Juul Labs Inc.

SUMMARY NOTICE OF WORKER AND APPLICANT PRIVACY PRACTICES

THIS SUMMARY NOTICE summarizes the full Worker and Applicant Global Privacy Notice, which describes how we may collect, use, store, disclose or erase your Personal Information when you apply to work for us, or to maintain a relationship with you when you work for Juul Labs, Inc.. (collectively, “Juul Labs“, “we“, “us“, “our“).

If we process Personal Information about you as a job applicant or worker, we are required to comply with applicable laws to protect the security and privacy of Personal Information. These laws include, but are not limited to: (i) the California Consumer Privacy Act (the “CCPA”) the EU General Data Protection Regulation 2016/679 (the “EU GDPR“); (ii) the EU GDPR as it forms part of retained EU law in the UK pursuant to the European Union Withdrawal Act 2018 (the “UK GDPR“); and the UK Data Protection Act 2018. Throughout this Summary Notice and the full Worker and Applicant Global Privacy Notice, the term “GDPR” is used to refer to the EU GDPR and the UK GDPR, to the extent each applies, and the term “Personal Information” has the meaning given to it under the law where you live, but typically refers to information that can be used to identify you as an individual.

CATEGORIES OF PERSONAL INFORMATION

We process Personal Information we collect during the application process and, as applicable, as your employer in the course of your employment. We collect this information from you, your supervisor or authorized third parties (e.g., recruitment agencies, government agencies and other public authorities) including information such as: your name, other identification data, bank account details, information related to your past jobs and current role, health-related information, salary and benefits, equity compensation, information related to your use of Juul Labs’ equipment and resources, your communications, your performance, certain sensitive Personal Information, and any disciplinary actions against you. We may also collect some Personal Information automatically, such as from your use of the Juul Labs’ technology. For more details, see Personal Information We Collect.

PROCESSING PURPOSES

We process your Personal Information to evaluate your eligibility for a role at Juul Labs, to maintain an employment relationship with you, provide payments and benefits to you, managing your daily job activities, to ensure compliance with laws and regulations and Juul Labs policies and procedures, to monitor job performance, security, and fraud prevention, to comply with corporate responsibilities, audit requirements, and support cost and budgeting analysis and other controls. For more details, see How We Use Your Information.

LEGAL BASES FOR THE PROCESSING OF YOUR PERSONAL DATA

Depending on where you live and the Juul Labs’ company that controls your Personal Information, applicable privacy laws may require us explain the legal reason(s) that justify our processing of your Personal Information. We generally rely on the following legal bases to justify our processing: (i) to comply with our employment contracts and maintain our relationship as an employer with our workers; (“Contract Justification“); (ii) to comply with our legal obligations, and (“Legal Obligation Justification“), and (iii) to pursue our legitimate interests when they are not overridden by your interests or fundamental rights and freedoms (“Legitimate Interest Justification“). If you are a resident of Europe or UK, please see the Supplemental Notice for Workers and Applicants in the UK or EEA for additional details.

DATA TRANSFERS AND RECIPIENTS

We may transfer your Personal Information to our group companies and third parties (e.g., business partners, customers, benefits providers), acquiring or acquired entities, service providers, and, in accordance with applicable law, governmental authorities, courts, external advisors, and similar third parties. Some recipients of your Personal Information may be in countries other than that in which you are located or employed. If you are a worker employed by Juul Labs in the UK, please see Annex I for more details.

RETENTION PERIODS AND DELETION

Your Personal Information will be deleted once no longer needed for the purposes of the original collection, resolve disputes, establish legal defenses, pursue our legitimate business purposes, or as required by applicable law and in line with our data retention policies. For more details, see the Data Retention.

YOUR PRIVACY RIGHTS

Depending on where you live and what laws apply to you, you may have rights regarding how we use your Personal Information, including the right to request a copy of your Personal Information, to have it corrected, or deleted. Please refer any questions to dataprivacy@juul.com. For more details, see the Individual Rights in Personal Data.

CHANGES OF THIS SUMMARY AND THE DETAILED PRIVACY NOTICE

This Summary Notice and the full Worker and Applicant Global Privacy Notice are subject to change. We will notify you of any material changes by email.

HOW TO CONTACT US

If you wish to exercise your privacy rights under applicable law, or if you have questions about our privacy practices, please contact us at dataprivacy@juul.com.

JUUL LABS

WORKER AND APPLICANT GLOBAL PRIVACY NOTICE

Effective Date: June 6, 2024

SCOPE

This Privacy Notice applies to employees, contractors, contingent and other personnel (collectively, “Workers”) and applicants and prospective Workers (collectively, “Applicants”) whose Personal Information Juul Labs may collect and process during its human resources operations, from submission of an application, throughout the course of an individual’s tenure with Juul Labs, and following such employment or services (collectively, the “Human Resources Operations”).

As used in this Privacy Notice, “Personal Information” has the meaning given to it under the law where an Applicant or Worker lives (also referred to as “you”), but typically refers to information that can be used to identify you as an individual. Please also note that any activities we take with respect to your Personal Information are referred to as “processing” or “processing activities.”

The terms “Juul Labs,” “we,” “us,” and “our” means Juul Labs, Inc.

his Privacy Notice explains the kinds of Personal Information we may collect, how we intend to use and share that information, and the rights you may have related to these processing activities.

An Important Note: This Privacy Notice only applies to data that we collect and process when interacting with you in your capacity as a Worker or an Applicant. Unless otherwise indicated on a specific website page or form, this Privacy Notice does not apply to any of the Personal Information that we process through your use of our public-facing websites, or product-related applications or services, which are subject to our user Privacy Policy governing those properties.

PERSONAL INFORMATION WE COLLECT

Juul Labs collects Personal Information about Workers and Applicants (and your family and dependents if you provide this information to us) as described below.

Personal Information We Collect from You Directly. We may process the following categories of Personal Information that you provide to us, if and as may be applicable to your relationship with us:

Profile/Demographic Information. For example, name, work address, telephone numbers, User ID, Personal ID, email addresses; home address, personal email address, citizenship, passport data (where required for international travel), nationality, citizenship, birth date, country of birth, national insurance number, tax reference, emergency contact details, CV data, bank account(s), information on prior employers, family members, family status, and, with respect to a company vehicle assigned to you or that you drive for company business, your license plate, car insurance, driving license, and other information pertaining to such vehicle, including your driving history and safety record;
Worker-Related Data: For example, job title and code, work location, division, department, position level, language(s) spoken and written, employment contract (if applicable), working time, attendance and leave (as applicable and allowed or required by law), manager’s name, business travel data, data about completion of required training, information related to talent management, start and end date, reason for leaving and similar job-related data;
Sensitive Personal Information: We may also collect sensitive Personal Information such as details of health and disability, including medical information, health insurance information, mental health, medical leave, marriage leave, and parental leaves (maternal, paternal, adoption); information about residency, citizenship, or immigration status; and optional demographic information such as sexual orientation, gender identity or affinity, race, ethnicity or veteran status, to helps us to comply with our reporting obligations and provide insight into equity and inclusion objectives.
Communications with Us. Personal information such as personal contact information when an Applicant or Worker communicates with us, for example to inquire about worker benefits.
From time to time, we may ask you to give us your feedback, opinion, or participate in optional surveys or polls. If you decide to participate, you may be asked to provide certain information, which may include Personal Information.
Elective Social Activities. Occasionally, Juul Labs may run elective social activities for the benefit of its Workers. Workers who elect to participate may be asked to provide Personal Information to administer the activity and award prizes or other types of recognition.

Information from Other Sources. We may collect or receive information about Applicants and Worker from other sources, including through third-party services and organizations to supplement information provided by you. For example, where relevant to the role in question and as permitted by law, we may conduct background and credit checks on Applicants prior to employment with Juul Labs.

Personal Information generated through Applicant and Worker Relationships. We may collect, generate, or compile information about you based on the nature and tenure of our relationship.

Performance-Related Data: For example, Worker performance reviews, evaluations and ratings, disciplinary allegations, disciplinary process and disciplinary warnings, details of grievances, and any outcome and similar data about Worker performance.
Compensation-Related Data: For example, basic salary, bonus and commission entitlements, insurance benefits (including partner, dependent and beneficiary details), date-of-birth and other information about you and your dependents required by our insurer or benefits vendor, tax code, accrued salary information, and information relating to any applicable retirement plan or pension program applicable any company loan, company credit cards, salary garnishments, capital-forming benefits, any units of stock or directorships held, details of all restricted stock units or any other entitlement to shares of any group company stock awarded, cancelled, exercised, vested, unvested or outstanding.
Intra-Group Communications. Juul Labs may offer, enable, or require Workers to utilize Juul Labs-provided intra-company accessible sites, video-enabled meetings, pages, messaging channels, apps, blogs, or group forums (“Intra-Company Communication Channels”). Juul Labs and other individuals who use the Intra-Company Communication Channels may collect Personal Information and other information you submit or make available when using or participating in the Company Communication Channels. Personal Information collected or generated about you when using Intra-Company Communication Channels may be considered “public” and may not be subject to the same privacy protections set forth herein.
Miscellaneous Information. We may receive or collect other miscellaneous Personal Information, (for example, information an Applicant chooses to disclose during the interview process, whether in oral or written form, and opinions generated by other Workers during the interview process.

Personal Information We Collect Automatically.

Worker Use of Juul Labs Information Technology Systems and Networks. Juul Labs may collect certain information automatically through the course of its Workers’ employment or services, such as Internet protocol (IP) address, inferred location based on IP address or activities, device identifiers associated with a computer or device (whether owned or authorized by us), mobile carrier and related information, activity logs, and other information about activities Workers may engage in on Juul Labs property, equipment, accounts, systems, and networks. Juul Labs may monitor and review Workers’ uses of Juul Labs equipment, accounts, information technology systems and networks, including its phone networks, computer networks, including those used to access the Internet, videoconferencing systems and other Intra-Company Communications Channels. Juul Labs may access and review Workers’ video-recordings, transcripts, electronic files, chat and other forms of real-time messages, and emails sent or stored on its information technology systems, including accounts, computers and devices provided to Workers, or on Workers’ devices on which Juul Labs systems or tools are enabled subject to Juul Labs’ internal IT terms and policies.
CCTV Footage. Where and as permitted by law, Juul Labs may monitor its premises using CCTV cameras.

NOTE: WORKERS SHOULD HAVE NO EXPECTATION OF PRIVACY WHILE ON JUUL LABS PREMISES OR USING JUUL LABS INFORMATION TECHNOLOGY SYSTEMS, DEVICES, NETWORKS, AND ELECTRONIC COMMUNICATION TOOLS REGARDLESS OF LOCATION. THIS PRIVACY NOTICE DOES NOT ESTABLISH THAT ALL WORKERS WILL HAVE ACCESS TO, OR WILL PARTICIPATE IN, THE SYSTEMS, NETWORKS, DATA, PROGRAMS, AND OTHER BUSINESS ACTIVITIES DESCRIBED IN THIS PRIVACY NOTICE.

HOW WE USE YOUR INFORMATION

We process Personal Information to the extent permitted or required under applicable law for a variety of business purposes including those listed below. We will not process your Personal Information for a purpose other than that for which it was collected unless we have provided further information about this to you before that processing takes place. Please see the Supplemental Notice for Workers and Applicants in the UK or EEA for a table of legal bases that explains how we process your Personal Information under the GDPR.

Applicants

To assess your suitability, aptitude, skills, qualifications, and interests for employment with or provision of services to Juul Labs;
To communicate with you about the application process and/or your application, and
To take steps at your request prior to entering a relationship with you (for example, after we have sent you an offer, to process certain Personal Information to enter and commence employment).

Workers

To assist you with a job-related relocation, or to obtain an immigration visa or work permit (where required and requested by you);
To manage workflow, including assigning, managing and administering projects;
To conduct job grading activities;
To administer Human Resources Operations and communicate with Workers and Applicants;
To administer payroll and award benefits;
To administer compensation-related activities, including calculating and analyzing salary, bonuses, long-term incentives, and equity/stock plans;
To monitor overtime, ensure Juul Labs’ compliance with labor laws, and operate Worker recognition programs;
To pursue our legitimate interests (for example security and fraud prevention activities such as prevention of fraud, misuse of IT systems, or money laundering, physical security, IT and network security, or internal investigations, Worker monitoring for safety or management, whistleblowing schemes, internal investigations, and research purposes);
To manage Worker performance and development;
To undertake organizational development and succession planning exercises;
To manage Worker attendance and absences;
To operate helpdesk and IT support services;
To run, enable or cooperate with internal and/or external or governmental compliance investigations;
To operate, enable or cooperate with internal or external audits;
To support diversity and inclusion initiatives;
To support the organization and Workers during corporate restructuring events (including acquisitions, divestitures, and integrations);
To protect Worker safety, including by administering emergency services;
To establish, exercise or defend our legal rights;
To comply with our legal obligations, including to support any claim or defense before any jurisdictional, and/or administrative authority, arbitration or mediation panel and to cooperate with, or to inform, law enforcement or relevant regulatory authorities to the extent required by law in or outside of your country;
To process Worker expenses and travel charges and operate reimbursement programs, and
To act on your behalf as you may otherwise offer, agree, or consent.

HOW WE DISCLOSE YOUR INFORMATION

We may disclose Personal Information as described in this Privacy Notice (e.g., with our third-party service providers; to comply with legal obligations; to protect and defend our rights and property) or with your permission.

Vendors and Service Providers. Juul Labs may disclose Personal Information we receive pursuant to this Privacy Notice with vendors and service providers. The types of service providers to whom we entrust Personal Information include, for example and without limitation, service providers that help us: (i) operate company programs to enable Workers to perform their job functions such as corporate travel services, expense reimbursement programs and administration of job-related stipends, if and as applicable; (ii) maintain our Human Resources Operations; (iii) provide IT and related services, and (iv) provide specialized external advice (e.g., outside law firms and auditors). A list of vendors and service providers that we may use to process your Personal Information if you are a Worker employed by Juul Labs in the UK, is available in Annex I or by contacting us dataprivacy@juul.com, at any time.

Other Group Companies. Juul Labs may share Personal Information with our corporate affiliates as permitted by applicable law, to pursue our legitimate interests in connection with the following purposes: to facilitate internal communication and task management to other group companies; group wide HR planning and administration (including staffing, succession planning, forecasting and budgeting, investment decisions, training and performance management, in connection with the group’s matrix structure etc.); and to be able to fulfil the employment relationship within our global structure (i.e., to facilitate global cooperation and worker transfers within the group). Certain group companies other than the group company that is your employer may function as a data controller for certain purposes (typically this would include any group company that makes its own decisions concerning some of the purposes above (e.g., worker transfers)).

Other Juul Labs Workers. If Workers elect to share Personal Information or other information through Intra-Company Communication Channels, other Workers may be able to see some or all this information. In addition, Worker name and photo may be available through the Intra-Company Communication Channels to facilitate collaboration and workplace communications.

Third Parties. We may and/or other group companies may transfer Personal Information to government agencies and regulators (e.g., tax authorities), social insurance carriers, courts, and government authorities, in accordance with applicable law where believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal processes, such as court orders, subpoenas, or regulatory investigations; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation or prosecution of suspected or actual illegal activity.

Merger, Sale, or Other Asset Transfers. If we participate in an actual or proposed merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another entity, we may transfer your information as part of such a transaction as permitted by law and/or contract.

INTERNATIONAL DATA TRANSFERS

In conducting our Human Resources Operations, we may transfer, process, and store all information collected via or by Juul Labs anywhere in the world, including, but not limited to, the United States. To the extent Personal Information is transferred from the United Kingdom (“UK”) or European Economic Area (“EEA“) to the United States or other jurisdictions that require valid safeguards to be in place, Juul Labs will adopt sufficient legal safeguards (whether by standard contractual clauses or certification), and we have completed the relevant risk and impact assessments for such a transfer. We take all commercially reasonable measures to safeguard Personal Information consistent with the requirements of applicable laws and will not transfer Sensitive Personal Information outside of your country unless permitted by applicable law. If you are a resident of the UK or EEA, you may request information or to see a copy of any data transfer agreement(s) to the extent Juul Labs has relied on them to transfer of your Personal Information by Contacting Us.

INDIVIDUAL RIGHTS IN PERSONAL DATA

To the extent permitted under applicable law, you may have the right to:

Obtain access to and portability of your Personal Information, including: (i) confirming whether and how we are processing your Personal Information; (ii) obtaining access to or a copy of your Personal Information; (iii) receiving an electronic copy of Personal Information that you have provided to us, or asking us to send that information to another company (the “right of data portability”);
Request correction of your Personal Information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your Personal Information, or we may refer you to the controller of your Personal Information who is able to make the correction;
Request deletion of your Personal Information, in cases where Juul Labs is not required to retain such Personal Information and subject to other legal requirements and exceptions prescribed by law; and
Request restriction of or object to our processing of your Personal Information, if and as applicable, and where such requests are permitted by law, including the right to (i) withdraw your consent to processing, (ii) object to, or restrict, processing of your sensitive Personal Information for certain purposes, or (iii) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

You also have the right to lodge a complaint with your data protection supervisory authority. If you reside in the UK, this is the Information Commissioner’s Office (“ICO”). If you are located in the EU, information about your national supervisory authority can be found here.

If you would like to exercise any of these rights, please contact us. We will process such requests in accordance with applicable laws. To protect your privacy, Juul Labs will take measures to verify your identity before fulfilling your request. You may authorize an agent to may make a verifiable consumer request on your behalf. To authorize an agent to exercise a privacy right on your behalf, you must provide us with written authorization signed both by you and your designated agent and contact us for additional instructions.

We will not discriminate or retaliate against anyone exercising their privacy rights.

DATA RETENTION

Juul Labs retains the Personal Information we receive as described in this Privacy Notice for as long as necessary to fulfill the purpose(s) for which it was collected, carry out our Human Resources Operations, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, comply with applicable laws, or based upon other criteria, including, but not limited to, the sensitivity and volume of such data. Additionally, we endeavor to retain all such Personal Information in accordance with legal requirements.

SECURITY OF YOUR INFORMATION

We take steps to safeguard your Personal Information in accordance with this Privacy Notice. Unfortunately, we cannot guarantee the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

THIRD-PARTY WEBSITES/APPLICATIONS

Various resources and sites at Juul Labs may contain links to third party websites/applications and other websites/applications may reference or link to Juul Labs that we do not control. We do not control these third-party services. We encourage Applicants and Workers to read the privacy policies of each website and application with which they interact. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or applications. Visiting these other websites or applications is at your own risk.

CHANGES TO OUR PRIVACY NOTICE AND PRACTICES

We may revise this Privacy Notice from time to time at our sole discretion. If there are any material changes to this Privacy Notice, we will notify you as required by applicable law. You understand and agree that by continuing your employment with or service engagement with us after the new Privacy Notice takes effect you will be deemed to have accepted the updated Privacy Notice.

CONTACT US

If you wish to exercise any of your privacy rights or have any questions about our privacy practices or this Privacy Notice, please contact us at dataprivacy@juul.com.

SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

The following describes the categories of Personal Information Juul Labs collects and the categories of third parties to which such information has been disclosed:

Category of Personal Information Collected: Identifiers

For example, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number or other similar identifiers.

Category of Third Parties:

Service providers
Juul Labs affiliates
Government entities such as federal, state, or local regulators

Category of Personal Information Collected: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))

For example, a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

Category of Third Parties:

Service providers
Juul Labs affiliates
Government entities such as federal, state, or local regulators

Category of Personal Information Collected: Sensitive Personal Information

For example, a social security, driver’s license, state identification card, or passport number, an account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, precise geolocation, racial or ethnic origin, citizen or immigration status, religious or philosophical beliefs, or union membership, contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication, or genetic information.

Category of Third Parties:

Service providers
Juul Labs affiliates
Government entities such as federal, state, or local regulators

Category of Personal Information Collected: Protected classification characteristics under California or federal law

For example, age (40 years or older), race, color, ancestry, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Category of Third Parties:

Service providers
Government entities such as federal, state, or local regulators

Category of Personal Information Collected: Sensory data

For example, audio, electronic, or visual information.

Category of Third Parties:

Service providers

Category of Personal Information Collected: Professional or employment-related information

For example, current or past job history or performance evaluations.

Category of Third Parties:

Service providers
Juul Labs affiliates

The categories of sources from which we collect Personal Information are described above in the section titled “Personal Information We Collect.”

Your Personal Information is not: (i) “sold” or (ii) “shared” (for purposes of targeted advertising) by us and we use the data we collect about you for the business purposes described above in the section titled “How We Use Your Information.” In addition, we may share any data we hold about you with the parties described above.

Data Retention. The Data Retention section above outlines the criteria we utilize for determining how long to retain data.

Sensitive Personal Information. We process sensitive Personal Information exclusively for the purposes outlined above, and only to the extent permitted under law. We do not use sensitive Personal Information to infer any characteristics about you.

SUPPLEMENTAL NOTICE FOR WORKERS AND APPLICANTS IN THE UK OR EEA

We rely on the following legal bases for the processing of your Personal Information. Where we process Sensitive Personal Information, we will only do so when we have both a legal basis for doing so and one of the additional conditions under the GDPR applies:

Purpose:

Compensation-Related