Effective Date: April 24, 2026

This California Privacy Notice addresses how we process the Personal Information of applicants for employment, employees, and contractors who are residents of California.  This Notice supplements our underlying Employee and Contractor Privacy Policy to ensure compliance with the law.  

If you are an Employee or Contractor residing in California, you have rights regarding how we collect and process your Personal Information under the California Consumer Privacy Act (“CCPA”), as modified by the California Privacy Rights Act (“CPRA”). This Addendum will provide you with a summary of the categories of information we collect, the reasons that we collect each category of information, information regarding how we may disclose your Personal Information to third parties, and information regarding your rights under the CPRA. If you have any questions, please contact us via the Contact Us section, below.

1. Information We Collect 

In the preceding 12 months, we have collected the categories of Personal Information identified above in Section 3 of the Employee and Contractor Privacy Notice for the purposes identified in Section 4 of the Employee and Contractor Privacy Notice. 

2. Sources of Personal Information

We collect the majority of the information that we process about you directly from you, through the applications or forms you submit and the information you provide at the time of hiring.  In addition to the information that you provide to us, we may collect information about you from third parties, such as information from third parties that provide accreditation, educational institutions, benefits providers, and vendors that provide background checks or related information.  Finally, we may automatically collect, store, or otherwise process information about you as you use our tools, systems, or resources. 

3. How Your Personal Information Is Disclosed

In the preceding 12 months, we have disclosed the following categories of employment related information to service providers, who are necessary for facilitating the employment relationship and providing you with benefits: 

• – Identifiers, Personal, Classification, Internet, Professional, Education, and Sensitive Information.  

We enter into written contracts with our service providers to ensure the privacy and security of your Personal Information.  Under these contracts, we restrict the access to and processing of your Personal Information to that which is necessary for the purpose of the disclosure.  

In certain circumstances, we may provide you with opportunities to sign up for certain benefits programs that involve the disclosure of your Personal Information to third party benefits providers.  Any such program will be purely optional and based on your opt-in participation. Any service providers used to provide these benefits will provide you a notice of their information management practices at the time of data collection.  

In the preceding 12 months, we have not sold or shared employment related Personal Information to third parties for money or anything of monetary value. To the extent that personnel use our website or Services, the use of such Services may be subject to the terms of the Privacy Policy provided on such Service.  

We do not collect, process, or disclose sensitive Personal Information, as defined under the CPRA, for purposes other than those specifically authorized in Section 7027 of the CPRA regulations. 

We may collect certain information regarding the family members of Personnel for the purposes of providing benefits. In some circumstances, this may include information about individuals under 16 years of age. In no circumstances do we sell or share information regarding children under 16 years of age. In no circumstances do we process such information for any purpose other than for purposes reasonably associated with providing the relevant benefits. 

4. Individual Rights

The CPRA provides residents of California with a series of rights regarding the processing of their Personal Information.  This section explains the scope of these rights and outlines how you may exercise them. 

1. (a) Right to Know About Personal Information Collected, Disclosed, Shared, or Sold 

You have the right to know whether we are processing your Personal Information and to request that we disclose the Personal Information we collect, use, and disclose to third parties.  There are two types of Rights to Know requests that you can make: an Abbreviated Request and a Specific Information Request. 

If you make a Right to Know (Abbreviated Request), you will receive the following information about you: 

1. a. Categories of Personal Information collected, sold, or shared; 

2. b. Categories of sources from which Personal Information is collected; 

3. c. Categories of third parties to whom the information is sold, shared, or disclosed; 

4. d. Business or commercial purpose for collecting, sharing, or selling Personal Information;  

5. e. Categories of Personal Information disclosed for a business purpose and categories of persons to whom it was disclosed for a business purpose. 

If you make a Right to Know (Specific Pieces of Information Request), you will receive the following information about you: 

1. (a) Specific pieces of Personal Information collected about you. 

We will provide this information to you free of charge, unless we determine that your request is manifestly unfounded or excessive.  You may request this information twice in a 12-month period. 

We will provide this information to you in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data without hindrance.  

There are certain exceptions to the Right to Know.  We will state in our response if an exception applies.  

2. (b) Right of Deletion 

You have the right to request that we and our service providers delete Personal Information that we have collected about you by submitting a verifiable request.  This right is subject to certain exceptions and does not require us to delete information that we are otherwise required to hold under applicable laws.  We will state in our response if an exception applies. 

3. (c) Right of Correction 

You have the right to request that we correct inaccuracies in any Personal Information that we collect or process about you upon receipt of a verifiable request.  When submitting a correction request, we request that you provide all of the information reasonably necessary to confirm the accuracy of the correction request.  This right is subject to certain exceptions.  We will state in our response if an exception applies. 

4. (d) Right to Non-Discrimination 

We will not retaliate against any employee, applicant for employment, or independent contractor for exercising your rights under the CPRA.  Additionally, we will not discriminate against you by: denying goods or services to you; charging different prices or rates for benefits, goods, or services, including through the use of discounts or other benefits or imposing penalties; providing a different level of quality of goods or services to you; or suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.   

5. (e) Submitting Requests 

You may submit a request using the contact information set forth in Section 8 of the Employee and Contractor Privacy Notice.  

We will respond to these requests, if applicable, within 45 days of receipt of the request and without undue delay.  If we need to extend this period, we will notify you of the delay and explain the reasonably necessary justifications for our delay.   

We will provide responses to your requests free of charge unless exclusions apply, which we will identify in our response.  

6. (f) Verifying Requests 

To ensure the protection of your Personal Information, we must verify that the individual submitting a request is the contractor or employee to whom the request relates prior to processing the request.  To verify your identity, we may request up to three pieces of Personal Information about you to compare against our records.  

You will not be required to create an account with us to submit a verifiable request.  However, you may be required to access an existing account to the extent accessing the account is necessary.  

We will only use Personal Information provided in your request to verify your identity and will delete any information you provide after processing the request.  We reserve the right to take additional steps as necessary to verify your identity where we have reason to believe a request is fraudulent. 

7. (g) Authorized Agents 

California residents may submit rights requests through the use of an Authorized Agent registered with the California Secretary of State to act on your behalf.  If you choose to use an Authorized Agent, we require that you provide the Authorized Agent with written permission to allow them to submit your request and that you verify your identity directly with us.  Failure to do so may result in us denying your request. 

5. Data Retention 

We retain the information collected pursuant to this Privacy Policy during the period of active employment of the employee or service relationship of the contractor, as well as during the post-employment period only as long as the Personal Information is required to serve its original purpose or as directed by applicable legislation or regulation. Such post-employment retention may be as long as 7 years in certain cases, as required by law or best practice.  We may retain information regarding applicants for the duration of the hiring process, for a reasonable period following the hiring process as required by law or internal policy, or as may be required for relevant statistical purposes. Personal Information that is no longer needed for its stated purpose will be destroyed, erased, or made anonymous. 

We take appropriate measures to ensure that your Personal Information is processed and disposed of in a manner that maintains its confidentiality.  All Personal Information disposal procedures, including the disposal of computerized data storage devices, are designed to ensure the complete destruction of Personal Information and eliminate the risk of subsequent unauthorized access or disclosure. 

6. Changes to This Privacy Policy 

We reserve the right to make changes to this Privacy Policy from time to time.  When we update this Privacy Policy, we will post an updated version where TOHO houses other similar policies.  If you have questions regarding this Privacy Policy, please contact us by email [email protected]. You can review or consult the Privacy Policy at any time.  Any changes to this Policy will become effective as of the effective date of the new policy.   

We may be subject to certain laws and regulations relating to privacy and information security in more than one jurisdiction. If any term, covenant, condition, or provision of this Notice is held by a court of competent jurisdiction to be invalid, void, or unenforceable, it is the intent of this Notice that the scope of the rights and obligations of the Notice be reduced only for the affected jurisdiction and only to the extent deemed necessary under the laws of the local jurisdiction to render the provision reasonable and enforceable and the remainder of the provisions of the Notice will in no way be affected, impaired, or invalidated as a result.