Notice at collection of personal information

Effective as of January 1, 2020
Last updated: October 2025

 Download privacy notice (PDF, 270 KB) Opens in a new window.

Scope of this Policy

This Privacy Policy applies to the personal information of California residents collected by CIBC (“you”), including the personal information collected when you visit our website, in your capacity as an employee or prospective employee.

Personal information does not include: 

  • Information publicly available from government records or made publicly available by you or with your permission;
  • Deidentified or aggregated information; and
  • Information excluded from the scope of the California Consumer Privacy Act (CCPA), such as protected health information covered by the Health Insurance Portability and Accountability Act or the Health Information Technology for Economic and Clinical Health Act, medical information covered by the California Confidentiality of Medical Information Act, or personal information covered by certain sector-specific privacy laws such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or the California Financial Information Privacy Act.

California Notice at Collection
CIBC collects the personal information identified in the section below titled “What we collect and how we collect it,” for the purposes identified in the section below titled “How we use and retain your information,” and retains it for the period described in that same section. We may disclose personal information for cross-context behavioral advertising (“sharing”) as described in the section below titled “What we disclose and to whom.” We do not sell your personal information, or collect or process sensitive personal information for the purpose of inferring characteristics about you. 

California residents — your privacy rights regarding your actual or prospective employment

What we collect and how we collect it

We may collect the following categories of personal information from you in your capacity as an employee or prospective employee. Not all categories may be collected about every individual. Over the past 12 months we have collected, and may continue to collect on an ongoing basis, the following categories of information:

Category Examples
Identifiers  A real name, alias, email, telephone number, residential or business address, employee identification number for data and benefits analysis
Characteristics of Protected Classifications Under California or Federal Law for employees Age, marital status, gender, national origin, disability, veteran status, collected as part of inclusion and diversity initiatives, or as necessary to comply with applicable laws. Disability, medical condition, and pregnancy, childbirth, breastfeeding, and related conditions, as necessary to comply with applicable laws related to leaves of absence and accommodation.
Professional employment-related information Current or past job history related to an individual, professional credentials, training, seniority, job titles, education, business travel and expense records, compensation (salary, bonus and commission, equity compensation)
Benefits information Information necessary to administer short and long-term benefits as well as other benefit plans, beneficiary information
Internet or other similar network activity Browsing history, cookie information, and log in/out and activity on CIBC's electronic resources
Preferences Hobbies and leisure activities, membership in voluntary/charitable/public organizations, and preferences regarding work tools, travel, hours, food for company events, etc.
Geolocation To help serve the appropriate CIBC website or provide suggestions based on physical location
Audio, electronic, visual, or similar information Audio or visual recordings of workplace conversations (e.g., telephone conversations), business meetings or training sessions may be captured by CIBC for various reasons, such as to facilitate accurate information gathering, provide absent parties with access to meeting content, or respond to workplace accommodation needs; images on building and ATM security cameras; voice message recordings, photos, and other images or videos (i.e., events, promotions)
Prospective employee assessments Inferences drawn from any of the personal information provided as part of an employment application to create a profile about a prospective employee reflecting the prospective employee’s preferences, characteristics, predispositions, behavior, attitudes, abilities, and aptitudes

Category Examples
Government issued identification numbers Social Security Number or Social Insurance Number, driver’s license, state identification card, or passport number, including issue and expiration dates and personal address, as applicable
Financial information  Bank details for payroll and reimbursement purposes. 
Race, ethnicity, sex life or sexual orientation Demographics collected as part of inclusion initiatives, or as necessary to comply with applicable laws
Biometrics Fingerprints to manage physical access to secure areas
Health information To manage health and safety in the workplace, meet accommodation needs, and administer health benefits plans
Citizenship and immigration status To ensure employment eligibility and comply with immigration law

CIBC may obtain the categories of personal information listed, both directly and indirectly:

  • Directly from you. For example, from forms you complete or benefit selections you may choose.
  • Indirectly from you. For example, from observing your actions on our website.
  • From publicly available sources. Public records or widely available sources, including information from the media, and other records and information that are made available by federal, state, and local government entities. We also may collect personal information that you intentionally choose to make public, including via social media (e.g., we may collect information from public social media profile(s) to the extent individuals choose to make their profile(s) publicly visible and accessible).
  • From business partners. For example, we may rely on professional employer organizations or staffing agencies for recruiting purposes; other employees may provide information about you, such as performance or evaluation information from a People Leader or other member of management. We may combine information that we collect from different sources.

How we use and retain your information

We may use the personal information we collect for one or more business purposes as described below:

  • To administer the employment relationship, including recruitment, human resources administration, timekeeping, disciplinary matters, and facilitating employee communication and collaboration 
  • To create, maintain, customize, and secure your payroll and benefits with us.
  • For performance management, internal reporting and other administrative processes.
  • To defend our company, property, and others.
  • To manage and secure our assets and premises and maintain the health and safety of others.
  • To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
  • As described to you when collecting your personal information or as otherwise permitted by law.

In the 12 months preceding the date of this Notice at Collection and Privacy Policy, we have not “sold” personal information subject to the CCPA nor have we “sold” personal information of minors under the age of 16. As defined by CCPA, “sold” means the disclosure of personal information to a third party for monetary or other valuable consideration. 

We keep personal information as long as it is necessary or relevant for the purposes for which it was collected. For employees, we keep information in accordance with CIBC’s Records Retention Schedule, available on the CIBC Intranet.  For prospective employees, if hired, we will retain your personal information for the duration of the employment relationship, and as described above. CIBC will retain information of prospective employees who are not hired for seven years after the record is collected, for our internal recordkeeping and reporting purposes in compliance with California Government Code § 12946.  We may keep information for a longer period than as described above, where required by law. 

What we disclose and to whom

Over the past 12 months we have disclosed, and may continue to disclose on an ongoing basis, personal information to the categories of third parties listed below, for the following “business purposes” as that term is defined by California law:

  • Service providers: CIBC may disclose to its service providers any of the categories of personal information listed in the section above titled “What we collect and how we collect it,” for the business purpose of performing services on our behalf, and for the specific purposes described in the section above titled “How we use and retain your information.” 
  • Auditors, lawyers, consultants, and accountants engaged by us: CIBC may disclose the categories of personal information listed in the section above titled “What we collect and how we collect it,” for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on our behalf. 
  • Affiliated companies: CIBC may disclose any of the categories of personal information listed in the section above titled “What we collect and how we collect it,” to other companies within the CIBC family of companies, for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

In addition, we have also disclosed over the past 12 months, and may continue to disclose, personal information to the following categories of third parties for purposes other than a “business purpose” as defined by California law:

  • Your direction: We may disclose your personal information to third parties at your direction. 
  • Clients and customers: This may include, for example, disclosing your business contact information to a CIBC customer for customer support purposes.
  • Business partners: For example, we might disclose your business contact information to a co-developer of a new product or service with which you will be working.
  • Government or administrative agencies: These may include, for example the Internal Revenue Service to pay taxes or the California Department of Industrial Relations as required to resolve workers’ compensation claims.
  • Public: We may disclose personal information of employees to the public as part of a press release, for example, to announce promotions or awards, or in marketing and promotional materials with your authorization. 
  • Legal compliance and required disclosures: We may disclose personal information if we think we have to in order to comply with the law or to protect ourselves. For example, we may disclose information in response to a court order or subpoena, or to a request made by a government agency or investigatory body, including U.S. and non-U.S. law enforcement or regulatory authorities.
  • Protections: We may disclose personal information when we believe disclosure is necessary to protect the rights, property, or safety of CIBC, individuals, or others.
  • Corporate Transactions: As part of a merger, acquisition, or other sale or transfer of all or some of our assets, or as part of a bankruptcy or financing we may disclose all categories of personal information.

CIBC may share personal information for cross-context behavioral advertising. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising. Review the CIBC Digital Banking Privacy Notice and Cookie Policy to learn more about how CIBC uses online tracking technologies, such as cookies, to conduct personalization, analytics, and targeted advertising.

How to exercise your rights

You can exercise your CCPA rights or ask for more information in two ways:

Submit a request

All requests must be verified prior to receiving a response. To verify a request, each request must include certain criteria:

  • Enough information that lets us reasonably confirm you’re the person about whom we collected personal information or an authorized representative
  • Enough detail in your request that lets us properly understand, evaluate and respond to it

CIBC will search our existing information to confirm your identity or authority to make the request. Please note that for certain requests, we may ask you to provide us with a signed declaration under penalty of perjury affirming that you are the consumer whose personal information is the subject of the request. Information submitted for verification purposes will only be used to verify your identity and/or authority to make a request on another’s behalf.

If we cannot verify your request, we may deny the request. Additionally, we will not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another California resident or where the personal information that we maintain about you is not subject to the CCPA's access or deletion rights. 

Upon submission of a request, you will receive an initial confirmation of receipt within 10 days. We will respond to your request within 45 days. If we need an extension for up to an additional 45 days in order to process your request, we will provide you with an explanation for the delay.

Under CCPA, you may only make a verifiable request for access twice within a 12-month period.

Designate an Agent

You may directly exercise these rights or designate an authorized agent to make a request on your behalf. If you are a minor under 16 years of age, your parent or guardian may make a verifiable request on your behalf. 

Requests made on another person’s behalf can only be accepted upon receipt of documentation that the requestor is an authorized agent, parent, or legal guardian of the consumer whose information is being requested. This will require the submission of a valid Power of Attorney, Birth Certificate, Guardianship Order, or other court order granting authority to receive information, as appropriate.

Your California privacy rights

As a California resident, you have certain rights with respect to your personal information.

Access to specific information rights

Subject to certain exceptions, you have the right to know what personal information CIBC has collected about you and our use of your personal information for the period during which we retain the personal information for business purposes. Once we receive and confirm your verifiable request, we’ll provide you with this information:

  • The categories of personal information we collected about you
  • The categories of sources for the personal information we collected about you
  • Our business or commercial purpose for collecting that personal information
  • The categories of third parties with whom we disclose that personal information
  • The specific pieces of personal information we collected about you
  • If we disclosed your personal information for a business purpose, we’ll provide a separate list of disclosures for a business purpose. We'll identify the personal information categories that each category of recipient received

Deletion request rights

You have the right to ask us to delete any of the personal information we collected from you and kept, with certain exceptions. Once we receive and confirm your verifiable request, we’ll delete your personal information from our records, unless there’s an exception.

Correction rights

Subject to certain exceptions, you have also have the right to ask us to correct any inaccurate personal information we collected from you and kept. Once we receive and confirm your verifiable request, we’ll correct your personal information within our records.

Antidiscrimination rights

You have the right not to receive discriminatory treatment for exercising your privacy rights.

Do not sell or share rights

CIBC doesn’t sell personal information, meaning under California law, that we do not provide personal information to a third party for monetary or other valuable consideration. We do not sell personal information of minors under the age of 16. 

CIBC may share personal information as defined by CCPA as the disclosure of personal information to a third party for cross-context behavioral advertising. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising in the following ways:

  • You can enable the Global Privacy Control (GPC) in your browser. GPC is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When we detect a GPC signal from a browser, our Digital Banking services are designed to treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser. 
  • You can opt out of cross-context behavioral advertising by going to Manage cookie preferences and switching the toggle to the left and clicking save, indicating that you do not want us to share your personal information for cross-context behavioral advertising.

Your choices are specific to the device, website, mobile app and browser you are using. They can be reset when you clear your browser’s cookies and data on your device. For more information on cookies, visit the Cookie Policy.

At any time, you may change your preference setting using the toggle bar. Any manual adjustment will override previous settings.

Other important information

We may change or update this Notice at Collection and Privacy Policy from time to time. When we do, we will post the revised Notice on this page with a new “Last Updated” date.

General questions

If you have questions, please contact the CIBC HR Contact Center at 800-668-0918 Opens your phone app.. Job applicants may contact .