Last Updated: December 30, 2022

This California Privacy Notice is a supplement to our General Privacy Notice. To understand our privacy practices, you should refer to our General Privacy Notice and this supplemental California notice (“Notice”). BambooHR complies with the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (together with the CCPA, “CPRA”), and all other applicable privacy laws.

For purposes of this Notice, “Bamboo HR” includes Bamboo HR LLC, BambooHR Payroll LLC, Front & Main, Inc. d/b/a Honey, and Glide Holdings, Inc. d/b/a Welcome (together “BambooHR,” “we,” “our,” and “us”). We collect information in connection with our products and services as well as how our website and mobile applications automatically collect information.

1. What This Privacy Notice Covers

If you are an individual employee or prospective employee of a BambooHR customer, this Notice does not apply to you. For more information on your employer’s privacy practices, please refer to your employer’s privacy notice. Under applicable privacy laws, we are a Service Provider, and your employer is a Business under the CPRA.

If you are a customer, please see Section 12 of the General Privacy Notice for information on collection, use, and sharing of customer Data, including Personal Information.

The CPRA and this Notice apply to Visitors, Users, BambooHR’s business-to-business relationships, employment applicants, employees, independent contractors, and others who are California residents (“consumers” or “you”). For information on Visitors and Users, please see Section 2 our General Privacy Notice.

This Notice applies to California residents’ Personal Information, as defined below, we collect to provide them with certain products and services (collectively, “Services”). The requirements of CPRA do not apply to deidentified or aggregate consumer information, which is a type of information that is not capable of identifying you.

This Notice describes the rights available to you regarding our use of your Personal Information (defined below). Our use of Personal Information collected through the BambooHR Services shall be limited to the purposes of providing the Services for which you have engaged us, as described in this Notice, and otherwise used with your consent.

2. What Personal Information We Collect

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. “Sensitive Personal Information” is a type of Personal Information that receives heightened protection under the CPRA and includes: (a) social security, driver's license, state identification card, or passport number; (b) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) precise geolocation data; (d) racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication; (f) genetic data; (g) biometric data; (h) health data; and (i) sex life or sexual orientation data.

Children’s Personal Information

Our Services are not intended for or directed to children under the age of 13. We do not knowingly collect Personal Information directly from children under the age of 13 without parental consent. If we become aware that a child under the age of 13 has provided us with Personal Information, we will delete the information from our records. If you believe we have collected Personal Information for an individual under the age of 13, please contact us.

Categories of Personal Information We May Collect

Below are the categories of Personal Information that we may have collected, disclosed for a business purpose, or sold or shared in the last twelve (12) months:

3. How Long Do We Keep Your Personal Information

We retain Personal Information about you necessary to fulfill the purpose for which that information was collected and if applicable, in accordance with your employer’s contract with us, consistent with applicable laws. For example, we generally retain information regarding our payroll services for at least ten years from the date of our last interaction/account closure/etc., in compliance with our obligations under applicable laws, or for longer if required to do so according to our regulatory obligations or where we believe necessary to establish, defend, or protect our legal rights or those of others. When we destroy your Personal Information, we do so in a way that prevents that information from being restored or reconstructed.

4. How Do We Collect Your Personal Information

Below are the sources from which we may receive your Personal Information:

• directly from you when you inquire about our Services
• from your device when you access our website, mobile app, and other online services
• from third parties that assist us in providing relevant Services

We may combine Personal Information that you provide us through our website with other information we have received from you or your employer, whether online or offline, or from other sources such as from our service providers.

5. Cookies, Do Not Track Requests, and Opt-Out Preference Signals

Cookies

For information about cookies, please see Section 5 of our General Privacy Notice for more information on cookies collected via our website.

Do Not Track Requests

BambooHR does not respond to the Do Not Track requests. Do Not Track is a privacy preference you can set in your web browser to indicate that you do not want certain information about your web page visits tracked and collected across websites. For more details, including how to turn on Do Not Track, visit www.donottrack.us. We do, however, honor opt-out preference signals, as noted below.

Opt-Out Preference Signals

An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sharing for cross-context behavioral advertising or sale of your personal information. You can learn more about implementing opt-out preference signals such as the Global Privacy Control here or by exploring other developing technologies and services that offer this tool.

6. How We Use and Disclose Your Personal Information for Business and Commercial Purposes

We may use or disclose the Personal Information listed in Section 2 for the following purposes:

Business Purposes. BambooHR uses information, including Personal Information, provided by you to provide the Services and for business purposes such as:

• Processing your registration for a BambooHR event, request for information, or a free trial.
• Processing and fulfilling orders, billing, implementation, service improvement, research, marketing and for other general business purposes.
• Conducting internal research to develop and demonstrate technology.
• Keeping a record of our transactions and communications.
• Conducting audits and reporting related to transactions and interactions, including online interactions, you may have with us or others on our behalf.
• Delivering marketing communications (emails, calls, invitations, etc.) under applicable law or with your consent.
• Delivering user surveys, customized content and analytics on our websites or application.
• Operating and improving our website, performing analytics, and improving our Services.
• Helping to protect you and us from fraud or economic loss and protecting your health, safety, or welfare.
• Detecting, analyzing, and preventing security incidents, and other fraudulent or illegal activity.
• Identifying, debugging, and repairing errors in our systems, websites, or applications that impair existing functionality.
• Short-term, transient use of Personal Information that is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

Consent. BambooHR may disclose your Personal Information when you provide your consent and intentional direction. For example, when you request content or register for an event, you consent to receiving marketing communications from BambooHR and our third-party partner or co-sponsor of that content or event. For example, you may consent to participate in marketing, product, or customer service research or user surveys.

You may always opt-out of receiving marketing communications by unsubscribing or submitting a privacy rights request here.

Legal Proceedings. BambooHR will share your information, including Personal Information, to respond to investigations, court orders, legal process, or to investigate, prevent or act regarding illegal activities, suspected fraud, or situations involving potential threats to the physical safety of any person, violations of BambooHR's Terms of Service, or as otherwise required by law. If BambooHR is required by law or an order of a court of competent jurisdiction to disclose your information, BambooHR will promptly notify you of this requirement, if permitted by the court or applicable law, so that you may seek a protective order or other appropriate relief.

Service Providers. BambooHR may also share Personal Information with our service providers, who help us to provide the Services, such as cloud storage, security, application communications, customer support backup, data analytics. We will ensure that those service providers are obligated to protect Personal Information under contract terms which are no less protective than those set out in this Privacy Notice.

Merger, Acquisition, Sales. If BambooHR is involved in a merger, acquisition, restructuring or sale of all or a portion of its assets, equity or similar transaction, Personal Information may be transferred to the acquiring person or entity and you will be notified via email and/or a prominent notice on our website of any change in ownership or uses of Personal Information, as well as any choices you may have regarding Personal Information. We will use reasonable efforts to direct the acquiring person or entity to use your Personal Information in a manner that is consistent with our Privacy Notice.

Employment. We use your Personal Information for recruiting, hiring, and onboarding; applicant and employee communications (email, texts, calls); and conducting general human resources activities (payroll, administration of benefits, timekeeping, ID badges, and post-application or post-employment activities).

Within the last 12 months, we have disclosed Personal Information identified in the “Personal Information” section, categories (A)-(L) above only (i) at your express request or at the direction of your employer; (ii) to our partner or co-sponsor with your consent and intentional direction, and (iii) to our service providers for the business purpose(s) described above.

Sale or Sharing. We do not sell your Personal Information to third parties for monetary consideration. However, we may share your Personal Information with third parties for cross-context behavioral advertising, as described in Section 5 of the General Privacy Notice. We do not knowingly sell, share, use for cross-context behavioral advertising or disclose the Personal Information of children under the age of 16.

7. Your Privacy Rights

If you are a California resident, you may exercise certain privacy rights related to your Personal Information. You may exercise these rights free of charge except as otherwise permitted under applicable law. We may limit our response to your exercise of these privacy rights as permitted under applicable law.

Right to Know/Access

You have the right to know and access the Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you. You have the right to receive this information in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the Personal Information to a person without impediment, where the processing is carried out by automated means.

If you have an online account or profile with us, you may access your Personal Information via your account through the website or mobile app. Alternatively, you may submit your request using our toll-free number or via our online form. Please contact us. We will use commercially reasonable efforts to honor your requests.

Right to Correct

You have the right to update the Personal Information that BambooHR has collected about you directly or indirectly, including Personal Information collected by a service provider or contractor on our behalf.

If you have an online account or profile with us, you may access your Personal Information via your account through the website or mobile app. Alternatively, you may submit your request using our toll-free number or via our online form. Please contact us. We will use commercially reasonable efforts to honor your requests.

Right to Request Deletion

You have the right to request that BambooHR delete your Personal Information, subject to certain limited exceptions. For example, we may retain an archived copy of your records consistent with applicable law, to continue to provide Services, or for other legitimate business purposes (e.g., to ensure the security and integrity of our systems, debug to identify and repair errors or certain internal uses).

You may submit your request using our online form. or by calling our toll-free number. Please see our Contact Information.

Right to Opt-out of the Sale or Sharing

You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising or the sale of your personal information.

You may submit your request using our online form or by calling our toll-free number. Please see our Contact Information.

Your Right to Limit the Use of Sensitive Personal Information

BambooHR may collect the following categories of Sensitive Personal Information: Social Security, driver’s license, state identification card, or passport number; financial information; health data; sex life or sexual orientation (if ascertainable from gender or marital status); biometric information; precise geolocation; racial or ethnic origin; and the contents of communications where BambooHR is not an intended recipient. We only collect, use and disclose this Sensitive Personal Information for certain limited purposes that are permitted under the CPRA, such as to perform the services reasonably expected; to prevent, detect, and investigate security incidents; to resist malicious, deceptive, fraudulent, or illegal actions; to ensure the physical safety of natural persons; and to verify or maintain the quality or safety of our services and devices. Because we use Sensitive Personal Information for these limited purposes, we do not offer a right to limit use and disclosure of Sensitive Personal Information. However, if you have any questions, please contact us.

Right to Opt-out of Automated Decision-Making Technology (Profiling)

BambooHR does not engage in automated decision-making or profiling. As such, we do not offer an opt-out or access right related to automated decision-making or profiling at this time.

For more information, please contact us.

Right to Non-Discrimination

You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services; and (e) retaliating against you for exercising your privacy rights.

Direct Marketing Requests

If you are a California resident, you may request certain information regarding disclosure of Personal Information (defined below) to third parties for their direct marketing purposes under California Civil Code Section 1798.83. For more information, please contact us using our toll-free number, email or mailing address.

For more information, please contact us.

8. How We Verify Your Identity and Process Your Rights Request

When you submit your request by using our online form, our toll-free number, via email, or by mail, we will need to verify your identity.

We will only use the Personal Information provided in a verifiable consumer request to verify your identity or authority to make the request. BambooHR will attempt to verify your identity with a reasonably high degree of certainty. BambooHR will require you to attest to your identity and California residence. If BambooHR cannot verify your identity, we will, in accordance with its obligations under the CPRA, decline to comply with your request.

Please see Section 9 below for information on how to submit an authorized request on another’s behalf.

Except for the opt-out of sale or sharing right (which we honor within 15 business days), we endeavor to respond to a verifiable consumer request within 45 calendar days of its receipt. If we require more time (for a maximum total of 90 calendar days), we will inform you of the reason and extension period in writing.

9. How You Can Authorize an Agent to Exercise Your Rights

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please submit requests via our online form or by calling our toll-free telephone number. Please see contact us.

10. Notice of Financial Incentive

We do not offer financial incentives to individuals for providing Personal Information.

11. BambooHR Customer Data

As discussed in Section 2 above, this Notice does not apply to individual employees or prospective employees of BambooHR customers. Such individuals should access the customer or employer’s privacy notice.

If you are a BambooHR customer, please see Section 12 of our General Privacy Notice for more information.

12. Changes to Our Privacy Notice

We reserve the right to amend this Notice at our discretion and at any time. We will do so by updating this Notice. Amended terms take effect upon being incorporated into this Notice, and your continued use of the website or association with your employer following the posting of any changes constitutes acceptance of any updated terms. If the changes will materially affect the way we use your Personal Information in connection with Services that we have already collected, we will notify you or your employer.

13. Requesting Notice in Other Languages or Formats

You may be able to request this Notice in another language where we provide such notices in the ordinary course of business or in an alternative format if you have a disability. Please contact the Privacy Office below to request an alternative format.

14. Contact Information

If you have questions or comments about this Notice, our privacy notices, the ways in which we collect and use your information, your choices, and rights regarding such use, or wish to exercise your rights under California law, please contact us at:

Bamboo HR LLC
BambooHR Payroll LLC
Front & Main, Inc. d/b/a/ Honey
Glide Holdings, Inc. d/b/a Welcome
Attn: Legal Department/Privacy
335 South 560 West
Lindon, UT 84042-1911
USA

Toll Free: 1-866-387-9595
Phone: 801-724-6600
Email: [email protected]
Submit a Privacy Rights Request here.