California Residents – Applicants for employment with ghSMART

ghSMART California Consumer Privacy Act (“CCPA”)

January 1, 2023

This ghSMART CCPA Privacy Policy (“privacy notice”, “privacy statement”, or “notice”) describes how G. H. Smart & Company, LLC and its subsidiaries (collectively “ghSMART”) collect and use personal information about internal and external employment applicants and candidates who are residents of California (“California Applicants”). Our mailing addresses are included at the end of this notice.

Scope

This Notice applies only to the personal information that ghSMART collects related to California Applicants, including personal information collected in the context of reviewing, assessing, considering, managing, storing, or processing applications or otherwise considering California Applicants for positions with ghSMART. This Notice is intended to satisfy ghSMART’s applicable notice obligations under the CCPA.

The categories of personal information that we collect, and our use of personal information, may vary depending upon the position(s) or location, as well as the associated qualifications and responsibilities. For example, ghSMART conducts in-depth verbal interviews or discussions as part of our recruiting process. The information in this Notice is intended to provide an overall description of our collection and use of personal information about California Applicants. Also, in some cases (such as where required by law), we ask for your consent or give you certain choices prior to collecting or using certain personal information.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

For the purposes of the CCPA, ghSMART is a “business”. This means that we are responsible for deciding how we hold and use personal information about you. As a business we are required under CCPA to notify you of the information contained in this privacy notice.

What isn’t covered by this Notice? This Notice does not address or apply to our collection of personal information that is not subject to the CCPA, such as (i) protected health information, consumer reports (such as credit reports and background checks), publicly available data lawfully made available from state or federal government records, or other information that is exempt under the CCPA; or (ii) the personal information that we collect about residents of states other than California. In addition, the personal information we collect from employees, officers, and directors who are not residents of California is subject to other notices and not this one.

Your data

Categories of Personal Information Collected and Disclosed.  The section below generally identifies the categories of personal information we have collected about California Applicants, as well as the categories of third parties to whom we may disclose this information for a business or commercial purpose:

  • Identifiers: such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number or other government identifiers
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Financial or payment information:  such as banking information for reimbursing payment expenses or payroll onboarding services
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Characteristics of protected classifications Under California or Federal Law: such as race, sex, sexual orientation, gender identity, age, national origin, disability, citizenship status, military/veteran status, marital status, medical condition or other characteristics of protected classifications under California or federal law. (Note: generally, this information is collected on a voluntary basis and is used in support of our equal opportunity and diversity and inclusion efforts and reporting obligations, or where otherwise required by law)
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Audio, visual, and other electronic data: interview recordings, transcriptions and other audio recordings (e.g., recorded meetings and webinars)
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Professional or Employment-Related Information: such as your application responses and cv/Resume, information related to your employment history provided during the recruitment process, including employment verification and references from former employers or colleagues; training; professional experience; contact details of employer; employment appraisal/assessment; details of qualifications; job description tasks and responsibilities; linguistic and job related skills and competencies; details of past and current organizational projects and initiatives; reason for leaving prior roles; standardized test scores; volunteer or professional organization memberships
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Education information: such as information about education history or background that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99)
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Inferences: Inferences drawn from any of the information identified above to about California Personnel reflecting their experiences, preferences, characteristics, behavior and abilities
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law
  • Sensitive Personal Information: we may collect limited ‘sensitive personal information’ (as defined by the CCPA) from Personnel, including: (a) Social Security number and other government identifiers (e.g., as part of the application and verification process); (b) racial or ethnic origin or sexual orientation (e.g., on a voluntary basis to support of our equal opportunity and diversity and inclusion efforts and reporting obligations, or where otherwise required by law, or union membership); and (c) health (e.g., as necessary to provide reasonable accommodations)
    • Third Party Disclosures for Business or Commercial Purposes: service providers, benefits providers, affiliates and subsidiaries, regulators, government entities and law enforcement, internet service providers required for cloud data storage, email, antivirus protection and standard technology operations, operating systems, and platforms, and others as required by law

Sales and Sharing of Personal Information. California privacy laws define a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising.  We do not sell or share personal information or sensitive personal information about California Applicants as defined by CCPA, nor do we sell or share any personal information about individuals who we know are under sixteen (16) years old.

Sources of Personal information. In general, we may collect personal information from the following categories of sources:

  • Directly from the individual
  • Recruiters and recruiting platforms
  • Employee referrals
  • Publicly available information and sources
  • Former employers
  • References you provide

Purposes of Collection, Use and Disclosure.

In this section we outline the purposes for which we may process your data.

Recruiting, hiring, and evaluating applicants: to review, assess, recruit, consider or otherwise manage applicants, candidates and job applications, including:

  • scheduling and conducting interviews;
  • identifying candidates, including by working with external recruiters;
  • reviewing, assessing and verifying information provided, to conduct criminal and background checks, and to otherwise screen or evaluate Applicants’ qualifications, suitability and relevant characteristics;
  • extending offers, negotiating the terms of offers, and assessing salary and compensation matters;
  • satisfying legal and regulatory obligations;
  • communicating with Applicants regarding their applications and about other similar position(s) for which they may be interested;
  • maintaining Applicant personal information for future consideration;
  • in support of our equal opportunity employment policy and practices; and
  • facilitating the reimbursement of approved travel, accommodations, or other expenses during the recruiting process.

Security and monitoring: to monitor and secure our resources, network and assets, including:

  • monitoring for, preventing and investigating suspected or alleged misconduct or violations of work rules;
  • monitoring for, preventing, investigating, and responding to security and privacy incidents;
  • providing and managing access to technical access controls; and
  • monitoring activities, access and use to ensure the security and functioning of our systems and assets.

Health and safety: for health and safety purposes, such as contact tracing or conducting appropriate screenings of individuals prior to entering or accessing certain locations or premises.

Auditing, accounting and corporate governance: relating to financial, tax and accounting audits, and audits and assessments of our business operations, security controls, financial controls, or compliance with legal obligations, and for other internal business purposes such as administration of our records retention program.

M&A and other business transactions: for planning, due diligence and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions.

Defending and protecting rights: to protect and defend our rights and interests and those of third parties, including to manage and respond to employee and other legal disputes, to respond to legal claims or disputes, and to otherwise establish, defend or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties.

Complying with legal obligations: relating to compliance with applicable legal obligations (such as hiring eligibility, responding to subpoenas and court orders) as well as assessments, reviews and reporting relating to such legal obligations, including under employment and labor laws and regulations, Social security and tax laws, environmental regulations, workplace safety laws and regulations, and other applicable laws, regulations, opinions and guidance.

Sensitive Personal Information. Our collection, use, and disclosure of sensitive personal information (as defined by the CCPA) is generally limited to what is reasonable and proportionate for the following purposes: (a) to comply with our legal, regulatory and reporting obligations; (b) to make reasonable accommodations where necessary, (c) to verify the information you provide to us, (d) as otherwise necessary to carry out our functions as an employer; (e) in support of our equal opportunity and diversity and inclusion efforts (on a voluntary basis); (f) where necessary to protect the health and safety of an individual; and (g) to protect and take action against malicious, deceptive, fraudulent, or illegal actions, security incidents. We do not use or disclose California Applicant sensitive personal information for purposes except as described herein (and as permitted by the CCPA.)

If you fail to provide personal information

A failure to provide certain requested information may prevent us from completing our recruiting process, however you are under no obligation to provide us with personal information.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

The period for which data is stored 

The information we collect during the ghSMART service process will form part of our records and as such will be retained as required by legal, accounting, reporting standards as reflected in the ghSMART corporate records retention policy applicable to our business. ghSMART may also be required to retain this information based on statute of limitations for specific countries, as well as government record retention requirements for tax purposes. ghSMART reviews the data to determine that the policy for data storage is in line with our stated purposes for which we may process your data. In some circumstances, we may aggregate or deidentify your personal information so that it can no longer be associated with you, in which case we may continue to use such information without further notice to you.

Your rights

CCPA Rights. Under the CCPA, California residents have the following rights (subject to certain limitations):

  • Opt out of sales and sharing: The right to opt-out of our sale and sharing of their personal information. As noted above, we do not sell or share (as such terms are defined in CCPA) California Applicants’ personal information.
  • Limit uses and disclosure of sensitive personal information: the right to limit our use or disclosure of sensitive personal information to those authorized by the CCPA.
  • Deletion: the right to the deletion of their personal information that we have collected, subject to certain exceptions.
  • To know/access. The right to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
  • Correction. The right to correct inaccurate personal information that we maintain about them.
  • Non-discrimination. The right not to be subject to discriminatory treatment for exercising their rights under the CCPA.

How to Exercise Available Rights. If you think we may have incorrect personal information, or would like a copy of the personal information we hold on you, or to exercise any other data protection right, please contact dataprotection@ghsmart.com or call +1 877 294 3368.

We will take steps to verify your request by matching the information provided by you with the information we have in our records. This may include your first and last name, email address, physical address, telephone number, and information about your relationship with us or other information needed to verify your identity. You must provide us with this information via the above phone number or email address to verify your request.  We will process your request based upon the personal information in our records that is linked or reasonably linkable to the information provided in your request. We may need to request additional specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another security measure designed to ensure that personal information is not disclosed to any person who has no right to receive it. If we are unable to adequately verify a request, we will notify the requestor.  Authorized agents may initiate a request on behalf of another individual; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Changes to this privacy notice

Any changes we make to our privacy notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice.

Contact details 

If you have any questions about this privacy notice or how we handle your personal information, please contact: dataprotection@ghsmart.com or +1 877 294 3368.

Mail address:

G. H. Smart & Company, LLC
203 North LaSalle Street
Suite 2100
Chicago, IL 60601
The United States of America