Sierra Central Credit Union (“SCCU”) provides this Privacy Notice which applies to California resident employees, employee applicants, owners, directors, officers, or contractors of SCCU, including as applicable, those individuals’ emergency contacts and beneficiaries. This Privacy Notice sets forth our privacy practices as required by the CCPA. Please note, there may be additional or different privacy notices or disclosures that govern our use of your personal information beyond the CCPA. Where collection, use and disclosure of personal information is subject to the CCPA, this Privacy Notice shall prevail. For collection, use and disclosure of personal information beyond the CCPA, those separate and relevant privacy notices and disclosures shall prevail. Any terms defined in the CCPA have the same meaning when used in this notice.

Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), we provide the following details regarding the categories of Personal Information we have collected within the preceding twelve (12) months:

Information We Collect

We collected the following categories of Personal Information:

• Identifiers, such as name and government-issued identifier (e.g., Social Security number);

• Personal information, as defined in the California safeguards law, including without limitation, name, signature, SSN, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information;

• Characteristics of protected classifications under California or federal law, including without limitation, age, gender, medical conditions, marital status, sex (including pregnancy, childbirth, breastfeeding, and related medical conditions), race, color, religion or creed, ancestry, national origin, disability, genetic information, AIDS/HIV status, sexual orientation, gender identity and expression, citizenship, primary language, immigration status, military/veteran status, political affiliation/activities, domestic violence victim status, and request for leave;

• Commercial information, such as transaction information and purchase history;

• Biometric information, such as face scans, fingerprints and voiceprints;

• Internet or network activity information, such as browsing history and interactions with our websites;

• Geolocation data, such as device location;

• Audio, electronic, visual and similar information, such as call and video recordings;

• Professional or employment-related information, such as work history and prior employer;

• Education information subject to the federal Family Educational Rights and Privacy Act, such as student records and directory information; and

• Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.

We retain this information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Sensitive Personal information

Below are categories of sensitive personal information we have collected from consumers within the last twelve (12) months:

• Government Identifiers, such as social security, driver’s license, state identification card, or passport number

• Complete account access credentials, such as user names, account numbers, or card number combined with required access/security code or password.

• Racial or ethnic origin

• Religious or philosophical beliefs

• Mail, email, or text messages contents not directed to us

• Unique identifying biometric information

• Health Information

• Sex life, or sexual orientation information

Sources of Personal Information

We collected this Personal Information directly from employees, employee applicants, owners, directors, officers, contractors, former employers (or other sources that provide employment verification), employment agencies, screening services (or other background check providers), credit reference agencies, public record sources (Federal, State, or Local Government Sources), Information from our affiliates, and/or website/mobile app activity/social media.

We also collected Personal Information about our employees’ and other individuals’ emergency contacts and beneficiaries from such employees or other individuals.

Use of Personal Information

We may use this Personal Information to operate, manage, and maintain our business, for our employment purposes, and to otherwise accomplish our business purposes and objectives.

Our business purposes and objectives include, for example:

• developing and improving our services and programs for our employees;

• conducting research, analytics, and data analysis;

• maintaining our facilities and infrastructure,

• provide facility access need to complete job duties;

• undertaking quality and safety assurance measures;

• conducting risk and security controls and monitoring;

• detecting and preventing fraud;

• performing identity verification;

• performing accounting, audit, and other internal functions, such as internal investigations;

• complying with law, legal process,

• to ensure each employee is paid earned income, and that our tax and other statutory dues are paid,

• verify each employee’s qualification and suitability for a position,

• evaluate and manage job performance, fulfill our commitment to workforce diversity,

• provide support and to respond to inquiries, including investigating and addressing concerns and monitor and improve responses, and internal policies;

• maintaining records and exercising and defending legal claims.

Specifically, we may use this information in some of the following ways, though this is not an all-inclusive list:

• To Recruit Employees, including to conduct employment related background screening and checks.
• To Administer Benefits, such as medical, dental, optical, commuter, and retirement benefits, including recording and processing eligibility of dependents, absence and leave monitoring, insurance and accident management and provision of online total reward information and statements.
• To Pay and Reimburse for Expenses, including salary administration, payroll management, payment of expenses, to administer other compensation related payments, including assigning amounts of bonus payments to individuals, administration of departmental bonus pools and administration of stock option payments.
• To Conduct Performance-Related Reviews, including performance appraisals, career planning, skills monitoring, job moves, promotions and staff re- structuring.
• To Monitor Work-Related Licenses and Credentials, including provisioning software licenses for use in the course of an employee’s work-related responsibilities, ensuring compliance, training, examination and other requirements are met with applicable regulatory bodies.
• To Provide Our Employees with Human Resources Management Services, including providing employee data maintenance and support services, administration of separation of employment, approvals and authorization procedures, administration and handling of employee claims, and travel administration.

• To Maintain Your Contact Information, including altering your details across relevant entities within SCCU (for example personal, other employment and transferring roles).

• To Assist You in Case of Emergency, including maintenance of contact details for you, and your dependents in case of personal or business emergency.

• To Monitor Eligibility to Work in the U.S., which means monitoring and ensuring compliance of employees’ ability to work in the U.S.

• To Conduct Healthcare-Related Services, including conducting pre-employment and employment-related medical screenings for return-to-work processes and medical case management needs; determining medical suitability for particular tasks; identifying health needs of employees to plan and provide appropriate services, including operation of sickness policies and procedures; and providing guidance on fitness for travel.

• To Facilitate A Better Working Environment, which includes conducting staff surveys, providing senior management information about other employees, and conducting training.

• To Ensure a Safe and Efficient Working Environment, which includes SCCU actions relating to disciplinary actions, and code of conduct processes and investigations.

• To Maintain Security on Company Websites, which includes hosting and maintenance of computer systems and infrastructure; management of SCCU’s software and hardware computer assets; systems testing, such as development of new systems and end-user testing of computer systems; training; and monitoring email and Internet access.

• To Comply with Applicable Law or Regulatory Requirements, such as legal (state and federal) and internal company reporting obligations, including headcount, management information, demographic and Health, Safety, Security and Environmental reporting.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice.

Sharing or Selling Personal Information

1. As defined in the CCPA, “sold” or “sale” means the disclosure of Personal Information for monetary or other valuable consideration but does not include, for example, the transfer of Personal Information as an asset that is part of a merger, bankruptcy, or other disposition of all or any portion of our business. “Share” or “sharing” means disclosing Personal Information to a third party for cross-context behavioral advertising (targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses), whether or not for monetary or other valuable consideration.

2. We have not “sold” or “shared” your Personal Information.

Consumers Under Age 16. SCCU does not knowingly sell or share Personal Information about consumers under age 16.

Disclosure to Third Parties for Business Purposes

1. We may also disclose the following Personal Information to third parties, such as our service providers and affiliates, for our operational business purposes in the preceding twelve (12) months:

SCCU only uses and discloses your sensitive Personal Information for the limited purposes permitted by the CCPA and its implementing regulations.

Your Rights and Choices

1. The CCPA provides consumers (California residents) with specific rights regarding their personal information. Please note, not all of the rights described here are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity. This section describes your CCPA rights and explains how to exercise those rights.
2. Right to Know. You have the right to know:
   • What categories of personal information we collected about you;
   • What categories of sources from which we collected such personal information;
   • The business or commercial purpose for collecting (if applicable) personal information about you;
   • The categories of third parties to whom we disclose your personal information; and
   • The specific personal information we collected about you.
3. Right to Delete. You can ask us to delete Personal Information we collected from you. However, SCCU has the right to maintain Personal Information, despite a deletion request, when retention of the information is reasonably necessary for the business or necessary in order to comply with a legal obligation. We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers, contractors and other third parties, if any, to take similar action.
4. Right to Correct. You can ask us to correct inaccurate Personal Information that we maintain about you.
5. Right to Opt-Out of Sale or Sharing. We do not sell the personal information of consumers we actually know are less than 16 years old.
6. Right to Limit use or disclosure of Sensitive Personal Information. We only use a consumer’s sensitive personal information for the purposes identified in Section 7027(m) of the California Code of Regulations. Therefore, we are not required to give you notice of the right to limit the use of sensitive personal information or give you the opportunity to request that such information be limited.
7. Right to No Discrimination or Retaliation. You have the right to be free from unlawful discrimination, retaliation, and/or harassment for exercising your rights under the CCPA.

Exercising your CCPA Rights

1. To exercise your rights under the CCPA, please submit a request online at www.sierracentral.com and click on Privacy Notice at the bottom of the web page. You may also complete and forward a request for information by mailing to:

   • Sierra Central Credit Union 1351 Harter Parkway Yuba City, CA 95993

2. To exercise your rights under the CCPA, you must submit a verifiable consumer request. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request to know, delete or correct on behalf of your minor child. You may only submit a request to know twice within a 12-month period.

3. A verifiable employee request must provide sufficient information that allows us to reasonably verify whether you are the person about whom we collected personal information or an authorized representative. We will request, for example, the submission of your first and last name, address, date of birth.

4. If we cannot verify your identity or authority to make the request, we will not be able to fulfill your request. The information provided for verification will only be used for that purpose.

Response Timing and Format

1. We will confirm receipt of the request within ten (10) business days, If you do not receive confirmation within the 10-day timeframe, please call 1-800-222-7228.

2. We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

3. We will deliver our written response by mail or electronically, at your option.

4. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. For a request to know, you may request information collected beyond the 12-month period provided the information was collected on or after January 1, 2022, and providing the information would not be impossible or involve disproportionate effort. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For requests for specific Personal Information, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, and we will send this information to you in a secure manner.

5. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes to Our Privacy Notice

1. We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the website and update the notice’s effective date.

2. Continued use of our website following the posting of changes constitutes acceptance of such changes.

Contact Information

1. You can contact us with your questions, comments, rights requests, and other CCPA- related inquiries:

• Call 1-800-222-7228

• Mail 1351 Harter Parkway, Yuba City, CA 95993. Attn: Human Resources

Effective Date: This Privacy Notice for California consumers is effective January 1, 2023.

Sierra Central Credit Union (“SCCU”) provides this Privacy Notice which applies to California resident employees, employee applicants, owners, directors, officers, or contractors of SCCU, including as applicable, those individuals’ emergency contacts and beneficiaries. This Privacy Notice sets forth our privacy practices as required by the CCPA. Please note, there may be additional or different privacy notices or disclosures that govern our use of your personal information beyond the CCPA. Where collection, use and disclosure of personal information is subject to the CCPA, this Privacy Notice shall prevail. For collection, use and disclosure of personal information beyond the CCPA, those separate and relevant privacy notices and disclosures shall prevail. Any terms defined in the CCPA have the same meaning when used in this notice.

Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), we provide the following details regarding the categories of Personal Information we have collected within the preceding twelve (12) months:

Information We Collect

We collected the following categories of Personal Information:

• Identifiers, such as name and government-issued identifier (e.g., Social Security number);

• Personal information, as defined in the California safeguards law, including without limitation, name, signature, SSN, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information;

• Characteristics of protected classifications under California or federal law, including without limitation, age, gender, medical conditions, marital status, sex (including pregnancy, childbirth, breastfeeding, and related medical conditions), race, color, religion or creed, ancestry, national origin, disability, genetic information, AIDS/HIV status, sexual orientation, gender identity and expression, citizenship, primary language, immigration status, military/veteran status, political affiliation/activities, domestic violence victim status, and request for leave;

• Commercial information, such as transaction information and purchase history;

• Biometric information, such as face scans, fingerprints and voiceprints;

• Internet or network activity information, such as browsing history and interactions with our websites;

• Geolocation data, such as device location;

• Audio, electronic, visual and similar information, such as call and video recordings;

• Professional or employment-related information, such as work history and prior employer;

• Education information subject to the federal Family Educational Rights and Privacy Act, such as student records and directory information; and

• Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.

We retain this information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Sensitive Personal information

Below are categories of sensitive personal information we have collected from consumers within the last twelve (12) months:

• Government Identifiers, such as social security, driver’s license, state identification card, or passport number

• Complete account access credentials, such as user names, account numbers, or card number combined with required access/security code or password.

• Racial or ethnic origin

• Religious or philosophical beliefs

• Mail, email, or text messages contents not directed to us

• Unique identifying biometric information

• Health Information

• Sex life, or sexual orientation information

Sources of Personal Information

We collected this Personal Information directly from employees, employee applicants, owners, directors, officers, contractors, former employers (or other sources that provide employment verification), employment agencies, screening services (or other background check providers), credit reference agencies, public record sources (Federal, State, or Local Government Sources), Information from our affiliates, and/or website/mobile app activity/social media.

We also collected Personal Information about our employees’ and other individuals’ emergency contacts and beneficiaries from such employees or other individuals.

Use of Personal Information

We may use this Personal Information to operate, manage, and maintain our business, for our employment purposes, and to otherwise accomplish our business purposes and objectives.

Our business purposes and objectives include, for example:

• developing and improving our services and programs for our employees;

• conducting research, analytics, and data analysis;

• maintaining our facilities and infrastructure,

• provide facility access need to complete job duties;

• undertaking quality and safety assurance measures;

• conducting risk and security controls and monitoring;

• detecting and preventing fraud;

• performing identity verification;

• performing accounting, audit, and other internal functions, such as internal investigations;

• complying with law, legal process,

• to ensure each employee is paid earned income, and that our tax and other statutory dues are paid,

• verify each employee’s qualification and suitability for a position,

• evaluate and manage job performance, fulfill our commitment to workforce diversity,

• provide support and to respond to inquiries, including investigating and addressing concerns and monitor and improve responses, and internal policies;

• maintaining records and exercising and defending legal claims.

Specifically, we may use this information in some of the following ways, though this is not an all-inclusive list:

• To Recruit Employees, including to conduct employment related background screening and checks.
• To Administer Benefits, such as medical, dental, optical, commuter, and retirement benefits, including recording and processing eligibility of dependents, absence and leave monitoring, insurance and accident management and provision of online total reward information and statements.
• To Pay and Reimburse for Expenses, including salary administration, payroll management, payment of expenses, to administer other compensation related payments, including assigning amounts of bonus payments to individuals, administration of departmental bonus pools and administration of stock option payments.
• To Conduct Performance-Related Reviews, including performance appraisals, career planning, skills monitoring, job moves, promotions and staff re- structuring.
• To Monitor Work-Related Licenses and Credentials, including provisioning software licenses for use in the course of an employee’s work-related responsibilities, ensuring compliance, training, examination and other requirements are met with applicable regulatory bodies.
• To Provide Our Employees with Human Resources Management Services, including providing employee data maintenance and support services, administration of separation of employment, approvals and authorization procedures, administration and handling of employee claims, and travel administration.

• To Maintain Your Contact Information, including altering your details across relevant entities within SCCU (for example personal, other employment and transferring roles).

• To Assist You in Case of Emergency, including maintenance of contact details for you, and your dependents in case of personal or business emergency.

• To Monitor Eligibility to Work in the U.S., which means monitoring and ensuring compliance of employees’ ability to work in the U.S.

• To Conduct Healthcare-Related Services, including conducting pre-employment and employment-related medical screenings for return-to-work processes and medical case management needs; determining medical suitability for particular tasks; identifying health needs of employees to plan and provide appropriate services, including operation of sickness policies and procedures; and providing guidance on fitness for travel.

• To Facilitate A Better Working Environment, which includes conducting staff surveys, providing senior management information about other employees, and conducting training.

• To Ensure a Safe and Efficient Working Environment, which includes SCCU actions relating to disciplinary actions, and code of conduct processes and investigations.

• To Maintain Security on Company Websites, which includes hosting and maintenance of computer systems and infrastructure; management of SCCU’s software and hardware computer assets; systems testing, such as development of new systems and end-user testing of computer systems; training; and monitoring email and Internet access.

• To Comply with Applicable Law or Regulatory Requirements, such as legal (state and federal) and internal company reporting obligations, including headcount, management information, demographic and Health, Safety, Security and Environmental reporting.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice.

Sharing or Selling Personal Information

1. As defined in the CCPA, “sold” or “sale” means the disclosure of Personal Information for monetary or other valuable consideration but does not include, for example, the transfer of Personal Information as an asset that is part of a merger, bankruptcy, or other disposition of all or any portion of our business. “Share” or “sharing” means disclosing Personal Information to a third party for cross-context behavioral advertising (targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses), whether or not for monetary or other valuable consideration.

2. We have not “sold” or “shared” your Personal Information.

Consumers Under Age 16. SCCU does not knowingly sell or share Personal Information about consumers under age 16.

Disclosure to Third Parties for Business Purposes

1. We may also disclose the following Personal Information to third parties, such as our service providers and affiliates, for our operational business purposes in the preceding twelve (12) months:

SCCU only uses and discloses your sensitive Personal Information for the limited purposes permitted by the CCPA and its implementing regulations.

Your Rights and Choices

1. The CCPA provides consumers (California residents) with specific rights regarding their personal information. Please note, not all of the rights described here are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity. This section describes your CCPA rights and explains how to exercise those rights.
2. Right to Know. You have the right to know:
   • What categories of personal information we collected about you;
   • What categories of sources from which we collected such personal information;
   • The business or commercial purpose for collecting (if applicable) personal information about you;
   • The categories of third parties to whom we disclose your personal information; and
   • The specific personal information we collected about you.
3. Right to Delete. You can ask us to delete Personal Information we collected from you. However, SCCU has the right to maintain Personal Information, despite a deletion request, when retention of the information is reasonably necessary for the business or necessary in order to comply with a legal obligation. We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers, contractors and other third parties, if any, to take similar action.
4. Right to Correct. You can ask us to correct inaccurate Personal Information that we maintain about you.
5. Right to Opt-Out of Sale or Sharing. We do not sell the personal information of consumers we actually know are less than 16 years old.
6. Right to Limit use or disclosure of Sensitive Personal Information. We only use a consumer’s sensitive personal information for the purposes identified in Section 7027(m) of the California Code of Regulations. Therefore, we are not required to give you notice of the right to limit the use of sensitive personal information or give you the opportunity to request that such information be limited.
7. Right to No Discrimination or Retaliation. You have the right to be free from unlawful discrimination, retaliation, and/or harassment for exercising your rights under the CCPA.

Exercising your CCPA Rights

1. To exercise your rights under the CCPA, please submit a request online at www.sierracentral.com and click on Privacy Notice at the bottom of the web page. You may also complete and forward a request for information by mailing to:

   • Sierra Central Credit Union 1351 Harter Parkway Yuba City, CA 95993

2. To exercise your rights under the CCPA, you must submit a verifiable consumer request. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request to know, delete or correct on behalf of your minor child. You may only submit a request to know twice within a 12-month period.

3. A verifiable employee request must provide sufficient information that allows us to reasonably verify whether you are the person about whom we collected personal information or an authorized representative. We will request, for example, the submission of your first and last name, address, date of birth.

4. If we cannot verify your identity or authority to make the request, we will not be able to fulfill your request. The information provided for verification will only be used for that purpose.

Response Timing and Format

1. We will confirm receipt of the request within ten (10) business days, If you do not receive confirmation within the 10-day timeframe, please call 1-800-222-7228.

2. We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

3. We will deliver our written response by mail or electronically, at your option.

4. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. For a request to know, you may request information collected beyond the 12-month period provided the information was collected on or after January 1, 2022, and providing the information would not be impossible or involve disproportionate effort. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For requests for specific Personal Information, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, and we will send this information to you in a secure manner.

5. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes to Our Privacy Notice

1. We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the website and update the notice’s effective date.

2. Continued use of our website following the posting of changes constitutes acceptance of such changes.

Contact Information

1. You can contact us with your questions, comments, rights requests, and other CCPA- related inquiries:

• Call 1-800-222-7228

• Mail 1351 Harter Parkway, Yuba City, CA 95993. Attn: Human Resources

Effective Date: This Privacy Notice for California consumers is effective January 1, 2023.