Personnel Privacy Notice
Last Updated: November 2023

This Privacy Notice explains how Car Chimp, LLC, its subsidiaries, affiliates, successors, and assigns (collectively, "Car Chimp," "we," "our," or "us") collects, uses, discloses, and otherwise processes personal data about our California-based employees, officers, directors, contractors, freelancers, contingent workers, consultants, and other outsourced and temporary workers (collectively, “personnel”), as well as their family members or other individuals whose personal data we process due to their relationship with personnel (collectively, “related persons”). It is the responsibility of our personnel to make this Privacy Notice available to their related persons.

This Privacy Notice is not a contract and does not create any legal rights or obligations. It also does not replace other notices or disclosures we may provide to individuals in connection with their role at Car Chimp, which will supersede any conflicting disclosures contained in this Privacy Notice.

What is Personal Data?

When we refer to “personal data” in this Privacy Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual within the context of their role as a member of our personnel or a related person. This does not include aggregated or deidentified information maintained in a form that cannot reasonably be used to identify an individual. We maintain deidentified data in that form and will not attempt to reidentify it, except as required or permitted by law.

Our Collection and Use of Personal Data

Personal Data of Personnel

Collection of Personal Data

In connection with an individual’s role as a member of our personnel, Car Chimp may collect the following professional or employment-related personal data:

• Contact Information: Full name, personal and work email addresses, home address, business address, telephone number, and emergency contact information.
• Identification Materials: Image, Social Security Number or other national identification numbers, driver’s license numbers, and vehicle license plate numbers.
• Professional Information: Hire date, job title, department, supervisor, hours worked, employment location, certifications, career development information, attendance records, performance reviews, and work-related licenses.
• Education & Training Information: Degrees, certifications, transcripts, and other qualifications relevant to the individual’s role.
• Financial Information: Hourly wage, salary, bonuses, benefits, expenses, bank account details, and corporate credit card information.
• Benefits Information: Details about personnel eligibility for benefits, claims related to benefits, and information about dependents or related persons included in benefits plans.
• Equal Employment Opportunity Information: Optional information on age, race, gender, sexual orientation, disability, or other protected characteristics provided voluntarily, in compliance with applicable laws.
• Security Information: Credentials, work-related account details, IP addresses, and device analytics data, as well as physical and electronic access logs.
• Other Work-Related Information: Personal data shared with us voluntarily, made publicly available, received from third parties, or collected in connection with grievances, agreements, or additional roles.
• Inferences: Predictions or insights about abilities, interests, or preferences generated from interactions or collected data.

We may collect this personal data directly from personnel, supervisors, colleagues, customers, vendors, and publicly available sources. Third-party providers, such as payroll processors, benefits administrators, or background check services, may also collect this information on our behalf.

Some personal data may be classified as “sensitive” under privacy laws. For more details, see the section on Sensitive Information.

Use of Personal Data

Car Chimp uses personal data to:

• Support personnel management, including recruiting, onboarding, performance reviews, training, discipline, and career development.
• Conduct organizational planning, budgeting, and administrative activities.
• Administer payroll, compensation, benefits, and other work-related financial processes.
• Communicate with personnel and their designated emergency contacts.
• Ensure compliance with Car Chimp’s policies, procedures, and applicable laws.
• Monitor security, manage access to systems and facilities, and protect company property.
• Investigate, document, and report work-related incidents, grievances, or legal compliance issues.
• Facilitate travel, expense reimbursements, and other business-related logistics.
• Operate our business, including ensuring personnel have the tools and resources needed for their roles.
• Fulfill legal or regulatory requirements, including tax, reporting, and immigration obligations.

Car Chimp is committed to handling personal data responsibly, ensuring transparency, and complying with applicable privacy laws. If you have any questions about this notice, please contact us for more details.

Personal Data of Related Persons

Collection of Personal Data

At Car Chimp, we may collect identifiers and other personal data about the family members and other related persons of our personnel in connection with emergency contacts, benefits, and services we provide. The types of personal data collected may include:

• Contact Information: Full name, email address, home address, business address, telephone number, and emergency contact information.
• Other Identification Materials: Image, Social Security Number or other national identification numbers, passport number, driver’s license number, or vehicle license plate number.
• Benefits and Services Information: Personal data necessary to extend benefits and services, including insurance-related information, claims-related data, and disbursement-related information.

We often collect this data directly from our personnel. However, we may also collect it directly from the related person or through third parties such as benefit administrators or other service providers acting on our behalf.

Some of the personal data described above may be classified as “sensitive” under certain privacy laws. For more information, please see the Sensitive Information of Personnel and Related Persons section in this Privacy Notice.

Use of Personal Data

We use the personal data collected about related persons to:

• Communicate about eligibility for benefits and services, events, or emergencies.
• Administer and provide benefits and related services.
• Respond to requests and inquiries.
• Conduct internal investigations, audits, compliance, risk management, and security operations.
• Fulfill contractual obligations.
• Comply with applicable laws, regulations, legal proceedings, and government investigations, including tax reporting and immigration requirements.

Disclosure of Personal Data

We may share the categories of personal data outlined above with the following third parties for the purposes described:

• Within Car Chimp: Personal data related to personnel and related persons may be shared within our family of companies for internal administrative purposes and other uses consistent with this Privacy Notice.
• Benefit Administrators: To offer and administer benefits and services, we share personal data with third parties managing these services. These third parties may collect additional data directly from personnel and related persons, subject to their own privacy policies.
• Compensation, Payroll, and Tax Providers: We share personal data with third parties that assist in payroll processing and other compensation-related services, including tax reporting.
• Other Service Providers: Additional third parties may assist in personnel management, benefits administration, and other business operations.
• Customers: Limited personal data may be shared with customers in connection with services we provide, such as sharing contact information or team details responsible for a specific account.
• Public Disclosure: Certain professional data, such as name, job title, and work contact information, may be disclosed publicly in connection with recruiting or business operations.
• Business Transactions or Reorganizations: In the event of a corporate transaction, such as a merger, acquisition, or sale, personal data may be shared with relevant third parties. In cases of insolvency or bankruptcy, personal data may be disclosed as part of proceedings.
• Legal Obligations and Rights: Personal data may be shared with legal advisors, law enforcement, or other third parties to comply with laws and regulations, enforce agreements, or protect the safety and property of Car Chimp, its personnel, or others.
• Consent or Direction: We may disclose personal data to third parties or publicly with the consent or direction of personnel or related persons.

Sales, Sharing, or Targeted Advertising

Car Chimp does not sell personal data about personnel or related persons, nor do we share or disclose such data for targeted advertising purposes or cross-context behavioral advertising.

Retention of Personal Data

We retain personal data only as long as reasonably necessary to fulfill the purposes for which it was collected. However, we may retain personal data for longer periods when required to comply with legal, tax, or regulatory obligations.

When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, our objectives, and our legal and regulatory obligations.

Once retention is no longer necessary, we securely delete, destroy, or deidentify personal data. If immediate deletion or deidentification is not possible (e.g., due to backup archives), the data will be securely stored and isolated until deletion or deidentification is feasible.

Sensitive Information of Personnel and Related Persons

Sensitive Information We Collect

Car Chimp may collect certain personal data elements about personnel and their family members or related persons that are considered “sensitive” under some privacy laws. These sensitive data elements may include:

• Social Security Number, driver’s license number, or passport number.
• Work-related accounts and passwords.
• Financial account information.
• Credit or debit card numbers, along with expiration dates and security codes (CVV).
• Information about racial or ethnic origin, religious beliefs, health, disabilities, sexual orientation, gender identity, or transgender status.

We use this sensitive information for purposes outlined in the Collection and Use of Personal Data section of this Privacy Notice.

Car Chimp does not sell sensitive information, nor do we process or share sensitive information for targeted advertising purposes. Subject to legal limitations, you may have the right to limit our processing of this information, as described in the Your Privacy Choices section below.

Your Privacy Choices

California Privacy Rights

California residents may have the following rights under applicable laws, subject to certain limitations:

• The Right to Know: Confirm whether we are processing your personal data and request personalized details, including:
  • Categories of personal data collected.
  • Sources of the personal data.
  • Purposes for collecting the personal data.
  • Categories of data shared or disclosed and the recipients.
  • Categories of data sold (if any) and to whom.
• The Right to Access & Portability: Request access to your personal data and, if applicable, obtain it in a portable, usable format.
• The Right to Correction: Request correction of inaccuracies in your personal data.
• The Right to Control Over Sensitive Information: Exercise control over the collection and processing of certain sensitive data.
• The Right to Deletion: Request the deletion of personal data we maintain about you.
• The Right to Control Over Automated Decision-Making/Profiling: Opt out of automated decision-making or profiling for certain purposes.
• Protection Against Discrimination: Exercise your rights without fear of retaliation or discriminatory treatment. However, limiting our ability to process your data may affect our engagement with you.

Submitting Privacy Rights Requests

To exercise your privacy rights, please:

• Contact your HR Business Partner (HRBP).
• Email us at privacy@carchimp.com.

We will verify your identity and confirm your residency in California before processing your request. Requests should include:

• Your full name.
• Dates of employment.
• Employee ID number (if available).

In some cases, we may request additional data to verify your identity. If we cannot verify your identity, or if you are not a California resident, we may decline your request.

Submitting Authorized Agent Requests

You may appoint an authorized agent to submit requests on your behalf by providing:

• A valid power of attorney, or
• A signed letter with your name, contact information, and a statement of authorization.

We may also contact you to verify the agent’s authority and your identity before processing the request.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may appeal our decision regarding your privacy request. Appeal requests can be submitted to:

• privacy@carchimp.com/li>
• Your HRBP.

Updates to This Privacy Notice

We periodically update this Privacy Notice. When changes occur, the “Last Updated” date will reflect the update. If significant changes are made, we will notify you through appropriate communication channels, such as email or postings on our intranet. Changes become effective upon publication unless stated otherwise.

Contact Us

If you have questions about this Privacy Notice or privacy-related matters, please contact us at privacy@carchimp.com.