California Employees and Applicants Privacy Policy and Notice at Collection (CCPA)

This California Employees and Applicants Privacy Policy and Notice at Collection describes how Business Wire, Inc. and its subsidiaries, affiliates, and related entities (“Business Wire,” “we,” “us,” or “our”) collect and process personal information about our employees and applicants who reside in California. We are committed to the proper handling of your personal information collected, processed, or retained in connection with your relationship with us.  This privacy policy and notice describes the categories of personal information we collect and the purposes for which we process that information in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”).  All terms used in this privacy policy and notice have the meaning afforded to them in the CCPA, whether or not such terms are capitalized herein.    

1. PERSONAL INFORMATION COLLECTION

What Personal Information Business Wire Collects

We collect, receive, maintain and/or share personal information with our service providers. The categories and purposes described below for use of personal information reflect data processed across our service providers in support of employment-related administration, compliance, and business operations.

Personal information does not include: 

• Publicly available information from government records or made publicly available by you or with your permission;
• Deidentified or aggregated consumer information;
• Information excluded from the scope of the CCPA, such as information covered by certain sector-specific privacy laws like the Health Insurance Portability and
• Accountability Act or the Fair Credit Reporting Act; or
• Personal information from residents outside of California

How We Use and Retain Your Personal Information

We may use and disclose personal information we collect to advance Business Wire’s business purposes, specifically to:

1. To comply with state and federal laws and regulations;
2. To manage your employment relationship with us, including:
   1. processing payroll;
   2. tracking time and attendance;
   3. onboarding;
   4. managing workers’ compensation claims;
   5. administering and maintaining benefits, including group health insurance;
   6. administering and maintaining retirement services;
   7. managing employee performance of their job duties, including promotions, discipline, and/or termination;
   8. training and developing employees;
   9. creating, maintaining, and securing your online employee accounts;
   10. providing human resource management services and employee data maintenance and support services;
   11. reaching you, your emergency contacts, and plan beneficiaries when needed, such as when you are not reachable or are injured or ill;
   12. improving employee productivity and Business Wire’s efficiency, logistics, and supply chain management;
   13. ensuring compliance with Business Wire’s information systems policies and procedures;
   14. maintaining personnel records and complying with record retention requirements; and
   15. other human resources purposes.
3. To conduct internal audits and workplace investigations;
4. To recruit and evaluate job applicants and candidates for employment;
5. To obtain and verify background checks;
6. To grant, manage, and monitor employees’ access to and prevent unauthorized access to or use of our property, including facilities;
7. To implement, monitor, and manage electronic security measures on Business Wire managed devices and systems, including endpoint protection, device compliance checks, access logging, and detection of unauthorized activity;
8. To maintain commercial insurance policies and coverages, including for workers’ compensation and other liability insurance;
9. To investigate and enforce compliance with and potential breaches of our policies and procedures;
10. To perform workforce analytics, data analytics, and benchmarking;
11. To administer and maintain Business Wire’s operations, including for safety purposes;
12. To exercise or defend the legal rights of Business Wire and its employees, affiliates, customers, contractors, and agents;
13. To respond to law enforcement requests and as required by applicable law or court order; and
14. As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We limit monitoring to what is necessary to protect company data, detect threats, and comply with legal requirements. Only authorized personnel have access to monitoring data.

We may use or disclose sensitive personal information for the following statutorily approved reasons (“Permitted SPI Purposes”):

1. Performing actions that are necessary for our employment relationship and that an average employee in an employment relationship with us would reasonably expect;
2. Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, and/or confidentiality of stored or transmitted personal information;
3. Defending against and prosecuting those responsible for malicious, deceptive, fraudulent, or illegal actions directed at Business Wire;
4. Ensuring physical safety;
5. Short-term, transient use, such as non-personalized advertising shown as part of an employee's current employment with us, if we do not:
   1. disclose the sensitive personal information to another third party; or
   2. use it to build a profile about the employee or otherwise alter the employee's experience outside their current employment with Business Wire.
6. Services performed for Business Wire, including maintaining or servicing accounts, providing human resources and employee benefits administration, processing or fulfilling transactions, verifying employee information, processing payments, or providing financing, analytic services, storage, or similar services for Business Wire;
7. Activities required to:
   1. verify or maintain the quality or safety of a product, service, or device that we own, had manufactured, or control; and
   2. improve, upgrade, or enhance the service or device that we own, had manufactured, or controlled.
8. Collecting or processing sensitive personal information not for the purpose of inferring characteristics about an employee.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. If required by law, we will also seek your consent before using your personal information for a new or unrelated purpose.

We may collect, process, and disclose aggregated or deidentified information about our employees for any purpose, without restriction. When we collect, process, or disclose this aggregated or deidentified information, we will maintain and use it in deidentified form and will not attempt to reidentify the information, except to determine whether our deidentification processes satisfies any applicable legal requirements.

Business Wire retains personal information for as long as reasonably necessary to fulfill the purposes described above, including satisfying legal, regulatory, tax, accounting, and operational requirements. Certain employment-related records may be retained permanently or for extended periods as required by applicable law.

2. DISCLOSURE OF PERSONAL INFORMATION

What Business Wire Discloses and to Whom

In the 12 months preceding the date of this privacy policy and notice, we have not sold personal information subject to CCPA nor have we sold personal information of employees or applicants we know are under the age of 16 years. We do not share your personal information with third parties for cross-context behavioral advertising.

Over the past 12 months we have shared, and may continue to share on an ongoing basis, listed in Categories A-J with the following third parties to fulfill business purposes as listed in the section above entitled “How We Use and Retain Your Personal Information” such as to help us administer our human resources functions, payroll, benefits administration, background screening, insurance administration, legal compliance, information technology hosting, workplace security, and other employment-related services:

• Service providers
• Human Resources service providers, including providers of human resources, absence management, benefits, payroll, health insurance, and timekeeping services
• Operating systems and platforms
• Third parties as part of our employment process, such as consumer reporting agencies for employment background checks
• Accountants, lawyers, and auditors, for the business purpose of auditing compliance with policies and applicable laws and performing services on our behalf
• Our affiliates, subsidiaries, and parent companies
• Third parties with whom you direct us to share your personal information
• Customers, such as business contact information for customer support purposes
• Government entities

3. YOUR RIGHTS AND CHOICES

Your Rights

If you are a California resident, you have the following rights under the CCPA regarding your personal information, subject to certain exceptions and limitations:

1. The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business purpose for collecting or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You may only exercise your right to know twice within a 12-month period.
2. The right to delete personal information that we have collected from you, subject to certain exceptions.
3. The right to correct inaccurate personal information that we maintain about you.
4. The right to limit our use and disclosure of sensitive personal information to only the Permitted SPI Purposes if we use or disclose it for purposes other than the Permitted SPI Purposes.
5. The right to opt out of the sale or sharing of your personal information, if applicable.
6. The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by the CCPA, in violation of California Civil Code § 1798.125, including an employee's, applicant's, or independent contractor's right not to be retaliated against for the exercise of their CCPA rights.

How to Exercise Your Rights

To exercise your rights under California law or ask for more information, please submit a verifiable request to use by: 

• Emailing us at DPO@businesswire.com
• Calling us at 1-888-297-8756
• Sending a request to 101 California St. Floor 20, San Francisco, CA 94111

Please provide your request with sufficient detail so we can properly understand, evaluate, and respond to it. You and your authorized agent may only submit a request to know or for data portability twice in a 12-month period.

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the ten (10) business day timeframe, please contact dpo@businesswire.com.

We endeavor to substantively respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. Our substantive response will tell you whether or not we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.

Any disclosures we provide will cover information for the 12-month period preceding the request's receipt date. We will consider requests to provide a longer disclosure period that do not extend past January 1, 2022, unless providing the longer timeframe would be impossible or involves disproportionate effort.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.