Employee CCPA Notice

Last Updated: May 1, 2026

This notice describes the categories of Personal Information (“PI”) collected by Afognak Native Corporation, its direct and indirect subsidiaries at any level (including Alutiiq, LLC Afognak Commercial Group, LLC, and Afognak Professional Consulting, LLC and their direct and indirect subsidiaries), and any joint ventures, partnerships, and affiliates of those companies (“Company”) from and about California residents who are employees, the purposes for which the Company collects and uses such information, how long we retain this information, and rights you may have under the California Consumer Privacy Act (“CCPA”), as amended.

We are providing this notice to you in accordance with California Civil Code Sec. 1798.100 (“CCPA”). For additional information about the Company’s data privacy practices, please review our Privacy Policy https://privacy.afognak.com/.

Categories of Personal Information Collected

The Company collects or has collected in the preceding 12 months, the following categories of PI. We may add to the categories we collect and will inform you in the event we do so.

Identifiers and other Contact information described in subdivision (e) of CA Civ Code Section 1798.80. This category includes names, addresses, telephone numbers, mobile numbers, email addresses, dates of birth, Social Security numbers, driver’s license or state identification numbers, passport number, bank account information, and other similar contact information and identifiers.

Protected classification information. This category includes characteristics of protected classifications under California or federal law.

Internet or other electronic network activity information. This category includes without limitation:

• all activity on the Company’s information systems to the extent permitted by law and Company policy including business-related internet browsing history; search history; intranet activity; email communications (sent/received or stored on Company systems); business related social media postings, stored documents and emails; system usernames, and authentication credentials managed through Company security systems.
• all activity on communications systems including phone calls, call logs, voice mails, text messages, chat logs, app use, mobile browsing and search history, mobile email communications, and other information regarding an employee’s use of company-issued devices.

Biometric data. This category may include the use of biometric equipment, devices, or software to record your time worked, facilitate entering or exiting facilities or rooms, to enable access or use of equipment, or for other business purposes.

Commercial data. This category includes, without limitation records of Company swag purchases or information related to reimbursement requests.

Professional and employment-related information. This category includes without limitation:

• data submitted with employment applications or collected during the application process.
• background check, background investigation, and criminal history
• employment history
• work authorization
• fitness for duty data and reports
• performance and disciplinary records
• salary and bonus data
• benefit plan enrollment, participation, and claims information
• leave of absence information including religious and family obligations, physical and mental health data concerning employee and his or her family members

Education information. This category includes information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).

Geolocation data. This category includes GPS location data from company-owned vehicles.

Audio, Electronic, Visual, or Similar Information. This category includes, without limitation, information collected from CCTV, vehicle tracking, footage on premises.

Sensitive Personal Information. This category includes the following:

• Social Security, driver’s license, state identification card, or passport number.
• account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
• precise geolocation.
• biometric data/information.
• racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
• content of mail, email, and text messages unless the Company is the intended recipient of the communication.
• health information (We may collect and process limited medical and health information, which may include, without limitation, fitness-for-duty information; medical certifications or healthcare provider documentation; information related to leaves of absence; accommodation requests and interactive process records; and other health-related information necessary for employment administration, workplace safety, benefits administration, legal compliance, or as otherwise permitted by applicable law. Such information may also include information relating to an employee’s or applicant’s physical or mental health condition, or that of their family members, to the extent relevant to employment-related benefits, leave entitlements, or accommodation obligations. We collect and use this information only for lawful employment-related purposes and maintain it in a confidential manner, consistent with applicable federal, state, and local laws.)

Inferences drawn from the PI in the categories above.

Please note that PI for purposes of this Notice does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern; information that is deidentified or aggregated; and information subject to certain other laws such as the Gramm-Leach-Bliley Act (GLBA), the California Financial Information Protection Act, the Health Insurance Portability and Accountability Act (HIPAA), the Fair Credit Reporting Act (FCRA), etc.

Purposes Personal Information is Used

The Company collects and uses PI for onboarding, managing the employment and post-employment relationship, for its business-related purposes, and for legal compliance. Personal Information collected is only used for purposes listed below, unless otherwise notified.

• Conducting background and related checks, personal security clearance processing, onboarding, and related activities.
• Confirming fitness for duty, obtaining and/or maintaining a facility clearance, obtaining and/or maintaining security guard license.
• Processing payroll, travel profile and employee benefit plan and program administration including enrollment and claims handling and leave of absence administration.
• Maintaining personnel records and satisfying record retention requirements.
• Communicating with employees and/or employees’ emergency contacts and plan beneficiaries.
• Complying with applicable state and federal health, labor, employment, benefits, workers compensation, disability, equal employment opportunity, workplace safety, and related laws, guidance, or recommendations.
• Preventing unauthorized access to, use, or disclosure/removal of the Company’s property, including the Company’s information systems, electronic devices, network, data, vehicles and other assets.
• Ensuring compliance with Company policies and procedures.
• Investigating complaints, grievances, and suspected violations of Company policy; establishing, responding to and managing legal claims against the Company and/or its personnel including civil discovery in litigation.
• Designing, implementing, and promoting the Company’s diversity and inclusion programs.
• Providing accommodations.
• Facilitating the efficient and secure use of the Company’s information systems and other assets.
• Ensuring compliance with Company policies and procedures.
• Improving efficiency, logistics, and supply chain management.
• Improving accuracy of time management systems.
• Evaluating an individual’s appropriateness for a participation position at the Company, or promotion to a new position.
• Customer engagement where relevant to an individual’s job responsibilities, and other legitimate business purposes
• Identifying trends requiring attention or opportunities for improving the Company’s response to employee issues; and to allow the Company to develop and improve recruitment and retention strategies.
• Promoting the recognition of contributions made by an individual Employee or team of Employees toward the Company’s goals and objectives.
• Administering the Company swag program.
• Improving safety of our facilities for employees, customers and the public with regard to use of Company property and equipment.
• Complying with federal, state, and local orders, identifying potential COVID-19 symptoms, and protecting the workplace
• Facilitating other business administrative functions and strategic activities, risk management, information technology and communications, financial management and reporting, workforce and succession planning, merger and acquisition activities, and maintenance of licenses, permits and authorization applicable to the Company’s operations.
• Engaging in human capital analytics, including but not limited to, identifying certain correlations about individuals and success on their jobs, analyzing data to improve processes, and analyzing employee preferences to inform HR Policies, Programs and Procedures.
• As required by applicable law.

Sources of Personal Information.

We may collect your personal information from the following sources:

• You. We may collect Personal Information directly from or about you when you send us an email, call, or otherwise communicate or interact with us during or after your employment. We may also collect information automatically from or about you when you use our information systems, through security cameras, through your use of our facilities, vehicles or other Company assets.
• Related Entities and Affiliates. We may collect information about you from our related parties and affiliates.
• Social media and related services. We may collect information about you through your social media services consistent with your settings on such services or from public websites as permitted by their terms of use.
• Third parties. We may collect information about you from third parties such as your colleagues, emergency contacts, or other third-party sources that are lawfully entitled to share your Personal Information with us. This may include service providers or contractors who collect or process your Personal Information on our behalf.

Disclosures. To carry out the purposes outlined above, we may disclose your Personal Information to

• our related entities, or affiliates (e.g., data is shared to administer employee benefits and/or claims).
• our business partners (e.g., data is shared to administer employee benefits and/or claims).
• service providers, contractors, and vendors (e.g., background check providers, payroll processors, benefits administrators, insurers, travel agencies, security consultants, information technology providers, data storage providers, HR software tool providers, time management providers, Company swag, etc.).
• professional advisors (e.g., lawyers, auditors, accountants, consultants).
• clients or customers (e.g., key personnel resumes may be included in proposal submissions, to facilitate site visits, or satisfy access requirements).
• third parties, as necessary, to: (1) comply with federal, state, or local laws; (2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; (3) cooperate with law enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws; (4) investigate claims or allegations or to establish, exercise or defend legal claims; or (5) evaluate or perform a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control or acquires all or part of the assets of our business.

The following chart lists the categories of Personal Information we disclose or may have disclosed in the preceding 12 months to service providers and contractors:

• Identifiers and other Contact Information
• Protected classification information
• Internet or other electronic network activity
• Commercial information
• Biometric Information
• Geolocation data
• Audio, electronic, visual, or similar information
• Biometric Information
• Education or Professional and Employment information, including veteran status or other similar identifiers.
• Sensitive information
• Inferences

California Resident Individual Rights Requests. Residents of the State of California have the following rights, subject to certain limitations.

Right to Opt Out of the Sale or Sharing of Your Personal Information. While you have the right to opt out of the sale or sharing of your Personal Information, please note the Company does not sell or share, as those terms are defined by the CCPA, any category of Personal Information we collect about you as an employee.

In addition, we do not have actual knowledge that we sell or share the Personal Information of individuals under the age of 16 years.

Right To Request Deletion of Your Personal Information. You have the right to request that we delete the Personal Information we collected or maintain about you. Once we receive your request, we will let you know what, if any, Personal Information we can delete from our records and will direct any service providers and contractors to whom we disclosed your Personal Information to also delete your Personal Information from their records. There may be circumstances where we cannot delete your Personal Information or direct service providers or contractors to delete your Personal Information from their records. Such instances include, without limitation, when the information at issue is maintained: (a) to enable solely internal uses that are reasonably aligned with your expectations based on your relationship with the Company and compatible with the context in which you provided the information, or (b) to comply with a legal obligation.

Right to Correct Inaccurate Personal Information. You have the right to request that the Company correct any inaccurate Personal Information we maintain about you, taking into account the nature of that information and purpose for processing it.

Right To Know What Personal Information is Being Collected. You have the right to request information beyond what we have disclosed above regarding the following, to the extent applicable:

• the categories of Personal Information the Company collected about you.
• the categories of sources from which that Personal Information was collected.
• the business or commercial purposes for which that information was collected, sold, or shared.
• the categories of third parties to whom the information was disclosed.
• the categories of Personal Information that we sold or shared about you, and for each category identified, the categories of third parties to whom we sold or shared that particular category of Personal Information.
• the categories of Personal Information that we disclosed for a business purpose, and for each category identified, the categories of service providers or contractors to whom we disclosed that particular category of Personal Information.
• the specific pieces of Personal Information collected.

Right to Limit Use and Disclosure of Sensitive Personal Information. The Company does not disclose Sensitive Personal Information for purposes other than those permitted under California Civil Code section 1798.121, including purposes necessary to perform employment and post-employment -related functions, ensure security and integrity, comply with legal obligations, or as otherwise permitted by law. Accordingly, the right to limit the use and disclosure of Sensitive Personal Information does not apply to the Company’s processing of such information in the employment context.

Right to Withdraw Consent. If we request and you provide your consent to process certain Personal Information, you may freely withdraw your consent at any time.

Right to Opt Out of Automated Decisionmaking (“ADMT”), Access Information about ADMT, and Appeal an ADMT Decision. The CCPA provides for certain rights related to the use of ADMT for significant decisions; however, we do not use ADMT to make significant decisions about you.

We will not retaliate against you for exercising any of the rights described above.

Submitting CCPA Rights Requests. To submit a CCPA Rights request, please contact us at 888-232-9574 or email us at HR@afognak.com. We reserve the right to only respond to verifiable Requests to Know, Delete, or Correct that are submitted as instructed. A verifiable consumer request is one made by any individual who is:

• the individual who is the subject of the request,
• an individual on behalf of the individual’s minor child, or 
• the authorized agent of the individual.

What to submit. If we request, you must provide us with sufficient information to verify your identity and/or authority to act on behalf of the individual. In general, we may ask you to provide identifying information that we already maintain about you, or we may use a third-party verification service. In either event, we will try to avoid asking you for Sensitive Personal Information to verify your identity. We may not be able to respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. However, making a verifiable request does not require you to create an account with us.

Additionally, you will need to describe your request in sufficient detail to allow us to review, understand, assess, and respond. We will not use the Personal Information we collect from an individual to determine a verifiable request for any other purpose, except as required or permitted by law.

Our response. We reserve the right to charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will attempt to notify you as to why we made that decision and provide a cost estimate before completing your request. We will endeavor to respond to a verifiable request within forty-five (45) calendar days of receipt, but we may require an extension of up to forty-five (45) additional calendar days to respond and we will notify you of the need for the extension.

Authorized Agent. You may authorize a natural person or a business (the Agent) to act on your behalf. When you submit a Request to Know, Correct, or Delete, the Agent must provide proof that you gave the Agent signed permission to submit the request, and you either must (i) verify your own identity with the business or (ii) directly confirm with us that you provide permission to the Agent. However, these steps are not required when you have provided the authorized agent with power of attorney pursuant to Probate Code sections 4000 to 4465. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization.

Spouses, Dependents, and Associates. If you have knowledge that the Company collected Personal Information related to your spouse, dependent, or associate, please share a copy of this notice with all such individuals.

If you have questions about this notice, you may call 888-232-9574 or email HR@afognak.com

Changes to Statement. We reserve the right to amend this Notice from time to time. If the Company makes material changes as to how it collects, uses, or discloses Personal Information, the Company will provide notice in accordance with applicable law.