California Personnel Privacy Notice

This California Personnel Privacy Notice (this “Notice”) supplements the Personnel Privacy Policy (the “Privacy Policy”) and applies solely to California Personnel. 

The California Consumer Privacy Act, as amended by the California Privacy Rights Act and its implementing regulations (collectively, the “CCPA”) provides California residents with certain rights in relation to their personal information (as defined in the CCPA). Pursuant to the CCPA, this Notice provides additional details regarding our collection, use, and disclosure of personal information relating to California Personnel. This Notice also describes the rights available to you as a California resident in relation to your personal information and how you can exercise your rights. 

Capitalized terms used but not defined in this Notice have the definitions ascribed to them in the Privacy Policy.

Notice at Collection

We collect the categories of personal information listed in the table below.

Category of Personal Information Collected	Sold or Shared
Identifiers, including names, postal addresses, email addresses, birth dates, IP addresses, Social Security numbers, driver’s license or state identification card numbers, passport numbers, and other similar identifiers.	No
Personal information as defined in the California Customer Records statute, including names, signatures, Social Security numbers, postal addresses, telephone numbers, passport numbers, driver’s license or state identification card numbers, education and employment information, bank account numbers and other financial information, medical information, and health insurance information.	No
Protected classification characteristics under California law or federal law, including age (over 40), race, religion, sex/gender, gender identity/gender expression, sexual orientation, marital status, military or veteran status, national origin, disability status, and leave requests.	No
Biometric information, including biometric identifiers (e.g., fingerprints, palm prints, scans of face geometry, etc.).	No
Internet or other electronic network activity information, including information about the access to and use of our IT systems and networks, such as internet browsing history, search history, and interactions with web-based tools.	No
Geolocation data, such as IP location.	No
Audio, electronic, visual, or similar information, including call recordings, audio/video recordings of meetings or events, and CCTV video footage.	No
Professional or employment-related information, including job roles/titles and performance evaluations.	No
Education information, including education records.	No
Inferences, meaning inferences drawn from any of the above-listed categories of information to create a summary about individuals’ abilities or aptitude.	No
Sensitive personal information, including Social Security, driver’s license, state identification card, and passport numbers; log-in information for Hershey-managed accounts in combination with passwords allowing access to the accounts; the contents of emails sent via Hershey’s systems; information revealing or concerning racial or ethnic origin, religious or philosophical beliefs, or union membership; biometric information; personal information collected and analyzed concerning health; and personal information collected and analyzed concerning sexual orientation.	No

As further described in the “Information Use” section of the Privacy Policy, we generally collect and use the above-listed categories of personal information to manage our relationship with you and as otherwise necessary or appropriate in connection with the fulfillment of other legitimate business purposes.

As noted in the table above, we do not “sell” or “share” (as these terms are defined in the CCPA) personal information.

We retain each category of personal information that we collect for as long as necessary to fulfill the purposes described in the Privacy Policy, including to satisfy legal or reporting requirements.

For additional information regarding our information handling practices and your legal rights, please continue reading this Notice.

Personal information collection and disclosure

The following chart details which categories of personal information we have collected from and about California Personnel in the past twelve (12) months, the source(s) of each category of information, and the categories of third parties to whom we have disclosed each category of information for a business purpose. Please note that the first column in the chart lists by category the types of information described in the “Information Collection” section of the Privacy Policy, as required by the CCPA.

Category of Personal Information	Categories of Sources	Disclosures of Personal Information for a Business Purpose
Identifiers, including names, postal addresses, email addresses, birth dates, IP addresses, Social Security numbers, driver’s license or state identification card numbers, passport numbers, and other similar identifiers.	Directly from individuals   Through automated means	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Our customers and partners · Other Personnel
Personal information as defined in the California Customer Records statute, including names, signatures, Social Security numbers, postal addresses, telephone numbers, passport numbers, driver’s license or state identification card numbers, education and employment information, bank account numbers and other financial information, medical information, and health insurance information.	Directly from individuals   Third-party sources	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Other Personnel
Protected classification characteristics under California law or federal law, including age (over 40), race, religion, sex/gender, gender identity/gender expression, sexual orientation, marital status, military or veteran status, national origin, disability status, and leave requests.	Directly from individuals	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Other Personnel
Biometric information, including biometric identifiers (e.g., fingerprints, palm prints, scans of face geometry, etc.).	Directly from individuals	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers
Internet or other electronic network activity information, including information about the access to and use of our IT systems and networks, such as internet browsing history, search history, and interactions with web-based tools.	Through automated means	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers
Geolocation data, such as IP location.	Through automated means	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers
Audio, electronic, visual, or similar information, including call recordings, audio/video recordings of meetings or events, and CCTV video footage.	Through automated means	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers
Professional or employment-related information, including job roles/titles and performance evaluations.	Directly from individuals   Third-party sources	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Other Personnel · Our customers and partners
Education information, including education records.	Third-party sources	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Other Personnel
Inferences, meaning inferences drawn from any of the above-listed categories of information to create a summary about, for example, individuals’ abilities or aptitude.	Through automated means   Third-party sources	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Other Personnel
Sensitive personal information, including Social Security, driver’s license, state identification card, and passport numbers; log-in information for Hershey-managed accounts in combination with passwords allowing access to the accounts; the contents of emails sent via Hershey’s systems; information revealing or concerning racial or ethnic origin, religious or philosophical beliefs, or union membership; biometric information; personal information collected and analyzed concerning health; and personal information collected and analyzed concerning sexual orientation.	Directly from individuals	Hershey has disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties:   · Our affiliates and subsidiaries · Our service providers · Other Personnel

Purposes for Collecting Personal Information

As described in more detail in the “Information Use” section of the Privacy Policy, we generally collect the above-listed categories of personal information to manage our relationship with you and as otherwise necessary or appropriate in connection with the fulfillment of other legitimate business purposes.

Disclosures of Personal Information

As detailed in the “Information Disclosure” section of the Privacy Policy, we disclose personal information to fulfill specific processing purposes. We will also disclose certain categories of personal information to competent governmental and public authorities and other third parties as necessary or appropriate, including when we have a legal or contractual obligation to disclose the information.

Sale and Sharing of Personal Information

We do not “sell” or “share” (as such terms are defined in the CCPA) personal information of any individuals (including individuals under 16 years of age) and have not “sold” or “shared” any personal information in the past twelve (12) months.

Use and Disclosure of Sensitive Personal Information

As detailed in the chart above, we collect certain “sensitive personal information” (as defined in the CCPA). However, we do not use or disclose sensitive personal information for any purpose outside of the limited permissible purposes set forth in the regulations implementing the CCPA. These purposes including: (i) preventing, detecting, and investigating security incidents; (ii) resisting malicious, deceptive, fraudulent, or illegal actions directed at our business; and (iii) processing the information for purposes that do not involve inferring characteristics about individuals.

Your Legal Rights

You have the right to request that we:

• Disclose to you the following information covering the twelve (12) months preceding your request:
  • the categories of personal information we have collected about you and the categories of sources from which we collected such information;
  • the specific pieces of personal information we have collected about you;
  • the business or commercial purposes for collecting, selling, or sharing your personal information (where applicable);
  • the categories of third parties to whom we disclosed such personal information; and
  • if we sold, shared, or disclosed your personal information for a business purpose, two separate lists disclosing:
    • sales and shares, identifying the personal information categories that each category of recipient received; and
    • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• Delete the personal information that we have collected from you, subject to certain exceptions.
• Correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing.

We will not discriminate against you if you decide to exercise your rights under the CCPA.

If you are interested in exercising any of the above-listed rights, you can do so by emailing the privacy group at privacy@hersheys.com.

To protect your privacy, we will require the matching of up to three pieces of personal information provided with your request with information we maintain to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only. Please note that we may decline a request where we are unable to verify your identity and confirm the personal information we maintain relates to you.

Authorized Agents

You may authorize someone to submit a privacy rights request on your behalf (an “authorized agent”). An authorized agent will need to demonstrate that you’ve authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable probate law. Depending on the evidence provided, we may also contact you to verify your identity with us or request confirmation from you that the agent is authorized to submit the request on your behalf.

Changes to this Notice

We may update this Notice from time to time to reflect changes in our information handling and privacy practices and/or changes in applicable law. The “Last Updated” date at the top of this page indicates when this Notice was last revised. If we make changes, we will revise the date at the top of this page. We encourage you to review this Notice periodically to remain informed about our information handling and privacy practices.

How to Contact Us

If you have any questions or comments about this Notice or our information handling and privacy practices, please contact us using the following contact details:

privacy@hersheys.com