Les Schwab Tire Centers Privacy Values and Policy -
Employees, Job Applicants and Contractors

Effective Date: 2/9/2023

Last Reviewed: 2/9/2023

This Privacy Notice for California Residents (“Notice”) applies solely to job applicants, employees, and contractors who reside in the State of California (“employees” or “you”). This Notice complies with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this Notice.

Information We Collect

Les Schwab collects “Personal Information,” which is any information that can be used to identify, relate to, describe, or be linked to a specific employee or contractor. Personal Information includes, but is not limited to, names, addresses, phone numbers, and email addresses. Les Schwab is committed to protecting the privacy of our employees and contractors and takes necessary measures to secure Personal Information from unauthorized access, misuse, accidental loss, and alteration.

Notice of Employee Monitoring

The Company’s employees and contractors have no expectation of privacy when using the Company’s technology or accessing the Company’s technology resources or information. You should review any other agreements or contracts that may apply to your relationship with the Company. (See also, the Company’s Electronic Information and Communications Policy)

Information We Collect and Sources of Personal Information

The Company collects personal information, as defined by the CCPA (“Personal Information”), through its online application and onboarding platforms and at its physical locations. In particular, Les Schwab has collected the following categories of Personal Information from its employees within the preceding twelve (12) months:

• Identifiers (e.g. real name, postal address, internet protocol address, email address)
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) (e.g. name, address, telephone number)
• Protected classification characteristics under California or federal law (e.g. age, gender)
• Internet or other similar network activity (e.g. browsing history, search history, and information regarding a Employee’s interaction with an internet website, application, or advertisement)
• Geolocation data (e.g. geographic location)
• Professional or employment-related information (e.g. information about previous employment)
• Non-public education information (e.g. school records or transcripts)
• Audio, Visual (Photographs, Video) or similar information
• Biometric information (Hair color, eye color, fingerprints, height, retina scans, facial recognition, voice, and other biometric data)

The examples listed above are illustrative and may not reflect all of the specific pieces of Personal Information we collect from any particular employee, nor do they provide a complete list of the specific pieces of Personal Information for each category.

Personal Information does not include information that falls outside of the CCPA’s definition of Personal Information or is excluded from the CCPA’s scope. Such information includes, but is not limited to:

• Publicly available information from government records
• Deidentified or aggregated Employee information
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994

Sensitive PI

The Company is committed to diversity and inclusion in the workplace and strive to ensure our employee demographics reflect the communities it serves. In order to assess and address any potential disparities, the Company may collect and use sensitive Personal Information about the race and ethnicity of our employees and customers.

The Company collects this information from trusted vendors who have safeguards in place to protect the privacy and security of sensitive data. The information is used solely for the purpose of comparing employee ethnicity against customer percentages and is not shared with any third parties.

Automated Decision-Making

The Company does not use automated decision-making techniques in making any decisions related to its employees. All decisions such as hiring, promotion, and disciplinary actions are made through a fair and transparent process that involves human review and input.

Purpose for Collection of Personal Information

We may use or disclose the Personal Information we collect for one or more of the following purposes:

• To facilitate your application for employment with the Company;
• To facilitate your employment or professional relationship with the Company;
• To communicate with you;
• To compensate and provide other benefits to you;
• To comply with legal obligations, such as responding to law enforcement requests and as required by applicable law, court order, or governmental regulations;
• To ensure the safety of our employees, contractors, facilities, and property;
• To ensure security and prevent unauthorized use of data; and
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA.

The Company enters into written contracts with its service providers to ensure the privacy and security of your Personal Information. Under these contracts, the Company restricts the access to and processing of your Personal Information to that which is necessary for the purpose of the disclosure.

In certain circumstances, the Company provides you with opportunities to sign up for certain benefits programs that involve the disclosure of your Personal Information to third party benefits providers. Any such program will be purely optional and based on your opt-in participation. In such situations, you should review the third-party benefits providers’ terms and privacy policy to see how they process your information.

Sales of Personal Information

In the preceding twelve (12) months, the Company did not sell its employee Personal Information.

Retention of Personal Information

Any Employee or Contractor Personal Information collected by the Company will be retained by the Company during the period of active employment of the Employee or service relationship of the Contractor, as well as during the post-employment period as long as the Personal Information is used to serve its original purpose or as directed by applicable legislation, regulation, or internal document retention programs. The Company will ensure all practices and procedures relating to the disposal of Personal Information will respect your privacy and will be done confidentially.

Your Rights and Choices

The CCPA provides employees (California residents) with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request the Company disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once the Company receives and confirms your verifiable employee request, the Company will disclose to you:

• The categories of Personal Information it collected about you.
• The categories of sources for the Personal Information that the company has about you.
• Its business or commercial purpose for collecting or selling that Personal Information.
• The categories of third parties with whom it shared that Personal Information.
• The specific pieces of Personal Information it collected about you (also called a “data portability request”).
• If it sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
• Sales, identifying the Personal Information categories that each category of recipient purchased; and
• Disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.

Personal Information Sales Opt-Out and Opt-In Rights

Employees and contractors have the right to direct the Company to not sell your Personal Information at any time (the “right to opt-out”).

Once you make an opt-out request, the Company will wait at least twelve (12) months before asking you to reauthorize Personal Information sales. However, you may change your mind and opt back in to Personal Information disclosures and/or sales at any time by:

The Company will only use Personal Information provided in an opt-out request to review and comply with the request.

Deletion Request Rights

You have the right to request the Company delete any of your Personal Information collected from you and retained, subject to certain exceptions. Once a verifiable Employee request is received and confirmed, the Company will delete (and direct its service providers to delete) your Personal Information from applicable records, unless an exception applies.

The Company may deny your deletion request if retaining the information is necessary for the Company or its service provider(s) to:

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Exercise free speech, ensure the right of another Employee to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with Employee expectations based on your relationship with the Company.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable Employee/Contractor request to the Company by either:

Only you, or someone legally authorized to act on your behalf, may make a verifiable Employee/Contractor request related to your Personal Information.

You may only make a verifiable Employee/Contractor request for access or data portability twice within a 12-month period. The verifiable Employee/Contractor request must:

• Provide sufficient information that allows the Company to reasonably verify you are the person about whom the Company collected Personal Information or a legally authorized representative.
• Describe your request with sufficient detail that allows the Company to properly understand, evaluate, and respond to it.

The Company cannot respond to your request or provide you with Personal Information if it cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable Employee request does not require you to create an account with the Company. The Company will only use Personal Information provided in a verifiable Employee request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

The Company endeavors to respond to a verifiable Employee request within forty-five (45) days of its receipt. If more time is required (up to forty-five (45) additional days), the Company will inform you of the reason and extension period in writing.

The Company will deliver its written response by mail or electronically, at your option.

Any disclosures the Company provides will only cover the 12-month period preceding the verifiable employee request’s receipt. The response provided will also explain the reasons the Company cannot comply with a request, if applicable. For data portability requests, the Company will select a format to provide your Personal Information that is readily usable and should allow you to transmit the information from one entity to another entity.

The Company does not charge a fee to process or respond to your verifiable employee request unless it is excessive, repetitive, or manifestly unfounded. If the Company determines the request warrants a fee, it will tell you why and provide you with a cost estimate before completing your request.

Legal Disclaimer

The Company does not guarantee your Personal Information will never be compromised. Further, while the Company employs reasonable measures to protect your Personal Information, it does not guarantee unauthorized third parties will not defeat those measures or use non-public Personal Information for improper purposes. Nevertheless, the Company values your relationship with the Company and adopted this Policy and undertaken reasonable security measures as an endeavor to respect your privacy and to keep your Personal Information confidential.

Unenforceability

If any part of this Policy is determined to be invalid or unenforceable pursuant to applicable law, then the invalid or unenforceable provision will be deemed superseded by a valid, enforceable provision that most closely matches the intent of the original provision, and the remainder of the Policy will continue in full force and effect.

Questions