Privacy Notice for California Employees and Applicants

About this Notice

This Privacy Notice (Notice) explains how Activate and its brands located in the US (We, our, us, Activate) collects, uses and shares (“processes”) your personal data in line with the California Consumer Privacy Act of 2018 (“CCPA“) and the California Privacy Rights Act of 2020 (“CPRA“) in connection with your employment relationship with us.

We will not sell your personal information, including any sensitive personal information. Nor will we share your data with third parties for cross-context behavioural advertising.

Personal Information Category	Business Purpose	Sold
Identifiers, such as your full name, contact information, gender, date of birth, signature, Social Security number, driver’s license or state identification numbers, and similar information for your dependents and beneficiaries.	●        Recruit and process employment applications, including verifying eligibility for employment and conducting background and related checks. ●        Conduct employee onboarding. ●        Maintain and administer payroll and employee benefit plans, including enrollment and claims handling. ●        Maintain personnel records and comply with record retention requirements. ●        Provide employees with human resources management services and employee data maintenance and support services. ●        Communicate with employees and their emergency contacts and plan beneficiaries. ●        Comply with applicable state and federal labor, employment, tax benefits, workers’ compensation, disability, equal employment opportunity, workplace safety, and related laws. ●        Prevent unauthorized access to or use of the Company property, including information systems, electronic devices, network, and data. ●        Ensure employee productivity and adherence to Company policies. ●        Conduct internal audits and investigate complaints, grievances, and suspected violations of company policy. ●        Respond to law enforcement requests and as required by applicable law or court order. ●        Exercise or defend the legal rights of the Company and its employees,  and affiliates, customers, contractors, and agents. ●        For the creation and development of in-house AI-enabled tools.	No
California Customer Records employment and personal information, such as your name, signature, Social Security number, physical characteristics or description, photograph, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, current employment, employment history, membership in professional organizations, licenses and certifications, bank account number, credit card number, debit card number, or any other financial, medical or health insurance information.	●        Same purposes as for identifiers category. ●        Administering termination and post-termination matters, e.g. outplacement services, liaison with employee legal representatives, enforcing restrictive covenants, expense reimbursements, employee benefits, and conducting termination and post-termination litigation.	No
Protected classification characteristics under California or federal law, such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, reproductive health decisionmaking, military and veteran status, or genetic information (including familial genetic information).	●        Comply with federal and state equal employment opportunity laws. ●        Design, implement, and promote the Company’s diversity and inclusion programs. ●        Perform workforce analytics, data analytics, and benchmarking. ●        Conduct internal audits, grievances, and suspected violations of Company policy. ●        Exercise or defend the legal rights of the Company and its employees, affiliates, customers, contractors, and agents.	No
	●        Respond to law enforcement requests and as required by applicable law or court order. ●        In order to fulfill expenses claims as they fall due. ●        Providing and administering remuneration, benefits, pensions and incentive schemes.	No
Professional or employment-related information, such as employment application information (work history, academic and professional qualifications, educational records, references, and interview notes, background check, drug testing results, work authorization, performance and disciplinary records, salary, bonus, commission, and other similar compensation data, benefit plan enrollment, participation, and claims information, leave of absence information including religious, military and family obligations, health data concerning employee and their family members.	●        Recruit and process employment applications, including verifying eligibility for employment, background checks, and onboarding. ●        Maintain personnel records and comply with record retention requirements. ●        Comply with applicable state and federal labor, employment, tax, benefits, workers’ compensation, disability, equal employment opportunity, workplace safety, and related laws. ●        Prevent unauthorized access to or use of the Company’s property, including its information systems, electronic devices, network, and data. ●        Ensure employee productivity and adherence to the Company policies. ●        Conduct internal audits and investigate complaints, grievances, and suspected violations of the Company policy. ●        Evaluate and provide useful feedback about job performance, facilitate better working relationships, and for employee professional development. ●        Exercise or defend the legal rights of the Company and its employees, affiliates, customers, contractors, and agents. ●        Administering termination and post-termination matters, e.g. outplacement services, liaison with employee legal representatives, enforcing restrictive covenants, expense reimbursements, employee benefits, and conducting termination and post-termination litigation.	No

Sensitive personal information is a subtype of personal information consisting of specific information categories. While we collect information that falls within the sensitive personal information categories listed in the table below, the CCPA does not treat this information as sensitive because we do not collect or use it to infer characteristics about a person.

Sensitive Personal Information Category	Business Purpose	Sold
Government identifiers, such as your Social Security number, driver’s license, state identification card, and passport and visa information, and immigration status and documentation.	●        Recruit and process employment applications, including verifying eligibility for employment and conducting background and related checks. ●        Process and administer payroll and employee benefit plans, including enrollment and claims handling. ●        Maintain personnel records and comply with record retention requirements. ●        Provide employees with human resources management services and employee data maintenance and support services. ●        Comply with applicable state and federal labor, employment, tax benefits, workers’ compensation, disability, equal employment opportunity, workplace safety, and related laws. ●        Respond to law enforcement requests and as required by applicable law or court order.	No
Complete account access credentials, such as usernames, account numbers, or card numbers combined with required access/security code or password.	●        Provide employees with human resources management services and employee data maintenance and support services. ●        Prevent unauthorized access to or use of the Company information systems, electronic devices, network, and data.	No
Precise geolocation, such as physical access to a Company office location, IP address or the location of a delivery, sales, or other employees in the field.	●        Improve safety of employees, customers, and the public regarding use of the Company property and equipment. ●        Prevent unauthorized access, use, or loss of the Company property. ●        Ensure employee productivity and adherence to the Company’s policies. ●        Exercise or defend the legal rights of the Company and its employees, affiliates and customers. ●        For the creation and development of in-house AI-enabled tools.	No
Racial or ethnic origin.	●        Comply with federal and state equal employment opportunity laws. ●        Design, implement, and promote the Company’s diversity and inclusion programs. ●        Perform workforce analytics, data analytics, and benchmarking. ●        Conduct internal audits and investigate complaints, grievances, and suspected violations of Company policy.	No
Religious or philosophical beliefs.	●        Review and process religious reasonable accommodation requests. ●        Exercise or defend the legal rights of the Company and its employees, affiliates and customers. ●        Perform workforce analytics, data analytics, and benchmarking.	No
Union membership.	●        Implement appropriate policies and procedures. ●        Deduct union dues from paychecks.	No
Mail, email, or text message contents not directed to the Company.	●        Conduct internal audits and investigate complaints, grievances, and suspected violations of the Company policy. ●        In order to give effect to data subject rights under data protection legislation. ●        Exercise or defend the legal rights of the Company and its employees, affiliates and customers.	No
Genetic data.	●        Investigate and process workers’ compensation claims. ●        Process health insurance claims.	No
Health information, including job restrictions, disabilities and workplace illness and injury information.	●        Processing information about absence in order to determine fitness for work, facilitate a return to work, make adjustments or accommodations to duties or the workplace, make management decisions regarding employment or engagement or continued employment or engagement or redeployment and conduct related management processes. ●        Investigate and process workers’ compensation claims. ●        Process health insurance claims. ●        Ensure equal access to retirement programs and fertility planning. ●        Ensure equal family leave policies and insurance for transgender surgeries. ●        Perform workforce analytics, data analytics, and benchmarking	No
Sex life or sexual orientation information.	●        Process health insurance claims. ●        Ensure equal access to retirement programs and fertility planning by same-sex spouses. ●        Ensure equal family leave policies and insurance for transgender surgeries. ●        Perform workforce analytics, data analytics, and benchmarking	No

AUTOMATED DECISION MAKING, PROFILING AND USE OF AI TECHNOLOGY

Your data will not be subject to automated decision-making or profiling, save for the following exceptions:

• communications sent and received using work-related internal or third-party chatbot systems;
• personal data that you input into internal or third-party AI tools for the purpose of facilitating your work.
• where personal data is entered by the user into these work-related chatbots or other AI systems, this information may also be collected and stored for tracking and product improvement.

Where Activate has provided you with an AI-enabled tool or product that has been created by one of our internal teams, please note that your data will not be used to train any underlying models.

Equally, and to aid transparency around our processing of personal data within the context of AI development, you will always be issued with a specific privacy notice in relation to that AI product or tool and/or a “just in time notice” before you can input any data. Please note that, depending on the AI models you are interacting with, any data you input may be accessed and/or used by these model’s providers for the purposes specified in their privacy notices. We recommend you consult the provider’s privacy notices to understand how your data may be used.

 

DATA SHARING

In order to fulfill the business purposes set out above personal information may be transferred within or outside of the jurisdiction where you are employed or perform work, either within our Group or to third parties, including, but not limited to:

• any holding company, subsidiary, affiliate of Activate
• with our chosen professional employer organization and or employer of record that we partner with
• certain third parties such as suppliers and service providers including payroll, pension providers ,to whom we may disclose personal information when required by law or court order, or as requested by any government or regulator or law enforcement authority or agency

Activate may also disclose personal information to a third party where it is necessary to do so in order to protect or pursue our legitimate interests (ensuring this is proportionate and limited to information which is strictly necessary for the purpose of the processing activity). This may include, but not be limited to, disclosure to a party with whom we are in negotiation for the sale or transfer of a business, assets or services. Activate will take appropriate steps to ensure that the recipient of personal information in such circumstances puts in place an adequate level of protection for such personal information in accordance with applicable legal requirements.

If you would like further information in relation to data sharing, please contact dpo-hub@Activate.com

DATA RETENTION

We will retain your Personal Data for as long as is reasonably necessary for the purposes explained in this Notice. This will usually be the period of your employment or other contract with us plus the length of any applicable statutory limitation period following your departure, although some data, such as pension information, may need to be kept for longer.

In some circumstances, we may retain your Personal Data for longer periods of time, for instance, where we are required to do so in accordance with legal, regulatory, tax or accounting requirements.

In some cases, we may also retain your Personal Data for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your relationship with us. Where your Personal Data is no longer required, we will ensure it is either securely deleted or stored in a way that no longer identifies you.

If you would like further details regarding our records retention, please contact the Data Protection and Privacy Office at dpo-hub@Activate.com

YOUR RIGHTS

Under the CCPA as amended, you have the following rights:

Right to be Informed. We are required by law to provide individuals with clear and precise transparency information regarding who we are and what we do with your data. This includes your right not to have your data subject to onward sale.

Right of Access. You have the right to access and review copies of your personal data alongside any other supplementary information that can better help you understand the data that we hold about you.

Right to Rectification. You have the right to correct any information that we hold about you that may be incorrect subject to any requirement to keep historical records.

Right to Erasure. You have the right to request that all data pertaining to you be erased from our systems. Please note that there are certain circumstances where this request may not be possible. If we are unable to comply, we will issue you with meaningful information regarding why this is the case.

Right Not to Be Subject To Automated Decision-Making. You have the right to request human intervention into any process involving automated decision-making or profiling where that processing results in legal or similarly significant effects.

Right Not to Receive Discriminatory Treatment. You have the right not to receive discriminatory treatment, including retaliation, by us for your exercise of privacy rights conferred by the CCPA.

Please note that the rights set out above are not absolute. Requests may be excluded where exemptions apply.

CONTACT AND COMPLAINTS

Under data protection legislation you have the right to make a complaint in relation to how your personal information is processed. If you do wish to register a complaint, you can submit this in writing to your line manager or alternatively you can email a copy of your complaint for the attention of the Head of Data Protection/ Data Protection Officer at dpo-hub@Activate.com

If following such a referral, you are still not satisfied with how your personal data is used by Activate you can make a complaint to the relevant Data Protection Regulatory Authority.

CHANGES TO THIS NOTICE

Activate will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.