CA Privacy Notice
Notice at Collection & Privacy Policy
For Employees and Job Applicants
Last updated: January 1, 2025
Pursuant to Section 1798.100(a) and Section 1798.145(m)(3) – (4) of the California Civil Code, if you are a California resident and one of the following: a job applicant, or current or former employee, owner, director, officer, medical staff member or contractor at any of the Reynolds American Inc. group of companies or of certain of their respective U.S. affiliates to which RAI Services Company provides HR services (collectively, “we”, “our” or “us”), then you have a right to know certain information about the data collected by or on behalf of us and your rights regarding those data practices.
For any questions or comments about this Notice, please contact Employee Relations at 877.723.2241 or email wppgeneral@RJRT.com using the subject line “CCPA/CPRA Rights”.
We reserve the right to change this Notice without prior notice to you. We will update this page when we do so; updates to this Notice shall be effective upon posting unless otherwise communicated to you. You should check this site regularly to see recent changes.
Categories of Information Collected and Purposes for Which Such Information Will Be Used
We collect the information listed in the tables below from the following sources of information: directly from you, from other employees, using technologies on the website, or from third parties (such as background check vendors, third-party job application sites, timekeeping software, information received from former employers or other references, benefit providers, and educational institutions).
“Sold” in this Notice means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.
“Shared” in this Notice means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
| Category of personal information | Business or commercial purpose for which it was collected or disclosed | “Shared” or “Sold” |
| Identifiers (such as name, date of birth, driver’s license number, Social Security number, telephone number, mailing address, email address, internet protocol address, and/or unique number assigned to identify the device used to access the website) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, to communicate with you, to manage you and our workforce (including recruitment, appraisals, performance management, managing sick leave and providing employment references). | No |
| Categories of personal information outlined in Section 1798.80(e) (such as name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, and/or health insurance information) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, to communicate with you, to manage you and our workforce (including recruitment, appraisals, performance management, managing sick leave and providing employment references). | No |
| Characteristics of protected classifications under California or federal law (such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and/or genetic information (including familial genetic information)) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, to manage you and our workforce. | No |
| Internet or other electronic network activity (such as browsing history, browser type and version, search history, and other information regarding a consumer’s interaction with an internet website, including screen resolution, monitor color depth, operating system, JavaScript version, connection speed, device type used to access the brand website (i.e., computer or mobile device), application version, click path taken through the brand website, and other publicly available information) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services on behalf of the business including providing advertising or marketing services and providing analytic services; auditing related to a current interaction with the consumer and concurrent transactions; to manage you and our workforce, and auditing compliance with this specification and other standards | No |
| Commercial information, including product reviews, quality surveys, products or services purchases, obtained, or considered | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services and providing analytic services, undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business | No |
| Geolocation data | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services and providing analytic services | No |
| Sensory data (such as audio, electronic, visual, thermal, olfactory or similar information) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity | No |
| Professional or employment-related information (such as education history and employment information including your employment history, language skills and professional qualifications, other information included on your resume or CV) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, and to manage you and our workforce. | No |
Categories of Sensitive Personal Information Collected; Use Purpose
| Category of sensitive personal information | Business or commercial purpose for which it was collected | “Shared” or “Sold” |
| Social security, driver’s license, state identification card, or passport number | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, to manage you and our workforce (including recruitment, appraisals, performance management, managing sick leave, verifying authorization to work, and providing employment references). | No |
| An individual’s racial or ethnic origin, religious or philosophical beliefs or union membership | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, to manage you and our workforce (including workplace investigations and determining accommodations), to perform the services or provide the goods reasonably expected by an average individual who requests those goods or services (including benefits services); to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information; to resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions; to ensure the physical safety of natural persons; to perform services on behalf of the business; to verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by the business; to collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about an individual. | No |
| Personal information collected and analyzed concerning an individual’s health | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, to manage you and our workforce (including workplace investigations, determining accommodations, providing health and wellness benefits, and managing leaves of absence). | No |
| Personal information collected and analyzed concerning an individual’s sex life or sexual orientation | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, to manage you and our workforce (including workplace investigations and determining accommodation). | No |
How Will We Share Your Information?
- Our Affiliates and Service Providers. We may share and disclose information among our businesses, including employees, agents and affiliates of our businesses, for the purposes listed in this Privacy Policy. In addition, we may share your information with non-affiliated businesses that perform services for us. For example, among other things, to correct technical problems and malfunctions on our websites, processing payroll and employee benefit plan and program administration including enrollment and claims handling. When we contract with such service providers to help us conduct our business, we do not permit them to use or store your personal information for any purpose other than the work they are doing on our behalf or as required by law.
- Other Third-Parties. We may also share your information with non-affiliated third-parties, including, for example: (1) if we believe that there has been a violation of our policies regarding our websites; (2) if we believe that someone may be causing injury to our rights or property, or those of anyone else; (3) to respond to judicial process or to provide information to law enforcement or other governmental agencies; (4) otherwise as required by law; or (5) in the event of a liquidation, reorganization, merger, consolidation, change of control, asset or stock acquisition/disposition or other corporate combination.
How Long Will We Keep Your Information?
We will retain your personal information for as long as is necessary for purposes for which it was collected. The precise period will depend on the reason why it was collected. Those periods are also based on the requirements of applicable data protection laws, applicable legal and regulatory requirements, and periods relating to the commencement of legal actions.
Your CCPA/CPRA Rights
Beginning January 1, 2023, if you are a California resident, then you also have certain rights, pursuant to the California Consumer Rights Act of 2018, as amended by the California Privacy Rights Act (“CCPA/CPRA”). These CCPA/CPRA rights may only apply in certain circumstances and are subject to certain exemptions. Please see the table below for a summary of your rights. You can exercise these rights using the contact details below.
If you would like to submit a verifiable request, you can do so using any of the following designated request methods: by calling Employee Relations at 877.723.2241 or email wppgeneral@RJRT.com using the subject line “CCPA/CPRA Rights”. You can also make updates to your data by logging into your account.
We may ask for certain information to verify a request in accordance with applicable law.
We did not disclose or sell any personal information to third parties for their business or commercial purposes during the last 12 months. We do not knowingly collect any personal information from anyone under 16 years of age. We did not disclose or sell any deidentified patient information derived from patient information.
If you would like to print a copy of this Privacy Policy, please select the “Print” button in your web browser.
| Right to Know | As a California resident, you have the right to request that we disclose what categories of personal information we collect, use, disclose and/or sell; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom we disclose personal information; and specific pieces of personal information we have collected about you. To enable us to fulfill that request, we will need to verify your identity. We may ask for certain information to verify the request in accordance with applicable law. If we use a service provider for such verification, then that service provider will not retain such information provided for verification purposes. |
| Right to Request Deletion | As a California resident, you have the right to request the deletion of your personal information collected or maintained by us. To enable us to fulfill that request, we will need to verify your identity. We may ask for certain information to verify the request in accordance with applicable law. If we use a service provider for such verification, then that service provider will not retain such information provided for verification purposes. |
| Right to Correct | As a California resident, you have the right to request that we correct your inaccurate personal information collected or maintained by us. To enable us to fulfill that request, we will need to verify your identity. We may ask for certain information to verify the request in accordance with applicable law. If we use a service provider for such verification, then that service provider will not retain such information provided for verification purposes. |
| Right to No Retaliation | As a California resident, you have a right not to receive discriminatory treatment by us for the exercise of any of your rights. |
| Authorized Agent | As a California resident, you can exercise your rights, or you can designate an authorized agent to make a request on your behalf. We may require that you provide the authorized agent written permission to submit a request on your behalf and that the authorized agent verifies their own identity directly with us. |
| Contact Us for More Information | If you have questions about this Privacy Policy, then please contact us by phone by calling Employee Relations at 877.723.2241 or by email to wppgeneral@RJRT.com, with a Subject Line of “CCPA/CPRA Rights”. |
For Employees and Job Applicants
Last updated: January 1, 2025
Pursuant to Section 1798.100(a) and Section 1798.145(m)(3) – (4) of the California Civil Code, if you are a California resident and one of the following: a job applicant, or current or former employee, owner, director, officer, medical staff member or contractor at any of the Reynolds American Inc. group of companies or of certain of their respective U.S. affiliates to which RAI Services Company provides HR services (collectively, “we”, “our” or “us”), then you have a right to know certain information about the data collected by or on behalf of us and your rights regarding those data practices.
For any questions or comments about this Notice, please contact Employee Relations at 877.723.2241 or email wppgeneral@RJRT.com using the subject line “CCPA/CPRA Rights”.
We reserve the right to change this Notice without prior notice to you. We will update this page when we do so; updates to this Notice shall be effective upon posting unless otherwise communicated to you. You should check this site regularly to see recent changes.
Categories of Information Collected and Purposes for Which Such Information Will Be Used
We collect the information listed in the tables below from the following sources of information: directly from you, from other employees, using technologies on the website, or from third parties (such as background check vendors, third-party job application sites, timekeeping software, information received from former employers or other references, benefit providers, and educational institutions).
“Sold” in this Notice means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.
“Shared” in this Notice means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
| Category of personal information | Business or commercial purpose for which it was collected or disclosed | “Shared” or “Sold” |
| Identifiers (such as name, date of birth, driver’s license number, Social Security number, telephone number, mailing address, email address, internet protocol address, and/or unique number assigned to identify the device used to access the website) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, to communicate with you, to manage you and our workforce (including recruitment, appraisals, performance management, managing sick leave and providing employment references). | No |
| Categories of personal information outlined in Section 1798.80(e) (such as name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, and/or health insurance information) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, to communicate with you, to manage you and our workforce (including recruitment, appraisals, performance management, managing sick leave and providing employment references). | No |
| Characteristics of protected classifications under California or federal law (such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and/or genetic information (including familial genetic information)) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, to manage you and our workforce. | No |
| Internet or other electronic network activity (such as browsing history, browser type and version, search history, and other information regarding a consumer’s interaction with an internet website, including screen resolution, monitor color depth, operating system, JavaScript version, connection speed, device type used to access the brand website (i.e., computer or mobile device), application version, click path taken through the brand website, and other publicly available information) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services on behalf of the business including providing advertising or marketing services and providing analytic services; auditing related to a current interaction with the consumer and concurrent transactions; to manage you and our workforce, and auditing compliance with this specification and other standards | No |
| Commercial information, including product reviews, quality surveys, products or services purchases, obtained, or considered | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services and providing analytic services, undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business | No |
| Geolocation data | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services and providing analytic services | No |
| Sensory data (such as audio, electronic, visual, thermal, olfactory or similar information) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity | No |
| Professional or employment-related information (such as education history and employment information including your employment history, language skills and professional qualifications, other information included on your resume or CV) | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, and to manage you and our workforce. | No |
Categories of Sensitive Personal Information Collected; Use Purpose
| Category of sensitive personal information | Business or commercial purpose for which it was collected | “Shared” or “Sold” |
| Social security, driver’s license, state identification card, or passport number | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, performing services including maintaining or servicing accounts, verifying information, providing analytic services, detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, prosecuting those responsible for that activity, to manage you and our workforce (including recruitment, appraisals, performance management, managing sick leave, verifying authorization to work, and providing employment references). | No |
| An individual’s racial or ethnic origin, religious or philosophical beliefs or union membership | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, to manage you and our workforce (including workplace investigations and determining accommodations), to perform the services or provide the goods reasonably expected by an average individual who requests those goods or services (including benefits services); to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information; to resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions; to ensure the physical safety of natural persons; to perform services on behalf of the business; to verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by the business; to collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about an individual. | No |
| Personal information collected and analyzed concerning an individual’s health | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, to manage you and our workforce (including workplace investigations, determining accommodations, providing health and wellness benefits, and managing leaves of absence). | No |
| Personal information collected and analyzed concerning an individual’s sex life or sexual orientation | For our operational purposes reasonably required for day-to-day operations, such as accounting, financial reporting and business planning, to manage you and our workforce (including workplace investigations and determining accommodation). | No |
How Will We Share Your Information?
- Our Affiliates and Service Providers. We may share and disclose information among our businesses, including employees, agents and affiliates of our businesses, for the purposes listed in this Privacy Policy. In addition, we may share your information with non-affiliated businesses that perform services for us. For example, among other things, to correct technical problems and malfunctions on our websites, processing payroll and employee benefit plan and program administration including enrollment and claims handling. When we contract with such service providers to help us conduct our business, we do not permit them to use or store your personal information for any purpose other than the work they are doing on our behalf or as required by law.
- Other Third-Parties. We may also share your information with non-affiliated third-parties, including, for example: (1) if we believe that there has been a violation of our policies regarding our websites; (2) if we believe that someone may be causing injury to our rights or property, or those of anyone else; (3) to respond to judicial process or to provide information to law enforcement or other governmental agencies; (4) otherwise as required by law; or (5) in the event of a liquidation, reorganization, merger, consolidation, change of control, asset or stock acquisition/disposition or other corporate combination.
How Long Will We Keep Your Information?
We will retain your personal information for as long as is necessary for purposes for which it was collected. The precise period will depend on the reason why it was collected. Those periods are also based on the requirements of applicable data protection laws, applicable legal and regulatory requirements, and periods relating to the commencement of legal actions.
Your CCPA/CPRA Rights
Beginning January 1, 2023, if you are a California resident, then you also have certain rights, pursuant to the California Consumer Rights Act of 2018, as amended by the California Privacy Rights Act (“CCPA/CPRA”). These CCPA/CPRA rights may only apply in certain circumstances and are subject to certain exemptions. Please see the table below for a summary of your rights. You can exercise these rights using the contact details below.
If you would like to submit a verifiable request, you can do so using any of the following designated request methods: by calling Employee Relations at 877.723.2241 or email wppgeneral@RJRT.com using the subject line “CCPA/CPRA Rights”. You can also make updates to your data by logging into your account.
We may ask for certain information to verify a request in accordance with applicable law.
We did not disclose or sell any personal information to third parties for their business or commercial purposes during the last 12 months. We do not knowingly collect any personal information from anyone under 16 years of age. We did not disclose or sell any deidentified patient information derived from patient information.
If you would like to print a copy of this Privacy Policy, please select the “Print” button in your web browser.
| Right to Know | As a California resident, you have the right to request that we disclose what categories of personal information we collect, use, disclose and/or sell; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom we disclose personal information; and specific pieces of personal information we have collected about you. To enable us to fulfill that request, we will need to verify your identity. We may ask for certain information to verify the request in accordance with applicable law. If we use a service provider for such verification, then that service provider will not retain such information provided for verification purposes. |
| Right to Request Deletion | As a California resident, you have the right to request the deletion of your personal information collected or maintained by us. To enable us to fulfill that request, we will need to verify your identity. We may ask for certain information to verify the request in accordance with applicable law. If we use a service provider for such verification, then that service provider will not retain such information provided for verification purposes. |
| Right to Correct | As a California resident, you have the right to request that we correct your inaccurate personal information collected or maintained by us. To enable us to fulfill that request, we will need to verify your identity. We may ask for certain information to verify the request in accordance with applicable law. If we use a service provider for such verification, then that service provider will not retain such information provided for verification purposes. |
| Right to No Retaliation | As a California resident, you have a right not to receive discriminatory treatment by us for the exercise of any of your rights. |
| Authorized Agent | As a California resident, you can exercise your rights, or you can designate an authorized agent to make a request on your behalf. We may require that you provide the authorized agent written permission to submit a request on your behalf and that the authorized agent verifies their own identity directly with us. |
| Contact Us for More Information | If you have questions about this Privacy Policy, then please contact us by phone by calling Employee Relations at 877.723.2241 or by email to wppgeneral@RJRT.com, with a Subject Line of “CCPA/CPRA Rights”. |