Workforce Privacy Notice

1. Notice of Data Practices

The description of our data practices in this Notice will be updated at least annually. We may change or update this Notice from time to time. When we do, we will communicate changes and updates by posting the updated Notice with a new “Updated” date. Otherwise, this Notice serves as our notice at collection.

(a) Personal Data Sources and Use 

We may collect your personal data directly from you, such as (i) when you apply for a position or become employed or engaged by us (e.g., identification/identity data, contact details, educational and employment data); (ii) indirectly from you, such as by overserving your actions on our network or from information your computer or mobile device transmits when interacting with our network; (iii) from others through interactions in the course of employment or engagement; (iv) from third parties (e.g., references); or (v) from public sources of data.

Generally, we use Workforce personal data for HR Business Purposes and as otherwise related to the operation of our business, including for: performing services; managing interactions and transactions; security; debugging; quality assurance; processing interactions and transactions; and research and development. For example, we may use Workforce personal data for the following purposes:

• Recruitment;
• Conducting background checks;
• Employee onboarding/off-boarding;
• Maintaining personnel records;
• Payroll, reimbursements, and timekeeping;
• Processing leaves of absence;
• Processing workers’ compensation claims;
• Booking employee travel;
• Benefits administration;
• Employee activation initiatives and communications;
• Facilitating diversity and inclusion programs;
• Administering training and education programs; 
• HR IT system management, administration, and security;
• Performance management;
• Safety and occupational health;
• Security (including network and physical security); and
• As required by law.

We may also use personal data for “Additional Business Purposes” in a context that is not a sale or share under the CCPA, such as:

• Disclosing it to our Service Providers or Contractors that perform services for us (“Vendors”);
• Disclosing it to you or to other parties at your direction, through your action, or as otherwise requested or permitted by you to enable us to satisfy our obligations to you pursuant to your employment or engagement by Cintas (e.g., payroll processors, benefits providers, some software platform operators, wellness program providers, insurance providers etc.);
• For the additional purposes explained at the time of collection (such as in any additional applicable privacy notice);
• As required or permitted by applicable law;
• To the government or private parties to comply with law or legal process or protect or enforce legal rights or obligations or prevent harm;
• To investigate, prevent, or take action if we think someone might be using information for illegal activities, fraud, or in ways that may threaten someone’s safety or violate our policies or legal obligations; and
• To assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business (“Corporate Transaction”).

Subject to restrictions and obligations under the CCPA, our Vendors may also use your personal data for Business Purposes and Additional Business Purposes, and may engage their own vendors to enable them to perform services for us.

(b) Personal Data Collection, Disclosure, and Retention - By Category

We collect, disclose, and retain Personal Data as follows: 

We do not sell your personal data and we do not “share” your personal data for purposes of cross-context behavioral advertising, as defined under the CCPA.  We have not engaged in such activities in the 12 months preceding the date this Notice was last updated.  Without limiting the foregoing, we do not knowingly sell or “share” personal data of minors under 16 years of age.

Retention of Information. We will keep your personal data for as long as necessary to fulfill the purposes we collected it for and in accordance with our internal document retention policy and any applicable laws. We will retain and use each category of personal data as long as you have a professional relationship with us. Thereafter, we will keep your personal data for as long as is necessary (1) to protect our legal interests; and (2) to keep records required by law. Different retention periods apply for different types of personal data. 

Purposes for the Collection, Use, and Disclosure of Sensitive Personal Data. We collect, use, and disclose sensitive personal data for purposes of: performing services on behalf of our business; performing services and providing goods as requested by you; ensuring the quality or safety of services we control or improving those services; ensuring the security and integrity of our infrastructure and the individuals we interact with; establishing and maintaining your employment relationship with us; managing payroll and corporate credit card use; administering and providing benefits; short-term transient use; securing the access to, and use of, our facilities, equipment, systems, networks, applications, and infrastructure; preventing, detecting, and investigating security incidents; resisting and responding to fraud or illegal activities; and other collection and processing that is not for the purpose of inferring characteristics about an individual. We do not use or disclose sensitive personal data for additional purposes.