Workforce Privacy Notice

Effective Date: 12/21/2021
Last Updated on: 12/21/2021

This Workforce Privacy Notice (“Notice”) sets out how First Watch Restaurants, Inc. (“First Watch,” “we,” or “us”) collects, uses, discloses, and protects the personal information about our workforce, including employees, contractors, job applicants, and job candidates who reside in certain jurisdictions, namely California and Virginia (“Workforce”). This Policy supplements our general Privacy Policy.

We are committed to protecting the privacy of our Workforce. Accordingly, we will use any Workforce personal information in accordance with this Notice. However, this Notice does not protect information you post to public areas or third-party websites, except as set forth herein. This Notice imposes no duties on us not imposed by state, federal, or other applicable law.

We may change this Notice periodically by updating this page. You should check back from time to time to ensure that you continue to agree with the terms of this Notice.

Any inquiries about this Notice should be directed to us at privacy@firstwatch.com, 941-500-1970 or toll free at 888-270-1095, or by mail to:

First Watch Restaurants, Inc.
Attn: Privacy
8725 Pendery Place, Suite 201
Bradenton, FL 34201

THE INFORMATION WE COLLECT

We may collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with individuals in the Workforce (“PI”).

PI does not include:

• Publicly available information from government records;
• Deidentified or aggregated consumer information;
• Health or medical information covered by the Health Insurance Portability and Accountability Act and the California Confidentiality of Medical Information Act; or
• PI covered by various privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act, and the Driver’s Privacy Protection Act of 1994.

We may collect PI about you through our application, recruitment, employment or engagement processes, either directly from you or (where applicable) from another person or entity, such as an employment agency, recruitment or professional networking website, background check provider, or from others who provide references on prospective workers. We will collect additional Workforce PI throughout the course of employment or other provision of services to us. Workforce PI may include, depending on the position:

• Identification information, such as name and date of birth.
• Contact information, such as home and business addresses, telephone numbers, and email addresses, including about your beneficiaries or emergency contacts.
• Professional or employment-related information, including:
  • Financial information, such as wages, bank account details if required for direct deposit, Social Security number, payroll records, tax identifier, and tax information.
• Business travel and expense information, such as TSA Known Traveler number, passport information, and corporate credit card usage.
• Application, recruitment, new-hire, or other engagement information, such as application forms and information included in a resume; copies of identity and immigration/work authorization documents; citizenship and residence status; background screening results and references.
• Career information, such as job title, organization charts, start and end dates, work location, appraisal and performance information, time-off records, disciplinary and grievance information, and termination details.
• Internet, electronic network, and device activity information and related identifiers, such as information about your use of our information, communication, and collaboration systems, including user IDs, passwords, IP addresses, and audit trails of system access.
• Physical security system information, such as security camera footage and security pass entry records.
• Photographs provided by you or used for work purposes.
• Sensitive information, such as demographic information and health information (e.g. disability status, leaves of absence, health and safety incidents or accidents, health insurance information, medical information related to worker’s compensation claims, other medical records, and information relating to ability to perform job duties).

In particular, we may collect the following categories of PI from our Workforce:

USE OF PERSONAL INFORMATION

We use Workforce PI for many purposes, including:

• Workforce planning, recruitment, and hiring, including assignment planning and budgeting, job advertising, interviewing, background checking as permitted by law, and selecting and engaging individuals to join our team.
• Workforce management and administration, including payroll processing, training administration, compensation and benefits, and performance management.
• Performance of business operations, including providing, managing, supporting, and improving information and communication systems and processes; maintaining accounts and internal directories; data administration; crisis management; processing payroll.
• Legal and regulatory compliance with policies, guidelines and contracts.
• Communications with our Workforce, including about updates and other changes.
• For business structure changes, evaluations, and due diligence.
• To personalize an applicant or candidate experience and to deliver content and information relevant to that purpose, including via email or text message (with your consent, where required by law).
• To help maintain the safety, security, and integrity of our network, systems, technology assets, business, premises, customers, and other members of our Workforce.
• To analyze trends, administer candidate or applicant websites, track user movement, and compile broad aggregate demographic information for reporting purposes.
• To respond to law enforcement or legal requests or investigations and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your PI or as otherwise permitted under applicable law.
• Matters relating and/or incidental to the items above.

We may use sensitive PI as follows:

• We may use information relating to medical conditions and disabilities or leaves of absence to comply with (or exercise rights under) employment and other legal or contractual obligations, for workforce planning and administration, and preparing analyses and reports.

• We may use information about your physical or mental health or disability status to help protect the health and safety of our workforce and workplace, to assess your fitness to work, to provide reasonable workplace accommodations and to monitor and manage absence to comply with (or exercise rights under) employment and other legal or contractual obligations, and (if necessary) to protect your or others’ vital interests.

• We may use information that we may collect about your demographics to ensure meaningful equal opportunity and diversity and inclusion monitoring and reporting, and to comply with (or exercise rights under) employment and other legal requirements.

We will not collect additional categories of PI or use the PI we collected for materially different, unrelated, or incompatible purposes without providing you notice.

SHARING OF PERSONAL INFORMATION

We may disclose your PI to the following third-party service providers:

• Compensation and benefits providers,
• Payroll service providers,
• Tax and other professional advisors,
• Technology service providers,
• Corporate card issuers,
• Travel and expense management providers,
• Transport and security providers,
• HR management and administration suppliers,
• Recruiting agencies and temporary employment agencies,
• Background check providers,
• Consumer reporting agencies and/or background check providers, and
• Auditors, lawyers, and other professional services providers.

Otherwise, we may disclose Workforce PI:

• If and when required to do so by law, regulation, or court order;
• In response to a request for assistance by a law enforcement agency;
• To seek legal advice external lawyers or in connection with litigation;
• In connection with the sale, purchase, or merger of a business or the establishment of a joint venture;

YOUR RIGHTS AND CHOICES

For certain jurisdictions: The CCPA provides California-resident consumers with specific rights regarding their PI. Other jurisdictions may also provide similar rights. This section describes CCPA rights and explains how to exercise those rights.

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your PI over the past 12 months (the “right to know”). Once we receive your request and confirm your identity, we will disclose to you:

• The categories of PI we collected about you.
• The categories of sources for the PI we collected about you.
• Our business or commercial purpose for collecting or selling that PI.
• The categories of third parties with whom we share that PI.
• If we sold or disclosed your PI for a business purpose, two separate lists disclosing:
  • sales, identifying the PI categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the PI categories that each category of recipient obtained.
• The specific pieces of PI we collected about you (also called a data portability request).

Right to Delete

You have the right to request that we delete any of your PI that we collected from you and retained, subject to certain exceptions (the “right to delete”). Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the PI applies. We may deny your deletion request if retaining the PI is necessary for us or our Service Provider(s) to, among other things:

• Complete the transaction for which we collected the PI, provide a service that you requested, or take actions reasonably anticipated within the context of our ongoing business relationship with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify PI not subject to one of these exceptions from our records and will direct our service providers to take similar action.  We commit that we will not reidentify deidentified PI.

DATA SECURITY

While no method of data transmission is guaranteed against unlawful third-party interception or other misuse (for example, e-mail sent to or from our Site may not be secure), First Watch uses commercially reasonable administrative, technical, and physical efforts to ensure protection of your PI from unauthorized access, disclosure, alteration, and destruction.

DATA RETENTION

We will retain PI for as long as the information has value as part of services we provide, or as long as is necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, whichever is longer.