Worksite Employee Privacy Policy

Para español haga clic aquí.

Scope of this Policy

G&A Partners and/or any affiliated entities (the “Company,” “our,” or “we”) has developed this Privacy Policy out of respect for the privacy of our worksite employees of our customers and their family members, dependents, and beneficiaries. Your employer (“Worksite Employer”) has entered into an agreement with the Company under which we provide Professional Employer Organization (“PEO”) services to the Worksite Employer. The PEO services provided by the Company typically include payroll processing, workers’ compensation coverage, and other services and/or benefits as may be selected by your Worksite Employer. As a worksite employee, you remain an employee of the Worksite Employer. The Company is not a joint employer with your Worksite Employer, and this Privacy Policy does not and cannot be interpreted to create an employment relationship between you and the Company.

This Policy describes the Personal Information we collect, both online and offline, for what purposes we use and disclose it, how long we retain it, and whether we sell it or share it for cross-context behavioral advertising purposes (we don’t by the way). We will collect some information from you, including information about your family members, dependents, and beneficiaries, for various purposes as detailed in this Privacy Policy during the course of the Company providing services to your Worksite Employer.

This Privacy Policy applies only to information collected, used, or disclosed by the Company in the course of providing services to your employer. It does not apply to other contexts, such as if you visit our public-facing website or engage in transactions with the Company in other capacities (as a client or customer); interactions outside of the Company providing services to your Worksite Employer are subject to the privacy policy on our website.

In the last 12 months, we have collected the following categories of Personal Information from or about worksite employees and their family members, dependents, and beneficiaries. For each category of information, we identify below the categories of third parties, service providers, and contractors to whom we have disclosed the information in the last 12 months. The examples provided for each category are not intended to be an exhaustive list or an indication of all specific pieces of information we collect from or about you in each category, but rather the examples are to provide you a meaningful understanding of the types of information that may be collected within each category.

Of the above categories of Personal Information, the following are categories of Sensitive Personal Information we plan to collect from or about worksite employees:

1. Personal Identifiers (social security number, driver’s license or state identification card number, passport number)
2. Account Information (your Company account log-in, in combination with any required security or access code, password, or credentials allowing access to the account)
3. Protected Classifications (racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, or sexual orientation)
4. Biometric Information (used for the purpose of uniquely identifying you)
5. Medical and Health Information
6. Geolocation Data (IP address and/or GPS location, latitude & longitude)
7. Data of a Known Child (under 16 years of age)

Personal Information does not include:

• Publicly available information from government records.
• Information that a business has a reasonable basis to believe is lawfully made available to the general public by the worksite employee or from widely distributed media.
• Information made available by a person to whom the worksite employee has disclosed the information if the worksite employee has not restricted the information to a specific audience.
• De-identified or aggregated information.

We may collect your Personal Information from the following sources:

• You, the worksite employee, when you voluntarily submit information
• Company systems, networks, software applications, and databases you log into or use in the course of performing your job, including from vendors the Company engages to manage or host such systems, networks, applications or databases
• Government agencies
• Insurance carriers, administrators, and brokers
• Credit and consumer reporting agencies
• Drug testing and physical testing providers and vendors
• HR support vendors, including administrators of benefits, workers’ compensation, unemployment claims, payroll, timekeeping, expense management, and training platforms
• Recruiters
• Staffing agencies
• Personal references and former Worksite Employers
• Other worksite employees, contractors, vendors, suppliers, and customers based on your interactions with them
• Your worksite employer and other worksite employees
• Affiliated entities (subsidiaries, sister companies, or parent company)

We may disclose your Personal Information to the following categories of service providers or contractors:

• Financial institutions
• Government agencies
• Benefits administrators and vendors, including third party administrators, 401K administrators, workers’ compensation and unemployment administrators, and wellness vendors
• Insurance carriers, administrators, and brokers
• Employee tracking and talent management systems
• Payroll processors, timekeeping vendors, and vendors providing services for purposes of our human resources information system (HRIS)
• Consulting and investigation firms, including human resources consultants, safety consultants, and workplace investigators
• Communications providers/vendors (such as those that manage SMS text messaging or mailers)
• Your Worksite Employer
• IT, cybersecurity, and privacy vendors and consultants
• Affiliated entities (subsidiaries, sister companies, or parent company)

We plan to collect and disclose your Personal Information for any of the following business purposes:

1. To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to become a worksite employee, we will use that Personal Information in connection with your employment with your Worksite Employer or your relationship with us.
2. To assist the Company’s customer (the Worksite Employer) to comply with local, state, and federal law and regulations requiring maintenance of certain records (such as immigration compliance records, travel records, personnel files, wage and hour records, payroll records, accident or safety records, and tax records).
3. To comply with local, state, and federal law and regulations that apply to the Company.
4. To manage and process payroll.
5. To validate a worksite employee’s identity for payroll and timekeeping purposes.
6. To maintain commercial insurance policies and coverages, including for workers’ compensation and other liability insurance.
7. To manage workers’ compensation claims.
8. To administer, manage, and maintain group health insurance benefits, 401K and/or retirement plans, and other Company benefits and perks.
9. To provide Human Resources best practices consulting services to the Company’s customer (the Worksite Employer), including the following topics:
   a. Worksite Employer’s management of worksite employees.
   b. Workplace investigations (such as investigations of workplace accidents or injuries, harassment, or other misconduct).
   c. Worksite Employer’s evaluation of job applicants and candidates for employment or promotions.
   d. Information gathered through background checks on job applicants and worksite employees and to verify worksite employment references.
   e. Worksite Employer’s decisions regarding a worksite employee’s employment, including decisions to hire, terminate, promote, demote, transfer, suspend or discipline.
10. To communicate with worksite employees regarding employment-related administrative matters such as upcoming benefits enrollment deadlines, action items, availability of W2s, and other alerts and notifications.
11. To implement, monitor, and manage electronic security measures on Company networks, software applications or systems, including managing and securing any online portals, as well as on worksite employee devices that are used to access Company networks, software applications or systems.
12. To engage in corporate transactions requiring review or disclosure of worksite employee records subject to non-disclosure agreements, such as for evaluating potential mergers and acquisitions of the Company.
13. To assist in communications with a worksite employee’s family or other contacts in case of emergency or other necessary circumstance.
14. To assist the Company’s customer (the Worksite Employer) to promote and foster diversity, equity, and inclusion in the workplace.
15. Infectious disease purposes (pandemic, outbreak, public health emergency, etc.).
16. To evaluate, assess, and manage the Company’s business relationship with vendors, service providers, and contractors that provide services to the Company.
17. To develop and improve our products and services based on your input and workplace activity, including developing, testing, and training our own custom software.
18. To improve user experience on Company computers, networks, software applications or systems, and to debug, identify, and repair errors that impair existing intended functionality of our systems.
19. To detect security incidents involving potentially unauthorized access to and/or disclosure of Personal Information or other confidential information, including proprietary or trade secret information and third-party information that the Company received under conditions of confidentiality or subject to privacy rights.
20. To protect against malicious or illegal activity and prosecute those responsible.
21. To prevent identity theft.
22. To verify and respond to consumer requests under applicable consumer privacy laws.
23. To conduct risk assessments under applicable consumer privacy laws.
24. To conduct cybersecurity audits under applicable consumer privacy laws.

We do NOT and will not sell your Personal Information in exchange for monetary or other valuable consideration. We do not share your Personal Information for cross-context behavioral advertising.

We do NOT and will not use or disclose your Sensitive Personal Information for purposes that give rise to a right to limit the use and disclosure of your Sensitive Personal Information under the CCPA.

We will retain each category of Personal Information for as long as we continue to have a legal or business need to retain it consistent with the purposes for which the information was collected or the employment context. Your Personal Information may be stored or maintained in a variety of different records, files, databases, and information systems some of which are controlled or managed by vendors. As a result, we are unable to predict at the point of collection of your information how long the information will be retained, as it depends on many factors. In deciding how long to retain each category of Personal Information that we collect, we consider many criteria, including, but not limited to: the business purposes for which the Personal Information was collected; relevant federal, state and local recordkeeping laws; applicable statute of limitations for claims to which the information may be relevant; and legal preservation of evidence obligations.

Because the law prescribes minimum periods for retention of certain employee records, some records will be retained for at least the duration of your employment plus a certain number of years. Retention is often measured from occurrence of a triggering event, such as the end of your employment or relationship with us, but we may also measure the retention period from either (1) the date the record or data was collected, created, or last modified, (2) the date of the particular transaction to which the record or data pertains, or (3) another triggering event that is determined to be reasonable and appropriate based on the nature of the data and the legal/business needs for its continued use.

If the business purposes for collecting the Personal Information, and legal reasons for retaining the Personal Information, have both expired, we will purge the information in a secure manner.

We may use other companies and individuals to perform certain functions on our behalf. Examples include administering e-mail and payroll services. Such parties only have access to the Personal Information needed to perform these functions and may not use or store the information for any other purpose.

In the event we sell or transfer a particular portion of our business assets, worksite employee information may be one of the business assets transferred as part of the transaction. If substantially all of our assets are acquired, employee information may be transferred as part of the acquisition.

We may disclose specific Personal and/or Sensitive Personal Information based on a good faith belief that such disclosure is necessary to comply with or conform to the law or that such disclosure is necessary to protect worksite employees or the public.

We do not knowingly sell or share the Personal Information of worksite employees or any of their family members, dependents or beneficiaries under 16 years of age.

The protection of the information that we collect about worksite employees is of the utmost importance to us and we take every reasonable measure to ensure that protection, including:

• We use commercially reasonable tools and techniques to protect against unauthorized access to our systems.
• We restrict access to private information to those who need such access in the course of their duties for us.

If you are a California resident, you have the following rights pursuant to the CCPA:

1. Right to Know. The right to request, up to 2 times in a 12-month period, that we identify to you (1) the categories of Personal Information we have collected, shared or sold about you, (2) the categories of sources from which the Personal Information was collected, (3) the business purpose for which we use this information, and (4) the categories of third parties with whom we disclose or have disclosed your Personal Information;
2. Right to Access. The right to request, up to 2 times in a 12-month period, that we provide you access to or disclose to you the specific pieces of Personal Information we have collected about you;
3. Right to Delete. The right to request, up to 2 times in a 12-month period, that we delete Personal Information that we have collected from you, subject to certain exceptions;
4. Right to Correct. The right to request that we correct inaccurate Personal Information (to the extent such an inaccuracy exists) that we maintain about you, and ensure any corrected data remains corrected;
5. The right to designate an authorized agent to submit one of the above requests on your behalf. See below for how you can designate an authorized agent; and
6. The right to not be retaliated against for exercising any of the above rights.

You Can Submit Any of the Above Types of Requests by Any of the Options Below:

1. Submit an online request on our website here.
2. Call our Access HR toll-free line at 1-888-412-3361.

How We Will Verify That it is Really You Submitting the Request:

If you are a California resident, when you submit a Right to Know, Right to Access, Right to Delete, or Right to Correct request through one of the methods provided above, we will ask you to provide some information in order to verify your identity and respond to your request. Specifically, we will ask you to verify information that can be used to link your identity to particular information in our possession, which depends on the nature of your relationship and interaction with us.

Responding to your Right to Know, Right to Access, Right to Delete, and Right to Correct Requests

Upon receiving a verifiable request from a California resident, we will confirm receipt of the request no later than 10 business days after receiving it. We endeavor to respond to a verifiable request within forty-five (45) calendar days of its receipt. If we require more time (up to an additional 45 calendar days, or 90 calendar days total from the date we receive your request), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

For a request to correct inaccurate Personal Information, we will accept, review, and consider any documentation that you provide, and we may require that you provide documentation to rebut our own documentation that the Personal Information is accurate. You should make a good-faith effort to provide us with all necessarily information at the time that you make the request to correct. We may deny a request to correct if we have a good-faith, reasonable, and documented belief that a request to correct is fraudulent or abusive. If we deny your request to correct, we shall inform you of our decision not to comply and provide an explanation as to why we cannot comply with a request, if applicable.

If You Have an Authorized Agent:

If you are a California resident, you can authorize someone else as an authorized agent who can submit a request on your behalf. To do so, you must either (a) execute a valid, verifiable, and notarized power of attorney, or (b) provide other written, signed authorization that we can then verify. When we receive a request submitted on your behalf by an authorized agent who does not have a power of attorney, that person will be asked to provide written proof that they have your permission to act on your behalf. We will also contact you and ask you for information to verify your own identity directly and not through your authorized agent. We may deny a request from an authorized agent if the agent does not provide your signed permission demonstrating that they have been authorized by you to act on your behalf.

By onboarding as a worksite employee of a Worksite Employer who has contracted with G&A Partners, you consent to all terms and conditions expressed in this Privacy Policy.

As our services evolve and we perceive the need or desirability of using Personal Information collected in other ways, we may from time to time amend this Privacy Policy. We encourage you to check the Employee WorkSight portal frequently to see the current Privacy Policy in effect and any changes that may have been made to them. If we make material changes to this Policy, we will post the revised Policy and the revised effective date on the Employee WorkSight portal. Please check back here periodically or contact us at the address listed at the end of this Policy.

This Policy is in a form that is or will be made accessible to individuals with disabilities upon request.

If you have any questions about this Privacy Policy, please contact us at accesshr@gnapartners.com or call 1-888-412-3361.