California Employer Privacy Notice
This Privacy Notice ("Privacy Policy" or "Policy") applies solely to individuals that reside in the State of California who are employees, job applicants, officers, directors, owners and independent contractors ("Workers") of Gulf, Inc. and its affiliates ("Company", "we" or "us"). We adopt this Policy to comply with the California Consumer Privacy Act of 2018 and any subsequent amendments, including the California Consumer Privacy Act ("CPRA"). Any terms defined in the CPRA have the same meaning when used in this Policy.
Personal information we collect
Information you provide
As part of your working relationship with us, we ask you to provide and update as necessary certain personal information and sensitive personal information. The personal information that you may be asked to provide may include:
• Name
• Contact information, including home address, home telephone, mobile telephone and email address
• Date of birth
• Tax Identification or other government identification number
• Work history
• Education history and results
• Citizenship
• Eligibility or right to work
• Interest in career opportunities
• Job specific questions that relate to your fitness for a particular position
• Employment history
• Log-in and other authentication information you use to validate your identity when accessing our facilities and systems
• Bank account and/or financial data to process payroll
• salary and salary history (relating to your engagement with us)
• bonus and commission participation and history
• deductions (tax and social security, garnishments, loan repayments, if applicable)
• details of equity participation in group company equity
In some circumstances, we may ask individuals to self-identify certain personal information such as their ethnicity, gender, veteran status, and disability information. Providing this information is voluntary and your decision to provide or withhold any of this information will not negatively impact your employment in compliance with applicable state and federal laws. If you decline to provide certain of these characteristics (e.g., race/ethnicity) about yourself, we may need to identify by reference to records or visual observation for compliance reporting purposes.
We will treat any personal information considered sensitive under applicable law in accordance with that applicable law. The collection and use of sensitive personal information will be limited to that which is strictly necessary for the purposes for which it was collected. Your explicit consent will be obtained to the processing of your sensitive personal information, unless otherwise permitted by applicable law.
Personal information we collect in the course of your engagement
As part of your working relationship with us, you will use our IT resources, and physical controls which we use to manage and administer our workforce and workplace and we may collect your personal information related to this use. For example, we may observe your actions as a Worker, record and store records of your use of our information technology, or activate location-tracking enabled devices connected to any company assets you may use as part of your work.
Personal information we collect about you from others
We also collect personal information and limited sensitive personal information from third parties, such as your bank, your co-workers, and government databases. For example, what we collect includes:
• interview notes, performance reviews and ratings and other inferences
• details of any grievances or disciplinary processes and outcomes
• information related to facilities and systems usage including on our computing assets and on your personal computing assets if using them to access our facilities and systems
• network and premises access including CCTV footage in public areas
• content of email, chat and other business communications on our systems
• details of trainings required and completed
• information on work related accidents
• information related to your health, leaves and benefits (including information related to your health and family which may be sensitive personal information) for administration of accommodations, leaves and benefits • verification of employment and education history
• credit history and credit reports as permitted by applicable law
• criminal background check information limited to criminal history records as permitted by applicable law
How we use personal information
Any personal information collected will be used to:
• enable us to administer and manage our workforce and relevant programs, including benefits programs
• performance assessment purposes, including undertaking promotion and succession planning
• comply with any applicable legal and regulatory requirements involving Workers, which may include providing reports to government agencies
• verify your identity to ensure security for one of the other purposes listed in this policy
• maintain your Worker records
• ensure or enhance the security and functionality of our electronic systems
• protect against fraud
• conduct internal investigations and comply with our policy and legal obligations.
Personal information is used only in ways that are compatible with the purposes described in this policy. We will provide notice to you if your information will be used for other purposes.
We take commercially reasonable steps to ensure that the personal information we collect is relevant to its intended use and is accurate, up-to-date, and complete.
Sharing of personal information
Within our company and group of companies
Because we have operations in many different locations, we may transfer your information from one legal entity to another or from one location to another in order to accomplish purposes listed in this Policy. We will transfer your personal information in a manner that is consistent with applicable legal requirements.
With Third Parties
We may share your personal information with third parties to:
• service providers we have retained to perform services on our behalf
• comply with legal obligations, including in response to a legitimate legal request from law enforcement authorities or other government regulators
• maintain the security and integrity of our networks and systems
• investigate suspected or actual illegal activity
• prevent physical harm or financial loss
• support the sale or transfer of all or a portion of our business or assets (including through bankruptcy)
All of our service providers will use personal information only for the purposes identified in this policy and will provide services under a contract which restricts use of information to that which is necessary to perform services on our behalf or to comply with legal requirements.
Access & Correction
As a California resident, you have a right to inquire about the personal information we collect, use, disclose and sell about you and the right to request deletion, subject to certain limitations. Please "Contact Us" section below for information on how to exercise such rights. To access or change your information, you can log into your profile and make any corrections or deletions required. If you have questions or concerns, contact us by emailing privacy@gulfinc.com
Non-discrimination
As a California resident, California law does not permit us to discriminate or retaliate against you because you exercised certain privacy rights under CPRA.
Safeguards
We have in place physical, electronic and procedural safeguards appropriate to the sensitivity of the information we maintain. Safeguards will vary depending on the sensitivity, format, location, amount, distribution and storage of the personal information. They include physical, technical, and managerial measures to keep personal information protected from unauthorized access. However, due to the nature of the internet and related technology, we cannot absolutely guarantee the security of personal information, and we expressly disclaim any such obligation.
Data Retention
We retain personal information as is reasonably necessary to fulfill the purposes described in this Policy. We retain your personal information as long as necessary during your engagement, during any transition period (e.g., for the provision of ongoing benefits) or to comply with applicable legal obligations and record retention requirements.
We determine how long to retain your personal information by reference to applicable law or regulation, court, administrative or arbitration proceedings, or audit requirements.
Changes to this Policy
As our company evolves, we expect to update this policy from time to time without prior notice. We encourage you to review this Policy on a regular basis for any changes.
Designating an Authorized Agent
California law permits California residents to designate an agent to manage their rights under California law. If qualify and you would like to designate an agent to manage your privacy preferences, you may do so using the mechanisms noted below under "Exercising California Privacy Rights". We will also need sufficient Personal Information about your authorized agent to be able to identify them. As part of this process, you must have permission from your authorized agent to disclose their Personal Information to us for the purpose of acting as your agent.
Exercising California Privacy Rights
If you are a California resident and would like to exercise any of your rights you may do so by contacting us by using the contact particulars noted in the "Contact Us" section below.
Contact Us
If you have any comments or questions, please email privacy@gulfinc.com.
If you are a California resident and wish to exercise your rights under the CPRA, please email privacy@gulfinc.com or write to the address below. We will confirm receipt without delay and endeavor to substantively respond within 45 days of receipt of your request. If you do not receive a response from us within 30 days, please contact us by phone at 770.431.7600 ext. 1200. If we require more time, we will let you know how long we need and why.
If you have questions about our privacy practices general, or wish to report a violation of the provisions of this Policy, please email us, or write to the following address:
Gulf, Inc.
Attn: Privacy Officer, Legal
492 Old Connecticut Path Suite 600
Framingham, MA 01701
Date this Policy was last updated: September 1, 2025.