California Privacy Rights Act Notice

The California Consumer Privacy Act of 2018 (“CCPA”) imposes specific obligations on businesses processing personal information of California residents. Pursuant to the CCPA, Legacy Transportation Services, Inc. (“Legacy”, “we” or “us”) is required to provide its employees, contractors who are California residents (“California Persons”) a notice, used at or before the point of collection of such personal information, that identifies the categories of personal information that may be collected and why Legacy collects such information.

This California Employee Privacy Notice (“Notice”) is intended to provide California Persons with the CCPA required notice.

1. Updates

This Notice will be updated at least once every twelve (12) months to reflect changes in our business, legal or regulatory obligations, so please check this Notice periodically for changes by visiting www.legacytsi.com/caprivacy.

Legacy will not collect additional categories of your personal information or use your personal information already collected for additional purposes without providing you with a notice of our intent to do so. Any changes to this Notice will be effective from the date they are communicated to you. If we make any material changes to this Notice, we will notify you by email before such changes are effective at the email address you have provided to us.

2. Definitions

2.1 “Personal information” has the meaning as defined in the CCPA, and includes information that is collected by Legacy about you in the course of employment for employment related purposes and encompasses any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you.

2.2 “Process”, “processed” or “processing” means any operation or set of operations which is performed on personal information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal information.

2.3 “Employees”, “employee” or “you” means an identified or identifiable natural person who is a California resident and who is acting as a Legacy job applicant, employee, or contractor. In this context “job applicant” refers to any person who has submitted his or her candidacy with Legacy; “employee” refers to any person who is employed at Legacy as a full-or part-time employee or temporary worker, and “contractor” means a natural person who provides any service to a business pursuant to a written contract.

3. Personal Information We Collect About You

Listed below are the categories of personal information that Legacy may process about employees:

3.1 Identifiers, including real name, alias, postal address, unique personal identifiers, email, account name, social security number, driver’s license number, passport number or other similar identifiers. In this context, a “unique personal identifier” means a persistent identifier that can be used to recognize an employee, or a device that is linked to an employee, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, or similar technology; unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers.

3.2 Characteristics of Protected Classifications Under California or Federal Law, including the following: race, skin color, national origin, religion (includes religious dress and grooming practices), sex/gender (includes pregnancy, childbirth, breastfeeding and/ or related medical conditions), gender identity, gender expression, sexual orientation, marital status, medical condition (such as genetic characteristics, cancer or a record or history of cancer), disability (such as mental and physical including HIV/AIDS, or cancer), military or veteran status, request for family care leave, request for leave for an employee’s own serious health condition, request for pregnancy disability leave, and age.

3.3 Internet or Other Electronic Network Activity Information, including browsing history, search history, application access location and information regarding an employee’s interaction with an internet website, application or advertisement, time and geolocation data related to use of an internet website, application or physical access to a Legacy office location.

3.4 Professional or Employment-related Information, including job related data, maintained as part of the employment relationship that is present in: a job application or resume; an employment contract; a contractor agreement; a performance review; a disciplinary record; photos; biometric data, including imagery of your fingerprint, face, and voice recordings; information from employee expenses; browsing and search history; payroll and benefits related data; internal and external contact information; or information captured from video, audio, systems, or other forms of monitoring or surveillance.

3.5 Education Information, including information about an employee’s educational background, such as education records, report cards, and transcripts that is not publicly available.

3.6 Inferences, including any information drawn from any of the personal information categories referenced above to create a profile about an employee reflecting the employee’s characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

4. Purposes for Collecting Your Personal Information

Legacy collects the personal information identified in Section 3 above for the reasons listed below.

4.1 To Recruit Employees, including to conduct employment related background screening and checks.

4.2 To Administer Benefits, such as medical, dental, optical, commuter, and retirement benefits, including recording and processing eligibility of dependents, absence and leave monitoring, insurance and accident management and provision of online total reward information and statements.

4.3 To Pay and Reimburse for Expenses, including salary administration, payroll management, payment of expenses, to administer other compensation related payments, including assigning amounts of bonus payments to individuals, administration of departmental bonus pools and administration of stock option payments.

4.4 To Conduct Performance-Related Reviews, including performance appraisals, career planning, skills monitoring, job moves, promotions and staff re-structuring.

4.5 To Monitor Work-Related Licenses and Credentials, including provisioning software licenses for use in the course of an employee’s work-related responsibilities, ensuring compliance, training, examination and other requirements are met with applicable regulatory bodies.

4.6 To Provide Our Employees with Human Resources Management Services, including providing employee data maintenance and support services, administration of separation of employment, approvals and authorization procedures, administration and handling of employee claims, and travel administration.

4.7 To Maintain Your Contact Information, including altering your details across relevant entities within the Legacy group of companies (for example personal, other employment and transferring roles).

4.8 To Assist You in Case of Emergency, including maintenance of contact details for you, and your dependents in case of personal or business emergency.

4.9 To Monitor Eligibility to Work in the U.S., which means monitoring and ensuring compliance of employees’ ability to work in the U.S.

4.10 To Conduct Healthcare-Related Services, including conducting pre-employment and employment-related medical screenings for return-to-work processes and medical case management needs; determining medical suitability for particular tasks; identifying health needs of employees to plan and provide appropriate services, including operation of sickness policies and procedures; and providing guidance on fitness for travel and fitness for expatriation.

4.11 To Facilitate Better Working Environment, which includes conducting staff surveys, providing senior management information about other employees, and conducting training.

4.12 To Ensure a Safe and Efficient Working Environment, which includes Legacy’s actions relating to disciplinary actions, and code of conduct processes and investigations.

4.13 To Maintain Security on Legacy’s Website and Internet Connected Assets, which includes hosting and maintenance of computer systems and infrastructure; management of Legacy’s software and hardware computer assets; systems testing, such as development of new systems and end-user testing of computer systems; training; and monitoring email and Internet access.

4.14 To Comply with Applicable Law or Regulatory Requirements, such as legal (state and federal) and internal company reporting obligations, including headcount, management information, demographic and Health, Safety, Security and Environmental reporting.

5. Third Parties with Access to Your Personal Information

As the employer, we maintain current accurate records for the duration of employment up to the record retention after separation.

Third Party	Personal Information Category	Purpose for Collecting	Length of time
Voya	401K Benefits-4.2, 4.6 , 4.7, 4.8	Administration	6 years
Duncan Financial	401K Benefits-4.2, 4.6, 4.7, 4.8	Administration	6 years
Amtrust	Worker’s Compensation Benefits-4.2, 4.6, 4.7, 4.8	Administration	5 years
UMR	Health Benefits-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
True North	Health Benefits-4.2, 4.6, 4.7, 4.8, 4.10	Administration/Marketing	5 years
Equifax/The Work Number	Verifications for Employment and Compensation-4.6	Administration	4 years
MedOne	RX Health Benefits-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
The Guardian	Dental/Vision Benefits-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
Navia	FSA/HSA/Commuter Benefits-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
TeleDoc	Telemedicine Benefit-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
Mutual of Omaha	Life and Accidental Death and Dismemberment, Disability insurance, Accident insurance, or Critical Illness insurance, Employee Assistance-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
Legal Shield	Legal service insurance-4.2, 4.6, 4.7, 4.8, 4.10	Administration	6 years
PriceKubecka	401(k) Auditors-4.5, 4.14	Administration	5 years
UniGroup	Recruiting/Training Plans-4.1, 4.2, 4.5, 4.6, 4.7, 4.9, 4.11, 4.12	Administration	4 years
Paylocity	Payroll, Human Resource Data System, Time and Attendance-4.1, 4.2, 4.3, 4.4, 4.6 , 4.7, 4.8, 4.9, 4.11, 4.14	Administration	4 years
Epic	Driver Recruiting- 4.2
Randstad Staffing	Temporary Staffing-4.1, 4.3, 4.6, 4.7, 4.8, 4.9, 4.12	Administration	4 years
Coast Staffing	Temporary Staffing-4.1, 4.3, 4.6, 4.7, 4.8, 4.9, 4.12	Administration	4 years
Blue Crew	Temporary Staffing- 4.1, 4.3, 4.6, 4.7, 4.8, 4.9, 4.12
Frasco/Clearstar	Background checking services-4.1, 4.9, 4.12, 4.14	Administration	4 years
IRS/Social Security Administration, Employment Development Department, Various government agencies or CA or US Courts	Requests for Information, garnishments/levies, unemployment, disability, to comply with agencies during a pandemic-4.2, 4.3, 4.6, 4.12, 4.14	Administration	4 years
Comdata	Advances-4.3	Administration	4 years
Samba/Qorta	Pull Notice Program-4.5, 4.7, 4.12, 4.14	Administration	As long as necessary to comply with legal and regulatory obligations.
Ten Street	Recruiting/Employment Information-4.1, 4.5, 4.6, 4.7,4.8, 4.9, 4.12, 4.14	Administration	Duration of employment.
Urgent care, acute care clinics	Worker’s compensation and drug testing-4.2, 4.5, 4.6, 4.8, 4.10, 4.12, 4.14	Administration	6 years
Credit Card/credit applications	To pay invoicing-4.3, 4.7	Administration of payments	As long as needed for payment.

6. Further Information

Legacy Transportation does not sell the information of our clients or providers. If you have any questions about this statement, please contact Legacy’s Human Resources CA Privacy Officer at (408) 294-9800 or ltrittin@legacytsi.com.