Effective Date: May 1, 2023

This Privacy Policy (“Policy”) describes how Frasco^® Profiles collects, uses, discloses, and processes personal information (“Personal Data”), referred to in the United States as Personal Identifying Information (“PII”) in connection with Frasco^® Profiles’ websites https://frascoprofilesprofiles.com and https://frascoprofilesprofiles.bgsecured.com (“Website” or “Site”), products and services (the “Services”). Please note that by using Frasco^® Profiles’ Site and Services, you are agreeing that you have read and agree to this Policy.

Depending on how you interact with Frasco^® Profiles, how we utilize the collected information may vary. Frasco^® Profiles interacts with three different types of individuals, Consumers, Clients, and Site Visitors.

Consumers are individuals Frasco^® Profiles has received information about for the purpose of using the Site or Frasco^® Profiles performing Services, such as pre-employment screening, occupational health screening, Form I9 or E-Verify completion. This information may come directly from Consumers or indirectly through Clients or affiliates.

Clients are organizations or individuals that use the Services.

Site Visitors are any individuals, Consumers or Clients accessing our Website.

1. What information does Frasco^® Profiles collect to perform the Services?

Frasco^® Profiles collects certain information that relates directly to the Consumer. Frasco^® Profiles may also collect limited information related to Clients and Site Visitors. Frasco^® Profiles has collected the following categories of Personal Data in the past twelve months:

• Identifiers, such as name, date of birth, online identifiers, phone number, email address, postal address, government issued identification numbers such as Social Security Number or Personal Identification Number, passport number, and driver’s license or permit numbers;
• Characteristics of protected classifications;
• Internet or other electronic network activity information, such as, IP address, browser type, device type, operating system and version, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site;
• Professional or employment related data, such as, previous employers, roles, employee record information, and salary;
• Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act, and professional training or credentialing information;
• Additional information or supporting documentation you provide in connection with the Services that is not exempt from applicable privacy laws;
• Information collected for activities involving the collection, maintenance, disclosure, communication, or use of such information regulated by the Fair Credit Reporting Act (“FCRA”), including but not limited to information found in public records, including civil and criminal court records; health records; public media articles; or business filings.
• Frasco^® Profiles does not and will never sell your Personal Data.

2. How does Frasco^® Profiles collect your information?

Frasco^® Profiles has collected information from the following categories of sources in the past twelve months:

Information You Submit To Us

Frasco^® Profiles collects Personal Data submitted directly to Frasco^® Profiles via our site or by telephone or email, such as information needed to produce a background check report; and Personal Data including name, email address and general business information provided in contact requests, in browser chats, and/or with Frasco^® Profiles representatives. Frasco^® Profiles may maintain records of communications submitted through the Site.

Third Party Information

Certain Services require the collection of information from third parties. Third party information may relate to Consumers or Clients and includes both public and private records as described below:

• Public Records: Frasco^® Profiles may collect public records bearing on an individual or business entity, including civil and criminal court records and documentation, business filings, and public media articles. Public records may be obtained from sources such as government offices, records databases, court systems, and law enforcement organizations.
• Private Records: Where appropriately authorized, Frasco^® Profiles may obtain private records, including educational, employment, financial, and health records. Private records may be obtained from sources such as schools and educational institutions, professional and licensing organizations, employers, drug testing and other healthcare service providers, and credit agencies.

Personal information may also be collected by Clients, third parties or affiliates and transferred to Frasco^® Profiles for the purpose of performing Services, such as producing a background check report.

Automatically Collected Information

When Consumers, Clients or Site Visitors visit the Site or use the Services, we automatically gather certain Internet or other electronic network activity information, including technical and usage information, which may be associated with your user account. Technical Information also includes “Cookies,” which are small text files containing a string of alphanumeric characters that are downloaded by your web browser when you visit a website. Cookies are used to provide a better user experience when visiting the Site and do not collect personal data.

3. How does Frasco^® Profiles use the collected information?

Frasco^® Profiles used all categories of data described in Section 1 in the past twelve months for the following purposes:

• To Perform Services and Provide the Site: Frasco^® Profiles uses collected information to perform Services for Consumers and Clients and provide the Site to all users. These services include producing employment related background check and clinical service reports, providing access to employment related background check and clinical service reports, providing certain analytics related to background check and clinical service reports, providing certain product functionality relating to use of background check and clinical service reports.
• To Communicate with You: Frasco^® Profiles uses collected information to communicate with you about the Services, such as by phone, mail, email, in-browser chat, or SMS regarding the status of certain requested Services, to provide updates on changes or modifications to the Services, and to facilitate the delivery of information authorized or required through the Services. Where appropriate, Frasco^® Profiles may send you product announcements and special promotions from Frasco^® Profiles or our business partners, or to administer participation in surveys, webinars, or other special events.
• Day to Day Business Operations: Frasco^® Profiles uses collected information for its day-to-day business operations, such as to administer your account, to process billing and payment information, manage preferences and troubleshoot problems, and personalize the content that account Consumers and Clients’ users see based on personal characteristics or preferences.
• To Meet Legal and Compliance Requirements: Frasco^® Profiles may use the collected information to: i) comply with any applicable procedures, laws, and regulations, subpoenas, governmental requests or legal process; ii) in connection with a legal investigation, if in our good faith opinion such is required or permitted by law; iii) protect the rights, property or safety of Frasco^® Profiles, our Consumers, our Clients, or third parties; (iv) prevent fraud or abuse of Frasco^® Profiles or our users; or (v) perform a task carried out in the public interest.
• To Provide Security: Frasco^® Profiles uses collected information to create Consumer and Customer account credentials, to verify identity prior to granting access to account information, to validate against existing information maintained by Frasco^® Profiles, to protect against duplicate or unauthorized account creation, to secure the Site and Services, and to address fraud, abuse or safety concerns of Frasco^® Profiles, our Clients or Consumers, including investigation of complaints or suspected fraud or wrongdoing.
• To Verify Your Identity: To verify the identity of UK Consumers, we may work with a third-party service provider, Yoti, which uses a scan of your facial features (“Biometrics Data”) to match them against your photo ID. Yoti is the data controller of this data processing and will ask for your consent before collecting your Biometrics Data. If you do not wish to consent to providing your Biometrics Data, we will offer an alternative solution for identity verification. Frasco^® Profiles does not store or otherwise access your Biometrics Data. We encourage you to visit Yoti’s Privacy Centre at https://www.yoti.com/privacy/ to learn more about their privacy practices, including their use and retention of Biometrics Data.
• To Improve our Systems: Frasco^® Profiles uses collected information to continuously improve system functionality through quality assurance checks and audits, to troubleshoot problems, and to verify, improve, or maintain the quality or safety of our services.
• As otherwise permitted by law.

In using the above categories of data, Frasco^® Profiles strives to adhere to a philosophy of data minimization so as to use only the data necessary to complete any of the above activities.

Data Retention

Frasco^® Profiles will retain collected information in accordance with applicable laws and agreements between Frasco^® Profiles and its Clients and affiliates. See Section 6 below for instructions on how to request deletion of your Personal Data.

Anonymized Information

We may use and share anonymized information without limitation, including sharing with third parties. This includes anonymized, pseudonymized, aggregated, or de-identified information about Consumers, Clients, Site Visitors, and information collected from third parties, including public records.

4. When does Frasco^® Profiles share collected information?

Frasco^® Profiles shares Personal Data only with authorization from a Consumer, a Customer, or other data controller, or when permitted by law. Frasco^® Profiles shares data with the following categories of third parties:

• Frasco^® Profiles affiliates and partners;
• Service Providers and Sub-processors;
• Government Entities; and
• Frasco^® Profiles Clients, with authorization from a Consumer

Frasco^® Profiles has shared the categories of data described in Section 1 in the past twelve months with the above third parties with consent, for a legitimate business purpose, or as required by law.

5. Will you receive notices and disclosures electronically?

Yes. The Services are offered through Frasco^® Profiles’ website, mobile site, and application. To obtain Services from Frasco^® Profiles, you must create an online account and (1) be able to access Services on a computer or other device that is capable of accessing the Internet, (2) have an active email account, and (3) consent to our use of our website, application, or email to provide you any written information that we may be required to send you in connection with the Services, your account, and/or background checks and reports. However, you may still exercise your rights under the FCRA by contacting us through non-electronic means such as mail or a phone call.

Method of Providing Communications to You in Electronic Form

All Communications that we provide to you in electronic form will be provided either (1) via email, telephone or text, (2) by making it available online and accessible via the Services, or (3) by requesting you download a PDF file containing the Communication.

Your Consent to Electronic Disclosures

By creating an account and/or authorizing a background check or other Services, you acknowledge and agree to the following:

• You can access and read the information we post on our website or mobile app;
• You will provide an email address that is active and effective for receiving emails from us;
• You will receive electronically on our website, app, or via email notices and disclosures, required by law related to your account and the Services; and
• You have received the following disclosures as required by the federal Electronic Signatures in Global and National Commerce Act (“ESIGN”).

Please read this Federal ESIGN disclosure and consent carefully and keep a copy for your records. Your consent is voluntary, but we cannot provide the Services to you if you do not consent. If you are unwilling to receive these disclosures and notices electronically, you may terminate the creation of your account by closing your browser at any time before you create an account and/or authorize a background check or Services.

Accurate Contact Information

It is your responsibility to provide us with true, accurate, and complete contact information, such as email address, and other information related to your account, and to maintain and update promptly any changes in this information. If you give us an incorrect email address or fail to update or correct your email address, an electronic communication will be deemed provided to you if we use the email address in our records for the electronic communication.

Scope of Communications to Be Provided in Electronic Form

Your consent to receive electronic communications and transactions includes, but is not limited to, all legal and regulatory notices or disclosures and communications associated with your account, the Services, your request for a background check, and any product or service we agree to provide you (each, a “Communication”).

How to Withdraw Consent

You may at any time withdraw your consent to receive Communications in electronic form. To begin receiving Communications in paper form, please contact us at the following address: 215 W Alameda Ave, Ste 203, Burbank, CA, 91502. Please specify the information you wish to receive in paper form. Be sure to state that you are requesting a copy of the disclosures, notices, etc., and include your name and mailing address. Your request will apply only to those specific items you designate. We will not impose any fee to process the withdrawal of your consent to receive electronic Communications. Any withdrawal of your consent to receive electronic Communications will be effective only after we have a reasonable period of time to process your withdrawal.

Required Equipment

In order to use the Services and to view and retain a copy of this Policy and certain Communications, you understand that you must have a computer or device equipped with at least: a browser with 128-bit encryption, a current version of a software that can open and display PDF files (e.g., Adobe), and either a printer or other electronic storage device.

Retaining Copies of the Communications

To retain a copy of any Communication we provide electronically, you can download an electronic copy to your computer or a storage device (such as a disk or USB storage device), request a copy by email, or print copies on a printer attached to your computer. You will not be charged for a downloaded or emailed copy.

6. How can you access, change, or delete information about you?

We offer certain privacy resources regardless of where you are located, as described below. Please note that if you reside in certain jurisdictions, you may have additional rights. Data deletion is subject to jurisdictional data retention requirements and may not be available in all states the United States for up to three years from the date your background report was produced.

For Consumers

Consumers may request access, correction, and deletion of their information as described below:

• Accessing Your Information: Consumers may request a copy of their consumer report or file by contacting Frasco^® Profiles at info@frasco.com or by telephone at 1-800-820-9029.
• Disputing Incorrect Information: If at any time you believe Frasco^® Profiles possesses or has communicated incorrect information about you to Clients, you should contact Frasco^® Profiles. You can contact Frasco^® Profiles at info@frasco.com or by telephone at 1-800-820-9029.
• Deleting your Information: You may request deletion of your data by contacting Frasco^® Profiles at info@frasco.com or by telephone at 1-800-820-9029.
• You may also request your information be deleted by mail at Frasco^® Profiles, 215 W Alameda Ave, Ste 203, Burbank, CA, 91502.
• After we process your request, you will no longer have access to our Candidate Portal.

For Clients:

Requests to update Customer account information or make other requests about your data should be directed to your account representative or emailed to info@frasco.com.

7. California and other state privacy laws

If you reside in California or certain other states (including Virginia), you may have rights under applicable state privacy laws, such as the California Consumer Privacy Act and the California Privacy Rights Act (collectively, “CPRA”) or the Virginia Consumer Data Protection Act (“VCDPA”).

Please note that the CPRA and VCDPA do not apply to Personal Data that is processed pursuant to the FCRA, the federal law which protects background check information. When Frasco^® Profiles processes Personal Data about California and Virginia residents for the purposes of performing a background check pursuant to the FCRA, such processing is exempt from the CPRA and VCDPA. In such cases, we process your Personal Data in accordance with the FCRA.

In addition, we often act as a “service provider” or “processor” with regard to Personal Data we receive and process through our Services. In such cases, we conduct our data processing in accordance with the restrictions set forth in the data processing agreements with our Clients, who act as the “business” or “controller” under the CPRA or VCDPA. The privacy practices of our Clients are subject to their privacy policies, which we encourage you to review. Frasco^® Profiles is not responsible for our Clients’ privacy practices or policies.

California and Virginia residents may learn more about their rights below:

• Right to know: California and Virginia residents have the right to know what categories of Personal Data have been collected about them, and whether such Personal Data has been disclosed or sold for a business purpose in the past 12 months.

For a description of the categories of Personal Data that Frasco^® Profiles has collected in the past 12 months, see the section above entitled, What information does Frasco^® Profiles collect through the Services? Frasco^® Profiles retains this Personal Data in accordance with applicable laws and agreements between Frasco^® Profiles and its Clients and affiliates.

For a description of the categories of Personal Data that Frasco^® Profiles has disclosed for a business purpose in the past 12 months, see the section above entitled, What information does Frasco^® Profiles collect through the Services? Frasco^® Profiles does not sell or share your Personal Data outside of the business use cases outlined in this policy.

For a description of the categories of third parties with whom Frasco^® Profiles has disclosed Personal Data for a business purpose in the past 12 months, see the section above entitled, When does Frasco^® Profiles share collected information?

• Access: California and Virginia residents have the right to request access to their Personal Data.
• Deletion: California and Virginia residents have the right to request the deletion of certain Personal Data.
• Right to Non-Discrimination: Frasco^® Profiles enforces a strict non-discrimination policy when you exercise your rights.
• Rights relating to sensitive personal information. Frasco^® Profiles will not process the sensitive personal information of Virginia Consumers, as defined by the VCDPA, without Consumer consent. California residents have the right to limit processing of sensitive personal information under the CPRA. Frasco^® Profiles may process the sensitive personal information of California Consumers as defined under California law, including the following categories: (1) social security number, driver’s license, state identification card, or passport number and (2) account log-in in combination with the credentials allowing access to an account. Frasco^® Profiles uses such sensitive personal information only for the following purposes.
• To the extent it is necessary to perform the services reasonably expected by the average Consumer who requested them;

To help ensure security and integrity to the extent the use of the Consumer’s personal information is reasonably necessary and proportionate for these purposes; and

Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, or providing similar services on behalf of the business.

Frasco^® Profiles will help you exercise these rights free of charge, where applicable. Please contact us at info@frasco.com if you would like to submit a request. If you make a request under the CPRA or VCDPA, we may need to take additional steps to verify your identity. If you designate an authorized agent to make a request on your behalf, we may require you to provide the authorized agent written permission to do so and to verify your own identity directly with us.

Regardless of where you are located, you may use the tools described above to request access, correction, and deletion of your information.

8. Does this Policy apply to third parties or third-party links?

No. This Policy does not apply to information that you may provide to or that may be collected by third parties. We encourage you to review such third parties’ privacy policies and terms and conditions before engaging with such third parties.

9. What choices do you have about email and text communications from Frasco^® Profiles?

Promotional Emails: Subject to any restrictions under applicable laws, we may send periodic promotional or informational emails to Clients. You may opt-out of such communications by clicking the unsubscribe link in the email. Please note that it may take up to 10 business days for us to process opt-out requests. If you opt out of receiving emails about recommendations or other information we think may interest you, we may still send you emails about your account or any services you have requested or received from us.

Opting Out of Frasco^® Profiles Text Messages: Text messaging may be used in conjunction with inviting a Consumer to provide consent to run a background check. Once you have authorized the background check, Frasco^® Profiles will discontinue sending text messages. If you no longer want to receive Frasco^® Profiles text messages, you may reply STOP to our messages at any time. After doing so, we will send you confirmation of your opt-out via text message.

10. How does Frasco^® Profiles protect your information?

Frasco^® Profiles maintains industry standard physical, technological, and administrative safeguards to help protect the security and privacy of the information we maintain about you. We may use such safeguards as encryption, multi-factor authentication, and other proactive security measures to help protect your information against unauthorized access and disclosure. However, no security measures are 100% effective. You should take steps to protect against unauthorized access to your information, passwords, accounts, phones, computers, and other devices.

11. GDPR and Other International Considerations

GDPR and UK GDPR

If you reside in the EEA or UK, you have the right to submit a data subject access request (“DSAR”) under the General Data Protection Regulation or UK General Data Protection Regulation (“GDPR”), including requests to access, correct, delete, download, and object to certain processing of your information. You can exercise many of these rights by contacting us at info@frasco.com if you would like to submit a DSAR.

Data Storage

Frasco^® Profiles uses infrastructure located and operated in the United States.

Personal Information Disclosure: United States or Overseas

When Frasco^® Profiles acts as an Investigative Consumer Reporting Agency under California state law, personal information collected from Consumers in the United States may be transferred outside of the United States as follows:

• To third parties from which we must collect or verify personal information to provide Services requested by a Customer. For example, if a Customer requests a background check in Canada, personal information may be transferred to the organization that provides such information.
• To service providers that help provide the Services outside of the United States, where the Customer has requested such Services. For example, if the Customer requests employment verification in Australia, personal information may be transferred to a service provider with expertise in performing such a verification in Australia.
• To affiliates, service providers, and contractors from time to time to help provide the Services.

For more information on how Frasco^® Profiles handles cross-border transfers of personal information, please read the remainder of this section below.

Data Transfer and Standard Contractual Clauses

Frasco^® Profiles may transfer or process your Personal Data in a country outside your jurisdiction, including countries outside the EEA and UK. We take appropriate safeguards with respect to such cross-border data transfers. For example, if we transfer Personal Data from the EEA or UK to another country, such as the United States, we will implement an appropriate data transfer solution such as entering into “standard contractual clauses” approved by the European Commission or competent UK authority (as applicable) with the data importer, or take other measures to provide an adequate level of data protection under EEA and UK law. Frasco^® Profiles may also rely on the active consent of EEA based data subjects. Data from EEA based data subjects is processed with consent, to fulfill our legitimate interests to produce a data subject’s requested background check, and to fulfill our contractual obligations. We may retain data for compliance with our legal obligations under applicable law, including the FCRA.

Additional Information for Canadian Users

This Policy applies to Clients, Consumers and Site Visitors in Canada. However, to the extent that this Policy is inconsistent with any applicable Canadian laws, Frasco^® Profiles will comply with the applicable law for Clients, Consumers and Site Visitors in Canada. For example, Frasco^® Profiles will only send commercial electronic messages to persons located in Canada with explicit, opt-in consent, unless otherwise permitted pursuant to Canadian legislation that is applicable to such activities.

Consumers who are located in Canada should also understand that the nature of the Services will involve Frasco^® Profiles obtaining potentially sensitive personal information about them, including consumer reports, criminal records, driving records, as well as education and employment records, from third parties such as consumer reporting agencies, police services, and government agencies (e.g., provincial transportation ministries).

Frasco^® Profiles will also share Consumers’ personal information with a third-party service provider in Canada, for the purpose of completing or facilitating the background checks described in this Policy.

In addition, Personal Data that is collected in the course of providing the Services will be transferred outside Canada. Therefore, such information may be accessible to law enforcement and national security authorities in the jurisdiction(s) where it is stored or processed.

Canadian Clients and Consumers will be notified of any material changes to this Policy, where such a change would result in use or disclosure of their personal information by Frasco^® Profiles in a manner not contemplated by this Policy or reasonably expected by the individual.

12. Changes to the Privacy Policy

Frasco^® Profiles reserves the right to change this Policy at any time. Please check this page periodically for changes. Your continued use of our Site and Services following the posting of changes to this Policy will mean you agree with, and consent to be bound by, the new revised Privacy Policy.

13. How can you contact Frasco^® Profiles with more questions?

If you have any questions, concerns or complaints about our Policy or Frasco^® Profiles’ handling of your personal information, or if you would like to access or update personal information that is not available via the Candidate portal, please contact us at:

Mail: Frasco^® Profiles, Attn: Privacy Questions, 215 W Alameda Ave, Ste 203, Burbank, CA, 91502

Email: info@frasco.com | Phone: 1-800-820-9029

In addition to those rights, you have the right to contact your relevant supervisory authority. However, we encourage you to contact us first, and we will do our very best to resolve your concern.