This California HR Data Privacy Policy (“Policy”) describes how AllyGPO, LLC and its controlled affiliates and business lines (collectively, “AllyGPO,” “we,” “us,” or “our”) collect, use, retain, and disclose personal information relating to California residents in a workforce or employment-related context.
For current Ally employees, the employing Ally entity is AllyGPO, LLC. References to affiliates apply to their relevant workforce relationships and historical HR records.
This Policy applies to California residents who are:
We refer to these individuals collectively as “Covered Persons.”
If you provide AllyGPO with personal information about another person, such as an emergency contact, dependent, beneficiary, or reference, you should provide that information only if you are authorized to do so and should make this Policy available to that person where appropriate.
This Policy is intended to serve as AllyGPO’s California notice at collection and workforce privacy policy. It does not form part of any employment contract, create contractual rights, or alter any person’s employment or independent-contractor status. Separate notices, agreements, benefit-plan documents, or policies may apply to particular processing activities and will control to the extent they provide more specific information.
Personal information collected outside an employment or workforce context is addressed in AllyGPO’s general Privacy Policy. When a Covered Person interacts with AllyGPO’s public websites outside the workforce context, the general Privacy Policy applies to that interaction. This Policy governs information used for recruiting, employment, contractor administration, or related HR purposes.
“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular individual or household. It does not include information excluded from the definition under applicable law.
During the preceding 12 months, AllyGPO collected the following categories of personal information, as applicable to the individual and the relationship involved:
| Category | Examples | Collection status |
|---|---|---|
| Identifiers and contact information | Name, preferred name, alias, signature, mailing address, email address, telephone number, employee or contractor identification number, username, online identifier, Internet Protocol address, driver’s-license information, passport information, Social Security number, and similar identifiers. | Collected as applicable. |
| Personal records information | Contact information, physical characteristics or descriptions when relevant, education and employment information, financial information, tax information, banking and direct-deposit information, insurance information, and medical or health-insurance information. | Collected as applicable. |
| Protected characteristics | Age, date of birth, sex or gender, race or ethnicity, citizenship or work-authorization status, marital status, military or veteran status, and health or disability information provided for benefits, leave, accommodations, or other lawful workforce administration. | Collected where required, permitted, or voluntarily provided. |
| Commercial and transaction information | Benefit selections, reimbursement requests, business-travel arrangements, expense records, purchasing or procurement activity, use or assignment of AllyGPO property, and records of services provided. | Collected as applicable. |
| Internet, electronic, and network activity | Use of AllyGPO systems, networks, devices, websites, applications, email, messaging services, collaboration tools, and security systems; login records; access logs; browsing and search activity on AllyGPO systems; and interactions with public website or recruiting content. | Collected as applicable. |
| Audio, electronic, visual, and similar information | Photographs, identification images, voicemail, and recordings of meetings, training sessions, webinars, or events where recording is disclosed or otherwise permitted. | Collected as applicable. |
| Professional and employment information | Résumés, applications, employment history, references, qualifications, licenses, certifications, work authorization, position, department, location, compensation, work schedule, attendance, leave, tenure, performance, disciplinary history, training records, goals, promotion or transfer information, and separation information. | Collected as applicable. |
| Education information | Schools attended, degrees, transcripts, grades, certifications, professional education, training, and other education records. | Collected as applicable. |
| Inferences | Inferences concerning qualifications, abilities, work preferences, performance, development needs, suitability for a position, compliance risk, security risk, or other employment-related characteristics. | Created or collected as applicable. |
| Sensitive personal information | Social Security, driver’s-license, state-identification, and passport numbers; account login credentials; racial or ethnic origin; and health information provided for benefits, leave, accommodations, or other lawful workforce administration. | Collected only as applicable and for legitimate workforce, legal, security, benefits, accommodation, or administrative purposes. |
The examples above describe information AllyGPO may collect across its workforce operations. AllyGPO does not necessarily collect every example from every Covered Person.
AllyGPO obtains personal information from the following categories of sources:
AllyGPO may collect and use personal information for the following business and operational purposes:
During the preceding 12 months, AllyGPO disclosed the categories of personal information identified as collected in Section 2, as applicable, to the following categories of recipients for legitimate business purposes:
| Recipient category | Examples and purposes |
|---|---|
| Affiliates and internal recipients | AllyGPO affiliates, business lines, managers, HR personnel, finance, information technology, legal, compliance, security, and other personnel with a business need to know. |
| HR and recruiting providers | Recruiting platforms, staffing firms, applicant-tracking systems, background-check providers, credentialing services, and training providers. |
| Payroll and benefits providers | Professional employer organizations and co-employers; payroll processors, benefit-plan administrators, insurers, brokers, retirement-plan providers, leave administrators, and wellness-program providers. |
| Technology and security providers | Cloud-hosting, software, communications, collaboration, cybersecurity, identity-management, equipment-support, and data-storage providers. |
| Business-operations providers | Travel providers, expense-management services, financial institutions, payment processors, auditors, consultants, and facilities providers. |
| Professional advisers | Attorneys, accountants, auditors, insurers, investigators, and other professional advisers. |
| Governmental and legal recipients | Courts, regulators, taxing authorities, law-enforcement agencies, licensing bodies, and other entities where disclosure is required or permitted by law. |
| Transaction participants | Potential or actual purchasers, investors, lenders, advisers, and other participants in a financing, reorganization, merger, acquisition, sale, or similar transaction. |
| Other authorized recipients | Other parties at the Covered Person’s direction, with appropriate authorization, or as otherwise disclosed at the time information is collected. |
Professional employer organizations, benefit plans, insurers, and other providers may process certain information under their own privacy notices and legal obligations. This Policy describes AllyGPO’s practices and does not replace those notices.
Service providers and contractors are expected to use personal information only for the services they provide to AllyGPO or as otherwise permitted by their contracts and applicable law.
AllyGPO does not sell or share personal information collected in a workforce or employment-related context.
When Covered Persons visit AllyGPO’s public websites outside a workforce or employment-related context, website and device information may be disclosed to advertising platforms for retargeting, interest-based advertising, audience management, conversion measurement, and related purposes. Those non-HR website activities, including the categories of information involved, the recipients, and available privacy choices, are described in AllyGPO’s general Privacy Policy, which applies to those interactions.
During the preceding 12 months, AllyGPO has not sold or shared Covered Persons’ HR personal information. In particular, AllyGPO does not sell or share payroll records, government identification numbers, financial-account information, health or accommodation information, benefit information, performance records, investigation records, or other sensitive HR information for targeted advertising.
Covered Persons may opt out of applicable sale or sharing by selecting Do Not Sell or Share My Personal Information or using the request methods described in Section 10. Exercising a sale or sharing opt-out will not affect processing necessary to administer an employment, applicant, contractor, or other workforce relationship, to the extent permitted by applicable law.
AllyGPO does not knowingly sell or share the personal information of individuals under 16 years of age.
AllyGPO uses and discloses sensitive personal information only as reasonably necessary to:
AllyGPO does not use or disclose sensitive personal information to infer characteristics about Covered Persons for unrelated purposes. Based on its current practices, AllyGPO does not use or disclose sensitive personal information in a manner that requires a separate right to limit. If that changes, AllyGPO will provide the notice and choice required by applicable law.
AllyGPO retains personal information only for as long as reasonably necessary and proportionate to the purposes for which it was collected, including legal, accounting, reporting, security, operational, and dispute-resolution requirements.
Retention periods are determined using criteria such as the nature and sensitivity of the information, the duration of the workforce or applicant relationship, operational needs, contractual requirements, applicable limitation periods, and legal recordkeeping obligations.
| Information or record type | General retention criteria |
|---|---|
| Applicant and recruiting records | Retained during the recruiting process and afterward for future opportunities, legal compliance, reporting, and the establishment or defense of claims, using the retention criteria described in this Section. |
| Personnel, performance, training, and employment records | Retained during the workforce relationship and afterward for the period required or appropriate for workforce administration, compliance, audits, and legal claims. |
| Payroll, tax, timekeeping, benefit, expense, and financial records | Retained for applicable tax, wage-and-hour, benefits, accounting, audit, and recordkeeping periods. |
| Leave, accommodation, medical, health, and safety records | Retained in restricted systems for the period required for benefits administration, accommodations, workplace safety, insurance, compliance, and claims. |
| System, device, access, and security records | Retained according to system-specific security and operational schedules and may be retained longer when relevant to an incident, investigation, or legal obligation. |
| Security footage, call recordings, and other audio or visual records | Retained for the applicable operational period unless needed longer for security, training, investigation, documentation, or legal purposes. |
| Investigation and compliance records | Retained for the duration of the matter and afterward as reasonably necessary for compliance and the establishment, exercise, or defense of legal claims. |
| Privacy-request and consent records | Retained for the period necessary to document compliance with privacy obligations and honor continuing preferences. |
| Advertising opt-out and suppression records | Retained as reasonably necessary to honor the opt-out or suppression preference, unless deletion is required or permitted. |
When information is no longer required, AllyGPO may delete, destroy, anonymize, or aggregate it in accordance with its document-retention and information-governance practices. Information maintained in backups may be deleted or rendered inaccessible through the normal backup lifecycle.
Subject to applicable exceptions, California residents have the following rights:
You may request information about AllyGPO’s collection, use, disclosure, sale, or sharing of your personal information, including:
You may request correction of inaccurate personal information maintained by AllyGPO.
You may request deletion of personal information collected from you and, beginning January 1, 2027, personal information collected about you from other sources, subject to exceptions that permit or require AllyGPO to retain the information.
You may request a portable copy of eligible personal information in a technically feasible and readily usable format.
You may direct AllyGPO not to sell or share your personal information. As explained in Section 6, AllyGPO does not sell or share HR personal information. Privacy choices for interactions outside the workforce context are described in the general Privacy Policy. This right does not restrict disclosures that do not constitute sale or sharing under applicable law.
Where applicable, you may direct AllyGPO to limit certain uses or disclosures of sensitive personal information. As explained in Section 7, AllyGPO does not currently use sensitive personal information for purposes that require a separate right to limit.
California requirements concerning automated decisionmaking technology used to make significant decisions become applicable beginning January 1, 2027.
If AllyGPO uses technology that replaces or substantially replaces human decisionmaking to make a significant employment-related decision, AllyGPO will provide any required pre-use notice and applicable rights to access information about the technology, opt out, or appeal a decision.
Ordinary software, databases, analytical tools, or systems that assist personnel without replacing meaningful human review do not necessarily constitute regulated automated decisionmaking technology. This Policy does not represent that AllyGPO currently uses regulated automated decisionmaking technology for employment decisions.
AllyGPO will not unlawfully discriminate or retaliate against you for exercising a California privacy right.
To submit a request to know, access, correct, delete, or obtain a portable copy of personal information, you may:
To opt out of sale or sharing:
An opt-out preference signal generally applies to the browser or device sending the signal. Where AllyGPO can reasonably associate the signal with a known individual or profile, AllyGPO will apply the preference accordingly, as required by law.
You do not need to create an account to submit a sale or sharing opt-out. AllyGPO will not require identity verification for an opt-out request, although it may request information reasonably necessary to identify the records or audience entries to which the request should apply.
For access, correction, deletion, and portability requests, AllyGPO may take reasonable steps to verify your identity and authority. Verification requirements will depend on the nature and sensitivity of the requested information. Information supplied for verification will be used only for verification, security, fraud prevention, and legal compliance.
You may designate an authorized agent to submit a request where permitted by law. AllyGPO may request proof of the agent’s authority and may require you to confirm your identity or authorization directly, except where applicable law provides otherwise.
AllyGPO will respond within the period required by applicable law. Certain information may be exempt from a request or may need to be retained to satisfy legal obligations, administer the workforce relationship, protect security, complete a transaction, or establish, exercise, or defend legal claims. If AllyGPO cannot fully honor a request, it will provide the explanation required by law.
AllyGPO uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure.
Access to HR personal information is restricted according to job responsibilities and legitimate business needs. Sensitive health, accommodation, payroll, financial, and identification information may be maintained in systems with additional access restrictions.
No system is completely secure, and AllyGPO cannot guarantee absolute security. Covered Persons should follow AllyGPO’s security policies and promptly report suspected loss, misuse, or unauthorized access.
Additional notices may apply to particular activities, including:
This Policy does not limit any rights or obligations under employment, labor, benefits, anti-discrimination, whistleblower, workplace-safety, or other applicable laws.
AllyGPO may update this Policy periodically to reflect changes in its practices, technologies, legal requirements, or operations. The effective date at the top identifies when the Policy was most recently updated.
When required by law, AllyGPO will provide additional or more prominent notice before materially different practices apply to personal information already collected.
Questions about this Policy or AllyGPO’s HR privacy practices may be directed to:
AllyGPO, LLC
Attn: Privacy Officer
5 Cowboys Way, Suite 300
Frisco, TX 75034
Email: privacyofficer@AllyGPO.com
Telephone: 1-866-255-9476