CCPA Privacy Notice
California Residents - California Privacy Notice
Pursuant to the California Consumer Privacy Act ("CCPA") this California Privacy Notice ("Notice") applies to individuals who reside in the State of California ("Consumers"), as defined under the law, and fulfills Ultimate's obligation to provide Consumers with a California-specific Privacy Notice. Effective January 1, 2020, this section supplements the information contained in our existing Privacy Notice. In the event of a conflict with any other portion of our general Privacy Notice, this Notice shall control in relation to Ultimate's obligations and a Consumer's right under CCPA.
Information that We Collect: We collect Personal Information ("PI"), as defined under the CCPA, which includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly, with a particular consumer or household.
Please review the below to learn more about (1) the categories of PI that Ultimate has collected about Consumers within the last twelve (12) months, (2) the categories of sources from which the PI was collected, (3) the business or commercial purpose(s) for collection and/or disclosure, and (4) the categories of third parties with whom we share PI.
|Category||Examples||Categories of Sources||Purpose(s)||Categories of 3rd Parties with whom we share|
|Personal Identifiers||Name (not alias), Address, Unique Personal Identifier, IP Address, Account Name, Social Security Number or other similar identifiers||Categories of Sources 1, 2, 3.||Purposes for Collection 1,3,4||Categories of 3rd Parties 1,2,3,4,5|
|Personal Information categories described in subdivision (e) of Section 1.798,8||Name, Social Security number, physical characteristics or description, passport or state identification (including driver's license) number, education and employment history, financial information, medical information or other similar identifiers||Categories of Sources 1, 2, 3.||Purposes for Collection 1,3,4||Categories of 3rd Parties 1,2,3,4,5|
|Characteristics of Protected Classifications under California or federal law||Age, date of birth, gender, military or veteran status, marital status, nationality, citizenship, pregnancy and related medical conditions, genetic information or other similar identifiers||Categories of Sources 1||Purposes for Collection 1,4||Categories of 3rd Parties 1,2,3,5|
|Commercial Information||Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies||Categories of Sources 2||Purposes for Collection 1,2||Categories of 3rd Parties 1,2,4|
|Biometric Information||Includes (but not limited to) imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns and voice recordings, from which an identifier template, such as a faceprint or a voiceprint can be extracted.
Additionally, keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health or exercise data that contain identifying information.
|Categories of Sources 1||Purposes for Collection 1,2,3||Categories of 3rd Parties 2,3,5|
|Internet or other electronic network activity information||Information including (but not limited to) browsing history and search history||Categories of Sources 3||Purposes for Collection 2,3||Categories of 3rd Parties 1,2,4,5|
|Geolocation data||Information used to identify your physical location, for example, to notify you of job openings, for payroll tax purposes and for the use of our time-related products.||Categories of Sources 1,3||Purposes for Collection 1,3,4||Categories of 3rd Parties 4|
|Audio, electronic, visual, thermal, olfactory or other similar information||Chat communications, video conferencing, webcasts, customer support.||Categories of Sources 1,2,3||Purposes for Collection 1,2||Categories of 3rd Parties 1,2,4,5|
|Professional or employment related information||Current or former job history, qualifications and skills, performance evaluations, payroll information, employment benefit information||Categories of Sources 1,2,3||Purposes for Collection 1,3,4||Categories of 3rd Parties 1,2,3,4,5|
|Inferences drawn from any of the information identified in the above categories used to create a profile about a consumer||Consumer profile reflecting the Consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes||Categories of Sources 1||Purposes for Collection 1,2,3||Categories of 3rd Parties 2|
Categories of Sources from which we collect PI:
- Directly from a Consumer, employee, applicant or prospect, when you provide us with your PI
- Ex: When you contact Ultimate via our website, email, phone or other similar methods
- Directly or indirectly from vendors, service providers or other third parties
- Ex: Our Customers (in the provision of services)
- Ex: Information the Consumer has voluntarily made public (i.e. for our use in background checks)
- Ex: Information you have shared on social media platforms, specifically publicly visible accounts (i.e. LinkedIn)
- From your use, visit or activity on any of our websites
- Ex: Directly (through your submission of information, for a webinar)
- Ex: Indirectly (through information disclosed by your device or browser, such as IP address)
Purposes for Collection:
- To fulfill the purpose(s) for which the information was collected/provided
- Ex: To provide the Services or Products contracted for with our Customers, at their direction
- Ex: To provide you with information, products, or services you have requested from us or that may be of interest to you
- Ex: To provide customer service and support
- Ex: Legitimate purposes including, but not limited to, human resource business reasons such as personalized job opportunities, payroll processing, tax purposes, and the provision of employment benefits
- To improve our website, services and products, through testing, research, analysis and product development
- For security purposes, including to prevent unauthorized access or disclosure, to maintain data accuracy, to protect the confidentiality, integrity and availability of your PI and to allow only the appropriate use of your PI
- To comply with all applicable legal obligations, including, but not limited to, the CCPA
Categories of 3rd Parties with whom we share your PI:
- Service Providers
- Affiliates/Subsidiaries and Related Entities
- Third parties to whom you or your agents authorize us to disclose your PI in connection with Products or Services we provide to you
- External advisors, such as auditors or outside legal counsel
- Governmental, legal, regulatory, or other similar authorities and/or local government agencies, upon request or where required
Your Rights: The CCPA provides individuals with various privacy-related rights ("Rights") relating to their PI. This section provides you with information regarding these Rights.
Right to a Notice: At or before the point of collection of PI, Consumers, Employees, Job Applicants and other individuals residing in the State of California are entitled to a notice that provides the categories of PI collected about them, and the purposes for that collection.
Right to Know: A Consumer has the right to request information regarding our collection, disclosure, sale and/or use of their PI over the previous twelve (12) months. A Consumer may request that Ultimate disclose:
- Categories of PI that we have collected about you;
- Categories of sources from which your PI is collected;
- Categories of PI about you that we have sold or disclosed for a business purpose;
- Categories of third parties to whom the PI was sold or disclosed for a business purpose;
- The business or commercial purpose for collecting or selling PI; and
- Specific pieces of PI that we have collected about you.
When providing you with your information electronically, we will, to the extent possible, deliver the information in a portable manner that allows you to transfer the information to another entity.
We may reject your request to know if your identity cannot be verified (your request is not a verifiable consumer request), or if the information has already been provided twice within a twelve (12) month period. We may also refuse to provide you with specific pieces of information that we have collected about you if disclosure creates a substantial, articulable, and unreasonable risk to the security of that PI, your account with Ultimate or the security of our systems.
Right of Deletion: A Consumer has the right to request the deletion of any PI that we collected from them, or that we maintain about them. Following our receipt of your verifiable consumer request, we will delete (and direct our Service Providers to delete) your PI, subject to the exceptions permitted under the CCPA, and any legal obligations that we have to retain that information.
Right to Opt-Out of the Sale of your Personal Information: The CCPA provides a Consumer with the right to opt-out of the sale (as defined under the law) of his/her PI. Ultimate Software does not sell PI, and thus does not provide you with a mechanism for opting-out.
Right to Non-Discrimination: Ultimate will not discriminate against a Consumer in response to the decision to exercise any of the privacy rights granted to you under the CCPA.
Asserting Your Rights - Submitting a Request to Know or Delete: As previously stated, we may reject your request if we cannot verify your identity. Please follow the instructions below, and provide the requested information to allow us to adequately address your request.
If you are a current or former employee of Ultimate residing in the State of California, you may submit your request via email at firstname.lastname@example.org. In the email, please indicate which right you are exercising. In order to verify your identity, your request must include the following:
- Your full name and email address associated with your profile;
- Your preferred contact phone number; and
- Your hire date, which can be found by current or former employees (up to one year following termination) within your profile, or on your offer letter. We require your hire date to be provided in the MM/DD/YY format.
If you previously applied for employment with Ultimate (job applicants) and reside in the State of California, you may submit your request via email at email@example.com. In the email, please indicate which right you are exercising. In order to verify your identity, your request must include the following:
- Your full name and email address associated with your profile;
- Your preferred contact phone number; and
- The number of employment opportunities you have applied for with Ultimate, as well as the Job Title and Job Code associated with each application, which can be found in your profile, under the Applications tab.
If you are a current or former employee or job applicant of one of Ultimate’s customers, please contact your employer/former employer directly.
If you have provided Ultimate with your information via our website (i.e. through a Webinar or for a Whitepaper) and reside in the State of California, please click here.
Authorized Agents: You may exercise your right to know or your request for deletion of your PI, through the use of an authorized agent. A request from an authorized agent on your behalf will only be accepted if the authorized agent provides us with written proof they are authorized to act on your behalf. We may also first require the authorized agent to verify their identity, before accepting the request. Ultimate may deny requests from authorized agents that fail to provide proof of their status as an authorized agent or verification of their identity.
Changes to this Notice
The practices described in this California-specific Notice are the current practices approved on December 20, 2019. Ultimate reserves the right to modify or amend this Notice at any time. We encourage you to periodically review this page for the latest information on our privacy practices.
At any time, you may contact Ultimate with questions or concerns about this Notice at firstname.lastname@example.org. Written responses may also be submitted to:
The Ultimate Software Group
Attention: Vice President of Privacy, Risk & Compliance
2000 Ultimate Way
Weston, FL 33326