California Applicant Privacy Notice
This California Workforce Privacy Notice describes the ways Black Rifle Coffee Company and its related business operations may collect, use, maintain, and disclose personal information concerning individuals who work with the Company in California. For purposes of this notice, Workforce Member may include current employees, former employees, part-time personnel, temporary workers, interns, independent contractors, and other individuals who have an employment, service, or work-related relationship with the Company. The notice explains how workforce-related information may be handled under the California Consumer Privacy Act, as amended, and addresses both relevant practices during the applicable preceding period and practices that are currently followed.
Workforce Member Personal Information generally means information that identifies an individual, describes that person, relates to the individual, or could reasonably be connected with or associated with the individual. Certain categories of information are not covered by the CCPA, including information that is lawfully available through public records, properly aggregated information, and information that has been de-identified in accordance with applicable requirements. Information governed by certain other federal or state privacy laws may likewise be excluded from the scope of this notice. Accordingly, this notice applies only to personal information that falls within the portions of the CCPA relevant to workforce members.
The Company may handle workforce information for a variety of legitimate employment and business purposes. These purposes can include recruiting, hiring, onboarding, communication, payroll administration, benefits management, workforce planning, performance management, workplace administration, information technology operations, facility protection, cybersecurity, fraud prevention, legal compliance, and general business management. The specific information collected and the manner in which it is used may depend on an individual’s relationship with the Company, job responsibilities, employment status, and the particular services or processes involved.
Basic identifying information may include a person’s name, residential or mailing address, email address, telephone number, online identifiers, account credentials, internet protocol address, Social Security number, driver’s license information, state identification information, or comparable identifiers. Such information may be necessary to communicate with workforce members, establish employment records, complete hiring and onboarding procedures, administer compensation and benefits, conduct required verification, maintain security, satisfy legal obligations, and perform other ordinary employment functions. When outside organizations assist with these activities, relevant information may be provided to appropriate service providers, technology companies, benefits administrators, payroll providers, retirement plan administrators, screening companies, security vendors, affiliates, and other authorized business partners.
The Company may also process information falling within California’s broader statutory categories of personal information. Depending on the circumstances, this can include signatures, telephone numbers, insurance-related information, education records, employment history, financial account information, and health insurance details. These categories may be needed to administer an employment relationship, process compensation, provide employee benefits, conduct recruiting and screening, maintain workplace systems, protect Company property, satisfy regulatory requirements, and support other lawful workforce activities.
Certain information concerning legally protected characteristics may be collected when appropriate for employment administration or other authorized purposes. Examples can include age, date of birth, marital or family status, citizenship, race, ethnic background, sex, gender, military or veteran status, disability-related information, and medical information. Such data may be used where permitted by law for purposes such as equal employment administration, benefits coordination, onboarding, workplace accommodation, regulatory reporting, compliance, and other legitimate human resources activities.
When Workforce Members interact with Company websites, applications, networks, devices, communication systems, or other electronic resources, technical and electronic activity information may also be collected. Depending on the system involved, this information may include browsing activity, search activity, usage records, system interactions, device information, access logs, and other technical details. Electronic activity information can assist with maintaining network security, administering technology resources, identifying unauthorized use, investigating potential incidents, preventing fraud, troubleshooting technical problems, and improving the operation and reliability of Company systems.
Commercial information may be processed when it is relevant to workforce-related activities. For example, transaction or purchase information could be associated with reimbursement procedures, business expenses, or other employment functions. The Company may also collect or derive location information when reasonably necessary for legitimate operational purposes. Location data may include information generated through Company vehicles or devices, as well as approximate geographic information inferred from an internet protocol address. Depending on the circumstances, such information may support job administration, security, technology management, fraud prevention, vehicle management, workplace operations, or other lawful business activities.
Visual and sensory information may also be obtained in connection with Company operations. Sources can include photographs, employee identification images, security cameras, video recordings, and comparable workplace systems. Such information may be used to support physical security, protect employees and visitors, administer access controls, investigate incidents, document authorized activities, maintain workplace safety, and create or distribute Company materials when appropriate.
Employment-related records can contain substantial information about an individual’s professional relationship with the Company. These records may include resumes, job applications, qualifications, references, recommendations, screening results, professional experience, educational background, training records, certifications, organizational assignments, employment status, performance evaluations, career development information, compensation records, payroll information, benefit elections, leave records, and other human resources documentation. Records may also relate to resignation, termination, workplace complaints, investigations, employment disputes, or other significant employment events. The Company may use these records to make employment decisions, administer personnel programs, manage compensation and benefits, evaluate performance, maintain workplace security, and comply with applicable legal obligations.
Non-public educational information may include institutions attended, degrees obtained, certifications, areas of study, training history, and other relevant educational records. Such information may be obtained during recruitment, candidate evaluation, onboarding, employment administration, professional development, or background verification. The information is generally used to assess qualifications, maintain accurate personnel records, administer employment programs, and fulfill applicable business or legal requirements.
Some categories of workforce information are considered sensitive under California law and may require additional care. Examples may include Social Security numbers, driver’s license or state identification numbers, precise geographic information, certain information revealing racial or ethnic background, and particular health-related information. Where such information is processed, the Company may use it for appropriate purposes such as payroll, benefits administration, employment verification, security, workplace safety, technology management, fraud prevention, compliance, and other activities authorized by applicable law.
Workforce information may also include categories that do not correspond directly to a particular CCPA classification. Depending on the employment relationship, this information could include immigration documentation, visa details, work authorization records, emergency contact information, language abilities, tax and withholding information, family-related information needed for benefits administration, leave and absence records, vehicle information, parking information, or other details required to manage employment responsibilities. Workforce Members may additionally provide information voluntarily through resumes, electronic correspondence, forms, applications, human resources processes, or other communications.
The Company may disclose Workforce Member Personal Information to third parties when such disclosure is reasonably necessary for legitimate business or employment purposes. Potential recipients can include payroll and timekeeping providers, benefits administrators, retirement plan providers, human resources service companies, information technology vendors, background screening organizations, security providers, analytics companies, insurance-related providers, affiliates, and other service partners. Disclosures are generally limited to information reasonably necessary for the relevant purpose or another purpose permitted under applicable law.
Personal information may also be disclosed or used when required or authorized by law. Circumstances can include responding to subpoenas, court orders, governmental investigations, regulatory requests, law enforcement demands, or other legally binding processes. The Company may use information when necessary to investigate suspected misconduct, protect its property and rights, protect another individual, address workplace concerns, establish or defend legal claims, participate in arbitration or mediation, or conduct appropriate internal investigations. Workforce information may also be transferred in connection with a merger, acquisition, restructuring, reorganization, sale, assignment, financing, or another corporate transaction involving the Company or its assets.
Information may come from several different sources. Workforce Members may provide information directly through applications, employment forms, onboarding materials, human resources procedures, email, Company systems, benefit enrollment processes, and other communications. Certain information is collected automatically through websites, applications, networks, devices, and other electronic resources. Individuals entering Company facilities may also be recorded by security systems such as cameras. In addition, the Company may receive information from outside organizations, including human resources providers, background screening services, benefits companies, technology vendors, security providers, and other business partners. Where appropriate and lawful, publicly accessible information from government records or other public sources may also be considered.
The Company does not sell Workforce Member Personal Information and does not disclose such information for cross-context behavioral advertising. Instead, workforce information is maintained and processed primarily in connection with employment administration, compensation, benefits, workplace management, security, compliance, technology operations, and other legitimate business activities described in this notice.
The Company retains Workforce Member Personal Information for only as long as reasonably appropriate for the purpose for which it was obtained, the administration of the employment relationship, ongoing business operations, legal and regulatory requirements, dispute resolution, or protection of Company rights and property. Retention periods can vary depending on the nature of the records, the reason they were collected, applicable recordkeeping obligations, and the circumstances of the individual’s relationship with the Company. When information is no longer reasonably necessary and there is no continuing legal or legitimate business reason to maintain it, the Company may take reasonable steps to dispose of or otherwise manage the information according to its applicable retention practices.
Eligible California Workforce Members may have privacy rights under the CCPA. Depending on the circumstances and subject to applicable exceptions, these rights can include requesting information about the categories of personal information collected, the sources from which information was obtained, the purposes for collection or use, and the categories of third parties to whom information may have been disclosed. Eligible individuals may also have the ability to request access to specific personal information maintained by the Company.
California Workforce Members may, where applicable, request that personal information collected from them be deleted. Such requests remain subject to statutory exceptions, which may allow or require certain records to be retained. Individuals may also request correction of personal information they reasonably believe to be inaccurate. Privacy requests are evaluated under the CCPA and other applicable legal requirements, and the Company may retain information when continued retention is permitted or required by law.
Because Workforce Member Personal Information is not sold and is not used for cross-context behavioral advertising, opt-out rights specifically relating to those activities generally do not apply to workforce information. Likewise, the Company does not use or disclose sensitive Workforce Member Personal Information for purposes that would ordinarily trigger a statutory right to limit such use or disclosure under the applicable CCPA provisions.
Individuals who exercise privacy rights provided by California law are entitled to receive treatment consistent with applicable legal protections. The Company will not unlawfully discriminate against or retaliate against an eligible employee, applicant, contractor, or other Workforce Member because that person exercised a privacy right. Making a lawful request to access, delete, or correct information should not result in prohibited adverse treatment.
For security purposes, the Company may need to verify the identity of an individual before completing a privacy request. A requester may be asked to provide information that can reasonably be compared with records already maintained by the Company. Where California law permits an authorized representative to submit a request on another person’s behalf, additional authorization or identity verification may be required before the request can be completed.
Questions about workforce privacy practices, the handling of personal information, available California privacy rights, or access to this notice in another format or language may be directed through the Company’s designated customer service channel. Privacy inquiries may be submitted by email at customerservice@blackriflecoffee.com or by telephone at 382-265-7384. Workforce Members are encouraged to contact the designated support channel when they need clarification concerning the collection, use, disclosure, retention, security, or handling of their personal information.