California Applicant Privacy Notice

Black Rifle Coffee Company places significant emphasis on respecting the privacy of individuals who have an employment, contracting, internship, or other work-related relationship with the Company in California. This California Workforce Privacy Notice describes the general ways personal information may be collected, used, stored, and disclosed in connection with workforce administration and business operations. It applies to current and former employees, temporary personnel, interns, contractors, and other individuals whose information is handled in connection with their work relationship. The notice is intended to explain applicable practices under the California Consumer Privacy Act and related requirements.

Workforce personal information generally means information that identifies a person, describes an individual, relates to someone, or could reasonably be connected with that individual. Certain categories of information may fall outside the applicable privacy requirements, including publicly available records, aggregated data, and information that has been properly de-identified. Information governed by separate federal or state regulations may also be subject to different rules. Accordingly, the scope of this notice is limited to workforce information covered by the relevant California privacy provisions.

The Company may handle workforce information for a variety of legitimate purposes connected with employment and business administration. These purposes can include recruiting, evaluating qualifications, completing onboarding procedures, managing payroll and benefits, maintaining employment records, communicating with workers, administering workplace responsibilities, supporting information technology, protecting physical and digital facilities, preventing fraud, and meeting legal or regulatory obligations. Information may also be used to support organizational planning, workplace security, internal administration, and other activities necessary for effective business operations.

The categories of information collected may differ depending on an individual’s relationship with the Company and the services involved. Identifying information can include a name, residential or mailing address, email address, telephone number, online identifier, internet protocol address, Social Security number, driver’s license information, account information, or comparable identifiers. These details may be required for employment administration, communication, compensation, benefits, identity verification, security, and compliance purposes.

Other workforce information may include telephone numbers, signatures, insurance details, educational records, employment history, financial account information, and health insurance information. Such data may be necessary for processing benefits, administering compensation, verifying qualifications, conducting background checks, maintaining employee records, or satisfying applicable legal responsibilities. The Company may also handle information concerning age, date of birth, marital status, citizenship, race, ethnicity, sex, gender, military or veteran status, disability, or medical circumstances when collection or use is legally permitted and relevant to employment administration.

Electronic activity can also generate information when workforce members interact with Company systems. Use of websites, applications, networks, computers, mobile devices, and other technology resources may produce records concerning browsing activity, searches, system usage, interactions, and technical characteristics. This information may assist with cybersecurity, system administration, troubleshooting, fraud detection, internal investigations, and the protection of Company technology.

Location-related information may be collected or determined when necessary for legitimate operational purposes. Depending on the circumstances, this could include approximate location information derived from an internet protocol address or more precise location information associated with Company vehicles, devices, or other resources. Such information may help with security, workforce administration, vehicle management, technology oversight, fraud prevention, and other authorized activities.

Visual information may also be processed in appropriate circumstances. Photographs, video recordings, identification images, security camera footage, and similar materials may be collected to protect workplace facilities, support safety programs, investigate incidents, administer access controls, document business activities, or create approved Company materials. These practices may vary according to the individual’s role, workplace, and applicable operational requirements.

Employment records can contain substantial information about an individual’s professional relationship with the Company. These records may include resumes, job applications, references, qualifications, professional skills, employment history, education, training, certifications, evaluations, performance information, career development records, compensation details, payroll information, benefit information, leave records, organizational assignments, employment status, and other human resources documentation. Records concerning resignation, termination, workplace disputes, investigations, disciplinary matters, or other employment events may also be maintained when appropriate.

Educational information may include schools attended, degrees, professional certifications, training records, and other non-public educational details. This information may be obtained during recruitment, onboarding, background verification, workforce development, or ongoing employment administration. The Company may also collect work authorization, immigration, visa, tax, withholding, emergency contact, vehicle, parking, language, family benefit, absence, and leave-related information when such details are reasonably necessary for managing the workforce.

Some information receives additional protection under California privacy requirements because of its sensitive nature. Examples may include Social Security numbers, government identification numbers, precise location information, certain racial or ethnic information, and particular health-related details. When such information is processed, the Company may use it only for appropriate purposes permitted by applicable law, such as payroll, benefits administration, security, safety, compliance, fraud prevention, technology management, and employment operations.

Workforce information can come from several different sources. Individuals may provide information directly through employment applications, resumes, onboarding forms, human resources procedures, Company systems, email communications, or other interactions. Certain information may be generated automatically through the use of websites, networks, applications, devices, and other technology. Security cameras and access systems may collect information when individuals enter Company facilities. The Company may also receive information from payroll providers, benefits administrators, background screening companies, technology vendors, human resources providers, security organizations, and other service providers. Publicly accessible information may also be obtained from lawful sources when appropriate.

To operate effectively, the Company may disclose limited workforce information to third parties that perform services on its behalf. These organizations may include payroll and timekeeping providers, benefits administrators, technology companies, background screening services, security providers, analytics providers, and other operational partners. Information is generally provided according to the needs of the relevant service and may be limited to what is reasonably necessary for the applicable business purpose.

Personal information may also be disclosed when required or permitted by law. Circumstances may include responding to subpoenas, court orders, government inquiries, regulatory obligations, or lawful requests from authorities. Information may be used to investigate suspected misconduct, address workplace incidents, protect property and legal rights, respond to claims, establish or defend legal positions, or participate in dispute resolution. Workforce information may additionally be transferred in connection with transactions such as mergers, acquisitions, reorganizations, restructurings, assignments, or sales involving relevant business operations.

The Company does not sell workforce personal information and does not use this information for cross-context behavioral advertising. Instead, workforce data is primarily handled to support employment administration, business management, benefits, payroll, security, compliance, technology, and other legitimate operational needs. Personal information is retained for periods appropriate to the purpose of collection, the nature of the employment relationship, recordkeeping requirements, legal obligations, dispute resolution needs, and legitimate business interests. When information is no longer reasonably necessary and no applicable obligation requires continued retention, reasonable measures may be taken to dispose of it.

Eligible California workforce members may have privacy rights under applicable California law. Depending on the circumstances and legal exceptions, individuals may be able to request information about the categories of personal data collected, the sources used to obtain it, the purposes for processing, and the categories of recipients with whom information is disclosed. Eligible individuals may also request access to specific personal information maintained about them.

California workforce members may have the ability to request correction of inaccurate information or deletion of information collected from them, subject to applicable exceptions. Certain records may need to remain available because of legal, regulatory, security, employment, or business requirements. Privacy requests are therefore reviewed according to the applicable provisions of California law.

Because workforce information is not sold or used for cross-context behavioral advertising, certain opt-out rights associated with those activities generally do not apply to this category of information. Likewise, sensitive workforce information is not used or disclosed in ways intended to trigger a separate right to restrict such processing under the applicable privacy framework.

Individuals who exercise valid privacy rights should not be subjected to unlawful discrimination or retaliation. The Company seeks to provide equal treatment to eligible employees, applicants, contractors, interns, and other workforce members who make privacy requests permitted by law. To protect personal information from unauthorized disclosure, the Company may also take reasonable measures to confirm the identity of anyone submitting a privacy request. Additional information may be requested when necessary to match a request with existing records, and authorized representatives may submit requests where permitted.

Workforce members who have questions about personal information practices, privacy rights, or access to this notice in another format or language may contact the designated customer service channel. The Company encourages individuals to seek clarification whenever they have concerns about how workforce information is collected, used, disclosed, retained, or protected.