Last Updated: January 1, 2023

This Workplace Privacy Notice explains what types of personal information may be collected from and about employees including contractors, temporary workers, job applicants, and prospective employees and how that personal information is used and shared by Gelson’s Markets and/or its subsidiaries affiliates and related companies’ (collectively, “Gelson’s”, “we”, “us” or “our”). Gelson’s recognizes the confidential nature of the personal information in its care and is accountable for the compliance of itself and its directors, officers, management, employees, representatives, and agents in protecting this personal information.

If you have any questions, comments, or concerns about this policy, please contact us at HRprivacy@gelsons.com.

For the purposes of this Workplace Privacy Notice, “personal information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. We collect personal information directly from you in circumstances where you provide personal information (e.g., during the onboarding process, signing up for direct deposit, enrolling in benefits or services). However, in some instances, the personal information we collect has been inferred about you based on other information you provide us, through your interactions with us, or from third parties. When we collect your personal information from third parties, it is either because you have given us express permission to do so, your permission was implied by your actions, or because you provided explicit or implicit permission to the third party to provide the personal information to us. We collect the following categories of personal information:

In the course of providing administrative employment services, including processing job applications, we may collect the following specific pieces of personal information from you:

• Name, email address, gender, home address and telephone number, date of birth, marital status, employee identification number, and emergency contacts.
• Residency and work permit status, military status, nationality, and passport information.
• Social security or other taxpayer/government identification number.
• Payroll information, banking details.
• Wage and benefit information.
• Retirement account information.
• Sick pay, paid time off, retirement accounts, pensions, insurance, and other benefits information (including the gender, age, nationality and passport information for any spouse, minor children or other eligible dependents and beneficiaries).
• Date of hire, date(s) of promotions(s), work history, technical skills, educational background, professional certifications and registrations, language capabilities, and training records.
• Beneficiary and emergency contact information.
• Height, weight and clothing sizes, photograph, videos, physical limitations, tobacco use, and special needs.
• Records of an employee’s login information including usernames and passwords, systems accessed.
• Records of locations worked, work absences, vacation/paid time off, entitlement and requests, salary history and expectations, performance appraisals, letters of appreciation and commendation, and disciplinary and grievance procedures (including monitoring compliance with and enforcing our policies).
• Video surveillance information collected at our facilities.
• Disciplinary investigation records including the investigators notes, witness information and contacts, pictures or videos submitted by staff, bystanders, guests, and managers.
• Records of employee time clock punches, card swipes, and other access data tied to an employee swipe card.
• Where permitted by law and applicable we may collect the results of credit and criminal background checks, the results of drug and alcohol testing, health screening, health certifications, vaccination information, medical records, driving license number, automobile insurance information, vehicle registration and driving history.
• Social media information, including profile picture and publicly shared data.
• Voicemails, e-mails, correspondence, documents, and other work product and communications created, stored or transmitted using our networks, applications, devices, computers or communications equipment.
• Date of resignation or termination, reason for resignation or termination, information relating to administering termination of employment (e.g., references).
• Letters of offer and acceptance of employment.
• Your resume or CV, cover letter, previous and/or relevant work experience or other experience, education, transcripts, or other information you provide to us in support of an application and/or the application and recruitment process.
• References and interview notes.
• Personal information that is necessary for us to retain and administer benefits to another person relating to you.
• Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We will retain your personal information for as long as necessary to carry out the purposes set out below for which your data is processed unless a longer retention period is required by applicable law. When determining the appropriate period to retain personal information after the employment relationship ends, we take into account how long the personal information is required (e.g. the administration of retirement, disability or survivor’s benefits), our legal and regulatory obligations, the amount, nature and sensitivity of the personal information, the purposes for processing and whether Gelson’s can achieve those purposes through other means, and the establishment and defense of legal claims.

Thus, your personal information relating to your employment will be kept for a period corresponding to your time within Gelson’s, increased by any legal obligations to which Gelson’s is bound (such as mandatory recordkeeping), as well as the limitation periods for all legal or administrative actions.

We use your personal information for the following purposes:

• Employee management: to manage all aspects of the employment relationship (e.g., determining eligibility for initial employment; pay and benefit administration; development and training; absence monitoring; project management; auditing, compliance, and risk management activities; employee communications; performance evaluation; disciplinary actions; grievance and internal investigation activities; processing employee work-related claims, such as worker’s compensation claims); maintain directories of employees; administer our occupational safety and health programs; maintain emergency contact and beneficiary details
• Protection and security: to protect the safety and security of our workforce, guests, property, and assets (including controlling and facilitating access to and monitoring activity on and in our premises and activity using our computers, devices, networks, communications and other assets and resources).
• Investigate claims: to investigate and respond to claims against us.
• To comply with applicable laws (e.g., health and safety, employment laws, office of foreign asset controls regulations, tax laws), including judicial or administrative orders regarding individual employees (e.g., garnishments, child support payments).
• Other related purposes: to carry out other purposes as part of our business activities when reasonably required by us.

In the preceding 12 months, we have sold or shared the following categories of personal information with the following categories of third parties and for the following business purposes:

In the preceding 12 months, we have disclosed the following categories of personal information with the following categories of service providers and for the following business purposes:

Any employees who have knowledge of an impending unauthorized disclosure, whether intentional or unintentional, and who fail to act to prevent the unauthorized disclosure will be subject to discipline as described in the Enforcement section below and/or as otherwise described in the employee handbook, up to and including the immediate dismissal of the offending employee(s).

All employees having care over or access to personal information must comply with the policies, procedures and practices described in this Workplace Privacy Notice. Any breach of any term or condition of this Workplace Privacy Notice, whether intentional or unintentional, is grounds for disciplinary action up to and including the immediate dismissal of any and all offending employees.

We may collect data about children that are under 16 years old as necessary to provide and administer employment benefits and/or to otherwise comply with applicable laws. We do not sell or share the personal information of consumers under 16 years of age.

We may collect data about children that are under 16 years old as necessary to provide and administer employment benefits and/or to otherwise comply with applicable laws. We do not sell or share the personal information of consumers under 16 years of age.

California residents have the following data rights:

Right to Know and to Access

Subject to certain exceptions, and legal obligations, you have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months, including whether we sell or share such information. You also have the right to request access to personal information collected about you and information regarding the categories of personal information; the categories of sources of that information; the business or commercial purposes for which we collect, sell or share it; the third parties to whom we sell, share, or disclose it; and the specific pieces of personal information we collected about you.

This information is disclosed in the “Information Collected” Section of this Privacy Notice. You may also submit a request for this information as described below. To protect your personal information, we are required to verify your identify before we can act on your request.

Right to Portability

You have the right to request that we provide a copy of the personal information we have collected about you, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. This right is subject to certain exceptions, and legal obligations imposed by state or federal privacy and employment laws. Once we receive your request and confirm your identity, we will provide to you a copy of your data as required under the applicable data protection laws. We may provide this data to you through your user account with us, or via email to the email address you have provided with your request.

Right to Delete

You have the right to request that we delete your personal information. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. This right is subject to certain exceptions, and legal obligations imposed by state or federal privacy and employment laws. We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Right to Correct Inaccurate Information

Subject to certain exceptions, and legal obligations imposed by state or federal privacy and employment laws, you have the right to request that we correct inaccurate personal information that we have collected about you. Once we receive your request and confirm your identity, we will review your request, taking into account the nature of the personal information and the purposes of the processing of the personal information to see if we can correct the data. We may also request additional information showing that the information you want to correct is inaccurate.

Right to Opt Out of the Sale or Sharing of Personal Information to Third Parties

You have the right to opt out of the sale or sharing of your personal information by Gelson’s to third parties. Under California law, “sell” means to sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means your personal information to a third party for monetary or other valuable consideration. “Share” means sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means your personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. We do not sell or share your personal information, as those terms are defined under California law.

Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to direct us to limit our use of your Sensitive Personal Information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. California law considers the following pieces of personal information to be “sensitive:” social security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data. We use Sensitive Personal Information only as it is necessary to perform the services for which it was collected, as described above.

Non-Discrimination or Retaliation

We will not discriminate or retaliate against you for exercising any of your data privacy rights.

How to Submit a Request

You or an authorized agent may submit a request to exercise your rights through one of two means:

• By filling out an Employee Data Request Form available at https://www.gelsons.com/cpra-request-employee

• By calling us toll-free at 888-204-9468.

Verification Procedures

In order to process your request to exercise your rights, we must first verify it using information necessary to complete your request. We do this by asking you to:

Provide personal identifiers we can match against information we may have collected from you previously; andConfirm your request using the email and/or telephone account stated in the request; or

We will not collect additional personal information from you for the sole purpose of your exercising your rights under the data protection laws. Similarly, we will not require you to create an account with us, solely for the purpose of exercising your rights under the data protection laws.

Authorized Agent

You may authorize another individual or a business registered with the California Secretary of State, called an authorized agent, to make requests on your behalf. We may ask the individual to submit documentation or proof supporting their authority to represent you, and we may ask you to either verify your own identity or confirm that you provided the authorized individual to act on your behalf. Parents of minor children may submit a birth certificate of the child in lieu of an affidavit, in order to make requests on the child’s behalf.