Room & Board, Inc. Privacy Policy for Human Resources Individuals

2. The Categories of Sources From Which We Collect Your Personal Information

• You, for example, in your application, forms you fill out for us, assessments you complete, surveys you submit, and any information you provide during the course of your relationship with us.
• Your spouse or dependent with respect to their own personal information.
• Vendors and service providers, for example, law firms.
• Third parties, for example, job references, business partners, professional employer organizations or staffing agencies, insurance companies.
• Public internet sources, for example, social media, job boards, public profiles, and other public online sources.
• Public records, for example, court records, and credentialing and licensing organizations.
• Automated technologies on Company’s electronic resources, for example, to track logins and activity across Company network.
• Surveillance/recording technologies installed by Company, for example, video surveillance in common areas of Company facilities, global positioning system (“GPS”) technologies, voicemail technologies, webcams, audio recording technologies, and blue-tooth technologies, any of these with consent to the extent required by law.
• Labor processes, including collective bargaining processes, National Labor Relations Board processes to determine union representation, and grievance and arbitration processes.
• Union agreements, including collective bargaining agreements and other agreements between Company and a union.
• Government or administrative agencies, for example, law enforcement, public health authorities, California Department of Industrial Relations, Employment Development Department.
• Acquired company, if Company acquired your employer, Company might collect personal information from that employer.

Note: This Privacy Policy does not cover background screening conducted by third-party background check vendors subject to the federal Fair Credit Reporting Act. Company provides separate notices for such screening.

3. The Purposes for Which We Use Your Personal Information

A. All HR Individuals

• Administration, including:
  • To manage personnel and workforce matters
  • To communicate with the workforce
  • To plan and arrange work supplies and workspaces
  • To fulfill recordkeeping and reporting responsibilities
  • For recruitment of new HR Individuals
  • To resolve internal grievances and disciplinary issues
  • To make business travel arrangements
  • To manage workforce-related emergencies, including health emergencies

• Workforce development, including:
  • To screen workforce for risks to Company and continued suitability in their positions
  • To conduct surveys

• Team-building, including:
  • To maintain an internal workforce directory and for purposes of identification
  • To facilitate communication, interaction, and collaboration among HR Individuals
  • To arrange meetings and manage Company-sponsored events and public service activities
  • To promote Company as a place to work
  • Workforce reporting and data analytics/trend analysis
  • For workforce satisfaction

• Monitoring, Security, and Compliance, including:
  • To monitor access to, and use of, Company facilities and information systems
  • To ensure compliance with applicable laws and Company policies
  • To conduct internal audits and investigations
  • To protect the safety and security of Company’s facilities, including preventing illicit activity
  • To report suspected criminal conduct to law enforcement and cooperate in investigations
  • To exercise Company’s rights under applicable law and to support any claim, defense, or declaration in a case or before a jurisdictional and/or administrative authority, arbitration, or mediation panel

• Conducting Our Business, including:
  • To engage in marketing, advertising, and promotion
  • For communications with prospective, current, and former customers
  • To provide a directory and contact information for prospective and current customers and business partners
  • For customer service purposes
  • To manage business expenses and reimbursements
  • To engage in project management
  • To conduct product and service training
  • To conduct research and development
  • To conduct quality assurance and improvement
  • For event planning
  • To engage in crisis management

• Miscellaneous Other Purposes:
  • To manage and operate information technology and communications systems, risk management and insurance functions, budgeting, financial management and reporting, and strategic planning;
  • To manage litigation involving Company, and other legal disputes and inquiries and to meet legal and regulatory requirements;
  • In connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of Company or any of its subsidiaries or affiliates;
  • To manage licenses, permits, and authorizations applicable to Company’s business operations; and
  • To protect the rights, property, or safety of Company, HR Individuals, customers or others.

B. Employees

• Administration, including:
  • To set up and manage a personnel file
  • To manage performance
  • To administer compensation, bonuses, equity grants, other forms of compensation, and benefits (as permitted by law)
  • To manage vacation, sick leave, and other leaves of absence
  • To track hours and attendance

• Employee development, including:
  • To provide, evaluate, and manage training and career development
  • To evaluate job performance and consider employees for other internal positions or promotions
  • To assist with professional licensing
  • To develop a talent pool and plan for succession

• Team-building, including:
  • For diversity and inclusion programs
  • To arrange team-building and other morale-related activities
  • To design employee retention programs

• Purposes For Using Employees’ Geolocation Data:
  • Company may issue employees an RFID-enabled security badge that tracks employee’s location within Company’s facilities.
  • Company may require field service employees to download a location tracking application (“app”) to allow customers to see these employees’ location only during working time but only for customers awaiting a service call.
  • Company may track the location of company-owned devices that can be associated with an employee.

• Purposes For Using Employees’ Health Information:
  • To the extent necessary to comply with Company’s legal obligations, such as to accommodate disabilities
  • To conduct a direct threat analysis in accordance with the Americans with Disabilities Act and state law
  • For workers’ compensation purposes
  • For occupational health surveillance
  • For occupational health and safety compliance and record-keeping
  • To conduct fitness-for-duty examinations
  • To administer leaves of absence and sick time
  • To provide a wellness program
  • To respond to an employee’s medical emergency

Note: This Privacy Policy does not cover health information governed by the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH Act), or California’s Confidentiality of Medical Information Act (CMIA) because these laws have their own disclosure requirements.

• Purposes For Using Employees’ Protected Categories of Information:
  • Company collects information about race, age, national origin, disability, sex, and veteran status as necessary to comply with legal obligations, including the reporting requirements of the federal Equal Employment Opportunity Act, The Office of Federal Contracting Compliance Programs (applicable to government contractors), and state laws, where applicable, such as the California’s Fair Employment and Housing Act. Company also collects information about disability status to the extent an employee may need special assistance during emergencies from Company or from first responders.
  • Company also collects the following characteristics (in addition to those listed above) for its diversity and inclusion programs (including analytics): (a) religion, (b) sex, (c) gender, (d) pregnancy, (e) childbirth, (f) breastfeeding, or related medical conditions, (g) sexual orientation, (h) disability, (i) gender identity, (j) gender expression, (k) marital status, (l) age, (m) familial status, or (n) ancestry.

• Company also uses this personal information for purposes including:
  • with respect to disability, medical condition, familial status, marital status, and pregnancy, childbirth, breastfeeding, and related medical conditions: as necessary to comply with Federal and California law related to leaves of absence and accommodation;
  • with respect to military and veteran status: as necessary to comply with leave requirements under applicable law and for tax purposes;
  • with respect to age: incidentally to the use of birth date for birthday celebrations and identity verification;
  • with respect to religion and pregnancy, childbirth, breastfeeding, and related medical conditions: as necessary for accommodations under applicable law;
  • with respect to protected classifications, such as national origin: to the extent this information is contained in documents that you provide in I-9 documentation; and
  • with respect to marital status and familial status: for Company events and as necessary to provide benefits and for tax purposes.

• Company collects personal information about membership in protected categories on a purely voluntary basis, except where required by law, and uses the information only in compliance with applicable laws and regulations.

C. Contingent Workforce

• Managing Contingent Workforce, including:
  • To evaluate the individual’s qualifications for engagements, including licensure and certifications
  • To negotiate and execute the agreement with the individual
  • To provide orientation and familiarization with Company’s working environment
  • To administer the contractual relationship, including payments
  • To manage absences

D. Related Contacts

• Spouse and Dependents/Beneficiaries
  • To manage and administer benefits
  • To communicate with the individual and manage the relationship
  • To arrange travel to, and manage participation in, Company events
• Emergency Contacts
  • To communicate in the event of an emergency involving the individual who provided the emergency contact’s information

4. How We May Disclose Your Personal Information

Company generally maintains information related to its personnel as confidential. However, from time to time, Company may have a legitimate business need to disclose personnel information for one of the purposes listed in Section 2, above, to one or more of the categories of recipients listed below. In that event, Company discloses your personal information only to the minimum extent necessary to achieve the purpose of the disclosure and only if the disclosure is permitted by the CPRA and other applicable laws.

• We may disclose your personal information to third parties at your direction.
• Company discloses your personal information to service providers and contractors to assist us in meeting our business needs and contractual and legal obligations.
  • Company discloses your personal information to service providers and contractors only subject to written contracts in compliance with the CPRA and any other applicable law.
  • Service providers and contractors include auditors, administrative service providers, law firms, travel agencies, benefits providers, and any other entity providing services to Company.
• Clients and customers: This may include, for example, disclosing a sales representative’s contact information with clients.
• Business partners: For example, Company might disclose your business contact information to a co-developer of a new product or service with which you will be working.
• Government or administrative agencies: These may include, for example:
  • Internal Revenue Service to pay taxes;
  • Employment Development Department as required for state payroll taxes and to respond to unemployment or state disability insurance claims;
  • OSHA as required to report work-related death or serious injury or illness;
  • Department of Fair Employment and Housing as required to respond to employment charges; and
  • California Department of Industrial Relations as required to resolve workers’ compensation claims.
• Public: Company may disclose your personal information to the public as part of a press release, for example, to announce promotions or awards. If you do not want your personal information in press releases, please contact Human Resources at humanresources@roomandboard.com. Company does not disclose sensitive personal information to the public.
• Required Disclosures: We may be required to disclose personal information (a) in a court proceeding, (b) in response to a court order, subpoena, civil discovery request, other legal process, or (c) as otherwise required by law.
• Legal Compliance and Protections: We may disclose personal information when we believe disclosure is necessary to comply with the law or to protect the rights, property, or safety of Company, our users, or others.

5. How Long We Keep Your Personal Information

Company will retain your personal information for the period necessary to fulfill the purposes outlined in this policy unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods are as follows: (i) the duration of the application process or considering whether your skills are suitable for other opportunities; (ii) as long as we have an ongoing relationship with you; (iii) as required by a legal obligation to which we are subject; and (iv) as advisable in light of our legal considerations such as applicable statutes of limitations, litigation, or regulatory investigations.

6. Privacy Rights for HR Individuals Who Are California Residents

A. Your California Privacy Rights

• You have the right to submit a verifiable request up to twice in a 12-month period for specific pieces of your personal information obtained from you and for information about the Company’s collection, use, and disclosure of your personal information.
• Please note that the CPRA’s right to obtain “specific pieces” does not grant a right to the whole of any document that contains personal information, but only to items of personal information. Moreover, HR Individuals have a right to know categories of sources of personal information and categories of third parties to which personal information is disclosed, but not the individual sources or third parties. Company does not always track individualized sources or recipients.
• You have the right to submit a verifiable request for the deletion of personal information that you have provided to Company.
• You have the right to submit a verifiable request for the correction of inaccurate personal information maintained by Company, taking into account the nature of the personal information and the purposes of processing the personal information.
• Company does not collect or process sensitive personal information or characteristics of protected classifications for the purpose of inferring characteristics about the HR Individual.
• No sales and no “sharing”, i.e., disclosure for cross-context behavioral advertising:
• Company does not sell the personal information of any HR Individuals nor disclose their personal information for cross-context behavioral advertising.

B. How to Exercise Your Rights

• Company will respond to requests to know, delete, and correct in accordance with applicable law if it can verify the identity of the individual submitting the request. You can exercise these rights in the following ways:
  • Call 1-888-985-4469
  • Email wellness@roomandboard.com.
• To restrict the use and disclosure of your sensitive personal information to permitted purposes, contact us via the phone number or email address provided above.

C. How We Will Verify Your Request:

The processes that we follow to verify your identity when you make a request to know, correct, or delete are described below. The relevant process depends on how and why the request is submitted.

• If you submit a request by any means other than through a password-protected account that you created before the date of your request, the verification process that we follow will depend on the nature of your request as described below:
• Requests To Know Categories Or Purposes: We will match at least two data points that you provide with your request, or in response to your verification request, against information about you that we already have in our records and that we have determined to be reliable for purposes of verifying your identity. Examples of relevant data points include your mobile phone number, your zip code, or your employee identification number.
• Requests To Know Specific Pieces Of Personal Information: We will match at least three data points that you provide with your request, or in response to our request for verification information, against information that we already have about you in our records and that we have determined to be reliable for purposes of verifying your identity. In addition, we may require you to sign a declaration under penalty of perjury that you are the individual whose personal information is the subject of the request.
• Requests To Correct or Delete Personal Information: Our process for verifying your identity will depend on the risk level (as determined by Company) associated with the personal information that you ask us to correct delete. For low-risk personal information, we will require a match of two data points as described in Point No. 1, above. For higher risk personal information, we will require a match of three data points and a signed declaration as described in Point No. 2, above.
• We have implemented the following additional procedures when verifying the identity of requestors:
  • If we cannot verify your identity based on the processes described above, we may ask you for additional verification information. If we do so, we will not use that information for any purpose other than verification.
  • If we cannot verify your identity to a sufficient level of certainty to respond to your request, we will let you know promptly and explain why we cannot verify your identity.

D. Authorized Agents

If an authorized agent submits on your behalf a request to know, correct or delete, the authorized agent must submit with the request either (a) a power of attorney, signed by you, that is valid under California law; or (b) another document signed by you that authorizes the authorized agent to submit the request on your behalf. In addition, we may ask you or your authorized agent to follow the applicable process described above for verifying your identity. You can obtain “Authorized Agent Designation” form by contacting us at wellness@roomandboard.com.

E. Company’s Non-Discrimination and Non-Retaliation Policy

Company will not unlawfully discriminate or retaliate against you for exercising your rights under the California Privacy Rights Act.