NOTICE TO EMPLOYEES PURSUANT TO THE CALIFORNIA CONSUMER PRIVACY ACT (CCPA)

Curbell Plastics, Inc. and/or any affiliated entities (collectively, the “Company”) may collect, receive, maintain, and use the Personal Information of current and former employees. This California policy is adopted to comply with the California Consumer Privacy Act (CCPA) 2018, Cal. Civil Code Section 1798.100 et. seq., as amended, and related regulations, as may be further amended from time to time (“CCPA Policy”). This CCPA Policy applies solely to current and former employees who reside in the State of California (“Employees”). Any terms defined in the CCPA have the same meaning when used in this CCPA Policy. This CCPA Policy explains how Company collects, uses, discloses and retains Personal Information and how Employees may exercise their rights under CCPA.

The CCPA defines Personal Information as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household” but does not include certain exempt information, publicly available information, or deidentified or aggregated information. Company’s data collection practices include the collection and use of Personal Information the employment context, for the following business purposes:

1. 1. To comply with local, state, and federal law and regulations requiring employers to maintain certain records (such as immigration compliance records, travel records, personnel files, wage and hour records, payroll records, accident or safety records, and tax records), as well as local, state, and federal law, regulations, ordinances, guidelines, and orders relating to COVID-19;
   2. to manage and process payroll and/or Company travel and expenses;
   3. to maintain commercial insurance policies and coverages, including for workers’ compensation and other liability insurance;
   4. to manage workers’ compensation claims;
   5. to administer and maintain group health insurance benefits, 401K and/or retirement plans;
   6. to manage employee performance of their job duties and/or employee conduct;
   7. to conduct workplace investigations (such as investigations of workplace accidents or injuries, harassment, or other misconduct);
   8. to evaluate job applicants and candidates for employment or promotions;
   9. to obtain and verify background checks on job applicants and employees;
   10. to evaluate, make, and communicate decisions regarding an employee’s employment, including decisions to hire, terminate, promote, demote, transfer, suspend or discipline;
   11. to communicate with employees regarding employment-related matters such as upcoming benefits enrollment deadlines, action items, availability of W2s, and other alerts and notifications;
   12. to grant employees access to secure Company facilities and maintain information on who accessed the facility;
   13. to implement, monitor, and manage electronic security measures on employee devices that are used to access Company networks and systems;
   14. to engage in corporate transactions requiring review of employee records, such as for evaluating potential mergers and acquisitions of the Company;
   15. to communicate with employee’s family or other contacts in case of emergency or other necessary circumstance;
   16. to manage employee recognition programs;
   17. to promote and foster diversity and inclusion in the workplace;
   18. to identify potential symptoms linked to COVID-19 (including through temperature checks, antibody testing, or COVID-19 questionnaire), protect employees and customers from exposure to COVID-19, permit contact tracing relating to any potential exposure, communicate with employees and customers regarding potential exposure to COVID-19, and reduce the risk of spreading the disease in or through the workplace;
   19. to provide services to corporate customers who may request certain pieces of information about a Company employee (such as name, phone number, and headshot) in order to permit the employee access or security clearance to their facility in advance of the Company employee being dispatched to provide services at the customer’s facility.

We collect Personal Information from you directly when you provide it to us. We may also collect information from background checks conducted prior to employment, from investigations, and from other publicly available sources.

The Company may collect, receive, and maintain the following categories of Personal Information of current and former employees for the above business purposes as referenced by number:

 

CATEGORY	EXAMPLES	BUSINESS PURPOSE
Personal Identifiers & Contact Information	Name, alias, postal or mailing address, email address, telephone number, social security number, driver’s license or state identification card number, passport number, employee ID number, username and password for Company accounts and systems	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 18, 19
Family Information	Contact information for family members listed as emergency contacts, contact information for dependents and other dependent information, medical and health information for family members related to COVID-19 symptoms, exposure, or testing, and family travel information	1, 5, 15, 18
Information of Friends, Co-workers, and Other Associates with Whom You Have Been in Close Contact within the Past 14 Days	Medical and health information for friends, co-workers, and other associates related to COVID-19 symptoms and their travel information	1, 18
Financial Information	Bank account number for direct deposit, credit card number, debit card number, or other financial account information	1, 2
Protected Classifications	Race, ethnicity, national origin, sex, gender, sexual orientation, gender identity, religion, age, disability, medical or mental condition, military status, familial status	1, 5, 7, 17, 18
Pre-Hire Information	Job application, resume, background check results, drug test results, job interview notes, and candidate evaluation records and assessments, work samples, voluntary disclosures, Wage Opportunity Tax Credit (WOTC) information	1, 2, 3, 6, 7, 8, 9, 10, 14
Professional or Employment-Related Information	Personnel file, new hire or onboarding records, I-9 forms, tax forms, time and attendance records, non-medical leave of absence records, workplace injury and safety records, performance evaluations, disciplinary records, investigatory records, training records, travel records, licensing and certification records, compensation and health benefits records, ergonomic information, COBRA notifications, and payroll information and records	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 14, 16
Medical and Health Information	Doctor’s notes for absences or work restrictions, medical leave of absence records, requests for accommodation, interactive process records, and correspondence with employee and his/her medical or mental health provider(s) regarding any request for accommodation or medical leave of absence, as well as post-hire drug test results, body temperature, symptoms that may be consistent with COVID-19, diagnoses of COVID-19, and medical testing relating to COVID-19	1, 3, 4, 5, 6, 7, 10, 14, 18
Travel Information	Locations travelled to within the 14 days prior to coming to the workplace and the dates spent in those locations	1, 18, 19
Education Information	Information from resumes regarding educational history; transcripts or records of degrees and vocational certifications obtained	1, 6, 7, 8, 10, 14
Visual, Audio or Video Recordings in the Workplace	Surveillance cameras or pictures of employees taken in the workplace or at a Company function or event, or pictures or video of employees representing the Company posted on social media	4, 6, 7, 10, 12, 14, 17
Facility & Systems Access Records	Information identifying which employees accessed secure Company facilities, systems, networks, computers, and equipment and at what times using their keys, badges, fobs, login credentials, or other security access method	3, 4, 6, 7, 8, 10, 12
Geolocation Data	IP address and/or GPS location (latitude & longitude) recorded on Company-issued computers, electronic devices, and vehicles, as well as timekeeping applications on cell phones that employees use to clock in and out and that log the geographic location at which each time entry was made	1, 2, 4, 6, 7, 10, 13
Internet, Network, and Computer Activity	Internet or other electronic network activity information related to usage of Company networks, servers, intranet, shared drives, or Company-issued computers and electronic devices, including system and file access logs, security clearance level, browsing history, search history, and usage history	6, 7, 10, 13
Mobile Device Security Information	Data identifying employee devices accessing Company networks and systems, including cell phone make, model, and serial number, cell phone number, and cell phone provider	2, 6, 7, 13

 

Categories of Third Parties with Whom We Disclose Personal Information
We disclose the categories of Personal Information outlined above to certain service providers or other third parties for the business purposes outlined above or for other purposes as provided by CCPA. This includes: a) our affiliates; b) to professional service providers for business operations; c) information technology, software, and cloud providers, security providers, and similar services; d) services and in the support of daily operations; e) to services providers to support business operations; f) to service providers to administer payroll and employee benefits; g) to our employees, affiliated companies, contractors, agents and third-party vendors to perform services related to your employment.

We may also have to disclose your information to: a) government agencies to fulfill legal obligations; b) to a buyer or successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred; c) to law enforcement or government officials; or d) to any other entity disclosed by Company when you provide the information, or for which you provide authorization.

Categories of Personal Information Sold or Shared to Third Parties
Company does not sell or share Personal Information with Third Parties as defined under CCPA. 

Consumer Rights under CCPA
The CCPA provides Employees with specific rights regarding their Personal Information. This section explains how those rights may be exercised.

1. 1. Employees have the right to request to certain information about our collection and use of Personal Information (the “Right to Know”) or access to specific pieces of personal information (“Specific Request to Know”). Employees may only submit two requests per a twelve-month period.
   2. Employees have the right to request correction of inaccurate Personal Information (“Right to Correct”) maintained by Company.
   3. Employees have the right to request deletion of Personal Information, subject to certain exceptions (the “Right to Delete”). Once we receive a request and confirm the consumer’s identity we will review the request to determine if an exception allowing us to retain the information applies. We may deny a deletion request if retaining the Personal Information is necessary for us to:

• • • • To enable solely internal uses that are reasonably aligned with the expectations of the Employees based on the Employee’s relationship with the business.
      • Comply with a legal obligation.
      • Otherwise use the consumer’s personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.
      • As otherwise allowed by the CCPA.

1. 4. We will not discriminate against Employees for exercising CCPA rights.

How To Exercise Rights Under CCPA
As January 1, 2023 California Employees or authorized agents may submit a request in one of the following ways:

1. 1. By emailing us at [email protected]
   2. By telephone at: 716-667-3377 ask for a representative of the Legal Department
   3. By written notice mailed to: Legal Department, 7 Cobham Drive, Orchard Park, NY 14127

If you’re making a request as an Authorized Agent, please submit the request on behalf of the individual and provide proof that the individual provided you signed permission to submit the request. We may also require other identity confirmation.

When submitting a request under CCPA, we are required to reasonably validate the requestor to appropriately secure Personal Information. If we cannot validate the request or based on the information provided, we will notify the requestor that we are unable to fulfill the request. We will only use Personal Information provided in the request to verify the requestor's identity or authority to make it. We will confirm receipt of a request within ten (10) business days. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period. We do not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will detail why we made that decision and provide a cost estimate before completing the request. If you have any other questions regarding this process, please contact us.

Updates to this CCPA Policy
Please refer to this CCPA Policy regularly as it may be revised. Revisions are effective upon posting. If you have any comments, concerns or questions about this CCPA Policy, please contact any representative of the Legal Department.

By your electronic signature to this notice, you acknowledge and confirm that you have received and read and understand this disclosure and you hereby authorize and consent to the Company’s use of the personal information it collects, receives or maintains for the business purposes identified above, and that you have certain rights concerning your data as outlined in the CCPA and above. If you have any questions, please contact any representative of the Legal Department.  

Last Updated: February 3, 2023