Last modified: July 1, 2023

CCPA Privacy Notice and Notice at Collection for California Employees and Applicants

Coca-Cola Bottlers’ Sales & Service Company LLC (“Company”) collects and uses your personal information for human resources, employment, benefits administration, health and safety, and business-related purposes and to be in legal compliance/the business purposes listed in the chart below. We are committed to responsibly managing the personal information collected or processed in connection with your employment relationship with us.

We will not sell the personal information, including any sensitive personal information, we collect about our employees or applicants for employment or share it with third parties for cross-context behavioral advertising.

To view our Applicant/Employee privacy policy, visit https://www.ccbss.com/applicant-privacy-policy/.

We may collect the personal information categories listed in the table below. The table also lists, for each category, our expected retention period and collection and use purposes.

Personal Information Category	Retention Period	Business Purpose
Identifiers, such as your full name, contact information, gender, date of birth, signature, Social Security number, driver’s license or state identification numbers, and similar information for your dependents and beneficiaries.	No longer than 10 years following termination of employment, except for information contained in employee benefit records, which shall be retained permanently.	·       Recruit and process employment applications, including verifying eligibility for employment and conducting background and related checks ·       Conduct employee onboarding ·       Maintain and administer payroll and employee benefit plans, including enrollment and claims handling ·       Maintain personnel records and complying with record retention requirements ·       Provide employees with human resources management services and employee data maintenance and support services ·       Communicate with employees and their emergency contacts and plan beneficiaries ·       Comply with applicable state and federal labor, employment, tax benefits, workers’ compensation, disability, equal employment opportunity, workplace safety, and related laws ·       Prevent unauthorized access to or use of the Company property, including information systems, electronic devices, network, and data ·       Ensure employee productivity and adherence to Company policies ·       Conduct internal audits and investigate complaints, grievances, and suspected violations of Firm policy ·       Respond to law enforcement requests and as required by applicable law or court order ·       Exercise or defend the legal rights of the Company and its employees and affiliates, customers, contractors, and agents
California Customer Records employment and personal information, such as your name, signature, Social Security number, physical characteristics or description, photograph, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, current employment, employment history, membership in professional organizations, licenses and certifications, bank account number, Company credit card number, Health Savings Account number, or any other financial, medical or health insurance information	Same as above	Same as above
Protected classification characteristics under California or federal law, such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, gender expression, pregnancy or childbirth and related medical conditions), reproductive health decision-making, military and veteran status.	7 years	·       Comply with federal and state equal employment opportunity laws ·       Design, implement, and promote the Company’s diversity and inclusion programs ·       Perform workforce analytics, data analytics, and benchmarking ·       Conduct internal audits, grievances, and suspected violations of Company policy ·       Exercise or defend the legal rights of the Company and its employees and affiliates
Biometric information, such as fingerprints, keystroke, or other physical patterns, and certain wellness metrics	7 years	·       Fingerprinting for a criminal background check after an initial offer of employment is made. Criminal background checks protect the company, mitigate risk, and avoid potential negligent hiring lawsuits ·       Administer and design health wellness programs ·       Exercise or defend the legal rights of the Company and its employees and affiliates
Sensory and surveillance data, call monitoring and video surveillance.	60 days	·       Comply with applicable state and federal laws, including on workplace health and safety ·       Prevent unauthorized access, use, or loss of the Company property ·       Improve customer service ·       Exercise or defend the legal rights of the Company and its employees and affiliates
Professional or employment-related information, such as employment application information (work history, academic and professional qualifications, educational records, references, and interview notes, background check, drug testing results, work authorization, performance and disciplinary records, salary, bonus, commission, and other similar compensation data, benefit plan enrollment, participation, and claims information, leave of absence information including religious, military and family obligations, health data concerning employee and their family members.	Generally no longer than 10 years, unless contained in an employee benefit plan, in which case such record will be permanently retained.	·       Recruit and process employment applications, including verifying eligibility for employment, background checks, and onboarding ·       Design and administer employee benefit plans and programs, including for leaves of absence. ·       Maintain personnel records and comply with record retention requirements. ·       Communicate with employees and their emergency contacts and plan beneficiaries. ·       Comply with applicable state and federal labor, employment, tax, benefits, workers’ compensation, disability, equal employment opportunity, workplace safety, and related laws. ·       Prevent unauthorized access to or use of the Company’s property, including its information systems, electronic devices, network, and data. ·       Ensure employee productivity and adherence to the Company policies. ·       Conduct internal audits and investigate complaints, grievances, and suspected violations of the Company policy. ·       Evaluate and provide useful feedback about job performance, facilitate better working relationships, and for employee professional development Exercise or defend the legal rights of the Company and its employees and affiliates.
Non-public education information, such as education records, degrees and vocational certifications obtained, report cards, and transcripts.	Employees: 6 years after termination of employment Unsuccessful candidates: 6 years following decision not to hire	·       Evaluate an individual’s appropriateness for hire, or promotion or transfer to a new position at the Company.

Sensitive personal information is a subtype of personal information consisting of specific information categories. While we collect information that falls within the sensitive personal information categories listed in the table below, the CCPA does not treat this information as sensitive because we do not collect or use it to infer characteristics about a person.

SOURCES OF PERSONAL INFORMATION

We collect personal information directly from you. We may also combine personal information collected from other sources with the personal information you provide to us. For example, we may collect information from:

• Recruiters
• Prior employers (e.g., for references)
• Professional references you provide to us
• Educational institutions
• Pre-employment screening services
• Credentialing and licensing organizations
• Publicly available sources such as your social media profile (e.g., LinkedIn, Twitter and Facebook)
• Third parties as necessary for providing you with benefits and ancillary services
• Other sources as directed by you

DISCLOSURE OF PERSONAL INFORMATION

We may share your personal information as necessary for the purposes described in this Privacy Notice. For example, we share your personal information with the following parties:

• Affiliates: We may share your personal information with our affiliates.
• Service Providers: We use service providers to operate, host and facilitate our operations and business (including human resources operations). These include hosting, technology and communication providers; security and fraud prevention consultants; analytics providers; background and reference check screening services; and hiring process and benefits management and administration tools.
• Government authorities and law enforcement: In certain situations, we may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
• Business transfers: Your personal information may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).
• Professional advisors: We may share your personal information with our professional advisors.
• Other: We may also share your personal information with third parties for purposes of fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, us or another party; enforcing any agreements with you; responding to claims; and resolving disputes.

Your Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months (the “right to know”). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  • sales, identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• The specific pieces of personal information we collected about you (also called a data portability request).

Right to Delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions (the “right to delete”). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Provide services to employees (including HR services) as required or requested by the employee.
2. Properly manage the employer-employee relationship.
3. Process employment applications in accordance with our internal process and applicable law.
4. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
5. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
6. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
7. Comply with a legal or other obligations to employees and applicants.
8. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Exercising Your Rights to Know or Delete

To exercise your rights to know or delete described above, please submit a request by either:

• Emailing us at [email protected].

Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information.

You may only submit a request to know twice within a 12-month period. Your request to know or delete must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

You do not need to create an account with us to submit a request to know or delete.

We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact [email protected].

We endeavor to substantively respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to an applicant’s or employee’s request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

Changes to Our Privacy Policy

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on the Website or Hub (as applicable) and update the notice’s effective date. For applicants, your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this notice, the ways in which CCBSS collects and uses your information described here, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Website: https://www.ccbss.com/contact-us/

Email: [email protected]

Postal Address:

One Coca-Cola Plaza, USA Building 6^th floor
            Atlanta, Georgia 30313

Attn: CCBSS Legal

If you need to access this Policy in an alternative format due to having a disability, please contact [email protected].