SHIP8 INC.

1.  Introduction

SHIP8 INC. and its subsidiaries, affiliates, and related entities (collectively, “SHIP8 INC.,” “we,” “our,” or “us”) are mindful of our responsibilities when we handle the Personal Information (as defined below) of our current, former and potential employees, job applicants, temporary staff, workers, contractors, consultants, and interns who perform services for SHIP8 INC. (collectively, “you,” “your,”or “Employee”).
This privacy notice (“Notice”) describes our practices regarding the collection, use, transfer, disclosure, and other handling of your Personal Information. In this Notice, “Personal Information” means any information related to an identified or identifiable individual or as otherwise defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”). Personal Information does not include anonymous data that is not associated with a particular individual, information that is lawfully made available from government records, deidentified or aggregated data, or information that is otherwise excluded from the scope of the CCPA.
Please read this Notice carefully and retain it, together with any other privacy notice we may provide on specific occasions when we are collecting or processing Personal Information about you, so that you understand your rights in relation to your Personal Information. This Notice does not form part of any contract of employment or other contract to provide services. We may update this Notice from time to time to reflect changes in our Personal Information practices and will notify you of any significant changes. Your continued engagement with SHIP8 INC. will imply your acceptance of such updates to this Notice.

2. Personal Information Collection and Disclosure

SHIP8 INC. collects Personal Information about you to conduct its operations and manage its workforce in a variety of ways. For example, we may collect Personal Information through application forms, CVs or resumes, your passport or other identity documents (e.g., your driving license), forms completed by you during your employment, correspondence with you, interviews, meetings, other assessments, or third parties which we describe in more detail below. We will inform you when providing your Personal Information is mandatory. If you do not provide your Personal Information when requested, we may not be able to consider your job application or, if you are employed, we may be unable to consider your subsequent request or continue our employment relationship with you. The categories of Personal Information we may collect, use, transfer, and disclose include:

• Personal Details. Name, employee identification number, work and home contact details (email, phone number(s), physical address), language(s) spoken, gender, date of birth, national identification card details, passport details, next of kin, disability status, emergency contact information, and photograph.SHIP8 INC. may also collect Personal Information, including name, age, and other contact information about your spouse, domestic/civil partner, or dependents.
• Documentation Required under Immigration Laws. Citizenship, passport data, details of residency or work permit including information received from border and security agencies (e.g., the UK Border Agency or the Home Office).
• Compensation, Benefits and Payroll. Base salary, bonus, benefits, compensation type, pay grade, salary step within assigned grade, details on stock options, stock grants and other awards, currency, pay frequency, effective date of current compensation, salary reviews, banking details, working time schedule and records (including vacation and other absence records and leave status such as leave taken by you due to holiday, sickness, family leave and sabbaticals, hours worked, and department standard hours), records of products and services purchased for business reasons, pay data and termination date, national insurance or other number, marital/civil partnership status, tax authorities certificates and details, domestic partners, and dependents.
• Position. Description of current position, job title, corporate status, management category, job code, job function(s) and sub-function(s), company name and code (legal employer entity), branch/unit/department (including location of workspace), employment status and type, full-time/part-time, attendance at work including CCTV footage, swipe card records and biometric data including finger-print scanning, terms of employment, employment contract, work history, hire/re-hire and termination date(s) and reason, length of service, retirement eligibility, promotions and disciplinary records (such as details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence), reporting manager(s) and supervisors information, and any other information which may be created during the course of your employment or engagement with us.
• Talent Management Information. Details contained in letters of application and resume/CV or in information you have provided to us (e.g., previous employment background including the start and end dates, education history, professional qualifications, language and other relevant skills, certification, certification expiration dates, references), information provided in recruitment selection or development surveys/questionnaires, information necessary to complete a background check, details on performance management ratings, development programs planned and attended, performance and development reviews, and training records (including competencies, qualifications, certificates and accreditations).
• Management Records. Details of any shares of common stock or directorships.
• System and Application Access Data. Information required to access company systems and applications such as System ID, LAN ID, email account, instant messaging account, mainframe ID, previous employee ID, previous manager employee ID, system passwords, previous company details, previous branch details, previous department details, information collected through automated means, and electronic content produced by you using SHIP8 INC. ’s systems, including documents, emails, call logs, and other communication systems.
• Workforce Management Information. Information reported regarding internal compliance, information required for workforce management, information gathered in the course of any follow-up investigations, report of the investigations, and outcomes of the reports.
• Special Categories of Information. We may also collect special categories of Personal Information, such as health/medical information (e.g., occupational health records including details relating to Occupational Medical Assessments, medical history, medical conditions including any disabilities for which we need to make reasonable adjustments – past & present, details relating to your GP, and doctors or consultants that you may be/have been in the care of), place of birth/citizenship/nationality, trade union membership information, equal opportunities monitoring information including information about your ethnic origin, sexual orientation, religion or belief, and any other personal information referring to protected characteristics. We collect this information for specific purposes, as described in Section 3 below.

Personal Information of California Consumers

The chart below provides the categories of Personal Information and Sensitive Personal Information of California consumers (as defined by the CCPA) we have collected, disclosed for a business purpose, or sold or “shared” (for cross-context behavioral advertising purposes) in the preceding twelve months since this notice was last updated.  The examples of Personal Information and Sensitive Personal Information provided for each category reflect each category’s statutory definition and may not reflect all of the specific types of Personal Information and Sensitive Personal Information associated with each category.

Personal Information Collected From Third Parties

To the extent permitted by applicable law, SHIP8 INC.  may obtain Personal Information about you from the following categories of sources:

• You/Your Devices: You or your devices directly.
• Affiliates.
• Government: Government entities.
• Partners: Business partners.
• Public: Publicly accessible sources and public databases.
• Former Employers.
• Educational Institutions.
• Background Check Providers.
• Credit Reference Agencies.
• Recruitment Agencies.
• Professional Employer Organizations.
• Social Media Platforms or Recruitment Companies.
• Third Parties and Service Providers.
• Other Employees:Managers, supervisors, and members of the HR Department.

SHIP8 INC. may seek Personal Information about you from third parties in connection with:

• Locating former employee and beneficiaries for purposes of administering SHIP8 INC.’s retirement, pension, or other benefits;
• Performance evaluations;
• References and background checks;
• Internal investigations;
• Other purposes that relate to your relationship with SHIP8 INC. ; and
• Other purposes permitted in accordance with applicable law.

3. Use of Personal Information

Depending on the country where you are located, we will only process your Personal Information based on a valid legal ground. The table below describes the legal grounds by purpose.

We only rely on our or a third party’s legitimate interests to process your Personal Information when these interests are not overridden by your rights and interests. When we use your Personal Information because we or a third party has a legitimate interest to do so, you may have the right to object to that use. We will not use your Personal Information for purposes other than that for which it was collected, unless we reasonably consider that this is required, and the reason is compatible with the original purpose. If we need to use it for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so or seek your consent. Please be aware that we may process your personal information without your knowledge or consent, in compliance with the above, where it is required or permitted by law.

Depending on the country where you are located, SHIP8 INC.  only processes special categories of Personal Information of Employees (such as information related to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, criminal convictions and offences, or genetic or biometric information), where:

• In limited cases, where SHIP8 INC.  has obtained the explicit consent of the Employee for the processing of the Personal Information. In these cases, you are free to grant or refuse your consent. Your contract will not be made condition upon your granting of consent;
• The processing is required or permitted by applicable law, for instance in the field of employment, social security law, and social protection law;  
• The Personal Information has manifestly been made public by the Employee;
• It is necessary to protect the vital interests of you or other employees and our customers’/clients’ personnel where you are legally incapable of giving consent;
• It is necessary for reasons of substantial public interest, proportionate to the aim pursued, with respect for rights to data protection and where we have provided measures to safeguard your rights;
• It is necessary for the establishment, exercise, or defense of legal claims; or
• It is necessary for the purposes of occupational medicine or for the assessment of the working capacity of the employee.

We will process special categories of Personal Information of Employees only where it is absolutely necessary. For example, we may process Personal Information related to your health to ensure your health and safety in the workplace, to provide workplace adjustments, to monitor and manage sickness absence, and to administer benefits. We may also process Personal Information about your ethnic origin, sexual orientation, and religion or belief for the purposes of equal opportunities monitoring. We may also collect information about your criminal convictions history where we are either required or entitled to carry out a criminal record check in order to ensure that there is nothing in your criminal convictions history that makes you unsuitable for the role.  Where required under applicable law, we maintain an appropriate policy document when processing special categories of Personal Information and criminal convictions data.

4. Disclosure of Personal Information

• SHIP8 INC.  Personnel. Access to, use of and other processing of Personal Information generally will be limited to individuals who have a need to know the information for the purposes described in this Notice, which may include your managers or others appointed by him or her, as well as personnel in HR and Recruitment (including payroll), IT, Compliance, Legal, Finance and Accounting, and Internal Audit. Most personnel within SHIP8 INC.  will have access to your business contact information such as name, position, telephone number, and email address.
• Third Parties and Service Providers. From time to time, SHIP8 INC.  may make Personal Information available to other entities, such as legal and regulatory authorities, accountants, auditors, lawyers and other outside professional advisors, former and future employers, and service providers (such as providers of payroll, pension scheme, insurance, medical benefits, human resources services, background checks, IT systems and support, and other third parties engaged to assist SHIP8 INC.  in carrying out business activities) located wherever they operate, including in other countries that have different data protection laws than those in the country in which you are based (for more information on international data transfers, see Section 6 “Cross-Border Data Transfers” below).
• As Required by Law. We also may disclose Personal Information to third parties other than service providers (i) if we are required to do so by law, regulation or legal process (such as a court order or subpoena), (ii) in response to requests by government agencies, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.
• Affiliates. SHIP8 INC. may disclose your Personal Information to SHIP8 INC.  affiliates to fulfill the purposes described in this Notice (e.g., to enable reporting activities on company performance, in the context of business reorganizations or group restructuring exercises, for system maintenance support and hosting of data).
• Business Transactions. We may also transfer your Personal Information in the event that we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution or liquidation). In these circumstances, the data will be subject to confidentiality arrangements. Some of these transfers may be to parties in countries outside of the country and region in which you work.

Disclosure of Personal Information of California Consumers

In the preceding twelve months since this Notice was last updated, we disclosed Personal Information of California consumers to the following categories of third parties for the purposes of recruiting and job applications, managing employee relationship, IT and security, administering payroll and providing services, managing workload, displaying your image, enforcing our policies, legal and compliance, and other business activities:

• Third Parties and Service Providers.
  • Personal Information we disclosed[A2] : Identifiers, Categories of Personal Information in Cal. Civ. Code Section 1798.80(e), Characteristics of Protected Classifications under California or U.S. Federal Law, Internet or Other Electronic Network Activity Information, Geolocation Data, Sensory Information, Professional or Employment-Related Information/Position, Non-Public Education Information (as defined in 20 U.S.C. 1232g; 34 C.F.R. Part 99), Inferences Drawn from Personal Information, Sensitive Personal Information (Identifiers), Sensitive Personal Information (Log-In and Financial Information), Sensitive Personal Information (Precise Geolocation), Sensitive Personal Information (Group Membership), Sensitive Personal Information (Contents of Communications), Sensitive Personal Information (Personal Information Collected and Analyzed Concerning an Employee’s Health), and Sensitive Personal Information (Personal Information Collected and Analyzed Concerning an Employee’s Sex Life or Sexual Orientation).
• Government: Government entities.
  • Personal Information we disclosed: Identifiers, Categories of Personal Information in Cal. Civ. Code Section 1798.80(e), Characteristics of Protected Classifications under California or U.S. Federal Law,  Professional or Employment-Related Information/Position,  Sensitive Personal Information (Identifiers), Sensitive Personal Information (Group Membership), and Sensitive Personal Information (Personal Information Collected and Analyzed Concerning an Employee’s Sex Life or Sexual Orientation).[A3] 
• Partners: Business partners.
  • Personal Information we disclosed: Identifiers, Categories of Personal Information in Cal. Civ. Code Section 1798.80(e), Characteristics of Protected Classifications under California or U.S. Federal Law,  Professional or Employment-Related Information/Position,  Sensitive Personal Information (Identifiers), Sensitive Personal Information (Group Membership), and Sensitive Personal Information (Personal Information Collected and Analyzed Concerning an Employee’s Sex Life or Sexual Orientation).[A4] 
• Background Check Providers.
  • Personal Information we disclosed: Identifiers and Categories of Personal Information in Cal. Civ. Code Section 1798.80(e).[A5]

5. Cross-Border Data Transfers

SHIP8 INC.  may transfer your Personal Information to locations in other countries that have different data protection laws than those in the country in which you are based or work and may not provide the same level of protection for your Personal Information.
Where such transfers occur and where required by applicable law (such as in the Europe Economic Area (“EEA”) or in the United Kingdom (“UK”)), we will ensure that adequate protection exists either through appropriate contractual arrangements (such as Standard Contractual Clauses or the UK Addendum to the Standard Contractual Clauses), or as otherwise required or provided for by applicable law (such as relying on adequacy decisions by the UK government and/or the European Commission in which they determine that the country offers an adequate level of protection for Personal Information).
For additional information about these safeguards, please contact SHIP8 INC. ’s HR department.

6. Information Security and Integrity

We take the security of your Personal Information very seriously. We have in place appropriate legal, organizational, physical, and technical measures that are designed to improve the integrity and security of Personal Information that we collect and maintain and to protect Personal Information in conformity with applicable privacy and data security laws from loss, accidental destruction, misuse, and accidental or unauthorized access or disclosure. As required by applicable law, when SHIP8 INC.  retains a third-party service provider, that provider will be required to use measures to protect the confidentiality and security of the Personal Information and process the Personal Information only as directed by SHIP8 INC.
To the extent required by applicable law, we take reasonable steps to ensure that the Personal Information we process is reliable for its intended use, is accurate, up-to-date and complete, and is limited to the Personal Information required to carry out the purposes of the processing, as described in this Notice. However, you acknowledge that the no electronic medium or security measure is 100% secure and that we cannot provide any absolute assurance regarding the security of your Personal Information. We will not be liable in any way in relation to any breach of security or unintended loss or disclosure of information caused by us in relation to your Personal Information for reasons beyond our control.
More details about our information security practices are available on SHIP8 INC.  Connect for your reference.

7. Data Retention

We will retain your Personal Information only for as long as necessary to fulfill the purposes outlined in this Notice unless a longer retention period is required or permitted by applicable law. This means that in some cases, we may be required to retain your Personal Information for a period of time following termination of your relationship with SHIP8 INC. . When determining the retention period, SHIP8 INC.  considers various criteria, such as the amount, nature, and sensitivity of the Personal Information, the potential risk from unauthorized use or disclosure of your Personal Information, the purpose for which we process your Personal Information, and whether we can achieve those purposes through other means, the services offered by you, the mandatory retention periods provided by law, and the relevant statute of limitations.

8. Monitoring and Automated Decision Making

We may conduct monitoring activities in the course of conducting our business, to the extent permitted by applicable law. This can result in the collection of Personal Information from Employees, for instance through their use of SHIP8 INC. ’s IT resources. The situations in which monitoring can be used and the purposes for such monitoring include training and performance management, security/performance of IT systems, and investigations for a misconduct or other suspected illegal activity. When you use company-owned or company-provided information technology hardware or systems, you should not have the same expectation of privacy as you do with your personally-owned tools and equipment that are not used for SHIP8 INC. ’s business.
SHIP8 INC.  does not engage in the employment context in what is known as “automated decision making,” which involves making decisions with legal or similarly significant effects solely based on automated processing of Personal Information.

9. Your Personal Information Rights, Questions, and Complaints

Subject to applicable law and your location, you have certain rights with respect to our processing of your Personal Information, which include the right to:

• Request information about our processing of your Personal Information, including the basis on which we process your Personal Information;
• Access and obtain a copy of your Personal Information held by SHIP8 INC.  upon request;
• Rectify inaccurate Personal Information and complete it where it is incomplete;
• Transmit your Personal Information to you or to another company;
• Erase Personal Information as permitted under applicable law;
• Obtain restriction of processing pending your objections and challenges to our processing activities, for the time necessary to answer such objections and challenges;
• Object to the processing of your Personal Information based on our legitimate interests and to decisions resulting from automated processing; and
• Withdraw any consent that you have given to SHIP8 INC.  in connection with the processing of your Personal Information, without such withdrawal affecting the lawfulness of processing based on consent before its withdrawal.

If you would like to exercise any of these rights that apply to you, ask a question, or raise a complaint regarding the processing of your Personal Information by SHIP8 INC. , please contact SHIP8 INC.  as described in Section 12. Please note, however, that certain Personal Information or certain uses of your Personal Information may be exempt from these rights pursuant to applicable data protection laws. SHIP8 INC.  may also refuse to act or may impose limitations on your privacy requests if, for instance, your request is likely to adversely affect the rights and freedoms of SHIP8 INC.  or others, prejudice the execution or enforcement of the law, interfere with pending or future litigation, or infringe applicable law.

You have a right to lodge a complaint with the data protection authority in your country if you feel that your Personal Information has been mishandled.

Your California Privacy Rights

If you are a California resident, you may exercise the following rights.

• Right to Know. You may submit a verifiable request for information regarding the (i) categories of Personal Information collected, sold, or disclosed by us, (ii) purposes for which categories of Personal Information are collected or sold by us, (iii) categories of sources from which we collect Personal Information, (iv) categories of third parties to whom we disclosed or sold Personal Information, and (v) specific pieces of Personal Information we have collected about you in the preceding twelve months.
• Right to Delete. Subject to certain exceptions, you may submit a verifiable request that we delete Personal Information about you that we have collected from you.
• Right to Correct. You may submit a verifiable request that we correct inaccurate Personal Information that we maintain about you.
• Verification. Requests to know, delete, or correct Personal Information are subject to our ability to reasonably verify your identity in light of the information requested and pursuant to relevant CCPA requirements, limitations, and regulations.
• Right to Opt Out. In some circumstances, you may opt out of the sale or sharing (for cross-context behavioral advertising purposes) of your Personal Information. We do not sell or share (for cross-context behavioral advertising purposes) your Personal Information.
• Right to Limit Use and Disclosure of Sensitive Personal Information. We do not use or disclose your Sensitive Personal Information for purposes other than the limited purposes permitted by the CCPA. 
• Right of No Retaliation. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations, including if you are an Employee of our business.

10. Your Obligations

Please help keep your Personal Information up-to-date and inform us of any significant changes to your Personal Information. You can update your information through ADP in the U.S. or by contacting your payroll processor outside the U.S. You agree to inform your spouse, domestic/civil partner, or dependents whose Personal Information you provide to SHIP8 INC.  about the content of this Notice and to obtain their consent (provided they are legally competent to give consent and that such consent is valid under applicable law) for the use (including transfer and disclosure) of that Personal Information by SHIP8 INC.  as set out in this Notice.
You must follow applicable law and SHIP8 INC. ’s policies, standards, and procedures that are brought to your attention when handling any Personal Information about others to which you have access in the course of your relationship with SHIP8 INC. . In particular, you must not access or use any such Personal Information for any purpose other than in connection with, and to the extent necessary for, your work with SHIP8 INC. . Your obligation to keep the Personal Information of others confidential continues after termination of your relationship with SHIP8 INC. .
In certain circumstances you have obligations under your employment contract to provide us with Personal Information. In particular, you are required to report absences from work, and you may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide us with Personal Information in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Please note that failure to provide the Personal Information may mean that you are unable to exercise your statutory rights.

11. SHIP8 INC.’s Contact Information

If you have any questions, grievances, complaints, or comments about this Notice and/or our privacy practices, or if you would like to exercise your rights with respect to your Personal Information, please contact us using the contact information below. 

[A1]@SHIP8 INC. : We’ve left in all of the categories in this chart, including Geolocation, Sensitive Personal Information (Precise Geolocation), Biometric Information, and Sensitive Personal Information (Identifying Biometric Information).  Though these appear to be duplicative, these categories are all explicitly outlined in the CCPA.

[A2]@SHIP8 INC. : We’ve updated this to include the categories of Personal Information and Sensitive Personal Information of California consumers from the Personal Information of California Consumers chart above.

We included all categories marked as “disclosed” from the chart in this Third Parties and Service Providers section since SHIP8 INC.  likely discloses all of these categories to its service providers (e.g., hosting providers, applicant tracking system service provider, benefits platform service , etc.).

[A3]@SHIP8 INC. : These categories include name, demographic information, and compensation information.

[A4]@SHIP8 INC. : These categories include employee name, position, demographic information, and compensation information.