California Privacy Notice

Effective Date: January 1, 2024

This Privacy Notice for California Consumers (“Notice”) reflects our understanding of the California Consumer Privacy Act ("CCPA") 2018, Cal. Civil Code Section 1798.100 et. seq., as amended, and the California Privacy Rights Act of 2020 ("CPRA"). This CA Policy provides you with the necessary information about the personal information we collect, how this information may be used by FrankCrum, your privacy rights, and FrankCrum's obligations in accordance with the aforementioned privacy laws.

This CA Policy supplements the information contained in FrankCrum's Privacy Policy here and applies solely to all visitors, users, and others who reside in the State of California ("consumers" or "you"). It applies solely to natural persons residing in California ("Consumers") and does not apply to individuals living elsewhere, businesses or other corporate entities. We adopt this notice to comply with the CCPA/CPRA, and any terms defined in the CCPA/CPRA have the same meaning when used in this CA Policy.

This CA Policy is a supplement to FrankCrum’s Privacy Policy.  Should this CA Policy conflict with FrankCrum’s Privacy Policy, this CA Policy shall prevail in regard to Consumers and their rights under CCPA/CPRA. 

This CA Policy covers the collection, use, disclosure, sale of Consumers’ Personal Information and Sensitive Personal Information as defined in the CCPA/CPRA.

Consumer Rights

Right to Access

You have the right to access PI which we may collect or retain about you.  If requested, we shall provide you with a copy of your PI which we collect as permitted by the CCPA/CPRA.

You also have the right to receive your PI in a structured and commonly used format so that it can be transferred to another entity (“Data portability”).

Right to Know

You have the right to request that we disclose the following about your PI, as defined by the CCPA/CPRA:

• The specific PI we may collect;
• The categories of PI we may collect;
• The categories of sources from which we may collect your PI;
• The business purpose(s) for so collecting or sharing your PI;
• The categories of PI we may disclose for business purposes; and
• The categories of third parties to whom we share your PI. 

Right to Opt-Out/Do Not Sell My Personal Information

FrankCrum does not sell PI within the meaning of the CCPA/CPRA.

Do Not Share or Disclose My Sensitive Personal Information

You have the right to limit how your SPI is disclosed or shared with third parties, as defined in the CCPA/CPRA.

Right to Deletion

In certain circumstances, you have the right to request the erasure of your PI.  Upon verifying the validity of a deletion request, we will delete your PI from our records, and instruct any service providers or third parties to delete your information, when applicable.

Right to Correction/Right to Rectification

In certain circumstances, you have the right to request correction of any inaccurate PI.  Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your PI as directed, taking into account the nature of the PI and the purposes of maintaining your PI.

Please note that the above rights are not absolute and we may be entitled to refuse requests, wholly or in part, where exceptions under applicable law apply.

Exercising Your Rights

If you are a California resident, you can exercise any of your rights as described in this CA Policy and under applicable privacy laws by using the contact information provided in this CA Policy.  We will not discriminate against you for exercising such rights.  Except as described in this CA Policy or provided for under applicable privacy laws, there is no charge to exercise your legal rights.

However, if your requests are manifestly unfounded or excessive, in particular, because of their repetitive character, we may:

• Charge a reasonable fee, taking into account the administrative costs of providing the information or taking the action requested; or
• Refuse to act on the request and notify you of the reason for refusing the request.

Verifying Consumer Requests

Any request you submit to us is subject to an identification and residency verification process, defined as a Verifiable Consumer Request under CCPA/CPRA.  This process may consist of our Privacy Team verifying your identity through established processes or asking you to confirm information previously submitted to FrankCrum.

We are unable to complete your request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected personal information.  Please follow the instructions on our Subject Access Request Form and respond timely to any inquiries we make.  You may also contact the Privacy Team at Privacy@frankcrum.com or 1-800-393-0815, Option 21. 

You may only make a verifiable consumer request for access or data portability twice within a 12-month period.  The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collect personal information or an authorized representative.
  

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  If we cannot comply with your request, we will explain the reason in our response.  You are not required to create an account with us to make a request.  We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.  We will track and document request responses unless you also give personal information to us for another purpose.

We make commercially reasonable efforts to identify personal information collected, processed, stored, disclosed, or otherwise used to respond to your Consumer Privacy Rights request.

Information We Collect

FrankCrum collects information that identifies, relates to, describes, references is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("personal information").   Further, we could collect a subset of personal information that requires greater security protections and standards of care in handling because, if lost, compromised, or disclosed, could result in substantial harm, embarrassment inconvenience, or unfairness to an individual (“sensitive personal information”).  

In particular, Utilized Individual Applications and required forms, FrankCrum's websites, www.frankcrum.com, www.fwcruminsurance.com, www.frankcrumstaffing.com, and FrankCrum’s employee portal, www.myfrankcrum.com, mobile applications, and the correspondence we have with clients, job applicants, vendors, service providers, third party affiliates, and utilized employees.

 
FrankCrum has collected the following categories of personal information and sensitive personal information from its consumers within the last twelve (12) months:

 

Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA's scope, like:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

FrankCrum reserves the right to convert or permit other service providers to convert your PI or SPI into de-identified data or aggregate consumer information.  We have no obligation to re-identify such information or keep it longer than we need it to respond to your requests.  This allows us to keep data at a minimum and in line with our data retention and security policies.

How Personal Information is Collected

FrankCrum obtains the categories of PI and SPI listed above from the following categories of sources:

• Publicly accessible sources;
• Directly from a third party for background checks;
• A third party, with your consent;
• Consultants or other professionals we may engage, with your consent;
• Directly from you. For example, from forms you complete or products and services you purchase.
• Indirectly from you. For example, from observing your actions on our Website through cookies (please view our Privacy Policy for more information).
• Our timeclock system, with your consent.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders.
• To provide, support, personalize, and develop our Website, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests, purchases, transactions, and payments and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, third-party sites, and via email or text message with your consent, where required by law.
• To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business.
• For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.
• To respond to law enforcement requests, attorneys, accountants, and auditors and as required by applicable law, court order, or governmental regulations.
• To protect FrankCrum’s rights, property or safety, our business partners, or other third parties/vendors/service providers under U.S. Law.
• Social Media and Public Websites
• Employee and Customer Referrals
• For job placement/recruiting
• To work with third party affiliates such as third parties that offer discounted products, services, or benefits or products we re-sell or license, such as time clocks.
• To post notices and legal updates as required by law.
• To provide marketing materials and communications for our products and services including those of our business partners and/or service providers.
• Our employees, affiliated companies, subsidiaries, agents, and service providers with whom we contract to perform services related to our clients’ and employees’ accounts, to offer additional services, perform analysis to determine qualification to receive future services or collect amounts due.
• Banking and brokerage firms to complete payroll processing and securities transactions.
• Credit bureaus and similar organizations, law enforcement or government officials.  We reserve the right to release information if we are required to do so by law or if, in our business judgment, such disclosure is reasonably necessary to comply with legal process, in a fraud investigation, an audit or examination.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.
• To report workers’ compensation claims, administration of workers’ compensation claims, and communicate with our workers’ compensation vendors (service providers) in regards to injuries sustained, treatment, and return to work.
• To effectuate coverage with insurance carriers (service providers) in an employee benefit plan per your request.  Employee benefit plans may include health, dental, supplemental benefits such as accident or cancer policies, life insurance, vision, and 401(k), if applicable.

FrankCrum will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

FrankCrum may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We share your personal information with the following categories of third parties:

• Client Companies
• Recruiting Service Providers
• Health and Welfare Service Providers
• Financial Service Providers
• Billing Service Providers
• Printing Service Providers
• Cloud providers, customer management platforms, security providers, and similar services in connection with providing products, services and in the support of daily operations. 
• Workers’ Compensation Service Providers
• Other Insurance Lines Service Providers
• IT Service Providers, including security, backup, and data hosting providers
• Timekeeping Hardware/Software Service Providers
• Drug Testing Service Providers
• Employment Screening Service Providers
• Website Analytics Service Providers
• Data Aggregators such as Google Analytics
• Law enforcement, public/regulatory bodies, accountants, attorneys, or judicial authorities in response to subpoenas, court orders, search warrants, legal processes or governmental regulations
• Any third party to whom you give us consent.  If you are a utilized individual/leased employee, we will share your information with our client company who employs you.
• Other FrankCrum entities or for the purpose of a company sale, assignment, merger to another business entity.
• Any other entity disclosed by FrankCrum when you provide information, or for which you provide authorization.

Disclosures of Personal Information for a Business Purpose

In the preceding twelve (12) months, FrankCrum has disclosed the following categories of personal information for a business purpose:

• Category A: Identifiers.
• Category B: California Customer Records personal information categories.
• Category C: Protected classification characteristics under California or federal law.
• Category D: Commercial information.
• Category E: Biometric information.
• Category F: Internet or other similar network activity.
• Category G: Geolocation data.
• Category I: Professional or employment-related information.

The Business Purpose for collecting and sharing personal information is listed above in the Collection and Personal Information Table.

Sales of Personal Information/Opt-outs

In the preceding twelve (12) months, FrankCrum believes there has been no sale of personal information as defined under CCPA/CPRA.  Should that change in the future, FrankCrum will update the CA Policy and provide a method to opt-out of a sale.  Until that time, we will treat all personal information as under a Do Not Sell request.  We will endeavor to restrict use of your personal information to only the business purpose for which it was collected with that associated service provider. If you direct us to share your personal information, these requests are not sales.  Further, the exchange of your personal information in between our Corporate entities is not considered a sale.

Do Not Track (DNT) is a privacy preference that can be set on your browser if you do not want web services to collect information about your online activity.  However, there is currently no universal standard for sending and receiving DNT signals. Due to this lack of universal standard, it would be impossible for us to promise that we comply with all known and unknown DNT standards.  Therefore, we do not believe these constitute a Do Not Sell request by you. 

Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights. 

Access to Specific Information and Data Portability Rights

1. Consumers have the right to request certain information about FrankCrum’s collection and use of PI (the “Right to Know”) or access to specific pieces of PI (the “Specific request to Know”).  Consumers are limited to two requests per twelve-month period.

2. Consumers have the right to request correction of PI (the “Right to Correct”).  Consumers may correct PI by requesting to do so through FrankCrum.

3. Consumers have the right to request deletion of PI (the “Right to Delete”).  Note, this is subject to certain exceptions under CCPA/CPRA.  Deletion of PI may occur once FrankCrum verifies the Consumer’s identity and determines no exception is applicable.

• Exceptions applicable are deleting all PI collected necessary to provide services to the Consumer that was requested or required for an ongoing relationship with FrankCrum, or otherwise required to fulfill our contractual obligations; and/or
• Is otherwise permitted under the CCPA/CPRA.

Exercising Access, Data Portability, and Deletion Rights

Consumers have the right to exercise these rights through an authorized agent who meets the requirements under the CCPA.  An authorized agent shall submit a request as noted below and FrankCrum will forward the necessary form for the consumer’s completion under the CCPA.  The Authorized Agent may then submit the Authorized Agent form along with the request.  If the Authorized Agent holds a power of attorney (POA), the POA may be submitted instead of the Authorized Agent form.

Any request you submit to us is subject to an identification and residency verification process, defined as a Verifiable Consumer Request under CCPA.  This process may consist of our Privacy Team verifying your identity through established processes or asking you to confirm information previously submitted to FrankCrum.

We are unable to complete your request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected personal information.  Please follow the instructions on our Subject Access Request Form and respond timely to any inquiries we make.  You may also contact the Privacy Team at Privacy@FrankCrum.com or 1-800-393-0815, Option 21.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  If we cannot comply with your request, we will explain the reason in our response.  You are not required to create an account with us to make a request.  We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request. We will track and document request responses, unless you also give personal information to us for another purpose.

We make commercially reasonable efforts to identify personal information collected, processed, stored, disclosed, or otherwise used to respond to your Consumer Privacy Rights requests. 

Response Timing and Format

We will confirm receipt of a request within ten (10) business days.  We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days days), we will inform you of the reason and extension period in writing.

We will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

It is vital to note that we will not deliver to you your social security number, drivers’ license number or other government-issued identification number, account password, or security questions or answers in response to your request.  These items will be redacted in the interest of the security of your personal information.  If you do have an account with us, you may be able to access some of this personal information by logging into your account.

Other California Notices

Third-Party Marketing Rights

California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us using any of the contact information method(s) in the Contact Information section below.  Please ensure any request is clearly noted with “California Privacy Rights Request” for accurate processing. Please also include your name, address, city, state, and zip code.  Not all information sharing is covered under this law and FrankCrum will only include information on covered sharing for California Consumers in our response.

Changes to Our Privacy Policy

FrankCrum reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice's effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this notice, the ways in which FrankCrum collects and uses your information described below and in the FrankCrum Privacy policy here your choices and rights regarding such use, or if you wish to exercise your rights under California law, please do not hesitate to contact FrankCrum’s Privacy Team at:

Phone: 1-800-393-0815, Option 21 Website: FrankCrum.com Email: Privacy@FrankCrum.com

Postal Address: FrankCrum Attn: Compliance Counsel 100 S. Missouri Ave. Clearwater, FL 33756