ORION MOBILE APPLICATION PRIVACY NOTICE

1. Scope

This Privacy Notice describes how Ubiquity Global Services, Inc. and its subsidiaries that are employers(1) (collectively referred to as “Ubiquity,” “we” or “us”) collect, access, use, disclose, transfer, retain and protect your personal data through the Orion mobile application.

Orion is Ubiquity’s internal human resources application and is made available only to authorized Ubiquity employees and other approved advisors. You are receiving this notice as a member of one of these categories.

This Privacy Notice supplements Ubiquity’s general Privacy Policy, available at https://www.ubiquity.com/privacy-policy. If there is a conflict concerning personal data processed through Orion, this Orion Privacy Notice will apply.

2. Data Available Through Orion

Depending on your location, role and enabled features, Orion may collect, process, display or retain the following personal information.

Your profile information

• Name and employee identification number
• Work email address and business contact details
• Job title, department, manager, employing entity and work location
• Employment status and other employment-related information
• Profile photograph, if provided

Your payroll and payslip information

• Salary and compensation information
• Payroll period and payment details
• Allowances, deductions, taxes, benefits and contributions
• Bank or payment-related information where included in payroll records
• Payslip documents and payroll history

Your work schedule information

• Assigned work schedules
• Shifts, rest days, attendance-related information and schedule changes
• Work location or assigned operating site

Newsfeed and communications

• Company news, announcements, policies and employee communications
• Confirmation that a communication was delivered, opened or acknowledged, if this functionality is enabled

Your account and authentication information

• Username or employee identifier
• Authentication records, login timestamps and session information
• Multi-factor authentication information
• Whether you have enabled optional biometric sign-in on your device (Ubiquity does not receive your fingerprint, facial or other biometric data)
• Account status and access permissions

Your device, application and technical information

• Device type, operating system, application version, language and general configuration
• Internet Protocol address and device or application identifiers
• Application activity, diagnostic logs, error reports and crash information
• Push-notification token and notification-delivery status
• Security events and suspected unauthorized-access information

Orion does not use, sell or otherwise make available your personal data for third-party advertising or behavioral advertising.

3. Sources of Personal Data

Most personal data displayed through Orion comes from Ubiquity’s existing Orion human resources database and other authorized HR, payroll, scheduling, identity and workforce-management systems. This data has been obtained:

• Directly from you, the employee
• From your manager, HR, Payroll or other authorized departments
• From your device when the application is used
• From approved service providers supporting the application

4. Purposes of Processing

Ubiquity uses Orion to:

• Authenticate you and manage your application access
• Display and maintain your profile information
• Provide you with electronic access to your payslips and payroll information
• Display your work schedule and authorized schedule changes
• Deliver company news, notices and employee communications
• Administer employment, payroll, benefits and workforce operations
• Provide technical support and troubleshoot application issues
• Detect, prevent and investigate unauthorized access, fraud, misuse or security incidents
• Maintain application availability, security, performance and reliability
• Analyze application usage and workforce information to evaluate, develop and improve Ubiquity’s tools, systems, services and workforce operations, including analytical and automated tools
• Comply with employment, tax, accounting, regulatory, security and legal obligations
• Establish, exercise or defend legal claims
• Enforce Ubiquity policies and protect Ubiquity personnel, systems and information

Orion does not make decisions producing legal or similarly significant effects concerning you through automated processing alone.

5. Legal Basis

Depending on the applicable jurisdiction, Ubiquity may process your personal data because:

• Processing is necessary to administer your employment relationship
• Processing is necessary to comply with legal obligations
• Processing is necessary for Ubiquity’s legitimate business, security and administrative interests
• Processing is necessary to protect individuals, systems or property
• You have provided consent where consent is required by applicable law

Where processing is based on your consent, you may withdraw that consent, subject to legal and operational limitations.

6. Access and Disclosure

Your personal data may be accessed by authorized personnel with a legitimate business need, including:

• Human Resources
• Payroll and Finance
• Workforce Management and Operations
• Information Technology and Information Security
• Legal, Privacy, Compliance and Internal Audit
• Your authorized managers
• Ubiquity affiliates supporting HR and business operations

Ubiquity may disclose information to approved service providers that support application hosting and infrastructure, identity and authentication, payroll and HR services, push notifications, application monitoring, analytics, crash reporting, technical support and security.

Service providers are required to process personal data only for authorized purposes and to maintain appropriate safeguards. Ubiquity may also disclose information when required by law, legal process or government authority, or to protect the rights, safety, property and security of Ubiquity or others. Ubiquity does not sell your personal data or share it for cross-context behavioral advertising.

7. International Transfers

Ubiquity operates internationally. Personal data may be processed in countries other than your work location. Where required, Ubiquity applies appropriate safeguards for international transfers, including contractual protections and recognized transfer mechanisms.

8. Data Security

Ubiquity maintains administrative, technical and physical safeguards designed to protect your personal data. These may include:

• Role-based access controls
• Encryption during transmission and, where appropriate, at rest
• Authentication and session controls
• Security logging and monitoring
• Vulnerability management and security testing
• Access reviews and personnel confidentiality requirements
• Incident-response and business-continuity procedures

No system can be guaranteed to be completely secure. You must protect your credentials and immediately report suspected unauthorized access.

9. Retention and Deletion

Ubiquity retains your personal data for as long as necessary to administer employment, provide Orion functionality, comply with legal obligations, resolve disputes, maintain security records and enforce agreements and policies.

Payroll, tax, employment, security and audit records may be retained after your employment ends where required by law or Ubiquity’s retention schedule.

Orion accounts are provisioned and managed by Ubiquity. Your access will normally be disabled when it is no longer required or when your employment ends. Disabling application access does not require Ubiquity to delete your employment records that must be retained for legal or legitimate business purposes.

You may submit an appropriate data-rights or deletion request using the contact information below. Ubiquity will evaluate each request under applicable law and its record-retention obligations.

10. Your Rights

Depending on applicable law, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete information
• Request deletion or restriction of certain information
• Object to certain processing
• Withdraw consent where processing is based on consent
• Request information about international transfers
• File a complaint with an applicable privacy authority

These rights may be subject to legal exceptions and employment-record requirements. You may direct requests concerning your employment records to your local Human Resources team or the Ubiquity Privacy Contact.

11. Mobile Permissions

Orion will request access only to device features reasonably necessary for enabled application functions. Any permission request will explain its purpose when required.

Orion currently requests the following permissions: internet and network access, used to connect to Ubiquity systems, load your content and send diagnostic and error reports; and, if you choose to enable it, biometric authentication (Face ID, fingerprint or an equivalent device feature), used to sign in and to open your payslips. Biometric sign-in is optional, and you may use your password and multi-factor authentication instead. Your device performs the biometric match, and Orion receives only confirmation that it succeeded or failed. Ubiquity does not collect, receive or store your fingerprint, facial geometry or other biometric data.

Orion does not access precise location, contacts, photographs, files, camera, microphone or other sensitive device features unless the related functionality has been enabled, described in this Privacy Notice and declared to Apple and Google. Where a permission is requested, you may decline it or change it later in your device settings, in which case only the feature that depends on that permission will be unavailable.

12. Your Responsibilities

You are required to:

• Keep your login credentials confidential
• Use Orion only for authorized employment-related purposes
• Protect payslips and other confidential information displayed through the application
• Secure your mobile device with an appropriate passcode or device lock
• Avoid accessing Orion through rooted, jailbroken, compromised or shared devices
• Promptly report a lost device or suspected unauthorized access

13. Children

Orion is an internal workforce application and is not intended for children.

14. Changes to This Privacy Notice

Ubiquity may update this Privacy Notice when Orion’s features, data practices, service providers or legal requirements change. We will communicate material updates to you through the application or another appropriate channel.

15. Contact Information

You may submit questions, concerns and privacy requests to the Ubiquity Privacy Contact and Data Protection Officer.

Email: [email protected]

Mail: Ubiquity Global Services, Inc., Attn: Data Protection Officer, 568 Broadway, Suite 601, New York, NY 10012

(1) For data protection purposes, the controller of your personal data is the Ubiquity entity that employs or engages you. Ubiquity Global Services, Inc. maintains this Privacy Notice on behalf of those entities.