Data Processing Notice

CSC GENERATION HOLDINGS, INC. DATA PROCESSING NOTICE

This notice (“Notice”) will provide you with information on our data processing activities with respect to certain personal information about employees and job applicants of CSC Generation Holdings, Inc. and its subsidiaries, affiliates, and acquired entities (collectively, the “Company” or “we”) in the United States, Canada, and Mexico.

How We Process Your Personal Information

We will process certain individually identifiable information about you prior to you applying to be a Company employee, during and after the course of any job application process (whether or not you are hired), and during and after your time as a Company employee. We collect this information (“Personal Information”) before and during your job application process, at the start of your employment, and in the course of your employment, for the purposes stated in Section II of this Notice. Such information may be collected directly from you or collected from other sources, such as information from our partners who assist with recruitment and human resources services, and publicly-available sources (e.g., LinkedIn and similar sources of publicly-available information about you).

The information we collect includes information about how to contact you, your role and compensation as a Company employee, who to contact in an emergency and your banking details. Some of the Personal Information we collect is “sensitive” information, such as information about your nationality, birth country, marital status, and health.

Please refer to the Annex to this Notice for full details of the information we collect about you. The list in the Annex is divided into different classes of Personal Information as we do not collect, use, and process all Personal Information for the same purposes.

Certain categories of Personal Information which we collect are necessary for us to fulfill our contractual obligations to you (for example, identification information and bank account information for us to pay your salary, and certain information may be necessary to process your job application). If you do not provide this Personal Information, we may not be able to fulfill certain obligations under your employment relationship with the Company.

Why We Process Your Personal Information

Your Personal Information may be processed where the Company reasonably considers it necessary for the purposes of complying with legal or regulatory obligations, investigating infringements of the law or Company policies (including disciplinary and grievance matters) and establishing, exercising or defending the Company’s legal rights. Your Personal Information will also be processed in the operation and management of the Company’s IT systems which systems may be hosted internally or externally.

We categorize Personal Information into Classes 1-4, defined in the Annex, although the Personal Information we collect may not be limited to those categories set out in the Annex. We process your Personal Information for the following purposes:

Class 1 Information: To facilitate cooperation, communication, and teamwork within the Company, including its Canada and Mexico subsidiaries, affiliates, and acquired entities, and to provide for a directory;
Class 2 Information: To plan and manage human resources, including but not limited to ensuring appropriate staffing and evaluating employees for their qualification for a particular job; cooperation, promotions, secondments, and transfers within the Company; cross-border team work; investment decisions; forecasting and budgeting; accounting, salaries, benefits, compensation and expenses; recruitment; administration of compensation and benefit programs, payroll management and/or processing, training, performance management, succession planning, for documenting proper conduct during the employment relationship and proper termination of employment relationships, and awards of equity or other types of rewards; providing data subjects with access to company computer systems and networks; other tangible and intangible benefits; obtaining feedback from our applicants and employees about our systems and their experience; and in cases of temporary or permanent assignments or secondments of individual employees (which will only occur at their request, with their voluntary consent or otherwise in compliance with applicable law) to such third parties in order to prepare and implement the transfer;
Class 3 Information: To provide third party benefit plans administration services, and assist the Company in discharging essential functions regarding its equity compensation and benefit plans;
Class 4 Information: The Company has in place secure systems where personal information, including employee payroll and benefits information, can be processed. We do not collect sensitive information unless this is legally required, or with consent, or as otherwise authorized under applicable law.

We process Class 1 Information to meet our legitimate interests in ensuring that our employees cooperate across locations, and to facilitate this communication.

As described above, we process Class 2 Information for certain purposes on the basis of your consent. We process Class 2 Information for the other purposes described above to meet our contractual obligations to you, for example, by providing the IT equipment required for you to carry out your role, and to meet our legitimate interests in ensuring that the business functions efficiently, by ensuring that appropriate staff are assigned to appropriate jobs, that our finances are kept in order across the Company, and that our records are kept up-to-date.

We process Class 3 Information to fulfill our contractual obligations to you when we contract with you to provide third party benefit plans. We also process Class 4 Information to carry out our contractual obligations to you, to ensure you are provided with the correct salary and benefits. We process sensitive categories of Personal Information, which are included in Class 4 Information, on the basis of your explicit consent.

Where we process information related to your health for the purposes described above (such as in relation to providing benefits services), we will do so on the basis that it is necessary to comply with our legal obligations in relation to employment law, or in cases where this is not strictly necessary, on the basis of your consent.

Where we process your Personal Information on the basis of your consent, you may withdraw this consent at any time.

Recipients Of Your Personal Information

The following recipients or categories of recipients will receive access to some of your Personal Information.

HRIS

We will include certain Personal Information in a human resources information system (“HRIS”), which is a tool that assists the Company to administer human resources and employee compensation and permits employees to manage their own Personal Information in some cases. The Company may host such respective servers in the United States or may utilize third party servers but in either case will be responsible as controller

for security access within the databases for Personal Information in the HRIS. This transfer of Personal Information will enable the Company to benefit from improved human resources management and to centralize payroll and benefits administration, which will reduce costs and minimize data transfers by less secure means.

With the exception of Class 1 Information, which is available to everyone in the Company to facilitate cooperation, only human resources managers and authorized employees with a need to know have access to the other classes of Personal Information. For example, managers are authorized to have access to Personal Information of the employees which report to them. Certain executives, managers, and employees may also have access to certain Personal Information, however, on a “need-to-know” basis if there are legitimate business purposes, e.g., supervisor-reporting relationships across national borders. A list of such affiliates is available upon request.

Service Providers, Third Parties

In addition, we make certain Personal Information available to affiliated and unaffiliated service providers on a “need-to-know” basis and other third parties. By way of example, some Personal Information in the HRIS will be available to the Company’s employee benefit plans service providers (who will have access to certain Class 3 Information), third parties who provide payroll support services to the Company, and government agencies and entities, where required.

International Transfers Of Personal Information

Some of the recipients of Personal Information discussed in Section III above will be located or may have relevant operations outside of your country. The Company has taken appropriate measures to ensure that Personal Information is treated in accordance with applicable data protection laws. In addition, the Company will provide an adequate level of protection for the Personal Information, and appropriate technical and organizational security measures will be in place to protect Personal Information against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

For How Long Is Personal Information Retained?

Information collected for the purposes stated in this Notice will be stored only as long as necessary during the term of your employment relationship with the Company (which also includes the relationship you have with the Company before and during the job application process), and may be stored during any necessary post-application or post-termination transition period. If a judicial or disciplinary action is initiated or anticipated, the relevant Personal Information may be stored until the end of such action, including any potential periods for appeal, and will then be deleted or archived.

Your Personal Information will not be kept in a form that allows you to be identified for any longer than is reasonably considered necessary by the Company in light of the purposes for which it was collected and any applicable data retention periods. The Company will only retain your Personal Information for longer than these retention periods where it is required to do so by applicable law.

[LAST UPDATED: JANUARY 1, 2023]

Annex I: Classes of Personal Information

Class 1 Information: Generally available contact information, which may include:

Name format type
Prefix (Mr./Mrs/etc.)
First name
Preferred Name
Middle name
Last name (Family Name)
Former Last Name (Maiden Name)
Job code
Reports to position number and name
Office e-mail address
Office phone number
Company cellular phone number
Employment Location
Job title
Employee ID

Class 2 Information: Qualified HR Data, which may include:

National ID Type
National ID
Country (that has issued the National Identification document)
Regulatory Region
Nationality
Date of Birth
Gender
Language Skills
Passport Issue Country
Passport Issue City
Passport Issue State
Passport Expiry Date
Visa Status
Country - for Visa/Permit (Country Name for which visa is applied/granted)
Visa Effective Date
Visa Type (Work Permit/Business/etc.)
Visa Contract
Visa Expiry Date
Home Address
Employment Location
Employment Action (Hire/Rehire/Termination)
Reason for Employment Action (Hire/Rehire/Termination/Leave)
Notice date (when payroll end date is different from working end date)
Temp agency (applicable for agency workers)
Job Code
Reports To Position Number and Name
Employee Classification
Employment Status
Type of Contract
Contractual starting date
Contractual end date
Probation Period
Continuous Service Date
Job classification
Full time/ Part time status
Part time percentage
Job Title
Department
Sub-Department
Region
Market
Project and Project allocation
Cost Center and Cost Center allocation
Supervisor (Employee Name and ID)
Work Period (Weekly/Monthly/etc.)
Salary Administration Plan
Salary Grade
Compensation Rate Code
Compensation Rate
Supplemental salary
Overtime compensation
Bonus compensation
Other variable compensation
Other leave compensation
Not taken holidays compensation
All company paid expenses, benefits and benefits in kind
Housing Allowances
Travel Allowances
Car or Commuting Allowances
Other Allowances (Cost of Living, Mobile Phone, etc.)
Employee expenses
Stock Administration Plan
Education
Company Training History
Performance Rating History
Marital Status
Number of Dependents – Children
Number of Dependents - Adults
Reason for Employment Action (Hire/Rehire/Termination)
Feedback provided to the Company
Days of absence taken per year (but not including health related personal information)
All personal information required to provide data subjects (1) access to company computer systems and networks and (2) tools to electronically communicate within the Company, including but not limited to IP address and user login name.
CCTV recordings which may include images of employees
Call recordings including employee voice recordings

Class 3 Information: Stock and Benefit Plans Administration Service Provider Data, which may include:

Name format type
Prefix (Mr./Mrs./etc.)
First name
Middle name
Last name
Country (that has issued the National Identification document)
E-mail address
Employee ID, other than Social Security Number for non-US employees
Employment Action (Hire/Rehire/Termination) – Date of hire
Employment Action (Hire/Rehire/Termination) – Termination date
Tax jurisdiction
Tax withholding rate
Annual Salary
Payroll entity responsible for reporting of income and taxes
General Ledger code (including business unit and department information)
Home address
Date of Birth
All details related to grants under the equity plans, including but not limited to grant date, number of shares granted, type of shares granted, vesting requirements and number of stock options exercised.

Class 4 Information: Locally Processed Data/Processing Services, which may include:

Photographs - for identification purposes (example: company directory) or security purposes (example: identification badge)
Dependent Details (Name, Date of Birth, Relationship)
End of Service payment and accruals
Holiday salary deduction
Holiday compensation and accruals
Other leave salary deduction
Paycheck details include the following (where applicable):

Total Gross Salary
Employee’s wage tax (withheld by the employer)
Employee’s compulsory Social Security deduction
Employee’s compulsory retirement deduction
Employee’s compulsory unemployment deduction
Employee’s additional medical care deduction
Other compulsory or additional employee’s deductions
Employee’s voluntary retirement deduction
Employee’s voluntary medical care deduction
Other Employee’s voluntary deductions
Total Employee Deductions
Total Net Salary
Stock purchase plan deduction
Expenses refund and advances
Expatriate expenses refund
Benefits in Kind deduction
Other Net adjustments
Salary Advance Adjustments
Third Party payments (net)
Total Net Adjustments
Net to Pay

Banking Details, including the following:

IBAN (International Banking Account Number) or BBAN (Basic Bank Account Number)
BIC (Bank Identifier Code) or SWIFT code
Account currency
Name on the bank account
Bank name
Percentage or amount transfer to bank

Third Party Payments (where acting as an employer surrogate when the employee is on leave for long-term sickness, accident at work or other reason.)

Annex II: California Privacy Notice

This California Privacy Notice supplements the CSC Generations Holdings, Inc. Data Processing Notice. It applies solely to residents of California and addresses Personal Information we collect online and offline.

Collection Of Your Personal Information

We collect, store, and use the following categories of Personal Information:

Identifiers, such as your name, home or other physical address, email address, phone number, username, password and other registration information.
Sensitive Personal Information, including your social security number, driver’s license, passport number, health information, contents of personal communications that you send or receive using Company resources, and login credentials.
Demographic information, such as your gender, age, and date of birth, some of which may be protected characteristics under anti-discrimination laws.
Contact preferences.
Recordings of audio/video calls you have with us.
Video recordings in certain work areas.
Professional or employment-related information, such as credentials provided on a curriculum vitae or resumé, professional history, business contact information, job title, and employer name.
Education information.
Internet or other network activity information associated with your use of Company IT systems, networks, and resources.
Inferences drawn from the categories of Personal Information described above.

Use Of Your Personal Information

We collect and use your Personal Information for the following business purposes:

Maintaining the employment relationship.
Maintaining business records.
Succession planning and workforce management.
Providing work-related accommodations and benefits.
Asset management.
Financial planning.
Informing you of other Company activities.
Processing employment applications.
Communicating with you, including responding to your inquiries and requests.
Protecting the security and integrity of the website or otherwise protecting our rights or property, your health and safety, or the health and safety of others.
Complying with applicable regulatory and legal requirements, responding to legal, court, or regulatory investigations or requests for information.

Categories of Sources of Personal Information

We collect or obtain personal information from the following sources:

From you.
Website interactions.
Social media.
Our service providers and partners that help us operate our services.
Information provided to us by third parties, such as staffing companies, recruiters, references, certification bodies, background check companies, employment services, training providers, and benefits providers.

Sharing Your Personal Information

We may disclose any of the personal information we collect to the following categories of third parties for the business purposes described above:

Our affiliates.
Service providers that provide services to help us with our business activities.
Benefits providers.
Consultants.
Law enforcement, government agencies, courts, or other third parties to protect ourselves, our employees, or others, to investigate fraud, or as required by law, such as to comply with a subpoena or similar legal process.
Third parties in the event we are involved in an actual or contemplated merger, acquisition, or sale of all or a portion of its assets, or in the unlikely event of bankruptcy. We will not rent, lease, sell or exchange Personal Information with other organizations.
Any other third party with your prior consent.

Your Rights

If you are a California resident, you may have the following rights with respect to your Personal Information, subject to applicable exceptions:

Right to Access. You may be entitled to request that we disclose to you the specific pieces of your Personal Information that we have collected about you in a portable and, to the extent technically feasible, readily usable format.‍
Right to Know. You may have the right to confirm that we have collected Personal Information about you and know what Personal Information we have collected about you, including, as applicable, the categories of Personal Information we have collected, the sources from which we collected that Personal Information, the business or commercial purposes for which we collected, sold, and shared that Personal Information, the categories of Personal Information that we sold, shared, or disclosed to third parties for business purposes and the categories of third parties to whom we sold, shared or disclosed Personal Information.‍
Right to Deletion. You may be entitled to request that we delete the Personal Information that we have collected from you. We will use commercially reasonable efforts to honor your request, in compliance with applicable laws. Please note, however, that we may need or be required to keep such information, such as for our legitimate business purposes or to comply with applicable law.‍
Right to Limit the Processing of Sensitive Personal Information. If you are a resident of California, you may be entitled to restrict the processing of your sensitive Personal Information in certain circumstances.‍
Right to Correct. You may request that we correct Personal Information that we hold about you.‍
Right to Opt-Out of Sales and Sharing of Personal Information. You may be entitled to opt out of sales of your Personal Information to third parties and to opt out of the disclosure of your Personal Information to third parties for certain targeted advertising. We do not sell or share your Personal Information.‍
Right to Non-Discrimination. You have the right not to receive discriminatory treatment if you exercise the rights conferred to you by applicable privacy law.

How to Exercise Your Rights

If you would like to exercise one of your rights or exercise rights on behalf of someone else, please contact us at info@cscgeneration.com or 1 (866) 758-8477 and provide us with a description of the information we require to address your rights request, including your name, email address, phone number, and the nature of your request.

To process your requests to Know, Access, Delete, or Correct Personal Information, we must be able to verify your identity to a reasonable degree of certainty. To verify your identity, we will ask you to provide your contact information and additional identifiers based on your relationship with us. Before we process your request, we will match these data points with data points we currently maintain to verify your identity and your relationship with us.

When you use an authorized agent to submit a request, you must provide the authorized agent with written permission to do so, and, in certain circumstances, we may ask you to verify your own identity directly with us. We may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf. Authorized agents may use the channels listed above to submit requests.