ONE OF CALIFORNIA'S FOREMOST MECHANICAL CONSTRUCTION firms

Please read this privacy policy carefully before providing any personal information to Lawson Mechanical Contractors a California Corporation, Lawson Mechanical Contractors, LLC, or Lawson SSP Group, LLC (hereinafter “Lawson”). This policy has been created in accordance with the California Consumer Privacy Act/California Privacy Rights Act (hereinafter “CPRA”). Lawson will only collect, use, retain, or share personal information as reasonably necessary and proportionate to achieve the purposes for which the information was collected or processed, or another disclosed and compatible purpose. By voluntarily providing personal data, using online portals associated with benefit plans sponsored by Lawson, or accessing its accounting software/applications, you acknowledge you have read and understood this policy and you consent to the collection, use, and disclosure of such data as set forth in this privacy policy.

Consumer Rights

1. Right to know what personal information is collected/what information is sold or shared and to whom. Consumers have the right to request that Lawson disclose (a) the categories of personal information it has collected about them; (b) the categories of personal information it has sold or shared about them; (c) the categories of sources from which the personal information was collected; (d) the business or commercial purpose for collecting, selling, and/or sharing personal information; (e) the categories of third parties to whom it discloses personal information; and (f) the specific pieces of personal information it has collected about The disclosure of the required information covers the 12-month period preceding the receipt of a verifiable consumer request. Lawson will provide information under this right to the same consumer a maximum of two times during a twelve month period.

2. Right to delete personal information. Consumers may request that Lawson delete any personal information
collected from them. When Lawson receives a verifiable request for deletion, it will delete the information
from its records, subject to exceptions, and notify service providers or contractors with whom Lawson shared
the personal information to delete it. Lawson will not delete personal information when it is reasonably
necessary to maintain the information in order to:

a. Complete a transaction for which the personal information was collected.
b. Ensure security and integrity.
c. Exercise free speech, ensure the right of another consumer to exercise their free speech, or exercise another right provided for by law.
d. Comply with any local or federal privacy or health regulation, including the California Electronic Communications Privacy Act.
e. Enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with LMC and compatible with the context in which the consumer provided the information.
f. Comply with legal obligations.

3. Right to correct inaccurate personal information. Consumers can request that inaccurate personal information be Lawson will use commercially reasonable efforts make requested corrections.

4. Right to opt out of the sale or sharing of personal information. Consumers have the right to direct Lawson not to sell or share their personal information to third parties. Consumers are hereby notified that Lawson does not sell the personal information of its consumers to any third parties.

5. Right to limit use and disclosure of sensitive personal information. Consumers have the right to restrict the use and disclosure of sensitive personal information collected to uses necessary to perform services expected by the consumer and as authorized by regulations. Sensitive personal information collected without the purpose of inferring characteristics about a consumer is not subject to this right and will be treated as personal information for the purposes of all other sections of the CPRA.

6. Right of no retaliation. Lawson will not discriminate or retaliate against a consumer, job applicant, or independent contractor for exercising their rights under the CPRA.

Exercising Consumer Rights

Lawson will respond in writing with 45 days of receipt of a verifiable request. Responses will be provided at no cost to consumers. Lawson will identify the categories of personal information collected, the categories of sources from which the consumer’s personal information was collected, the business purpose for collecting or sharing the personal information, and the categories of third parties to whom the information was disclosed.

The time period for Lawson to respond to an employee for any verifiable request may be extended by up to a total of 90 days where necessary, taking into account the complexity and number of the requests. Lawson will inform the employee of any such extension within 45 days of receipt of the request, together with the reasons for the delay.

If Lawson does not take action on a request, it will inform the employee within the time period permitted of response of the reasons for not taking action and any rights the employee may have to appeal the decision.

If requests from an employee are manifestly unfounded or excessive, Lawson may either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request and notify the employee of the reason for refusing the request.

Requests may be submitted online at https://www.lawsonmechanical.com/contact/, via email at hr2@lawsonmechanical.com, via telephone at P. 844.368.0500, or via a mail at Lawson Mechanical Contractors, LLC, Attn: Human Resources, 6090 S. Watt Ave., Sacramento, CA 95829.

Categories of Personal Information Collected During the Preceding Twelve Months:

1. Personal information. Name, former name/aliases, date of hire, signature, Social Security number, date of birth, physical characteristics or description, postal address, telephone number, passport number, emergency contact, personal physician, tax withholdings, driver’s license or state identification card number, criminal background, place of birth, union membership, insurance policy number, education, beneficiaries, employment history, email address, internet protocol (IP) address, dependent information, bank account number, billing address, credit card number, debit card number, or any other financial information, medical information, or health insurance information. The contents of mail, email, and text messages are included as personal information, unless Lawson is the intended recipient of the communication.
2. Protected classification characteristics. Race, creed, religion, color, national origin, ancestry, physical or mental disability, medical condition, marital status, registered domestic partner status, sex, gender, gender identity, gender expression, age, sexual orientation, reproductive health decisions, and military or veteran status. Lawson does not collect genetic information nor would it expect genetic information to be disclosed under leave or accommodation requests.
3. Internet or other similar network activity. Browsing history, search history, and information on interaction with a website.
4. Geolocation data. Physical location by IP address for electronic signatures.
5. Professional or employment-related information. Current or past job history or performance evaluations.

Categories of Personal Information Lawson Shares or Sells for a Business Purpose:

1. Lawson shares the following categories of information to service providers: personal information, characteristics of protected classifications, sensitive personal information, and geolocation data.
2. Lawson does not sell any consumer or employee information.

Categories of Third Parties to Whom Lawson Discloses Personal Information

1. Insurance and benefit administrators and/or carriers.
2. Third parties to comply with legal and/statutory requirements and recordkeeping.
3. Payment processors.
4. Financial institutions.
5. Mortgage brokers.
6. Property managers
7. Government entities.
8. Construction project owners and/or general contractors.
9. Union fringe benefit fund administrators4. Financial institutions.

Sources of Personal Information Collected:

1. Applicants provide information when completing an Application for Employment or when providing their resume.
2. Employees provide their personal information when they:
a. Complete a New Hire Packet.
b. Submit an Expense Report Form or Concur reimbursement request.
c. Provide a doctor’s note to establish a need for a government mandated leave of absence or request an accommodation.
d. Provide data to create an Apple ID for their use of an Lawson provided Apple device.
e. Request a religious or medical exemption for a jobsite with a specific health screening requirement.
f. Complete a direct deposit enrollment form.
g. Provide a revised Employee’s Withholding Certificate (W-4) form.
h. Complete a Workers’ Compensation Claim Form (DWC 1).
i. Provide documentation evidencing a qualifying event that changes benefits eligibility for themselves and/or their dependents.
j. Participate in client required background checks.
k. Use service provider portals or applications to enroll and/or participate in Lawson benefit programs.
l. Provide driving records required per Federal law.
m. Digitally sign documents via DocuSign.
n. Provide information relating to a protected class status.
3. Health clinics transmit pre-screening results or work status reports for injured employees.
4. Union representatives provide data on dispatch notices.
5. Client data is collected on an Lawson Credit Card Payment Authorization Form for customers that opt to pay for services using a personal credit card.

Business Purpose for Collecting/Sharing Personal Information

1. Screening job applicants.
2. Administering health, welfare, and retirement benefits.
3. Confirming individuals are legally authorized to work in the United States.
4. Administering payroll and processing automated deposits to an employee’s selected banking institution(s).
5. Performing tax reporting (e.g., federal/state reporting, tax credits, and business tax returns).
6. Auditing processes (e.g., year-end auditing of company general ledger, public auditing of accounting procedures, union trust reporting, and workers compensation wage auditing).
7. Ongoing motor vehicle record review for vehicle safety program compliance.
8. Pre-designation of a personal physician for treatment under a workers compensation program.
9. Compliance reporting (e.g., certified payroll, state benefit auditing, workers compensation reporting, EEO surveys, Bureau of Labor Statistics, and economic census).
10. Employment verification (e.g., banking, lenders, rentals, housing, and legal court orders, including garnishments).
11. Contract billing (e.g., contractual billing submissions, change order tracking/pricing, and extended overhead claims).
12. Building an account for use on company provided devices, including iPhones and iPads.
13. Creating or updating physical and digital employee files.
14. Processing religious, disability, or medical accommodation requests.
15. Background check screening at the direction of clients for construction jobsites that require heightened levels of security or protection of minors (e.g., prisons, schools, etc.).
16. Employment health screening at the direction of clients for construction jobsites with vulnerable populations (e.g., populated medical facilities).
17. Compliance with DOT and FMCRA procedural and recordkeeping requirements for commercial drivers.
18. Submitting a medical claim to Lawson’s workers compensation insurance carrier via Lawson’s third party claims administrator.
19. Conforming to IRS mandates regarding documentation maintenance for reimbursement of employee expenditures.
20. Processing leave requests.
21. Processing payments from Lawson customers that opt to use their personal credit cards.

Personal Information Storage/Security

1. Application and employment records are maintained as mandated under employment law.
2. Background check records are kept on file for a minimum of two years.
3. Health screening records are kept on file for the duration of a project and throughout the warranty period. They may be kept on file for longer, if they will also be used to qualify the employee for future work.
4. Credit card information is used to process a single credit card transaction. After the transaction is completed, all identifying personal information is redacted. The redacted form is stored with the credit card receipt on a network drive, with limited role-based user access, on a firewall-protected network server.
5. Injury records are maintained per OSHA and State of California recordkeeping requirements.
6. Electronic data is stored on a restricted Lawson network drive, which has limited role-based user access and is on a firewall-protected network server.
7. Websites and portals maintained by third party administrators or providers have secure server software that encrypts personal information. Access requires the use of unique usernames and strong passwords. All providers maintain safeguards that comply with federal and state regulations to guard non-public personal information.

Exemptions

CPRA obligations imposed on Lawson shall not restrict its ability to:
1. Comply with federal, state, or local laws or comply with a court order or subpoena to provide information.
2. Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.
3. Cooperate with law enforcement agencies concerning conduct or activity that Lawson, a service provider, or a third party reasonably and in good faith believes may violate federal, state, or local law.
4. Cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury provided that:
a. The request is approved by a high-ranking agency officer for emergency access to a consumer’s personal information.
b. The request is based on the agency’s good faith determination that it has a lawful basis to access the information on a nonemergency basis.
c. The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.
5. Exercise or defend legal claims.
6. Collect, use, retain, sell, share, or disclose consumers’ personal information that is de-identified or aggregate consumer information.

Personal information does not include publicly available information from government records, deidentified or aggregated consumer information, health or medical information covered by local and federal regulations, or data covered by certain sector-specific state and federal privacy laws. A verifiable employee request for specific pieces of personal information, to delete personal information, or to correct inaccurate personal information, does not extend to personal information about the employee that belongs to, or that Lawson maintains on behalf of, another natural person. Also, exempted:
1. Personal information collected as a job applicant to, an employee of, owner of, director of, officer of, or independent contractor of Lawson to the extent the information is collected and used solely within the context of that person’s role or former role.
2. Emergency contact information collected and used solely within the context of having an emergency contact on file.
3. Personal information necessary for Lawson to retain to administer benefits.

Lawson may rely on representations made in a verifiable employee request as to rights with respect to personal information and is under no legal requirement to seek out other persons that may have or claim to have rights to personal information. Lawson is under no legal obligation to take any action in the event of a dispute between or among persons claiming rights to personal information in Lawson’s possession.

Lawson is not liable if a service provider, contractor, or third party receiving personal information uses that information in violation of CPRA restrictions without Lawson’s knowledge.

The right to delete and the right to opt out do not apply to Lawson’s use or disclosure of particular pieces of an employee’s personal information if the employee has consented to the use or disclosure of that information to produce a physical item if Lawson has incurred significant expense in reliance on the employee’s consent and compliance with the employee’s request to delete the employee’s personal information would not be commercially reasonable. Lawson will comply with the employee’s request as soon as it is commercially reasonable to do so.

Changes to Lawson’s Privacy Policy

Lawson reserves the right to amend this Privacy Policy at its discretion and at any time. At a minimum, this policy will be updated annually. When we make changes, we will post the updated Policy on the website and update the Policy’s effective date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Contact Information

If you have any questions or comments about this Policy, the ways in which Lawson collects and uses your information described above, your choices and rights regarding such use, or wish to exercise your rights, please do not hesitate to contact us at: https://www.lawsonmechanical.com/contact/, hr2@lawsonmechanical.com, P. 844.368.0500, or Lawson Mechanical Contractors, Attn: Human Resources, 6090 S. Watt Ave., Sacramento, CA 95829.

Effective Date: January 1, 2024.