Applicant Privacy Notice

Diamond Generating Corporation and its subsidiaries and affiliated companies (“Company”) takes your privacy seriously. We want you to know how we collect, use, and disclose, your personal information.

EEO Statement

Company is an equal employment opportunity (EEO) employer. For more information about Company’s EEO policy, click here. www.dgc-us.com/eeo-policy

Assistance For The Disabled

Alternative formats of this Privacy Policy are available to individuals with a disability. Please contact hr@dgc‐us.com for assistance.

California Notice at Collection for California Residents

Company collects personal information identified in Section 1 for the purposes identified in Section 3 and retains it for the period described in Section 5. We do not sell your personal information or disclose it for cross‐context behavioral advertising (“sharing”). We also do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

This Privacy Policy explains:

The categories of personal information we collect about you
The categories of sources from which we collect your personal information
The purposes for which we use your personal information
How we may disclose your personal information
How long we keep your personal information
Additional information for applicants who are California residents
Statute on Lie Detector usage for Massachusetts applicants
Changes to this Privacy Policy

Scope:

This Privacy Policy applies to the personal information of individuals in their role as job applicants to Company (“Applicants”).

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Applicant.

1) THE CATEGORIES OF PERSONAL INFORMATION WE COLLECT ABOUT YOU

We may collect the following categories of personal information. Not all categories may be collected about every Applicant.

- Identifiers, for example: real name, nickname, telephone number, postal address, e‐mail address, and signature.
- Professional or Employment‐Related Information, for example: educational institutions attended, degrees and certifications, licenses, work experience and previous employers, and professional memberships and affiliations.
- Non‐public educational information, for example: academic transcripts.
- Commercial Information, for example: travel expense records for an interview
- Internet or Other Electronic Activity Information, for example: interactions with Company’s Internet web site, job application, or job advertisement, and publicly available social media activity.
- Sensory or Surveillance Data, for example: voice‐mails, and footage from video surveillance cameras.
- Physical description, for example: photograph for a security badge or if submitted as part of application materials.
- Other details, for example, hobbies and leisure activities or membership in voluntary/charitable/public organizations, for example, as stated on the Applicant’s resume.
- Inferences, for example, Company might infer characteristics from a personality assessment completed by the Applicant.
- Characteristics of Protected Classifications Under State or Federal Law for Applicants, collected on a purely voluntary basis, except where collection is required by law, and used only in compliance with applicable laws and regulations, for diversity and inclusion reporting and related purposes.
- Biometric information, for example, a fingerprint to conduct criminal history background checks.
- Geolocation data, for example: through a radio frequency identification (RFID) chip in a security badge to determine an applicant’s physical location.

2) THE CATEGORIES OF SOURCES FROM WHICH WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information from the following categories of sources. Not all categories apply to every Applicant.

- You, for example: in your job application, forms you fill out for us, assessments you complete, surveys you complete, and any information you provide us during the course of your application and interview process.
- Vendors and service providers, for example: recruiters.
- Third parties, for example: job references, affiliated companies, professional employer organizations or staffing agencies.
- Public internet sources, for example: social media, job boards, public profiles, and other public online sources
- Public records, for example: court records, and credentialing and licensing organizations.
- Automated technologies on Company’s electronic resources, for example, to track logins and activity on Company’s careers page.
- Surveillance/recording technologies installed by Company, for example: video surveillance in common areas of Company facilities, voicemail technologies, webcams, and audio/video recording technologies with consent to the extent required by law
- Government or administrative agencies, for example, law enforcement or public health authorities.
- Acquired company, if Company acquired your employer, Company might collect personal information from that employer.

Note: This Privacy Policy does not cover background screening conducted by third‐party background check vendors subject to the federal Fair Credit Reporting Act. Company provides a separate disclosure for such screening.

3) THE PURPOSES FOR WHICH WE USE YOUR PERSONAL INFORMATION

We may use the personal information we collect for one or more of the following purposes:

A. Generally Applicable Purposes

Unless stated otherwise in section 3.B, below, we may use Applicants’ personal information for the following purposes:

Recruiting, including:

- To evaluate Applicants’ qualifications or suitability for employment with Company
- To communicate with Applicants
- To conduct a pre‐employment or criminal history background check
- For identification purposes
- For diversity and inclusion purposes
- To arrange and manage Company‐sponsored events
- To create a talent pool for future job openings
- For recordkeeping purposes
- To demonstrate Applicants’ agreement to, or acceptance of, documents presented to them, e.g., pre‐ employment arbitration agreement, acknowledgment of employment application, offer letter
- To evaluate and improve the recruiting process
- To promote Company as a place to work

Monitoring, Security, and Compliance, including:

- To monitor use of Company facilities and information systems
- To conduct internal audits and investigations
- To protect the safety and security of Company’s facilities
- To report suspected criminal conduct to law enforcement and cooperate in investigations
- To exercise Company’s rights under applicable law and to support any claim, defense, or declaration in a case or before a jurisdictional and/or administrative authority, arbitration, or mediation panel

Conducting Our Business, including:

- For training purposes or quality assurance with respect to Company employees conducting the interviews or otherwise assisting with the recruiting and hiring process
- For travel and event planning
- To engage in crisis management
- To manage travel reimbursements

Miscellaneous Other Purposes:

- To manage and operate information technology and communications systems, risk management and insurance functions, budgeting, financial management and reporting, strategic planning;
- To manage litigation involving Company, and other legal disputes and inquiries and to meet legal and regulatory requirements;
- In connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of Company or any of its subsidiaries or affiliates; and
- To protect the rights, property, or safety of Company, Applicants, customers or others.

B. Purposes Specific To Certain Categories Of Personal Information

We may use the categories of Applicants’ personal information listed in this Section 3.B for the purposes stated below:

Purposes For Using Applicants’ Health Information:

- To the extent necessary to comply with Company’s legal obligations, such as to accommodate disabilities
- To protect the health and safety of Company’s employees and facilities, for example, to take the Applicant’s temperature
- For occupational health and safety compliance and record‐keeping
- To conduct pre‐employment medical examinations
- To respond to an Applicant’s medical emergency

Note: This Privacy Policy does not cover health information governed by the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH Act), or California’s Confidentiality of Medical Information Act (CMIA) because these laws have their own disclosure requirements.

Purposes For Using Applicants’ Protected Categories Of Information:

Company collects information about race, age, national origin, disability, sex, and veteran status as necessary to comply with legal obligations, including the reporting requirements of the federal Equal Employment Opportunity Act, The Office of Federal Contracting Compliance Programs (applicable to government contractors), and state laws, and for purposes of diversity analytics.

Company also uses this personal information for purposes including: (a) with respect to disability and/or medical condition, as necessary, to comply with federal and state law related to accommodation; and (b) with respect to age, incidentally to the use of birth date for identity verification.

4) HOW WE MAY DISCLOSE YOUR PERSONAL INFORMATION

Company generally maintains personal information related to Applicants as confidential. However, from time to time, Company may have a legitimate business need to disclose Applicants’ personal information for one of the purposes listed in Section 3, above, to one or more of the categories of external recipients listed below. In that event, Company discloses your personal information only to the minimum extent necessary to achieve the purpose of the disclosure and only if the disclosure is permitted by applicable laws.

- Your direction: We may disclose your personal information to third parties at your direction.
- Service providers and contractors: Company discloses your personal information to service providers and contractors for the purposes above to assist us in our recruiting efforts and in meeting our business needs and legal obligations.
  - Company only discloses your personal information to service providers and contractors subject to written contracts as required by applicable law.
  - Service providers and contractors include recruiters, law firms, travel agencies, and any other entity providing services to Company.
- Affiliated companies: Other companies within the Diamond Generating Corporation family of companies.
- Government or administrative agencies: These may include, for example the
  - Equal Employment Opportunity Commission as required for reporting.
  - State equal employment agencies as required to respond to employment claims and charges.
  - Law enforcement in the event of criminal investigations.
- Required Disclosures: We may be required to disclose personal information in a court proceeding, in response to a court order, subpoena, civil discovery request, other legal process, or as otherwise required by law.
- Legal Compliance and Protections: We may disclose personal information when we believe disclosure is necessary to comply with the law or to protect the rights, property, or safety of Company, our users, or others.

5) HOW LONG WE KEEP YOUR PERSONAL INFORMATION

If Company hires you, the information collected about you during the job application process may become part of your personnel file and may be used to administer the employment relationship and for related reporting and recordkeeping purposes. Company will retain application information for the entire duration of your employment relationship with Company and for as long thereafter as permitted or required by applicable law. Company makes its document retention schedule available to employees for review.

Company will retain information of applicants who are not hired for at least one year and longer if required by applicable law, such as for four years for California residents. These records will be retained for our internal recordkeeping and reporting purposes. During this retention period, we may use your information to consider you for positions in addition to the position(s) for which you initially applied.

6) ADDITIONAL INFORMATION FOR APPLICANTS WHO ARE CALIFORNIA RESIDENTS

This Section 6 applies only to Applicants who are residents of the state of California.

A. Additional Information Regarding Disclosures of Personal Information

The California Privacy Rights Act (CPRA) requires that we provide you with the following information about sales and “sharing” and disclosures of your personal information to third parties for “business purposes”, as those terms are defined in the CPRA:

- Service providers: Company may disclose to service providers any of the categories of personal information listed in Section 1, above, for the business purpose of performing services on Company’s behalf and, in particular, for the specific purposes described in Section 3, above.
- Auditors, lawyers, consultants, and accountants engaged by Company: Company may disclose the categories of personal information listed in Section 1, above, to these services providers or contractors for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on the Company’s behalf.
- Affiliated companies: Company may disclose any of the categories of personal information listed in Section 1, above, to other companies within the [insert name of family of companies] family of companies for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short‐term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

No sales or sharing

Company does not sell or “share” (disclose for cross‐context behavioral advertising) your personal information in connection with the HR relationship. In addition, we have no actual knowledge that we sell or share the personal information of individuals of any age in connection with the HR relationship, including the personal information of children under 16.

B. Your California Privacy Rights

Subject to applicable law, Applicants have the following rights:

- Right to Know: You have the right to submit a verifiable request up to twice in a 12‐month period for specific pieces of your personal information obtained from you and for information about Company’s collection, use, and disclosure of your personal information. Please note that the CPRA’s right to obtain “specific pieces” does not grant a right to the whole of any document that contains personal information, but only to discrete items of personal information. Moreover, Applicants have a right to know categories of sources of personal information and categories of external recipients to which personal information is disclosed, but not the individual sources or recipients.

- Right to Delete: You have the right to submit a verifiable request for the deletion of personal information that you have provided to Company.

- Right to Correct: You have the right to submit a verifiable request for the correction of inaccurate personal information maintained by Company, taking into account the nature of the personal information and the purposes of processing the personal information.

Right to Opt Out of Sale and Sharing: You have the right to opt out of the sale of your personal information and the disclosure of your personal information for cross‐context advertising. You may also implement a browser setting or extension to communicate your selling and sharing preferences automatically to the websites you visit. We honor your right to opt out of the sale and sharing of your personal information as signaled by a

universal opt out signal or Global Privacy Control (“GPC”). To enable GPC, you can visit the Global Privacy Control page at https://globalprivacycontrol.org. If you download a supported browser or extension and exercise your privacy rights with GPC, we will turn off certain third‐party cookies on our website after our website detects a GPC signal. However, if you visit our website from a different device or from a different browser on the same device, you will need to opt‐out or use an opt‐out preference signal for that browser and/or device.

- Right to Restrict Use and Disclosure of Sensitive Personal Information: You have the right to restrict Company’s use and disclosure of your sensitive personal information to purposes permitted under the CPRA, such as security, quality control, uses required by law, and disclosures to vendors in support of the permitted purposes. This right only applies to sensitive personal information collected or processed by Company for the purpose inferring characteristics about you.

Inferring characteristics: Company does not collect or process sensitive personal information or characteristics of protected classifications for the purpose of inferring characteristics about California residents.

As described below, most employers should be able to take the position, ideally stated in a written policy, that they do not collect or process sensitive personal information or characteristics of protected classifications for the purpose of inferring characteristics. Littler’s template CPRA Internal Data Rights Policy includes a provision on this issue.

“Infer” is defined as “the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.” “Characteristics” is not defined. This leaves ambiguity about what it means to “infer characteristics.” The CPRA’s regulations have not addressed this point, but, almost certainly, the CPRA and its regulations were not drafted with the HR context in mind with respect to inferring characteristics. In addition, it seems unlikely that any employer actions qualify as “inferring characteristics” from sensitive personal information. Many categories of sensitive personal information, e.g., sensitive identifiers, do not lend themselves to inferring characteristics. Moreover, using protected categories of sensitive personal information, such as sexual orientation, to infer characteristics about an individual most likely would violate anti‐discrimination laws.

C. How to Exercise Your Rights

Company will respond to requests to know, delete, and correct in accordance with applicable law if it can verify the identity of the individual submitting the request. You can exercise these rights in the following ways:

- Call (888) 413‐7147
- Email Privacy@dgc‐us.com

D. How We Will Verify Your Request:

If you submit a request through an adequately secure password‐protected account that you created before the date of your request, we will use the authentication mechanisms in the account to verify your identity. Otherwise, we match personal information that you provide us against personal information we maintain in our files. The more risk entailed by the request (e.g., a request for specific pieces of personal information), the more items of personal information we may request to verify you. If we cannot verify your identity to a sufficient level of certainty to respond security to your request, we will let you know promptly and explain why we cannot verify your identity.

E. Authorized Agents

If an authorized agent submits a request on your behalf, the authorized agent must submit with the request a document signed by you that authorizes the authorized agent to submit the request on your behalf. In addition, we may ask you or your authorized agent to follow the applicable process described above for verifying your identity. You can obtain our “Authorized Agent Designation” form by contacting us at Privacy@dgc‐us.com.

In the alternative, you can provide a power of attorney compliant with the California Probate Code.

F. Company’s Non‐Discrimination and Non‐Retaliation Policy

Company will not unlawfully discriminate or retaliate against you for exercising your privacy rights under the California Privacy Rights Act.

7) STATUTE ON LIE DETECTOR USAGE FOR MASSACHUSETTS APPLICANTS

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

8) CHANGES TO THIS PRIVACY POLICY

If we change this Privacy Policy, we will post those changes on this page and update the Privacy Policy modification date above.

For More Information

For questions or concerns about the Company’s privacy policies and practices, please contact us at Privacy@dgc‐us.com.