Vestwell California Resident Employee, Applicant, and Prospective Applicant Privacy Notice

CALIFORNIA RESIDENT EMPLOYEE, APPLICANT, AND PROSPECTIVE APPLICANT PRIVACY NOTICE

This California Employee, Applicant, and Prospective Applicant Privacy Notice (“California Privacy Notice”) is only applicable to California residents. It is delivered on behalf of Vestwell Holdings Inc. (“Vestwell”, “we”, “us”, and “our”), being the entity to which you are applying to work or that employs you and governs certain personal information we collect from you. We have adopted this notice to comply with the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq. (“CCPA”). Please read and understand this California Privacy Notice before submitting your information to us.

Scope

This California Privacy Notice covers personal information we collect from and about California residents in their capacity as current, former, or prospective job applicants to Vestwell. There is other personal information that this California Privacy Notice does not cover. In some cases, that personal information may not be subject to the CCPA. In other cases, a different privacy notice may apply. Accordingly, this California Privacy Notice and/or the California privacy rights set out herein may not apply to you or to all of your personal information.

By personal information we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, which includes “personal information” and “sensitive personal information” as those terms are defined in the CCPA. The following is not personal information for purposes of the CCPA: (i) “publicly available information”; (ii) lawfully obtained, truthful information that is a matter of public concern; (iii) “deidentified” consumer information about California residents; and (iv) “aggregate” consumer information about California residents (in each case, as those terms are used in the CCPA). This California Privacy Notice does not apply to such information.

Notice at Collection

The following table sets forth the categories of personal information we may collect from you as a business; the purposes for which we use it; and whether we “sell” or “share” it for purposes of the CCPA (as those terms are used in the CCPA). Our collection, use, and disclosure of personal information depends on your relationship with us and your interaction with us. For information on our receipt of personal information as a third party, please see Third Party Processing below.

Third Party Processing

We may also receive personal information from you from other sources, including a third party, such as:

• Personal information we collect from professional networks where you have set up a publicly available profile (e.g. LinkedIn) or from recruitment consultants to whom you have provided your resume for application purposes, which may include: (i) Identifiers and Categories in Cal. Civ Code 1798.80(e), such as name, unique personal identifier, online identifier, phone number and/or signature; (ii) Characteristics of Protected Classifications Under California or federal law, such as nationality, veteran status, gender, age, gender identity, race, or ethnic origin, religion or disability; (iii) Geolocation data, such as your home address; (iv) Audio, electronic, visual, thermal, olfactory or similar information, such as your photo; (v) Professional or employment information, such as your job title or employer, employment history, education and qualification details; and (vi) Inferences drawn from the information listed above to create a profile about a California resident reflecting their preferences, characteristics and other attributes.

• Details of your suitability to work with us, your past performance at work, your character, verification of the information that you provide to us as part of your application, and if legally permitted, driving record, any history concerning criminal convictions, and drug screening results from third party references that you provide to us, from your previous and/or current employers, opinions expressed by others about you and from third party background checking services or a previous employer, which may include: (i) Identifiers and Categories in Cal. Civ Code 1798.80(e), such as name, unique personal identifier, online identifier, phone number and/or signature; (ii) Characteristics of Protected Classifications Under California or federal law, such as nationality, veteran status, gender, age, gender identity, race, or ethnic origin, religion or disability; (iii) Geolocation data, such as your home address; (iv) Professional or employment information, such as your job title or employer, employment history, education and qualification details; (v) Inferences drawn from the information listed above to create a profile about a California resident reflecting their preferences, characteristics and other attributes; and (vi) Sensitive personal information, such as Social Security Number, driver’s license, state identification card of passport number.

This information may be stored and processed by us in the following ways and for the following purposes:

• To consider your job application (including, in some cases, verifying your qualifications, education and references with those third parties you name);

• If your application is unsuccessful or if you have indicated your interest for prospective roles, we will keep your information on record to notify you in the future of relevant job vacancies with Vestwell that you may be interested in; compliance with any legal or regulatory obligation to which Vestwell is subject (including compliance with any request from regulatory authorities or other relevant public authorities);

• The prevention and detection of crime or fraud, subject to local law;

• To assess your eligibility for certain opportunities and programs;

• For legitimate business purposes; to help us improve how we market our recruitment events and job roles; and to conduct activities that are required or permitted by applicable law.

We do not “sell” or “share” such personal information for purposes of the CCPA.

Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected and processed, including for the purposes of satisfying any legal, regulatory, accounting or reporting requirements. To determine the appropriate retention period for your personal information and sensitive personal information, we will consider the amount, nature and sensitivity of the personal information, the potential risk from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and applicable legal requirements.

Whether acting as a business or third party, in addition to the above, we reserve the right to collate, process and disseminate any statistics based on an aggregation of data held by us provided that any individual is not identified from the resulting analysis and the collation, processing and dissemination of such information is permitted by law. In certain circumstances, not providing the requested data to us may affect our ability to meet the above purposes.

Prior Collection, Use, and Disclosure of Personal Information

The CCPA requires us to give you specific information about the categories of personal information and sensitive personal information we collect about you, the sources from which we have obtained that information, the purposes for which we collect it and the categories of entities to whom we disclose it. Our relevant practices over the last twelve months are described below.

How We Disclose Personal Information

In the past twelve months, we have disclosed the following categories of personal information for business purposes as set out above:

• Identifiers
• Categories of Personal Information described in Cal. Civ. Code Section 1798.80(e)
• Characteristics of Protected Classifications under California or Federal Law
• Commercial Information
• Internet or other electronic network activity information
• Geolocation data
• Professional or employment information
• Inferences drawn from other personal information

Sales of Personal Information

We do not sell your personal information for purposes of the CCPA and have not done so in the past twelve months.

Minors Under the Age of 16

We do not have actual knowledge that we sell or share the personal information of minors under the age of 16.

Your Rights as a California Resident

As a California resident, you may have certain rights in relation to your personal information.

Right to Know

You may have the right to know how we have collected, used, and disclosed your personal information. Specifically, you may have the right to know:

• The categories of personal information we have collected about you.
• The categories of sources from which we have collected your personal information.
• The business or commercial purpose for which we collect, sell or share your personal information.
• The categories of third parties to whom we have disclosed your personal information.
• The categories of personal information that we have sold or shared about you and the categories of third parties to whom it was sold or shared
• The categories of personal information we have disclosed about you for a business purpose and the categories of persons to whom we have disclosed it.

In addition, you may have the right to know the specific pieces of personal information we have collected about you. Subject to certain limitations, you may request that we provide this information dating back to January 1, 2023.

Right to Make a Deletion Request

You may have the right to request that we delete your personal information that we have collected or received. Subject to certain exceptions, we must delete your personal information and direct our service providers and contractors to delete your personal information.

Right to Correct Inaccurate Personal Information

You may have the right to request that we correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.

Right to Opt-Out of Sales of Personal Information

If we were to sell your personal information for purposes of the CCPA, you may have the right to opt-out of the sale of your personal information.

Right to Opt-Out of Sharing of Personal Information

You may have the right to opt-out of us sharing your personal information for cross-context behavioral advertising purposes.

Right to Limit Use and Disclosure of Sensitive Personal Information

Subject to certain exceptions, you may have the right to limit our use and disclosure of your sensitive personal information. We do not collect sensitive personal information from you pursuant to this California Privacy Notice.

Right to Non-Discrimination

You have the right not to be discriminated against by us for choosing to exercise your rights under the CCPA.

How to Exercise Your California Privacy Rights

If you wish to exercise your right to know, delete or correct inaccuracies in your personal information, please submit a request to us by emailing us at Legal@vestwell.com, call us at (917) 979-5258. If you maintain an account with us, we may require you to submit a request through that account. To opt-out of the sharing of your personal information for cross-context behavioral advertising purposes, please email Legal@vestwell.com. If you opt-out of cross-context behavioral advertising using this tool, an “opt-out cookie” will be placed on your device. Opt-out cookies are device- and browser-specific, meaning that you must opt-out across all of your devices and browsers in an effort to opt-out of cross-context behavioral advertising with PIMCO. If you clear your cache or delete cookies from your browser, the opt-out cookie will also be deleted, meaning you will need to opt-out again.

“Do Not Track” Signals and Global Privacy Control (“GPC”) Signals

We rely on a third-party service provider to implement a tool in an effort to recognize and honor “do not track” and Global Privacy Control signals as requests to opt-out of “sharing” of personal information for cross-context behavioral advertising purposes.

Information for Authorized Agents

You can authorize a person (“Authorized Agent”) registered with the California Secretary of State to exercise your California privacy rights on your behalf. An Authorized Agent can also include a person who has power of attorney or is acting as a conservator. To submit a request to Vestwell on behalf of another person as an Authorized Agent, please submit a request to us by emailing us at Legal@vestwell.com or calling us at (917) 979-5358.

Verifying Your Requests

We only respond to your requests to know, access the specific pieces of personal information we have about you, delete and correct inaccurate personal information when we can verify that you are a California resident exercising your rights regarding your personal information. We may need to ask you for personal information to verify your request so we can match it to the personal information we already have about you. We may also need to obtain additional information about you that we do not already have. If you provide us with new personal information that we do not already have about you, we will use it solely for the purpose of verifying your request. We will let you know via email if we need more information from you to verify your request. Please reply to our requests promptly. We will communicate with you about your requests via email. We will use the email address you provided when submitting your request. If we cannot verify your identity, we will let you know.

Responding To Your Requests

We aim to promptly verify and respond to your requests within 45 days of receipt but may require a total of up to 90 days to respond to your requests. If we require additional time beyond the initial 45 days after we receive your request, we will let you know within the first 45 days. We do not ordinarily charge a fee for our response to your requests. However, we may do so to the extent your request(s) are excessive, repetitive, or manifestly unfounded. If we determine that charging a fee is warranted, we will let you know and will provide you with an estimate of the associated costs of responding to your request(s). If we determine that we cannot or will not take the action that you requested, we will let you know. We will inform you of our reasons for not taking action and any rights you may have to appeal the decision. Unless you tell us that you would like to receive a response via postal mail, we will respond to you via email regarding your requests to know and to access the specific pieces of personal information we have about you. We will contact you at the email address you provided when submitting your request(s). If you would like to receive responses to a request to know or access personal information via postal mail rather than email, please let us know when submitting your request(s).

Limitations

The CCPA does not apply in full to all personal information we collect from California residents. As set out in “Scope” above, the CCPA is not fully applicable to much of the personal information we collect from California residents. Therefore, even if you are a California resident and submit a verifiable request, we may not be required to comply with your request. We are only required to respond to certain requests twice in any twelve-month period. We are not required to provide you access to specific pieces of personal information more than twice in any twelve-month period. Similarly, we are not required to comply with your “requests to know” more than twice in any twelve-month period.

Changes to Our California Privacy Notice

From time to time, Vestwell may update or revise this California Privacy Notice. If there are changes to the terms of this California Privacy Notice, documents containing the revised policy on the relevant website(s) will be updated.

How to Contact Us

If you have any questions or concerns about this California Privacy Notice, please contact us at Legal@vestwell.com.