DuMond Electronic Recruiting and Personnel Information Privacy Policy

1. Purpose

DuMond is committed to protecting the privacy, confidentiality, and security of electronic information collected, received, maintained, or shared during the recruiting, hiring, and employment process.

This policy establishes requirements for handling electronic applicant records and employee personnel files to prevent unauthorized access, disclosure, alteration, loss, or misuse of personal information and to support compliance with applicable New York State and federal laws.

2. Scope

This policy applies to all DuMond Team Members, owners, managers, supervisors, Human Resources personnel, and other authorized individuals who access, receive, transmit, or maintain electronic recruiting or personnel information.

It covers information maintained in or shared through:

• Paylocity and other authorized HR or recruiting      systems.
• Email, messaging platforms, and electronic      document-sharing services.
• Electronic applications, resumes, interview notes,      and hiring records.
• Electronic personnel files, compensation documents,      performance evaluations, and disciplinary records.
• Payroll, benefits, training, and employee      acknowledgment records.
• Scanned documents, electronic signatures, and files      stored on company computers or approved cloud platforms.

3. Confidential Information

Electronic recruiting and personnel information is confidential and must be accessed and used only for authorized business purposes.

Examples include: 

• Applicant contact information, resumes, applications,      interview notes, and references.
• Employment eligibility documentation and      background-check information.
• Employee addresses, telephone numbers, dates of      birth, and Social Security numbers.
• Pay rates, salary information, bonuses, banking      details, and tax records.
• Performance reviews, disciplinary documentation,      training records, and employment decisions.
• Medical documentation, accommodation requests, and      protected leave information.
• Electronic signatures, identification documents,      passwords, and account credentials.

4. Access and Authorization

Access to electronic recruiting and personnel records will be restricted to individuals who require the information to perform their assigned responsibilities or who are otherwise legally authorized to receive it.

Human Resources is responsible for coordinating access to recruiting and personnel records and determining appropriate access permissions in consultation with authorized management or IT support, as necessary.

Supervisors and managers may receive information needed for hiring decisions, employee supervision, compensation administration, performance management, or other legitimate employment purposes. Access to an entire personnel file is not automatically authorized simply because an individual supervises the employee.

Team Members must not:

• Browse, download, or retrieve records without      authorization.
• Access another employee's records out of curiosity or      for personal reasons.
• Share login credentials or use another person's      account to access HR information.
• Copy or forward personnel records to personal email      accounts or unauthorized storage locations.
• Use confidential information for personal benefit or      disclose it to unauthorized individuals.

5. Electronic Sharing and Transmission

Before sending electronic recruiting or personnel information, employees must verify that the recipient is authorized to receive it and that the information is being sent for a legitimate business purpose.

Required practices include:

• Use DuMond-approved systems and accounts when sharing      recruiting and personnel documents.
• Verify email addresses and recipients before sending      attachments or sharing links.
• Use approved secure file-sharing methods for      sensitive documents when available.
• Limit attachments and information to what the      recipient needs.
• Restrict file-sharing permissions and remove access      when it is no longer needed.
• Avoid transmitting Social Security numbers, banking      details, medical records, or other highly sensitive information through      unsecured or unauthorized channels.
• Do not forward applicant or employee information to      personal email accounts or external parties without authorization.

When sharing information with payroll, benefits providers, background-screening providers, legal advisers, or other authorized service providers, limit disclosure to the information reasonably necessary for the approved purpose.

6. Storage and Security

Electronic recruiting and personnel records must be stored in approved company systems or designated secure locations.

Employees must follow applicable security procedures, including:

• Maintaining individual user accounts and strong      passwords.
• Using multifactor authentication when available or      required.
• Locking computers when unattended and protecting      devices from unauthorized use.
• Keeping electronic files organized within authorized      folders or systems.
• Avoiding unapproved downloads, removable storage      devices, and personal cloud accounts.
• Reporting suspected unauthorized access, lost      devices, misdirected emails, or accidental disclosures promptly to Human      Resources or the designated IT contact.

DuMond will use reasonable safeguards to protect covered private information consistent with applicable law, including the New York SHIELD Act.

7. Sensitive and Medical Information

Certain records require additional confidentiality protection.

Medical documentation, disability-related information, accommodation records, and protected leave documentation must be accessible only to authorized individuals and, when required by law, maintained separately from general personnel records.

Social Security numbers, banking information, government identification numbers, and background check records must receive appropriate protection and must not be shared more broadly than necessary.

Supervisors should generally receive only the information needed to administer a work restriction, accommodation, leave arrangement, or other employment matters rather than the employee's underlying medical details.

8. Applicant and Recruiting Records

Applicant information must be used only for legitimate recruiting, screening, hiring, and related employment purposes.

Limit access to resumes, applications, interview notes, references, and screening results to authorized individuals involved in the hiring process.

Do not circulate applicants' information among employees who have no legitimate role in the hiring decision, and do not retain it indefinitely without a business or legal reason.

Hiring personnel must follow applicable laws governing the collection and use of applicant information, including restrictions on requesting or relying on salary history under New York Labor Law § 194-a. DuMond may ask applicants about their compensation expectations instead of their salary history.

9. Employee Personnel Files

Maintain electronic personnel files in authorized systems and use them only for legitimate employment-related purposes.

Only authorized individuals may change personnel records, compensation information, employment status, or other official records, and only through approved processes.

Employees must not independently alter, delete, or remove official records without authorization. Corrections to inaccurate information should be directed to Human Resources.

Employee information may be disclosed to authorized management, payroll, benefits administrators, legal advisers, government agencies, or other parties when necessary and permitted or required by law.

10. Retention and Secure Disposal

DuMond will retain electronic recruiting and personnel records in accordance with applicable federal and New York State recordkeeping requirements, legitimate business needs, and any applicable legal holds.

When records are no longer required, DuMond must securely delete or destroy them in accordance with company procedures. Do not retain electronic files indefinitely without a legitimate reason, and preserve records subject to a legal hold, investigation, or audit as required.

Human Resources coordinates retention and disposal practices with appropriate management and IT support.

11. Reporting Privacy or Security Incidents

Any suspected or confirmed unauthorized access, disclosure, loss, alteration, or transmission of recruiting or personnel information must be reported promptly to Human Resources or the designated IT contact.

Employees must not conceal an incident or independently attempt to investigate it beyond their authorization.

DuMond will assess reported incidents, take appropriate corrective action, and provide any legally required notifications to affected individuals or government agencies.

12. Compliance and Accountability

All individuals with access to electronic recruiting and personnel information are responsible for complying with this policy.

Unauthorized access, use, disclosure, or mishandling of confidential information may result in corrective action, up to and including termination of employment, subject to applicable law.

DuMond prohibits retaliation against individuals who, in good faith, report suspected privacy violations or participate in an investigation.

13. Administration and Review

Human Resources is responsible for administering this policy and reviewing it periodically with appropriate management and IT support.

DuMond may update this policy as business practices, systems, and legal requirements change.

This policy does not create an employment contract or limit any rights protected by applicable law.