THE QUIKRETE^® COMPANIES EMPLOYEE PRIVACY NOTICE – CALIFORNIA

The Quikrete^® Companies (hereinafter "Quikrete") provide this Privacy Notice, which applies to California resident employees, employee applicants, directors, officers, and contractors of Quikrete, as well as those individuals' emergency contacts and beneficiaries who are California residents. This Privacy Notice has been adopted to comply with the California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA") effective January 1, 2023, and any implementing regulations (collectively referred to as "California Privacy Laws"). Terms used, but not defined, herein shall have the meanings given to such terms in the California Privacy Laws.

Collection of Personal Information
Pursuant to the California Privacy Laws, Personal Information is "information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household." Quikrete collects the following categories of personal information from California resident employees and employee applicants for our operational business and employment purposes:

• Identifiers, such as real name, alias, postal address, unique personal identifier, email address, or other similar identifiers.
• Personal information categories as listed in the California Customer Records Statute (Cal. Civ. Code 1798.80(e)), such as name, signature, Social Security number, photograph, address, telephone number, driver's license or state identification card number, education, employment history, bank account number, or any other financial information or medical information.
• Protected classification characteristics, such as race, color, national origin, religion, sex (including pregnancy, childbirth, breastfeeding, and related medical conditions), disability, age, citizenship status, genetic information, ancestry, marital status, sexual orientation, medical condition, military or veteran status, immigration status, and requests for leave.
• Professional or employment-related information, such as employment application information (work history, academic and professional qualifications, educational records, references, background check, drug testing results, work authorization, performance and disciplinary records, salaries, bonuses/commissions, hours, overtime, bank details (for payroll purposes), benefits in which employees may be enrolled, leave of absence information, health data, and identifying information for dependents and beneficiaries.
• Commercial information for employees, such as business travel and expense records.
• Internet activity information for employees, including all activity on Quikrete's information systems and communication systems.
• Sensory or surveillance data, such as Covid-19 related temperature checks, voicemails, recordings of meetings or videoconferences, and footage from video surveillance cameras.
• Biometric information, such as, for example, a fingerprint for a biometric timeclock.
• Geolocation data, such as, for example, global positioning system ("GPS") tracking in Quikrete vehicles.
• Health information, including accident reports, workers' compensation files, and medical records.

Quikrete also collects sensitive personal information. However, the California Privacy Laws do not treat this information as sensitive because we do not collect or use it to infer characteristics about a person.

Personal information may be used for the following purposes:

• To recruit and process employment application, including verifying eligibility for employment and conducting background and related checks;
• To conduct employee onboarding;
• To maintain and administer payroll and employee benefit plans, including enrollment and claims handling;
• To design employee benefit plans and programs;
• To maintain personnel records and comply with record retention requirements;
• To provide employees with human resources management services and employee data maintenance and support services;
• To communicate with employees and their emergency contacts and plan beneficiaries;
• To comply with applicable state and federal labor, employment, tax benefits, workers' compensation, disability, equal employment opportunity, workplace safety, and related laws;
• To prevent unauthorized access to or use of Quikrete property;
• To ensure employee productivity and adherence to Quikrete policies;
• To conduct internal audits and investigate complaints, grievances, and suspected violations of Quikrete policy;
• To exercise or defend the legal rights of Quikrete, its employees, affiliates, customers, contractors, or agents;
• To perform workforce analytics, data analytics, and benchmarking;
• To evaluate and provide useful feedback about job performance, facilitate better working relationships, and for employee professional development;
• To evaluate an individual's appropriateness for hire, promotion, or transfer to a new position at Quikrete;
• To respond to law enforcement requests and as required by applicable law or court order;
• To facilitate the efficient and secure use of Quikrete information systems;
• To ensure compliance with Quikrete information systems policies and procedures;
• To prevent unauthorized access to, use or disclosure or removal of Quikrete's property, records, data, and information;
• To enhance employee productivity;
• To improve the safety of employees, customers, and the public regarding use of Quikrete property and equipment;
• To prevent unauthorized access, use, or loss of Quikrete property;
• To improve efficiency, logistics, and supply chain management;
• To improve customer service;
• To comply with applicable laws, court orders, or governmental regulations.

Please note that while Quikrete collects some personal information, Quikrete does not share, sell, rent, or lease personal information to non-affiliated third parties unless otherwise stated at the time of collection.

Retention Policy
Quikrete will retain personal information for a commercially reasonable time for the purposes listed in this Privacy Policy and for archival and audit purposes.

Your Rights under the California Privacy Laws
The California Privacy Laws provides California consumers with privacy rights related to disclosure of personal information.

Disclosure of Information
You have the right to request that Quikrete disclose the collection and use of your personal information over the last 12 months. Once Quikrete receives a verifiable consumer request, it will promptly take steps to disclose and deliver, free of charge to the consumer, the personal information required by the California Privacy Laws. Specifically, Quikrete will address the following:

• The personal information gathered about the consumer
• The categories of personal information and specific pieces of personal information gathered about the consumer
• The business or commercial purpose for collecting that personal information
• The categories of third parties with whom we share this information
• If we disclosed your personal information for a business purpose, the personal information that each recipient obtained

Deletion of Personal Information
You have the right to request that Quikrete delete any personal information collected from you, subject to exceptions listed in the California Privacy Laws. Once Quikrete receives a verifiable consumer request to delete personal information, it will promptly take steps to delete such personal information and direct any service providers to delete the consumer's personal information from its records. Quikrete may deny your deletion requests pursuant to the California Privacy Laws if retaining the information is necessary to operate our business, administer our employees, protect our legal obligations and rights, or provide security for our employees or systems.

Right to Correct Personal Information
You have the right to request that Quikrete correct inaccurate Personal Information that we maintain about you. Quikrete reserves the right to delete this Personal Information in lieu of correcting it.

Right to Limit
In limited circumstances, you have the right to limit the use and disclosure of Sensitive Personal Information. Our use of your Sensitive Personal Information is solely for business purposes, and not for those purposes for which someone may exercise right to limit the use or disclosure under the California Privacy Laws. Therefore, we include this disclosure for informational purposes only.

Exercising Your Rights Under the California Privacy Laws
To exercise your rights as detailed above and in the California Privacy Laws, please submit a verifiable consumer request to us by either:

• Calling us at 1(800) 282-5828
• Visiting https://www.Quikrete.com/contactus/main.asp

Your verifiable consumer request must include sufficient information for Quikrete to verify that you are the person whose personal information was collected. We will only use the personal information provided in a verifiable consumer request to verify the requestor's identity and authority to make the request.

Verification Procedures
We are required by the California Privacy Laws to verify the identity of individuals who submit a request to know, request to delete, or request to correct. In compliance with the California Privacy Laws, we will take steps to verify your identity before granting you access to such Personal Information or acting on your request to exercise your rights. If we cannot verify your identity based on the information already maintained, we may request limited additional information from you, solely for the purpose of verifying your identity and for security or fraud-prevention purposes. Except as required by law, we will delete any new personal information collected for the purposes of verification as soon as practical after processing the request.

Authorized Agents
You may designate an authorized agent to make requests on your behalf by sending Quikrete written authorization in writing at Privacy Policy Manager, Attn: Legal Department, 5 Concourse Parkway, Suite 1900, Atlanta, GA 30328. If you use an authorized agent to submit a request to know or a request to delete, we may require you to: (1) provide the authorized agent with written permission to do so; and (2) verify your identity directly with us. However, we will not require these actions if you have provided the authorized agent with power of attorney pursuant to the California Probate Code. We may deny a request from the agent that does not submit proof that they have been authorized by the consumer to act on their behalf.

Nondiscrimination
Quikrete will not discriminate against anyone for exercising any California Privacy Laws rights.

Changes to the Privacy Notice
Quikrete may modify this Privacy Notice from time to time without prior notice. The most current version of this Privacy Notice will govern Quikrete's processing of personal information and data. A current version of this Privacy Notice can be found at: https://www.Quikrete.com/contactus/privacy.asp.

Last updated March 1, 2023