ThoughtSpot® Candidate Privacy Notice

Effective as of September 8, 2023

ThoughtSpot, Inc. and its subsidiaries (collectively “ThoughtSpot”, “we”, “our”, or “us”) is committed to protecting your privacy and Personal Data (as defined below). This Candidate Privacy Notice (“Notice”) covers our privacy practices with respect to the collection and use of information obtained or produced when you apply for a job or other role with us or participate in the recruitment process (“Personal Data”) and the rights you have in connection with that information.

What Personal Data ThoughtSpot Collects

ThoughtSpot collects Personal Data directly from you, as a job applicant, or may receive Personal Data from third parties, for example, in connection with a background, employment, or reference check, subject to your consent where required by law. Personal Data excludes anonymous or de-identified data that is not associated with a particular individual.

Data We Collect Directly From You

We may collect, store, and process the following categories of Personal Data directly from you, in connection with our application and recruiting activities:

• Identifiers, such as name, contact details (e.g., addresses, telephone numbers, and email addresses), and username and password for the recruitment system;
• Professional or employment-related information, such as work history and other relevant experience including information contained in a resume, CV, cover letter, or job application. This also includes information related to previous applications to, or previous employment with, ThoughtSpot as well as information for ThoughtSpot to determine:
  • Your legal right to work in the applicable jurisdiction (including visa status);
  • Whether you are open to relocation;
  • How you learned about the position;
  • Any non-competition or non-solicitation obligations that you may have that could impact your ability to perform the role for ThoughtSpot to which you have applied; and
  • Any actual or potential conflicts of interest;
• Education background and other information provided in support of the job application;
• Protected classifications for diversity recruitment and monitoring, where the collection of such data is allowed by applicable local laws (e.g., race, ethnicity, gender, veteran status and/or disabilities); citizenship or immigration information (e.g., for proof of right to work);
• Sensitive data. Some information we collect may be considered sensitive in some jurisdictions, such as username and password for the recruitment system and sensitive information about personal characteristics (e.g., your race, ethnicity, and disability status, which may also be considered sensitive data in your jurisdiction). For example, in some countries, ThoughtSpot may ask for information such as race, ethnicity, or disability status for the purposes of monitoring equal opportunity; however, for the purposes of your application we do not require applicants to provide this information. If you provide this information, it will not be considered in the hiring or selection process. To the extent that you provide us with sensitive Personal Data (race, ethnicity, political opinions or beliefs, membership of a trade union or political party, physical or mental health information, sexual orientation or information related to criminal convictions or offenses), you expressly authorize ThoughtSpot to handle such information in accordance with this Notice;
• Internet and other electronic network activity, such as browser type and operating system, browser history, clickstream data, search history, and information regarding your interaction with a website, application, or advertisement, including access logs and other activity information related to your use of the ThoughtSpot recruitment system, the length of time you visit the ThoughtSpot recruiting system, and the referring URL, or the website that led you to the ThoughtSpot recruiting system;
• Reference information and information received from background checks;
• Information related to any assessments you may take as part of the interview screening process;
• Financial details, such as your tax status or financial account information for any reimbursements related to the recruitment process;
• Inferences, such as your preferences, characteristics, soft-skills, and behavior; and
• Other information you may choose to voluntarily submit to us in connection with your application or job interview including compensation expectations, reasonable accommodation information that you may request or share during the recruitment process, and other information collected during phone screenings and interviews.

To the extent we collect sensitive data, we do so for the purposes described in this Notice and, where required by applicable data protection or privacy law, we will obtain your consent to our use of your sensitive Personal Data.

Data We Collect From Other Sources

We may also collect the following types of Personal Data about you from other sources during the recruitment process:

• Protected classifications for diversity recruitment and monitoring, where the collection of such information is allowed by applicable local laws;
• Education information, such as educational history details collected from educational institutions you have attended or educational reporting and degree verification providers;
• Professional or employment-related information, such as employment history obtained from employment screening agencies, publicly available registers or databases, former employers and/or educational institutions (as allowed by applicable laws), and information about your performance or conduct from references, other ThoughtSpot employees, clients or service providers, or former employers; and
• Publicly available information from websites or social media including LinkedIn or other job-search platforms, including information you choose to voluntarily submit to us in connection with your application (e.g., when applying through LinkedIn).

Some of the Personal Data listed in this Notice is mandatory in connection with our recruiting activities. Failure to provide or allow us to process mandatory Personal Data may affect our ability to accomplish the purposes stated in this Notice.

As you navigate through our website, we may also collect certain information from you about your visit to our websites using "cookies" and other similar tracking technologies. For further information, please consult our Cookie Policy.

How We Use Your Personal Data

We only process your Personal Data where applicable law permits or requires it in connection with carrying out our application and recruitment process. Certain countries require us to have a legal basis to process your Personal Data. The precise legal bases might vary by country, but in general, our legal bases to process your Personal Data are: to take steps necessary to enter into an employment contract with you, to comply with a legal obligation that applies to us, for our legitimate interests (we put in place safeguards to ensure that your privacy or other fundamental rights and freedoms are not overridden by our legitimate interest) or the legitimate interests of third parties, or with your consent if applicable law requires consent. We may process your Personal Data for the following legitimate business purposes:

• Identifying and evaluating job applicants, including assessing skills, qualifications, and interests for the purposes of determining suitability for the position for which you have applied;
• Verifying your information including through publicly available information (for example, on LinkedIn or other job search platforms) and carrying out employment, background, and reference checks, where applicable, subject to your consent where required by applicable law;
• Communicating with you about the recruitment process and your application;
• Creating and submitting reports as required or permitted by applicable law;
• Complying with our legal, regulatory, or other corporate governance requirements;
• Operating, analyzing and improving our job applications, recruitment process, and database of interested individuals;
• Sending you information about other positions with the ThoughtSpot group of companies that may be of interest to you (where required under applicable law, we will obtain your consent for such communications); and
• Complying with legal obligations to which we are subject and cooperating with regulators and law enforcement bodies. For example, ThoughtSpot may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

We may also process your Personal Data for our own legitimate interests, including for the following purposes:

• To prevent fraud.
• To ensure network and information security, including preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution.

We may also deidentify or anonymize your information in such a way that you may not reasonably be re-identified by us or another party, and we may use this deidentified data for any purpose. To the extent we deidentify any data originally based on personal data, we will maintain and use such information in deidentified form and will not attempt to reidentify the data.

How We May Share Your Personal Data

ThoughtSpot does not “sell” or “share” job candidate information as those terms are defined under applicable law. ThoughtSpot may, however, disclose your Personal Data to others in limited situations as follows for our business purposes. ThoughtSpot takes appropriate steps to ensure that people who receive your information are bound to maintain confidentiality of the information. With those safeguards in place, ThoughtSpot may disclose your Personal Data to those individuals or entities described below for the following additional purposes, where permitted or required by applicable law:

• Affiliates. We may disclose your personal data to other companies that fall within the ThoughtSpot group of companies for recruitment purposes, human resource management and internal reporting. In such cases, we may disclose Identifiers Professional or employment-related information, Education information, Protected classifications, sensitive data, Internet and other electronic network activity, Financial details, Inferences, Other information and/or Publicly available information.
• Service Providers. We may disclose your Personal Data to our service providers that perform business operations for us related to recruitment process, for example, recruiters, recruitment platform hosting, background checking services as necessary in connection with recruiting, employment, identity verification and other pre-employment screening providers, payment service providers, interview travel booking and expense reimbursement providers. In such cases, we may disclose identifiers, professional or employment-related information, education information, protected classifications, sensitive data, internet and other electronic network activity, financial details, inferences, other information and/or publicly available information.
• Attorneys and Related Legal Services Providers. We may disclose identifiers, professional or employment-related information, education information, protected classifications, sensitive data, internet and other electronic network activity, financial details, inferences, other Information and publicly available information.
• Law Enforcement and Government Agencies. We may disclose your Personal Data to law enforcement agencies, courts, regulators, tax authorities, government authorities or other third parties if necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, your rights or the rights of any third party.
• Other Companies. If (i) we or our affiliates are acquired by, merged with, or invested in by another company, or (ii) if any of our assets are transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected about you to the other company. As part of the business transfer process, we may disclose certain of your information with lenders, auditors, and third-party advisors, including attorneys and consultants.

We may also share your information for additional purposes with your consent where such consent is required by law and, in rare circumstances, during emergency situations or where necessary to protect the safety of persons.

How We Secure Your Personal Data

We implement physical, administrative, and technical safeguards designed to protect your Personal Data from unauthorized access, use, or disclosure. We also contractually require that our service providers protect such information from unauthorized access, use, and disclosure. In addition, we limit access to Personal Data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access. For more information about our security practices, please visit the Trust Center at www.thoughtspot.com/legal/trust.

How Long We Retain Your Personal Data

Except as otherwise permitted or required by applicable law or regulation, we will retain your Personal Data as needed to fulfill the purposes for which it was collected. We retain this information for various reasons, including in case we face a legal challenge in respect of a recruitment decision, to consider you for other current or future jobs at ThoughtSpot and to help us better understand, analyze, and improve our recruitment processes. When we have no ongoing legitimate business need to process your Personal Data, we will either delete it, anonymize it, or securely store your Personal Data and isolate it from any further processing until deletion is possible. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent.

If you are offered and accept employment with ThoughtSpot, the Personal Data we collected during the application and recruitment process will become part of your employment record, and we may use it in connection with your employment consistent with our employee Personal Data policies. If you do not become an employee, or, once you are no longer an employee of ThoughtSpot, we will retain and securely destroy your Personal Data in accordance with our document retention policy and applicable laws and regulations. If there is any data that we are unable, for legal compliance or technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the Personal Data.

Controlling Your Personal Data

Certain jurisdictions, for example the European Economic Area and California, provide their residents certain privacy rights under applicable law. Subject to applicable local law, you may have the right to access, delete, receive a copy of, or object to or restrict the processing of Personal Data, to data portability, to request that we correct any inaccuracies or otherwise update your Personal Data, or to request an explanation of the rules governing the processing of your Personal Data.

These rights may be limited or denied in some circumstances. For example, we may retain your Personal Data where required or permitted by applicable law. As noted above, in such situations we will put in place appropriate measures to prevent any further processing or use of the Personal Data.

You may contact us to exercise your rights using the contact details in the section titled “How to Contact Us” below. We will respond to such requests in accordance with the requirements of applicable data protection laws. Please note that in order to fulfill your request, we may need you to provide certain information to verify your identity. When you or your authorized agent contacts us in connection with your Personal Data under applicable local law, we will ask you to validate your identity before fulfilling your request. Authorized agents may also be required to provide a copy of the consumer’s signed permission authorizing the agent to submit requests on the consumer’s behalf.

We will not discriminate against you if you choose to exercise your privacy rights.

Automated Decisions About You

We do not make recruiting or hiring decisions based solely on automated decision-making or profiling (as those terms are defined under applicable local laws). If we choose to rely solely on automated decision-making and that could have a significant impact on you, or you could be subject to profiling, we will apply the appropriate safeguards as may be required by applicable laws.

International Data Transfers

ThoughtSpot stores and processes any information collected in: (i) any country where we have facilities; or (ii) any country in which we engage service providers. A list of ThoughtSpot global offices is available here.

If you are a candidate from the European Economic Area, we will protect your Personal Data when it is transferred outside of the European Economic Area by:

• Processing it in a territory which the European Commission has determined provides an adequate level of protection for Personal Data; or
• Otherwise implementing appropriate safeguards to protect your Personal Data, including through the use of Standard Contractual Clauses or another lawful transfer mechanism approved by the European Commission.

If you require further information about our international transfers of Personal Data, please contact us using the contact details in the section titled “How to Contact Us” below.

California Privacy Disclosures

The California Consumer Privacy Act (“CCPA”) requires businesses to provide additional disclosures of California consumer rights relating to the sharing of, access to, and deletion of Personal Data that is collected. We may share or disclose the Personal Data listed in the section above titled “Collection of Your Personal Data” for our business purposes.

California consumers have a right to request information about the collection of your Personal Data, and access to and deletion of your Personal Data under the CCPA. We do not sell the Personal Data of California consumers and do not discriminate in response to privacy rights requests.

If you are a California consumer and you or your authorized agent would like to exercise your privacy rights, please contact us using the contact details in the section titled “How to Contact Us” below. We may need to verify your identity and place of residence before completing your rights request.

Changes to this Privacy Notice

ThoughtSpot may modify or update this Candidate Privacy Notice from time to time to reflect the changes in our business and practices, and so you may request updated versions using the section titled “How to Contact Us” below.

How to Contact ThoughtSpot

If you have any questions about this Notice or our privacy practices, please email us at [email protected], call us at (800) 508-7008, or write to us at: