# nCino Applicant Privacy Notice Legal Information about nCino's Applicant Privacy Notice --- _Effective Date: August 31, 2026 _ nCino OpCo, Inc., the parent company, and our affiliates and subsidiary companies (collectively, “**nCino**,” “**we**” or “**us**”) are committed to privacy and to transparency in our information practices. This Applicant Privacy Notice (the “**Notice**”) describes how we collect, use, disclose, and otherwise process the personal data we collect about applicants and candidates (“**Applicants**”), as well as the rights and choices individuals have regarding such personal data. ## 1. Scope This Notice applies to the personal data we process about Applicants. Our collection, use, disclosure, and processing of personal data about individuals will vary depending upon the circumstances. This Notice is intended to describe our overall privacy and data protection practices with regard to Applicant personal data. **_Not covered by this Notice_**. This Notice does not apply to nCino employees, contractors or non-employee workers. It also does not apply to the personal data that we process regarding nCino customers, prospects or website visitors. **_Additional Privacy Notices_**. In some cases, different or additional notices about our data collection and processing practices may be provided and apply to our processing of certain personal data. The additional notice will control to the extent there is a conflict with this Notice, with respect to your personal data that is subject to that notice. **_Other Versions_**_. _We can make this Notice available in English, as well as a number of other languages; in the event of conflict between the English and any local language version of this Notice, this English version shall prevail. ## 2. Personal Data Collected The types of personal data we collect about you may vary depending upon the job position(s) or location, as well as the associated qualifications and responsibilities of the role you apply for and how you submit your application. The personal data requested as mandatory in your application process is required in order to assess your application for employment with us. Failure to provide any mandatory information will mean that we cannot carry out certain processes. For example, if you do not provide us with contact information or proof of qualifications, we will not be able to consider you properly for the role(s) for which you have applied. Where we ask you for personal data, we will indicate to you what information is mandatory and what is optional to provide. We collect personal data when you provide it to us, including for example through online profile creation or account registration in recruiting platforms, completion of (online) application forms in connection with your job application process and registration for employment offers on nCino’s career portal. In some cases (such as where required by law), we may ask for consent or give you certain choices prior to collecting or using certain personal data. Subject to applicable law, the personal data we may collect includes: - Identifiers: such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number or other government identifiers; - Records containing personal data, such as name, photo, contact information, education and employment history, Social Security number and other government identifiers, insurance policy number, financial or payment information, medical information, or health insurance information; - Sensitive or special personal data: such as race, ethnicity, color, sex, sexual orientation, gender identity, age, religion, national origin, disability, citizenship status, military/veteran status, marital status, trade union membership, medical condition; - Note: generally, this information is collected on a voluntary basis and is used in support of our equal opportunity and diversity and inclusion efforts and reporting obligations, or where otherwise required to comply with our obligations under law; - Location information about a particular individual when on site at any of the nCino offices; - Audio, video and other electronic data: audio, electronic, visual, thermal, olfactory, or similar information, such as, CCTV footage, photographs, and call recordings and other audio recordings (e.g., recorded meetings and webinars); - Employment and education information: professional or employment-related information and information about education history or background that is not publicly available, in addition to information you may make available on professional networking sites or platforms, such as LinkedIn; and - Any other personal data necessary or voluntarily given by you in connection with your application. **_From Third Parties_**. We may also collect certain personal data about you from third parties, including from recruiters we work with, nCino employees who may have referred you and with other third parties including where necessary to: (1) verify information about your credentials, such as education and prior employment, (2) follow-up on and contact references that you may provide, and (3) as necessary and to the extent permitted or required by applicable law to conduct background checks and screenings, including criminal background checks. **_Information We May Collect Via Automated Means or Derive About You_**. When you interact with us through our careers portal we may also collect personal data via cookies, pixel tags and other mechanisms, including IP address (and associated location information) and other information such as the type of your internet browser, your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, operating system name and version, device manufacturer and model, language, and the pages you view and links you select while using the careers portal, as well as date and time stamps associated with your usage of and activities on our careers portal. We use the information for security purposes, to facilitate navigation, and to improve, analyze and optimize the functionality of our website and careers portal. ## 3. Purposes of Collection and Processing Generally, we may use and disclose the personal data we collect about Applicants, subject to applicable law, for reviewing their qualifications for employment, reaching a hiring decision, documenting and maintaining records related to our recruitment procedures, and otherwise responding to and processing applications. We, and our third-party vendors, may use artificial intelligence or machine learning (“AI”) technologies to assist us in these efforts. In this section, we describe the purposes for which we will collect, use, disclose and otherwise process personal data. If you are applying for a role from or in the European Economic Area, Switzerland or the United Kingdom, please see Section 12.A for a description of the legal bases upon which we process your personal data. If you are applying for a role from or in the South Africa, please see Section12.C for a description of the legal bases upon which we process your personal data. - Recruiting, hiring, and evaluating applicants: to review, assess, recruit, consider or otherwise manage Applicants, including: - scheduling and conducting interviews; - identifying potential Applicants, including by working with external recruiters; - reviewing, assessing and verifying information provided to conduct criminal and background checks, and to otherwise screen or evaluate Applicants’ qualifications, suitability and relevant characteristics; - extending offers, negotiating the terms of offers, and assessing salary and compensation matters; - satisfying legal and regulatory obligations; - communicating with Applicants regarding their applications and about other similar position(s) for which they may be interested; - maintaining Applicant personal data for future consideration; and - in support of our equal opportunity employment policy and practices. - Security and monitoring: to monitor and secure our resources, network, premises and assets, including: - monitoring for, preventing and investigating suspected or alleged misconduct or violations of work rules; - monitoring for, preventing, investigating and responding to security and privacy incidents; - providing and managing access to physical and technical access controls; - monitoring activities, access and use to ensure the security and functioning of our systems and assets; - securing our offices, premises and physical assets, including through the use of electronic access systems and video monitoring; and - conducting appropriate screenings of individuals prior to entering or accessing certain locations or premises. - Auditing, accounting and corporate governance: relating to financial, tax and accounting audits, and audits and assessments of our business operations, security controls, financial controls, or compliance with legal obligations, and for other internal business purposes such as administration of our records retention program. - Mergers and acquisitions and other business transactions: for planning, due diligence and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions. - Defending, protecting, and asserting rights: to protect, defend and assert our rights and interests and those of third parties, including managing and responding to employee and other legal disputes, to respond to legal claims or disputes, and to otherwise establish, defend, assess, assert or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties. - Complying with legal obligations: relating to compliance with applicable legal obligations (such as hiring eligibility, responding to subpoenas and court orders) as well as assessments, reviews and reporting relating to such legal obligations, including under employment and labor laws and regulations, Social Security and tax laws, environmental regulations, workplace safety laws and regulations, and other applicable laws, regulations, opinions and guidance. - Health and safety: for health and safety purposes, including conducting appropriate screenings of Applicants prior to entering or accessing certain locations or premises. - Consideration for other positions: we may, in accordance with applicable law and our records retention program, save your personal data and use it for the purpose of considering whether you may be a suitable Applicant for other job opportunities at nCino or, where appropriate, notifying you about new job opportunities you may be interested in. **Special Categories of Personal data**. Subject to applicable law, personal data may also include sensitive or special personal data, also referred to as “special categories of personal data” such as: physical or mental health personal data and other special categories of personal data such as the commission or alleged commission by you of any offense; and any proceedings for any offense committed or alleged to have been committed by you, the disposal of those proceedings or the sentence of any court in those proceedings. Processing such sensitive personal data will, where required by law, rely on the legal bases identified in Section 12A. nCino may use Artificial Intelligence (AI) tools during the hiring processes. Certain jurisdictions may consider use of some of these tools to be “automated decisionmaking” or a similar term. We will provide you with separate notice of these tools in accordance with applicable law. ## 4. Disclosures of Personal Data We may disclose the personal data we collect to third parties, as reasonably necessary for the purposes described above and as otherwise directed or consented to by you, including: - Vendors and service providers: to our service providers, processors and others who perform functions on our behalf. These may include, for example, IT and hosting providers, help desk, payment processors, analytics providers, consultants, banks involved in processing reimbursements or with accountants, auditors, lawyers, and other outside professional advisors. These parties may use AI tools to perform some or all of the services on our behalf. - Subsidiaries and affiliates: to our affiliates or subsidiaries, who will use and disclose this personal data in accordance with the principles of this Privacy Notice, including sharing relevant news, information and offers with you. Where required by applicable law, we will obtain your consent to such sharing. - Business transfers: as part of any actual or contemplated merger, sale, and transfer of our assets, acquisition, financing or restructuring of all or part of our business, bankruptcy or similar event; and prior to the completion of such a transfer, where necessary for due diligence or to plan for the transfer, such as to lenders, auditors, and third-party advisors, such attorneys and consultants, where permitted by law. - Legal process: where we are required to do so by law or legal process (e.g., to law enforcement, courts or others, in response to a subpoena or court order) or to cooperate with requests from law enforcement or regulatory agencies. - Protect our rights: where we believe it necessary to respond to claims asserted against us or; enforce or administer our agreements or other legal rights; for fraud prevention, risk assessment, investigation, and to protect the rights, property, or safety of us, our clients and customers or others; for purposes related to litigation and other legal claims or proceedings in which we are involved; and for our internal accounting, auditing, compliance, recordkeeping, and legal functions. - Business transfers: as part of any actual or contemplated merger, sale, and transfer of our assets, acquisition, financing or restructuring of all or part of our business, bankruptcy or similar event; and prior to the completion of such a transfer, where necessary for due diligence or to plan for the transfer, such as to lenders, auditors, and third-party advisors, such attorneys and consultants, where permitted by law. Text Messaging: All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services and other legal process requests. Unless required by law, text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the Text Message services. ## 5. International Transfers of Personal Data nCino is headquartered in the United States. We and our vendors have operations in multiple jurisdictions, and our business processes and technical systems may operate across borders. Your personal data may be transferred to and processed in the United States and elsewhere, where our affiliates and vendors are located, and it may be subject to the laws and requests from law enforcement authorities in these jurisdictions. The United States and other countries may not have equivalent data protection laws as the country from which you provided the personal data. We will take steps to ensure that your personal data receives an adequate level of protection in the jurisdictions in which we transfer or process it. Where the GDPR or Brazil, Swiss or UK data protection laws apply, this generally includes entering into the EU standard contractual clauses for data transfers where required by applicable laws. In addition, nCino complies with EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Privacy Framework (the "Data Privacy Frameworks") as set forth by the U.S. Department of Commerce. nCino certified to the U.S. Department of Commerce that it complies with the Data Privacy Frameworks regarding the collection, use, and retention of personal data transferred from the European Union, UK, and Switzerland to the United States. If there is any conflict between the terms in this privacy policy and the Data Privacy Framework (DPF) Principles, the Data Privacy Principles shall govern. To learn more about the DPF program, and to view our certification, please visit [https://www.dataprivacyframework.gov/](https://www.dataprivacyframework.gov/). In compliance with the DPF, nCino commits to resolve inquiries and complaints about our collection or use of your personal data. EU, UK, and Swiss individuals with inquiries or complaints regarding our DPF practices should first contact nCino using the information in the "How to contact us" section, below. If you do not receive a timely response of if you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at [https://feedback-form.truste.com/watchdog/request](https://feedback-form.truste.com/watchdog/request). Under certain conditions, more fully described on the DPF website ([https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-](https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf)[Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf](https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf)), you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted. The Federal Trade Commission has jurisdiction over nCino's compliance with the DPF. ## 6. Retention of Personal Data Generally, we retain your personal data as long as necessary to fulfil the purposes outlined in this Notice unless you otherwise consent to a longer retention period or a longer period is required or permitted by local law or necessary to protect our legal interest. Please note that we may continue to retain your personal data if you have provided information in other applications that have been submitted or are in progress. Further, if we elect to make you an offer of employment, or if you are hired, your personal data may be incorporated into nCino’s human resources system and will become part of your human resources file which may be used for other employment and/or work-related purposes. ## 7. Security We have implemented safeguards that are intended to protect the personal data we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security. ## 8. Privacy Choices and Rights You may have certain privacy rights under applicable privacy laws, including (subject to certain limitations) the right to access and review your personal data held by us, to request the amendment of incomplete or inaccurate information, to request deletion of certain personal data, and to lodge a complaint regarding our privacy practices. In addition, residents of certain jurisdictions may be entitled to additional rights under the laws of those jurisdictions, as set forth in Section 15. Additional Privacy Information for Certain Jurisdictions below. **If you are a resident of a U.S. state with privacy laws including California, please review Section 15B.** You may submit a request to us to exercise your privacy rights, as applicable, by submitting your request via nCino’s [Privacy Request Center](https://preferences.ncino.com/). We will respond to your request as required under applicable privacy law and will request that you provide certain information to enable us to verify you and your request. Your right to access, correct and delete the personal data that nCino holds about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of your personal data. ## 9. Updates to Notice nCino may change or update this Notice at any time. If we make material changes to our processing of your personal data we will endeavor to notify you in advance, such as by posting notice on our careers portal or sending you notice via email. ## 10. Controller / Responsible Entity The responsible party (the “controller” or “business”) for your personal data will be the nCino entity who is the employer for the position(s) for which you have applied, together with nCino OpCo, Inc. You can contact nCino as set forth in the “Contact Us” section below. ## 11. Contact Us nCino has appointed a Data Protection Officer. Any questions, inquiries, complaints, and requests related to this Notice can be directed to us by submitting a request through our Privacy Preference Center, available at: [https://preferences.ncino.com](https://preferences.ncino.com), by email at [privacy@ncino.com](mailto:privacy@ncino.com), or by mail at: nCino OpCo, Inc. 6770 Parker Farm Drive Wilmington, NC 28405 USA ## 12. Additional Information for Certain Jurisdictions This section includes additional information as required under the privacy laws of certain jurisdictions. ## A. EEA, UK, Swiss and Brazilian Residents Subject to the conditions set out in applicable law, individuals in the European Union/European Economic Area, United Kingdom, and Brazil (as well as in other jurisdictions where similar rights apply) have the following rights regards our processing of their personal data: - Right of access: to confirm whether we are processing your personal data and to receive a copy of that personal data (along with certain other details). - Right to correction (rectification): to request that we correct any personal data we hold about you that is inaccurate or incomplete. - Right to erasure: to request that we delete your personal data under certain circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). (NOTE: If you request that we delete your personal data, we may do so by deleting your account(s) with us.) Brazilian Users may also request the anonymization, blocking, or erasure of unnecessary or excessive personal data, or personal data processed in violation of the LGPD. - Right to restrict (block) processing: to request that we restrict the processing of your personal data under certain circumstances, such as where you contest its accuracy or object to our use or stated legal basis. - Right to data portability: to receive a copy of personal data we have obtained from you in a structured, commonly used, and machine-readable format and to reuse it elsewhere or to ask us to transfer it to a third party of your choice, under certain circumstances. - Right to object: to object to our processing of your personal data on the basis of our legitimate interests, in which case, we must stop such processing unless we have compelling legitimate grounds that override your interest or where we need to process it for the establishment, exercise, or defense of legal claims.** **Where we are relying on our legitimate interests (other than marketing), we believe that we have a compelling interest in such processing, but we will individually review each request and related circumstances. - Right to object to marketing: to request that we stop processing your personal data for marketing purposes, on the basis of our legitimate interests. If you do so, we will stop such processing for our marketing purposes. - Right not to be subject to automated decision making: to not be subject to a decision when it is based on automatic processing if it produces a legal effect or similarly significantly affects you, unless it is necessary for entering into or performing a contract between us. - Right to withdraw your consent: where you have consented, to withdraw your consent to our processing of your personal data, without affecting the lawfulness of our processing prior to the withdrawal of your consent. Brazilian Users also have the right to be informed about the consequences of denying or withdrawing consent. - Right to lodge a complaint: to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes the law. - Digital legacy: if you are an Applicant in France, you also have the right to issue directives relating to the disposition of your personal data after your death. Please note that some of these rights may be limited, such as where we have an overriding interest or legal obligation to continue to process the data. Please contact us using the information set out in Section 11. Contact Us, if you wish to exercise any of your rights or if you have any inquiries or complaints regarding the processing of your personal data by us. **Legal Bases Under Certain Data Protection Laws**. We collect, use and otherwise process personal data for the legal bases described below, pursuant to the GDPR, UK data protection laws and similar data protection laws, as applicable. When we process Applicant personal data, generally, we rely on the following legal bases: - Entering or performing a contract: in order to take steps to assess your suitability for the vacancy prior to entering into an employment contract (necessary for hiring decisions). - Necessary for assessment of working capacity: the processing is necessary for the assessment of your working capacity, medical diagnosis, or for the provision of health or social care or treatment. - Our legitimate interest: where it is necessary to serve our legitimate interests, and your interests and fundamental rights do not override those interests. Legitimate interest, as used herein, means our interest in hiring qualified and appropriate people, to find the right candidate for future vacancies and to secure, defend and develop our business. - Necessary to comply with a legal obligation: where we need to comply with a legal obligation under UK, EU or EU Member State law to which we are subject (including reviewing eligibility for work, addressing occupational health issues). - Establish, defend and protect legal rights: where processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or nCino in the field of employment law, socialsecurity and social protection law and there is no reason to believe that you have an overriding legitimate interest in not processing the Applicant’s personal data. - Your consent: where we have your free and explicit consent, for example, if you choose to provide the personal data to us voluntarily. You may withdraw your consent at any time as set forth in the “What are your rights” section below.For sensitive personal data, we rely (where applicable) on the following legal grounds: - Necessary to comply with a legal obligation: to carry out legal obligations in the field of employment law, disability and social protection law, as well as complying with regulations, for example making reasonable adjustments for Applicant disabilities and implementing health and safety measures; - Necessary for assessment of working capacity: for the purposes of occupational medicine or the assessment of your working capacity, to the extent permitted by applicable laws, for example undertaking health assessments; - Necessary to establish, defend and protect legal rights: where necessary to establish, exercise or defend legal rights, for example conducting litigation; - With your explicit consent_: _In some cases, your explicit consent, but only where your participation in an activity is entirely voluntary.In exceptional circumstances, we may also process personal data (including sensitive data) where necessary to protect your vital interests. ## B. California & Other State Residents This Section 12.B describes nCino’s collection and use of personal data from Applicants who are residents of certain states that have enacted privacy laws that apply to employees, contractors, and other acting in a business context, such as California, ( “**Certain State Applicant**”) and is intended to satisfy our applicable notice requirements under each state’s applicable privacy laws including the California Consumer Privacy Act (“**CCPA**”) (collectively, ”**State Privacy Laws**”). We may provide California Applicants additional notices about our data collection practices that are covered by other laws (e.g., if we conduct a background check). This Section 12.B does not address or apply to personal data that is exempt under State Privacy Laws including consumer credit reports and background checks, publicly available data, or other information that is exempt under State Privacy Laws. It also does not apply to the personal data we collect from customers and clients, subject to nCino’s Privacy Statement available at [https://www.ncino.com/privacy-statement](https://www.ncino.com/privacy-statement). **Categories of Personal Data that We Collect and Disclose**. Our collection, use and disclosure of personal data about Certain State Applicants will vary depending upon the circumstances and nature of our interactions or relationship with such residents. In the table below we describe the categories of personal data we may collect about Certain State Applicants (including the categories of personal data that we have collected about Certain Applicants in the past twelve (12) months), as well as the categories of third parties to whom we may disclose such information for a business or commercial purpose. In addition, we may disclose any of the categories of personal data we collect about you to other third parties as directed by or consented to by you, or where necessary to fulfill your specific requests. In some cases (such as where required by law), we may ask for consent or give you certain choices prior to collecting or using certain personal data. **Categories of Personal Data** **Third Party Disclosures for Business or Commercial Purposes** **Identifiers**: such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number or other government identifiers. service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Paper and electronic records**: records containing personal data, such as name, signature, photo, contact information, education and employment history, Social Security number and other government identifiers, insurance policy number, financial or payment information, medical information, or health insurance information. service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Characteristics of protected classifications under California and federal law**: such as race/ethnicity, gender, sex, veteran status, disability, and other characteristics of protected classifications under California or federal law. (Note: generally, this information is collected on a voluntary basis and is used in support of our equal opportunity and diversity and inclusion efforts and reporting obligations, or where otherwise required by law. ) service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Location data**: location information about a particular individual while on or in any of nCino premises or offices. service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Audio, video and other electronic data**: audio, electronic, visual, thermal, olfactory, or similar information, such as CCTV footage, photographs, and call recordings and other audio recording (e.g., recorded meetings and webinars). service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Employment information**: professional or employment-related information, including information you may make available on professional networking sites or platforms, such as LinkedIn. service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Education information**: information about education history or background that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99). service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Sensitive Personal Data**. We may collect limited ‘sensitive personal data’ (as defined by State Privacy Laws) from Applicants, including: (a) Social Security number and other government identifiers (e.g., as part of the application and verification process); and (b) health and disability information (e.g., as necessary to provide reasonable accommodations). service providers advisors and agents recruiters third party screening companies affiliates and subsidiaries regulators, government entities and law enforcement others as permitted or required by law **Sources of Personal Data. **In general, we may collect the categories of personal data identified in the table above from the following categories of sources: - Directly from the individual; - Recruiters and recruiting platforms; - Employee referrals; - Publicly-available information and sources; - Former employers; - Our service providers, representatives and agents; - References you provide; and - Data brokers and public data sources. **Purposes for Collecting, Using, Disclosing and Processing**. As described in more detail in Section 3 (“ Purposes of Collection and Processing”) and Section 4 (“Disclosures of Personal data”), we collect, use, disclose and otherwise process personal data (including sensitive personal data) for the following business or commercial purposes or as otherwise directed or consented to by you: - Recruiting, hiring, and evaluating applicants; - Security and monitoring; - Auditing, accounting and corporate governance; - Mergers and Acquisitions and other business transactions; - Defending, protecting and asserting rights; - Complying with legal obligations; - Health and safety; and - Consideration for other positions. We do not “sell” or “share” personal data, including sensitive personal data, of Applicants as defined in applicable State Privacy Laws. Accordingly, we do not have actual knowledge that we “sell” or “share” personal data of consumers under the age of 16. **Sensitive Personal Data**. Notwithstanding the purposes described above, we do not collect, use or disclose sensitive personal data about Certain State Applicants beyond the purposes authorized by State Privacy Laws (for example, pursuant to Cal. Code Regs. tit. 11, § 7027(l) (2022)). Accordingly, we only use and disclose sensitive personal data as reasonably necessary (i) to perform our services requested by you, (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents, (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, (vi) to our service providers who perform services on our behalf, and (vii) for purposes other than inferring characteristics about you. **Retention. **We retain the personal data we collect about Certain State Applicants only as reasonably necessary for the purposes described herein or otherwise disclosed to you at the time of collection. For example, we will retain your information as necessary to comply with our tax, accounting and recordkeeping obligations, as well as an additional period of time as necessary to protect, defend or establish our rights, defend against potential claims, and comply with our legal obligations. **State Privacy Law Rights. **Certain State Applicants generally have the following rights under State Privacy Laws with respect to their personal data processed by us, subject to certain limitations and exceptions. These are: - **Deletion**. The right to the deletion of their personal data that we have collected, subject to certain exceptions. - **Know/access**. The right to know what personal data we have collected about them, including the categories of personal data, the categories of sources from which the personal data is collected, the business or commercial purpose for collecting, selling, or sharing personal data, the categories of third parties to whom we disclose personal data, and the specific pieces of personal data we have collected about them. This also includes a right to know about our use of AI tools that are considered “automated decisionmaking technologies” that make a significant decision about consumers. - **Correction**. The right to correct inaccurate personal data that we maintain about them. - **Limit use/disclosure of sensitive personal data**. The right to request that we limit certain uses and disclosures of sensitive personal information. However, as discussed above, we do not use or disclose Applicant personal data beyond the purpose authorized by State Privacy Laws. - **Non-discrimination**. The right not to be subject to discriminatory treatment for exercising their rights under State Privacy Laws. **Submitting Requests. **Certain State Applicants may exercise their rights under State Privacy Laws by submitting a request via nCino’s [Privacy Request Center](https://preferences.ncino.com/). We will take steps to verify your request by matching the information provided by you with the information we have in our records. Your request must: - Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal data or an authorized representative. - Describe your request with sufficient details that allows us to properly understand, evaluate, and respond to it. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual through one of the above methods; authorized agents will be required to provide proof of their authorization and we may also require that the relevant individual directly verify their identity and the authority of the authorized agent. ## C. South African Applicants These additional provisions apply to individuals applying for a position in South Africa and shall be read together with the provisions of the Privacy Notice above. **Responsible Party**. The responsible party is nCino South Africa (Pty) Ltd with the following address: 04-121 WeWork The Link, 173 Oxford Road, Rosebank, Gauteng 2196. For any questions about this privacy notice, please contact the information officer at [privacy@ncino.com.](mailto:privacy@ncino.com) **Special personal data. **We will only process your special personal data with your consent, where it is necessary for the establishment, exercise or a defence of a right or obligation in law, or on any other justifiable ground as contained in the Protection of Personal Information Act 4 of 2013 (**POPIA**). **Legislation**. Legislation in terms of which personal data may be required to be processed includes: - the Employment Equity Act (e.g., preventing unfair discrimination; compliance with affirmative action requirements, if applicable; etc.); - the Occupational Health and Safety Act (e.g., ensuring a safe work environment; ensuring compliance with applicable regulations); and - the Income Tax Act (e.g., compliance with PAYE requirements). **International Data Transfers. **Your personal data may in appropriate circumstances be transferred outside of South Africa. In circumstances where the recipient entity is not subject to a law that requires the processing and protection of personal data in a manner similar to what is contained in POPIA, we will ensure that the recipient is subject to binding corporate rules or a binding transfer agreement that ensures adequate protection. **Your rights. **You shall have the following rights: - the right to establish whether we hold your personal data; - the right to request access to your personal data (subject to the provisions of the Promotion of Access to Information Act); - the right to request the correction, destruction or deletion of personal data; - the right to object, in appropriate circumstances, to the processing of information; - the right to submit a complaint to the Information Regulator regarding alleged interference with the protection of your personal data; and - the right to institute civil proceedings regarding the alleged interference with the protection of your personal data. Should you wish to exercise your right to request access to, or the correction, destruction or deletion of, your personal data, or to object to the processing of your information, you are required to submit your request in writing to the Information Officer. Depending on your request, we may require you to complete the relevant form prescribed by the POPIA Regulations. --- [View sitemap](https://www.ncino.com/api/markdown/sitemap)