Notice at Collection

PRIVACY NOTICE AT COLLECTION TO CALIFORNIA EMPLOYEES

GDH Consulting, Inc. and/or any affiliated entities (collectively, the “Company” or “we”) provide this California Privacy Notice (“Notice”) to describe our privacy practices with respect to our collection of Personal Information as required under the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”). This Notice applies only to employees who are residents of the State of California (“Consumers”) and from whom we collect “Personal Information” as defined in the CCPA/CPRA. We provide you this Notice because under the CCPA/CPRA, California residents who are employees qualify as Consumers. For purposes of this Notice, when we refer to Consumers, we mean you only to the extent you are an employee of the Company who has employees in California.

1. Information We Collect from/or About Employees

We may collect Personal Information from or about you in a variety of different situations and using a variety of different methods, including, but not limited to, on our website, your mobile device, through email, in physical locations, through written applications, through the mail, and/or over the telephone. Generally, we may at various times throughout your employment with the Company collect, receive, maintain, and use the following categories of Personal Information for any of the purposes listed below in this Notice and to the extent permitted under applicable law:

Of the above categories of Personal Information, the following are categories of Sensitive Personal Information the Company may collect from or about consumers, contractors, or applicants:

1. Personal Identifiers (social security number, driver’s license or state identification card number, passport number)
2. Account Information (your Company account log-in, in combination with any required security or access code, password, or credentials allowing access to the account)
3. Protected Classifications (racial or ethnic origin, religious or philosophical beliefs, union membership, or sexual orientation)
4. Biometric Information (used for the purpose of uniquely identifying you)
5. Medical and Health Information
6. Geolocation Data (IP address and/or GPS location, latitude & longitude)

Personal information does not include:

• Publicly available information from government records.
• Information that a business has a reasonable basis to believe is lawfully made available to the general public by the employee or from widely distributed media.
• Information made available by a person to whom the employee has disclosed the information if the employee has not restricted the information to a specific audience.
• De-identified or aggregated information.

2. How We Use Personal Information and Sensitive Personal Information

The Personal Information and Sensitive Personal Information we collect, and our use of Personal Information and Sensitive Personal Information, may vary depending on the circumstances. This Notice is intended to provide an overall description of our collection and use of Personal Information and Sensitive Personal Information. Generally, we may use or disclose Personal Information and Sensitive Personal Information we collect from you or about you for one or more of the following purposes:

1. To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to become an employee, we will use that Personal Information in connection with your employment and for current and future job opportunities with us or with our customers, including determining your eligibility and suitability for such opportunities.
2. To comply with local, state, and federal law and regulations requiring employers to maintain certain records (such as immigration compliance records, travel records, personnel files, wage and hour records, payroll records, accident or safety records, and tax records), as well as local, state, and federal law, regulations, ordinances, guidelines, and orders relating to COVID-19.
3. To evaluate suitability for temporary assignments with clients; and to facilitate such assignments and address any issues that may arise therefrom.
4. To manage and process payroll and/or Company travel and expenses.
5. To validate an employee’s identity for payroll and timekeeping purposes.
6. To maintain commercial insurance policies and coverages, including for workers’ compensation and other liability insurance.
7. To manage workers’ compensation claims.
8. To administer, manage, and maintain group health insurance benefits, 401K and/or retirement plans, and other Company benefits and perks.
9. To manage employee performance of their job duties and/or employee conduct, including by engaging in lawful monitoring of employee activities and communications when they are on duty, on Company premises, or utilizing Company internet and WiFi connections, computers, networks, devices, software applications or systems.
10. To conduct workplace investigations (such as investigations of workplace accidents or injuries, harassment, or other misconduct).
11. To evaluate job applicants and candidates for employment or promotions.
12. To obtain and verify background checks on job applicants and employees and to verify employment references.
13. To evaluate, make, and communicate decisions regarding an employee’s employment, including decisions to hire, terminate, promote, demote, transfer, suspend or discipline.
14. To communicate with employees regarding employment-related matters such as upcoming benefits enrollment deadlines, action items, availability of W2s, and other alerts and notifications.
15. To grant employees access to secure Company facilities and maintain information on who accessed the facility.
16. To track employee movement and activity throughout Company facilities and keep the facilities secure.
17. To implement, monitor, and manage electronic security measures on Company internet and WiFi connections, computers, networks, devices, software applications or systems, as well as on employee devices that are used to access Company internet and WiFi connections, computers, networks, devices, software applications or systems.
18. To engage in corporate transactions requiring review or disclosure of employee records subject to non-disclosure agreements, such as for evaluating potential mergers and acquisitions of the Company.
19. To communicate with an employee’s family or other contacts in case of emergency or other necessary circumstance.
20. To manage employee recognition programs.
21. To promote and foster diversity, equity, and inclusion in the workplace.
22. To provide services to corporate customers who may request certain pieces of information about a Company employee (such as name, phone number, and headshot) to permit the employee access or security clearance to their facility in advance of the Company employee being dispatched to provide services at the customer’s facility.
23. To exercise Company’s rights under applicable law and to support any claim, defense, or declaration in a case or before a jurisdictional and/or administrative authority, arbitrator, or mediation panel.
24. To efficiently manage and operate administrative, information technology, and communications systems.
25. INFECTIOUS DISEASE RELATED PURPOSES
    a. To reduce the risk of spreading the disease in or through the workplace.
    b. To protect employees and anyone who interacts with our employees from exposure to COVID-19.
    c. To comply with local, state, and federal law, regulations, ordinances, guidelines, and orders relating to COVID-19, including applicable reporting requirements.
    d. To facilitate and coordinate pandemic-related initiatives and activities (whether Company-sponsored or through the U.S. Center for Disease Control and Prevention, other federal, state and local governmental authorities, and/or public and private entities or establishments, including vaccination initiatives).
    e. To identify potential symptoms linked to COVID-19 (including through temperature checks, antibody testing, or COVID-19 questionnaire).
    f. To permit contact tracing relating to any potential exposure.
    g. To communicate with employees and others who interacted with our employees regarding potential exposure to COVID-19 and properly warn others who have had close contact with an infected or symptomatic individual so that they may take precautionary measures, help prevent further spread of the virus, and obtain treatment, if necessary.
26. To evaluate, assess, and manage the Company’s business relationship with vendors, service providers, and contractors that provide services to the Company.
27. To improve user experience on Company computers, networks, devices, software applications or systems, and to debug, identify, and repair errors that impair existing intended functionality of our systems.
28. To detect security incidents involving potentially unauthorized access to and/or disclosure of Personal Information or other confidential information, including proprietary or trade secret information and third-party information that the Company receives under conditions of confidentiality or subject to privacy rights.
29. To protect against malicious or illegal activity and prosecute those responsible.
30. To prevent identity theft.
31. To verify and respond to consumer requests under applicable consumer privacy laws.

3. Retention of Personal Information

The Company will retain each category of Personal Information in accordance with our data retention schedule, as generally indicated above. In deciding how long to retain each category of Personal Information that we collect, we consider many criteria, including, but not limited to: the business purposes for which the Personal Information was collected; relevant federal, state and local recordkeeping laws; applicable statute of limitations for claims to which the information may be relevant; and legal preservation of evidence obligations.

We apply our data retention procedures on an annual basis to determine if the business purposes for collecting the personal information, and legal reasons for retaining the personal information, have both expired. If so, we will purge the information in a secure manner.

4. Sale/Sharing of Information to Third Parties

The Company does not and will not sell your Personal Information or Sensitive Personal Information for any monetary or other valuable consideration. The Company does not and will not share your Personal Information or Sensitive Personal Information for cross-context behavioral advertising.

5. Access to Privacy Policy

For more information, please review the Company’s Privacy Policy. If you are an employee, the policy can be found by navigating to your Paylocity Home. If you are not an employee, you may review the Company’s online Privacy Policy at Privacy Policy – GDH (gdhinc.com).  

6. Changes to this Notice and Effective Date

If we change this Notice, we will post the revised Notice on our site with an updated revision date. Any new Notice will automatically be effective when it is published on the website. You should therefore return here regularly to review our most up-to-date Notice. The Effective Date of this Privacy Notice is October 15, 2025.