Salo Human Resources Privacy Notice for California Personnel

Last Updated 4/21/2023

INTRODUCTION

Salo LLC (“Salo”, “we”, “us”, or “our”) is providing this Salo Human Resources Privacy Notice (“HR Privacy Notice”) to give its California employees, job applicants, contractors, officers, directors, and other individuals whose Personal Information is collected for human resources management purposes (such as dependents) (collectively “Personnel”) information regarding how we collect and use your Personal
Information in connection with your employment and other relationship with Salo for these purposes. In this Notice, “Personal Information” has the meaning given to the term in the California Consumer Privacy Act.

SCOPE OF THIS POLICY

This HR Privacy Notice applies only to Personal Information processed in the 12 months preceding the effective date in the context of Human Resources (“HR”), employment, and other business functions relating to our Personnel and their family members or beneficiaries, including internal and external computer systems, networks, and online services.

Salo’s consumer Privacy Policy (“Consumer Privacy Policy”) describes how we collect, use and protect the Personal Information of individuals who use the Salo website (https://hellosalo.com/) and other online services, including employees, job applicants, contractors, officers, directors, and other individuals. The Consumer Privacy Policy will apply to the extent Salo Personnel use the Salo website or other services subject to the Consumer Privacy Policy.

HOW TO CONTACT US

Salo LLC
701 N Washington Ave., Suite 500
Minneapolis, MN 55401
[email protected]
1(866) 221-1651

Please note, if you to wish to access or update information, you may be able to do so directly through your Workday employee account. See below for information relating to how to submit requests to exercise your rights in the Personal Information we process.

CATEGORIES OF PERSONAL INFORMATION

This chart describes the categories of Personal Information that Salo may collect in connection with its Personnel relationships. Note, all Personal Information may be used and disclosed in connection with our Business Purposes.

Category of PI and Representative Data Elements	Common Purposes for Collecting and Sharing the PI
Contact Data Examples: • Honorifics and titles • Mailing address • Email address • Phone number • Social media or communications platform usernames or handles	• Employment/Benefits • Financial Administration • Immigration Management • IT Services • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Background Checks • Legal
Identity Data Examples: • Full name, nicknames or previous names (such as maiden names) • Date of birth • Language • Company ID number • Company account identifiers and passwords • Benefits program identifiers • Travel loyalty numbers • System identifiers (e.g., usernames or online credentials)	• Employment/Benefits • Financial Administration • Immigration Management • IT Services • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Background Checks • Legal • Arranging Consulting Engagements • Arranging Travel for Personnel
Government ID Data Examples: • Social security number • Driver’s license number • Passport number • Other government-issued identifiers as may be needed for risk management or compliance (e.g., if you are a licensed professional, we will collect your license number)	• Employment/Benefits • Financial Administration • Immigration Management • Background Checks • Legal • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Arranging Consulting Engagements • Arranging Travel for Personnel
Biographical Data Examples: • Resume or CV • Data from LinkedIn profiles and similar platforms • Education and degree information • Professional licenses, certifications, memberships, and affiliations • Personal and professional skills and talents summaries (e.g., languages spoken, CPR certification status, community service participation), interests, and hobbies • Professional goals and interests	• Employment/Benefits • Immigration Management • Internal Programs • Risk Management and Loss Prevention • Background Checks • Arranging Consulting Engagements
Transaction and Interaction Data Examples: • Dates of Employment • Re-employment eligibility • Position, title, department, reporting information • Work history information • Time and attendance records • Leave and absence records • Salary/Payroll records • Benefit plan records • Travel and expense records • Training plan records • Performance records and reviews • Disciplinary records	• Employment/Benefits • Financial Administration • Immigration Management • Internal Programs • Health and Safety • Risk Management and Loss Prevention
Financial Data Examples: • Hourly wage/salary details • Bank account number and details • Company-issued payment card information, including transaction records • Personal payment card information, if provided for reimbursement • Credit history, if a credit check is obtained (only done in limited circumstances)	• Employment/Benefits • Financial Administration • Risk Management and Loss Prevention • Background Checks • Arranging Travel for Personnel
Health Data Examples: • Medical information for job placement, including drug testing and fitness to work examinations, accommodation of disabilities • Medical information for leave and absence management, emergency preparedness programs • Dietary restrictions or information • Wellness program data • Information pertaining to enrollment and utilization of health and disability insurance programs	• Employment/Benefits • Internal Programs • Health and Safety • Legal
Device/Network Data Examples: • Device information from devices that connect to our networks • System logs, including access logs and records of access attempts • Records from access control devices, such as badge readers • Information regarding use of IT systems and Internet access, including metadata and other technically-generated data • Records from technology monitoring programs, including suspicious activity alerts • Data relating to use of communications systems and content of those communications	• Employment/Benefits • Financial Administration • Immigration Management • IT Services • Internal Programs • Risk Management and Loss Prevention
Audio/Visual Data Examples: • Photographs or headshots • Video images, videoconference records • CCTV recordings • Call center recordings and call monitoring records • Voicemails	• Employment/Benefits • IT Services • Risk management and loss prevention
Inference Data Examples: • Performance reviews • Results of tests related to interests and aptitudes • System, software, asset and network usage information	• Employment/Benefits • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Background Checks • Legal
Compliance and Demographic Data Examples: • Diversity information • Employment eligibility verification records, background screening records, and other record maintained to demonstrate compliance with applicable laws, such as payroll tax laws, ADA, FMLA, and ERISA • Occupational safety records and worker’s compensation program records • Records relating to internal investigations, including compliance hotline reports • Records of privacy and security incidents involving HR records, including any security breach notifications	• Employment/Benefits • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Legal
Protected Category Data Examples: Characteristics of protected classifications under state or federal law, e.g. race, national origin, gender, disability, marital status, sexual orientation, or gender identity	• Employment/Benefits • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Legal • Arranging Consulting Engagements • Arranging Travel for Personnel
Sensitive Personal Information Examples: • Social security, driver’s license, state identification card, or passport number • Data concerning health, including disability or vaccination data • Racial, national, or ethnic origin • Account log‐in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account • Biometric data, such as fingerprints or iris scans, for the purpose of uniquely identifying a natural person • Personal information collected concerning sexual orientation, solely for the purpose of benefits administration	• Employment/Benefits • Internal Programs • Health and Safety • Risk Management and Loss Prevention • Legal • Arranging Consulting Engagements • Arranging Travel for Personnel

SOURCES OF PERSONAL INFORMATION

We collect Personal Information from various sources, which vary depending on the context in which we
process that Personal Information.

Data you provide us – We will receive your Personal Information when you provide it to us, when you apply for a job, complete forms, or otherwise direct information to us. You may be:
- Prospective Personnel – you have submitted a job application to Salo
- Current Personnel – you hold an existing employment, contractor, officer, or director position
  with Salo
- Former Personnel – Your employment, contractor, officer, or director role at Salo has ended
- HR Management – You are a dependent or other individual related to Salo Personnel.
Data we collect automatically – We may also collect information about or generated by any device you use to access IT services, applications, and networks.
Data we receive from references – We may receive Personal Information from third-party personal or professional references during the application process.
Data we receive from service providers or vendors – We receive information from service providers or vendors performing services on our behalf.
Data we create or infer – We (or third parties operating on our behalf) create and infer Personal Information such as Inference Data based on our observations or analysis of other Personal Information processed under this Privacy Notice, and we may correlate this information with other information we process about you. We may combine Personal Information about you that we receive from you and from third parties.

DISCLOSURE OF PERSONAL INFORMATION

We generally process HR Personal Information internally; however, it may be shared or processed externally by third party service providers and our consulting customers (“Clients”), when required by law or necessary to complete a transaction, or in other circumstances described below.

CATEGORIES OF INTERNAL RECIPIENTS

The Personal Information collected from our Personnel may be disclosed to the following categories of
recipients in relevant contexts.

People Connections – Personal Information relating to Human Resources, Recruitment, HR Operations, and to the extent necessary to evaluate, establish, and maintain the employment relationship, conduct reviews, handle compliance obligations, and similar matters.
Business Development Directors and Associates – Personal Information related to the sourcing of new talent and development of new business or commercial opportunities.
Internal Finance – Personal Information to the extent related to company and employee transactions.
Employee’s Manager – Elements of Personal Information to the extent permitted in jurisdiction, to the extent necessary to evaluate, establish, and maintain the employment relationship, conduct reviews, handle compliance obligations, and similar matters.
IT, and Sales Operations – Personal Information as necessary for providing relevant IT-related support services (conducting IT security measures and IT support services).
Peers and Colleagues – Elements of Personal Information in connection with company address books, intracompany and interpersonal communications (such as Outlook and Microsoft Teams), and other contexts relevant to the day-to-day operation of company business.

CATEGORIES OF EXTERNAL RECIPIENTS

Salo may provide HR Personal Information to external third parties as described below. The specific Personal Information disclosed may vary depending on context but will be limited to disclosures permitted by law. We generally provide Personal Information to:

Certain Clients, depending on the nature of the request (e.g. client invoices)
Our subsidiaries, affiliates, and parent company Korn Ferry
Service providers, vendors, and similar data processors that process Personal Information on Salo’s behalf (e.g., analytics companies, financial analysis/budgeting, trainings, benefits administration, payroll administration, etc.)
Prospective sellers or buyers of our business or assets in the event Salo sells or buys any business or assets or engages in a merger or similar transaction
Future Salo affiliated entities, if Salo or substantially all of its assets are acquired by a third party, in which case Personal Information held by it about its Personnel will be one of the transferred assets
Government agencies or departments, employee unions, or similar parties in connection with employment-related matters
Any public authority in relation to national security or law enforcement requests, if Salo is required to disclose Personal Information in response to lawful requests by public authority
Any other appropriate third party, if Salo is under a duty to disclose or share your Personal information to comply with any legal obligation or to protect the rights, property, or safety of Salo, our employees, customers, or others.

LOCATIONS OF RECIPIENTS

Salo is located in the United States. Any Personal Information collected under this HR Privacy Notice will likely be processed in the United States, in addition to any other jurisdiction where Salo affiliates, subsidiaries and our parent and its affiliates are located.

PURPOSES FOR COLLECTING, USING, AND DISCLOSING PERSONAL INFORMATION

Salo collects Personal Information about its prospective, current, and former Personnel, in the context of an employment or contractual work relationship (such as dependents) for various general HR and Business Purposes, as described below. We do not sell or “share” (as defined in CCPA) HR Personal Information with third parties in exchange for monetary or other valuable consideration or for advertising purposes.

GENERAL HR PURPOSES

Salo collects Personal Information about its prospective, current, and former employees, job applicants, contractors and other individuals as appropriate in the context of an employment or contractual work relationship, including for recruitment and IT/technical support services, and as needed for using internal software, networks and devices. The categories of Personal Information we process, along with representative data elements, are listed in the chart below. We may not collect from you or process all of the Personal Information identified below, depending on your position or the nature of your relationship with Salo.

We generally process Personal Information for the following purposes:

Personal Information pertaining to *Prospective* Personnel may be processed for the following	Employment / Benefits	• Evaluating prospective employment/engagement • Recruiting and staffing assessment, including evaluating skills and job placement • Conducting reference checks • Tracking application status and application follow up and activities • Making hiring decisions, including negotiating compensation, benefits, relocation packages, etc.
	Immigration Management	• Determining an individual’s eligibility to work • Processing work permits or visas
	IT Services	• Analyzing job post activity and recruitment website traffic statistics and aggregate user behavior
	Background Checks	• Conducting background checks, vetting and verification, consumer credit reporting, and conducting related assessments (where permitted by law)
	Legal	• Reporting to EEOC and other federal/state governments • Protecting against liability, complying with lawful governmental investigation or request, enforcing our policies and agreements
Personal Information pertaining to *Current* Personnel may be processed for the following	Employment / Benefits	• Evaluating, creating, and maintaining the employment relationship • Administering payroll and compensation • Administering insurance and benefits programs e.g. dental, FSA, HSA, etc. • Hiring and job placement • Conducting reference checks • Time and attendance tracking, scheduling, managing absences, administering other workplace tasks, and facilitating relationships within Salo • Developing talent and performance, managing skills, training, conducting performance reviews (including customer surveys), conducting engagement surveys, and administering recognition and reward programs • Conducting HR support services, such as responding to inquiries, providing information and assistance, and resolving disputes • Conducting salary market surveys • Recordkeeping and verifying employment/income
	Internal Finance	• Handling reimbursements for expenses and expenditures • Invoicing • Administering ESOP/401k/investment plans • Conducting salary surveys
	Immigration Management	• Evaluating and maintaining visa eligibility • Verifying right to work/eligibility
	IT Services	• Managing computers and other IT assets • Supporting systems and promoting security • Providing email and other communications and software services
	Internal Programs	• Conducting diversity, equity, and inclusion initiatives and programs • Conducting health and wellness programs
	Health and Safety	• Conducting occupational health and safety programs (including required reporting, disaster and pandemic planning, vaccination status tracking, and managing incidents) • Making and assessing disability accommodations • Conducting anti-harassment training
	Risk Management and Loss Prevention	• CCTV and premises monitoring, such as in the office, or adjacent to Salo premises, and managing/authenticating on- site access • Recording calls for training purposes • Monitoring IT systems for security and support purposes
	Background Checks	• Conducting background checks, vetting and verifying, consumer credit reporting, and conducting related assessments (where permitted by law)
	Legal	• ACA and IRS reporting • EEOC and federal/state government reporting • Protecting against liability, complying with lawful governmental investigation or request, enforcing our policies and agreements
Personal Information pertaining to *Former* Personnel may be processed for the following	Employment / Benefits	• Evaluating, creating, and maintaining the employment relationship in the event of re-employment • Administering insurance and benefits programs e.g. dental, FSA, HSA, etc. • Archiving and recordkeeping • Verifying employment and income
	Internal Finance	• Administering ESOP/401k/investment plans
	Legal	• Protecting against liability, complying with lawful governmental investigation or request, enforcing our policies and agreements
Personal Information pertaining to individuals whose information is provided to Salo in the course of HR management (e.g. regarding Personnel family members, beneficiaries, dependents, emergency contacts, etc.) may be collected, used and shared for:	Legal	Protecting against liability, complying with lawful governmental investigation or request, enforcing our policies and agreements

BUSINESS PURPOSES

“Business Purposes” means the following purposes for which Personal Data may be collected, used and shared:

Managing identity and credentials, including verifying and authenticating identity, issuing ID cards and badges, administering systems, and managing access credentials
Administering security, loss prevention, information security and cybersecurity
Complying with laws and regulations, including without limitation all uses and disclosures of Personal Information that are required by law or for compliance with legally-mandated policies and procedures, such as anti-money laundering programs, security and incident response programs, intellectual property protection programs, and corporate ethics and compliance hotlines, and other processing in connection with establishing of and defending against legal claims
Auditing, analyzing, and consolidated reporting
Enforcing our contracts and protecting Salo, our Personnel, our Clients and their employees, and the public against injury, theft, legal liability, fraud or abuse, to people or property
As needed for de-identifying data or creating aggregated datasets, such as for consolidating reporting, research, or analytics
Making back-up copies for business continuity and disaster recovery purposes, and other IT support, debugging, security, and operations
Analyzing and improving technical and organizational services and operations
As needed for facilitating corporate governance, including mergers, acquisitions and divestitures.

DATA ADMINISTRATION

SECURITY

Salo requires that Personal Information be protected using technical, administrative, and physical safeguards, as described in our various security policies. Salo staff must follow the security procedures set out in applicable security policies at all times.

RETENTION AND DISPOSAL

Salo intends to retain Personal Information or Sensitive Personal Information (as defined above) for no longer than is reasonably necessary and proportionate to achieve the legitimate business purpose for which it was collected or to satisfy a legal requirement. What is necessary may vary depending on the context and purpose of processing. We generally consider the following factors when we determine how long to retain data (without limitation):

Retention periods established or necessary under applicable law;
Industry and human resources best practices;
Whether the purpose of processing is reasonably likely to justify further processing;
Risks to individual privacy in continued processing;
Applicable data protection impact assessments;
IT systems design considerations/limitations; and
The costs associated with continued processing, retention, and deletion.

Salo staff must follow any applicable records retention schedules and policies and destroy any media containing Personal Information or Sensitive Personal Information in accordance with applicable company policies. Personal Information shall not be further processed in a manner that is incompatible with these purposes.

YOUR RIGHTS AND CHOICES

YOUR RIGHTS, INCLUDING YOUR CALIFORNIA PRIVACY RIGHTS

Under the California Consumer Privacy Act (“CCPA”) and other comprehensive state privacy laws, you may have the following rights, subject to your submission of an appropriately verified request (see below for verification requirements):

Right to Know	You may request any of following, for the 12 month period preceding your request: (1) the categories of Personal Information we have collected about you, or that we have sold, or disclosed for a commercial purpose; (2) the categories of sources from which your Personal Information was collected; (3) the business or commercial purpose for which we collected, sold or shared your Personal Information; (4) the categories of third parties to whom we have sold or shared your Personal Information, or disclosed it for a business purpose; and (5) the specific pieces of Personal Information we have collected about you, subject to exceptions under applicable law.
Right to Delete	You have the right to delete certain Personal Information that we hold about you, subject to exceptions under applicable law.
Right to Correct	You have the right to correct certain Personal Information that we hold about you, subject to exceptions under applicable law.
Right of Non-retaliation	You have the right to not to receive discriminatory treatment as a result of your exercise of rights conferred by the CCPA.
Direct Marketing	You may request a list of Personal Information we have disclosed about you to third parties for direct marketing purposes during the preceding calendar year, if applicable.
Opt-Out of Sale or Sharing	We do not sell or share HR Personal Information with third parties in exchange for monetary or other valuable consideration or for cross-context behavioral advertising. Salo’s Consumer Privacy Policy describes how we collect, use and protect the Personal Information of individuals who use the Salo website (https://hellosalo.com/) and other online services, including employees, job applicants, contractors, officers, directors, and other individuals. The Consumer Privacy Policy and its “Opt-Out of Sale or Sharing” process will apply to the extent Salo Personnel use the Salo website or other services subject to the Consumer Privacy Policy.
Limit the Use of Sensitive Personal Information	We only process Sensitive Personal Information for certain limited purposes as permitted under the CCPA, such as performing services as reasonably expected, to prevent, detect, and investigate security incidents, to resist malicious, deceptive, fraudulent, or illegal actions, to ensure the physical safety of natural persons, for short- term transient use, to perform services on behalf of the business, to verify or maintain the quality or safety of a product, service, or device, or for purposes that do not infer characteristics about our Personnel. Thus, we do not offer a right to limit use and disclosure of Sensitive Personal Information. However, if you have any questions, please contact us. Salo’s Consumer Privacy Policy describes how we collect, use and protect the Sensitive Personal Information of individuals who use the Salo website (https://hellosalo.com/) and other online services, including employees, job applicants, contractors, officers, directors, and other individuals. The Consumer Privacy Policy and its “Limit the Use of My Sensitive Personal Information” process, if any, will apply to the extent Salo Personnel use the Salo website or other services subject to the Consumer Privacy Policy.
Minors	We have actual knowledge that we collect or maintain Personal Information of minors, such as employee dependents. To the extent we collect or maintain Personal Information of a minor under age 16, those minors between the age of 13 and 16 must opt in to any Selling or Sharing of Personal Information (as defined in CCPA), and minors under the age of 13 must have a parent consent to Selling or Sharing of Personal Information (as defined in CCPA), subject to exceptions under applicable law. All minors have the right to opt-out later at any time, subject to exceptions under applicable law. Minors under age 13 may have other rights under the Children’s Online Privacy Protection Act (“COPPA”).

SUBMISSION OF REQUESTS

Current Personnel can review and update much of their Personal Information via their Workday employee accounts. If you are a current Salo employee, officer, director, or contractor, you can send an email to [email protected] to submit requests to exercise your rights in Personal Information subject to this HR Privacy Notice, to the extent you have those rights under applicable law. You may also contact the HR Office for assistance. If you are an applicant, former employee, former officer, former director, beneficiary, dependent, or family member, please contact us at the email listed below for assistance with your privacy requests. For all other questions or comments about this HR Privacy Notice or our privacy practices, please contact:

Salo LLC
Attn. Human Resources
701 N Washington Ave., Suite 500
Minneapolis, MN 55401
Re: Data Rights Requests

[email protected]
https://hellosalo.com/privacy-policy/
1(866) 221-1651

VERIFICATION OF REQUESTS

Requests to receive a copy of Personal Information and requests to delete or correct Personal Information, must be verified to ensure that the individual making the request is authorized to make that request, to reduce fraud, and to ensure the security of your Personal Information. We may require that you log in through Workday (if you are a current employee, officer, director, or contractor), and/or that you provide the email address we have on file for you (and verify that you can access that email account) as well as an address, phone number, or other information we have on file, in order to verify your identity. If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf.