Employee Privacy Notice

About this Notice

Welcome to enVista! This privacy notice sets out how we collect, use, and disclose your personal information during the course of your employment or application process, in compliance with our obligations under the California Consumer Privacy Act (CCPA) (as amended by the California Privacy Rights Act of 2020 (CPRA)) and India’s Digital Personal Data Protection Act (DPDP Act). This notice applies to all employees, including full-time, part-time, and temporary employees of enVista located in California and India.

This notice supplements other Human Resources-related policies and notices, that apply to all enVista employees and that can be viewed at provide directions where HR policies are located if applicable.

For information on our privacy practices applicable to customers and website visitors, please view our Consumer Privacy Notice.

This Privacy Notice applies to both our online (for example, when you apply for a job via an online portal) and offline information practices. Under California law, the term “personal information” refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to you or your household, directly or indirectly. Under India law, the term “personal information” (used interchangeably with the term “personal data”) refers to any information about an individual who is identifiable by or in relation to such information.

The data controller or business in charge of operating our website is enVista, LLC, located at 11555 N. Meridian Street, Suite 300, Carmel, Indiana 46032, USA. To contact us with questions about our privacy practices, please see the Contact Information section below.

Our Information Practices

a) Personal Information We Collect About You

We only process personal information with your consent, and we only collect it for the purposes of supporting your employment application with us and during the course of your employment.

We collect and use the following categories of personal information:

b) Categories of Sources from Which Your Personal Information is Collected

As an employer, enVista collects personal information of employees and job applicants from the following categories of sources:

Directly from individuals: We collect information directly from you when you provide it during the application process, interviews, onboarding, or throughout your employment. This may include information submitted on resumes, application forms, or through our communication channels.

Service providers: We may obtain personal information from our service providers or vendors, such as background check providers, recruitment agencies, or technology solution providers, to verify qualifications, conduct reference checks, facilitate the hiring process, and to prevent and/or resolve disruptions of work devices.

Publicly available sources: To the extent permissible under the applicable federal, state, and local laws, we may gather information from publicly available sources, such as professional networking platforms or websites, or your social media accounts, to gain insights into your professional background, work history, work ethic, communication skills, or overall suitability for a position.

Company systems and records: During your employment, we may collect personal information from internal systems and records, including HR databases, keycards and access management systems, timekeeping systems, performance evaluations, and other employment-related platforms.

Please note that the specific sources from which we collect personal information may vary depending on the circumstances and applicable legal requirements.

c) Purposes for Collecting and Using Your Personal Information

We may use your personal information for the following business purposes:

Managing Human Resource Functions:

• Workforce planning
• Recruiting, hiring, and onboarding
• Performing background checks
• Increasing employee engagement
• Training and career development
• Assessing performance
• Determining promotions, transfers, salary, awards, and bonuses
• Managing disciplinary matters
• Managing payroll and business expenses
• Administering leave requests
• Employee communications
• Administration of benefits
• Promoting employee health and safety

Conducting Business Operations:

• Budgeting
• Recordkeeping and reporting requirements
• Managing infrastructure and company assets
• Strategic planning
• Maintaining security
• Emergency response and business continuity
• Conducting audits
• Pursuing or defending legal or administrative claims

Monitoring:

• Compliance with internal policies and procedures
• Use of company resources
• Any other monitoring activities permitted by applicable laws

Compliance with:

• Legal and regulatory obligations
• Court or other government directives
• Internal policies and procedures

Investigating:

• Reports of wrongdoing
• Policy violations
• Internal complaints

d) Sale and Sharing of Personal Information

We do not sell your personal information or share your personal information for purposes of cross-contextual behavioral advertising.

Categories of Service Providers and Third Parties

We may share your personal information with:

• Service providers we use to help deliver benefits and services related to your prospective or actual employment, such as identity verification providers, payment service providers, time and attendance programs, benefits programs, and more. We grant our service providers access to personal information only to the extent needed for them to perform their functions, and we require them to protect the confidentiality and security of such information.
• Third parties approved by you (e.g., your legal counsel, assessment and background check providers, and others).
• Law enforcement, government entities, and pursuant to the legal process where required by law.

Categories of Information That May Be Disclosed

We have disclosed the following categories of personal information, as described in Section 2(a) above, to service providers and third parties for a business purpose in the past twelve (12) months:

• Identifiers
• Consumer records information
• Protected classification characteristics under state or federal law
• Internet or other electronic network activity
• Geolocation data
• Audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information
• Education information
• Sensitive personal information

Purposes of Disclosure

For each category of personal information listed in Section 2(b)(ii) above, we may disclose such information for the following purposes:

• To respond to your requests or inquiries. We may disclose your personal information to any third party to respond to your requests or inquiries, with your consent or at your direction.
• For marketing purposes. In the case of marketing materials or events in or at which you have consented to appear, we may disclose your personal information to the general public to facilitate marketing and business promotion.
• To facilitate business transfers or assignments. We may disclose your personal information to other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
• For legal and regulatory compliance. We may disclose your personal information to government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.

e) Personal Information of Persons Under Sixteen (16) Years of Age

enVista does not knowingly employ or recruit, or collect, use, sell, or share personal information of individuals under 16 years of age. We employ background checks and other verifications to make certain that our employees and job applicants are of the legal age of majority for employment in their jurisdiction.

f) Use or Disclosure of Sensitive Personal Information

enVista uses or discloses sensitive personal information of employees or job applicants only:

1. To perform the services expected by an average employee or job applicant in connection with their employment applications for employment, such as processing applications, background checks and functions attendant the employment relationship.
2. To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
3. To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.
4. To ensure the physical safety of natural persons.
5. To perform services on behalf of the business. For example, we may use information for the purposes of hiring, processing employment applications, background checks and functions attendant the employment relationship.
6. To verify or maintain the quality or safety of devices that are owned or controlled by us, and to improve, upgrade, or enhance such devices.

g) Protecting Your Personal Information

Personal information is stored by enVista using industry-standard, reasonable, and technically feasible physical, technical, and administrative safeguards against foreseeable risks, such as unauthorized access. Such safeguards include: (a) privileged access controls; (b) encryption in transit and at rest; (c) backup and recovery procedures in the event of a business interruption; (d) vulnerability and patch management; (e) third-party due diligence practices; and (f) monitoring and logging of hardware to detect potential data breaches.

h) How Long Your Personal Information Will Be Kept

We will keep your personal information for the duration of the job application and employment relationship, unless applicable law requires otherwise. Thereafter, we will keep your personal information pursuant to our Data Retention and Deletion Policy:

• To respond to any questions, complaints or claims made by you or on your behalf
• To comply with legal obligations and to enforce our rights
• To show that we treated you fairly, or
• To keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this notice. Different retention periods apply for different types of personal information. For details on retention periods, please see our Data Retention and Deletion Policy.

When it is no longer necessary to retain your personal information, we will delete or anonymize it.

FOR RESIDENTS OF INDIA: When you request erasure of your personal information, or when the purpose for which your data was collected ends, we may retain certain information solely for the limited purposes of (i) enabling the detection of unauthorized access, investigation, remediation to prevent recurrence, and continued processing in the event of a security compromise, or (ii) compliance with applicable law that requires retention — but in no event for longer than one (1) year following such request or the end of the original processing purpose, unless otherwise required by law. For example, after an employee leaves the organization, their data is retained only for a reasonable period and then deleted. A forty-eight (48) hour warning shall be issued to employees before erasing any such data. Once the retention period expires, data will be securely deleted or anonymized.

Employee Privacy Rights

To exercise any of your rights under this notice, you may contact the designated contact person using the details provided in the Contact Information section below.

FOR RESIDENTS OF CALIFORNIA:

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), you have the following rights:

• Right to Know: Employees have the right to know the personal information a business collects about them and how it is used and shared.
• Right to Correct: Employees have the right to correct inaccurate information we have about them.
• Right to Delete: Employees have right to delete personal information collected from them (with some exceptions).
• Right to Opt Out of Sale/Sharing: Employees have the right to opt-out of the sale or sharing of their personal information. EnVista does not sell or share employee information for the purposes of cross-platform behavioral advertising.
• Right to Limit Use and Disclosure of Sensitive Personal Information: Employees have the right to limit the use and disclosure of sensitive personal information collected about them (subject to certain exceptions).
• Right to Non-Discrimination: Employees will not be discriminated against for exercising their CCPA rights.
• Right to Appeal: You have the right to appeal a refusal to take action on a request to exercise any of the rights above within thirty (30) days after your receipt of the notice sent us informing you that we have rejected your request. If you would like to appeal a denial of a rights request, please contact us via email at [email protected].
  • You also have the right to submit a complaint with the California Attorney General or the California Privacy Protection Agency (CPPA). For more information, see https://privacy.ca.gov/submit-a-complaint/ccpa-complaints/.

We will confirm receipt and respond to a verifiable request no later than 10 business days after receiving it. We will tell you our verification process and when you can expect a response, except if we have already granted or denied the request.

We will respond to a request to delete, request to correct, and request to know no later than 45 calendar days after receipt of the request. If we cannot verify the consumer within the 45-day time period, we may deny the request. If necessary, we may take up to an additional 45 calendar days to respond to your request, for a maximum total of 90 calendar days from the day the request is received. If we do so, we will provide you with written notice and an explanation of the reason for extension.

FOR RESIDENTS OF INDIA:

Under the Digital Personal Data Protection (DPDP) Act and DPDP Rules, you have the following rights:

• Right to Access: Employees can request information about the personal information being processed and with whom it is shared.
• Right to Correction: Employees can request correction, completion, or updating of inaccurate or incomplete personal information.
• Right to Erasure: Employees can request deletion of their personal information when it is no longer necessary for the purpose collected or when consent is withdrawn (subject to legal retention requirements).
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw such consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Grievance Redressal: Employees have access to an internal mechanism to raise concerns about data processing practices. We will endeavor to investigate and respond to your complaint in a reasonable timeframe.
  • If you are not satisfied with the resolution of your grievance, you may file a complaint with the Data Protection Board of India in accordance with the procedures established under the DPDP Act and DPDP Rules.
• Right to Nominate: Employees may nominate an individual to exercise their rights in the event of their death or incapacity.

We will respond within 90 days after receipt of a verifiable request.

Changes to this Notice

We reserve the right to amend this notice at our discretion and at any time. When we make material changes to this notice, we will notify you by emailing you or posting an updated notice and listing the effective date of such updates.

Contact Information

If you have any questions or concerns about this notice or the information we collect about you, please contact us at:

Name: Privacy Officer
Email Address: [email protected]
Address: 11555 North Meridian Street, Suite #300, Carmel, IN 46032 USA