Notice at Collection and Privacy Policy for Applicants and Employees Who Reside in California

Please take notice that Super Store Industries (SSI) collects certain personal information about our applicants and employees. SSI is committed to protecting the privacy and security of the personal information provided to us. This notice describes the categories of personal information SSI collects and the purposes for which they are used in accordance with the California’s Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

The law provides California applicants and employees with certain rights with respect to the personal information collected from them, including the right:

• To delete personal information.
• To correct inaccurate personal information.
• To access personal information.
• To know what personal information is sold or shared and to whom.
• To opt out of selling or sharing personal information.
• To limit use and disclosure of sensitive personal information.
• Not to be discriminated against or retaliated against for exercising rights under the law.

Categories of Personal Information Collected. SSI is collecting the following personal and sensitive personal information:

• Personal identifiers, such as name, preferred name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, date of birth, and other similar identifiers.
• Personal Records, such as signature, Social Security number, address, telephone number, education, employment, or employment history.
• Protected characteristics, such as minority, veteran, and disability status, through voluntary self-disclosure. Such information will only be collected as permitted by applicable law and will not be used to make hiring decisions.
• Commercial information, such as transaction information or purchase history (e.g., in connection with expense reimbursements).
• Internet or other similar network activity information, such as IP address, log-in information, or information regarding your interaction with a website, application or advertisement.
• Geolocation Data, such as IP addresses from which SSI can determine your general location.
• Sensory data, such as audio and visual information, for example if using video interviewing as part of the application process, or visiting the facilities, entry and exit may be monitored by CCTV.
• Professional or employment-related information, such as work history, references, information about skills and abilities, accomplishments and awards, training and development information, performance evaluation information, and employment termination information.
• Education information, such as education history, education records (such as grades, transcripts, and class lists), and other information included in a resume or cover letter.
• Inferences drawn from other personal information, such as a profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
• Other: Job interview notes, responses to screening questions, assessment results, and any other information provided in connection with the recruitment process. SSI also collects legal and contractual information, such as information necessary to respond to law enforcement and governmental agency requests, comply with legal and contractual obligations, exercise legal and contractual rights, and initiate or respond to, or establish, exercise, and defend, legal and contractual rights claims.

Sources of Personal Information. SSI collects personal information voluntarily provided to us when applying for a job, complete pre-employment screening, or during employment. If you are visiting our website or online job application, SSI may also automatically collect device information such as IP addresses and device identifiers.

SSI may also combine personal information collected from other sources with the personal information that you provide to us. For example, we may collect information from:

• Yourself.
• Spouse, Partner, or Dependent, with respect to their own personal information.
• Recruiters.
• Prior employers (e.g., for references).
• Professional references provided to SSI.
• Educational institutions.
• Government or administrative agencies.
• Pre-employment screening services.
• Credentialing and licensing organizations.
• Publicly available sources such as your social media profile (e.g., LinkedIn, Twitter, and Facebook).
• Internally generated, for example, SSI may generate performance ratings, evaluations, hours worked, and other information about you.
• Surveillance or record technologies installed by SSI, for example video surveillance in common areas of SSI facilities, voicemail technologies, webcams, any of these with consent to the extent required by law.
• Other sources as directed by you.

Use of Personal Information: SSI uses the categories of personal information listed above for the following purposes:

• Recruiting and retaining employees
• Collecting and processing employment applications, including confirming eligibility for employment, background related checks and onboarding.
• Employee benefit plan and program administration.
• Leave of absence administration.
• Compensation administration and compliance, including payroll, bonuses, reimbursements, etc.
• Maintaining personnel records and complying with record retention requirements.
• Communicating with employees and/or employees’ emergency contacts and plan beneficiaries.
• Facilitating and administering the use of the SSI’s property and resources, including the SSI’s information systems, electronic devices, network, and data, and preventing unauthorized access of such.
• Workplace health and safety compliance.
• Ensuring employee productivity and adherence to policies and procedures.
• Investigating complaints and suspected violations of policy.
• Complying with applicable state and federal laws, including labor, employment, tax, benefits, workers compensation, disability, equal employment opportunity, workplace safety and related laws.
• Exercising and defending legal claims.

Disclosure of Personal Information: SSI may share your personal information as necessary for the purposes described in this Privacy Notice, including internally with our personnel involved in the hiring process. We make third party business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. We share, and during the past 12 months, we have shared for our business purposes the categories of personal information listed above to the following categories of third parties:

• Service Providers: We use service providers to operate, host and facilitate our hiring and recruitment process. They include hosting, technology, and communication providers; background and reference check screening services; and hiring process management tools.
• Government authorities and law enforcement: In certain situations, we may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet security or law enforcement requirements.

Sale of Personal Information: For the purposes of CCPA/CPRA, SSI does not sell the personal information or sensitive personal information of job applicants or employees.

Data Retention: SSI will store your personal data, in a form that permits us to identify you, for no longer than is necessary for the purpose for which the personal data is processed. We store your personal data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and rights, or if it is not technically and reasonably feasible to remove it.

How to Exercise Your Rights: SSI will respond to requests to know, delete, and correct in accordance with applicable law if it can verify the identity of the individual submitting the request. You can exercise these rights in the following ways:

• Call: (888) 462-5143
• Email: hr@ssica.com

How SSI Will Verify and Respond to Requests: The processes that we follow to verify your identity when you make a request to know, correct, or delete are described below. The relevant process depends on how and why the request is submitted. If you submit a request by any means, the verification process that we follow will depend on the nature of your request as described below:

• Requests To Know Specific Pieces of Personal Information: We will match at least three data points that you provide with your request, or in response to our request for verification information, against information that we already have about you in our records and that we have determined to be reliable for purposes of verifying your identity. In addition, we may require you to sign a declaration under penalty of perjury that you are the individual whose personal information is the subject of the request.
• Requests To Correct or Delete Personal Information: Our process for verifying your identity will depend on the sensitivity (as determined by SSI) of the personal information that you ask us to correct or delete. For less sensitive personal information, we will require a match of two data points as described above. For more sensitive personal information, we will require a match of three data points and a signed declaration as described above.

SSI has implemented the following additional procedures when verifying the identity of a requestor:

• If we cannot verify your identity based on the processes described above, we may ask you for additional verification information. If we do so, we will not use that information for any purpose other than verification.
• If we cannot verify your identity to a sufficient level of certainty to respond to your request, we will let you know promptly and explain why we cannot verify your identity.

SSI will acknowledge receipt of your requests to know, to delete, and to correct information within 10 days of receipt of your requests. We will respond to your request within 45 days; if we need additional time, we will notify you that we need up to another 45 days to respond. Responses to requests for specific information about you will be provided using a format that is readily useable, including by mailing you a paper copy or providing an electronic copy to you by email.

Authorized Agents: If an authorized agent submits on your behalf a request to know, correct or delete, the authorized agent must submit with the request either (a) a power of attorney, signed by you, that is valid under California law; or (b) another document signed by you that authorizes the authorized agent to submit the request on your behalf. In addition, we may ask you or your authorized agent to follow the applicable process described above for verifying your identity.

Company’s Non-Discrimination and Non-Retaliation Policy: Company will not unlawfully discriminate or retaliate against you for exercising your rights under the California Privacy Rights Act.

Changes to This Policy: If we change this policy, we will post those changes on this page and update the Effective Date above. If we materially change this policy in a way that affects how we use or disclose your personal information, we will provide prominent notice of such changes and the effective date of the changes before making them.

Contact Information: If you have any questions or concerns regarding this Privacy Notice or the collection of your personal information, please contact: hr@ssica.com.