Privacy Notice – Human Resources, Insurance Producers, and Contractors

Last updated December 21, 2023

We are committed to protecting your privacy and earning your trust. This Privacy Policy ("notice") describes the information we collect about you and how we use and protect it. It applies to the following individuals:

• Our job applicants and employees
• Contractors who perform services for us
• Insurance agents or brokers (together, “Producers”) who do business with us
• Visitors to our employment and Producer websites, applications and platforms (the “Sites”)

Third-party service providers host portions or all of the Sites. They will process information submitted through a Site and may provide it to us.

This notice does not govern our other websites or third-party websites. Those are subject to their respective privacy policies and associated notices.

• Summary
• What information do you collect about me?
• Who might get information about me from you?
• How do you protect my information?
• Our family of companies
• Additional information about internet practices
• What about Site security?
• What about links to other websites?
• California Consumer Privacy Act Supplement to Privacy Notice
• California Notice at Collection

Summary

This section summarizes our privacy practices. For more detail, please read the entire notice.

• We gather information from you, your interactions with us, and outside sources.
• We use your information only to conduct our business and act consistently with our relationship with you.
• We will share your information with companies that provide certain products or services you request through us.
• We limit access to your information and use safeguards to help protect it.

What information do you collect about me?

We collect information about you so that you can search and apply for jobs or an appointment with us and submit and update your resume, career, and contact information. We also may use the information we collect to process your employment application, act as your employer, conduct business with you, and operate the Sites. The information we collect about you is called “Nonpublic Personal Information” or "NPI" if it identifies you and is not available to the public. Depending on your interactions with us, we collect it from some or all of the following sources. We have provided a few examples for each source, but not all may apply to you.

• Information from you: You provide this on your employment application; through the Sites or third-party websites; and via our human resources, Producer and other communications, workplace and business platforms and interactions. It may include your name, street and e-mail addresses, phone number, driver’s license number, Social Security number, date of birth, gender, and educational and employment history. It also may include information about your employment benefits elections, dependents, and beneficiaries.
• Consumer Report Information: We obtain this from consumer reporting agencies. It may include criminal background checks and your driving record. The information is kept by the consumer reporting agencies and disclosed by them to others as permitted by law.
• Benefit Provider Information: Subject to applicable law, we may obtain information about you from the employment and workplace benefits providers we use.
• Other Third-Party Information: If you are a contractor or Producer working for an entity that does business with us, the entity may provide us with your name and other information about you. We may also obtain information about you from directories and other outside sources.
• Observation, Interaction, and Transaction Information: This is information from our observations of you and your interactions and transactions with us, our affiliates, or others. It includes your performance, disciplinary history, and your time, pay, and tax records. If you are a Producer, it includes your sales history.

We also may collect “Site Information” about you. This is unique to Internet and electronic activity. It may include how you linked to our Site. It also may include your IP address and information about your personal or work device, time of visit, and what pages you visit on our Site. When you visit our Sites, we may use cookies, web beacons, and other technology to collect information about you and your activities on our Sites. We may do this to provide services to or conduct business with you, enhance your online experience, and notify you of employment opportunities.

Who might get information about me from you?

We share your information for what we feel are legitimate business, legal, or compliance purposes. Disclosures include, for example, those that we feel are required to provide insurance claims or customer service, prevent fraud, perform research, comply with the law, inform you about or provide you with available benefits, or otherwise run our business. Recipients include, for example, our family of companies, service providers, consumer reporting agencies, others we do business with, law enforcement, courts and government agencies. They may disclose the information to others as permitted by law.

Some benefits and other products or services obtained through us will be provided by other companies. We may share your information with these companies. They will use the information as described in their privacy policies. These companies may share with us information about you and your transactions with them.

How do you protect my information?

We restrict access to your information to our employees and others who we feel must use it to provide our products and services or otherwise run our business. Their use of the information is limited by law, our employee code of conduct, and written agreements where appropriate. We also maintain physical, electronic, and procedural safeguards to protect your information.

Our family of companies

This notice is from our family of companies . Our family of companies also includes ARX Holding Corp., Protective Insurance Corporation, and the entities that they directly or indirectly majority own or control. You can learn more about those entities at American Strategic | Our Companies and Affiliations and About Protective Insurance.

Additional Information about Internet Practices

When you visit our Sites, we collect Site Information for various reasons. For example, if you start an employment application on our Site, but decide to finish it later, we will save your information so you can pick up where you left off. We may also use Site Information to customize your experience with and analyze your use of our Sites and interaction with us.

You may be able to control the use of cookies and other tracking technologies on some of our Sites. You may be able to instruct your browser or mobile device to warn you each time a cookie is being sent, or to reject all or certain kinds of cookies. Typically, you can do this by changing the privacy settings on your internet browser or device. However, if you reject cookies, some websites may not function properly, and some website services may be diminished. In most cases, you must manage these settings on each of your browsers or devices. For example, blocking cookies on your desktop browser may not work for your mobile device.

What about Site security?

Our security measures help secure your data, so that others cannot access it while in transit. We limit access to our servers and require our employees to adhere to high standards of ethics and integrity in performing their jobs.

What about links to other websites?

Our Sites may contain links to other sites and applications that we do not maintain. We make no warranties or representations about other websites or applications. We recommend that you read the privacy and security policies of these sites and applications.

California Consumer Privacy Act Supplement to Privacy Notice

This Supplement (“Supplement”) describes our collection and use of Personal Information that is subject to the California Consumer Privacy Act (the “CCPA”) and describes the rights of Consumers under the CCPA. This Supplement does not apply to information that is exempt from the CCPA. This Supplement controls if there is a conflict with our privacy notice.

Our Personal Information practices

We collected each of the categories of Personal Information listed in the “Notice at Collection” below during the twelve months preceding the date of this notice (the “past year”).

We collect Personal Information for the Purposes listed in the Notice at Collection.

The categories of our sources for Personal Information about Consumers include:

• Lead sources or aggregators, or other third-party sites, web browsers or search engines
• Consumers or our observation of Consumers
• Data analytics providers
• Data brokers
• Government entities
• Insurance agencies and brokerages
• Internet service providers
• Operating systems and platforms
• Our benefits and/or other service providers
• Persons involved in claims, litigation, or fraud prevention or detection
• Social networks
• Third-party product providers

We disclose the following categories of Personal Information. During the past year, we disclosed the following Personal Information for business purposes:

• Identifiers were disclosed to third-party sites, web browsers or search engines; data analytics providers; data brokers; government entities; insurance agents or brokers; operating systems and platforms; our benefits, internet and/or other service providers; persons involved in claims, litigation or fraud prevention or detection; and third-party product providers.
• CCR Categories were disclosed to data analytics providers; data brokers; government entities; insurance agents or brokers; operating systems and platforms; our benefits and/or other service providers; and persons involved in claims, litigation or fraud prevention or detection.
• Protected Classifications were disclosed to government entities and our benefits and/or other service providers.
• Commercial Information was disclosed to our benefits and/or other service providers and third-party product providers.
• Internet or Other Electronic Network Activity Information was disclosed to operating systems and platforms; third-party sites, web browsers or search engines; data analytics providers; our benefits and/or other service providers; and social networks.
• Geolocation Data was disclosed to our benefits and/or other service providers.
• Sensory Data was disclosed to data analytics providers; persons involved in claims, litigation, and fraud prevention and detection; and our benefits and other service providers.
• Professional or Employment-Related Information was disclosed to third-party sites, web browsers or search engines; data analytics providers; government entities; our benefits and/or other service providers; persons involved in claims, litigation, or fraud prevention or detection; and third-party product providers.
• Sensitive Identifiers were disclosed to data analytics providers; government entities and our benefits and/or other service providers.
• Sensitive Account Information was disclosed to our service providers.
• Sensitive Geolocation Information was disclosed to our benefits and/or other service providers.
• Sensitive Demographics were disclosed to government entities.
• Sensitive Communications were disclosed to persons involved in claims, litigation, or fraud prevention or detection.

All of this information may be disclosed within our family of companies.

We make these disclosures for the following purposes:

• Analytics, research & development, pricing, and improving or upgrading applicant, workforce and/or Producer experience
• Auditing and quality control
• Claims and litigation
• Compliance and related purposes, including, without limitation, making disclosures required by law or regulation, for governmental investigations or processes, or to our attorneys, accountants and auditors
• Investigations, discipline and helping to detect security incidents, resist malicious, fraudulent or illegal activity, report and help prosecute such activity, and help protect safety
• Maintaining and protecting our data, systems and ourselves, including, without limitation, debugging to identify and repair errors
• To provide, process and service our products or offerings (e.g., maintaining or servicing policies, providing other consumer services, processing or fulfilling transactions and payments, verifying consumer information, communications, etc.)
• To provide job applicant, employee, contractor and independent agent services and experiences (e.g., processing or fulfilling transactions and payments, verifying applicant, employee, contractor, and Producer information, communications, candidate recruiting/processing, onboarding, management, resource development, pay, time and leave, benefits and other programming, etc.)
• Sharing information with other companies in our family of companies or in which we invest

We do not use or disclose the “Sensitive Personal Information” described in the “Notice at Collection” below for purposes other than those specified by the CCPA and its regulations.

We did not sell Personal Information or share it with others for Cross-Context Behavioral Advertising during the past year. “Cross-Context Behavioral Advertising” means targeting advertising to a Consumer based on the Consumer’s Personal Information obtained from that person’s activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the person intentionally interacts.

Your rights to delete, discover and correct

To the extent provided by law, you are entitled to receive a “Notice at Collection,” which we have attached to this Supplement.

To the extent provided by law, you may request that we:

• delete Personal Information that we collected from you;
• correct inaccurate Personal Information that we maintain about you; and
• disclose the following to you free of charge:
  • the categories of Personal Information we collected about you;
  • the categories of sources from which it is collected;
  • our purpose for collecting Personal Information;
  • the categories of third parties to whom we disclose Personal Information;
  • the specific pieces of Personal Information we collected about you; and
  • the categories of Personal Information about you that we disclosed for a business purpose and the categories of persons to whom it was disclosed.

You may exercise the rights described above by using the form at privacyrequest.progressive.com or by calling us toll-free at 1-855-955-0742.

Nondiscrimination

We will not discriminate against you for exercising your rights under the CCPA. However, we may charge a different price for goods or services if the difference is reasonably related to the value of your Personal Information. We may offer financial incentives for the collection or retention of personal information pursuant to our employee referral program. More information about this program is available on our intranet site or by calling our Human Resources Service Center.

Verifying requests

If you request to delete, correct, or discover Personal Information, we will attempt to verify your identity by trying to match identifying information provided by you to Personal Information about you that we have. If we do not have enough information to match, we may try to contact you to verify your identity. Examples of information you may be asked to provide include your name, address history, and information about your interactions with us. If you want us to disclose specific pieces of Personal Information that we collected about you, delete Personal Information that we collected from you, or correct Personal Information we collected about you, you may also be asked to provide a copy of the front and back of your driver's license or other government-issued identification card. We will notify you if we cannot timely verify that you are the consumer about whom we have collected Personal Information.

How an agent can make requests on your behalf

You may designate an agent to make requests on your behalf. To make such a request, your agent may use privacyrequest.progressive.com or call us toll-free at 1-855-955-0742. The agent must provide us with a power of attorney from you or your signed permission authorizing the agent to make the request for you. If the agent requests disclosure of specific pieces of personal information or deletion of personal information, the agent may also be asked to send us a copy of the front and back of your driver's license or other government-issued identification card. If the agent does not provide us with a power of attorney, we may contact you to directly verify with you your identity and that you gave the agent permission to submit the request.

Questions and concerns

If you want to access this notice in a different format because of disability, or if you have any other CCPA questions or concerns, you may contact us at privacyrequest.progressive.com or call us at 1-855-955-0742.

Date

This Supplement was last updated as of December 21, 2023.

California Notice at Collection

This Notice applies only to California residents (“Consumers”) concerning Personal Information that is subject to the California Consumer Privacy Act (“CCPA”). This Notice does not apply to information that is exempt from the CCPA.

This Notice does not govern our other websites or third-party websites. Those are subject to their respective privacy policies and California notices at collection.

"Personal Information" is information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household in California. It includes the following categories:

• "Identifiers" such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
• "CCR Categories,” which may include the following categories of Personal Information described in the California Customer Records statute: name, signature, Social Security number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• "Protected Classification Characteristics" under California or federal law such as age, marital status, and gender.
• "Commercial Information," which may include records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• "Biometric Information," which means a Consumer’s physiological, biological or behavioral characteristics used or intended for use singly or in combination with each other or other identifying data to establish individual identity.
• "Internet or Other Electronic Network Activity Information," which may include website information, browsing history, search history, information on a Consumer’s interaction with an internet website, application, or advertisement.
• "Geolocation Data" about physical location or movements.
• "Sensory Information" consisting of audio, electronic, visual or similar information.
• "Professional or Employment-Related Information" such as information about current or past employment.
• "Education Information" such as education level.
• "Inferences" drawn from other Personal Information to create a profile about a Consumer reflecting the Consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Personal Information also includes the following categories of “Sensitive Personal Information”:

• “Sensitive Identifiers,” meaning Personal Information that reveals a Consumer’s Social Security, driver’s license, state identification card, or passport number.
• “Sensitive Account Information,” meaning Personal Information that reveals a Consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
• “Sensitive Geolocation Information,” meaning Personal Information that reveals a Consumer’s geolocation within an area that is equal to or less than the area of a circle with a radius of 1850 feet.
• “Sensitive Demographics,” meaning Personal Information that reveals a Consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
• “Sensitive Communications,” meaning the contents of a Consumer’s mail, email, and text messages unless we are the intended recipient of the communication.
• “Sensitive Biometrics,” meaning the processing of biometric information for the purpose of uniquely identifying a consumer.

We may collect and use Personal Information (including Sensitive Personal Information) about you and your household for the following purposes (the “Purposes”):

• Analytics, research & development, pricing, and improving or upgrading applicant, workforce and/or Producer experience
• Auditing and quality control
• Auditing related to counting ad impressions to unique visitors, and verifying positioning and quality of ad impressions
• Claims and litigation
• Compliance and related purposes, including, without limitation, making disclosures required by law or regulation, for governmental investigations or processes, or to our attorneys, accountants and auditors
• Investigations, discipline and helping to detect security incidents, resist malicious, fraudulent or illegal activity, report and help prosecute such activity, and help protect physical safety
• Maintaining and protecting our data, systems and ourselves, including, without limitation, debugging to identify and repair errors
• Marketing and advertising products and services offered by us or others and employment opportunities with us and lead monetization
• To provide, process, and service our products or offerings (e.g., maintaining or servicing policies, providing other consumer service, processing or fulfilling transactions and payments, verifying consumer information, communications, etc.)
• To provide job applicant, employee, contractor, and independent agent services and experiences (e.g., processing or fulfilling transactions and payments, verifying applicant, employee, contractor, and Producer information, communications, candidate recruiting/processing, onboarding, management, resource development, pay, time and leave, benefits and other programming, etc.)
• Sharing information with other companies in our family of companies or in which we invest

The minimum length of time for which we will retain the Personal Information we collect varies based on applicable statutes of limitations and whether we think we might need the information for court or other official proceedings.

We may allow third parties to collect personal information from our websites.

This Notice is incorporated into our Privacy Notice.