California supplementary people privacy notice

The People privacy notice already describes the information we collect and the sources of information. This section organizes the information around the personal information categories set out in the California Consumer Privacy Act of 2018 (“CCPA”).

We have collected the following categories of personal information about you:

Identifiers: Name, postal address, Internet Protocol address, email address, Social Security number, driver’s license number and passport number

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code §1798.80(e)): Name, signature, Social Security number, address, telephone number, driver’s license, state identification card number, passport number, education, employment, employment history, bank account number, debit card number, credit card number, tax records (W2 form) or any other financial information, and medical information

Protected classification characteristics under California or federal law: Age, gender, race, citizenship, marital status, physical or mental disability, veteran, or military status

Medical and health data: Doctor’s notes, work restriction information, medical leave of absence records, requests for ADA accommodations, and work injury

Internet or other similar network activity: Browsing history, search history, interaction with a website or application

Geolocation data: Physical location or movements (for example, when operating a company owned vehicle)

Sensory data: Audio, electronic, visual, or similar information

Professional or employment-related information: Performance evaluations, resume/CV information, certifications and professional associations, and employment screening (for example, driver license checks)

Education data: Education level, school attended, field of study and date of graduation

Inferences drawn from other personal information: Profile reflecting a person’s behavior (for example, driver profile)

Mott MacDonald has disclosed the following categories of personal information for a business purpose to the following third parties:

• We have disclosed your internet or other network activity information to IT support to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and to identify and repair website errors.
• We have disclosed your identifiers and sensory data (visual information including photos) to business partners and social networks for profile or promotional materials.
• We have disclosed your identifiers, personal information categories, professional and employment information and medical and health data to service providers in connection with human resource activities and workforce management, including our professional advisors (tax firm and law firm), financial institutions (including insurance agencies and pension plan administrators), credit reporting agencies, health and benefits administrators, background screening providers, travel accommodation providers, communication vendors (for emergency situations) and mailing vendors.
• We have disclosed your identifiers, personal information categories, professional and employment information, and education information to our trusted business partners (i.e., clients) as part of client retention and management.
• We have disclosed your identifiers, personal information categories, professional and employment information to government agencies to fulfil our legal obligations (for example, to comply with a court order or subpoena).

Please note that we do not sell your personal information as defined under the CCPA.

We will only keep your personal information for as long as is necessary. Here’s what we consider when we establish retention periods:

• If we need it to operate or provide services or benefits. For example, we need to keep your information to administer your health benefits.
• How long we need to retain the information to comply with certain legal obligations. For example: tax, health and safety, immigration, and financial audits; a legal request or obligation including obligations of Mott MacDonald companies; or to comply with applicable law or a legal claim, complaint, litigation or regulatory proceedings.
• If we need it for other legitimate purposes, such as to prevent harm to individuals or to our business, promote safety, security, and integrity, or protect our legal rights, property, or assets.

In some instances, and for specific reasons, we’ll keep information for an extended period of time. For example, if it’s needed in relation to a legal claim, complaint, litigation or regulatory proceedings, to prevent harm or for safety, security and integrity purposes.

When your personal information is deleted or destroyed, we ensure that it is safely and permanently disposed of in accordance with relevant California laws and regulations.

The CCPA, as amended by the California Privacy Rights Act (“CPRA”) (collectively, “CCPA”) grants certain rights to California residents. To the extent that the CCPA applies to our processing of your personal information, you have the following rights over your personal information:

• Right to access/know and request what personal information we have collected, used, and disclosed about you.
• Right to correct the personal information we hold about you. This enables you to ask us to amend or update any incomplete or inaccurate personal information.
• Right to request the deletion of personal information about you unless an exception applies. We may deny your request, for example, to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for such activities or to comply with a legal obligation.
• Right to non-discriminatory treatment if and when you exercise your rights under the CCPA.
• Right to limit use of sensitive personal information when such use goes beyond that which is necessary for permissible purposes like fraud, customer service or quality control. Sensitive information includes Social Security number, driver’s license number, biometric information, precise geolocation, and racial and ethnic origin. However, Mott MacDonald does not process sensitive personal information in a manner which gives rise to this right.

Response timing and format

We endeavor to respond to your request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

Authorized agents

If you are a California resident, only you or a person that you authorize to act on your behalf may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.

If you have any questions about this California supplementary people privacy notice or wish to exercise your rights as a California resident, please contact the Privacy and Data Protection Team at privacy@mottmac.com. As a resident of California, you can also contact privacyamericas@mottmac.com or dial 925 469 8010.