This California Consumer Privacy Act Disclosure & Statement of Rights (“Disclosure”) provides additional information regarding the privacy rights of California residents, and supplements and is an integral part of our Privacy Statement. Among other things, this Disclosure identifies generally the categories of personal information we collect, details how we use, sell and share personal information, explains how you, as a California resident, can get specific information about our use, collection, sale and sharing of personal information about you, and how you may request deletion of personal information we have collected from you.

THIS DISCLOSURE PERTAINS ONLY TO THOSE PERSONS WHO ARE, OR AT ANY TIME SINCE JANUARY 1, 2019, WERE, CALIFORNIA RESIDENTS.

IF YOU ARE NOT A CALIFORNIA RESIDENT, PLEASE REFER TO OUR PRIVACY STATEMENT FOR INFORMATION ABOUT OUR PRIVACY POLICIES AND PRACTICES THAT ARE APPLICABLE TO YOU.

1. Categories of Personal Information We May Collect and Use

We may collect and use personal data and information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (collectively, “Personal Information”). Our Privacy Statement lists many of the types of Personal Information we may collect and use (see “4. How and why we obtain personal information about you”). Additionally, we may collect and use the following categories of information, to the extent not otherwise prohibited by law:

• Personal Identifiers (non-sensitive information that identifies you, such as your name, living address, mailing address, email address, state of residency, nonfinancial account number, employee number, and photographic/video imagery);
• Sensitive (information such as your social security number, driver license number, passport number, criminal history, date of birth, political views/affiliations/activity, religious views/affiliations/activity, union memberships, and other sensitive information which is generally considered subject to a heightened level of scrutiny and security);
• Demographic (information such as your age, marital status, gender/gender identification, race, income level, occupation, number of children, education level, housing type and the like);
• Personal Financial (information relating to your specific financial condition, credit scores, bank/credit/debit accounts, assets, debts, investments, motor vehicle registrations, and investment preferences, attitudes, characteristics, tendencies and behaviors);
• Internet or Other Electronic Network Activity Information (for example, browsing history, search history, login credentials, IP address, device identifiers, and information regarding interaction with an internet web site, application, or advertisement);
• Charitable (information relating to involvement with charities and charitable donations);
• Geolocation;
• Professional (information regarding your professional history, affiliations, licenses and certifications, as well as disciplinary events);
• Employment (past and current employment experience, status, performance, compensation and employment benefits);
• Legal (information such as legal proceedings, convictions, judgments and garnishments);
• Business/Commercial (information relating to your business activities, property and purchasing histories and tendencies, company affiliations, business contact information, business philosophies, and the like); and
• Education (information such as education level, degree(s), academic achievements/accomplishments, and personally identifiable information about a student or a student’s family, as those terms are defined in the federal Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g and implementing regulations in 34 C.F.R. Part 990).

Personal Information also includes inferences developed about your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes. Personal information does not include information that is publicly available (i.e., information lawfully made available by federal, state, or local governments

Personal information does not include deidentified or aggregated consumer information

2. Sources from which we may Collect or Receive Personal Information

We collect and receive Personal Information directly and indirectly from you and from others (“Information Sources”). Our Privacy Statement lists many of the sources from which we may collect or receive of Personal Information (see “4. How and why we obtain personal information about you” and “5. Cookies”)). Additionally, we may collect Personal Information

• via electronic technologies through which you interact with us, such as our external-facing public and private websites (including cookies), intranet sites, internal computer and communications networks, email messages and systems, voicemail messages and systems, text messages and systems, instant messages and systems, and third party services like LinkedIn and Facebook;
• from third parties such asocial media providers, advertising networks, data brokers, and other companies with which we have relationships in connection with the conduct of our business;
• via other electronic means, such as physical access control systems (e.g., door entry and other access control technologies, reception logs, closed circuit TV); and
• public records.

3. Purposes for which we may Collect or Use Personal Information

We collect and use Personal Information for a variety of purposes, as explained in our Privacy Statement (see “4. How and why we obtain personal information about you” and “7. Sharing your personal data”).

Additionally, we collect and use Personal Information in connection with

• personnel matters, such as employee and contractor hiring, management and other human resources functions; benefits administration; and life safety; and
• facilities management and operations, including physical access control.

4. Sale of Personal Information to Others and Your Opt-Out Rights

At this time, we do not sell (i.e., transfer in exchange for payment of money or other valuable compensation), and during the past 12 months have not sold, Personal Information to third parties. However, you have the right to opt out of the sale of Personal Information about you that might occur in the future. For more information about your right to opt out of the sale of Personal Information, or to submit a sale opt-out request to us, please click here or click the link at the bottom of this page entitled “Do Not Sell my Personal Information.”

5. Disclosure of Personal Information to Others

Although at this time we do not sell Personal Information, we do share Personal Information with others for business purposes. Our Privacy Statement explains how, when and with whom we share Personal Information (see “7. Sharing your personal data”). The categories of Personal Information we have shared during the past 12 months are listed below (although not every category of information may have been shared about every California resident):

6. Right to Request Deletion of Personal Information we Collect from You

You have the right to request that we delete Personal Information about you that we have collected from you. Upon receipt from you of a Verified Request (as defined below) asking that we delete Personal Information about you that we have collected from you, we shall delete all such information unless you request deletion of only certain items of information (in which case, we will only delete the items you request), and shall direct our service providers to do the same, except for Personal Information that that we or the service providers have a legal right or obligation to retain.

If we do not delete certain items of Personal Information because we have a legal right or obligation to retain that information, we shall notify you of that. Further, if we do not delete certain items of Personal Information because we have a legal right or obligation to retain that data, we shall delete that information at such later time that we no longer have a legal right or obligation to retain that information.

7. Right to Request Information about Personal Information we Collect about You

You have the right to request information about our collection of your Personal Information. Upon receipt from you of a Verified Request (as defined below) for information about our collection of Personal Information about you, we shall disclose to you:

• the categories of Personal Information we have collected about you during the 12 months prior to our receipt of your request;
• the categories of Information Sources from which we collected your Personal Information;
• a description of the business or commercial purpose for collecting or selling your Personal Information;
• descriptions by category or type of those third parties with whom we share Personal Information; and
• the specific pieces of Personal Information we have collected about you.

8. Right to Request Information about Sales and Disclosures

You have the right to request information about our sale and disclosure of Personal Information about you. Upon receipt from you of a Verified Request (as defined below) for information about our sale and disclosure of Personal Information about you, we shall disclose to you:

• the categories of Personal Information we have collected about you;
• the categories of Personal Information about you that we have sold to others during the 12 months prior to our receipt of your request, and descriptions by category or type of those purchasers; and
• the categories of Personal Information about you that we have shared with others during the 12 months prior to our receipt of your request.

9. How to Submit a Request

Starting on January 1, 2020, you may submit a request to us to delete Personal Information about you that we have collected from you, or a request for information about our collection of your Personal Information, or a request for information about our sale and disclosure of Personal Information about you.

For your convenience, we have established 4 alternative options for you to submit requests to us:

• You may call us, toll free, at 1-855-825-9101
• You may send a letter to our US Data Protection Officer at the postal address provided in the Privacy Statement
• You may send an email to our US Data Protection Officer at the email address provided in the Privacy Statement
• You may use our online request submission form available here

If you wish to opt out of the sale of Personal Information about you, please see “Sale of Personal Information to Others and Your Opt-Out Rights” above.

You also may authorize another person or a company to submit a request on your behalf. (See Section 10 below for more information on submitting requests through an authorized agent.)

10. Verified Requests; Authorized Agents

A “Verified Request” is a request that we can reasonably verify as having been submitted by you on your own behalf, or by you on behalf of any of your children under 18 years of age, or by another person or business registered with the California Secretary of State that is authorized by you to submit the Verified Request or that has general authority to act on your behalf.

Promptly after receiving your request, we will take such reasonable steps as may be needed to verify that the person making the request is the person about whom we have collected the Personal Information that is the subject of the request, that the person making the request is doing so on behalf of the person’s minor child, or that the person or company submitting the request on behalf of another is authorized to do so. In attempting to verify the request, we may:

• request sufficient information to enable us to identify the person making the request (for example, your full name, postal address, email address, employee number, account number, social security number, passport number, or birth date);
• request sufficient information to enable us to identify the person that is the subject of the request;
• request proof of identity (such as a copy of your driver’s license or passport, a recent utility bill or a recent account statement);
• if you are making the request on behalf of another person, request proof of your relationship with such other person and your authority to make the request on their behalf; and

If you have asked another person or company to submit a request on your behalf, your request must include an explanation of your relationship with that other person or company. In connection with processing your request, my may request additional information to verify that the person or company submitting the request on your behalf is authorized to do so. For example, we may require proof that a company submitting the request is registered with the California Secretary of State as well as a written certification or other documentation from you confirming the authority of that other person or company to submit the request on your behalf.

If we cannot reasonably verify the request, then we will not consider the request to be a “Verified Request” and we will not be required to honor the request. Similarly, we may refuse to process a request submitted by another person or company on your behalf if we are unable to confirm that the person or company submitting the request has been duly authorized by you to do so or that the request is otherwise fraudulent.

If we are unable to verify a request to delete Personal Information, the request will be treated as a request to opt out of the sale of Personal Information about you (see Section 4 above).

Any Personal Information we collect to verify a request, and which do not otherwise possess for other purpose, will be used solely for the purposes of verification of your request.

11. Responding to Requests

We will respond to a Verified Request to provide information within 45 days of receiving the request, unless a longer period of time is reasonably necessary to provide the requested information, in which case we may take up to 90 days to provide the requested information. If providing the requested information will require more than 45 days, then within 45 days of having received your request, we will notify you of the delay and the reason(s) for it.

Our response to a Verified Request to provide information will be in writing and will be delivered to you in the manner specified by you in your request. Information disclosed pursuant to the Verified Request, including any specific pieces of Personal Information we have collected about you that you have requested we provided to you, will be in a readily useable format that you can transmit to others.

If responding to a Verified Request does not require that we provide information to you (for example, if you are requesting that we delete Personal Information we have collected from you), then we will act on the request within 45 days of receipt, unless a longer period of time is reasonably necessary to act on the request, in which case we may take up to an additional 90 days (for a total of 135 days) to act on the request. If acting on such a request will require more than 45 days, then within 45 days of having received your request, we will notify you of the delay and the reason(s) for it.

If we have questions about your request or otherwise need to discuss it with you, we will attempt to contact you in the manner you have specified in your request for communicating with you.

If we do not take action on your request, we will inform you of that decision and the reasons for it within the time periods specified above.

We are not required under CCPA to provide information to you about our collection of your Personal Information or our sale and disclosure of Personal Information about you more than twice within a 12 month period. Additionally, we may refuse to honor unfounded or excessive repetitive requests to us, or charge a reasonable administrative fee for honoring those requests, and in either case, will notify you of our decision.

12. Fees & Charges

Except as noted above, you will not be charged by us for determining whether your request is a Verified Request, responding to your request (whether or not a Verified Request), providing information in response to your request, acting on your request, or communicating with you about your request.

13. Contacting Us Regarding Your Requests; Appeal

If you wish to contact us about a request you have submitted to us, or if you believe we have made a mistake in responding to or denying your request, you may contact our US Data Protection Officer by telephone, email or U.S. mail as specified above under “How to Submit a Request”.

14. Notice of Non-Discrimination

We shall not discriminate against you if you exercise your rights under CCPA. This means that we will not do any of the following things just because you have exercised your CCPA rights:

• deny goods or services to you;
• charge different prices or rates for goods or services, including through the use of discounts or other benefits of imposing penalties; or
• provide a different level or quality of goods or services to you

15. Financial Incentives

At this time we do not offer (a) monetary payments or other financial incentives in exchange for individuals permitting us to collect, sell or delete their Personal Information or (b) alternative prices or rates, or different levels or quality of goods or services, based on the value to us of your Personal Information.

16. Applicable Law & Exceptions

This Disclosure is being provided to you in accordance with the California Consumer Privacy Act of 2018, as amended (“CCPA”). The provisions of CCPA can be found in sections 1798.100 et seq of the California Civil Code.

Please be aware that in certain circumstances, the provisions of CCPA, including some or all of the provisions of this Disclosure, may be wholly or partially inapplicable. Please refer to CCPA for more information about those circumstances.

Until January 1, 2021, and subject to certain exceptions, CCPA and this Disclosure do not apply Personal Information described below:

• Personal Information collected by us about persons applying for jobs with us or about our employees, business owners/directors/officers and contractors
• Personal Information collected by us that is emergency contact information of persons applying for jobs with us or about our employees, business owners/directors/officers and contractors
• Personal Information collected by us that is necessary for us to administer benefits for others related to persons applying for jobs with us or our employees, business owners/directors/officers and contractors
• Personal Information about employees, owners, directors, officers and contractors of businesses and government agencies collected by us in connection with verbal or written communications, or business transactions, between us and those businesses or government agencies, and in the course of conducting due diligence regarding, or providing or receiving a product or service to or from such business or agency.

If we rely on an exception to CCPA in refusing to honor or act on your request to us, we will so notify you in our response to your request. If you are uncertain whether an exception to CCPA may apply to you or Personal Information about you, or if you have more questions regarding your rights under CCPA, please contact an attorney.

17. Changes to this Disclosure

From time to time we may make changes to this Disclosure. This Disclosure was last updated on January 1, 2020.