understand how we may disclose your personal information.

We only collect sensitive personal information, as the CCPA defines this term, if you voluntarily disclose it to us. Please see “How we use your personal data” above for information about the purposes for which we use your personal information.

California Rights:

If you are a California resident, you have the following rights:

• Right to Know: You may request access to personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You may only exercise your right to know twice within a 12-month period.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-out: of the “sale” or “sharing” of your personal information. We did not sell or share your personal information in the preceding 12 months, including for cross-context behavioral advertising.
• Right to Limit: the use and disclosure of sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those specified in Cal. Civil Code 1798.121(a). To exercise your California privacy rights, submit a request using one of the methods described below, and provide the information required.
• Non-Discrimination: You may not be discriminated against because you exercise any of your rights under the CCPA, in violation of California Civil Code § 1798.125. including an employee's, applicant's, or independent contractor's right not to be retaliated against for the exercise of their CCPA rights.

To exercise your California privacy rights, submit a request using one of the methods described below, and provide the information required.

To exercise any privacy rights, please submit a Data Subject Rights request or by calling +1 (833) 312-0166. For your protection, we may only process requests with respect to the personal information associated with the email address that you use to send us your request, and we may need to verify your identity before processing your request. We will respond to your requests within the timelines prescribed by applicable law.

Do Not Sell/Share My Data

California residents have the right to opt out of the “sale” or “sharing” of their personal information. Anaplan does not “sell” or “share” personal information (as defined by CCPA/CPRA), including for cross-context behavioral advertising. We obtain your consent and direction before disclosing personal information to our partners. In the preceding 12 months, we have not sold or shared California residents’ personal information, including that of minors under 16. Anaplan applies an opt-out by default standard for all website visitors - no personal information is sold or shared unless you affirmatively choose to opt in through our cookie preferences. You can update your preferences anytime via Cookie Preferences by toggling off relevant settings.

Verification

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may designate an authorized agent by taking the steps outlined under "Authorized Agent" further below. In your request or in response to us seeking additional information, you, or your authorized agent, must provide sufficient information to allow us to reasonably verify that you are, in fact, the person whose personal information was collected which will depend on your prior interactions with us and the sensitivity of the personal information being requested. We may ask you for information to verify your identity and, if you do not provide enough information for us to reasonably verify your identity, we will not be able to fulfil your request. We will only use the personal information you provide to us in a request for the purposes of verifying your identity and fulfilling your request.

We may modify or update this Notice from time to time to reflect changes in our practices, legal requirements, or operations. The most current version will always be posted here, with a revision date at the top to indicate when updates were made.

Changes become effective upon posting. We encourage you to review this Notice periodically. Continued engagement with our recruitment process after updates constitutes your acceptance of the revised terms. For questions or concerns, contact us at privacy@anaplan.com.