Alma Privacy Notice for Job Applicants

Purpose

This policy is to adhere to certain privacy laws which govern applicant information such as the CCPA (California Consumer Privacy Act) as amended, including specifically as amended by the CPRA (California Privacy Rights Act) to the extent they are applicable to Alma.

Scope

All Alma Applicants.

This Applicant Privacy Notice does not apply outside of the context of your role as an Applicant or to Personal Information that is excluded from the scope of the CPRA, such as Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA).

Some of these exclusions may be applicable to the Personal Information we collect about you as part of background checks. If you have any questions on whether one of these exceptions apply to your Personal Information, please contact us through the Contact Information below.

Definitions

Policy

1. Types of Personal Information We Collect About You

Alma collects and, over the prior twelve (12) months has or may have collected, the following categories and corresponding pieces of Personal Information about our Applicants:

We will not collect additional categories of Personal Information without providing you notice. As further described in Who Do We Sell or Share Your Personal Information To Section, we do not (i) “sell” any categories of Personal Information for monetary or other valuable consideration, or (ii) “share” any categories of Personal Information for cross-context behavioral advertising.

Note that you may provide information to our background check partners directly and that information is not stored in our systems and is subject to their privacy policy terms. If you have any concerns about our background check partners please contact us through the Contact Information below.

2. Retention of Personal Information

For all categories of Personal Information described above, we will retain your Personal Information for the duration of your relationship with us, or the length of time required by applicable law or our record retention guidelines for the type of document that contains your Personal Information.

However, we may also retain any or all categories of Personal Information when your information is subject to one of the following exceptions:

• When stored in our backup and disaster recovery systems. Your Personal Information will be deleted when the backup media your Personal Information is stored on expires or when our disaster recovery systems are updated.
• When necessary for us to exercise or defend legal claims.
• When necessary to comply with a legal obligation.
• When necessary to help ensure the security and integrity of our websites and IT systems.

3. Sources of Personal Information

We collect Personal Information:

• Directly from you when you provide it to us during the application and recruitment process or when you otherwise contact us in your role as an Applicant.
• From third party sources that assist us with our application and recruitment efforts, such as:
  • Recruiters or other third-party platforms (such as Indeed, LinkedIn, etc.), from which we collect information you submit in connection with your application for a position with Alma (for example, through your formal submission of an application and related materials, including your CV or resume and cover letter);
  • Pre-employment screening and background check providers, from which we collect information disclosed in your pre-employment screenings or background checks (which may include, among other information, criminal convictions and drug and/or psychometric test results); and
  • Prior employers, educational institutions, and other references you list on your application materials or that are referred to us.

4. How We Use Your Personal Information

We may use the Personal Information we collect for one or more of the following purposes:

• recruiting, including identifying and evaluating job applicants, and assessing skills, qualifications, and interests for the purposes of determining suitability for the position for which you have applied;
• verifying your information and carrying out pre-employment, background, and reference checks, where applicable, subject to your consent where required by law, and maintaining records on such checks as required by law;
• communicating with you and our personnel about the recruitment process and your application (including scheduling and conducting interviews with you), and facilitating your communications with our personnel and other third parties involved in the application and recruitment process;
• analyzing and improving our application and recruitment process;
• complying with our applicable legal and regulatory requirements;
• responding to law enforcement requests and as required by applicable law, court order, or governmental regulations;
• maintaining the security and safety of our facilities, personnel, and other assets, including to authenticate Applicants to access our facilities;
• detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and helping prosecute those responsible for that activity;
• evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Alma’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by Alma about our Applicants is among the assets transferred; and
• as described to you when collecting your Personal Information or as otherwise permitted by applicable law.

Alma will not use the Personal Information it collected for materially different, unrelated, or incompatible purposes without providing you notice.

5. Third Parties to Whom Do We Disclose Your Personal Information for Business Purposes

Alma may disclose your Personal Information to third parties for one or more business purposes related to your role as an Applicant of Alma. When we disclose Personal Information to non-affiliated third parties for a business purpose, we enter a contract that describes the purpose, requires the recipient to both keep that Personal Information confidential and not use it for any purpose except for the purposes for which the Personal Information was disclosed and requires the recipient to otherwise comply with the requirements of the CPRA.

Alma discloses and, in the preceding twelve (12) months, has disclosed the following categories of Personal Information about its Applicants to the following categories of third parties for one or more of the business purposes described below:

We disclose your Personal Information to the categories of third parties listed above for the following business purposes:

• Helping to ensure the security and integrity of our facilities and IT infrastructure, to the extent the use of such Personal Information is reasonably necessary and proportionate to achieve this purpose.
• Performing services on behalf of Alma, such as administering the recruitment and application process, facilitating pre-employment screenings and background checks, verifying Applicant information, and providing other similar services on our behalf.

In addition to the above, we may disclose any or all categories of Personal Information to any third party (including government entities and/or law enforcement entities) as necessary to:

• comply with federal, state, or local laws, or to comply with a court order or subpoena to provide information;
• comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities;
• cooperate with law enforcement agencies concerning conduct or activities that we (or one of our service providers’) believe may violate federal, state, or local law;
• comply with certain government agency requests for emergency access to your Personal Information if you are at risk or danger of death or serious physical injury;
• complete a transaction where a business transfer or change in ownership occurs as part of a merger, divestiture, restructuring, reorganization, dissolution, bankruptcy, liquidation, or similar proceeding; or
• exercise or defend legal claims.

6. Who Do We Sell or Share Your Personal Information To

“Sale” of Your Personal Information

Alma has not “sold” any Personal Information for either monetary or other valuable consideration in the preceding twelve (12) months, and it has no actual knowledge of “selling” any Personal Information of minors under the age of 16.

“Sharing” of Your Personal Information for Cross-Context Behavioral Advertising

Alma has not “shared” any Personal Information for the purpose of cross-context behavioral advertising in the preceding twelve (12) months, and it has no actual knowledge of “sharing” any Personal Information about minors under the age of 16.

7. Applicant Data Requests

The CPRA provides Applicants with specific rights regarding their Personal Information. This section describes these rights and explains how to exercise those rights. You may exercise these rights yourself or through your Authorized Agent (as defined below). For more information on how you or your Authorized Agent can exercise your rights, please see Exercising Your CPRA Privacy Rights.

• Right to Know. You have the right to request that Alma disclose certain information to you about our collection and use of your Personal Information over the past 12 months (a “Right to Know” request). This includes: (a) the categories of Personal Information we have collected about you; (b) the categories of sources from which that Personal Information was collected; (c) our purposes for collecting this Personal Information; (d) the categories of third parties to whom we have disclosed your Personal Information; and (e) if we have “sold” or “shared” your Personal Information, a list of categories of third parties to whom we “sold” or “shared” your Personal Information, and a separate list of the categories of third parties to whom we disclosed your Personal Information to. You must specifically describe if you are making a Right to Know request or a Data Portability Request. If you would like to make both a Right to Know Applicant Request and a Data Portability Applicant Request, you must make both requests clear in your submission to Alma. If it is not reasonably clear from your request, we will only process your request as a Right to Know request. You may make a Right to Know or a Data Portability Applicant Request a total of two (2) times within a 12-month period at no charge.
• Access to Specific Pieces of Information (Data Portability). You also have the right to request that Alma provide you with a copy of the specific pieces of Personal Information that we have collected about you, including any Personal Information that we have created or otherwise received from a third party about you (a “Data Portability” request). If you make a Data Portability Applicant Request electronically, we will provide you with a copy of your Personal Information in a portable and, to the extent technically feasible, readily reusable format that allows you to transmit the Personal Information to another third party. You must specifically describe if you are making a Right to Know request or a Data Portability request. If you would like to make both a Right to Know Applicant Request and a Data Portability Applicant Request, you must make both requests clear in your request. If it is not reasonably clear from your request, we will only process your request as a Right to Know request. We will not disclose your Social Security number, driver’s license number or other government-issued identification number, financial account number, health insurance or medical identification number, or your account password or security question or answers in response to a Data Portability Applicant Request. We will also not provide this information if the disclosure would create a substantial, articulable, and unreasonable risk to any of the following: (a) your Personal Information; (b) your relationship with Alma as an Applicant; or (c) the security of our systems or networks. We will also not disclose any Personal Information that may be subject to another exception under the CPRA. If we are unable to disclose certain pieces of your Personal Information, we will describe generally the types of Personal Information that we were unable to disclose and provide you a description of the reason we are unable to disclose it. You may make a Right to Know or a Data Portability Applicant Request up to two (2) times within a 12-month period at no charge, although you may have other rights to access certain pieces of your Personal Information under applicable labor and employment laws.
• Correction. You have the right to request that we correct any inaccurate Personal Information we maintain about you to ensure that it is complete, accurate, and as current as possible. You may also request that we correct the Personal Information we have about you as described below under Exercising Your CPRA Privacy Rights. In some cases, we may require you to provide reasonable documentation to show that the Personal Information we have about you is incorrect and what the correct Personal Information may be. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.
• Deletion. You have the right to request that Alma delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your Applicant Request (see Exercising Your CPRA Privacy Rights), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies under the CPRA. Some exceptions to your right to delete include if we are required to retain your Personal Information to detect security incidents or protect against other malicious activities, and to comply with legal obligations (among others). We may also retain your Personal Information for other internal and lawful uses that are compatible with the context in which we collected it.
• Limiting our Uses and Disclosures of Your SPI. You have the right to request that Alma limit its uses and disclosures of your Sensitive Personal Information to only those purposes specifically enumerated in the CPRA. Currently, we do not use or disclose your Sensitive Personal Information for purposes other than those expressly permitted by the CPRA. Should this change in the future, we will update this Applicant Privacy Notice and provide you with methods to limit the use and disclosure of Sensitive Personal Information.
• Non-Discrimination. We will not discriminate against you for exercising any of your CPRA rights. Unless permitted by the CPRA, we will not do any of the following as a result of you exercising your CPRA rights: (a) deny you employment or other similar relationship with Alma; (b) offer you with different compensation, benefits, work hours, or terms of employment or other similar relationship with Alma; or (c) suggest that you may receive different compensation, benefits, work hours, or terms of employment or other similar relationship with Alma.

Exercising Your CPRA Privacy Rights

To exercise the rights described above, please submit a request (an “Applicant Request”) to us by:

• Calling us at (213) 443-8093
• Emailing us at support@helloalma.com

If you fail to make your Applicant Request in accordance with the ways described above, we may either treat your request as if it had been submitted with our methods described above or provide you with information on how to submit the request or remedy any deficiencies with your request.

Only you, or your Authorized Agent that you authorize to act on your behalf, may make an Applicant Request related to your Personal Information. To designate an Authorized Agent, see Authorized Agents below.

All Applicant Requests must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an Authorized Agent of such a person. This may include:
  • Providing certain information about yourself (such as verifying your home address, date of birth, and the last four digits of your Social Security number).
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm which Personal Information relates to you or the individual for whom you are making the request as their Authorized Agent.

We will only use Personal Information provided in an Applicant Request to verify the requestor’s identity or authority to make the request.

Authorized Agents

You may authorize your agent to exercise your rights under the CPRA on your behalf by registering your agent with the California Secretary of State (an “Authorized Agent”). You may also provide your Authorized Agent with power of attorney to exercise your rights in accordance with applicable laws. We may request that your Authorized Agent submit proof of identity and that they have been authorized exercise your rights on your behalf. We may deny a request from your Authorized Agent to exercise your rights on your behalf if they fail to submit adequate proof of identity or adequate proof that they have the authority to exercise your rights.

8. Changes to This Applicant Privacy Notice

We reserve the right to amend this Applicant Privacy Notice at our discretion and at any time. When we make changes to this Applicant Privacy Notice, we will notify you regarding the updated notice through Alma’s communication channels, including through paper or email (or other electronic) notices, and update the notice’s effective date.

9. Contact Information

If you have any questions or comments about this Applicant Privacy Notice, the ways in which Alma collects and uses your information described above, your choices and rights regarding such use, or wish to exercise your rights under applicable state law, please contact us at: