This California Privacy Policy supplements the WebsitePrivacy Policy with respect to specific rights granted under the California Consumer Privacy Act of 2018 (as amended, the "CCPA") and the California Privacy Rights Act of 2020 (the "CPRA," and together with the CCPA, collectively "California Privacy Laws") to natural person California residents.

This policy provides information regarding how California residents can exercise their rights under California Privacy Laws. This California Privacy Policy applies only to you if you are a resident of California as determined in accordance with the CCPA/CPRA.

Regulated Entities:

This policy applies to Workscaler Inc., doing business as:
Resumas (resumas.com)

Additional Privacy Notices:

Information required to be disclosed to California residents under California Privacy Laws regarding the collection of personal information not set forth in this policy is otherwise set forth in the Website Privacy Policy. If you provide personal information through another means (e.g., as an employee, job applicant, client, or investor), you will receive a separate privacy notice that will govern that personal information.

2.1 Scope of This Policy

This California Privacy Policy applies solely to your interactions with us through our Websites and mobile applications, including:

• Resumas.com
• Associated mobile applications and services

2.2 Not Applicable To

This California Privacy Policy does not apply to:

• Employment relationships (separate privacy notice required)
• Job applicants seeking employment (separate notice required)
• Independent contractors (separate notice may apply)
• Client relationships outside our Services
• Investor communications and accounts
• B2B relationships with other companies

Each of these categories will receive a separate, tailored privacy notice governing their personal information.

2.3 Children's Privacy

We do not knowingly collect or solicit personal information from anyone under the age of 16. If we become aware that we have collected personal information from a child under 16, we will delete such information and terminate the child's account immediately.

3.1 Information Collected Over Last 12 Months

We collect limited types of personal information through our Websites and associated platforms (collectively, the "Websites"). The categories of personal information we have collected from individuals on our Websites over the last twelve (12) months include:

Identifiers:

• Name and legal name
• Contact details (email address, phone number)
• Physical mailing address
• Internet Protocol (IP) address
• Device identifiers
• Account username and account ID

Other Customer Records:

• Telephone number
• Personal information provided in connection with account registration and access
• Payment method information (processed through third-party providers)
• Account history and transaction records

Commercial Information:

• Account data and service usage history
• Purchase history and subscription information
• Billing and payment information
• Service preferences and settings

Professional or Employment-Related Information:

• Current and past job titles
• Employment history and experience
• Company information
• Professional credentials
• Skills and competencies
• Career goals and preferences

Education Information:

• Educational background and credentials
• Degrees and certifications
• Training and coursework history
• Educational institution names

Internet or Other Electronic Network Activity Information:

• Website usage data (pages visited, features accessed, actions taken)
• Cookies and tracking technologies
• Browsing history and search history
• Time spent on website and interaction patterns
• Referral source
• Device information (type, operating system, browser)
• Information from correspondence and inquiries submitted through the website

Precise Geolocation Data:

• GPS coordinates (if you enable location services)
• Location derived from IP address

Audio, Electronic, Visual, or Similar Information:

• Audio or video recordings (if you participate in interviews or coaching sessions)
• Chat transcripts and communication records

Sensitive Personal Information (per CPRA):

We limit collection of Sensitive Personal Information to what is necessary for service delivery:

• Government-issued identifiers (Social Security numbers if provided for background checks)
• Financial account information (credit card details processed by third parties only)
• Precise geolocation data
• Citizenship and immigration status
• Racial or ethnic origin
• Religious or philosophical beliefs
• Union membership
• Health information (career-related health accommodations)
• Sexual orientation or sex life information
• Genetic data
• Biometric information used for identification
• Contents of communications (emails, messages, chat logs)

Inferred Information:

• Inferences drawn about your interests, characteristics, and preferences
• Predicted job compatibility and career recommendations (AI-generated)
• Professional profile analysis and recommendations

3.2 Sensitive Personal Information Protections

Under the CPRA, we handle Sensitive Personal Information with enhanced care by:

• Limiting collection of SPI to only what is necessary to provide Services
• Limiting use and disclosure of SPI to specified business purposes
• Providing consumers the right to limit use and disclosure of their SPI
• Implementing additional security measures for SPI protection

4.1 How We Obtain Your Personal Information

We collect and maintain your personal information from the following sources:

Information You Provide Directly:

• Information from your communications with us in connection with our Websites
• Registration information and account creation data
• Information provided through online forms
• Information from surveys and questionnaires
• Information from support requests and inquiries
• Resume, CV, or profile information you upload
• Career coaching interactions and session information
• Job application submissions
• Payment and billing information
• Update notices and preference changes

Information Captured Automatically:

• Information captured on our Websites through cookies, web beacons, and similar tracking technologies
• Registration information and login data
• Browsing history and website usage patterns
• Device information and identifiers
• IP address and geolocation data
• Referral source and traffic data

Information from Third Parties:

• Information from publicly available sources
• Information from data brokers or aggregators
• Information from social media platforms (if you link accounts)
• Information from job boards or recruitment sites
• Information from Google Analytics and similar analytics providers
• Information from advertising networks
• Information from business partners and service providers

Aggregated and Inferred Information:

• Information combined from multiple sources
• Inferences drawn about your interests and preferences
• Aggregated insights based on your interactions

4.2 Combination of Information

We may combine personal information that you provide to us with information that we collect from or about you from publicly available sources. This includes information collected in online or offline contexts. Combined information may be used for purposes outlined in Section 5.

5.1 How We Use Your Personal Information

We use your personal information for one or more of the following business purposes:

Service Delivery:

• To perform services for you and maintain your account
• To provide career coaching, job search assistance, and outplacement services
• To process your requests and respond to your inquiries
• To match you with job opportunities based on your profile
• To provide AI-generated recommendations and career guidance

Website and Service Improvement:

• To improve our Websites and the products and services that we offer
• To notify you about changes to our products and services
• To test features and conduct user research
• To optimize user experience and website performance
• To develop new features and services

Communication:

• To communicate with you regarding your account and services
• To respond to requests for information submitted by you through our Websites
• To send administrative communications and notifications
• To notify you of changes to our policies or services
• To send security alerts and notifications

Relationship Management:

• To keep a record of your relationship with us
• To facilitate ongoing customer service and support
• To track your service usage and preferences

Operations and Administration:

• Ongoing operations, administrative, accounting, reporting, account maintenance
• Other business processes related to service delivery
• Internal record-keeping and documentation

Compliance and Legal:

• To audit and verify the quality and effectiveness of our services and compliance
• To generally comply with U.S., state, local, and non-U.S. laws, rules, and regulations
• To establish, exercise, or defend legal claims
• To respond to government requests and regulatory requirements
• To prevent fraud and illegal activity

Security and Safety:

• To detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity
• To investigate and prevent unauthorized access
• To protect the rights, property, and safety of our company, users, and employees

Marketing and Analytics:

• To keep you informed of our products and services (if you have consented or we have an existing relationship)
• To contact you about products and services similar to those we provide you
• To conduct market research and analyze usage patterns
• To measure campaign effectiveness and optimize marketing
• To create aggregate or anonymized insights about our user base

AI Model Improvement:

• To train and improve our AI algorithms and machine learning models
• To analyze patterns and trends in career data
• To enhance recommendation accuracy

5.2 Legal Basis for Processing

We process personal information based on:

• Your explicit consent
• Performance of a contract or service with you
• Compliance with legal obligations
• Protection of vital interests
• Legitimate business interests (balanced against your rights)
• Public task or authority
• For Sensitive Personal Information, explicit consent or necessity for service delivery

6.1 We Do NOT Sell Your Personal Information

Clear Statement: We do not sell any of the personal information we collect about you to third parties for monetary consideration, consistent with CCPA/CPRA requirements. We also do not share your personal information for cross-context behavioral advertising or targeted advertising without your consent.

6.2 Disclosure to Third Parties

We do not disclose any personal information about you to third parties except as permitted or required by law, rule, or regulation and to:

Service Providers and Contractors:

• Affiliates and subsidiaries
• Service providers who process data on our behalf, including:
• Payment processors and financial service providers
• Cloud hosting and infrastructure providers
• Email and communication service providers
• Analytics and data analytics providers
• Customer support platforms
• Marketing and advertising platforms
• Strategic partners and consultants
• Auditors and accounting firms
• Law firms and legal advisors
• Placement agents and recruitment partners

Legal and Regulatory Requirements:

• Governmental agencies and law enforcement
• Regulatory organizations and self-regulatory organizations
• In response to legal process (subpoenas, court orders, warrants)
• As required by law or regulation

Business Transfers:

• In the event of a reorganization, merger, sale, acquisition, assignment, bankruptcy proceeding, or other disposition of all or a portion of our business, assets, or shares

6.3 Disclosure Summary - Last 12 Months

Within the last twelve (12) months, we have shared each of the categories of personal information identified in Section 3 with the persons identified in Section 6.2 above.

No Sales or Sharing for Behavioral Advertising: We have not sold or shared (for cross-context behavioral advertising) any personal information in the last 12 months. We maintain this commitment and continue to honor consumer opt-out rights.

6.4 Data Processing Agreements

All service providers who access personal information are required to:

• Execute written Data Processing Agreements
• Use personal information only for specified business purposes
• Not sell or share personal information
• Comply with CCPA, CPRA, and all applicable privacy laws
• Implement reasonable security measures
• Assist with consumer privacy rights requests
• Notify us if they can no longer meet their obligations

7.1 Security Measures

We consider the protection of sensitive information to be a sound business practice. We employ appropriate organizational, physical, technical, and procedural safeguards to protect your personal information in our possession or under our control from unauthorized access and improper use.

Our Security Practices Include:

• Encryption of data in transit (SSL/TLS) and at rest
• Access controls and role-based permissions
• Network firewalls and intrusion detection systems
• Regular security assessments and vulnerability testing
• Employee training on data protection and privacy
• Confidentiality agreements for all employees and contractors
• Physical security of data centers and facilities
• Incident response procedures for unauthorized access
• Regular audit and compliance reviews
• Data minimization practices
• Secure deletion of data at end of retention period

7.2 Data Breach Notification

In the event of a data breach compromising personal information:

• We will notify affected California residents within 30 calendar days of discovery
• We will notify the California Attorney General within 15 calendar days if 500+ residents are affected
• Notifications will include description of breach, types of information involved, and steps to protect yourself

8.1 Retention Periods

We retain personal information only as long as necessary to provide Services and fulfill stated purposes:

8.2 Deletion Upon Request

Subject to legal exceptions, we will delete personal information upon your request as provided in Section 9 (Your Rights Under California Privacy Laws).

9.1 Comprehensive Overview of Rights

California residents have the following rights under the CCPA and CPRA. To exercise any of these rights, see Section 10 (How to Exercise Your Rights).

9.2 Right to Know

Right Description: You have the right to request that we disclose to you certain information regarding our collection and use of personal information about you. Specifically, you have the right to know:

Information You Can Request:

• The categories of personal information we collected about you
• The categories of sources from which personal information is collected
• Our business or commercial purpose for collecting personal information
• The categories of third parties with whom we share personal information
• The specific pieces of personal information we have collected about you
• Whether we disclosed your personal information to third parties for a business purpose, and if yes, the categories of personal information that each recipient obtained
• Whether we sold or shared your personal information, and if yes, the categories of personal information we sold or shared

Timeframe: You have the right to submit a request up to twice in a twelve (12) month period.

Response Timeline: We will respond to verifiable requests within 45 calendar days. If we require additional time, we will notify you within 45 days with a completion timeline of no more than 90 calendar days total.

9.3 Right to Delete

Right Description: You have the right to request that we delete any of your personal information that we retain, subject to certain statutory exceptions.

Exceptions to Deletion: We may not delete personal information if necessary to:

• Complete the transaction for which personal information was collected
• Provide goods or services requested by you
• Detect security incidents or prevent fraud
• Comply with legal obligations
• Enable internal uses reasonably aligned with consumer expectations
• Fulfill other purposes compatible with the context of collection
• Defend against legal claims
• Enable another entity to fulfill obligations on our behalf

Response Timeline: Upon verification, we will delete your personal information within 45 calendar days (with possible 45-day extension if necessary). We will notify you if we cannot comply with your request and provide an explanation of the reasons.

9.4 Right to Correct (CPRA)

Right Description: You have the right to request correction of inaccurate personal information we maintain about you.

How to Exercise: You may correct information directly in your account dashboard or submit a correction request through the methods in Section 10.

Response Timeline: We will make corrections within 45 calendar days (with possible extension).

9.5 Right to Opt-Out of Sales and Sharing

Right Description: You have the right to opt out of:

• The sale of your personal information
• The sharing of your personal information for cross-context behavioral advertising

Current Status: We do not currently sell or share your personal information. However, we maintain this opt-out right for your future protection.

How to Opt-Out: To opt out, submit a request using the methods in Section 10 with "DO NOT SELL MY PERSONAL INFORMATION" or "DO NOT SHARE MY PERSONAL INFORMATION" in the subject line. You may also use our "Do Not Sell or Share My Personal Information" link on our homepage.

Financial Incentives: We do not require you to opt out in order to receive equal service and pricing. Opting out will not result in differential treatment.

9.6 Right to Limit Use and Disclosure of Sensitive Personal Information (CPRA)

Right Description: You have the right to limit our use and disclosure of your Sensitive Personal Information to only what is necessary to provide Services you requested or as otherwise permitted by law.

How to Exercise: Submit a request using the methods in Section 10 with "LIMIT USE OF MY SENSITIVE PERSONAL INFORMATION" in the subject line.

Our Response: Upon receipt, we will limit use and disclosure of your SPI to the specified purposes and cease using it for other purposes.

9.7 Right to Non-Discrimination

Right Description: We will not discriminate against you for exercising your rights under California Privacy Laws.

Prohibited Discrimination: We will not:

• Deny you service or goods
• Charge different prices or rates for services or goods
• Provide different level or quality of service
• Suggest that you will receive different treatment
• Threaten, intimidate, or coerce you into waiving your rights

Permitted Differentiation: We may offer financial incentives, loyalty programs, or other benefits that are reasonably related to the value of your data, with your consent.

9.8 Right to Authorized Agent

Authorized Representative: You may designate an authorized agent to make requests under California Privacy Laws on your behalf. Your authorized agent must:

• Provide a signed, notarized letter authorizing them to act on your behalf
• Provide proof of their authority (power of attorney, etc.)
• Be verified according to our standard verification procedures

Verification: We may verify the authorized agent's identity and authority using the procedures outlined in Section 10.2.

9.9 Right to Opt-Out of Automated Decision-Making (CPRA)

You have the right to opt out of profiling or automated decision-making that has a legal or similarly significant effect on you. For opt-outs related to AI-generated recommendations, submit a request as described in Section 10.

10.1 Submission Methods

To exercise any of your rights under California Privacy Laws, or to submit questions regarding our processing of your personal information, please submit a request using any of the methods set forth below. All methods are equally accessible and available:

Online Request Form:

• Visit: www.resumas.com
• Available 24/7

Email:

• Send your request to: support@resumas.com
• Monitored during business hours

Mailing Address:

• Workscaler Inc.
• 717 K Street
• Sacramento, CA 95814
• Attn: Privacy Team

No Account Required: You may submit requests without creating an account. However, existing account holders may submit requests through their account dashboard.

10.2 Verification Process

Identity Verification: We will contact you to confirm receipt of your request and request any additional information necessary to verify your request. We verify requests by:

• Matching information provided in your request to information contained in our records
• Requesting confirmation of account details (if you have an account)
• Asking for basic identifying information

What We Will NOT Request:

• Government-issued identification numbers
• Financial account information or passwords
• Sensitive personal information unrelated to your request

Verification Sensitivity: Depending on the sensitivity of the request and varying levels of risk (e.g., risk of responding to fraudulent or malicious requests), we may request further information or your account access credentials to verify your request.

Authorized Agent Verification: If an authorized agent submits a request on your behalf, we will verify the agent's identity and authority using the procedures above, and may request a signed power of attorney or similar documentation.

10.3 Response Timeline and Communication

Standard Response Timeline: Our goal is to respond to any verifiable consumer request within 45 calendar days of our receipt of such request.

Extended Timeline: In certain cases where requests are complex or require significant resources, additional time might be required. If we cannot respond within 45 days, we will notify you within 45 days and provide a completion timeline of no more than 90 calendar days total.

Response Method: We will respond through the method you used to submit your request, or through another reasonable method if you indicate a preference.

Free Responses: We will provide your requested information at no charge. We may charge a reasonable fee if your request is manifestly unfounded or excessive. We will notify you of any fees before providing information.

11.1 California Privacy Protection Agency

If you have concerns about our privacy practices or believe we have violated your rights under California Privacy Laws, you may file a complaint with the California Privacy Protection Agency:

• California Privacy Protection Agency
• Email: info@cppa.ca.gov
• Website: cppa.ca.gov
• Mailing Address: See CPPA website for current address

Note: The CPPA became the primary enforcement agency for CCPA/CPRA violations effective July 1, 2023.

11.2 California Attorney General

You may also contact the California Attorney General:

• California Attorney General
• Consumer Protection Section
• 1300 I Street
• Sacramento, CA 95814
• Website: oag.ca.gov/privacy

If you have any questions or comments about this California Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or if you wish to exercise your rights under California Privacy Laws, please do not hesitate to contact us at:

Email: support@resumas.com

Mailing Address:
Workscaler Inc.
717 K Street
Sacramento, CA 95814
Attn: Privacy Team

Please note that we may require additional information to verify your identity or evaluate your request as set forth in Section 10.