Applicant, Employee, and Independent Contractor Privacy Notice

Updated: June 22, 2023

Scope
This Privacy Notice applies to personal information of all current and former employees, officers, directors, contractors, agents contingent and other personnel (collectively, “Workers”) of Model N, and their emergency contacts and beneficiaries, whose personal information we process in the course of our business in the course of our Human Resources Operations, from submission of an application, throughout the course of an individual’s employment, and following employment (collectively, the “Human Resources Operations”).

Workers, emergency contacts and beneficiaries with disabilities may access this notice in an alternative format by contacting legal@modeln.com.

The terms “Model N,” “we,” “us,” and “our” include Model N, Inc. and our affiliates and subsidiaries. This Privacy Notice explains the kinds of information we may collect about you during the preceding 12 months, how we may use and share that information, and how you may be able to opt-out of a use or correct or change such information. If you are a resident of the European Economic Area (“EEA”), please see our Data Privacy Framework (DPF) for more information about your personal information and rights.

Notice at Collection Rights

At or before the time of collection, applicable law, such as the California Privacy Rights Act (“CPRA”), may provide a right to receive notice of our privacy practices, including the categories of personal information to be collected during the preceding 12 months, the purposes for which such information is collected or used, whether such information is sold or shared, and how long such information is retained. You can find those details in this notice below.

CPRA provides California residents with the right to know: (1) what categories of personal information Model N has collected about them during the preceding 12 months; (2) the categories of sources from which the personal information is collected; (3) the business or commercial purposes for collecting, selling or sharing personal information; (4) the categories of third parties to whom personal information is disclosed; (5) the categories of personal information sold or shared for purposes of cross-context behavioral advertising in the preceding 12 months; (6) the categories of personal information disclosed for business purposes in the preceding 12 months; and (7) a description of CPRA rights and how to exercise those rights. California residents can find this information below:

Categories of Sources from which Personal Information is Collected

Personal Information We Collect from You Directly or Someone Providing Personal Information on your Behalf

We may collect the following personal information that you provide, or someone on your behalf provides, to us:

• General HR Information. This may include your name, alias, postal address, phone number, unique personal identifier, online identifier, email address, date of birth, age, passport number, driver’s license number, Social Security number or other government-issued identification number, employment history, education information and records, professional qualifications, salary information, financial information related to credit checks, bank account number, routing number, and other details required for payroll, information that may be recorded on a resume/CV or application form (such as education history, education records such as grades and transcripts, and employment history), language abilities, records of personal property, business or professional licenses and insurance information and motor vehicle records, and contact information of third parties in case of an emergency.
• Demographic and Health Information. We may also collect sensitive personal information such as details of health and disability, including details regarding your COVID-19 tests and vaccinations, health insurance information, mental health, medical leave, and maternity leave, national origin, or immigration status. Where permitted by law, we may also ask Workers for optional information like race, disability, marital status, sex, ethnicity, gender, or military and veteran status.
• Performance Information. We may also receive or collect other information to help evaluate your performance, such as information provided by you during performance reviews. We may also collect job assignments, work schedule, hours worked, accomplishments and awards, training and development information, discipline and counseling information, opinions, evaluations, and information provided to us from other Workers as part of this review process.
• Communications with Us. We may collect personal information such as personal contact information when a Worker or dependent communicates with us, for example to inquire about employee benefits.
• Posting on Intra-company Sites. We may offer intra-company accessible sites, pages, messaging channels, blogs, or forums for Workers to communicate and collaborate with each other, like Slack or Zoom (“Intra-Model N Sites”). We and other individuals who use the Intra-Model N Sites may collect the information you submit or make available through these sites. If you choose to make content available on any public area of the Intra-Model N Sites, such content will be visible to other Workers and not subject to the privacy protections set forth here in this notice.
• Surveys and Promotions. From time to time, we may ask Workers and/or dependents to participate in optional surveys. If you decide to participate, you may be asked to provide certain information, which may include personal information. In addition, we may also run optional Worker and dependent promotions and contests. It’s possible that you may be asked to provide certain information to participate, which may include personal information.
• Contests. Occasionally, Model N may run contests. We ask those who participate to provide information relevant to the contest.
• Legal Information. We also collect contractual information, such as information necessary to comply with legal and contractual obligations, exercise legal and contractual rights, and initiate or respond to legal claims.
• Personal Information about Dependents or Other Family Members. We may collect information about your dependents under the age of eighteen or other family information if you voluntarily provide such information in connection with the enrollment and administration of benefits, or for other human resource purposes involving such dependents.

Personal Information We Collect Automatically.

We may collect personal information about you through your use of Model N’s property, equipment, systems, or applications:

Please note that you have no expectation of privacy while at Model N premises or using Model N information technology systems, networks, and electronic communication tools.

• Device Information. Like most companies, we receive information like your internet protocol (IP) address, your location based on your IP address or activities, identifiers associated with your computer or device, cell phone-related information, activity logs, browsing history, search history, information regarding your interaction with a website, and other information about activities you engage in while working with us, and on our equipment, accounts, systems, and networks.
• System Monitoring. We may monitor and review the use of Model N equipment, accounts, information technology systems and networks. Model N may also access and review electronic files, messages, and emails sent or stored on its information technology systems and hardware.

Note that this Privacy Notice does not establish, and should not be construed to mean, that all Workers will have access to, or will participate in, the systems, networks, data, programs, and other business activities described in this Privacy Notice.

• CCTV Footage. Model N may monitor its premises using CCTV cameras.
• Audio and/or Visual Information. We may collect audio and visual information such as through photographs used for identification purposes, and we might also use those photos to promote Model N. We may also collect audio and video recordings of training sessions or other Model N meetings (e.g., conference calls).

Personal Information Collected from Other Sources or Otherwise Permitted by Applicable Law.
We may collect or receive information about you from other sources, including through third-party services and organizations to supplement information provided by you. For example, where permitted by law, we may conduct background and credit checks on you prior to your employment with Model N.

The Business or Commercial Purposes for Collecting, Selling or Sharing Your Information

DISCLOSURE REGARDING “SALES” OF PERSONAL INFORMATION UNDER THE CPRA. IN THE PRECEDING TWELVE MONTHS, WE HAVE NOT “SOLD” ANY PERSONAL INFORMATION (AS DEFINED BY THE CPRA), NOR DO WE HAVE ACTUAL KNOWLEDGE OF ANY “SALE” OF PERSONAL INFORMATION OF MINORS UNDER 16 YEARS OF AGE.

DISCLOSURE REGARDING CROSS-CONTEXT BEHAVIORAL ADVERTISING UNDER THE CPRA. IN THE PRECEDING TWELVE MONTHS, WE HAVE NOT “SHARED” ANY PERSONAL INFORMATION FOR “CROSS-CONTEXT BEHAVIORAL ADVERTISING” (AS SUCH TERMS ARE DEFINED IN THE CPRA), NOR DO WE HAVE ACTUAL KNOWLEDGE OF ANY “SHARING” OF PERSONAL INFORMATION OF MINORS UNDER 16 YEARS OF AGE FOR “CROSS-CONTEXT BEHAVIORAL ADVERTISING”.

We process personal information for a variety of business purposes that may include as applicable:

• To assess your suitability, aptitude, skills, qualifications, and interests for employment with or provide services to Model N;
• To communicate with you about the application process and/or your application;
• To assist you with obtaining an immigration visa or work permit (where required and requested by you);
• To take steps at your request prior to entering into an employment relationship with you (for example, after we have sent you an offer, we need to process certain personal information in order to enter into and commence employment);
• Workflow management, including assigning, managing and administering projects;
• Human Resources Operations administration and communication;
• Payroll and the provision of benefits;
• Compensation, including bonuses and long-term incentive administration, stock plan administration, compensation analysis, including monitoring overtime and compliance with labor laws, and company recognition programs;
• To pursue our legitimate interests (for example, fraud prevention, network and information security, disclosure to affiliated organizations for administrative tasks, Worker monitoring for safety or management, whistleblowing schemes, enforcement of legal claims, and research purposes);
• Job grading activities;
• Performance and Worker development management;
• Organizational development and succession planning;
• Benefits and personnel administration;
• Absence management;
• Helpdesk and IT support services;
• Internal and/or external or governmental compliance investigations;
• Internal or external audits;
• Where it is necessary for the establishment, exercise or defense of legal claims;
• Diversity and inclusion initiatives;
• Restructuring and relocation;
• Emergency contacts and services;
• Worker and dependents’ safety;
• To comply with our legal obligations;
• Processing of Worker expenses and travel charges;
• Acquisitions, divestitures, and integrations; and/or
• As you otherwise agree or consent.

Categories of Third Parties to Whom Personal Information is Disclosed
We may share your information as described in this Privacy Notice or with your permission, such as with:

• Vendors and Service Providers. We may share any information we receive with vendors and service providers. The types of service providers to whom we entrust personal information include service providers for: (i) provision of IT and related services; and (ii) processing to maintain our Human Resources Operations.
• Affiliates and Subsidiaries. Model N may share personal information with our affiliates and subsidiaries for our and our affiliates and subsidiaries’ internal business purposes.
• Other Individuals You Share or Interact With. When you post content you to the Intra-Model N Site(s), other individuals may be able to see some information about you, such as your name and/or picture in addition to the content you post. We are not responsible for practices of the individuals who view and use your information.
• Disclosures to Protect Us or Others. We may access, preserve, and disclose your personal information if we believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our or others’ rights, property, or safety; (iii) to enforce Model N policies and contracts; (iv) to collect amounts owed to us; (v) when we believe disclosure is necessary or appropriate to prevent financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; or (vi) if we, in good faith, believe that disclosure is otherwise necessary or advisable.
• Merger, Sale, or Other Asset Transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another entity, then your information may be transferred as part of such a transaction as permitted by law and/or contract.

International Data Transfers
All information collected via or by Model N may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States, in order to carry out our Human Resources Operations.

Description of Your CPRA and other applicable Privacy Rights and How You Can Exercise Them

In accordance with applicable law, you may have the right to:

• Know Whether Model N is Processing Your Personal Information (Right to Know);
• Request Access to and Portability of Your Personal Information, including: (i) obtaining access to or a copy of your personal information; and (ii) receiving an electronic copy of personal information that you have provided to us, or asking us to send that information to another company in a structured, commonly used, and machine readable format (also known as the “right of data portability”);
• Request Correction of your inaccurate personal information;
• Request Deletion of your personal information subject to statutory exceptions;
• Know what Personal Information we sell or share about you;
• Right to Limit Use and Disclosure of Sensitive Personal Information about you; and
• Withdraw your Consent to our processing of your personal information. Please note that your withdrawal will only take effect for future processing and will not affect the lawfulness of processing before the withdrawal.

If you would like to exercise any of these rights, please contact us as set forth below. We will process such requests in accordance with applicable laws. To protect your privacy, Model N will take steps to verify your identity before fulfilling your request.

If you are located in the EEA, please see our HR E.U.-U.S. Privacy Shield Privacy Policy for more information regarding your individual rights and choices with respect to your personal information.

Data Retention
Model N retains the personal information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, carry out our Human Resources Operations, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

To determine the appropriate retention period for personal information, we may consider applicable legal requirements, the amount, nature, and sensitivity of the personal information, certain risk factors, the purposes for which we process your personal information, and whether we can achieve those purposes through other means.

Disclosure Regarding Sensitive Personal Information. Model N only uses and discloses sensitive personal information for the following purposes:

• To perform the HR functions set forth in our Privacy Notice.
•  To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, and or confidentiality of stored or transmitted personal information.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at Model N and to prosecute those responsible for those actions.
• To ensure the physical safety of natural persons.
• To verify or maintain the quality or safety of Model N products, services, or devices, and to improve, upgrade, or enhance Model N’s services or devices.
• For purposes that do not infer characteristics about individuals.

Categories of Personal Information Collected and Disclosed for a Business Purpose, Sold, or Shared for Purposes of Cross Context Behavioral Advertising in the Preceding 12 Months

The CCPA provides California residents with the right to know what categories of personal information Model N has collected about them, and whether Model N disclosed that personal information for a business purpose (e.g., to a service provider) in the preceding twelve months. California residents can find this information below:

The categories of sources from which we collect personal information and our business and commercial purposes for using and disclosing personal information are set forth in “What Personal Information Model N Collects”, “How Model N Uses Your Personal Information”, and “How Model N Discloses Your Personal Information” above, respectively. We will retain personal information in accordance with the time periods set forth in “Retention of Personal Information.”

Additional Privacy Rights for California Residents

“Sales” of Personal Information under the CCPA. California Residents have the right to opt-out of the sale or sharing of their personal information by their employer and employer’s vendors. In the preceding twelve months, Model N has not “sold” any personal information (as defined by the CCPA), nor does Model N have actual knowledge of any “sale” of personal information of minors under 16 years of age.

Cross-Context Behavioral Advertising under the CCPA. California Residents have the right to know what personal information Model N shared for cross-context behavioral advertising. In the preceding twelve months, Model N has not “shared” any personal information for “cross-context behavioral advertising” (as such terms are defined in the CCPA), nor does Model N have actual knowledge of any “sharing” of personal information of minors under 16 years of age for “cross-context behavioral advertising”.

Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

Authorized Agent. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To authorize an agent, provide written authorization signed by you and your designated agent and contact us as set forth below for additional instructions.

Verification. To protect your privacy, we will take steps to reasonably verify your identity before fulfilling your request submitted under the CCPA. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Examples of our verification process may include asking you to provide the email address or phone number we have associated with you, opening a link sent to the contact information provided, and following the instructions on the website you are taken to.

Disclosure Regarding Opt-Out Preference Signals. Model N does not “sell” personal information or “share” personal information for “cross-context behavioral advertising” so it does not respond to opt-out preferenc signals.

How To Exercise Your Rights Under the CPRA.
If you are a California resident and would like to exercise any of your rights under the CPRA (including those listed in the “Individual Rights in Personal Information” section of the Privacy Notice), please contact us as set forth below. We will process such requests in accordance with applicable laws.

Supplemental Notice For European Union or United Kingdom Residents

If your personal information is subject to the data protection laws of the European Economic Area and/or the United Kingdom:

• Lawful Basis. Model N’s processing of your personal information is supported by the following lawful bases:
  • Performance of a Contract. We need to process your personal information to carry out your employment contract.
  • Legitimate Interest. We process your personal information to further our legitimate interests but only where our interests are not overridden by your interests or fundamental rights and freedoms. For example, we or a third party have legitimate interests in carrying on, managing, and administering our respective businesses effectively and properly and in connection with those interests, processing your personal or sensitive personal data.
  • Compliance with our Legal Obligations. We may process your personal information to comply with our legal obligations. Such as to provide a safe place of work and avoiding unlawful discrimination.
  • Consent. In some cases, we may also rely on your consent to process your personal information.
• Processing sensitive personal data. If we process sensitive personal data about you, we will ensure that one or more of the grounds for processing sensitive personal data applies, including where:
  • You have provided your explicit consent;
  • Processing is necessary for the purposes of your or our obligations and rights in relation to employment when it is authorized by law or collective agreement;
  • Processing relates to sensitive personal data about you that you have made public (e.g., if you tell colleagues that you are ill); and
  • Processing is necessary to establish, make, or defend legal claims.

If your personal information is subject to the applicable data protection laws of the European Economic Area, Switzerland, or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority if you believe our processing of your personal information violates applicable law.

• EEA Data Protection Authorities (DPAs)
• Swiss Federal Data Protection and Information Commissioner (FDPIC)
• UK Information Commissioner’s Office (ICO)

For more information about this process, please refer to our HR E.U.-U.S. Privacy Shield Privacy Policy.

Third Party Websites/Applications

Various resources and sites at Model N may contain links to third party websites/applications and other websites/applications may reference or link to Model N. These third-party services are not controlled by us. We encourage our Workers and their dependents to read the privacy policies of each website and application with which they interact. We do not endorse, screen or approve, and are not responsible for the privacy practices or content of such other websites or applications, including failures of their software. Visiting these other websites or applications is at your own risk.

Changes To Our Privacy Notice and Practices

We may revise this Privacy Notice from time to time in our sole discretion. If there are any material changes to this Privacy Notice, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Notice if you continue your employment or services with Model N after the new Privacy Notice takes effect. If at any point you do not agree to any portion of the Privacy Notice in effect, you must immediately contact Human Resources.

Contact Us

Model N is the controller of the personal information we process under this Privacy Notice.

If you have any questions about our privacy practices or this Privacy Notice, please contact us at legal@modeln.com.