California Consumer Privacy Act (CCPA)
This policy outlines the personal information collected, used, and retained by Forvis Mazars, LLP (hereafter the Firm) and applies to job applicants, independent contractors, and employees who reside in the state of California. This disclosure is to comply with the California Privacy Rights Act (CPRA) which is an amendment to the California Consumer Privacy Act of 2018 (CCPA).
Personal Information Collected
The personal information collected, used, and retained by the Firm includes, but is not limited to, the following categories.
Sensitive personal information
- Name
- Contact information such as address, telephone number, and email address
- Date of birth
- Social Security Number
- Driver’s license or state/federal government identification number(s)
- Financial bank account information
- Family, dependents, and/or emergency contacts
- Neural data that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information
- Other contact information and identifiers including protected classifications under federal and California state law
Internet or other electronic network activity information
- Internet browsing and search history that includes geo-location
- Intranet activity
- Email communications
- Firm related social media postings
- Stored documents
- Network usernames and passwords
- Phone calls, call logs, and voicemails
- Instant message chat logs
- Employee’s use of company-issued software applications and devices
Professional and employment related information
- Data submitted with employment applications including salary history, employment history, employment recommendations, etc.
- Background check and criminal history
- Education information including education history
- Work authorization
- Fitness for duty data and reports
- Performance and disciplinary records
- Salary and bonus data
- Benefit plan enrollment, participation, beneficiary, and claims information
- Leave of absence or accommodation information including religious and family obligations, physical and mental health data concerning employee/applicant and family members
Obtaining Personal Information
Several different methods may be used in obtaining personal information by the Firm.
- Directly – Information that is entered or provided by applicants, employees, or independent contractors in person, online, by email, by phone, by document upload, etc.
- Directly or Indirectly – Information automatically collected by the Firm based upon website browsing history or network usage by applicants, employees, and independent contractors.
- Vendors or Clients – Information shared with third-party vendors or clients based upon interactions by employees and independent contractors at the Firm related to business needs.
Use of Personal Information
The Firm may share personal information with third parties, such as background vendors, third-party human resources and information technology vendors, outside legal counsel, and state or federal governmental agencies. The Firm reserves the right to add/remove the categories of personal information it collects and uses related to this policy at any time. Use of personal information may include:
- Collect and process employment applications, including confirming eligibility for employment, background related checks, checks regarding fitness for duty, onboarding, and related recruiting efforts
- Evaluate an individual’s appropriateness for a particular position at the Firm, or promotion to a new position
- Processing payroll and employee benefit plan and program design and administration including enrollment and claims handling, and leave of absence administration
- Maintaining personnel records and record retention requirement
- Communicating with employees/applicants and/or employee’s emergency contacts and plan beneficiaries
- Complying with applicable state and federal labor, employment, tax, benefits, workers compensation, disability, equal employment opportunity, workplace safety, and related laws, guidance, or recommendations
- Preventing unauthorized access to, use, or disclosure/removal of the Firm’s property, including the Firm’s information systems, electronic devices, network, and data ensuring and enhancing employee productivity and adherence to the Firm’s policies
- Investigating complaints, grievances, and suspected violations of Firm policy
- Design, implement, and promote the Firm’s diversity and inclusion programs
- Ensure compliance and secure use of the Firm’s information system resources
- Physical formats, including paper documents, printed images, vinyl records, or video tapes
- Digital formats, including text, image, audio, or video files
- Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence (AI) systems that are capable of outputting personal information
- Improve safety of employees, applicants, customers, and the public with regard to use of Firm property and equipment
- Improve accuracy of time management systems
- Client engagement and other legitimate business purposes
Rights Under the CCPA
Individuals may exercise their rights based upon the guidance outlined under the CCPA.
Right to Know
You have the right to request about the Firm’s collection, use, and disclosure of your personal information. Once the Firm receives and verifies your request, unless an exemption applies, we will disclose to you the categories and sources of how personal information was collected and shared.
Right to Delete
You have the right to request that we delete any of your personal information that we collected and retained. Once we receive and verify your request, we will delete, de-identify, or aggregate your personal information. In the event an exception applies, the Firm may deem it necessary to deny the request based upon business or legal obligation.
Right to Correct
You have the right to request that we correct your personal information if it is inaccurate. Once we verify your identity and confirm that your personal information is inaccurate, we will correct your personal information.
Right to Limit the Use of Sensitive Personal Information
You have the right to direct or limit the use of your sensitive personal information to uses which are necessary to perform the services reasonably expected. However, the Firm only uses sensitive personal information for employment related purposes.
Right to Opt Out
If applicable, you have the right to opt out of the 1) sale of personal information, 2) sharing of your personal information, and 3) use of personal information in automated decision-making technology in connection with decisions about the consumer’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. 4) sharing consumer personal information with another business as an asset, as a part of a merger, acquisition, bankruptcy, or other transaction.
The Firm does not share personal information for the purpose of cross-contextual behavioral advertising or process your personal information with automated decision-making.
Right to Non-Discrimination
The Firm prohibits discrimination and retaliation against individuals who exercise their rights under the CCPA.
Submitting a Request Under CCPA Rights
For personal information requests, we may ask for verification of your identity before processing your request. This includes, but not limited to, your full name, contact information, and your relationship with the Firm. If you are submitting a request on behalf of someone else, written authorization may be needed as proof for acting on behalf of someone else including a valid power of attorney. Depending on the nature of the request, the Firm may ask you to provide additional information. Once the Firm receives this information, the request will be reviewed, and a response will be determined.
If you need to submit a request under CCPA Rights, contact:
Compliance Officer
4350 Congress Street, Suite 900
Charlotte, NC 28209
704-367-7030
Email: privacy.notice@us.forvismazars.com
Response Time & Delivery Method Under CCPA Rights
The Firm will acknowledge a request within 10 business days of its receipt under the CCPA. The Firm will respond to a request within 45 days of its receipt. If more time is required to respond (up to 45 additional days for a total of 90 days from receipt of the request), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically. The response provided may also explain the reasons we cannot comply with a request, if applicable.
Questions
If you have any questions regarding the CCPA, contact:
Compliance Officer
4350 Congress Street, Suite 900
Charlotte, NC 28209
704-367-7030
Email: privacy.notice@us.forvismazars.com