Employee Privacy and Fair Processing Policy

LAST UPDATED: December 9, 2022

Thrive Market (“Thrive,” “we,” “our” or “us”) is committed to protecting the privacy and security of your personal data.  This Employee Privacy and Fair Processing Notice (“Privacy Notice”) describes how we collect, process, and use personal data about you during and after your working relationship with us, in accordance with applicable law, including the California Privacy Rights Act (“CPRA”).  This Privacy Notice applies to all employees and contractors of Thrive that are located in or reside in California.  This Privacy Notice does not apply to any employees or contractors who are based outside of California, or permanently reside of California.

This Privacy Notice does not form part of any contract or guarantee of employment or other contract to provide services. We reserve the right to update this Privacy Notice at any time without notice.

California Notice at Collection:  We collect the information identified in this Privacy Notice under “What Information About You Do We Collect and Use” for business purposes identified under “How and Why Will We Use Your Personal information.”  To learn more about your privacy rights, please see “Your California Privacy Rights.”

QUICK GUIDE TO CONTENTS

 

1. What information about you do we collect and use?
2. How and why will we use your personal data?
3. With whom do we share your personal data?
4. How long will your personal data be retained?
5. Your California Privacy Rights
6. Questions?

 

It is important that you read this Privacy Notice, together with any other notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information.

• What information about you DO we collect and use?

During your employment or engagement with Thrive, it is routine for us to collect, use, store, and process personal data about you.  As such, “personal information” is information that identifies or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household.  This personal data will include your: 

• Identifiers / Contact Information, such as your name, address, phone number, email address, employee ID number, or other identifiers.
• Professional and Employment-Related Information, such as:
• Organizational data (such as employee type, employee photo, work location, division, department, position level);
• Emergency contact details (person and contact information to be contacted in case of an emergency, if provided by the employee);

 

• Contract data (such as contract type, hire date, end date, non-disclosure agreements, reason for termination);

 

• Compensation information (such as payroll records, bank account information, amount, currency, number of payments per year, details for participation in and administration of an equity plan, National Insurance number and related details, applicable bonus and incentive plans);

 

• Working time data (such as absence, annual leave and payment records, time recording information, other leave records);

 

• Expense administration (such as expense reports, expense evidence entries);

 

• Benefits information (such as enrollment in employee benefits programs, contributions to health insurance, pension contributions, dependent(s) personal information);

 

• Performance data (such as performance evaluation and ratings);

 

• Training information (such as training courses performed);

 

• Disciplinary data;

 

• Background check records (such as criminal records checks for all employees, drug screening for fulfillment center employees); and

 

• Personal Information described in Cal. Civ. Code 1798.80(e) (such as financial or payment card information).

 

• Characteristics of Protected Classifications under Federal or California Law, such as your gender, date of birth, citizenship, marital status, or immigration status.
• Internet or other Electronic Network Activity Information, such as your system ID, access rights, network usage data, and any other information that we may collect or process about your use of Thrive networks, systems, or managed devices.
• Visual Information, such as your photo.
• Education and Work History Information, such as recruitment, internal and external work experience history, education history and accomplishments, references, and background checks.
• Inferences drawn from the above categories of personal information.
• Sensitive Personal Information, such as your government-issued identification numbers (national tax number, social security number, social insurance number, passport number, or national ID card number), account credentials, contents of communications sent or received (on Thrive-issued devices, devices connected to Thrive resources, or via any channel connected to your employment), precise-geolocation of devices used to access Thrive network or system resources, racial or ethnic origin, health or medical information (medical questionnaires, medical reports, sickness or absence records, leave records.  We process sensitive personal information or “special categories” of personal data for limited purposes in accordance with applicable law.

 

We take steps to protect the confidentiality of personal data and information from disclosure to third parties, except on a need-to-know basis and consistent with the terms of this Privacy Notice.  

We obtain this information either directly from you or from third parties, such as employment agencies or background check agencies. 

• How and why will we use your personal Data? 

We need to use your personal data to administer your employment or engagement, as applicable.

The situations in which we will commonly use your personal data include:

• your recruitment, appraisals, promotions, talent management, career planning, and making decisions about your continued employment or engagement, consistent with applicable laws;
• payment of your salary and benefits, payroll, taxation, applicable social security contributions (and other statutory or contractual deductions from salary);
• reimbursement of your expenses and business travel;
• responding to any disciplinary matters or any grievance raised by or involving you; 
• managing your holiday, sick leave and any other absences including family leave;
• providing you with company identification and access to company resources needed to carry out your responsibilities;
• our compliance with immigration requirements;

• supporting training and development of our employees;
• review and management of HR policies and procedures;
• administering IT applications and programs, and providing information technology and information security support;
• recruitment and succession planning;
• maintaining an efficient employee benefits program;
• providing a working environment free from unlawful discrimination and complying with other employment protection legislation;
• implementing appropriate security measures for our business, and ensuring compliance with our rules and processes; for example, we monitor use of our IT systems, including email, internet and intranet, Thrive mobile and landline phones, computers and tablets to gather evidence in respect of any potential wrongdoing; 
• protection of Thrive property and property belonging to third parties;
• maintaining a well-managed and orderly workforce and business;

• compliance with applicable laws and to protect Thrive’s legal rights, including in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes (including disclosure of such information in connection with legal process or litigation); and 

• other purposes required by law, regulation or as deemed necessary by Thrive for the proper management of its employees and its business.

Sensitive Personal Data: Thrive may process and use sensitive personal data, to the extent permitted by law, for the following purposes:

• health information: assessing eligibility for or administering and paying benefits related to ill-health (sick pay, private medical insurance, long term disability schemes and life insurance), monitoring and managing sickness absence and the safety of the workplace, complying with obligations under health and safety and disability discrimination legislation.
• ethnicity and nationality: monitoring the effectiveness of our equal opportunities practices, confirming employee’s right to work.
• criminal records: assessing employee’s suitability for their role, where appropriate to the role.

 

We are guided by the principle that you should not be surprised by any use we make of your personal data. As defined in California law, we do not “sell” or “share” your Personal Data or Sensitive Personal Data we collect for employment purposes. When Thrive processes any of these sensitive categories of personal data, it will comply with the more stringent requirements set forth in applicable law.

• With whom do we share your Personal Data?

We will need to share your personal data with third parties in order to effectuate your employment and our business. This includes sharing information as follows:

• Service Providers: Thrive may contract with third party service providers as part of its normal business operations to carry out certain human resources-related tasks and data hosting services (such as for example employee benefits providers, IT service providers, or HR database services). We will (a) diligently choose such third-party service providers, (b) ensure that such third-party service providers adopt adequate technical and organizational security measures to safeguard the personal data, and (c) use the personal data only as instructed by Thrive and for no other purposes.
• Professional Advisors: We may share your personal data with our professional advisers, such as our accounting and legal advisers, where they require that information in order to provide advice to Thrive.
• Legal Matters; Safety: We may share information with local authorities and other parties in accordance with local regulations, to prevent crime, or as part of internal investigations within Thrive. Where permitted by law, employee personal data also may be shared to respond to internal or external audit and inquiries, compliance investigations, law enforcement requests, requests from administrative or judicial authorities, or where required by applicable laws, court orders, or government regulations. Such parties with which personal data may be shared for such purposes may include: (a) tax authorities, social security services, judicial authorities, employment/labor or other authorities; and (b) independent public accountants, authorized representatives of internal control, regulatory or compliance functions such as auditors, legal and/or corporate security firms.
• Business Transfers: We may also disclose or otherwise process personal data in the context of any sale or transaction involving all or a portion of the business, or as may be required or permitted by law.

• how long will your personal Data be Retained?

Your personal data will only be retained for as long as is reasonably necessary. What this means in practice will vary as between different types of information, and when we consider our approach we take into account any ongoing need for the information, as well as our legal obligations for example in relation to tax, health and safety, employment rights and potential or actual disputes or investigations. Please refer to our Document Retention Policy for more details.

• YouR California Privacy Rights

If you are a California resident, you may take advantage of the following privacy rights: 

• Right to Know:  You have the right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. 
• Right to Delete:  You may request that we delete the personal information that we have collected from or about you. Note that there are some reasons when we will not be able to fully address your request, such as if we need to complete a transaction for you, to detect and protect against fraudulent and illegal activity, to maintain for internal purposes, to comply with a legal obligation or to exercise our rights. 

• Right to Correct:  You have the right to correct inaccurate personal information that we may maintain about you, subject to appropriate verification. 

Right to Non-Discrimination.You have a right not to receive discriminatory treatment from THRIVE for exercising your privacy rights conferred by law. 

Notice about Sales of Personal Information.  We do not “sell” or “share” personal information as these terms are defined under California privacy laws.

How to Submit a Request.To take advantage of your right to know, delete, or correct under California law, or to submit an appeal of a denial of your privacy rights, please contact your HR representative or the Privacy team at datarequests@thrivemarket.com. We may request certain information to verify your identity before we can respond to your privacy rights request.

Authorized Agent Requests.  You may authorize someone to make a privacy rights request on your behalf (an authorized agent). Authorized agents will need to demonstrate that you’ve authorized them to act on your behalf.  Thrive retains the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent’s identity.

Mandatory Data Protection Disclosures.  In the preceding 12 months and as reflected in this Employee Privacy Policy, Thrive has disclosed the categories of personal information that Thrive collects listed under “What Information About You Do We Collect and Use” to service providers and professional advisors as detailed under “With Whom Do We Share Your Personal Data” for business purposes detailed under “How and Why Will We Use Your Personal Data.”

• Questions OR CONCERNS?

If you have any questions about anything in this Privacy Notice or concerns about our use of your personal information, please submit your questions or concerns to help@thrivemarket.com.   

Our general contact details are (1) by email to help@thrivemarket.com.  

Effective Date: December 9, 2022