CONSUMER RIGHTS PRIVACY PROTECTION POLICY

Bowman and Company, LLP policy on collecting, using, storing and protecting 

sensitive employee personal information. 

I. GOVERNING AUTHORITY:

It is the intention of this policy to comply with the California Privacy Rights Act (CPRA) which is the governing authority regulating how a consumers personal information, in the case of the Firm, the information of an applicant and / or employee, is collected, used, stored, and protected. 

II. COLLECTION OF PERSONAL SENSITIVE APPLICANT AND / OR EMPLOYEE INFORMATION:

Throughout the applicant process and duration of employment with Bowman should the applicant be hired with the Firm including the required timeline for storing data for the lawful duration after separation, Bowman will collect the following information on the Bowman job application, applicant resume and new hire employee data sheet for the intended purposes described in this policy. Information collected is as follows: 

A. Job applicant and / or employee contact information including home address, telephone number, email address, and all personal information defined in Civil Code Section 1798.80.

B. Job applicant and / or employee professional or employment related information, career or job history, resume, references, degree and certification status, 

C. Characteristics of protected classifications under California and Federal Law including race, gender, veteran status and status of any disability.

D. New Hire applicant and / or employee unique identification including social security number, birth certificate, passport number, date of birth and driver’s license number as well as a background check verification of employment, a credit check and emergency contact information.

III. HOW, WHY AND FOR HOW LONG IS THE DATA COLLECTED:

The above-mentioned data will be collected throughout the application, new hire, onboarding and employment processes as defined below. 

A. Applicant process. The following data will be collected for the following reasons and for the indicated duration.

1. Job applicant contact information including items listed in section II., A of this document and job applicant professional or employment related information including the items listed in section II., B. of this document. This information is used for the purpose of contacting and corresponding with the job applicant, setting up interviews, evaluating the skill and credentials of an applicant in order to identify if the applicant meets the education requirements and skill criteria of the job description at the required level of proficiency expectations of the role. The resume and information will be used through the recruiting process and kept as follows:

a. Job applicant who does not get hired with Bowman – The information will be kept for one-year from the initial submission and housed in the virtual human resources applicant files located on the company private and protected intranet and will be disposed upon exceeding one-year storage by deleting the file. Any paper copies will be scanned and saved on the company private intranet and the hard copies will be shredded using Firm protocol for shredding confidential records. 

b. Job applicants who do get hired with Bowman – The information will be kept in the employee’s personnel file. Currently we have two duplicate files;  1. Paper file which is housed in a locked fireproof cabinet in the office of the Chief Human Resources Officer which has its own private lock and,  2. Virtual copy housed on Bowman’s private and protected intranet in the Human Resources file accessible only to the Chief Human Resources Officer and Partners of the Firm. The information is stored for the duration of employment and disposed of after seven years of separation with Bowman. By deleting the virtual file and shredding the paper file using Firm protocol for shredding confidential records. 

2. Job applicant protected class characteristics. The Firm collects protected class information identified in section II., C of this document for the following purposes.

a. In order to maintain State and Federal reporting compliance including EE0-1 requirements.

b. To evaluate opportunities, needs and best practices implementing an inclusive employee culture focused and DEI (diversity, equity and inclusion) strategies and best practices. 

· Disposal of this data follows the procedures identified in section III., A., 1., a and section III., A., 1., b in this document. 

B. NEW HIRE ONBOARDING PROCESS 

1. New Hire unique identification information identified in section II., D of this document is collected for the following purposes:

a. Pursuant to the IRCA (Immigrant Reform and Control Act of 1986) to maintain compliance with the Federal I-9 requirement. 

b. To complete the new-hire background check in order to verify and confirm credentials, education and information provided by the new-hire. 

c. To complete the new-hire credit check. The credit check is part of the Firm due diligence and quality process due to the nature of the work done by employees of the Firm as employees have access to and work with confidential client information including bank information, tax records and client unique identification information as defined in section II., B of this document.

d. To create an employee record in the company HRIS and payroll system in order to ensure each employee has their own confidential record and for the purposes of recording their tax filing status and ensuring each employee is paid properly. 

· Disposal of this data follows the procedures identified in section III., A., 1., a, should the new hire get disqualified in the new hire stage and section III., A., 1., b in this document. 

IV. CONSUMER RIGHTS

Consumers are provided with the following legal rights under the California Privacy Rights Act (CPRA). 

A. Right to request the Firm to delete any personal information about the job applicant and / or employee collected by the Firm. 

B. Right to correct inaccurate information.

C. Right to know and access personal information. 

D. The right to know, limit and opt out of any potential of information being sold, shared or disclosed and to whom.

E. Right of no retaliation. The Firm cannot discriminate or retaliate against an employee, job applicant or independent contractor for exercising their rights under the CPRA. 

F. You may exercise your rights under CPRA by any of the following:

a. Request the Firm to conduct an internal investigation into an area of concern. 

b. Submit a CPRA complaint using the following web address: https://cppa.ca.gov/applications/complaint