California Employee and Applicant Privacy Policy

Last Updated: September 9, 2026

This California Employee and Applicant Privacy Policy describes how Sunshine Retirement Living LLC and the subsidiaries, affiliates, and related entities that employ personnel or participate in recruiting (collectively, “Sunshine,” “Company,” “we,” or “us”) collect and process personal information about California residents in an employment context. The California Consumer Privacy Act (“CCPA”) requires us to provide California employees and job applicants with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, sale, sharing, and retention of personal information, together with a description of applicable rights. Terms defined in the CCPA have the same meaning when used in this policy.

This policy applies to current and former employees and job applicants who are California residents. It also describes information we may collect about dependents, beneficiaries, emergency contacts, references, and other individuals when that information is provided in connection with an employment relationship or application.

This policy does not apply to personal information we collect from you in a consumer or business-to-business capacity unrelated to employment. For information about those practices, including online advertising and opt-out preference signals, please see our State Privacy Notice at https://www.sunshineretirementliving.com/state-privacy-notice/ and our general Privacy Policy at https://www.sunshineretirementliving.com/privacy-policies/.

Personal Information Collected

We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household (“personal information”). Personal information does not include:

• Publicly available information, including information from government records, widely distributed media, or information an individual makes available to the general public without restricting it to a specific audience.
• Lawfully obtained, truthful information that is a matter of public concern.
• Deidentified or aggregated information.
• Information excluded from the CCPA’s scope, such as qualifying health or medical information governed by HIPAA or the California Confidentiality of Medical Information Act, qualifying clinical trial or research information, and personal information governed by certain sector-specific laws such as the Fair Credit Reporting Act, to the extent an exclusion applies.

Personal Information Categories Chart

The chart below identifies the categories of personal information we collected from California employees and applicants within the last 12 months and the retention criteria we generally apply. Actual retention may vary based on the employment relationship, the application process, legal obligations, litigation holds, security needs, and other legitimate business requirements.

Sensitive Personal Information Categories Chart

Sensitive personal information is a subtype of personal information. The chart below identifies the sensitive personal information categories we may collect and whether Sunshine uses that information to infer characteristics about employees or applicants. Sunshine generally collects sensitive personal information for employment administration, legal compliance, benefits, safety, timekeeping, and other purposes an employee or applicant would reasonably expect—not to infer characteristics for unrelated purposes.

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you, including through applications, resumes, interviews, screening questions, ADP Workforce Now, benefit and payroll forms, leave or accommodation requests, communications, and other information you provide.
• Indirectly from you, including through your interactions with applicant portals, HR systems, time clocks, Company systems, communications, training systems, and workplace processes.
• From workplace security systems and communication technologies, including common-area video surveillance and meeting or call recording functionality where used.
• Recruiting and job-posting platforms, including ADP Workforce Now Recruiting, Indeed, ZipRecruiter, and other sites to which job postings may be distributed.
• Service providers, including ADP Workforce Now, First Advantage, Relias, ADP CaseBuilder, UnitedHealthcare/UMR, Principal, Symetra, Empower Retirement, DailyPay, SurveyMonkey, Microsoft, Calendly, and other providers that support recruiting, background screening, payroll, benefits, training, communications, scheduling, surveys, unemployment claims, and HR administration.
• Government agencies, educational institutions, professional licensing bodies, background-screening sources, former employers, references, and other sources authorized or permitted by law.
• Managers, supervisors, coworkers, residents, customers, visitors, and other individuals who provide information related to performance, conduct, safety, scheduling, investigations, or workplace operations.
• Benefit providers, insurers, medical professionals, and other authorized sources involved in administering benefits, leaves, accommodations, workers’ compensation, drug testing, or post-offer examinations.
• Inferences generated from application responses, preliminary screening questions, employment records, performance information, and other information collected in the employment context.

How We Use Personal Information

Personal Information Collection, Use, and Disclosure Purposes

We may use and disclose personal information, including sensitive personal information, for the following employment-related business purposes:

• Recruiting, receiving and processing applications, communicating with applicants, evaluating qualifications, administering screening questions, scheduling interviews, checking references, and making hiring decisions.
• Conducting background checks, drug testing, post-offer examinations where permitted, verifying identity, evaluating driving qualifications, and confirming employment eligibility and work authorization.
• Onboarding employees and creating, maintaining, and securing employee accounts and personnel records.
• Administering timekeeping, scheduling, payroll, direct deposit, expense reimbursement, compensation, bonuses, and other payments.
• Administering health, dental, life, retirement, leave, disability, workers’ compensation, wellness, and other employee benefits and programs.
• Handling leave requests, reasonable accommodations, workplace injuries and illnesses, workers’ compensation, and occupational health and safety obligations.
• Providing training, professional development, licenses, certifications, and compliance programs, including through Relias and other authorized providers.
• Managing job assignments, performance, attendance, promotions, discipline, investigations, grievances, separations, unemployment claims, and other aspects of the employment relationship.
• Using biometric time clocks and related systems to identify employees and record time punches.
• Administering equal-employment-opportunity, affirmative-action, diversity, and legally required reporting programs. Information voluntarily collected for these purposes is not used in employment selection decisions except as permitted or required by law.
• Operating, securing, maintaining, and monitoring Company facilities, systems, devices, communications, accounts, and information; preventing unauthorized access; and investigating security incidents, fraud, misconduct, or violations of Company policy.
• Communicating with employees, applicants, emergency contacts, dependents, beneficiaries, service providers, and government agencies.
• Managing insurance coverage, claims, audits, legal compliance, litigation, investigations, subpoenas, court orders, and other legal or regulatory obligations.
• Performing workforce planning, analytics, reporting, budgeting, quality control, operational improvement, and organizational management.
• Evaluating or completing mergers, acquisitions, reorganizations, financing, asset transfers, or similar corporate transactions involving employment records.
• Fulfilling other purposes disclosed when information is collected, as otherwise permitted by the CCPA, or with consent where required.

Sensitive Personal Information Use and Disclosure Purposes

We use and disclose sensitive personal information only for purposes permitted by the CCPA and reasonably expected in the employment relationship, including:

• Performing recruiting, onboarding, payroll, timekeeping, benefits, leave, accommodation, workplace-safety, and other employment-administration activities.
• Verifying identity, work authorization, qualifications, licenses, certifications, direct-deposit information, and employee or applicant records.
• Preventing, detecting, and investigating security incidents, malicious or fraudulent conduct, policy violations, and unauthorized access to Company information or property.
• Protecting the physical safety of employees, residents, visitors, and others.
• Providing services on Sunshine’s behalf, including HR administration, recruiting, background screening, payroll, benefits, training, storage, analytics, security, and communications.
• Verifying or maintaining the quality, safety, and effectiveness of employment-related systems and services.
• Complying with federal, state, and local employment, tax, benefits, leave, accommodation, immigration, safety, and records-retention requirements.
• Collecting or processing sensitive personal information without using it to infer characteristics for unrelated purposes.

Sunshine does not use or disclose sensitive personal information for purposes that give rise to a right to limit its use or disclosure under the CCPA. Accordingly, Sunshine does not currently provide a separate mechanism to limit the use or disclosure of employment-related sensitive personal information.

Additional Categories or Other Purposes

We will not collect additional categories of personal information or use personal information for materially different, unrelated, or incompatible purposes without providing appropriate notice. We will obtain consent when required by law.

We may collect, process, and disclose aggregated or deidentified employment information for lawful purposes. When we maintain information in deidentified form, we will not attempt to reidentify it except as permitted to test whether deidentification processes satisfy applicable legal requirements.

Disclosing, Selling, or Sharing Personal Information

Business Purpose Disclosures

We may disclose personal information, including sensitive personal information, to service providers, contractors, affiliates, government entities, professional advisers, and other recipients for the business purposes described above. We require service providers and contractors to process personal information under written terms that describe the permitted purposes, require appropriate confidentiality and privacy protections, and restrict use of the information beyond providing services to Sunshine.

The following chart identifies principal categories of recipients, representative recipients, categories of information disclosed, and disclosure purposes during the preceding 12 months.

Selling or Sharing Personal Information

In the employment context, Sunshine does not sell personal information to third parties and does not share personal information with third parties for cross-context behavioral advertising. Sunshine has not sold or shared employment-related personal information for those purposes during the preceding 12 months.

Information collected when you interact with Sunshine as a website visitor or consumer, rather than as an employee or applicant, is governed by our State Privacy Notice, which describes Sunshine’s online advertising and sharing practices and related opt-out rights.

Your Rights and Choices

California employees and applicants may have the following rights under the CCPA, subject to applicable exceptions and limitations.

Right to Know and Data Portability

You may request that we disclose information about our collection and use of your personal information, including the specific pieces of personal information we maintain about you. Our response will cover the 12 months preceding the request. You may also request personal information we collected and maintain about you beyond that 12-month period, beginning on or after January 1, 2022, unless providing that information would be impossible or involve disproportionate effort. You may exercise the right to know twice in any 12-month period.

After verifying the request, we may disclose:

• The categories of personal information we collected about you and the categories of sources from which we collected it.
• The business or commercial purposes for collecting, using, and disclosing the information.
• The categories of persons to whom we disclosed personal information and the categories disclosed to each type of recipient.
• A portable copy of the specific personal information we maintain about you, subject to permitted redactions and security protections.

Right to Delete and Right to Correct

You may request deletion of personal information that Sunshine collected from you and retained, subject to legal and operational exceptions. Employment, payroll, tax, benefits, safety, investigation, and legal obligations may require us to retain significant portions of an employment or applicant record. When deletion is required, we will also direct relevant service providers and contractors to take appropriate action.

You may request correction of personal information that you believe is inaccurate. We may request documentation reasonably necessary to verify your identity and evaluate the requested correction. When correction is required, we will also notify relevant service providers and contractors as appropriate.

Right to Limit Sensitive Personal Information Use and Disclosure

The CCPA provides a right to limit certain uses and disclosures of sensitive personal information. Sunshine does not currently use or disclose employment-related sensitive personal information in a manner that gives rise to that right. Accordingly, Sunshine does not currently provide a separate limitation mechanism for employment-related sensitive personal information.

Personal Information Sales or Sharing Opt-Out Rights

Because Sunshine does not sell employment-related personal information or share it for cross-context behavioral advertising, we do not provide a separate employment-context sale or sharing opt-out mechanism. California consumers may exercise opt-out rights for Sunshine’s consumer-facing online practices through the methods identified in our State Privacy Notice.

Automated Decisionmaking Technology Rights

California law may provide additional rights when a business uses automated decisionmaking technology (“ADMT”) to make significant decisions about employment or compensation without meaningful human involvement. Sunshine does not currently use ADMT to make significant employment or compensation decisions without meaningful human involvement. Applicant tracking and recruiting systems may present screening questions, organize applicant information, or otherwise assist Sunshine personnel, but Sunshine personnel make hiring and other significant employment decisions. If Sunshine begins a covered use of ADMT, it will provide any notice and applicable rights required by law.

Right to Non-Discrimination

You have the right not to be discriminated or retaliated against for exercising rights provided by the CCPA.

How to Exercise Your Rights

Exercising the Rights to Know, Delete, or Correct

To submit a verifiable request, contact Sunshine through any of the following methods:

• Call 866-712-1087.
• Email Hrteam@sunshineret.com
• Online: https://www.sunshineretirementliving.com/privacy-request/.

Please describe your request with sufficient detail to allow us to understand, evaluate, and respond to it. Current employees may also contact Human Resources through established internal channels. You do not need to create a new account to submit a request.

Verification Process and Authorized Agents

Only you or a person legally authorized to act on your behalf may submit a request concerning your personal information. To designate an authorized agent, we may require written authorization or other documentation permitted by law. If a request is submitted on behalf of another individual, including a minor, we may require appropriate documentation establishing the requester’s authority to act on that individual’s behalf, as permitted by law.

We may request information reasonably necessary to confirm identity or authority, such as your name, contact information, current or former employment or applicant status, work location, employee identification number, application details, Company email address, or information maintained in ADP Workforce Now. We use information provided for verification only to process the request and protect personal information from unauthorized disclosure.

We cannot fulfill a request to know, delete, or correct if we cannot verify the requester’s identity or authority and confirm that the information relates to that individual. Requests submitted through a Company email address, authenticated HR account, or other trusted channel may be treated as sufficiently verified when appropriate to the sensitivity of the requested information.

Responding to Your Requests to Know, Delete, or Correct

We will confirm receipt of a request within ten business days. We will substantively respond to a verifiable request within 45 calendar days. If we reasonably require additional time, we may extend the response period by up to another 45 calendar days and will notify you of the extension and explain the reason for it.

Our response will state whether we complied with the request. If we deny a request in whole or in part, we will explain the basis for the denial to the extent permitted by law. We may withhold or retain information when required or permitted by employment, payroll, tax, benefits, safety, security, litigation, privilege, or other applicable legal requirements.

For data-portability requests, we will provide responsive information in a readily usable format reasonably designed to permit transmission to another entity without hindrance. We do not charge a fee unless a request is excessive, repetitive, or manifestly unfounded; if a fee is warranted, we will explain the basis and provide an estimate before completing the request.

How We Protect Your Personal Information

We use commercially reasonable administrative, physical, and technical measures designed to protect personal information from accidental loss or destruction and unauthorized access, use, alteration, or disclosure. We limit access to employees, agents, service providers, and contractors with a legitimate employment-related business need. No system, storage method, or electronic transmission is completely secure, and we cannot guarantee absolute security.

Employees and applicants should protect account credentials and use reasonable care when sending personal information by email, text, chat, or other electronic communications. Any transmission of personal information is at the sender’s risk.

Changes to This Policy

We may update this California Employee and Applicant Privacy Policy from time to time. If we make material changes, we will update the “Last Updated” date above and provide the revised policy through an appropriate method, such as the Company intranet, ADP Workforce Now, email, an applicant portal, or another employment communication channel.

Contact Information

For questions or comments about this policy, Sunshine’s employment privacy practices, or California privacy rights, contact:

Phone: 866-712-1087
Email: Hrteam@sunshineret.com

Postal Address:
Sunshine Retirement Living LLC
Attn: Human Resources / Privacy
1080 Mount Bachelor Dr., #200
Bend, OR 97702

If you need this policy in an alternative format because of a disability, contact Hrteam@sunshineret.com or 866-712-1087.