backgroundchecks.com Privacy Notice

We respect your ability to make informed choices about the collection and use of information about you. This Privacy Notice tells you about our collection, through this website, of information about you. This Privacy Notice also tells you about the use and disclosure of that information.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include information where the identity has been removed (anonymous data).

What general types of data do we handle?

To help describe the types of personal data we might collect, we have grouped types of personal data together as set out below. The listing here does not mean that we have or will collect this type of information about you.

• Identity Data includes name, aliases, user name, driver's license number, social security number, passport number, and similar identifiers.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Technical Data includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices used to access this website.
• Characteristic Data includes birthdate and sex.
• Transactional Data includes details about payments to us and other details about purchases of our products and services.
• Credit Data includes information about amounts owing and payments to creditors generally.
• Biometric Data includes facial imagery, fingerprints, and physical descriptions (such as eye color and height).
• Profile Data includes interests, preferences, feedback and survey responses.
• Usage Data includes information about the use of our website, products, and services.
• Communications Data includes preferences in receiving marketing from us and our third parties and preferences in receiving other communications from us and our third parties.
• Organization Data includes title and the organization represented.
• Professional Data includes employment history, professional licenses, occupational certifications, and professional references.
• Education Data includes education history.
• Medical Data includes information from drug tests, alcohol tests, and physical capability tests.
• Public-record Data includes information about criminal history, civil litigation history, driving history, listing on offender registries, and listing on government exclusion lists.
• Scoring Data includes inferences drawn from the other categories of data.

We do not collect any of the following:

• Information covered by California Civil Code section 1798.80 except to the extent identified in some category above;
• Geolocation data, except to the extent that it is Technical Data or Profile Data;
• Audio, thermal, olfactory, or similar information;
• Electronic information except to the extent identified in some category above; or
• Visual information except to the extent that it is Biometric Data.

From whom do we collect information?

We collect information from four main sources.

When any of the four sources interact with our website, email servers, fax machines, or telephone systems, we automatically collect Technical and Usage Data. On our website, we collect data about equipment, browsing actions, and patterns by using cookies, server logs and other similar technologies. In our email servers, we collect data about who transmitted the email to us and how. In our fax machines and telephone systems, we collect data including the telephone number transmitting to us.

We collect some data from Visitors, meaning people who:

• use our public website without logging in to an account for a Customer or a Subject, beginning the process to register as a Customer or a Subject, or explicitly identifying as a Customer or a Subject; or
• send us email, call one of our telephone numbers, send us mail, or send us a fax, with content that does not cause us to associate the information with a Customer, Subject, or Furnisher.

Examples of Visitors' activities from which we collect data include subscribing to our publications; requesting marketing materials to be sent to you; entering a competition, promotion, or survey; or giving us feedback.

We collect some data from Customers, meaning people who:

• log in to our website as a Customer;
• begin the process of registering as a Customer on our website; or
• send us email, call one of our telephone numbers, send us mail, or send us a fax, with content that causes us to associate the information with a Customer.

Examples of Customers' activities from which we collect data include registering to receive services, providing credit card information for billing, and identifying users who can order services.

We collect some data from Subjects, meaning people about whom we are performing services. Examples of Subjects' activities from which we collect data include completing forms about themselves, acknowledging disclosures and notices, giving authorization and consent to perform background checks, requesting disclosure of information in our files, and requesting a reinvestigation of that information.

We collect some information from Furnishers, meaning people who:

• have information about our customers (or their representatives);
• have information about the subjects of our services;
• perform processing for our customers; or
• act as an intermediary to one of the above.

Examples of Furnishers' activities from which we collect data include providing marketing leads; providing information establishing the legitimacy of prospective Customers; processing of credit card payments from Customers; verifying the employment or educational history of Subjects; providing summaries of court records or driving history about Subjects; and providing credit reports about Subjects. Most of our services involve us obtaining information from Furnishers, so there are Furnisher activities that are specific to each of our services.

How do we collect data about you through your visiting this website?

When you visit this website, the website automatically collects Technical Data in server logs and Technical Data and Usage Data through cookies.

When you visit this website, the website places one or more text files (each called a "cookie") in the browser directory of your computer's hard drive. A cookie is a small piece of information that a website can store on your web browser and later retrieve. The typical information that cookies store includes the date and time of your visit, your registration information, and your navigational and purchase activity. Our website uses the cookies to identify your computer consistently as you navigate through the website and to control what it displays to you. Most browsers allow you to decline cookies. But if you decline cookies, the website may not operate properly. Our website does not currently recognize "do not track" signals transmitted by web browsers. You are free to delete cookies after your session. Your browser should contain instructions on how to do this.

We use Google Ads. As you navigate to this website from Google Ads, the website may place advertising cookies on your computer. These advertising cookies identify your computer as one that has visited the website. When you visit another site that has an agreement with our advertising network, the other site will use the cookie to display our advertisements to you on the other site. This does not involve collecting personal data about you such as your name, email address, postal address or telephone number. Google makes available a number of ways to control this at https://support.google.com/ads/answer/2662922?hl=en. Additionally, the National Advertising Initiative makes available a tool to opt out of multiple advertising networks at http://optout.networkadvertising.org/.

We use Cake (of www.getCAKE.com) to help us track users who come to us from websites that advertise our services and that have signed up with us directly. We understand that Cake only uses the data so gathered to help us, as our service provider.

We use Google Analytics to help us analyze the use of our own website. You can find more information about what data gets collected and used at this website: https://policies.google.com/technologies/partner-sites.

We use VWO to help us analyze the use of our own website. You can find out more information about what data gets collected and used at this website: https://help.vwo.com/hc/en-us/articles/360021116134-How-VWO-Handles-Personal-Data-of-Your-Website-Users.

Do we collect information from children?

We do not intend to collect personal data from anyone under the age of 18. If you are under 18, you should not enter information on this website and should ask a parent to do so for you.

On whom do we collect information?

We generally collect information on two types of individuals:

First, we collect information on Users, meaning individuals who interact with us. In the table below, the User column indicates whether we collect information about the User as the user with whom we are interacting, rather than as the subject of our services.

Second, we collect information on Applicants, meaning individuals who are the subject of the services we provide. In the table below, the Applicant column indicates whether we collect information about the Applicant as the subject of our service, rather than as the user with whom we are interacting.

When the source of data is the Subject, the User and the Applicant are the same person. In that case, we indicate in the User column the types of data that we collect primarily for the purpose of interacting with the user and we indicate in the Applicant column the types of data that we collect mainly for the purpose of using or providing it in the performance of services for our customer.

What happens if you do not provide your personal data?

Where we need to collect personal data by law or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us but we will inform you if this is the case at the time.

Where we need to collect personal data about you in order to provide a service to our customer and you fail to provide that data when requested, we may not be able to provide that service to our customer. If we are unable to provide that service, then our customer might not grant you whatever benefit you were seeking that caused the customer to obtain services from us. For example, if you fail to provide information that we need for a background report to your prospective employer, your prospective employer might (and typically would) rescind your conditional job offer.

Once we collect personal data, how do we use it?

We use personal data about you when we have one of the following lawful bases:

• Legitimate Interest, which means the interest of our business in conducting and managing our business to enable us to serve you, the organization you represent, or our customer. We consider and balance any potential impact on you (both positive and negative) and your rights before we process personal data about you for our legitimate interests. We do not use personal data about you for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or authorized to by law).
• Contract Requirement, which means a requirement to process personal data about you for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
• Legal Requirement, which means a requirement to process personal data about you for compliance with a legal or regulatory obligation that we are or might be subject to.
• Legal Authority, which means a law that gives us authority to process personal data about you.
• Consent, which means your express, written consent to process personal data about you.

Note that we may process personal data for more than one lawful basis depending on the specific purpose for which we are using personal data about you.

We have set out below, in a table format, a description of the ways we plan to use personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

What happens if there is a change in the purpose?

Certain laws require us to do something if the purpose of our use changes. (For example, it might require us to get your consent or give you notice.) This section applies only to the extent that those laws apply to you and the data.

If we want to use personal data about you for a purpose other than the purpose for which we collected it, we will consider whether that purpose is compatible with the original purpose. If the purpose is compatible, we will use the personal data for that additional purpose. If you want to get an explanation about how the additional purpose is compatible with the original purpose, please contact us by email (at the email address shown in contact details below). If the additional purpose is not compatible but we have a legal basis for using the personal data anyway, we will inform you and we will explain the legal basis which allows us to use the personal data for the additional purpose.

Please note that we may process personal data about you without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How do we control using personal data for marketing purposes?

We provide you with choices regarding certain uses of personal data about you, particularly around marketing and advertising. We have established the following personal data control mechanisms:

We may use your Identity, Contact, Characteristic, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. (We call this marketing). You will receive marketing communications from us if you have requested information from us or purchased services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing.

We will get your express opt-in consent before we share personal data about you with any organization outside the HireRight group of companies for marketing purposes of those other organizations. (This does not apply to service providers who are assisting us with our own marketing, such as Constant Contact, whom we use to send emails on our behalf and manage your opt-out preferences in response to them.)

You can ask us or our service providers to stop sending you marketing messages at any time by logging into the website and checking or unchecking relevant boxes to adjust your marketing preferences or by following the opt-out links on any marketing message sent to you. If you continue to receive marketing messages from us more than a few days after opting out, please contact us at info@backgroundchecks.com. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of the services you purchase from us or that our customers purchase from us about you.

Do we disclose personal data to third parties?

We may share personal data about you with the parties set out below for the purposes set out in the table above about how we plan to use personal data about you.

• Internal processors, meaning other companies in the HireRight Group (which is the group of commonly controlled companies we belong to). For further information on the current members of the HireRight Group, please see https://www.hireright.com/contact-us/offices. We and they may disclose information to our and their employees, directors, and individuals acting as contractors. We assure that these companies, our personnel, and their personnel use the information in accordance with this Privacy Notice.
• External processors, meaning the categories set out below. We employ procedures to require our external processors to respect the security of personal data about you and to treat it in accordance with the law. We do not grant permission for our external processors to use personal data about you for their own purposes and only grant permission for them to process personal data about you for specified purposes and in accordance with our instructions.
• Providers of information technology and system administration services to us.
• Professional advisers (including lawyers, bankers, auditors, brokers, insurers, and marketing agencies) who provide consultancy, banking, legal, insurance, accounting, and marketing services to us.
• Organizations and individuals who obtain information on our behalf from data sources described below.
• Other organizations that provide services to us.
• Payment processors. The privacy policies and practices of these payment processors may be different from ours. We do not control them and assume no responsibility for them. We understand that their conduct for the information we provide them is governed by law, such as the Gramm-Leach-Bliley Act, or by card association rules, such as the rules of the Visa and MasterCard networks and the Payment Card Industry Security Standards Council.
• Marketing affiliates and program sponsors. If you register using a promotional code for one of our marketing affiliates or program sponsors, we may disclose information about you and your purchases (such as the name of your company and the value of your purchases each month) to the marketing affiliate or program sponsor. We do not provide them the details or results of any background checks you purchase from us. The privacy policies and practices of these marketing affiliates or program sponsors may be different from ours. We do not control them and assume no responsibility for them.
• Data Sources, meaning organizations and individuals who provide us data that we use in our services. For example, if you ask us for a credit report, we would provide your company's name and the identity of the subject to the credit bureau from whom we obtain the report. As another example, if one of our customers asked us for a traditional county criminal search about you, we would provide the identity of the subject to a court clerk to obtain criminal history records. The privacy policies and practices of these information sources may be different from ours. We do not control them and assume no responsibility for them. We understand that, in most cases, their conduct for the information we provide them is governed by law, such as the Fair Credit Reporting Act or state open-records laws.
• Regulators, taxing authorities, law enforcement, and courts who require reporting of data in certain circumstances. We may disclose your information in the good faith belief that disclosing it is reasonably necessary to comply with law or legal process, respond to claims, or protect the rights, property or safety of our company, employees, or customers or of the public.
• Organizations to whom we may choose to sell or transfer all or part of our business or assets, or with whom we may merge, consolidate, or amalgamate. If a change happens to our business, then the new owners may use personal data about you in the same way as set out in this privacy notice.
• Customers, meaning organizations who purchase our services (including services like background checks, drug tests, and other consumer reports).

What additional information is relevant for California?

The following is information organized in a way that the California Consumer Privacy Act (the "CCPA") requires us to supply. It only applies to you if you live in California, though we believe it is accurate in the entire United States. This table has the following information in it:

• The first column identifies the type of data, using the definitions above.
• The second column says whether, in the 12 months before we posted this Privacy Notice, we sold any personal data of that type.
• The third column says whether, in the 12 months before we posted this Privacy Notice, we disclosed any personal data of that type for a business purpose. If so, we disclosed it as described in the section above.
• The fourth column identifies whether, in the 12 months before we posted this Privacy Notice, we provided any personal data of that type in a consumer-reporting activity. California Civil Code section 1798.145(d) excludes consumer-reporting activity from the CCPA, so we have not included it in the second or third columns. (In some circumstances, section 1798.145(e), (f), or (m) may also apply as an exclusion.) We include it in the fourth column to prevent confusion about what the table means. Additionally, section 1798.140(v)(2) excludes public-record data from the definition of "personal information." Again, we include that row to prevent confusion about what the table means.

Additionally, California law defines the term "sell" to include any disclosure of "personal information" in exchange for anything of value. Depending on how this law is interpreted, it could include a situation in which we provide your information to another organization so that it can do something with the information for us. Because we receive the benefit of that processing, which is of value to us, any such relationship might be the sale of personal data. Therefore, we hereby notify you that we may sell personal data about you to the extent that the term "sell" is interpreted in that manner.

Do we oversee the privacy of sites to which we link?

This website may provide links to third-party websites. Those third-party websites are outside of our control and are not covered by this Privacy Notice. The privacy policies and practices of these sites may be different from ours. We do not control them and assume no responsibility for them. If you have questions about how another website uses your information, consult that website's privacy statement.

Where might your information be stored, used, or disclosed?

We (and anyone to whom we disclose information) may store, access, disclose, and use information in jurisdictions whose privacy laws are different and less protective than those of your home jurisdiction.

What security measures do we use?

We are committed to protecting the personal data that we receive. While we cannot guarantee the security of that data, we utilize a combination of online and offline security technologies, procedures and organizational measures to help safeguard consumer information against loss, misuse, and unauthorized access, disclosure, alteration and destruction.

We employ Secure Socket Layer (SSL) data encryption when data is transmitted over the Internet to our web site. We have installed layered firewalls and other security technologies to help prevent unauthorized access to our systems. Strong password protection protocols are used on our employees' computers, and employees are regularly trained on our security and privacy policies. The servers used to store consumer information are maintained in a secure physical environment with appropriate physical security measures.

What are your rights?

If you would like to obtain disclosure of or dispute information that we have included, have provided for inclusion, might later include, or might later provide for inclusion in a consumer report, please visit our page on disputes and disclosures at https://www.backgroundchecks.com/disputes.

Under certain circumstances, you have rights under data protection laws in relation to personal data about you. Please see below for specific rights that may apply to your location. If you wish to exercise any of those rights, please contact us as set out in the contact details below.

What rights do you have in California?

California Consumer Privacy Act Notice

The California Consumer Privacy Act provides you certain rights if you are a California resident. But the CCPA also has exceptions. Generally, our business falls within those exceptions, and the CCPA does not apply. But if you want disclosure or correction of information that we hold about you within these parts of our business (e.g., we did a background check about you), you can still request a disclosure or reinvestigation from us. Information how to do o is available at https://www.backgroundchecks.com/disputes.

You have the following rights if you are a California resident:

• You have the right to request us to disclose information that we have collected about you, including the general categories of information, the categories of sources from which we collected the information, the purpose for collecting or selling that information, the categories of third parties with whom we share the information, and the specific pieces of information we have collected.
• If we sell personal information or disclose it for a business purpose, you also have the right to request the categories of third parties to whom we sold your information or disclosed your information for a business purpose (by category of personal information in each case).
• You have the right to request to opt-out of our sale of personal data about you.
• You have the right to be free of retaliation for exercising your rights under the CCPA.

You may make a request under the CCPA by emailing us at info@backgroundchecks.com. You must include the following information: your full name; all physical addresses we may have associated with you; all email addresses we may have associated with you; all telephone numbers we may have associated with you; all employers we may have associated with you. If you are requesting that we disclose, correct, or delete specific personal data information to you (as opposed to disclosing categories of personal data), you must also provide a legible image of a government-issued ID. You may hide the identification number and photo from that ID, but you must not hide the name or address shown on it. We will use the information you supply to identify relevant information in our systems. If you want us to disclose the information to an agent, you must say so in writing and provide us with the mailing address of the agent.

Do Not Sell My Personal Information

To opt out of our sale of information to the extent required under the California Consumer Privacy Act (the "CCPA"), please send an email to info@backgroundchecks.com. In that email, please provide the following information:

• your full name
• all physical addresses we may have associated with you
• all email addresses we may have associated with you
• all telephone numbers we may have associated with you
• all employers we may have associated with you
• a legible image of a government-issued ID showing your address in California (You may hide the identification number and photo from that ID, but you must not hide the name or address shown on it.)

Something that is important for you to know is that the CCPA does not apply to our background screening business. We are a consumer reporting agency that the federal Fair Credit Reporting Act (the "FCRA") governs. The CCPA includes an explicit exemption for consumer-reporting information. However, the FCRA gives you other rights of disclosure and corrections. For more information about that, please go to our disputes and disclosures page at https://www.backgroundchecks.com/disputes.

Personal Information Disclosure: United States or Overseas

This is a disclosure under California law, applicable only to the extent that law applies.

In preparing a consumer report or investigative consumer report, we send information about the subject of the report outside the United States if our customer asks for information from a jurisdiction outside the United States or ordered the report for delivery outside of the United States. For example, if a prospective employee worked outside of the United States, our client might ask for a criminal history report for the country in which the prospective employee worked. When we do this kind of report, we send enough information to identify the subject of the report.

Additionally, we use personnel (including our employees, employees of companies in our family of controlled companies, and employees or our contractors) located outside the United States to perform functions that our own employees also perform, such as public records research; employment, education, and license verification; and customer and applicant service.

How do we change this Privacy Notice?

We may change our Privacy Notice at any time, but will not do so without posting the revised policy on this website. We encourage you to review this Privacy Notice whenever you visit our website to make sure you understand how we use the information we collect.

How can you get more information?

For more information about our privacy practices or policies, please contact our Applicant Care Team at P.O. Box 353, Chapin, South Carolina 29036, or by telephone at (866) 265-6602, or by email to info@backgroundchecks.com.