California Employee Privacy Notice

Last Updated: August 14^th, 2023

Figment Inc. and its affiliated entities (collectively, “Figment,” “we,” “our,” or “us”) are committed to protecting the personal information of its employees. We are providing this California Employee Privacy Notice (this “Notice”) to you pursuant to the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”). This Notice discloses the personal information we collect about you (or that you may voluntarily provide to us) and why.

This Notice applies to current and former employees who are residents of California. This Notice does not form any contract of employment nor modify the employment terms of any candidates hired by Figment.

1. What Personal Information About Employees We Collect

During the course of your employment, we collect and maintain different types of personal information about you relating to your employment relationship with Figment. Depending on the nature of your employment, we may collect the following categories of personal information from you:

• Identifiers: This category may include name, physical address, email address, unique device identifiers (such as IP addresses), phone number, or other similar identifiers.

• Personal Information Categories Listed in the California Customer Records Act (Cal. Civ. Code § 1798.80(e)): This category may include name, signature, Social Security number, physical characteristics, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education or employment information, financial account numbers (such as your banking information and payment card information), medical information, or health insurance information.

• Protected Classification Characteristics under California or United States Federal Law: This category may include age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex and gender information, veteran or military status, or genetic information.

• Online Network Information: This category may include browsing history, search history, email and instant messaging activity, and information regarding an employee’s interaction with an internet website, application, or advertisement.

• Geolocation Data: This category may include physical location or movements.

• Professional or Employment-related Information: This category may include current or past job history, performance evaluations, income and wage information, job title, emergency contacts, dependents’ personal information, beneficiaries’ personal information, personal references, timesheets, and references related to your previous employment.

2. How We Collect Your Information

We collect information that you give us directly when you complete your employment paperwork during the onboarding process, enroll in employee benefits, or when you otherwise interact with us and provide personal information in the context of your employment.

We may collect information about you from third parties (such as prior employers and professional references), our service providers to whom you provide your personal information, such as recruiters and employee benefits providers, and from your medical providers, such as when you authorize medical providers to send us information about you.

3. The Purposes for Which We Use Your Personal Information

We do not sell your personal information or share your personal information for cross-context behavioral advertising as those terms are defined by applicable law. We will use your personal information for the following purposes:

• Job Applications: We use your personal information to track and process job applications you submit to us, to make employment decisions, including regarding salary, to perform background checks, and to establish and manage your employment relationship with Figment.

• Onboard New Employees: We use your personal information to establish and manage your employment relationship with Figment, to perform background checks, to verify your eligibility to work in the United States pursuant to federal law, to set up payroll and benefits, and to process your benefit enrollments and elections.

• Manage Workforce: We use your personal information to maintain personnel records and record retention requirements, to administer payroll and benefits, to perform background checks, to conduct performance evaluations, to evaluate promotions, to review employment decisions, for tax reporting and filings, to manage disciplinary matters, grievances and terminations, to maintain an internal employee directory, to accommodate a disability or illness, and to process information as disclosed at the time we collect the information or as otherwise set forth in this Notice or in other documents made available to you.

• Business Operations and Programs: We use your personal information to manage our business, which includes managing recruiting, human resource administration, product and service development, tax reporting and filings, allocating company assets and human resources, strategic planning, maintaining records relating to business activities, and operating and managing IT and communications systems and facilities. We also may use your personal information for Figment programs or employee incentives.

• Monitoring and Compliance: We use your personal information to maintain internal recordkeeping and oversight of Figment personnel and their work hours, to intake ethics and compliance complaints, to manage pending complaints and cases, and to comply and monitor compliance with internal policies and applicable state and federal labor, employment and wage and hour laws (such as laws related to benefits, workers’ compensation, disability, equal opportunity, and workplace safety), and to comply and monitor compliance with all other applicable state, federal, or international laws or regulations.

• Communications, Facilities and Emergencies: We use your personal information to facilitate communication with you, to ensure business continuity and crisis management, to protect the health and safety of personnel and others (including the monitoring of your health and possible symptoms related to public health emergencies), and to safeguard and maintain our property.

4. Disclosure of Your Personal Information

We may disclose the information we have collected about you, including personal information, as disclosed at the time you provide your information, as described herein and in the following circumstances:

• Service Providers: We may disclose your personal information to service providers, such as recruiters, job application trackers, pre-employment screening services, third-party benefits administrators, payroll processors, background check providers and others.

• When You Agree to Receive Information From Third Parties: You may be presented with opportunities to receive offers or information directly from third parties. If you agree to have us disclose your personal information, we will disclose your personal information to such third parties. Please be advised that the third party’s own privacy policy may apply to its use of your personal information. If you decide that you no longer want to receive communications from a third party, you agree to contact that third party directly.

• Administrative and Legal Reasons: We may transfer and disclose your information, including personal information, to third parties: (i) to respond to subpoenas or other legal process or if in our opinion such disclosure is required by law; (ii) at the request of governmental authorities conducting an investigation; or (iii) to protect the personal safety, rights, property or security of any individual.

• Business Transfer: We may disclose personal information to our subsidiaries and affiliates for internal reasons. We also reserve the right to disclose and transfer all information including, without limitation, your personal information, in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of Figment’s stock and/or assets or other corporate change, including, without limitation, during the course of any due diligence process.

• Professional Financial and Legal Advisors: We may need to disclose personal information to our professional advisors, which includes lawyers, auditors, bankers, or other professional consultants for business purposes.

5. Data Retention

We retain your personal data to fulfill the purposes for which it is collected, as described herein, or as required by applicable laws and regulations. When determining the retention period, we take into account various criteria, such as the nature and length of your employment relationship with us, the impact on our ability to provide employment services if we delete some personal information from or about you, and mandatory retention periods provided by law and the statute of limitations.

6. Updates

This Notice may be changed to reflect changes in our business, legal, or regulatory obligations, so please check this Notice periodically for changes. To the extent we intend to collect additional categories of your personal information, or use your personal information that has already been collected for additional purposes, we will update this Notice. Any changes to this Notice will be effective as of the “Last Updated” date at the top of this Notice.

7. Contact Us

For more information regarding our privacy practices, please visit our Privacy Policy here. If you have any questions concerning this Privacy Notice or our handling of personal information more generally, please contact us by email at legal@figment.io or by mail at: 545 King Street West, Toronto, Ontario, M5V1M1 Canada.