Applicant/Employee Privacy Policy

The Company is committed to the privacy and security of personal information. The purpose of this Privacy Policy ("Policy") is to provide you with information about how Company collects, uses, shares, and safeguards personal information it gathers. It also describes options you have concerning your personal information. In general, our processing of personal information is designed to improve the experience of our applicants/employees and to carry out the various payroll, benefit, and administrative functions related to employment.

---

About This Policy

This Policy describes the privacy practices of the Company and its subsidiaries, divisions, and affiliates (collectively and/or individually, "Company", "our", or "we"). Except as otherwise provided, it applies to our interactions with our applicants/employees.

Please read this Policy carefully before submitting information to us. By submitting your information, you indicate your understanding that the collection, use, and sharing of your information is subject to the terms of this Policy. If you do not consent to the collection, use, and sharing of your information as described in this Policy, please do not provide us with such information.

---

Personal Information We Collect

As described below, Company may collect or has collected in the preceding 12 months the following categories of personal information ("PI" or "personal information"). We may add to the categories of personal information or sensitive personal information we collect. In that case, we will inform you.

• Identifiers and Contact information. This category includes names, signature, addresses, telephone numbers, mobile numbers, email addresses, dates of birth, Social Security numbers, passport number, driver's license or state identification numbers, insurance policy number, bank account information, medical information or health insurance information, emergency contact information, and other similar contact information and identifiers.
• Protected classification information. This category includes characteristics of protected classifications under California or federal law.
• Commercial information. This category includes transaction information in connection with expense reimbursements.
• Internet or other electronic network activity information. This category includes without limitation:
  • all activity on the Company's information systems, such as internet browsing history, search history, intranet activity, email communications, social media postings, stored documents and emails, usernames, and passwords
  • all activity on communications systems including phone calls, call logs, voice mails, text messages, chat logs, app use, mobile browsing and search history, mobile email communications, and other information regarding an Employee's use of company-issued devices
• Geolocation data. This category includes GPS location data from company-issued devices and company-owned vehicles.
• Audio, electronic, visual, thermal, or similar information. This category includes, for example, information collected from cameras, thermometers, and similar devices.
• Biometric information. This category includes certain wellness metrics and related information.
• Professional and employment-related information. This category includes without limitation:
  • data submitted with employment applications including employment history, employment recommendations, etc.
  • professional licenses
  • background check and criminal history
  • work authorization
  • fitness for duty data and reports
  • performance and disciplinary records
  • salary and bonus data
  • data on hours worked/paid
  • benefit plan enrollment, participation, and claims information
  • leave of absence information including religious and family obligations, physical and mental health data concerning employee and his or her family members
• Education information. This category includes education history and degrees.
• Inferences drawn from the PI in the categories above. We may use the information collected above to aid in the training and development process of employees.
• Other

Personal information does not include publicly available information or lawfully obtained, truthful information, that is a matter of public concern.

---

Sources of Personal Information

The Company collects information about you from various sources, which may include you, prior employers, educational institutions, references, recruiters, job-related social media platforms, background check companies, licensing and credentialing organizations, claim administrators and investigators, and other third-party sources.

---

Purposes We Collect Your Personal Information

The Company may collect information about you for any of the following purposes:

• Collect and process employment applications, including confirming eligibility for employment, background and related checks, onboarding, and related recruiting efforts
• Processing payroll and employee benefit plan and program design and administration including enrollment and claims handling, and leave of absence administration
• Maintaining personnel records and record retention requirements
• Communicating with employees and/or employees' emergency contacts and plan beneficiaries
• Complying with applicable state and federal labor, employment, tax, benefits, workers compensation, disability, equal employment opportunity, workplace safety, and related laws
• Preventing unauthorized access to, use, or disclosure/removal of the Company's property, including the Company's information systems, electronic devices, network, and data
• Ensuring and enhancing employee productivity and adherence to the Company's policies
• Investigating complaints, grievances, and suspected violations of Company policy
• Design, implement, and promote the Company's diversity and inclusion programs
• Facilitate the efficient and secure use of the Company's information systems
• Ensure compliance with Company information systems policies and procedures
• Improve safety of employees, customers, and the public with regard to use of Company property and equipment
• Improve efficiency, logistics, and supply chain management
• Improve accuracy of time management systems
• Evaluate an individual's appropriateness for a participation position at the Company, or promotion to a new position
• Customer engagement and other legitimate business purposes
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, in which personal information held by us is among the assets transferred.

---

Sharing of Personal Information

For purposes of the CCPA/CPRA, the Company does not sell or share the personal information or sensitive personal information of job applicants or employees.

To carry out the purposes outlined above, the Company may disclose information to third parties.

Categories of personal information disclosed:

• Identifiers and contact information
• Protected classification information
• Commercial information
• Internet or other electronic network activity information
• Geolocation information
• Audio, electronic, visual, thermal, or similar information
• Biometric information
• Professional and employment-related information
• Education information
• Other

Categories of third parties to whom disclosed:

• Third parties as directed by you. We will disclose your PI with those third parties to whom you direct. For example, if you authorize us to complete a verification of employment with your bank.
• Third parties who perform services on our behalf. For example, we disclose information to certain service providers, including benefit consultants, wellness vendors, insurance carriers, background check vendors, etc. We might also authorize our service providers to collect PI on our behalf.
• Governmental entities, legal service providers. We may disclose your PI in order to comply with the law and in the course of consulting on employment related matters. We may also disclose information if a government agency or investigatory body submits a request.
• Successors to all or portions of our business. If all or part of our business is sold, we may disclose PI in preparation for or as part of that transaction.

---

Applicable law

This Policy is governed by the laws of the State of Indiana, without regard to its conflict of laws principles. Jurisdiction for any claims arising under or out of this Privacy Policy shall lie exclusively with the state and federal courts within Indiana. If any provision of this Policy is found to be invalid by a court having competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Policy, which shall remain in full force and effect.

---

Contact Us

If you have additional questions you may call us at (866) 900-4236, submit the CPRA Employee Request Form in Employee Self Service, or email privacy@kempercpa.com. You can write to us at:

Partner in Charge of Administration
7200 Eagle Crest Blvd
Evansville, IN 47715.

---

Changes to this Privacy Policy

Effective Date: November 15, 2024

From time to time we may change our privacy policies. We will notify you of any material changes to our Privacy Policy by posting an updated copy on our company intranet and external website. Please check periodically for updates.

---

For California Residents

This section of the Privacy Policy ("CA Policy") supplements and amends the information contained in our Privacy Policy with respect to California residents. This CA Policy applies solely to individuals, visitors, users, and others who are natural persons and residents of the State of California ("consumers" or "you"). THIS ADDENDUM TO THE PRIVACY POLICY DOES NOT APPLY TO USERS WHO ARE NOT NATURAL PERSONS AND NOT CALIFORNIA RESIDENTS.

The CA Policy describes Company's policies and practices regarding the personal information we collect, use, and disclose about you, including personal information you submit or we obtain during the employment process. This CA Policy is adopted in part to comply with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Any terms defined within the CCPA/CPRA have the same meaning when utilized within this CA Policy. The other provisions of the Policy continue to apply except as modified in this CA Policy. Note, however, that personal information as used in this CA Policy does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA/CPRA's scope, such as personal information covered by certain sector-specific privacy laws, including medical information governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or California's Confidentiality of Medical Information Act, Fair Credit Reporting Act (FRCA), information held by financial institutions, the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Consumer Rights. Pursuant to the CCPA/CPRA, and as detailed below, consumers have various rights with respect to their PI.

• Right to Delete Personal Information. You have the right to request that we delete your PI from our records and direct any service providers to delete your PI from their records, subject to certain exceptions. Upon receipt of a confirmed verifiable consumer request (see below), and as required by the CCPA/CPRA, we will delete and direct any service providers to delete your personal information from our records.

  The Company is not required to comply with your request to delete your PI if it is reasonably necessary for us (or our service provider) to maintain your PI for certain specified reasons, including to comply with a legal obligation.

• Right to Correct Personal Information. You have the right to request that we correct inaccurate PI about you in our records or the records of our service providers. Upon receipt of a confirmed verifiable consumer request (see below), and as required by the CCPA/CPRA, we will correct and direct any service providers to correct your personal information.

• Right to Know and Access Personal Information. You have the right to request that we disclose the following to you as it relates to the 12-month period preceding receipt of your verifiable consumer request:

  1. The categories of PI we have collected about you.
  2. The categories of sources from which the PI was collected.
  3. The business or commercial purpose for collecting, selling, or sharing PI.
  4. The categories of third parties to whom we disclosed PI.
  5. The specific pieces of PI we collected about you.

  Upon receipt of a confirmed verifiable consumer request (see below), and as required by the CCPA/CPRA, we will disclose the requested information.

• Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to request that the use and disclosure of sensitive personal information be restricted. Upon receipt of a confirmed verifiable consumer request (see below), and as required by the CCPA/CPRA, we will restrict the disclosure of sensitive personal information.

• Right of No Retaliation. We will not discriminate or retaliate against you in violation of the CCPA/CPRA for exercising any of your CCPA/CPRA rights.

Upon receipt of a confirmed verifiable consumer request (see below), and as required by the CCPA/CPRA, we will provide a response to such requests.

How Consumers Exercise CPRA Rights. To submit any of the Consumer Rights requests as outlined above, please contact us at (866) 900-4236 and ask for Human Resources, submit the CPRA Employee Request Form in Employee Self Service, or email privacy@kempercpa.com. We reserve the right to only respond to verifiable consumer requests. A verifiable consumer request is one made by any individual who is:

1. the consumer who is the subject of the request,
2. a consumer on behalf of the consumer's minor child, or
3. by a natural person or person registered with the Secretary of State authorized to act on behalf of a consumer.

If we request, you must provide us with sufficient information to verify your identity and/or authority to act on behalf of the consumer. In general, we may ask you to provide identifying information that we already maintain about you or we may use a third-party verification service. In either event, we will try to avoid asking you for sensitive PI to verify your identity. We may not be able to respond to your request or provide you with PI if we cannot verify your identity or authority to make the request and confirm the PI relates to you. However, making a verifiable consumer request does not require you to create an account with us. Additionally, you will need to describe your request with sufficient detail to allow us to review, understand, assess, and respond. PI collected from an individual to determine whether a request is a verifiable consumer request may not be used or disclosed for any other purpose except as required by law. We will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of receipt, but we may require an extension of up to forty-five (45) additional calendar days to respond and we will notify you of the need for the extension.

We will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the receipt of your verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. To the extent permitted by the CCPA/CPRA, we will respond to no more than two requests during any 12-month period.

You may authorize a natural person or a business registered with the California Secretary of State to act on your behalf with respect to the right under this CA Policy. When you submit a request, unless you have provided the authorized agent with a qualifying power of attorney, you must provide your authorized agent written permission (signed by you) to act on your behalf and verify the authorized agent's identity with us. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization.

Questions. If you have questions about this CA Policy, please contact us as described above in the Privacy Policy.