CCPA Notice

Updated July 17, 2023

This Privacy Notice to California Employees (this “Policy”) is effective as of January 1, 2023, and supplements the information contained in other applicable policies and procedures of HF Foods Group Inc. and its operating companies, subsidiaries, divisions and affiliated companies (individually and collectively, the “Company,” “we,” or “us”). We have adopted this Policy to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2022, and their implementing regulations (collectively, the “CCPA”).

This Policy applies solely to current and former job applicants, employees, officers, directors, partners and contractors of the Company (each, as applicable, a “Role”) who are residents of the State of California (each, an “Employee,” “You,” or “Your”).  This Policy describes the collection, use, disclosure, and destruction of Your Personal Information (as defined in Section 1 below) by the Company in connection with Your Role. This Policy also applies to Personal Information about other individuals that You provide to us in connection with the Company’s administration of Your Role, such as Personal Information about Your emergency contacts or, if applicable, beneficiaries of Your employee benefits (collectively, “Related Individuals”).

• INFORMATION THE COMPANY COLLECTS

The Company collects information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual person, including You or a Related Individual (“Personal Information”). In particular, the Company may collect from or about You, or has collected from or about You or Related Individuals, the following categories of Personal Information within the last twelve (12) months

Category

Examples

Identifiers.

A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

A name, signature, physical characteristics or description, birth date, gender, race, ethnicity, marital or registered domestic partner status, veteran status, citizenship status, address, telephone number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, compensation information, medical information, or health insurance information. Personal Information also may include the name, address, birth date, address of any spouse/domestic partner, children and other dependents, or other Related Individuals. Some Personal Information included in this category may overlap with other categories.

Commercial information.

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Biometric information.

Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Internet or other similar network activity.

Browsing history, search history, information on an applicant’s, employee’s and visitor’s interaction with a website, application, or advertisement.

Geolocation data.

Physical location or movements.

Sensory data.

Audio, electronic, visual, thermal, olfactory, or similar information.

Professional or employment-related information.

Current or past job history, performance evaluations, licenses, certifications, organization memberships.

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

Education and training records directly related to Your Role, such as those maintained by an educational institution or party acting on its behalf (e.g., grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records), or information related to other required or discretionary education or training programs or classes.

Inferences drawn from other Personal Information.

Profile information reflecting a person’s preferences, intelligence, characteristics, predispositions, behavior, attitudes, abilities, and aptitudes.

In the administration of our policies, benefits and programs, we also may collect Sensitive Personal Information. “Sensitive Personal Information” means Personal Information that is not publicly available and reveals one or more of the following

• Social Security, driver’s license, state identification card, or passport number;

• account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;

• precise geolocation;

• racial or ethnic origin, and any other status protected by applicable anti-discrimination laws;

• the contents of mail, email, and text messages unless the Company is the intended recipient of the communication; or

• Personal Information collected and analyzed concerning health.

Personal Information does not include

• publicly available information from government records;

• information that we have a reasonable basis to believe is lawfully made available to the general public by You or from widely distributed media;

• information made available by a person to whom You disclosed such information without restriction;

• de-identified or aggregated information; and

• information excluded from the CCPA’s scope, such as:

• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;

• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

The Company obtains Personal Information from the following categories of sources

• directly from You or Your agents. For example, from documents that You provide to the Company related to Your application for employment or in connection with Your Role with the Company;

• indirectly from You or Your agents. For example, through information we collect from You in the course of considering You for employment or in connection with the administration of Your Role with the Company;

• directly and indirectly from activity on our external and internally linked websites, for example, from submissions through our websites or website usage details collected automatically; and

• from third parties that provide services to us or otherwise interact with us in connection with Your application for employment or in connection with Your Role with the Company. For example, from licensing organizations or our payroll provider with respect to Employees, including documents required for employment or tax reporting information required by us as an employer, or our benefits administration providers.

• USE OR DISCLOSURE OF PERSONAL INFORMATION

We may use or disclose the Personal Information that we collect for one or more of the following “Business Purposes”

• to fulfill or meet the reason for which the information is provided. For example, if You provide us with Personal Information in order for us to consider employing You or that is required in connection with Your Role, we will use that Personal Information in connection with Role-related matters, including but not limited to hiring decisions, administering benefits, employee review and discipline, termination, and post-termination and all other matters related to Your Role;

• to provide You with information that You request from us;

• to provide You with emails and notices concerning Your Role, benefits, the Company, or other information or news that may be of interest to You;

• to carry out our obligations and enforce our rights arising from any agreements, policies and procedures related to Your Role;

• to provide, maintain, support, and improve the Company’s services, technologies, and websites and to present website content to You, as applicable;

• as necessary or appropriate to protect the rights, property or safety of us, our clients, customers, employees and others;

• to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;

• to respond to Your request, such as verifying employment in order for You to obtain, for example, a mortgage or other financial services;

• in connection with litigation or charges or investigations to which the Company or You are a party or witness;

• to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred; and

• as described to You when collecting Your Personal Information and as otherwise required or permitted under the CCPA.

Additionally, the Company may use or disclose Sensitive Personal Information for one or more of the following Business Purposes

• to fulfill or meet the reason You provided the information, including to provide or administer employment benefits or to evaluate equal employment opportunity compliance;

• to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;

• to respond to Your requests under the CCPA;

• for any other purpose described to You when we collect Your Sensitive Personal Information; and

• for any other permissible purposes as set forth in the CCPA.

The Company may disclose Personal Information to our “Service Providers”, to our “Contractors”, and to “third parties” (each as defined by the CCPA) for Business Purposes.  “Service Providers” and “Contractors” are third parties that process Personnel Information that we provide or make available in connection with a written contract that includes certain CCPA-required restrictions, such as prohibiting the sale of Personal Information or disclosing Personal Information other than as permitted in our contract with the Service Provider. A “Third Party” is a third party that receives Personal Information from us for any other purpose.

When we disclose Personal Information for Business Purposes, we enter into an agreement with the receiving party that describes the purpose for sharing the Personal Information, and that requires the receiving party to keep that Personal Information confidential. In the case of disclosures to our Service Providers, our Service Providers are obligated not to use the Personal Information for any purpose other than performing the services according to their agreement with us. In the case of our Contractors, our Contractors are obligated not to use the Personal Information for any purpose unrelated to the Business Purpose for which we’ve engaged them.

We may disclose Your Personal Information with the following categories of entities

Categories of Personal Information

Business Purpose

Types of Recipients

Name, address, social security number of You and your spouse/domestic partners and any dependents; birth date; medical condition; compensation information;

Provision and administration of health insurance, leave benefits and retirement plans

Health, disability and leave insurers and/or administrators, third-party providers handling the Company’s 401(k) plans,

Name, address, social security number, compensation information

Payroll and tax compliance and reporting

Payroll provider, federal, state and local tax authorities

Employment-related data, including compensation information, contact information, as applicable, such as name or address, racial or ethnic origin and/or gender, and any other status protected by applicable anti-discrimination laws; performance evaluations; discipline; or compliance with applicable training, mandated continuing education or licensing requirements.

Compliance with subpoenas and/or government requests for information or mandated reporting; and/or in connection with litigation discovery or orders or agency investigations or proceedings; compensation reviews, and/or in response to reference requests or requests for verification of employment data by businesses such as mortgage loan providers.

Governmental agencies such as the Employment Development Department, the California Civil Rights Department, the Equal Employment Opportunity Commission, the Department of Labor, the Department of Industrial Relations; and in the context of litigation or arbitration, as required by law to parties to pending or active litigation and/or to their attorneys.

• Sales and Sharing of Personal Information

Definitions: “Sell,” “Selling,” or “Sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Personal Information to another business or a third party for monetary or other valuable consideration.

“Share,” “Sharing,” or “Shared” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Personal Information to a third party for Cross-context Behavioral Advertising, whether or not for monetary or other valuable consideration. “Cross-context Behavioral Advertising” means the targeting of advertising to an individual based on that individual’s Personal Information obtained from activity across businesses or distinctly-branded websites, applications, or services, other than the business or distinctly-branded website, application, or service with which the individual intentionally interacts.

We do not Sell or Share Your Personal Information, nor will we ever Sell or Share Your Personal Information without providing notice to You and getting Your consent.

• Retention and Deletion of Personal Information

We retain each category of Personal Information for as long as it is reasonably necessary for one or more Business Purposes.

However, due to the nature of the Personal Information we collect and the Business Purposes for which it is received, it is not possible to predict the length of time that we intend to retain Your Personal Information. Instead, we use the following criteria to determine whether it remains reasonably necessary to retain Personal Information

• the initial Business Purposes for which the Personal Information was collected or a subsequent Business Purposes in accordance with the CCPA;

• whether there is a retention period required by applicable contracts with third parties, professional rules of conduct, or applicable law or regulation;

• the existence of threatened or actual litigation for which the Company is required to preserve Personal Information; or

• the generally accepted best practices of the legal industry or of the applicable affiliate of the Company receiving Personal Information.

When we determine that it is no longer reasonably necessary to retain Your Personal Information for one or more disclosed Business Purpose(s) based on the above criteria, we will delete Your Personal Information.

• Your Rights and Choices

You may request information about our collection, use, disclosure of Your Personal Information, whether or not it was collected electronically. For purposes of this Section 5, You includes Related Individuals.

“Verifiable Request” means that the identifying information You provide in connection with a request matches the Personal Information the Company already maintains. Identifying information may include Your name, address, date of application or date of hire.

If You submit a Verifiable Request, we will provide You with information regarding

• the categories of Personal Information we have collected about You; the categories of sources from which Your Personal Information was collected; our Business Purposes for collecting or Sharing Your Personal Information; the categories of third parties with whom we disclose that Personal Information; and the specific pieces of Personal Information we collected about You; and

• what categories of Personal Information we disclosed for a Business Purpose, and to which categories of recipients we disclosed it.

You also have the right to request a copy of Your Personal Information, and/or to request that we transmit Your Personal Information to another entity.  To the extent technically feasible, we will comply with Your request and provide and/or transmit Your Personal Information in a structured, commonly used, machine-readable format.

You also have the right to request that we delete any of Your Personal Information that we collect or maintain by submitting a Verifiable Request. We may deny Your deletion request if retaining Your Personal Information is necessary for us or our “Service Providers” or “Contractors” to

• complete a transaction for which we collected Your Personal Information, provide goods or services that You requested, take actions reasonably anticipated within the context of Your ongoing Role with us or in connection with the Personal Information of a Related Individual;

• help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

• debug products and websites to identify and repair errors that impair existing intended functionality;

• exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law;

• comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);

• engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the achievement of such research, if You previously provided informed consent;

• enable solely internal uses that are reasonably aligned with the expectations of Employees based on Your Role with us;

• comply with a legal obligation; or

• make other internal and lawful uses of that information that are compatible with the context in which You provided it.

You further have the right to request that we correct any of Your Personal Information that is inaccurate by submitting a Verifiable Request. We will correct any inaccurate Personal Information pursuant to Your request to the extent possible using commercially reasonable efforts. We may deny Your correction request if the Personal Information is accurate.  We may also delete Your Personal Information instead of correcting it to the extent such deletion would not negatively impact You.

You also have the right to request that we limit the use and disclosure of Sensitive Personal Information by submitting a Verifiable Request. If You submit such a Verifiable Request, we may continue to use or disclose Your Sensitive Personal Information to

• complete a transaction for which we collected Your Sensitive Personal Information, provide goods or services that You requested, take actions reasonably anticipated within the context of our ongoing business relationship with You, or otherwise perform our contract with You;

• detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

• use in a short-term and transient manner, including, but not limited to, to facilitate non-personalized advertising shown as part of Your current interaction with the technologies used by the Company, but not including disclosure to third parties or use outside Your current interaction with such technologies;

• enable solely internal uses that are reasonably aligned with employee expectations based on Your relationship with us; or

• make any other uses of that information that are permitted by the CCPA and its implementing regulations.

If You choose to exercise a privacy right under the CCPA, You have the right not to receive discriminatory treatment.

You may submit a Verifiable Request for the information listed above, or exercise any of Your rights enumerated under this Notice, by calling us at (888) 905-0998, or by completing a form on our website, or by email to [email protected]. You may also submit a Verifiable Request on behalf of Your minor child.

After we receive Your Verifiable Request, we will provide to You, in writing and free of charge (unless Your request is excessive, repetitive, or manifestly unfounded), the requested information. Unless you specify a shorter period for the request and processing Your request does not require disproportionate effort, we will process Your request with respect to Personal Information we have collected from January 1, 2022 to the time of processing your request). You can choose to have this information delivered to You by postal mail or electronically. We will try to respond to Your verified request within forty-five (45) days of receipt, but if we require more time (up to another forty-five (45) days) we will inform You of the reason and extension period in writing. Please note that we are not required to comply with Your request for information more than twice in any 12-month period. If applicable, our response will explain the reasons why we cannot comply with Your request.

The Company does not and will not Sell or Share Personal Information.

If You choose to exercise any of the rights enumerated under this Policy, we will not

• deny You goods or services, or terms, conditions or benefits of employment

• charge You different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

• provide You a different level or quality of goods or services; or

• suggest that You may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, please be aware that it is necessary for the Company to have Personal Information about You in order for You to be employed by the Company and for us to provide You with Employee benefits.  Additionally, it may be a functional necessity for us and/or our technologies to have Personal Information about You in order to operate, and we may not be able to provide some or all of our benefits or services to You if You direct us to delete Your Personal Information.

• Changes to this Policy

We may amend this Policy from time to time. When we make changes to this Policy, we will notify You by email or on an internal Company website.

• Contact Information

If You have any questions or comments about this Policy, the ways in which we collection, use, disclosure, or destroy Your Personal Information, Your choices and rights regarding Your Personal Information, please do not hesitate to contact us at: [email protected]

To opt out of the sale or sharing of your personal information, use our Do Not Share My Personal Information form.