ONE OF CALIFORNIA'S FOREMOST MECHANICAL CONSTRUCTION firms

Please read this privacy policy carefully before providing any personal information to Lawson Mechanical Contractors, LLC or Lawson Mechanical Contractors a California Corporation (hereinafter “LMC”). This policy has been created in accordance with the California Consumer Privacy Act/California Privacy Rights Act (hereinafter “CPRA”). LMC will only collect, use, retain, or share personal information as reasonably necessary and proportionate to achieve the purposes for which the information was collected or processed, or another disclosed and compatible purpose. By voluntarily providing personal data, using online portals associated with benefit plans sponsored by LMC, or accessing its accounting software/applications, you acknowledge you have read and understood this policy and you consent to the collection, use, and disclosure of such data as set forth in this privacy policy.

Consumer Rights
1. Right to know what personal information is collected/what information is sold or shared and to whom. Consumers have the right to request that LMC disclose (a) the categories of personal information it has collected about them; (b) the categories of personal information it has sold or shared about them; (c) the categories of sources from which the personal information was collected; (d) the business or commercial purpose for collecting, selling, and/or sharing personal information; (e) the categories of third parties to whom it discloses personal information; and (f) the specific pieces of personal information it has collected about them. The disclosure of the required information covers the 12-month period preceding the receipt of a verifiable consumer request. LMC will provide information under this right to the same consumer a maximum of two times during a twelve month period.

2. Right to delete personal information. Consumers may request that LMC delete any personal information collected from them. When LMC receives a verifiable request for deletion, it will delete the information from its records, subject to exceptions, and notify service providers or contractors with whom LMC shared the personal information to delete it. LMC will not delete personal information when it is reasonably necessary to maintain the information in order to:

a. Complete a transaction for which the personal information was collected.
b. Ensure security and integrity.
c. Exercise free speech, ensure the right of another consumer to exercise their free speech, or exercise another right provided for by law.
d. Comply with any local or federal privacy or health regulation, including the California Electronic Communications Privacy Act.
e. Enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with LMC and compatible with the context in which the consumer provided the information.
f. Comply with legal obligations.

3. Right to correct inaccurate personal information. Consumers can request that inaccurate personal information be corrected. LMC will use commercially reasonable efforts make requested corrections.

4. Right to opt out of the sale or sharing of personal information. Consumers have the right to direct LMC not to sell or share their personal information to third parties. Consumers are hereby notified that LMC does not sell the personal information of its consumers to any third parties.

5. Right to limit use and disclosure of sensitive personal information. Consumers have the right to restrict the use and disclosure of sensitive personal information collected to uses necessary to perform services expected by the consumer and as authorized by regulations. Sensitive personal information collected without the purpose of inferring characteristics about a consumer is not subject to this right and will be treated as personal information for the purposes of all other sections of the CPRA.

6. Right of no retaliation. LMC will not discriminate or retaliate against a consumer, job applicant, or independent contractor for exercising their rights under the CPRA.

Exercising Consumer Rights
LMC will respond in writing with 45 days of receipt of a verifiable request. Responses will be provided at no cost to consumers. LMC will identify the categories of personal information collected, the categories of sources from which the consumer’s personal information was collected, the business purpose for collecting or sharing the personal information, and the categories of third parties to whom the information was disclosed.

The time period for LMC to respond to an employee for any verifiable request may be extended by up to a total of 90 days where necessary, taking into account the complexity and number of the requests. LMC will inform the employee of any such extension within 45 days of receipt of the request, together with the reasons for the delay.

If LMC does not take action on a request, it will inform the employee within the time period permitted of response of the reasons for not taking action and any rights the employee may have to appeal the decision.

If requests from an employee are manifestly unfounded or excessive, LMC may either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request and notify the employee of the reason for refusing the request.

Requests may be submitted online at https://www.lawsonmechanical.com/contact/, via email at hr2@lawsonmechanical.com, via telephone at P. 844.368.0500, or via a mail at Lawson Mechanical Contractors, Attn: Human Resources, 6090 S. Watt Ave., Sacramento, CA 95829.

Categories of Personal Information Collected During the Preceding Twelve Months:
1. Personal information. Name, former name/aliases, date of hire, signature, Social Security number, date of birth, physical characteristics or description, postal address, telephone number, passport number, emergency contact, personal physician, tax withholdings, driver’s license or state identification card number, criminal background, place of birth, union membership, insurance policy number, education, beneficiaries, employment history, email address, internet protocol (IP) address, dependent information, bank account number, billing address, credit card number, debit card number, or any other financial information, medical information, or health insurance information. The contents of mail, email, and text messages are included as personal information, unless LMC is the intended recipient of the communication.
2. Protected classification characteristics. Race, creed, religion, color, national origin, ancestry, physical or mental disability, medical condition, marital status, registered domestic partner status, sex, gender, gender identity, gender expression, age, sexual orientation, reproductive health decisions, and military or veteran status. LMC does not collect genetic information nor would it expect genetic information to be disclosed under leave or accommodation requests.
3. Internet or other similar network activity. Browsing history, search history, and information on interaction with a website.
4. Geolocation data. Physical location by IP address for electronic signatures.
5. Professional or employment-related information. Current or past job history or performance evaluations.

Categories of Personal Information LMC Shares or Sells for a Business Purpose:
1. LMC shares the following categories of information to service providers: personal information, characteristics of protected classifications, sensitive personal information, and geolocation data.
2. LMC does not sell any consumer or employee information.

Categories of Third Parties to Whom LMC Discloses Personal Information
1. Insurance and benefit administrators and/or carriers.
2. Third parties to comply with legal and/statutory requirements and recordkeeping.
3. Payment processors.
4. Financial institutions.
5. Mortgage brokers.
6. Property managers.
7. Government entities.
8. Construction project owners and/or general contractors.
9. Union fringe benefit fund administrators.

Sources of Personal Information Collected:
1. Applicants provide information when completing an Application for Employment or when providing their resume.
2. Employees provide their personal information when they:
a. Complete a New Hire Packet.
b. Submit an Expense Report Form or Concur reimbursement request.
c. Provide a doctor’s note to establish a need for a government mandated leave of absence or request an accommodation.
d. Provide data to create an Apple ID for their use of an LMC provided Apple device.
e. Request a religious or medical exemption for a jobsite with a specific health screening requirement.
f. Complete a direct deposit enrollment form.
g. Provide a revised Employee’s Withholding Certificate (W-4) form.
h. Complete a Workers’ Compensation Claim Form (DWC 1).
i. Provide documentation evidencing a qualifying event that changes benefits eligibility for themselves and/or their dependents.
j. Participate in client required background checks.
k. Use service provider portals or applications to enroll and/or participate in LMC benefit programs.
l. Provide driving records required per Federal law.
m. Digitally sign documents via DocuSign.
n. Provide information relating to a protected class status.
3. Health clinics transmit pre-screening results or work status reports for injured employees.
4. Union representatives provide data on dispatch notices.
5. Client data is collected on an LMC Credit Card Payment Authorization Form for customers that opt to pay for services using a personal credit card.

Business Purpose for Collecting/Sharing Personal Information
1. Screening job applicants.
2. Administering health, welfare, and retirement benefits.
3. Confirming individuals are legally authorized to work in the United States
4. Administering payroll and processing automated deposits to an employee’s selected banking institution(s).
5. Performing tax reporting (e.g., federal/state reporting, tax credits, and business tax returns).
6. Auditing processes (e.g., year-end auditing of company general ledger, public auditing of accounting procedures, union trust reporting, and workers compensation wage auditing).
7. Ongoing motor vehicle record review for vehicle safety program compliance.
8. Pre-designation of a personal physician for treatment under a workers compensation program.
9. Compliance reporting (e.g., certified payroll, state benefit auditing, workers compensation reporting, EEO surveys, Bureau of Labor Statistics, and economic census).
10. Employment verification (e.g., banking, lenders, rentals, housing, and legal court orders, including garnishments).
11. Contract billing (e.g., contractual billing submissions, change order tracking/pricing, and extended overhead claims).
12. Building an account for use on company provided devices, including iPhones and iPads.
13. Creating or updating physical and digital employee files.
14. Processing religious, disability, or medical accommodation requests.
15. Background check screening at the direction of clients for construction jobsites that require heightened levels of security or protection of minors (e.g., prisons, schools, etc.).
16. Employment health screening at the direction of clients for construction jobsites with vulnerable populations (e.g., populated medical facilities).
17. Compliance with DOT and FMCRA procedural and recordkeeping requirements for commercial drivers.
18. Submitting a medical claim to LMC’s workers compensation insurance carrier via LMC’s third party claims administrator.
19. Conforming to IRS mandates regarding documentation maintenance for reimbursement of employee expenditures.
20. Processing leave requests.
21. Processing payments from LMC customers that opt to use their personal credit cards.

Personal Information Storage/Security
1. Application and employment records are maintained as mandated under employment law.
2. Background check records are kept on file for a minimum of two years.
3. Health screening records are kept on file for the duration of a project and throughout the warranty period. They may be kept on file for longer, if they will also be used to qualify the employee for future work.
4. Credit card information is used to process a single credit card transaction. After the transaction is completed, all identifying personal information is redacted. The redacted form is stored with the credit card receipt on a network drive, with limited role-based user access, on a firewall-protected network server.
5. Injury records are maintained per OSHA and State of California recordkeeping requirements.
6. Electronic data is stored on a restricted LMC network drive, which has limited role-based user access and is on a firewall-protected network server.
7. Websites and portals maintained by third party administrators or providers have secure server software that encrypts personal information. Access requires the use of unique usernames and strong passwords. All providers maintain safeguards that comply with federal and state regulations to guard non-public personal information.

Exemptions
CPRA obligations imposed on LMC shall not restrict its ability to:
1. Comply with federal, state, or local laws or comply with a court order or subpoena to provide information.
2. Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.
3. Cooperate with law enforcement agencies concerning conduct or activity that LMC, a service provider, or a third party reasonably and in good faith believes may violate federal, state, or local law.
4. Cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury provided that:
a. The request is approved by a high-ranking agency officer for emergency access to a consumer’s personal information.
b. The request is based on the agency’s good faith determination that it has a lawful basis to access the information on a nonemergency basis.
c. The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.
5. Exercise or defend legal claims.
6. Collect, use, retain, sell, share, or disclose consumers’ personal information that is de-identified or aggregate consumer information.

Personal information does not include publicly available information from government records, deidentified or aggregated consumer information, health or medical information covered by local and federal regulations, or data covered by certain sector-specific state and federal privacy laws. A verifiable employee request for specific pieces of personal information, to delete personal information, or to correct inaccurate personal information, does not extend to personal information about the employee that belongs to, or that LMC maintains on behalf of, another natural person. Also, exempted:
1. Personal information collected as a job applicant to, an employee of, owner of, director of, officer of, or independent contractor of LMC to the extent the information is collected and used solely within the context of that person’s role or former role.
2. Emergency contact information collected and used solely within the context of having an emergency contact on file.
3. Personal information necessary for LMC to retain to administer benefits.

LMC may rely on representations made in a verifiable employee request as to rights with respect to personal information and is under no legal requirement to seek out other persons that may have or claim to have rights to personal information. LMC is under no legal obligation to take any action in the event of a dispute between or among persons claiming rights to personal information in LMC’s possession.

LMC is not liable if a service provider, contractor, or third party receiving personal information uses that information in violation of CPRA restrictions without LMC’s knowledge.

The right to delete and the right to opt out do not apply to LMC’s use or disclosure of particular pieces of an employee’s personal information if the employee has consented to the use or disclosure of that information to produce a physical item if LMC has incurred significant expense in reliance on the employee’s consent and compliance with the employee’s request to delete the employee’s personal information would not be commercially reasonable. LMC will comply with the employee’s request as soon as it is commercially reasonable to do so.

Changes to LMC’s Privacy Policy
LMC reserves the right to amend this Privacy Policy at its discretion and at any time. At a minimum, this policy will be updated annually. When we make changes, we will post the updated Policy on the website and update the Policy’s effective date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Contact Information
If you have any questions or comments about this Policy, the ways in which LMC collects and uses your information described above, your choices and rights regarding such use, or wish to exercise your rights, please do not hesitate to contact us at: https://www.lawsonmechanical.com/contact/, hr2@lawsonmechanical.com, P. 844.368.0500, or Lawson Mechanical Contractors, Attn: Human Resources, 6090 S. Watt Ave., Sacramento, CA 95829.