Northern Trust Alumni Network Privacy Notice

This Notice (“the Notice”) applies to the processing of any personal information which is provided by you or on your behalf to The Northern Trust Company or any of its affiliated entities or subsidiaries (the “Company”) in connection with your voluntary participation in the Company alumni network (the “Alumni Network”). 

Personal information is information about an identifiable individual, as more particularly described under applicable privacy legislation.

The Company will process such personal information in accordance with the terms of this Notice and applicable privacy legislation (“the Acts”). 

This Notice applies only to the processing of personal information in connection with the Alumni Network. This Notice does not address or apply to other Company information practices or other kinds of information Company may process, such as information collected from Company employees or from applicants in connection with an application for employment and/or the administration of employment. For additional information on our general privacy practices, please visit our privacy page  available at Global Privacy Standard | Northern Trust . For more information on the application of privacy practices to Northern Trust employees, please refer to the respective Employee Privacy Notice available to Northern Trust employees in MyPlace. 

Personal Information We Collect

The Company and its agents and representatives collect personal information in several circumstances in the course of operating, administering and allowing you to participate in the Alumni Network. We collect certain personal information that you can choose to make public in your profile, including name, address, telephone number, current location (city and country), and other contact information, educational or other credentials, employment history and experience, skills, certifications, languages, and volunteer work. You can choose to provide us with certain personal information about your employment with Company, including your NT Employee ID, your most recent business unit and office location, and your start/end year of employment with Company. We also collect certain network activity and site interaction information as part of operating the Alumni Network, including which parts of our site you visit, how often, and for how long. (For more information, see our Cookie Policy at https://www.northerntrust.com/united-states/cookie-policy.) We collect this information together with any other information you provide to us or that we may collect with your consent or as required by applicable law. We may also process some information via CCTV if you attend our offices and messages you send back and forth through the Alumni Network’s chat feature.

We generally collect personal information identified above directly from you.

Some of this information (including messages you exchange) may be considered “sensitive personal information” under applicable privacy and data protection laws. Whether information is “sensitive” will depend on the laws of your jurisdiction.

Use of Personal Information, Legal Basis, and Retention

The Company will use personal information for the purpose of operating, administering, and allowing you to participate in the Alumni Network, including event invitations and our messaging features. The Company will also use personal information to send email communications, including about updates, events, and administrative messages about your account or profile. The Company may also use personal information for the purpose of statistical analysis. The Company may also use personal information to notify you of any changes to the website, this privacy notice or any other policies or agreements relevant to site users and for other purposes, either with your consent or as required by law.

We may use personal information collected in connection with the Alumni Network for security and monitoring purposes, including to keep our platform and websites secure. If you elect to use third-party multifactor authentication tools (“Authentication Methods”), we may communicate with you by email, phone call or SMS/text message in order to send security codes via the Authentication Method.

Please note, Northern may also use personal information in making decisions about marketing Northern products and services to you and to market to you. However, you may direct us to not share this information with Northern's affiliates or joint marketing partners where you do not have accounts for their use in marketing decisions, and we will take reasonable steps to ensure that your information is only processed by the legal entities involved in the provision of service unless you agree to us sharing your information with other Northern entities. We already have your preference noted in our records.

We use sensitive personal information for reasonably expected purposes to provide you with services, in connection with your requests, and as authorized by law.

Use of Cookies. To provide better services to our customers and more effective delivery of the Alumni Network, Northern gathers and analyzes online data, including number of hits, pages visited, length of user session, etc., and uses “cookies”. A cookie is a small piece of information stored by a web site on the user's browser which can only be read by the web site that set it. Depending on your location of residence, you may be able to customize your cookie preferences. You may obtain further information about Northern's use of cookies by viewing Northern's Cookie Policy located at https://www.northerntrust.com/united-states/cookie-policy. 

Use of Personal Information, Legal Basis, and Retention

Where the Acts require the Company to process your personal data on the basis of a specific lawful justification, we generally process your personal data under one of the following bases:

• Compliance with a legal obligation to which the Company is subject;
• Your consent; or;
• For the Company’s legitimate interests being those purposes described in the section above, where this is not overridden by your interests.

Disclosure of Your Personal Information

Other Participants in the Alumni Network: The Alumni Network is intended to provide a convenient platform for Company alumni to access information about the Company and other Company alumni. You must create a profile and you may choose which personal information to make visible to other participants in the Alumni Network. Any information that you choose to make public in your profile will be shared with and visible to other Alumni Network participants. Any messages you send to other Alumni Network participants will be shared with the recipient that you designate. Keep in mind that recipients could share your messages with others.

Service Providers and Affiliates: The Company may transfer personal information to outside agents or service providers (including affiliates of the Company acting in this capacity) who perform services on our behalf. Our service providers and affiliates may collect, use, disclose, store or process personal information on our behalf for the purposes described in this privacy notice, including storage of personal information on a central database accessible to human resources personnel within the Company.

Internet Providers, Operating Systems, and Platforms. If you sign in to or access Company platforms in connection with the Alumni Network, we may disclose the following categories of personal information to Internet service providers, operating, systems and platforms for security and integrity purposes: identifiers and Internet and network activity information.

International Processing: Some of our service providers or affiliates may be located in jurisdictions different from where you reside. Some of those jurisdictions may have data protection laws that do not offer the same degree of legal protection as those of the country where you reside.

The Company maintains a global operating model which enables delivery of our services and products to our international client base. The disclosure of personal data to third parties, including Northern Trust affiliates, set out above may therefore involve the transfer of your personal data to the USA, European Union, India, the Philippines and other countries or territories outside your country of residence. Such transfers are made in accordance with locally applicable data protection laws.

Some of the countries to which Northern Trust transfers personal data to are deemed under locally applicable data protection law, to provide an adequate level of data protection. However, you should be aware that data protection laws in other countries to which the Company transfers personal data may be considered less protective than those in your country of residence.

Where we are required to do so under applicable data protection laws, we take appropriate steps to implement appropriate technical and organisational safeguards, such as Binding Corporate Rules (see our Privacy Page available at Global Privacy Standard | Northern Trust) or the European Commission’s Standard Contractual Clauses, or their equivalent applicable in the U.K. to ensure your data continues to be adequately protected and your privacy rights respected.

We also assess the overall level of protection offered in the context of specific transfers and, where necessary, our use of appropriate safeguards is supplemented by additional measures that support an adequate level of data protection, where required under applicable data protection laws. We apply these safeguards to transfers of personal data to third parties as well as to the Northern Trust affiliates.

In limited circumstances and where permitted under applicable data protection laws, the Company may rely on a derogation from the obligation to ensure an adequate level of protection, meaning that we transfer personal data without the use of appropriate safeguards. This may be the case where, for example, a transfer of your personal data is necessary for important reasons of public interest, or to establish, exercise or defend legal claims.

Please contact Privacy_Compliance@ntrs.com for copies of appropriate safeguards. Please be aware that appropriate safeguards may be redacted for reasons of commercial confidentiality.

Business Transactions: The Company may disclose personal information to successors of the Company, who may use and disclose personal information for those purposes described in this privacy notice.

Legal, Regulatory: The Company may disclose your personal information as necessary to meet legal, regulatory, insurance, audit and security requirements and otherwise with your consent or as required by applicable law, rule, regulation, or valid legal process.

Protection of Us and Others. We may disclose personal information if required to do so by law, to protect rights, property, or safety of our employees and contractors, our shareholders, clients, prospects, business associates, and guests, ourselves or others; or where we have a legitimate interest in doing so.

Other Disclosures. We may disclose personal information to others and in ways not described above that we notify you of or that we obtain your consent for.

Your Consent

How Consent Is Provided: You may provide us with your consent to the collection, use and disclosure of personal information in various ways such as by creating an account as part of the Alumni Network. Consent can be express (for example, by submitting an online form that contains a consent provision), or implied, where permitted under applicable law. 

Consent For Disclosed Purposes: Generally, when creating an account and providing us with personal information, you will be asked to consent to our collection, use and disclosure of such information for the purposes identified or described in this privacy notice, if applicable, or otherwise at the time of collection.

Withdrawal of Consent: You may withdraw your consent to our collection, use and disclosure of personal information at any time, subject to contractual and legal restrictions and reasonable notice, where permitted under applicable data protection laws. If you withdraw your consent to certain uses of your personal information, we may no longer be able to continue our relationship with you and you may no longer be able to participate in the Alumni Network.

Security

Security Measures: The Company will take reasonable steps to protect your personal information against loss, theft or misuse as well as unauthorized access, disclosure, copying, use, modification, alteration or destruction, which steps may include technical, contractual, administrative, and physical steps that are appropriate to the sensitivity of the information. 

Insecure Transmissions: Please note that the Company cannot guarantee the security of any communication or material transmitted to/from the Company via the Internet, whether through the site or by email. Therefore, please do not send any sensitive personal information using these methods.

Local Laws: The reasonable contractual and other measures we take to protect your personal information while processed or handled by service providers and affiliates may be subject to legal requirements of the applicable countries where processing or handling takes place, for example, lawful requirements to disclose personal information to government authorities in those countries.

Retention

 We store your personal information for as long as needed, or permitted, based on the reason we obtained it (consistent with applicable law), and to comply with Company’s record retention requirements. When deciding how long to keep your personal information, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period of time before we can delete them) or whether we have taken any legal positions that require data retention (e.g., issued any legal holds or otherwise need to preserve data). From time to time, we may also deidentify your personal information, retain it and use it for a business purpose in compliance with applicable laws.

Your Data Subject Rights and Contacting Us

The Company may establish and maintain a profile of your personal information for the purposes described above. You have the following rights in certain circumstances as permitted under applicable laws and subject to certain exception, in relation to your personal information based on your country of residence:

1. Right of access (Subject Access Requests) – In certain circumstances, you have the right to request personal information that the Company holds and to be informed about how we obtained and use your personal information.
2. Right of rectification (right to correct) – In certain circumstances, you have the right to request that the Company rectify inaccurate personal information.
3. Right of erasure (right to be forgotten) – In certain circumstances you have the right to request that the Company erase or delete personal information, subject to certain exceptions. Please note, Northern Trust is not obligated to delete Personal Information that it is required to maintain to comply with applicable laws.
4. Right to restrict processing – In certain circumstances you have the right to request that the Company restrict the use of personal information (e.g. if the individual believes it to be inaccurate).
5. Right to data portability – In certain circumstances you have the right to request that the Company provide your personal information to you or another controller in a structured, commonly used, machine-readable format.
6. Right to object – In certain circumstances you have the right to object to certain processing of personal information (unless the Company has overriding compelling grounds to continue processing) and the right to object to direct marketing.
7. Rights relating to automated decision making – In certain circumstances you have the right to object/opt-out of automated decision making that significantly affects the individual (e.g. certain profiling).
8. Right to opt-out of a “sale” or “share” of your personal information – In certain circumstances you have the right to opt out for the “sale” or “sharing” of your personal information, as these terms are defined under applicable laws. We do not “sell” or “share” Personal Information (as those terms are defined under the CCPA). We do not sell or share sensitive Personal Information, nor do we sell or share Personal Information about individuals who we know are under sixteen (16) years old.

You can also turn off or opt out of receiving messages from other Alumni Network participants in your settings.

If you are a resident of California, you may have additional rights regarding your “Personal Information” as defined under the CCPA. These rights include:

Right to Know/Access. You have the right to request (subject to certain exemptions):

• The categories of Personal Information we collected about you;
• The sources from which we have collected that Personal Information;
• Our business or commercial purpose for collecting, selling, or sharing that Personal Information;
• The categories of third parties to whom we have disclosed that Personal Information; and
• A copy of the specific pieces of Personal Information we have collected.

Right to Limit Use and Disclosure. We do not use or disclose “sensitive personal information” for purposes except as described in this Notice (and as permitted pursuant to the CCPA regulations).

Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this section.

Additional Notes for California Residents: Please use the contact information below and indicate you are exercising your “CCPA privacy rights.” Company will confirm your identity before fulfilling certain verifiable requests. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial. You may designate someone as an authorized agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow the authorized agent to act on your behalf. We may also ask you directly to verify that you have authorized your authorized agent to act on your behalf.

If you wish to make inquiries or complaints or have other concerns about our personal information practices, you may contact us as below or you can fill out our Data Subject Rights Form.

Privacy Notice Changes

The practices outlined above represent our current policies with respect to the handling of personal information. We may review and revise this Notice from time to time without notice. Your continued provision of personal information or use of this site or participation in the Alumni Network following any changes this Notice constitutes your acceptance of any such changes. You should review this Notice often to ensure familiarity with its then-current terms and conditions. We will obtain explicit consent from you for changes to this Notice, where required under applicable data protection laws.

Last Updated / Effective Date / Last Reviewed Date: 29.06.2026