California Privacy Notice

California Privacy Notice

This California Privacy Notice (the “Notice”) explains the obligations of Cornerstone OnDemand, Inc. (“Cornerstone” or “we”) under California law regarding the collection, use, and disclosure of personal information (“PI”) for California residents. Effective September 30, 2025, this Notice supplements our general Website Privacy Policy and will prevail in case of any conflict related to California Consumer Privacy Act (“CCPA”) requirements.References to “Website” refer to www.cornerstoneondemand.com.

Please note that this Notice does not apply to the use of Cornerstone’s software applications or services.If you are affiliated with a Cornerstone customer, contact your organization directly.

Information We Collect

We collect PI as defined by the CCPA, including identifiers like name, email, phone number, company details, job information, and data from event registrations or website visits. Sources include direct interaction with users, third parties, vendors, and online activity.

Purposes for Which We Collect, Use and Disclose Your Personal Information

We may collect, use, and disclose your PI for any of the following purposes:

1. To fulfill or meet the purpose for which you provided the PI, or a purpose reasonably associated with the context in which you provided the PI and consistent with reasonable consumer expectations.
2. To address consumer inquiries, including requests for information, through methods such as website chat and phone calls.
3. To comply with our contractual obligations to our marketing partners and vendors.
4. To embed and display video content hosted on third-party platforms.
5. To enable user interaction with hosted video content.
6. To improve user experience on our Website.
7. To understand the demographics of our Website visitors.
8. To debug, identify, and repair errors that impair existing intended functionality of our Website.
9. To protect against malicious or illegal activity and prosecute those responsible.
10. To verify and respond to consumer requests.

Do We Sell Your Information?

We do NOT and will not sell or share your PI in exchange for monetary consideration. However, we may share some of your PI with third parties for other valuable consideration, as noted below.

We may share your PI for the following business or commercial purposes:

1. To improve your experience on our Website.
2. To send you advertisements that are tailored to your interests.
3. To generate leads for advertising and marketing.
4. To fulfill contractual obligations with our vendors.

Other than these exceptions, we do not and will not disclose your PI to any third party in exchange for monetary or other valuable consideration or share your PI for cross-context behavioral advertising.

Sharing PI

Service providers, Cornerstone subsidiaries, authorized contractors, external advisors, and government authorities may receive PI as required to provide services or fulfill legal requests.

Co-Branded Services

From time to time, we may enter into an arrangement with another entity that is not owned by or affiliated with us to provide additional features on the Website. These arrangements may include business partners, sponsors, and co-branded online services (referred to here as “co-branded services”). Any information, including PI, that you provide on one of these co-branded services may be shared with these partners. By participating in activities or providing your PI on these co-branded services, you consent to our providing your PI to those partners. Separate privacy policies may apply to these partners’ uses of your PI.

Third Party Vendors

We may use other companies and individuals to perform certain functions on our behalf. Examples include administering e-mail services and running special promotions. Such parties only have access to the PI needed to perform these functions and may not use or store the PI for any other purpose.

Retention of Personal Information

We will retain each category of PI in accordance with our established data retention policy and practice. In deciding how long to retain each category of PI that we collect, we consider many criteria, including but not limited to the business purposes for which the PI was collected; relevant federal, state and local recordkeeping laws; applicable statute of limitations for claims to which the PI may be relevant; and legal preservation of evidence obligations.

Per our data retention procedures, on an annual basis we review PI held to determine if the business purposes for collecting the PI, and legal reasons for retaining the PI, have both expired. If so, we will purge the PI in a secure manner.

California Consumer Rights

Under the CCPA, you have the following rights regarding your PI, which can be exercised directly or, in certain cases, through an authorized agent:

Right to Know

You may request, (1) the categories of PI we have collected about you, (2) the categories of sources from which the PI was collected, (3) the business or commercial purpose for collecting, selling, or sharing this PI, (4) the categories of third parties with whom we share or have shared your PI, (5) as applicable, the categories of PI that we have sold or shared about you and the categories of third parties to whom the PI was sold or shared, by category or categories of PI for each category of third parties to whom the PI was sold or shared, (6) the categories of PI that we have disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose, and (7) a list of the specific third parties to whom we sell personal data.

Right to Access

You may receive a copy of the PI you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your PI to another person.

Right to Portability

You may receive a copy of the PI you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your PI to another person.

Right to Confirm

You may confirm if we are processing your PI and to access your PI, as just stated above.

Right to Delete

You may request that we delete PI that we collected from you, subject to certain exceptions.

Right to Correct

You may request we correct inaccurate PI (to the extent such an inaccuracy exists) that we maintain about you.

Right to Opt-Out

You have the right to opt-out of certain uses or disclosures of your PI, including opting out of the selling of your PI or the sharing of such PI for cross-context behavioral advertising purposes. To learn more about this right and how to exercise it, please refer to the detailed discussion in the section below.

Right to Non-Discrimination

You have the right to not be discriminated against or retaliated against for exercising any of the above rights.

Right to Appeal

You have the right to appeal our refusal to take action on a request.

Notice of Right to Opt-Out of Profiling, Automated Decision Making, and Targeted Advertising

You may have the right to opt out of targeted advertising and selling of your data. You may submit a request to exercise this right by submitting a request through one of the two options provided in the “Submitting a Consumer Request” section below.

We may create a profile regarding your interests and preferences for our products and services including your potential to purchase a product or service. For job applicants or independent contractors, we may create a profile regarding predispositions, behavior, attitudes, intelligence, abilities, and aptitudes for recruiting and hiring assessments and decisions. You may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

Submitting a Consumer Request

You can submit any of the above types of consumer requests through either of the options below:

• Submit an email to dpo@csod.com
• Via postal mail at the Contact Us mail address below

How We Will Verify That It Is You Submitting the Request

When you submit a request through one of the methods provided, we will need to confirm and verify your identity.

We will ask you to provide some information to verify your identity and respond to your request.During verification, we will only request the minimum PI necessary to correctly identify you for the purpose of fulfilling your request.

We may decline a request to exercise the rights described above, when we are unable to verify your identity or locate your PI in our systems. If we are unable to comply with your request, we will explain the reasons for declining to comply with your request.

Designated Authorized Agent

You may have the right to designate an authorized agent to submit one of the above requests on your behalf. To do so, you must either (a) execute a valid, verifiable, and notarized power of attorney or (b) provide other written, signed authorization that we can then verify. We maintain the right to deny any request from an authorized agent that does not submit sufficient proof that they have been authorized by you to act on your behalf.

Updates

This Notice may be updated at any time. Please review periodically.

Contact Us

Email: dpo@csod.com

Website: www.cornerstoneondemand.com

Mail:

Cornerstone OnDemand, Inc.

Attention: Legal Requests

1601 Cloverfield Blvd, 600S

Santa Monica, CA 90404