Employee & Applicant Privacy Notice

Effective Date: July 1, 2026

1. Who this notice applies to

This notice applies to all individuals who interact with Lumin Digital (“Lumin,” “we,” “us,” or “our”) in an employment context, including:

  • Applicants for employment (at any stage of the hiring process)
  • Current employees: full-time, part-time, and temporary
  • Contingent workers, contractors, and interns engaged through Lumin
  • Former employees

It supplements Lumin’s consumer-facing privacy notice, which continues to govern non-employment interactions. California residents have specific data subject rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), described in Section 7. Employees in other states (such as Illinois and Texas) may have additional rights under their state’s laws; see Section 9 for details.

2. What Personal Information we collect

We collect, and in the 12 months prior to the “Last Reviewed” date of this notice have collected, the following categories of personal information. Not every category applies to every individual.

Identifiers, such as name, alias, home address, email address, phone number, employee or applicant ID, LinkedIn and social-media profile URLs, online identifiers, and government-issued identification numbers such as Social Security numbers (SSNs), driver’s license numbers, state ID numbers, and passport numbers. 

  • Government ID numbers are collected only for legally required purposes, such as identity verification, payroll processing, and tax reporting.

Personal Records, such as signature, physical address, telephone number, employment and education history, bank routing and account numbers, and medical or insurance information.

Protected Classification Characteristics, such as age (if 40 or older), race, color, national origin, citizenship and immigration status, religion, marital status, sex, gender identity or expression, sexual orientation, disability status, veteran or military status, and pregnancy or related condition. 

  • Self-identification in these categories is generally voluntary and is used only for reporting required by law.

Biometric Information, such as voice prints and facial geometry. 

  • Important Notice: Lumin uses a tool during remote interviews to verify candidate identity and detect fraud. This tool captures a voice print (a biometric identifier unique to your voice). Interview audio is retained in the tool for a brief period of time and then deleted. See Section 4 for how we use this information and your rights regarding sensitive personal information.

Internet or Electronic Network Activity, such as activity logs generated through Lumin-issued systems, applications, and devices.

Geolocation Data, such as precise geolocation data captured by our deepfake audio detection solution used during remote interviews. Approximate geolocation may also be inferred from your IP address when you use Lumin-issued systems.

Audio, Electronic, Visual, or Sensory Information, such as interview recordings and transcripts created during virtual interviews; photographs used in our employee directory; video from on-premises security cameras; and voicemails and call recordings (where permitted by law).

Professional or Employment-Related Information, such as job title, employment history, performance ratings, manager and peer feedback, disciplinary records, compensation and bonus information, equity grants, training and certification records, garnishment and income-withholding orders, and verifications of employment.

Education Information, such as degrees, certifications, transcripts, and other non-public education records you provide or that are verified through background-check providers.

Inferences, such as inferences about professional skills, engagement, fit, or development potential drawn from the above categories.

Sensitive Personal Information: The following sub-categories of the above constitute “sensitive personal information” under the CCPA, and are subject to additional protections (see Section 4):

  • Social Security numbers
  • Driver’s license, state ID, and passport numbers
  • Bank routing and account numbers, and financial-account credentials
  • Precise geolocation
  • Racial or ethnic origin
  • Health or medical information
  • Biometric information used to uniquely identify you

3. Where we collect your information

We collect personal information from the following categories of sources:

  • You. Directly from you.
  • Third Parties. From third parties acting on your behalf or at your request.
  • Service Providers. From our service providers and processors.
  • Government Agencies. From government and court agencies.
  • Staffing Agencies. From staffing agencies and external recruiters.
  • Lumin IT and Security Systems, including automated monitoring of our websites and other technical systems, such as our computer networks and connections, access control systems, communications systems, email, and instant messaging systems.

We collect and use personal information for the following general business purposes:

  • Recruit, evaluate, and hire candidates
  • Verify candidate identity and detect fraud or impersonation
  • Conduct background checks, reference checks, and education verification
  • Onboard new hires and maintain employment records
  • Calculate and disburse payroll, withhold and remit employment taxes, and issue paystubs and W-2s
  • Administer employee benefits (health, dental, vision, life, disability, FSA/HSA, 401(k)), leaves of absence, and garnishment or levy orders
  • Manage performance reviews, talent development, and succession planning
  • Benchmark and administer compensation and equity
  • Comply with legal and regulatory obligations
  • Maintain the security of Lumin’s systems, networks, and facilities
  • Conduct internal and external audits
  • Defend against or pursue legal claims
  • Ship preboarding gear and new-hire kits
  • Measure employee engagement and inform people-program decisions

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Use of Sensitive Personal Information

Under the CCPA, you have the right to limit how we use sensitive personal information to certain permitted purposes. We use your sensitive personal information only for the following purposes permitted by California law:

  • To provide services you reasonably expect as an employee or applicant, including payroll, direct deposit, benefits enrollment and administration, HSA/FSA and 401(k) administration, leave of absence administration, and tax-form preparation
  • To prevent, detect, and investigate security incidents, fraud, and impersonation
  • To verify or maintain the quality or safety of our services and systems
  • To perform services on behalf of the business
  • To comply with legal obligations

We do not use or disclose sensitive personal information to infer characteristics about you beyond these permitted purposes.

5. Who we share information with

We share personal information only in the following circumstances, and only to the extent necessary for each purpose:

  • Service providers and processors who perform functions on our behalf under written agreements that limit their use to the contracted purpose. These include vendors for applicant tracking, background screening, identity verification, HR and payroll systems, video conferencing, leave management, performance management, compensation benchmarking, and benefits administration.
  • Benefit carriers, brokers, and retirement plan administrators and fiduciaries to administer benefits.
  • Banking and ACH partners to deliver direct-deposit pay and remit payroll taxes.
  • Government, tax, and court agencies as required by law, including the IRS, state tax authorities, state unemployment agencies, USCIS / E-Verify, the Bureau of Labor Statistics, and courts or agencies that issue garnishment, levy, or income-withholding orders.
  • Verifiers of employment (lenders, landlords, prospective employers) only with your explicit authorization.
  • Auditors, legal counsel, and professional advisors, under confidentiality obligations.
  • Acquirers or successors in interest in connection with a merger, acquisition, asset sale, or similar corporate transaction, subject to customary confidentiality protections.
  • Other parties where you have authorized disclosure.

A current vendor list is maintained internally and is available upon request by emailing [email protected].

6. How long we keep your information

We retain personal information for as long as necessary to fulfill the purposes described in this notice and to comply with our legal, accounting, audit, tax, ERISA, and reporting obligations. The specific retention period may vary depending on the type of information and applicable regulatory or policy requirements. For example:

  • Employment records are retained in accordance with labor laws
  • Financial records follow retention periods defined by tax and audit regulations

When information is no longer needed, we securely delete, anonymize, or archive it using methods designed to protect confidentiality and prevent unauthorized access.

7. Your rights under California law

The rights described in this Section 7 are provided under the CCPA and apply to California residents. If you are not a California resident, please see Section 9 for information about rights that may apply in your state. All rights are subject to certain exceptions; we will tell you if an exception applies to your request.

7.1 Right to Know

You have the right to request that we disclose:

  • The categories of personal information we have collected about you
  • The categories of sources from which we collected it
  • The business or commercial purposes for collecting it
  • The categories of third parties with whom we have shared it
  • The specific pieces of personal information we hold about you (a “data portability” request)

To exercise any of the rights described above, please contact us using the information provided in the “Contact Us” section below. We may ask you to verify your identity before processing your request. Additional rights may apply to residents of California, as described in the following section.

7.2 Right to delete

You have the right to request that we delete personal information we have collected from you, subject to exceptions. Some information cannot be deleted because we are legally required to retain it (for example, payroll, tax, I-9, ERISA, and other regulated records). If a legal exception applies, we will tell you.

7.3 Right to correct

You have the right to request that we correct inaccurate personal information we hold about you. We will use commercially reasonable efforts to correct the information, taking into account the nature of the data and the risk of harm to you from keeping inaccurate data.

7.4 Right to limit use of sensitive Personal Information

You have the right to request that we limit our use and disclosure of sensitive personal information to only the purposes permitted by law. Note that some uses of sensitive personal information are necessary to perform the services you reasonably expect as an employee (e.g., payroll, benefits, and tax administration), and those uses cannot be limited because they are inherent to the employment relationship. We will explain this if it applies to your request.

7.5 Right to opt out of sale or sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. This right is not currently applicable, but we will update this notice if our practices change.

7.6 Right to non-retaliation

We will not discriminate against you, discharge you, demote you, or otherwise retaliate against you for exercising any of the rights described in this Section 7. Exercising your privacy rights will have no effect on your employment or application status.

8. How to Submit a Privacy Request

Because Lumin is a small-to-medium employer, we fulfill privacy requests manually rather than through a self-service portal. Here is what to expect:

8.1 How to submit

  • Email [email protected] with the subject line “CCPA Request.”
  • Tell us which right(s) you are exercising (know, delete, correct, or limit sensitive PI use) and provide any context that will help us locate your information.
  • Current and former employees may also submit a written request to the Human Resources team.

8.2 Verification

Before we respond, we will verify your identity to protect your information from unauthorized disclosure. For current employees, this typically means matching information already in our possession (such as employee ID, work email, and last four digits of your SSN). For applicants and former employees, we may ask for additional identifying information appropriate to the sensitivity of the request.

8.3 Timelines

  • We will acknowledge your request within 10 business days.
  • We will respond substantively within 45 calendar days.
  • We may extend this period by an additional 45 days when reasonably necessary and will notify you by email if we do.

8.4 Authorized agents

You may designate an authorized agent to submit a request on your behalf by providing the agent with signed, written permission. We will independently verify your identity and confirm the agent’s authority before processing the request.

8.5 What to expect during fulfillment

Because your information may be held in multiple systems, a complete response may require us to gather records from multiple teams. We will complete this within the statutory timelines. There is no charge for submitting a request, though we may charge a reasonable fee or decline to act on requests that are manifestly unfounded or repetitive.

9. Additional rights for employees in other states

This notice is written primarily to satisfy California law. Lumin employs or may employ individuals in other states that have their own privacy or biometric data laws. If you are located in one of the states below, those laws may give you additional rights or impose additional obligations on Lumin:

  • Illinois – Biometric Information Privacy Act
  • Texas – Capture or Use of Biometric Identifier Act.

This list may be updated as Lumin expands or as new state laws take effect. If you believe your state provides additional rights not addressed here, please contact [email protected].

10. Notice at collection

This notice serves as Lumin’s “notice at collection” as required by CCPA §1798.100(b). It describes the categories of personal information we collect and the purposes for which we use that information. We will provide this notice to applicants at the start of the application process and to employees at or before onboarding.

We will not collect additional categories of personal information or use personal information for purposes that are materially different from those described here without first updating this notice.

11. Changes to this notice

We review and update this notice at least annually, or sooner when our data practices change in a material way. When we make material changes, we will communicate them to current employees through our normal internal channels and update the effective date at the top of this notice. Applicants will be directed to the most current version of this notice during the application process.

12. Contact us

If you have questions about this notice, want to exercise a privacy right, or have concerns about how Lumin handles your personal information, please contact:

Lumin Digital Privacy Team
Email: [email protected]
Subject line: “Employee Privacy Inquiry” or “CCPA Request”
We are committed to resolving your concerns promptly and transparently.