Privacy Policy Supplement for California Residents

Notice at Collection and Privacy Policy Supplement for California Residents (“California Privacy Notice”)

Policy effective and last reviewed December 29, 2022

This California Privacy Notice, which supplements our general Privacy Policy, only applies to residents of California who use our Site or Services. If you are not a resident of California, this section does not apply to you.

Note that Noridian has separate notices for employees and applicants who are California residents.

• If you are a California employee or contractor, please refer to our Notice at Collection & Privacy Policy for Employees Residing in California
• If you are a California applicant, please see the Notice at Collection & Privacy Policy for Applicants Residing in California

Noridian provides this California Privacy Notice pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively the “CCPA”), to the extent our practices may be covered under the CCPA. Terms that are capitalized are defined in the California law.

This California Privacy Notice includes information about the Personal Information collected about Consumers in the preceding 12 months and Personal Information that will be collected about Consumers.

Categories of Personal Information Collected

We may collect the following categories of Personal Information from or about you:

• Identifiers
• Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Characteristics of protected classifications under California or federal laws
• Commercial information
• Internet or other similar network activity
• Geolocation data
• Professional or employment-related information

For additional details, please see INFORMATION WE COLLECT, in our general Privacy Policy.

Categories of Sources of Personal Information

Noridian obtains the categories of Personal Information listed above from the following categories of sources:

• Directly from you. We collect Personal Information that you provide to us. For example, we collect Personal Information from forms you complete online or from RFP responses.
• Indirectly from you. For examples, we collect information by observing your actions on our Site or from information your computer or other device transmits when interacting with our Site, among other things.
• From Service Providers, Vendors, and Other Third Parties. We may collect information about you from our partners.

Purposes for Collecting Personal Information

We may collect Personal Information for the business or commercial purposes listed in HOW WE USE INFORMATION in our general Privacy Policy.

Personal Information Disclosed for Business Purposes

Categories of Entities to Whom Noridian Discloses Personal Information for a Business Purpose.

Noridian may disclose your Personal Information for a business purpose, including to our service providers, affiliates, and third parties with whom you direct us to share your Personal Information. For more information, see HOW WE DISCLOSE INFORMATION in our general Privacy Policy.

Categories of Personal Information Disclosed for a Business Purpose.

Noridian has disclosed the following categories of Personal Information for a business purpose:

• Identifiers
• Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Characteristics of protected classifications under California or federal laws
• Commercial information
• Internet or other similar network activity
• Geolocation data
• Professional or employment-related information

“Selling” and “Sharing” Personal Information

As defined by the CCPA, we do not Sell and Share Personal Information. Noridian does not have actual knowledge that it Sells or Shares Personal Information about Consumers under 16 years of age.

Retention Policy

The criteria we may use to determine retention of information: the type of data; whether you have provided your consent and have not withdrawn it; whether the information is subject to a deletion request; and whether retention is necessary to comply with legal obligations.

Your CCPA Consumer Rights

The CCPA provides Consumers with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

• The right to know what Personal Information the business has collected about the Consumer, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom the business discloses Personal Information, and the specific pieces of Personal Information the business has collected about the Consumer;
• The right to delete Personal Information that the business has collected from the Consumer, subject to certain exceptions;
• The right to correct inaccurate Personal Information that a business maintains about a Consumer;
• To the extent the business Sells or Shares Personal Information, the right to opt-out of the sale or sharing of Personal Information by the business;
• If the business uses or discloses sensitive Personal Information for certain reasons, the right to limit the use or disclosure of sensitive Personal Information by the business; and
• The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by the CCPA, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their CCPA rights.

Exercising Your CCPA Rights

To exercise the access, data portability, correction and deletion rights described above, please submit a verifiable Consumer request to us by either:

• Calling us at 1-800-667-8519
• Emailing us at Noridiancompliance@noridian.com

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. The verifiable Consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may only make a verifiable Consumer request for access or data portability twice within a 12-month period.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a verifiable Consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable Consumer request to verify the requestor’s identity or authority to make the request.

CCPA Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.