California Employee Privacy Policy

Effective Date: 7/1/2023

Heavy Equipment Management Company LLC and its subsidiaries and affiliates (“Company,” “we,” “our,” or “us”) respects the privacy of our employees’ personal information.

Pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”), we are required to provide California employees with a privacy policy that contains a comprehensive description of our online and offline practices regarding our collection, use, sale, sharing and retention of their personal information as well as a description of the rights they have regarding their personal information (“CAE Privacy Policy”). This CAE Privacy Policy provides the information the CCPA requires as well as other useful information regarding our collection and use of personal information.

Please review this CAE Privacy Policy carefully. From time to time, we may change this CAE Privacy Policy. If we do, we will post an amended version on our intranet and our applicant portal. You also may receive a copy by contacting us as described in the “How to Contact Us” section below.

This CAE Privacy Policy covers the following topics:

Scope of CAE Privacy Policy
Notice at Collection of Personal Information
Disclosure of Personal Information
Retention of Personal Information
Your Rights
How to Submit a Request to Know, Delete and/or Correct
Our Process for Verifying a Request to Know, Delete and/or Correct
Other Relevant Policies, Including Monitoring
Accessibility
How to Contact Us

1. Scope of CAE Privacy Policy

When This CAE Policy Applies

This CAE Privacy Policy is intended solely for, and is applicable only to, current and former California employees. Where relevant, it also applies to California job applicants, interns, agency workers, contractors, consultants, directors and other individuals whose information we collect in connection with providing employment. For ease of reference, this CAE Privacy Policy generally refers to employee data, but this does not indicate in any way that a job applicant or other individual who we have not hired is our employee.

When This Policy Does Not Apply

This CAE Privacy Policy does not apply to individuals who are not California residents.

This CAE Privacy Policy also does not apply to our collection and use of your personal information in a consumer or business-to-business capacity. For more information on our collection and use of your personal information in that capacity, including how we process opt-out preference signals, please see our online privacy policy available at Privacy Policy.

2. Notice at Collection of Personal Information

Personal Information We Collect

The CCPA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available, deidentified, or aggregated information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this CAE Privacy Policy, we will refer to this information as “Personal Information.”

We currently collect and, in the twelve (12) months prior to the Effective Date of this CAE Privacy Policy, have collected the following categories of Personal Information from employees:

Identifiers (name, alias, account name, email address, postal address, Social Security number, driver’s license number, other types of state identification card numbers such as California ID Cards, passport number, Internet Protocol address, online identifiers and other similar identifiers).
Unique personal identifiers (cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; employee number, unique pseudonym, or user alias; telephone numbers or other forms of persistent or probabilistic identifiers that can be used to identify a particular employee or device).
Signature.
Telephone numbers.
Physical characteristics or description.
Bank account number, corporate debit and credit card number and other financial information.
Account log-in, financial account, corporate debit card or credit card number in combination with any required security or access code, password or credentials allowing access to an account.
Internet or other electronic network activity information (browsing history; search history; and information regarding an individual’s interaction with a website, application or advertisement).
Precise geolocation data.
Commercial information (records of personal property, products, or services purchased, obtained or considered; other purchasing or consuming histories or tendencies).
Medical information.
Insurance policy number or subscriber identification number.
Any unique identifier used by health insurer to identify employee.
Any information in an individual’s application and claims history, including appeals records, if information is linked or reasonably linkable to an individual or household, including via device, by business or service provider.
Education information.
Professional or employment-related information (including employment history).
Biometric information (imagery of iris, retina, fingerprint, face; hand; palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted; keystroke patterns or rhythms; gait patterns or rhythms; and sleep, health, or exercise data that contain identifying information).
Characteristics of protected classifications under California or federal law (including, but not limited to, race, color, sex/gender, age (40 and older), national or ethnic origin, ancestry, union membership, disability (mental and physical), citizenship or immigration status, marital status, medical condition, military or veteran status, requests for family care leave or leave for an employee’s own health condition).
Audio, video, electronic, visual, thermal, olfactory or similar information that is linked or reasonably linkable to an employee.
Contents of an employee’s mail, email and text messages unless we are the intended recipient of the communication.
Inferences drawn from above information to create a profile about an employee reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes.

Sources of Personal Information

We collect Personal Information directly from California residents and from recruiters; staffing companies; references; former employers; educational institutions; online providers (such as LinkedIn and similar providers); government entities; other employees; business partners; payroll providers; benefits providers; medical providers; background checks; company bankers; claims handlers; authentication and single sign-on providers; advertising networks; internet service providers; data analytics providers; operating systems, platforms, or software; social networks; and data brokers. We do not collect all categories of Personal Information from each source.

Purposes for Collection

We currently collect and have collected the above categories of Personal Information for all purposes of providing employment, including to:

Process payroll;
Enable recruiting services;
Request you complete applications and forms associated with your employment or prospective employment;
Consider you for potential employment;
Perform background checks and drug testing;
Verify your ability to work in this country;
Identify you as a veteran;
Process security clearances;
Perform diversity and inclusion initiatives, including data analysis, development, and deployment;
Perform company audits;
Request you acknowledge your agreement to certain company policies;
Administer our wellness program;
Administer and maintain benefits, including group health insurance, retirement accounts, employee compensation and employee leave;
Contact individuals for emergency purposes;
Track time and attendance at work;
Manage workers’ compensation claims;
Manage your job-related performance;
Arrange business travel;
Investigate and handle disciplinary actions or termination;
Establish training and/or development requirements;
Detect lost/stolen equipment, fraud or other types of wrongdoing;
Grant and monitor your access to secure company facilities and files;
Engage in corporate transactions requiring review of employee records and information, such as for evaluating potential mergers and acquisitions;
Review web traffic and events, monitor for virus attacks and web content, and determine bandwidth consumption;
Maintain commercial insurance policies and coverages, including for workers’ compensation and other liability insurance;
Maintain commercial licenses for enterprise applications and platforms;
Prevent the spread of illness and administer programs during a public health emergency or pandemic (e.g., COVID-19);
Perform call monitoring and video monitoring of our property (e.g., CCTV);
Comply with federal and state law;
Enforce our legal rights; and
Engage in other legitimate business purposes reasonably required for our day-to-day operations such as accounting, financial reporting and business planning.

We also use your Personal Information for the purposes described in our Employee Handbook, applicable policies and procedures posted on our intranet, or otherwise provided to employees from time to time.

3. Disclosure of Personal Information

The following table identifies the categories of Personal Information that we disclosed for a business purpose in the twelve (12) months preceding the Effective Date of this CAE Privacy Policy and, for each category, the categories of recipients to whom we disclosed Personal Information.

Category of Personal Information	Categories of Recipients
Personal identifiers as disclosed in Section 2.	Human resource information systems; operating systems and platforms; customer relationship management systems; background check service providers; government or law enforcement entities; applicant and recruiter software; payroll/tax providers; expense management service providers; enterprise travel providers; data analytics providers; company bankers; authentication and single sign-on providers; security providers; mobile device management providers; accountants; attorneys; benefits providers; social networks; company insurers; manufacturing partners, consultants and other professional advisors.
Medical and insurance information as disclosed in Section 2.	Benefits providers and consultants; company insurers; workers compensation administrators.
Education, employment history and related information as disclosed in Section 2.	Applicant and recruiter software; human resource information systems; operating systems and platforms; background check service providers; benefits providers; and attorneys.
Characteristics of protected classifications under California or federal law as disclosed in Section 2.	Applicant and recruiter software; human resource information systems; operating systems and platforms; background check service providers; benefits providers; and attorneys.

We disclosed Personal Information to the above categories of recipients for the following business or commercial purposes:

Please refer to the Purposes for Collection section in Section 2 above.

We have not sold or shared Personal Information in the twelve (12) months preceding the Effective Date of this CAE Privacy Policy. We do not knowingly collect, sell or share the Personal Information of individuals under 16 years of age. We do not collect or process Personal Information for purposes of inferring characteristics.

4. Retention of Personal Information

We retain your Personal Information for as long as necessary to fulfill the purposes for which we collect it, such as to provide you with services you have requested, and for the purpose of satisfying any legal, accounting, contractual or reporting requirements that apply to us. Please contact us as described in the “How to Contact Us” section below for more information on our employee data retention schedule.

5. Your Rights

If you are a California employee, you have the following rights with respect to your Personal Information:

The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which we collected Personal Information, the business or commercial purpose for collecting, selling or sharing Personal Information (if applicable), the categories of third parties to whom we disclose Personal Information (if applicable), and the specific pieces of Personal Information we collected about you;
The right to delete Personal Information that we collected from you, subject to certain exceptions;
The right to correct inaccurate Personal Information that we maintain about you;
If we sell or share Personal Information, the right to opt-out of the sale or sharing;
If we use or disclose sensitive Personal Information for purposes other than those allowed by the CCPA and its regulations, the right to limit our use or disclosure; and
The right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by the CCPA.

6. How to Submit a Request to Know, Delete and/or Correct

You may submit a request to know, delete and/or correct by emailing your request through our online portal here or by calling (866) 864-3626.

In addition to the CCPA rights discussed above, California law provides current and former employees with the right to request certain information relating to their employment, such as the right to access their personnel file and payroll records. Because these requests are governed by laws that contain different requirements than the CCPA, we handle such requests separately from CCPA requests. If you would like to make such a request, please contact Human Resources by emailing humanresources@hemco.com.

If you would like to update your personal information, such as to notify us of a change of name or address, or if you have questions about your employment, please contact Human Resources by emailing humanresources@hemco.com.

7. Our Process for Verifying a Request to Know, Delete and/or Correct

We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California employee on whose behalf you are making such request. We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized disclosure, deletion or correction as applicable.

For requests to access categories of Personal Information and for requests to delete or correct Personal Information that is not sensitive and does not pose a risk of harm by unauthorized deletion or correction, we will verify your identity to a “reasonable degree of certainty” by verifying at least two data points that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

For requests to access specific pieces of Personal Information or for requests to delete or correct Personal Information that is sensitive and poses a risk of harm by unauthorized deletion or correction, we will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

8. Other Relevant Policies, Including Monitoring

When we hire you, we provide you with other policies and procedures that govern your use of our offices, networks, computers and other devices. We have the right to monitor your use of our offices and electronic resources in accordance with those policies and procedures.

For more information, please read our Employee Handbook and other policies and procedures posted on our intranet.

9. Accessibility

We are committed to ensuring this CAE Privacy Policy is accessible to individuals with disabilities. If you wish to access this CAE Privacy Policy in an alternative format, please contact us as described below.

10. How to Contact Us

To contact us with questions or concerns about our privacy policies or practices, please email us at humanresources@hemco.com.