California Applicant Privacy Notice

Effective Date: June 27, 2024

This California Applicant Privacy Notice (the “Notice”) is provided by Convex Labs, Inc. and its subsidiaries (“Convex Labs,” “we” or “us”), pursuant to the California Consumer Privacy Act (Cal. Civ. Code § 1798.100, et seq.), as amended by the California Privacy Rights Act of 2020, and its implementing regulations (“California Privacy Law”). In this Notice, we describe our collection and processing of personal information related to current and former job applicants, candidates and prospective employees who are residents of California (each an “Applicant”), as well as the rights these Applicants have regarding their personal information.

I. SCOPE

This Notice applies only to the personal information that Convex Labs collects related to California Applicants and is intended to satisfy Convex Labs’s applicable notice obligations under the CCPA. We may also provide additional notices to Applicants about our data collection practices that are covered by other laws (such as if we conduct a background check).

This Notice does not address or apply to our collection of personal information that is not subject to the CCPA, such as (i) protected health information, consumer credit reports and background checks, publicly available data lawfully made available from state or federal government records, or other information that is exempt under the CCPA; (ii) the personal information that we collect about Applicants and other individuals who are not residents of California; or (iii) the personal information we collect from employees, contractors, officers and directors, which is subject to other notices and not this one.

II. COLLECTION AND PROCESSING OF PERSONAL INFORMATION

Our collection and processing of personal information may vary depending upon the circumstances, such as the role, responsibilities, location, and qualifications associated with a position. The information in this Notice is intended to provide an overall description of our collection and use of personal information about Applicants.

Categories of Personal Information and Third Parties. The table below identifies, generally, the categories of personal information we may collect about Applicants, as well as the categories of third parties to whom we may disclose this information for a business or commercial purpose (subject to applicable laws). 

Categories of Personal Information	Third party disclosures for business or commercial purposes
Identifiers: such as name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers. We also collect identifiers about your references and referral sources, if provided.	Service providers Advisors and agents Recruiters Regulators, government entities and law enforcement Affiliates and subsidiaries Internet service providers, operating systems and third-party platforms Others as required by law
Paper and electronic records: records containing personal information, such as name, signature, photo, contact information, education and employment history, Social Security number and other government identifiers, insurance policy number, financial or payment information, medical information, or health insurance information.	Service providers Advisors and agents Recruiters Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law
Characteristics of protected classifications: such as race and national origin, sex, age, national origin, disability, citizenship status, military/veteran status, marital status, medical condition or other characteristics of protected classifications under California or federal law. (Note: generally, this information is collected on a voluntary basis and is used only in order to provide accommodations to an Applicant, in support of our reporting obligations, or where otherwise required by law.)	Service providers Advisors and agents Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law
Internet or network activity information: such as browsing history, search history, and information regarding interactions with an internet website, application, or advertisement, as well as physical and network access logs and other network activity information related to your use of any Convex Labs device, network or other information resource.	Service providers Advisors and agents Regulators, government entities and law enforcement Affiliates and subsidiaries Internet service providers, operating systems and third-party platforms Others as required by law
Geolocation data: location information about a particular individual or device.	Service providers Advisors and agents Regulators, government entities and law enforcement Affiliates and subsidiaries Internet service providers, operating systems and third-party platforms Others as required by law
Audio, video and other electronic data: audio, electronic, visual, thermal, olfactory, or similar information, such as, CCTV footage, photographs, and call recordings and other audio recordings (e.g., recorded meetings and webinars) or thermal temperature readings (which are not generally maintained on an individual basis).	Service providers Advisors and agents Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law
Professional Information: professional or employment-related information, such as information related to your employment history during the recruitment process	Service providers Advisors and agents Recruiters Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law
Education information: information about education history or background that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99).	Service providers Advisors and agents Recruiters Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law
Inferences: inferences drawn from any of the information identified above to create a profile about California Applicants reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Service providers Advisors and agents Recruiters Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law
Sensitive personal information: we may collect limited ‘sensitive personal information’ (as defined by the CCPA) from Applicants, including: (a) Social Security number and other government identifiers (e.g., as part of the application and verification process); (b) racial or ethnic origin, gender, whether the person is of transgender experience, an applicant’s pronouns, sexual orientation, and veteran status (e.g., on a voluntary basis to support of our equal opportunity and diversity and inclusion efforts and reporting obligations, or where otherwise required by law), or union membership; and (c) health and disability information (e.g., as necessary to provide reasonable accommodations).	Advisors and agents Regulators, government entities and law enforcement Affiliates and subsidiaries Others as required by law

Sources of Personal Information. In general, Convex Labs may collect the categories of personal information identified in the table above from the following categories of sources: 

• The Applicant; 
• Recruiters and recruiting platforms;
• Our employees;
• References and other referral sources;
• Publicly available information and sources; and
• Our service providers, representatives and agents.

Retention.  We retain the personal information we collect only as reasonably necessary for the purposes described below or otherwise disclosed to you at the time of collection. For example, we will retain your information as necessary to comply with our tax, accounting and recordkeeping obligations, to consider you for additional positions, as well as an additional period of time as necessary to protect, defend or establish our rights, defend against potential claims, and comply with our legal obligations. 

Purposes for Processing Personal Information. Subject to applicable legal restrictions, generally, we collect, use, disclose and otherwise process Applicant personal information for the following business and commercial purposes:

Recruiting, hiring, managing and evaluating Applicants: to review, assess, recruit, consider or otherwise manage the recruiting process and job applications, including: Scheduling and conducting interviews; Identifying potential candidates, including by working with external recruiters; Reviewing, assessing and verifying information provided, to conduct criminal and background checks (where relevant and pursuant to applicable law), and to otherwise screen or evaluate Applicant qualifications, suitability and relevant characteristics; Extending offers, negotiating the terms of offers and assessing salary and compensation matters Satisfying legal and regulatory obligations; Communicating with California Applicants regarding their applications and about other similar position(s) for which they may be interested; Maintaining California Applicant personal information for future consideration; and Supporting our equal opportunity employment policy and practices.

Onboarding: where applicable, to conduct pre-employment checks, work with you to complete new hire paperwork, enroll you in our HR and other relevant systems, and set up your personnel file.

Security and monitoring: to monitor and secure our resources, network, premises and assets, including: Detecting, preventing and investigating suspected or alleged misconduct or violations of work rules; Detecting, preventing, investigating, mitigating and responding to security and privacy incidents; Implementing and managing physical and technical access controls; Monitoring activities, access and use to ensure the security and functioning of our systems and assets; and Securing our offices, premises and physical assets, including through the use of electronic access systems and video monitoring.

Health and safety: for health and safety purposes, such as contact tracing or conducting appropriate screenings of individuals prior to entering or accessing certain locations or premises.

Auditing, accounting and corporate governance: relating to financial, tax and accounting audits, and audits and assessments of our business operations, security controls, financial controls, or compliance with legal obligations, and for other internal business purposes such as administration of our records retention program.

M&A and other business transactions: for planning, due diligence and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions.

Defending and protecting rights: to protect and defend our rights and interests and those of third parties, including to manage and respond to legal claims or disputes (including Applicant claims and disputes), and to otherwise establish, defend or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties.

Complying with legal obligations: relating to compliance with applicable legal obligations (such as hiring eligibility, responding to subpoenas and court orders) as well as assessments, reviews and reporting relating to such legal obligations, including under employment and labor laws and regulations, Social Security and tax laws, environmental regulations, workplace safety laws and regulations, and other applicable laws, regulations, opinions and guidance.

Sensitive Personal Information. We do not use or disclose Applicant sensitive personal information for purposes beyond the permissible purposes authorized by the CCPA.  In general, our use and disclosure of Applicant sensitive personal information is limited to what is reasonable and proportionate for the following purposes: (a) to comply with our legal, regulatory and reporting obligations; (b) to provide services requested by you, to respond to your requests, to make reasonable accommodations where necessary, and to verify the information you provide to us; (c) to manage and administer the application and hiring process and communicate with Applicants; (d) in support of our equal opportunity and diversity and inclusion efforts (on a voluntary basis); (e) to protect the health and safety of an individual; (f) to protect and defend our rights; (g) to prevent, protect and take action against malicious, deceptive, fraudulent, or illegal actions, and security incidents.

Sales and Sharing. We do not ‘sell’ or ‘share’ for ‘cross-context behavioral advertising’ purposes (as defined by the CCPA) any Employee personal information (including about individuals we know are minors).

III. CALIFORNIA PRIVACY RIGHTS

CCPA Rights of Applicants. Subject to certain limitations and exceptions, Applicants (who are residents of California) generally have the following rights under the CCPA with respect to their personal information collected and processed by us:

• Right of deletion: to request deletion of their personal information that we have collected about them and to have such personal information deleted (without charge), subject to certain exceptions. 
• Right to know (access): to request that we (i) disclose the categories and sources of personal information we have collected about them, the categories of personal information disclosed, sold and shared, the categories of third parties to whom we have sold, shared or disclosed such personal information, and the business or commercial purposes for which we collect, use, disclose and process their personal information, and (ii) provide them with a copy of the personal information we have collected about them (in a portable format to the extent practicable).
• Right to correct: to request that a business that maintains their inaccurate personal correct that personal information.  
• Right to non-discrimination: to not to be subject to discriminatory treatment for exercising their rights under the CCPA.  

Submitting CCPA Requests. Applicants may exercise their CCPA rights by submitting a Privacy Request online here or calling our toll-free number (866) 622-0680.  We will take steps to verify your request by [(i) sending a confirmation email to your email address on record with us (which you must take action to confirm); and (ii) matching the information provided by you with the information we have in our records.]  You must complete all required fields on our webform (or otherwise provide us with this information if you submit your request via email) to verify your request.  In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor.  Authorized agents may initiate a request on behalf of another individual through one of the above methods; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

IV. CALIFORNIA PRIVACY RIGHTS

If you have questions or concerns regarding this Notice or the handling of your personal information by Convex Labs, please contact us at privacy@servicetitan.com.