Employee Privacy Notice

Statement & introduction

The California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”), require Shakey’s USA, Inc. (“Shakey’s” or “Company”) to provide its employees who are California residents (“Employees”) a notice (“Employee Privacy Notice” or “Notice”) that identifies the categories and items of personal information that may be collected at or before the time of collection by Shakey’s during the employment application process and in the course of employment, to the extent the personal information is subject to the CCPA and CPRA. This Notice also provides Employees with a description of their privacy rights regarding the collection, use and disclosure of their personal information.

Scope

This Employee Privacy Notice applies solely to Shakey’s Employees who are California residents.

Definitions

Employee – As defined by the CCPA and CPRA, a consumer includes a covered business’ employees and is a natural person who is a California resident or individual domiciled in California.

Personally Identifiable Information (“PII” or “Personal Information”) – PII, generally, is a fact about an individual which, if combined with one or more other facts about that individual, would enable others to determine the specific person to whom the facts apply.

Sensitive Personal Information (“SPI”) – A subset of PII that requires greater security protections and standards of care in handling. SPI, also known as "special categories of information", is defined as information that if lost, compromised or disclosed could result in substantial harm, embarrassment, inconvenience or unfairness to an individual.

Business purposes & types of personal information collected

The business purposes for which the Company will collect or use your PII include, to:

comply with state and federal law and regulations requiring employers to maintain certain records (such as work authorization records, personnel files, payroll records, safety records, EEOC demographics and tax forms);
record time worked, earned wages and paid time off and to process payroll;
make payroll direct deposits into bank and debit card accounts;
maintain commercial insurance policies, including for workers’ compensation and other liability insurance and to ensure valid personal auto insurance coverage for business purposes;
manage workers’ compensation claims and related work accommodations;
evaluate and determine ADA and other reasonable work accommodations such as for pregnancy, lactation, religious or other reasons;
maintain and administer group healthcare insurance benefits and 401(k) plans;
manage team member job performance and conduct;
facilitate a better working environment;
conduct investigations of incidents such as workplace accidents and claims of harassment, discrimination or other misconduct;
capture and maintain video and audio recordings of workplace activity for the investigation of reported incidents such as accidents, injuries and team member conduct;
establish, administer and communicate team member work schedules and hours;
evaluate job applicants and candidates for employment;
obtain and verify background checks and job references on job applicants and team members;
verify U.S work authorization;
evaluate, make and communicate decisions regarding a team member’s work performance and employment, including decisions to hire, terminate, promote, demote, transfer, suspend or take corrective action;
administer and deliver general Shakey’s workstation and leadership training modules and program completion;
communicate with team members regarding employment-related matters such as general Shakey’s news and announcements, employment policy changes, benefits enrollment deadlines, benefits statements and other team member alerts and notifications;
grant team members access to secure Shakey’s facilities and maintain information on who accessed the facility;
implement, monitor and manage data security measures and activity on Company-issued and personal team member electronic devices that are used to access Company networks and systems;
administer safety training, injury and illness prevention programs and workers’ compensation claims;
obtain, process and administer required food and beverage handling and service licenses and certifications;
determine qualification for and obtain state and federal work opportunity tax credits;
determine team member geographic location when clocking in and out for work and meal breaks; and
process reimbursements for bona fide business expenses; and
provide employment verification for future employers.

Personally Identifiable Information

The data categories and data items of PII that we may collect and share with third parties, and within the last twelve (12) months may have collected and shared with third parties, as your potential employer or during your employment with Shakey’s, include the following:

Data Categories	Data Items
Personal Identifiers	Full name, alias, street or mailing address, personal email address, telephone number, unique personal identifier, social security number, driver’s license or state identification card number, passport number, telephone number
Physical Characteristics	Height, weight, hair color, eye color
Financial Information	Bank account numbers and routing numbers for direct deposit, credit card number, debit card number
Protected Classification	Gender, gender identity, sex, sexual orientation, age, race, ethnicity, national origin, marital status, military status, religion, medical or mental condition, language preference
Pre-Hire Information	Job application, resume, background check results, job interview notes, reference check notes, candidate evaluation records
Employment-Related Information	Personnel file records, hire date, termination date, pay rates, onboarding documents, I-9 form data, tax withholding forms, payroll data, leave of absence requests, paid sick leave taken, training records, corrective action documents, employee action forms, health benefits enrollment data, workplace incident investigation notes, meal break violation records, performance evaluations, business expense receipts and records
Past Employment and Work History	Prior employer names, positions held, job titles, salary information, qualifications, references, information on your resume, cover letter and/or employment application, dates of service, work performance history
Medical and Health Information	Doctor’s notes, work restrictions information, medical leave of absence records, requests for ADA accommodations, interactive process notes, communications with medical/mental health providers, drug/alcohol test results, work injury, illness triage reports
Dependent Benefits Enrollment	Dependent(s) name, social security or tax identification number, date of birth, gender
Biometric Information	Fingerprints for POS operations and timekeeping
Education Information	Schools currently attending, schools attended, academic degrees completed, vocational school certifications, licensure and certification records
Video and Audio Recordings	In-store video camera and audio microphone recorded data including voice, photographs and video
Facility Access Records	Building/store entry and exit records, alarm set/disarm events
Geolocation Data	Physical location for timekeeping mobile applications
Internet, Network and Computer Activity	Internet activity including browsing/search history, Company computer/electronic device and information usage data, interaction with Internet websites, personal data process on Company IT systems including email, texts and other messaging applications; Company network usage activity, system and file access logs
Mobile Device	Personal mobile phone number, mobile phone provider, mobile phone usage

Sensitive Personal Information (“SPI”) We Collect

We may also collect or process SPI as necessary when you apply for employment and/or in the course of your employment with Shakey’s. You may also supply us with, or we may receive, the following SPI:

social security, driver’s license, state identification card or passport number;
financial account, debit card or credit card number in combination with any required security or access code, password or credentials allowing access to an account;
insurance policy number;
physical characteristics or description;
racial or ethnic origin, religious or philosophical beliefs;
contents of email and text messages, unless the business is the intended recipient of the communication;
precise geolocation;
genetic data and the processing of biometric information for the purpose of uniquely identifying a consumer;
medical health or healthcare insurance information; and
information concerning a consumer’s sexual orientation or gender identity.

How Personal Information is Collected

We obtain most PII and SPI directly from you during employment application and new hire onboarding processes. However, we may also collect PII from the following:

human resources and payroll service providers;
publicly accessible sources;
third-party conducting background checks;
employment eligibility verification services;
certification or licensure governing agencies;
workplace injury and illness triage consultant;
healthcare providers;
bank or financial institution;
point-of-service and timekeeping systems;
door entry systems;
video and audio recording systems;
Shakey’s information technology (IT) systems; and
personal electronic device identifiers and cookies.

Disclosure of Personal Information

We only share your information with the following categories of third parties who provide services to Shakey’s that assist in maintaining regulatory and legal compliance and managing human resources and operations functions:

human resources and payroll service providers;
healthcare and workers’ compensation insurance and financial services (401k) providers;
applicant tracking and onboarding systems;
Work Opportunity Tax Credit capturing services;
electronic data storage providers;
restaurant point-of-service systems providers;
restaurant operation management and communications systems providers;
learning management systems providers;
information technology consulting service providers;
state unemployment claims administration providers;
SSA and USCIS administered E-Verify system;
employment and pay verification service providers;
COBRA administration service providers;
workplace injury and illness triage service providers; and
employment law consulting and law firms.

Our third-party service providers are subject to security and confidentiality obligations and are only permitted to process information for a specified, legitimate business purpose and in accordance with our instructions.

The Company may also share or disclose your PI under the following circumstances to:

comply with applicable federal, state and local laws;
respond to inquiries from government agencies, including police and courts of competent jurisdiction;
comply with any legal or regulatory obligations; and
protect the vital interests of the Company and its employees, managers and officers.

Shakey’s shall use a reasonable standard of care to store and protect from disclosure any PII collected using the principles of least-privileged access and by limiting access to PII and SPI to individuals with a “need to know”.

Employee Privacy Rights

Right to Know

You have the right to request that we disclose to you the following about your PII, as defined by the CCPA/CPRA:

categories of PII we may collect;
specific PII we may collect;
business purpose(s) for collecting or sharing your PII;
categories of sources from which we may collect your PII;
categories of PII we may disclose for business purposes; and
categories of third parties to whom we may share your PII.

Right to Access

You have the right to access PII that we may collect or retain about you. If requested, we shall provide you with a copy of your PII that we collect.

You also have the right to receive your PII in a structured and commonly used format.

Right to Deletion

In certain circumstances, you have the right to request the erasure of your PII. Upon verifying the validity of a deletion request, we will delete your PII from our records and instruct any service providers or third parties to delete your information, when applicable.

Right to Correct

In certain circumstances, you have the right to request correction of any inaccurate PII. Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your PII as directed, taking into account the nature of the PII and the purposes of maintaining your PII.

Do Not Share or Disclose My Sensitive Personal Information

You have the right to limit how your SPI is disclosed or shared with third parties, as defined in the CCPA/CPRA. Upon verifying the validity of a request to limit disclosure or sharing of SPI, we will implement the request and instruct any service providers or third parties to limit disclosure or sharing of your information, when applicable.

Right to Opt-Out/Do Not Sell My Personal Information

Shakey’s does not sell Employees’ PII within the meaning of the CCPA/CPRA.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, in whole or in part, where exceptions under applicable law apply.

Exercising Your Rights

You can exercise any of your rights as described in this Notice and under applicable privacy laws by addressing your data requests to datarequests@shakeys.com.

We will not discriminate against you for exercising such rights. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may refuse to act on the request and notify you of the reason for refusing the request.

Verifying Consumer Identity

Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm the identity.

Data Storage Security and Retention

Shakey’s shall use a reasonable standard of care to store and protect your PII. We use appropriate physical, technical and organizational security measures and procedures to protect PII from unauthorized use, loss, alteration, destruction or modification.

The Company shall retain your PII until the initial purpose for collecting and retaining such data has been satisfied or in accordance with retention requirements and laws applicable to employee personnel data. If you subsequently agree to a new or additional purpose, your PII may be retained for the period applicable to that new or additional purpose.

Data Rights Requests

You can exercise any of your rights as described in this Notice and under applicable privacy laws by addressing your data request or questions to datarequests@shakeys.com.

Responsibilities

Shakey’s VP, Human Resources is responsible for maintaining, reviewing and updating this Privacy Notice.

Contact Information

We have appointed the following contact in the event you have any questions regarding this Employee Privacy Notice or about your rights with respect to your Personally Identifiable Information:

William Graham
VP, Human Resources
Shakey’s USA, Inc.
(626) 576-0616, Ext. 402
wgraham@shakeys.com

Modifications and Revisions

This Notice will be updated at least once every twelve (12) months to reflect changes in our business, legal or regulatory obligations. You may access an electronic version of this Notice or check periodically for changes to this Notice online at https://www.shakeys.com/privacy-policy/employee-notice.

Shakey’s will not collect additional categories of your person information or use your personal information already collected for additional purposes without providing you with a notice of our intent to do so.

We reserve the right to modify, revise or otherwise amend this Employee Privacy Notice at any time and in any manner. Any changes to this Notice will be effective from the date they are communicated to you. If we make any material changes to this Notice, we will notify you by email at the email address you have provided to us before such changes are effective.