Upbound Group, Inc. Coworker and Contractor Privacy Policy 

Effective date: January 29, 2024 

1. Overview 

This Coworker and Contractor Privacy Policy (the “Privacy Policy”) contains the policies and procedures to be followed by Upbound Group, Inc. including its present or future affiliates and subsidiaries (the “Company,” “Upbound,” “we,” “us,” or “our”) related to the collection and use of personal information of an applicant, coworker, a Company officer or director, or a contractor1 in the United States, (collectively referred to this in Privacy Policy as the “Coworker/Contractor,” “you,” or “your”).     

Upbound wants you to understand how and why we collect “Personal Information,” which includes any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Coworker/Applicant/Contractor.  Coworkers/Contractors should have no expectation of privacy when using technology provided by Upbound or whenever accessing Upbound technology resources or information. 

Upbound is committed to protecting the privacy of all of our Coworkers/Applicants/Contractors, and we take administrative, technical, and physical safeguards to protect your Personal Information from unauthorized access, misuse, accidental loss, or alteration. 

If you are a resident of California, please see the attached < ; a href="#californiaprivacyaddendum"> ; California Privacy Notice Addendum< ; /a> ; for a full list of the disclosures and rights available to you under California law.     

2. Notice of Coworker Monitoring

We may monitor telephonic and electronic conversations or transmissions, including e-mail and internet access, by coworkers and contractors conducted using our systems or devices. This includes use of systems, computers, telephones, and other devices provided or maintained by the Company or by our service providers. We may monitor these devices and services to ensure their safety, security, and efficiency, and to permit internal evaluations.   

3. What Information Do We Collect? 

The following chart identifies the categories of Personal Information that we may collect or process and the specific reasons for which we process each category of information. For more detailed information regarding why we process each category of information, please see the Purposes of Collection section, below.   

Please note that we may not collect all categories of Personal Information about each Coworker/Applicant/Contractor.  For example, if the collection of Personal Information relates to a specific benefit that is not generally available, we would only collect that Personal Information from the Coworkers/Contractors who are eligible for and enroll in the benefit.  Additionally, when we collect a category of Personal Information, we may not collect each specific example listed.   

    4. Purposes of Collection 

a. Administering the Coworker/Applicant/Contractor Relationship 

We keep and process Personal Information for traditional employment and contractor engagement purposes.  We use this information for management and administrative uses and only disclose it with others who have a need-to-know such information.  We keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately, during the recruitment process, while you are working for us, and after your employment or contract has ended.  This includes using Personal Information to enable us to comply with any legal requirements associated with a coworker or contractor relationship, to administer payroll, to provide you with benefits, ensure your safety, comply with an employment or service contract, and to demonstrate our commitment to equal employment opportunity and fair employment practices.     

b. Compliance with Legal Obligations 

In certain situations, we may need to collect and process your Personal Information to comply with our legal obligations.  This may include: 

• Tracking demographic information to confirm compliance with equal opportunity and non-discrimination policies and requirements ;  

• Processing information relating to your health, which could include reasons for absence and doctor’s reports and notes, in order to comply with our obligations under applicable employment and safety and health laws ;    

• Processing information regarding certifications and qualifications for your role or position ;  

• Processing information regarding participation in employment related activities about which we are required to retain a record ; and/or 

• Processing information relevant to any alleged violations of the Code of Conduct or other Company policies necessary to investigate allegations and institute disciplinary action as is required.   

c. Facilitate Communications and Efficiency   

The Company uses various tools and platforms that allow Coworkers/Contractors to more easily communicate with each other and to more efficiently access and disclose various types of work products and schedules.  Some tools may also allow Coworkers/Contractors to disclose information via social media or other channels, including information relating to job opportunities.  These tools and platforms may collect and disclose contact information and company profile pictures ; log certain preferences and actions ; collect your geolocation ; and create user profiles that allow Coworkers and the Company to track their efficiency and performance.  We may also have access to communications sent using Company systems and devices.   

d. Provide Benefits   

We offer Coworkers a variety of benefits, including benefits related to healthcare, retirement savings, and the ability to order goods and services directly from the Company.  If Coworkers take advantage of other benefits, such as fitness-related benefits, we may also collect additional biometric and sensory information.  When you participate in certain benefits programs, we may also generate a log of your activity, track internet and other network activity, and develop a user profile to provide those programs to you in a manner tailored to your preferences.      All benefits may not be available to all Coworkers, and the Company will only collect Personal Information to provide a benefit if the Coworker is eligible for and enrolled in that benefit.  Coworkers should take care to read the specific terms applicable to any particular mobile application or benefits program to understand the specific pieces of information collected. 

e. Ensure the Safety of Employees, Contractors, Facilities, and Property 

We collect various categories of information to ensure the safety of Employees/Contractors, facilities and property.  This information helps verify the identity of Employees/Contractors in specific facilities and ensure the security of facilities and Company vehicles.  It may also include the collection of certain health, vaccination, or screening information when individuals enter our facilities.   

Additionally, we may process certain categories of Personal Information to ensure the safety and security of our electronic systems and devices.  This includes monitoring our systems for suspicious or fraudulent activity and other forms of illegal conduct.  This monitoring is to ensure the safety and security of our systems and the confidential information that is entrusted to us.      Information Regarding Automated Processing of Information  We rely on certain types of automated processing to assist in identifying and screening job candidates for open positions.  This means that we use automated programs that analyze job applicants’ skills based upon a series of questions and defined job requirements.  Screening criteria and all final hiring decisions are made by the relevant management team.    This system provides benefits to our job applicants by increasing the speed of the interview process.  We periodically review the functionality of these systems to ensure their accuracy and fairness and mitigate any risks associated with their use.  However, our automated profiling system may not have access to all relevant information or may process information that is, or that you believe to be, inaccurate, which may negatively impact the outcome of the interview determination.    If you wish to opt-out of Automated Profiling, you may refuse to provide your consent at the time you submit information to Upbound for consideration of employment.     

1. Disposal of Personal Information 

We take appropriate measures to ensure that your Personal Information is processed and disposed of in a manner that maintains its confidentiality.  All Personal Information disposal procedures, including the disposal of computerized data storage devices, are designed to ensure the complete destruction of Personal Information and eliminate the risk of subsequent unauthorized access or disclosure. 

1. Updates to the Privacy Policy   

This Privacy Policy is subject to occasional revision, and if we make any material changes in the categories of information we collect or the reasons we collect that information, we will notify you by sending you an e-mail and/or by prominently posting notice of the changes.  This Privacy Policy will also be posted to the Legal Department site on RACiNET and on the Upbound Group, Inc. and affiliate websites.  You can review or consult the Privacy Policy at any time.    The Company may be subject to certain laws and regulations relating to privacy and information security in more than one jurisdiction in which Coworkers/Contractors reside.  If any term, covenant, condition, or provision of this Privacy Policy is held by a court of competent jurisdiction to be invalid, void, or unenforceable, it is the intent of this Privacy Policy that the scope of the rights and obligations of the Privacy Policy be reduced only for the affected jurisdiction and only to the extent deemed necessary under the laws of the local jurisdiction to render the provision reasonable and enforceable and the remainder of the provisions of the Privacy Policy statement will in no way be affected, impaired, or invalidated as a result. 

1. Contact us with Questions 

If you have questions regarding this Privacy Policy, please contact the Privacy Team at employeeprivacy@acima.com.    California Privacy Notice Addendum  Effective Date: January 1, 2023  This California Privacy Notice Addendum (“Addendum”) applies to applicants, coworkers, and contractors that are residents of the state of California.  This Addendum supplements our Coworker and Contractor Privacy Policy (“Privacy Policy”).  Words used in this Addendum shall be interpreted as defined by the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act, and implementing regulations (collectively, the “CCPA”).    This Addendum will provide you with a summary of the categories of information we collect, the reasons that we collect each category of information, information regarding how we may disclose your Personal Information with third parties, and information regarding your rights under the CCPA.   

1. Information We Collect and Sources of Personal Information 

In the preceding 12 months, we have collected the categories of Personal Information identified above in the Coworker and Contractor Privacy Notice.  We collect the majority of the information directly from you, through the applications or forms you submit and the information you provide at the time of hiring.  In addition to the information that you provide to us, we may collect information about you from third parties, such as information from third parties that provide accreditation, educational institutions, benefits providers, and vendors that provide background checks or related information.  Finally, we may automatically collect, store, or otherwise process information about you as you use our tools, systems, or resources, or when you are on-site at one of our locations. 

1. How Your Personal Information Is Disclosed 

In the preceding 12 months, we have disclosed the following categories of employment related information with service providers, who are necessary for facilitating the employment relationship and providing you with benefits: 

• A (Identifiers), B (Personal), C (Classification), F (Internet), G (Geolocation) (I) (Professional), J (Education), L (Sensitive).   

We enter into written contracts with our service providers to ensure the privacy and security of your Personal Information.  Under these contracts, we restrict the access to and processing of your Personal Information to that which is necessary for the purpose of the disclosure.    In certain circumstances, we may provide you with opportunities to sign up for certain benefits programs that involve the disclosure of your Personal Information to third party benefits providers.  Any such program will be purely optional and based on your opt-in participation.  In such situations, you should review the third party benefits providers’ terms and privacy policy to see how they process your information.    In the preceding 12 months, we have not sold or shared employment related Personal Information to third parties for money or anything of monetary value.  We do not collect, process, or disclose Sensitive Personal Information, as defined under the CCPA, for purposes other than those specified in Section 7027 of the CCPA regulations, or any employment related information regarding individuals under 16 years of age.   

1. Individual Rights 

The CCPA provides residents of California with a series of rights regarding the processing of their Personal Information. This section explains the scope of these rights and outlines how you may exercise them. 

1. Right to Know About Personal Information Collected, Disclosed, Shared, or Sold 

You have the right to know whether we are processing your Personal Information and to request that we disclose the Personal Information we collect, use, and disclose to third parties.  There are two types of Rights to Know requests that you can make: an Abbreviated Request and a Specific Information Request.  If you make a Right to Know (Abbreviated Request), you will receive the following information about you: 

1. Categories of Personal Information collected, sold, or shared ;  

2. Categories of sources from which Personal Information is collected ;  

3. Categories of third parties to whom the information is sold, shared or disclosed ;  

4. Business or commercial purpose for collecting, sharing, or selling Personal Information ;    

5. Categories of Personal Information disclosed for a business purpose and categories of persons to whom it was disclosed for a business purpose. 

If you make a Right to Know (Specific Pieces of Information Request), you will receive the following information about you: 

1. Specific pieces of Personal Information collected about you. 

We will provide this information to you free of charge, unless we determine that your request is manifestly unfounded or excessive.  You may request this information twice in a 12-month period.  We will provide this information to you in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data without hindrance.    There are certain exceptions to the Right to Know.  We will state in our response if an exception applies.   

1. Right of Deletion 

You have the right to request that we and our service providers delete Personal Information that we have collected about you by submitting a verifiable request.  This right is subject to certain exceptions and does not require us to delete information that we are otherwise required to hold under applicable laws.  We will state in our response if an exception applies. 

1. Right of Correction 

You have the right to request that we correct inaccuracies in any Personal Information that we collect or process about you upon receipt of a verifiable request. When submitting a correction request, we request that you provide all of the information reasonably necessary to confirm that the accuracy of the correction request. This right is subject to certain exceptions. We will state in our response if an exception applies. 

1. Right to Opt-Out of the Sale or Sharing of Personal Information 

You have the right to opt-out of the sale or sharing of your Personal Information by a business subject to certain laws and regulations.  We do not sell or share information that we collect or process about you in your capacity as a Coworker or Contractor.      To the extent you interact with the Company outside of your capacity as a Coworker or Contractor, please see our general online Privacy Policy 

1. Right to Limit the Use and Disclosure of Sensitive Personal Information 

You have the right to request that we limit the use and disclosure of your Sensitive Personal Information to only those purposes specifically authorized under California law.  At this time, we do not process or disclose your Sensitive Personal Information for purposes that are not specifically authorized under California law.  Should this change, we will notify you and provide you with an opportunity to limit our processing of your Sensitive Personal Information.   

1. Right to Non-Discrimination 

We will not retaliate against any employee, applicant for employment, or independent contractor for exercising your rights under the CCPA. Additionally, we will not discriminate against you by: denying goods or services to you ; charging different prices or rates for benefits, goods, or services, including through the use of discounts or other benefits or imposing penalties ; providing a different level of quality of goods or services to you ; or suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.     

1. Submitting Requests 

To submit a rights request, you may email us at employeeprivacy@acima.com  or contact us by phone at (801) 383-2806,  We will respond to these requests, if applicable, within 45 days of receipt of the request and without undue delay.  If we need to extend this period, we will notify you of the delay and explain the reasonably necessary justifications for our delay.      We will provide responses to your requests free of charge unless exclusions apply, which we will identify in our response.   

1. Verifying Requests 

To ensure the protection of your Personal Information, we must verify that the person submitting a request is the contractor or coworker to whom the request relates prior to processing the request.  To verify your identity, we may request up to three pieces of Personal Information about you to compare against our records.   

You will not be required to create an account with us to submit a verifiable request.  However, you may be required to access an existing account to the extent accessing the account is necessary.    We will only use Personal Information provided in your request to verify your identity and will delete any information you provide after processing the request.  We reserve the right to take additional steps as necessary to verify your identity where we have reason to believe a request is fraudulent. 

1. Authorized Agents 

California residents may submit rights requests through the use of an Authorized Agent registered with the California Secretary of State to act on your behalf.  If you choose to use an Authorized Agent, we require that you provide the Authorized Agent with written permission to allow them to submit your request and that you verify your identity directly with us.  Failure to do so may result in us denying your request.