TIAA privacy notice for TIAA applicants residing in California

This TIAA California Applicant Privacy Notice or (this "Notice") is for Applicants for TIAA positions ("Applicant(s)") residing in California and is made available pursuant to the California Consumer Privacy Act and its implementing regulations, as subsequently amended by the California Privacy Rights Act (collectively, the "CCPA"). TIAA, in this Notice, refers to Teachers Insurance and Annuity Association of American and its subsidiaries and affiliates, including but not limited to TIAA Trust, N.A. and Nuveen Services, LLC (collectively, "TIAA" or the "TIAA Companies").

If you are applying for a job with TIAA and you reside in California, please review this Notice carefully, as it applies to the personal information we collect about you solely in your capacity as an Applicant. We encourage you to read this Notice to have a full description of our online and offline data practices.

If you receive an employment offer for TIAA, you may receive additional requests for information, including a background check, subject to additional disclosures.

Under the CCPA, personal information includes information that identifies and describes who you are; as well as information that relates to, is capable of being associated with, or could reasonably be linked to you, one of your devices and/or a member of your household. In this Notice, we refer to the information subject to the CCPA as "Applicant Personal Information."

Your rights under the CCPA

If you are a California resident, you have the following rights with respect to your Applicant Personal Information:

  • Receive information on our privacy and information practices, including why we collect Applicant Personal Information about you, from whom, for what purposes, and with whom we share or "sell" it.This information is contained in the chart below. You are also entitled to know how long we expect to retain your Applicant Personal Information. Our retention period for Applicant Personal Information is generally five years from the date of creation, and may be extended under some circumstances, such as anticipated or ongoing litigation or regulatory activities.
  • Request access to Applicant Personal Information that we have collected about you in the twelve months prior to your request. Please note that we are not required to disclose any Applicant Personal Information that may compromise the security of your information or put you at risk of identity theft; for example, we will not disclose to you your specific Social Security Number if we have collected it.
  • Request the deletion of your Applicant Personal Information, if we use it outside our business purposes (which are explained below).
  • Request the correction of your Applicant Personal Information.
  • Limit the use of your sensitive Applicant Personal Information, if we use it outside our business purposes. We may collect sensitive Applicant Personal Information if you voluntarily provide it to us for self-identification purposes. If we extend an offer to you for employment, we will also collect your age, date of birth, government issued identification numbers (such as Social Security or Driver's License); we use this information solely to comply with employment laws and regulatory requirements. These use cases are considered to be "business purposes" under CCPA. Therefore, the right to limit our use of your sensitive Applicant Personal Information is not available at this time.
  • Opt-out of certain automated decision-making. Until the California regulators define automated decision making, we are not yet able to offer this right to you. We do not use automated decision-making in a way that will materially impact your legal rights or discriminate against you.
  • Receive information whether we "sell or share" your Applicant Personal Information with vendors that provide cross-context digital advertising or cannot assure us that your Applicant Personal Information is used only to deliver services we have hired them to provide us. You are also entitled to opt-out of any such "sale or sharing." We do not sell or share with anyone any of your Applicant Personal Information.
  • Not be discriminated against for exercising these rights.

Our business purposes

Certain activities we perform require the use of your Applicant Personal Information and/or your sensitive Applicant Personal Information. Under the CCPA, you may not request that we (i) delete it; (ii) limit our use of your Applicant Personal Information or sensitive Applicant Personal Information; or (iii) limit our sharing it with our service providers when our activities fall within our "business purposes".

We require our service providers to contractually agree to use your personal and sensitive Applicant Personal Information only to render us the services we have hired them to perform, to protect it with technical, administrative and physical measures appropriate to its sensitivity, not to use it for their own purposes or collect further Applicant Personal Information with respect to it, to tell us if they cannot comply with such requirements and to allow us to make sure that they are complying with their obligations.

The activities constituting our "business purposes" are:

  • Completing a transaction for which the Applicant Personal Information was collected, providing a product or service requested by you, taking actions reasonably anticipated within the context of your employment application, or otherwise performing our contract(s) with you.
  • Preventing, detecting and investigating security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible for such activities.
  • Debugging products to identify and repair errors that impair existing intended functionality.
  • Short-transient use relating to our current business interaction with you.
  • Exercising free speech, ensuring the right of other consumers to exercise their free speech rights, or exercising another right provided for by law.
  • Enabling solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
  • Complying with a legal obligation, including our records retention obligations, to answer subpoenas or requests from regulators.
  • Making other internal and lawful uses of that information that are compatible with the context in which you provided it.

Category and Sources of Personal Information

Contact Information

We collect this type of information from:

  • You, when you apply for employment with us, set up your Applicant profile, or otherwise provide us with such information for employment application-related use
  • A third-party service, such as LinkedIn, trade shows and conferences

Examples of Types of Data Elements:

  • Full name, title, preferred form of address
  • Mailing address
  • Residential address
  • Email address
  • Telephone number
  • Mobile number

Purpose for Collecting and Disclosing the Applicant Personal Information:
We use this type of information:

  • To identify you and stay in touch with you regarding your application for employment
  • For our business purposes and to satisfy regulatory requirements

Categories of Third Parties to whom this type of Applicant Personal Information is Disclosed for a Business Purpose:
We may disclose this type of information to other TIAA Companies, for their business purposes, and to service providers, since they have agreed to use your information solely to render services to us and protect it.

Categories of Third Parties with whom this type of Applicant Personal Information is Sold or Shared:
We do not sell this information for money or share this personal information with third parties for cross-context behavioral advertising or other activities from which you are entitled to opt-out.

Government-issued Identification Numbers

We collect this type of information from:

  • You

Examples of Types of Data Elements:
We may collect from you:

  • A government issued identifier, such as a Social Security or Driver's License Number

Purpose for Collecting and Disclosing the Applicant Personal Information:
We use this type of information:

  • To identify you
  • For authentication
  • For security and risk management, fraud prevention and similar purposes
  • For our business purposes

Categories of Third Parties to whom this type of Applicant Personal Information is Disclosed for a Business Purpose:
We may disclose this type of information to our service providers and to other TIAA Companies for our business purposes.

Categories of Third Parties with whom this type of Applicant Personal Information is Sold or Shared:
We do not sell this information for money or share this personal information with third parties for cross-context behavioral advertising or other activities from which you are entitled to opt-out.

Network Access Information

We collect this type of information from:

  • You, when you establish an account or change your password in an online portal that you need pursuant to your application for employment

Examples of Types of Data Elements:
Data elements in this category include:

  • Usernames and passwords
  • Account recovery information

Purpose for Collecting and Disclosing the Applicant Personal Information:
We use this type of information:

  • To identify and authenticate you
  • To permit you to access the online portals that you need to apply for employment with us
  • For security and similar purposes

Categories of Third Parties to whom this type of Applicant Personal Information is Disclosed for a Business Purpose:
We may disclose this type of information to service providers that we have hired for IT services and for our business purposes.

Categories of Third Parties with whom this type of Applicant Personal Information is Sold or Shared:
We do not sell this information for money or share this personal information with third parties for cross-context behavioral advertising or other activities from which you are entitled to opt-out.

Online & Technical Information

We collect this type of information from:

  • You and from your connected devices when you interact with our websites and mobile applications. For example, when you visit our websites, our server logs record your IP address and other information.
  • Through digital tracking technologies such as cookies, pixels, and beacons,

We also associate information with you using unique identifiers collected from your devices or browsers.

Examples of Types of Data Elements:
Applicant Personal Information collected by our use of digital tracking technology on our websites is information that, on its own, might not identify you; however, when such information is combined with other information about you, it may be possible to identify you or your household. In the context of digital tracking technology, such information may include:

  • your identifiers, including your cookie identifier, Internet Protocol address, hashed email address, device identifier, mobile ad identifier, and similar online and unique personal identifiers
  • your geolocation data
  • your internet or other electronic network activity information, such as the time you spent on the website, your navigation throughout the site, and other information regarding your interaction with an internet website, application, or advertisement)

Purpose for Collecting and Disclosing the Applicant Personal Information:
We use this type of information:

  • To make our websites and applications usable by enabling basic functions, like page loading, account sign-in, and filling out forms
  • To monitor traffic and activity
  • To maintain security, enable fraud detection, and provide trouble-shooting and support
  • To facilitate an action initiated by you, such as setting or detecting your privacy settings
  • To authenticate and remember usernames upon login
  • To establish and maintain a logged-in connection while you are in the secure section(s) of our website
  • To enable us to personalize your web experience by remembering your online preferences including, but not limited to, your preferred language, web layout, or location settings
  • To detect your browser and device capabilities for displaying website content
  • To measure the level of engagement with the TIAA employment application websites
  • To deliver content to you as an Applicant
  • For our business purposes

Categories of Third Parties to whom this type of Applicant Personal Information is Disclosed for a Business Purpose:
We may disclose this type of information to:

  • TIAA Companies
  • Service providers
  • Third parties who assist with our information technology and security programs, including companies such as network security services who retain information on malware threats detected
  • Third parties who assist with fraud prevention, detection, and mitigation
  • Third party network advertising companies
  • Other third parties as required by law

Categories of Third Parties with whom this type of Applicant Personal Information is Sold or Shared:
We do not sell this information for money or share this personal information with third parties for cross-context behavioral advertising or other activities from which you are entitled to opt-out.

Biometric Information

We collect this type of information from:

  • You

Examples of Types of Data Elements:

  • Depending on your job function, we may collect biometric information such as fingerprints and faceprints

Purpose for Collecting and Disclosing the Applicant Personal Information:
We use this information to comply with regulatory requirements related to your application for employment with us.

Categories of Third Parties to whom this type of Applicant Personal Information is Disclosed for a Business Purpose:
We may share your Applicant Personal Information with vendors who have agreed to use it only to render contracted services to us and keep it confidential.

Categories of Third Parties with whom this type of Applicant Personal Information is Sold or Shared:
We do not sell this information for money or share this personal information with third parties for cross-context behavioral advertising or other activities from which you are entitled to opt-out.

Background and Employment Information

We collect this type of information from:

  • You
  • Third party service providers who are able to verify your background or vaccination information.

Examples of Types of Data Elements:

  • Information about your educational and professional background
  • Personal characteristics
  • COVID-19 vaccination status, including any health information or documentation submitted as proof of vaccination or religious/medical exemption

Purpose for Collecting and Disclosing the Applicant Personal Information:
We use this information to comply with employment laws, and federal and regulatory requirements

Categories of Third Parties to whom this type of Applicant Personal Information is Disclosed for a Business Purpose:
We may share your Applicant Personal Information with vendors who have agreed to use it only to render contracted services to us and keep it confidential.

Categories of Third Parties with whom this type of Applicant Personal Information is Sold or Shared:
We do not sell this information for money or share this personal information with third parties for cross-context behavioral advertising or other activities from which you are entitled to opt-out.

What to Expect When You Exercise an Available CCPA Right

Verification & Response Process

We take protecting your Applicant Personal Information very seriously. When you make a request, we will first take steps to verify that it is really you who is making the request. Depending on the sensitivity of your Applicant Personal Information, we may request that you provide us with additional documentation to verify your identity and may decline your request if we are unable to verify your identity. To provide a "verifiable request" you must provide enough information that allows us to reasonably confirm and verify you are the person about whom TIAA collected Applicant Personal Information or you are the attorney-in-fact of a CA resident.

Access to Applicant Personal Information

Once we have verified your request, we will provide information from our records for the preceding 12 months, including the business purpose for our collection. We will also direct our service providers to do the same if they are holding your Applicant Personal Information. Please note, we may decline your request if we are unable to verify your identity. We also decline to provide you with any of your Applicant Personal Information that may put you at risk of ID theft or create a security risk. For example, we would not disclose to you a specific government-issued ID number.

Deletion of Applicant Personal Information

The Applicant Personal Information we have collected about Applicants for employment is retained for business purposes as permitted by the CCPA, including to comply with our legal obligations and record retention requirements. If our legal and records retention obligations with respect to your specific personal information have expired, we have either deleted your information or it remains archived without further use on our part or the ability to reasonably access it.

Appointing a designated agent

CCPA allows you to exercise your rights through a designated agent. Please submit to us at our address below a duly notarized California power of attorney appointing the individual whom you have designated to act on your behalf for this purpose. We will verify your identity and the identity of your attorney-in-fact.

TIAA
Privacy Fulfillment
P.O. Box 1259
Charlotte, NC 28201

Exercising rights and verifiable requests

You can access the Applicant portal through Workday to view the specific pieces of Applicant Personal Information we have collected about you.

Correction of inaccurate Applicant Personal Information

You can correct the Applicant Personal Information that TIAA has related to your application for employment by logging into the Applicant portal through Workday and making any necessary corrections.

Questions

If you have any questions about this Notice or the ways in which TIAA collects and uses your Applicant Personal Information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at 877-554-1001.

Non-Discrimination

TIAA will not discriminate against you for exercising any of your CCPA rights as described in this Notice. Unless permitted by the CCPA, we will not:

  • Deny you goods or services;
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
  • Provide you a different level or quality of goods or services; or
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Changes to this privacy notice

We reserve the right to amend this Notice at our discretion and at any time. When we make substantive changes to this Notice, we will inform you through a notice on our website.

January 2023