Workforce Privacy Notices

Scope and Overview

Cintas Corporation (together with its relevant subsidiaries, associates, and affiliated companies, “Cintas,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information. Cintas operates in multiple different countries. Some of these countries have laws related to the collection, use, transfer, and disclosure of the personal information of individuals, including our employees. We take these obligations very seriously. This Privacy Notice describes how and why Cintas collects and processes personal information about you in various human resources (“HR”) contexts.

The Cintas entity that employs or engages you will be accountable for the processing of your personal information; however, in accordance with this Privacy Notice other Cintas entities may also be involved in the processing of your personal information.

This Notice applies to the following individuals whose personal information we collect and process in HR context (collectively, “Workforce”):

• Current/former job applicants who have applied for a position with Cintas;
• Current/former employees of Cintas;
• Current/former independent contractors of Cintas;
• Individuals whose family members or friends have provided personal information about you to Cintas in HR context, such as if:
  • You are listed as an emergency contact for one of the foregoing; and/or
  • You are a beneficiary or dependent of one of the foregoing.

Non-Applicability: This Notice does not apply to our consumer facing website(s) or to those of our Workforce acting in their personal capacity, which are addressed in our General Privacy Notice, except when you submit a job application to us.

This Notice describes the categories of personal information that we collect, how we use personal information about you, how we secure personal information about you, when we may disclose personal information about you to third parties, and when we may transfer personal information about you outside of your home jurisdiction. This Notice also describes your rights regarding the personal information that we hold about you, including how you can access, correct, and request erasure of personal information about you, or withdraw your consent or object to the processing of personal data about you under certain circumstances. You may also have the right to request that we transfer personal information that you provided to us to another party.

We will process personal information about you in accordance with this Notice unless otherwise required by applicable law. We take steps to ensure that the personal data that we collect about you are adequate, relevant, not excessive, and processed for limited purposes.

Collection of Personal Information

For the purposes of this Notice, personal information means any information about an identifiable individual member of our Workforce or their friends or family members, which may include data collected during the recruitment, onboarding, and during the employment/engagement process. Personal information excludes anonymous data that is not associated with a particular individual and cannot be used, directly or indirectly, to identify an individual. To carry out our activities and obligations, we may collect, store, and process the following categories of personal information, some of which we require in connection with our recruiting activities, or to administer the employment / contracting relationship with you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal and work email addresses.
• Date of birth.
• Age
• Gender.
• Marital and dependent status, only when needed to administer benefits such as health insurance or pension benefits.
• Beneficiary and emergency contact information.
• Government identification numbers such as social insurance or other national insurance number, driver’s license number, or other identification card number.
• Immigration information.
• Trade union membership.
• Bank account details and payroll information.
• Wage and benefit information.
• Compensation history including any incentive compensation, bonus, benefits or other allowances.
• Performance information.
• Insurance enrollment information.
• Start date and job title and other employment status information such as employment type, retirement eligibility, reporting manager information, responsibilities, promotion dates.
• Location of employment and branch/unit/department name.
• Biometric information.
• Geolocation data.
• Education and training, including degrees awarded, transcripts, and other information provided in support of the job application.
• Information collected during phone screenings and interviews.
• Details regarding the type of employment sought, desired salary, willingness to relocate, job preferences, and other information related to compensation and benefits.
• Information related to previous applications to or previous employment history with Cintas, if any.
• Employment records (such as professional memberships, work history, and proof of work eligibility such as citizenship, passport data and details of residency, work permit).
• Leave information, including working time records (including vacation and other absence, leave status, hours worked and department standard hours).
• Audio, electronic, visual, or similar information such as your photograph or via our video security recordings and our HR hotline.
• Other personal details included in a CV, resume, application form or cover letter or that you otherwise voluntarily provide to us.
• Feedback collected from workplace experience and satisfaction surveys.
• Communications content on or with Cintas-systems (including browsing history and browsing logs, video and audio information derived from conferences, meetings screen sharing, training, webinars, search history, email logs and messages, system or development tool logs, text and instant messaging content sent or received using a Cintas device).
• Internet and network usage information including IP address, call, and video recordings (including CCTV).
• Network and account credentials.

We collect most of the personal information about you directly from you. In limited circumstances, we may obtain personal information about you from other sources, such as former employers, Cintas personnel, our customers, our service providers, licensing/certification organizations, recruiters, official bodies (such as regulators), benefit providers, professional advisors, publicly available databases, or educational institutions.

Use of Personal Information

We process personal information about you where applicable law permits or requires it, including where the processing is necessary to effectuate or administer employment or an independent contractor relationship with you, where the processing is necessary to comply with a legal or regulatory obligation that applies to us, for our legitimate interests or the legitimate interests of third parties, to protect your vital interests, or with your consent if applicable law requires consent, or for other purposes as permitted or required by applicable law. We may process personal data about you for the following legitimate business purposes and for the purposes of effectuating or administering employment or an independent contractor relationship with you:

• Identifying and evaluating job applicants, including assessing skills, qualifications, and interests for the purposes of determining suitability for the position for which you have applied.
• Communicating with you about the recruitment process and your application.
• Keeping records related to our hiring processes, for only as long as appropriate under the circumstances.
• Analyzing and improving our application and recruitment process.
• Employee administration (including payroll and benefits administration).
• Business management and planning including facilitating communications with you (such as by email, phone, and text message).
• Booking employee travel.
• Processing employee work-related claims (for example, insurance and worker's compensation claims) or leaves of absence.
• Facilitating diversity and inclusion programs.
• Accounting and auditing.
• Conducting performance reviews and determining performance requirements.
• Assessing qualifications for a particular job or task.
• Gathering evidence for disciplinary action or termination.
• Facilitating leave requests, sickness absence, employee transfers and terminations.
• Education, training, and development requirements.
• Health administration services, including employee activation initiatives and communications, including in the event of an emergency.
• HR electronic file management, administration, and security.
• Understanding employee experience and satisfaction.
• Security (including network and physical security), including to ensure the safety of personnel and visitors and to respond to, handle and document accidents or other emergencies.
• Creating and submitting reports as required by applicable laws or regulations.
• Complying with our legal, regulatory, or other corporate governance requirements, including health and safety obligations.

For job applicants, we may retain and use personal information about you to inform you about and consider you for other positions that may be appropriate.

Where none of these reasons apply, your decision to provide personal information to Cintas is voluntary. We will only process personal information about you for the purposes for which we collected it or for compatible purposes, if permitted by applicable law. If we need to process personal information about you for another purpose, we will provide notice to you and, if required by law, seek your consent. We may process personal information about you without your knowledge or consent where required by applicable law or regulation. Where we process your personal information based on your consent, withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

We may also process personal information about you for our own legitimate interests, including for the following purposes:

• To prevent fraud and other crimes or breaches of internal Cintas policies.
• To ensure network and information security, including preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution.
• To monitor, search and review corporate and Workforce communications to ensure compliance with internal policies and applicable laws and regulations.
• To support internal administration with our affiliated entities.
• To conduct data analytics and other analyses to review and better understand employee satisfaction and retention and attrition rates, and to better allocate resources.

You will not be subject to decisions that have a legal or another considerably adverse effect solely based on automated processing of your personal information without prior consent, unless permitted by applicable law.

Collection and Use of Sensitive Personal Information

We may collect and process personal information that may be viewed as sensitive when necessary to carry out our obligations under employment law, with your explicit consent, for the performance of the employment contract, or as applicable law otherwise permits, including:

• Union membership information for the purpose of paying union premiums.
• Physical or mental health information or disability status to comply with health and safety obligations in the workplace, to make appropriate workplace accommodations, as part of sickness absence monitoring, and to administer benefits.
• Race or ethnic origin, religious affiliation, health information and sexual orientation to ensure meaningful equal opportunity monitoring and reporting.
• Previous criminal charges or convictions where relevant for the position.
• Precise geolocation data to the extent it is collected through an employee’s use of a Cintas-owned vehicle or device.
• Biometric information to the extent it is voluntarily provided for the purpose of optional wellness programs and to the extent it may be collected through dashboard cameras mounted in Cintas-owned vehicles.

Data Sharing

We will only disclose personal information about you to third parties where required by law or to our employees, contractors, designated agents, or third-party service providers who require such information to assist us with administering the recruitment process or the employment or independent contractor relationship with you, including third-party service providers who provide services to us or on our behalf. Third-party service providers may include, but are not limited to, payroll processors, benefits administration providers, communications providers, and data storage or hosting providers, among others (e.g., Twilio, Anthem, EyeMed, Alight). These third-party service providers may be located outside of the province or country in which you live or the province or country where the position you have applied for is located.

We require all our third-party service providers, by written contract, to implement appropriate security measures to protect personal information about you consistent with our policies and any data security obligations applicable to us. We only permit them to process personal information about you for specified purposes in accordance with our instructions.

We may also disclose personal information about you as permitted or required by applicable law:

• To other members of our group of companies (including outside of your home jurisdiction) for the purposes set out in this Privacy Notice and as necessary to administer the application and recruitment process and/or to perform our employment or independent contractor relationship with you.
• To comply with legal obligations or valid legal processes such as search warrants, subpoenas, or court orders. When we disclose personal information about you to comply with a legal obligation or legal process, we will take reasonable steps to ensure that we only disclose the minimum personal information necessary for the specific purpose and circumstances.
• To our professional advisors (such as accountants, auditors, lawyers, insurers, bankers, and other professional advisors) to the extent necessary to facilitate their provision of services to us when it is in our legitimate interests to do so or when required to comply with a legal obligation.
• To protect our rights and property.
• During emergency situations or where necessary to protect the safety of persons.
• Where the personal information is publicly available.
• If a business transfer or change in ownership occurs and the disclosure is necessary to evaluate or complete the transaction. In these circumstances, we will limit data sharing to what is necessary, and we will anonymize the data where possible.
• For additional purposes, with your consent where such consent is required by applicable law.
• To other third parties that you have authorized or directed us to share personal information about you, such as your family members.

Cross-Border Data Transfers

We may transfer personal information about you outside of your home jurisdiction, including to the United States and other countries (such as Canada, Honduras, Mexico, Switzerland, and Singapore) that may not be deemed to provide the same level of data protection as your home jurisdiction. We will do so to achieve the processing purposes set out in this Privacy Notice.

For transfers to the United States and other jurisdictions not considered adequate by the UK or Swiss government, we have put in additional safeguards to protect your personal information, such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You may request a copy of these safeguards by contacting at [email protected].

Data Security

We have implemented appropriate physical, technical, and organizational security measures designed to secure personal information about you against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, we limit access to personal information to those employees, agents, contractors, and other third parties that have a legitimate business need for such access for the purposes described in this Privacy Notice, such as individuals in HR, Finance & Accounting, Legal, Risk & Compliance, Internal Audit, and IT. All personnel within Cintas will generally have access to your business contact information such as name, position, telephone number, postal address, and email address.

INTERNAL POLICIES

In addition to the measures to protect personal information described in this Privacy Notice, Cintas has internal procedures and policies regarding our handling of personal information to facilitate compliance with this Privacy Notice and applicable laws, including with respect to retention and access to personal information and complaints. Please contact your human resource manager for additional information on the procedures and policies that Cintas has in place or contact us at [email protected].

DATA RETENTION

Except as otherwise permitted or required by applicable law or regulation, we will only retain personal information about you for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal, accounting, or reporting obligations, or as necessary to resolve disputes.

Under some circumstances we may anonymize personal information about you so that it can no longer be associated with you. We reserve the right to use such anonymous data for any legitimate business purpose without further notice to you or your consent.

If you are offered and accept employment or contract with us, the personal information we collected during the application and recruitment process will become part of your employment record or contractor file, and we may use it in connection with your employment or contract consistent with this Privacy Notice and other Workforce policies. If you do not become an employee or contractor, or once you are no longer an employee or contractor of Cintas, we will retain and securely destroy personal information about you in accordance with our document retention policy and applicable laws and regulations.

Rights of Access, Correction, Erasure, and Objection

It is important that the personal information we hold about you is accurate and current. Please keep us informed if personal information about you changes during the recruitment process or your employment or contract.

If you want to request access to, verify, correct, request erasure of, or object to the processing of personal information about you, request access to information about the ways in which your personal information is or has been used and the third parties with whom we have shared your personal information, request that we transfer a copy of the personal information that you provided to us to another party (portability), or to withdraw your consent (when you have provided it to us for certain processing activities), please contact us at [email protected]. We will respond to your request in accordance with applicable law. Please note, however, that certain personal information may be exempt from requests pursuant to applicable data protection laws or other laws and regulations.

If we receive a request from you to correct personal information and we determine that your request is reasonable, we will correct the personal information and send the corrected personal information to the third parties with whom we shared that personal information, where required. If we determine that your request is not reasonable, we will annotate the personal information, noting that the correction was not requested but not made.

You also may lodge a complaint or report an alleged infringement of applicable data protection law with the data protection authority for your country or region where you have your habitual residence or place of work, or where an alleged infringement of applicable data protection law has occurred. The data protection authority for the UK is the Information Commissioner’s Office (https://ico.org.uk/) and the data protection authority for Switzerland is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home.html).

Employee's obligations

It is important that the personal information we hold about you is accurate and current. Please keep us informed if personal information about you changes during your employment or contract. You agree to inform your dependents whose personal information you provide to Cintas about the content of this Privacy Notice, and ensure you have the right to provide that information to Cintas. You further agree to follow applicable law and Cintas’ policies, standards and procedures that are brought to your attention when handling any personal information to which you have access in the course of your relationship with Cintas. In particular, you will not access or use any personal information for any purpose other than in connection with and to the extent necessary for your work with Cintas. You understand that these obligations continue to exist after termination of your relationship with Cintas.

Changes to this privacy notice

We reserve the right to update this Privacy Notice at any time. We will take reasonable steps to provide or make available to you the updated Privacy Notice when we make any updates. We will communicate changes and updates to this policy by posting an updated notice to www.cintas.com/privacy.