CCPA/CPRA Employee Privacy Policy and Notice

(Applicable to California Residents)

Effective Date: January 1, 2023

I. Introduction and Defined Terms

Jelly Belly Candy Company ("JBCC") must collect Personal Information from you in order to conduct business and comply with federal, state, and local government regulations governing such matters as employment, tax, insurance, etc.

"Employee" - This policy applies to the Personal Information of California residents who are (i) employees, (ii) job applicants, (iii) contractors, interns, and other individuals who perform work for JBCC (collectively "Non-Employees"), and (iv) employees' and Non-Employees' dependents, emergency contacts, and beneficiaries (all collectively "HR Individuals"). For convenience, all HR Individuals are referred to as "Employees" herein.

"Personal Information" is any information that we can reasonably use to identify you, including information that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household. If you reside in California, it includes all personal information as defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the "CCPA"). Personal Information includes "Sensitive Personal Information."

"Sensitive Personal Information" includes special categories of Personal Information, including but not limited to, a social security number, a driver's license number, a passport number, an account login, a password, a precise geolocation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, and data concerning a natural person's sex life or sexual orientation.

The nature of the information collected varies somewhat for each Employee, depending on the applicable role and employment responsibilities, your citizenship, the location of the facility where you work, and other factors. We collect Personal Information from you solely for business purposes, including those related directly to your application for employment and/or employment with JBCC, and those required by governmental agencies.

Data collected may include, without limitation, such things as:

  • Name
  • User ID(s)
  • Phone number(s)
  • Email address (es)
  • Mailing address(es)
  • Banking and other financial data
  • Government identification numbers, e.g., Social Security number, driver's license number
  • Date of birth
  • Gender, race, and ethnicity
  • Health and disability data
  • Family-related data, e.g., marital status, family member information
  • Personal and health-related data for you and your family
  • Trade union data
  • Payroll and benefits information
  • Emergency contacts
  • Work permit status
  • Military status
  • Nationality
  • Residency
  • Passport information
  • Retirement account information
  • Date of hire, date(s) of promotion(s), work history, technical skills, educational background, professional certifications and registrations, language capabilities, and training records
  • Physical limitations and special needs in order to provide reasonable accommodations

Generally, we collect Personal Information directly from you in circumstances where you provide such data. However, in some instances, the Personal Information we collect has been provided by other means including your interactions with us and by third parties (e.g., employer organizations, insurance companies, your spouse or dependent, public records, automated technologies, government agencies and acquired companies).

II. Use of the Personal Information We Collect

The primary purposes for collection, storage and/or use of your Personal Information include, but are not limited to:

  • Human Resources Management. We collect, store, analyze, and share (internally) Personal Information in order to attract, retain and motivate a highly qualified workforce. This includes recruiting, compensation planning, succession planning, reorganization needs, performance assessment, training, employee benefit administration, compliance with applicable legal requirements, and communication with Employees and/or their representatives.
  • Business Processes and Management. Personal Information is used to run our business operations including, for example, scheduling work assignments, managing company assets, and populating employee directories. Information may also be used to comply with government regulations.
  • Communication and Identification. We use your Personal Information to identify you and to communicate with you.

III. Disclosure of Personal Information

JBCC acts to protect your Personal Information and ensure that unauthorized individuals do not have access to your Information by using security measures to protect Personal Information. We will not knowingly disclose, sell or otherwise distribute your Personal Information to any third party without your knowledge and, where appropriate, your express written permission, except under the following circumstances.

  • Legal requests and investigations. We may disclose your Personal Information when such disclosure is reasonably necessary (i) to prevent fraud; (ii) to comply with any applicable statute, law, rule or regulation; or (iii) to comply with a court order.
  • Third-party vendors and service providers. We may, from time to time, outsource services, functions, or operations of our business to third -party service providers, such as payroll and benefits service providers. When engaging in such outsourcing, it may be necessary for us to disclose your Personal Information to those service providers. In some cases, the service providers may collect Personal Information directly from you on our behalf. We will work with any such providers to restrict how the providers may access, use and disclose your Personal Information and Sensitive Personal Information. When using a third party provider to whom we must furnish your Personal Information, we will select reliable third parties and we will require them to enter into written agreements with JBCC which will (i) specify the rights and obligations of each party; (ii) provide that the third party has adequate security measures in place to protect the Personal Information; and (iii) the provider will only process Personal Information on the specific written instructions of JBCC.
  • Business Transfers: During the term of your employment, we may buy other companies, create new subsidiaries or business units or sell part or all of JBCC or its assets. Although we do not anticipate transferring any of your Personal Information to such entities, in the event that we do, your Personal Information will remain subject to the protections outlined in the then current Privacy Policy.
  • Protection of Company and Other. We may release Personal Information when we believe release is necessary to comply with the law; enforce or apply our policies and other agreements; or protect the rights, property, or safety of JBCC, our employees, or others. This disclosure will never, however, include selling, renting, sharing or otherwise disclosing your Personal Information for commercial purposes in violation of the commitments set forth in this Privacy Policy.

IV. Your Rights Under the CCPA/CPRA

As of the date that this policy was published, eligible California Employees have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the "CCPA"):

Right to Know

You have a right to submit a verifiable request for copies of your Personal Information that JBCC has held over the past 12 months, free of charge, including:

  • The categories of personal information that we have collected.
  • The categories of sources from which we collected personal information.
  • The business or commercial purpose for collecting, selling, or sharing personal information.
  • The categories of third parties to whom we disclose personal information.
  • The specific pieces of personal information we have collection.

Right to deletion

At your request, we will delete your Personal Information unless we need to keep such information for legal purposes and/or to provide services or further the relationship with us that you have requested (including, but not limited to your role as an employee or other employment or business relationship).

Right to opt out of sale or sharing

Subject to certain business and legal exceptions (see e.g., Section III, above), you may request that we stop selling or sharing your Personal Information for cross-context behavioral advertising. JBCC does not sell nor disclose Employees' Personal Information for cross-context behavioral advertising.

Right to correct

We will use commercially reasonable efforts to comply with your request to correct any inaccurate Personal Information.

Right to limit the use and disclosure of Sensitive Personal Information

Subject to certain business and legal exceptions (see e.g., Section III, above), you may request that we limit the use and disclosure of Sensitive Personal Information.

Right to data portability

At your request, and subject to certain exceptions, we will provide you free of charge with any of your Personal Information that we hold, and will provide it in a structured, commonly used and machine-readable format.

Right to nondiscrimination

You are entitled to exercise the rights described above free from discriminatory treatment prohibited by the CCPA.

V. Document Retention

We keep your Personal Information for as long as needed to fulfill the particular purpose for which it was collected and in accordance with our record retention schedule. We may also retain your records if legally required or to fulfill a legitimate business interest.

VI. Updates to JBCC's CCPA/CPRA Employee Privacy Policy

JBCC reserves the right to modify this CCPA/CPRA Employee Privacy Policy at any time. Your provision of Personal Information to use after any change in this policy will constitute your acceptance of such change.

VII. How to Exercise Your Rights

JBCC will respond to permitted requests in accordance with applicable laws if it can verify the identity of the individual submitting the request. You can exercise your rights under the CCPA by contacting JBCC at 707-399-2299 (fax) or call us 707-428-2800.