CALIFORNIA CONSUMER PRIVACY ACT NOTICE – CREDIBLE LABS INC., CREDIBLE OPERATIONS, INC., and CREDIBLE INSURANCE, INC. EMPLOYEES AND OTHER WORKERS

Last Updated: January 8th, 2025

This California Consumer Privacy Act Notice explains what types of personal information may be collected by Credible Labs Inc., Credible Operations, Inc., and Credible Insurance Inc. (“COMPANY,” “we,” “us,” or “our”) about (i) our prospective, current, and former California employees, and (ii) contractors, who are California residents and who are informed of the applicability of this Privacy Notice to their personal information, as well as California residents who are designated as emergency contacts or beneficiaries (although they are not COMPANY employees) (collectively, “Workers”). It also provides details about how that personal information may be used and disclosed. All employees are responsible for reviewing this Privacy Notice.

California residents who are business consumers acting as employees, owners, directors, officers or independent contractors of an entity conducting due diligence or providing or receiving a product or service from COMPANY may view our Business-to-Business privacy notice here.

As used in this Privacy Notice, “Personal Information” means, in general, information that identifies, or relates to, a particular person. Specific categories of Personal Information are listed below.

Pursuant to the California Consumer Privacy Act (“CCPA”), we provide the following details regarding the categories of Personal Information about California Workers that we have collected or disclosed during the last 12 months:

Categories of Personal Information Collected and Disclosed: The categories of Personal Information that we collected and disclosed are below, along with the categories of third parties to whom each category of Personal Information was disclosed. Depending on the California Worker's interactions with us, COMPANY may not have collected or disclosed each of these categories of Personal Information about that person.

Category of Personal Information Collected	Categories of Third Parties to Whom Personal Information Is Disclosed
Identifiers, such as name, government-issued identifiers (e.g., Social Security number), and unique identifiers (e.g., employee ID)	Service providers, COMPANY affiliates, governmental bodies (e.g., in connection with reporting requirements), entities with whom we have a business relationship, and other parties for our operational business purposes
Personal information, as defined in the California Customer Records law, such as contact and financial information and vaccination status	Service providers, COMPANY affiliates, governmental bodies (e.g., in connection with reporting requirements), entities with whom we have a business relationship, and other parties for our operational business purposes
Characteristics of protected classifications under California law, such as age, gender, or medical conditions (e.g., where relevant or required to provide accommodations), and marital status	Service providers, COMPANY affiliates, governmental bodies (e.g., in connection with reporting requirements), entities with whom we have a business relationship, and other parties for our operational business purposes
Commercial Information, such as transaction information and purchase history (e.g., in connection with travel or other reimbursements)	Service providers, COMPANY affiliates, governmental bodies (e.g., in connection with reporting requirements), entities with whom we have a business relationship, and other parties for our operational business purposes
Biometric Information, such as fingerprints (e.g., in connection with certain legal requirements)	Service providers, COMPANY affiliates, and other parties for our operational business purposes
Internet or network activity information, such as browsing history and interactions with our online systems, websites, and digital applications	Service providers, COMPANY affiliates, and other parties for our operational business purposes
Geolocation data, such as device location on certain safety apps	Service providers, COMPANY affiliates, and other parties for our operational business purposes
Audio, electronic, visual and other similar information, such as call and video recordings (e.g., in connection with closed circuit TV and recorded web-based trainings)	Service providers, COMPANY affiliates, and other parties for our operational business purposes
Professional or employment-related information, such as work history and prior employer	Service providers, COMPANY affiliates, and other parties for our operational business purposes
Non-public education information	Service providers, COMPANY affiliates, and other parties for our operational business purposes
Inferences drawn from any of the Personal Information listed above (e.g., to analyze general usage trends in connection with cloud-based applications)	Service providers, COMPANY affiliates, and other parties for our operational business purposes

Sources of Personal Information. We collect this Personal Information directly from California Workers themselves, or at their direction or with their authorization, where required, as well as from prior employers, references, recruiters, job-related social media platforms, e-Learning or joint marketing partners, COMPANY affiliates, and other sources of demographic or other information. Depending on the California Worker's interactions with us, COMPANY may not have collected Personal Information from each of these categories of sources.

Purposes. We may use this Personal Information and/or disclose it to third parties for the following purposes:

to operate, manage, and maintain our business;
to provide our products and services;
for our employment purposes and objectives, including employee health and safety and workplace monitoring and safety, and employee benefits; and
to otherwise accomplish our business purposes including, for example:
- developing, improving, repairing, and maintaining our products and services;
- personalizing and marketing our products and services;
- conducting research, analytics, and data analysis;
- maintaining our facilities and infrastructure;
- quality and safety assurance measures;
- conducting risk and security controls and monitoring;
- detecting and preventing fraud;
- performing identity verification;
- performing accounting, audit, and other internal functions, such as internal investigations;
- complying with law, legal process, and internal policies;
- maintaining records; and
- exercising and defending legal claims.

Depending on the California Worker's interactions with us, COMPANY may not have used any Personal Information collected about that person for each of these purposes.

Sensitive Personal Information. We do not process sensitive Personal Information of Workers for purposes other than those specified in the CCPA Regulations section 7027(m) (such as to provide our products and services and for security purposes).

Please note that there may be instances when COMPANY may use or disclose Personal Information, including situations where COMPANY has a good faith belief that such use or disclosure is necessary in order to: (i) protect, enforce, or defend the legal rights, privacy, safety, or property of COMPANY, our COMPANY affiliates or our or their employees, agents and contractors (including enforcement of our agreements); (ii) protect the safety, privacy, and security of Workers or members of the public; (iii) protect against fraud or for risk management purposes; (iv) comply with the law or legal process; or (v) respond to requests from public and government authorities.

Sale and Sharing of Personal Information. We do not “sell” or “share” Workers' Personal Information, as those terms are defined by the CCPA. Please note, however, that the CCPA definition of “sale” does not include, for example, the transfer of Personal Information as an asset that is part of a merger, bankruptcy, or other similar transaction involving all or any portion of our business.

Data Retention. We will retain Personal Information from or about Workers as reasonably necessary and proportionate to achieve the purpose(s) for which the Personal Information was collected or processed as outlined in this Notice unless a longer retention period is required or allowed by law.

California Rights. California Workers have the following rights:

(1) Right to Know. California Workers have the right to request that we disclose to them the following information:

The categories of Personal Information we collected about them and the categories of sources from which we collected such Personal Information;
The specific pieces of Personal Information we collected about them for the applicable time period;
The business or commercial purpose for collecting, disclosing, or selling or sharing Personal Information about them;
The categories of Personal Information about them that we sold or shared and the categories of third parties to whom we sold or shared that Personal Information; and
The categories of Personal Information about them that we otherwise shared or disclosed and the categories of third parties with whom we shared or disclosed that Personal Information.

To make a request for their Personal Information, California Workers can click here or call us at 877-791-6510. The California Worker will need to provide: First Name, Last Name, Month of Birth, Day of Birth, Email, Address, City, and ZIP together with other details about their request.

They will then receive verification instructions by email. In some circumstances, we may need additional information from them in order to verify their identity or proceed with their request. For specific information requests, we will require the requestor to sign and return a declaration form stating that they are the individual whose personal information is the subject of the request.

California Workers can use an authorized agent to submit a request for their Personal Information. If you are an authorized agent, and would like to submit a request under the CCPA, please email [email protected] to start the process. Please note that, in addition to verifying identity, as described above, we also will need to verify the authorized agent's ability to act on behalf of the California Worker (e.g., by receiving a copy of their signed permission). Once verification is complete, we may communicate directly with the California Worker for privacy and security reasons.

Please note that, in some instances, we may decline to honor a request, where, for example, we are unable to verify the California Worker's identity or an exception to this right applies.

(2) Right to Request Deletion. California Workers have the right to request that we delete certain Personal Information we collected from them.

To make a request for deletion, please click here or call us at 877-791-6510. The California Worker will need to provide: First Name, Last Name, Month of Birth, Day of Birth, Email, Address, City, and ZIP together with other details about their request. The California Worker will then receive verification instructions by email. In some circumstances, we may need additional information from the California Worker in order to verify their identity or proceed with their request.

California Workers can use an authorized agent to submit a request for deletion. If you are an authorized agent, and would like to submit a request under the CCPA, please email [email protected] to start the process. Please note that, in addition to verifying their identity, as described above, we also will need to verify the authorized agent's ability to act on the Worker's behalf (e.g., by receiving a copy of their signed permission). Once verification is complete, we may communicate directly with the California Worker for privacy and security reasons.

Please note that, in some instances, we may decline to honor a request where, for example, we are unable to verify the California Worker's identity or an exception to this right applies.

(3) Right to Request Correction. California Workers have the right to request that we correct inaccurate Personal Information we collected about them.

To make a request for correction of inaccurate Personal Information, please click here or call us at 877-791-6510. The California Worker will need to provide: First Name, Last Name, Month of Birth, Day of Birth, Email, Address, City, and ZIP together with other details about their request including a description of the inaccurate information currently held by COMPANY. They will then receive verification instructions by email. In some circumstances, we may need additional information from the California Worker in order to verify their identity or proceed with their request.

California Workers can use an authorized agent to submit a request for correction of inaccurate Personal Information. If you are an authorized agent, and would like to submit a request under the CCPA, please email [email protected] to start the process. Please note that, in addition to verifying their identity, as described above, we also will need to verify the authorized agent's ability to act on the Worker's behalf (e.g., by receiving a copy of their signed permission). Once verification is complete, we may communicate directly with the California Worker for privacy and security reasons.

Please note that, in some instances, we may decline to honor a request where, for example, we are unable to verify the California Worker's identity or an exception to this right applies.

(4) Right to be Free from Discrimination. California Workers have the right to be free from unlawful discrimination for exercising their rights under the CCPA.