California Employee Privacy Notice

Effective on: January 31, 2023

Last Reviewed on: January 31, 2023

Infusion Software, Inc. (“Keap,” “we,” “us,” and “our”) understand the importance of protecting your privacy. This California Employee Privacy Notice ("Notice") is designed to explain how we handle your personal information and supplements the information contained in our Privacy Policy. This Notice sets forth our privacy practices as required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively “CCPA”).

This Notice applies to “Personal Information” (as described in the CCPA) collected by Keap or its agents, of California residents, who are our employees, contractors, or job applicants as well as the emergency contacts provided by such individuals. We refer to all such people as “employees” in this Notice. This Notice does not apply to Personal Data we collect in other contexts, such as Personal Information we collect about the business representatives of our vendors and business customers, or Personal Information collected by a third-party on their own behalf. Where we refer to employment, engagement, personnel, or similar term in this Notice, we do so for convenience only, and this should in no way be interpreted as purporting to confer employment status on non-employees to whom this Notice also applies.

Please note that this Notice does not form part of any contract of employment or engagement, and it does not confer any employment status or contractual right on any individual and does not place any contractual obligation on us.

Categories of Personal Information We Collect. We may collect Personal Information from you in a variety of different situations, including, but not limited to on our website, our work tools, your mobile device (if you have installed any Keap work tools on your device), through job portals, through email, in physical locations, through the mail, and/or over the telephone. We collect the following categories of Personal Information from California employees:

• Identifiers. For example, name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.
• Personal information (California Customer Records Statute). For example, name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, employee health information, bank account number, or any other financial information.
• Protect Classification Characteristics. Age, race, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), and information relating to same-sex benefits, veteran, or military status.
• Commercial information. For example, expense reimbursement information or items purchased with a Keap payment card.
• Biometric Information. For example, we may collect genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans.
• Internet or similar network activity. For example, browsing history, search history and information on interactions with a website, our services, or job advertisements.
• Geolocation data. For example, physical location or movements and information inferred from your IP address when accessing our systems.
• Sensory data. For example, photographs, call recordings and video recordings.
• Professional or employment-related information. For example, current or past job history, including but not limited to position, company name, hire date, start date, salaried or hourly, pay rate, rate per, full time or part time, hours per week, schedule information, contract of employment and amendments to it, sick leave information, career history, training records, appraisals, other performance measures and disciplinary and grievance records.
• Inferences drawn from other personal information. For example, profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Under the CPRA, the following types of Personal Information mentioned above are considered Sensitive Personal Information:

• Social Security, driver’s license, state identification card, or passport number.
• Information about racial or ethnic origin, medical condition, physical or mental disability.
• Biometric information.
• Precise geolocation.
• The contents of your mail, email, and text messages (unless Keap is the intended recipient of that communication).

Monitoring: We reserve the right to monitor the use of our premises, equipment, devices, computers, network, applications, software, and similar assets and resources. We conduct monitoring for the following purposes:

• To detect and prevent unauthorized access or misuse of company resources.
• To investigate and deter potential security incidents, such as hacking or theft.
• To maintain and improve the performance and security of our IT systems and network infrastructure.
• To ensure compliance with company policies and regulations.
• To protect the safety and security of our employees, visitors, and property.

In the event such monitoring occurs, it may result in the collection of Personal Information about you. Our facilities are equipped with surveillance equipment, such as cameras, which may capture your image or information about your movements. This is not meant to suggest that all employees will in fact be monitored, but to alert you that, when using our equipment and resources, you should not have any expectations of privacy with respect to your use of such equipment or resources. Monitoring is done by authorized personnel only, and access to the collected data is restricted to those who have a legitimate need to know.

Personal Information does not include deidentified information or aggregate information. It also does not include Information excluded from the CCPA’s scope, such as Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; or The Gramm-Leach-Bliley Act (GLBA) or California Financial Information.

Categories of Sources of Personal Information. We obtain the categories of Personal Information listed above from the following categories of sources:

• Directly from you. For example, from forms or surveys you complete, information you provide us (for example, when you submit your resume or other information to us), or services we provide you.
• Indirectly from you. For example, from observing your actions on our website or from information your computer or mobile device transmits when interacting with our IT systems, among other things.
• Third parties. For example, staffing and recruiting agencies with whom we contract for services and consumer reporting agencies when we perform employee background screenings.

How We Use Personal Information. We may use or disclose the Personal Information we collect from you or about you for the following business purposes:

• To fulfill or meet the purpose for which you provided the information. For example, if you disclose your name and contact information to apply for a job or become an employee, we will use that Personal Information in connection with your employment or potential employment.
• To contact you and to inform you about benefits or information relating to your employment or potential employment.
• To create, maintain, customize, and secure your information or accounts with us.
• To process your requests or transactions and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To help maintain the safety, security, and integrity of our systems, services, databases and other technology assets and business.
• For research and analytics, including to develop and improve our business processes, systems, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA or subsequently agreed to by you.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.

How We Disclose Personal Information. In the preceding twelve (12) months, Keap has disclosed the following categories of Personal Information to following categories of third parties for a business purpose:

• Identifiers. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Personal information (California Customer Records Statute). IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Protect Classification Characteristics. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Commercial information. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Biometric Information. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Internet or similar network activity. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Geolocation data. IT, Facilities Management, & Security service providers
• Sensory Data. IT, Facilities Management, & Security service providers
• Professional or employment-related information. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers
• Inferences drawn from other personal information. IT, Facilities Management, & Security service providers; Employment, Benefits, Payroll, & Personnel Management service providers; Corporate, Administration, & Management service providers

Sales and Sharing of Personal Information. In the preceding twelve (12) months, we have not sold or shared (as defined in the CCPA) Personal Information.

Retention of Personal Information. We retain your Personal Information for as long as necessary to fulfil the purposes for which it is collected, unless a longer retention period is required or permitted by law, including for the purposes of satisfying any legal, accounting, or reporting requirements, or any other lawful legitimate purposes.

Your Privacy Rights and Choices. Subject to certain limitations, you have the right to (1) request to know more about the categories and specific pieces of Personal Information we collect, use, disclose, share, and sell, and to access your information, (2) request correction of your Personal Information if it is inaccurate, (3) request deletion of your Personal Information, and (4) not be discriminated against for exercising these rights.

Exercising Your Rights. To exercise the rights described above, please submit a verifiable consumer request to us by:

• Email: [email protected]
• Telephone: +1 844-929-0667
• Web form

Only you, or a person authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. If you work for Keap, please use your Keap email address or phone number to contact us so we can easily verify your identity. If you have applied for a job with Keap, please use the same email address you included in your application. If we receive your request from an authorized agent and they do not provide a valid power of attorney, we may ask the authorized agent to provide proof that you gave the agent signed permission to submit the request to exercise rights on your behalf. In the absence of a valid power of attorney, we may also require you to verify your own identity directly with us or confirm to us that you otherwise provided the authorized agent permission to submit the request. If you are an authorized agent duly acting on behalf of another person, we ask you to submit your request by email or telephone.

Changes and Effective Date. We may change this Notice at any time and from time to time. The most recent version of the Notice is reflected by the version date located at the top of this Notice. All updates and amendments are effective immediately upon notice, which we may give by any means, including, but not limited to, by posting a revised version or other notice on our website. We encourage you to review this Notice often to stay informed of changes that may affect you. If you would like to see an earlier version of this Notice, please contact us using one of the methods set forth above and specify the applicable date or time period for the prior Notice version requested.