California Privacy Notice and Privacy Policy

Introduction

This California Privacy Notice and Policy (“Notice”) describes how Yahoo collects, uses, and discloses human resources information in the context of our California operations (collectively, “Personal Information”), pursuant to the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended, and its implementing regulations (“CCPA”). As used in this Notice, “Yahoo,” “Company,” “we,” and “us” means College Top Holdings, Inc. and any entity directly or indirectly controlled by it.

This Notice applies to (i) all of our current and former employees; and (ii) non-employee consultants, contractors, agents, selected service providers, and contingent workers who are residents of California and with whom Yahoo has contracted directly (e.g., 1099 relationship). This Notice also applies to all job applicants and beneficiaries of our benefit plans (as applicable) who are residents of California. This Notice does not form part of any employment contract or contract to provide services. If you provide services to us through or in connection with another company, we are not responsible for that company’s privacy practices. If you provide your information to a third party directly, that company’s privacy policy may apply.

This Notice also does not address our information practices with respect to your interactions with the Company as a consumer or customer. When you interact with us as a consumer or customer, the privacy policy and/or terms of service associated with that product or service apply.

We may also provide you a separate privacy notice on specific occasions when we are collecting, using, or disclosing personal information about you, so that you are aware of how and why we are using such information. We may update this Notice at any time. This Notice does not apply to the information subject to the Health Insurance Portability and Accountability Act of 1996, including information that our health plans collect. Such information is subject to our HIPAA Notice of Privacy Practices, available on The Street.

Categories of Personal Information Collected Under the CCPA

The table below generally identifies the categories of personal information we collect, as well as the categories of third parties to whom we may disclose this information for a business or commercial purpose:

Categories of Personal Information Third Party Disclosures for Business or Commercial Purposes

Identification and contact information and related identifiers, such as full name, alias, date and place of birth, Social Security number, tax ID, citizenship and permanent residence, home and business addresses, telephone numbers, email addresses and unique personal identifiers.
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Professional or employment-related information, including:

  • Recruitment, employment or engagement information, such as application forms and information included in a resume, cover letter or other information provided through the application or engagement process; copies of identification documents, such as driver’s licenses, passports and visas; and background screening results and references.
  • Career information, such as job titles; work history; start and end dates; work locations; employment, service or engagement agreements or any other contract we have signed with you; appraisal and performance information; information about skills and qualifications, experience and preferences, and training; absence and leave records; professional memberships; disciplinary and grievance information; termination details; and other information you may provide in an interview or as part of our hiring application process.
  • Financial information, such as salary, bank account details, payroll records and tax information.
  • Business travel and expense information, such as travel itineraries, expense reports, and corporate credit card usage.
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Internet, electronic network, and device activity and device information and related identifiers, such as information about your use of Company network, information, and communication systems and Company devices, including user IDs, passwords, IP addresses, device IDs, web logs, audit trails of system access, call and text usage, email and text content, destination IP addresses, and location information.
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Audio or visual and security-related information, such as photos and CCTV footage, badge swipe data, as well as other information relating to the security of our premises.
  • service providers
  • advisors and agents
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Location, such as your VPN location
  • service providers
  • advisors and agents
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Legally protected classification information, such as race/color, age, sex, pregnancy, sexual orientation, gender identity and expression, national origin, disability, marital status, citizenship status, veteran status, military service status, medical condition or any other protected category under applicable law.
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Health-related information, such as disability status, health and safety incidents or accidents, sickness records, and health issues requiring adaptations to your working environment or working practices.
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Information about your partner, spouse, beneficiaries and dependents, such as name, address, Social Security number, date of birth, and relationship status.
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Sensitive Personal Information (as defined by the CCPA), such as: (a) Social Security number and other government identifiers (e.g., as part of the application and verification process); (b) racial or ethnic origin or sexual orientation (e.g., on a voluntary basis to support our equal opportunity and diversity and inclusion efforts and reporting obligations, or where otherwise required by law, or union membership); and (c) health (e.g., as necessary to provide reasonable accommodations).
  • service providers
  • advisors and agents
  • benefit(s) providers and administrators
  • corporate affiliates
  • regulators, government entities and law enforcement
  • others as required by law

Sources of personal information. In general, we may collect the categories of Personal Information identified in the table above from the following categories of sources:

  • Directly from the individual
  • Our service providers, representatives, and agents

Retention. We retain the Personal Information we collect only as reasonably necessary for the purposes described below or otherwise disclosed to you at the time of collection. For example, we will retain your information as necessary to comply with our tax, accounting and recordkeeping obligations, as well as an additional period of time as necessary to protect, defend or establish our rights, defend against potential claims, and comply with our legal obligations.

How we use personal information

We use Personal Information for our and our services providers’ business purposes, which include, where applicable:

Workforce recruitment, management and administration, including job advertising, interviewing, and selecting and hiring new staff, training, compensation, and benefits, approving and managing invoices and leave, scheduling, feedback surveys, career development, performance appraisals and recognition, diversity programs, investigating and resolving queries and complaints, providing references, succession planning, planning changes in organization structure, investigating and preventing fraud, ensuring you are paid and taxed correctly and preparing analyses and reports, and providing you with health benefits and wellness programs.

Performance of business operations, including providing, managing, supporting, and improving information and communication systems (such as laptops, phones and corporate email, intranet, collaboration and storage systems) and processes; maintaining accounts and internal directories, crisis management, managing the environmental impacts associated with business operations; protecting and monitoring workforce occupational health and safety; participating in business-related due diligence activities; business succession planning; building algorithms to help with our internal processes; and conducting internal analyses, audits, research, and reports.

Security, health, and safety management, such as to help ensure physical and network and information security (including detecting security incidents, debugging and repairing errors, and preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution); monitoring and controlling access to Company premises and locations; monitoring your use of our information, communications and collaboration systems to ensure compliance with Company policies; preventing data loss and corporate device management; and to ensure the health and safety of our personnel.

Legal compliance, such as complying with applicable legal and regulatory requirements and responding to and cooperating with legal or regulatory requests and investigations.

Charitable and volunteer programs, including processing, tracking, and reporting of your charitable donations, volunteer work, and other such contributions.

Workforce updates, such as communicating with our workforce about updates and other changes to any of the above (e.g., changes to benefits packages or security protocols); informing our workforce about perks, benefits and discounts, including those offered by Company our business partners; and notifying our workforce about updates and other changes to Company products and services.

M&A and other business transactions, for planning, due diligence and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions.

Defending and protecting rights, to protect and defend our rights and interests and those of third parties, including to manage and respond to employee and other legal disputes, to respond to legal claims or disputes, and to otherwise establish, defend or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties.

Sensitive personal information. We do not collect, use or disclose sensitive personal information beyond the purposes authorized by the CCPA (pursuant to Cal Civ. Code § 1798.121 and § 7027(l) of the CCPA regulations). Accordingly, we only use and disclose sensitive personal information as reasonably necessary and proportionate: (i) to perform our services requested by you; (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents; (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct; (iv) to verify or maintain the quality and safety of our services; (v) for compliance with our legal obligations; (vi) to our service providers who perform services on our behalf; and (vii) for purposes other than inferring characteristics about you.

Your rights under California law

You generally have the following rights under the CCPA with respect to your personal information processed by us, subject to certain limitations and exceptions. The right to:

  • Opt out of sales and sharing. The right to opt-out of our sale and sharing of their personal information. We do not sell or share your personal information, including those we know are under the age of 16, thus this right is not available to Company personnel.
  • Limit certain uses and disclosures of sensitive personal information. The right to limit our use or disclosure of sensitive personal information to those uses authorized by the CCPA. As noted above, we do not use or disclose sensitive personal information beyond the purposes authorized by the CCPA, thus this right is not available to Company personnel.
  • Deletion. The right to the deletion of your personal information that we have collected, subject to certain exceptions.
  • Know/access. The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
  • Correction. The right to correct inaccurate personal information that we maintain about you.
  • Non-discrimination. The right not to be subject to discriminatory treatment for exercising your rights under the CCPA.

Submitting CCPA requests. You may exercise your California privacy rights as set forth above by sending an email to privacy-inquiries@yahooinc.com. We will take steps to verify your request by matching the information provided by you with the information we have in our records. You must (1) provide sufficient information to allow us to verify that you are the person about whom we have collected personal information, and (2) describe your request in sufficient detail to allow us to understand, evaluate, and respond to it. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual through one of the above methods; authorized agents will be required to provide proof of their authorization and we may also require that the relevant personnel directly verify their identity and the authority of the authorized agent

How to contact us about this notice

Email us with any questions at california_privacy@yahooinc.com

Last updated: December 2022