LEGAL

Privacy Notice for California Residents

Effective Date: September 1, 2026 · Last Updated: September 1, 2026

SkillStorm Commercial Services, LLC

This Privacy Notice for California Residents ("California Notice") describes how SkillStorm Commercial Services, LLC and its subsidiaries and affiliates (collectively, "SkillStorm," "Company," "we," or "us") collect and process personal information about consumers who reside in California. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), requires us to provide California consumers with a privacy policy that contains a comprehensive description of our online and offline practices regarding our collection, use, sale, sharing, and retention of their personal information, along with a description of the rights they have regarding their personal information. This California Notice supplements the information contained in our general Privacy Policy and provides the information the CCPA requires. Any terms defined in the CCPA have the same meaning when used in this California Notice.

This California Notice applies to California residents who visit our websites, contact us, receive our communications, express interest in or apply to our training programs or opportunities, or interact with us on behalf of a current or prospective client, partner, or vendor.

This California Notice does not apply to our collection and use of personal information in an employment capacity from individuals who have become SkillStorm employees, consultants, or contractors, or who have entered our formal hiring or program-admission process. Those individuals should see our California Employee and Applicant Privacy Notice (www.skillstorm.com/privacy-policy/applicants). Consumers residing outside California should see our general Privacy Policy.

Personal Information Collected

We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("personal information"). Personal information does not include:

Publicly available information, including from government records, through widely distributed media, or that the consumer made publicly available without restricting it to a specific audience.
Lawfully obtained, truthful information that is a matter of public concern.
Deidentified or aggregated consumer information.
Information excluded from the CCPA's scope, such as personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), which governs consumer reports such as background checks we may obtain with your authorization.

Personal Information Categories Chart

The chart below identifies the categories of personal information we have collected from consumers within the last 12 months and the expected retention period for each. As a general rule we retain personal information for 12 months from our last interaction with you, unless a longer or shorter period is required by law, after which it is deleted, destroyed, or deidentified.

Category	Examples	Collected	Retention Period
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, or other similar identifiers.	YES	12 months from our last interaction with you, unless a longer or shorter period is required by law
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, address, telephone number, education, employment, employment history, professional licenses and certifications. Some personal information included in this category may overlap with other categories.	YES	12 months from our last interaction with you, unless a longer or shorter period is required by law
C. Protected classification characteristics under California or federal law.	Citizenship, to the extent reflected in your answers to our application questions about work authorization, visa sponsorship, and eligibility to obtain a U.S. government security clearance. We ask these questions only to evaluate eligibility for positions and engagements that carry legal or client work-authorization or clearance requirements, and no answer automatically disqualifies an applicant.	YES (limited)	12 months from our last interaction with you, unless a longer or shorter period is required by law
D. Commercial information.	Records of personal property, products, or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO	N/A
E. Biometric information.	Fingerprints, faceprints, voiceprints, iris or retina scans, keystroke, gait, or other physical patterns.	NO	N/A
F. Internet or other similar network activity.	Activity on our websites, such as browsing history, pages viewed, system usage, electronic communications with us, and interactions with our emails and advertisements.	YES	12 months from our last interaction with you, unless a longer or shorter period is required by law
G. Geolocation data.	General location (such as city, state, or postal code) inferred from your IP address or provided by you. We do not collect precise geolocation.	YES (general only)	12 months from our last interaction with you, unless a longer or shorter period is required by law
H. Sensory data.	Audio recordings of telephone calls with our representatives or automated calling system, where you have been notified that the call is recorded.	YES (limited)	12 months from our last interaction with you, unless a longer or shorter period is required by law
I. Professional or employment-related information.	The position or program applied for and your responses to our application questions: work authorization and sponsorship, eligibility to obtain a security clearance, highest level of education, field of study, years of experience, a description of your technical skills and certifications, and willingness to relocate.	YES	12 months from our last interaction with you, unless a longer or shorter period is required by law
J. Non-public education information (FERPA).	Education records maintained by an educational institution or party acting on its behalf.	NO	N/A
K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, aptitudes, or abilities.	NO	N/A
L. Sensitive personal information.	Further identified in the chart below.	See below	See below

Sensitive Personal Information Categories Chart

Sensitive personal information is a subtype of personal information consisting of the specific information categories listed in the chart below. Importantly, the CCPA only treats this information as sensitive personal information when we collect or use it to infer characteristics about a consumer. The chart below identifies which sensitive personal information categories, if any, we have collected from consumers to infer characteristics about them in the last 12 months.

Sensitive Personal Information Category	Collected to Infer Characteristics?	Retention Period
L.1. Government identifiers, such as Social Security number, driver's license, state identification card, or passport number.	NO	N/A
L.2. Complete account access credentials.	NO	N/A
L.3. Precise geolocation.	NO	N/A
L.4. Racial or ethnic origin.	NO	N/A
L.5. Citizenship or immigration status. (We may collect work authorization status that you volunteer in connection with an inquiry or expression of interest, but we do not use it to infer characteristics about you; we use it only to determine eligibility for programs and opportunities with legal or client-imposed work authorization or clearance requirements.)	NO	12 months from our last interaction with you, unless a longer or shorter period is required by law
L.6. Religious or philosophical beliefs.	NO	N/A
L.7. Union membership.	NO	N/A
L.8. Mail, email, or text messages not directed to the Company.	NO	N/A
L.9. Genetic data.	NO	N/A
L.10. Neural data.	NO	N/A
L.11. Unique identifying biometric information.	NO	N/A
L.12. Health information.	NO	N/A
L.13. Sex life or sexual orientation information.	NO	N/A
L.14. Children's personal information (under age 16).	NO	N/A

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

Directly from you, such as from the forms and other information you provide to us, including through our "Get in Touch" and job application forms and in your communications with us.
Indirectly from you, such as from your interactions with our websites, emails, text messages, telephone calls, and social media pages.
From our service providers, such as data analytics providers, applicant tracking and customer relationship management platforms, and security and anti-fraud services.
From professional networking, job-board, and recruiting platforms (such as LinkedIn or Indeed) when you apply to or express interest in a SkillStorm opportunity through those platforms.
From our clients and business partners, such as when a client refers a candidate to us or identifies you as a point of contact for a client relationship.
From publicly available sources, such as professional profiles you have made public.

How We Use Personal Information

Personal Information Collection, Use, and Disclosure Purposes

We may use and disclose the personal information we collect to advance the Company's business and commercial purposes, specifically to:

Develop, offer, and provide our training programs and workforce and technology services, including evaluating your interest in and qualifications for SkillStorm training programs, employment opportunities, and client engagements, and communicating with you about them.
Respond to your inquiries and requests and provide candidate and client support.
Meet our obligations and enforce our rights arising from any contracts with you, including for billing or collections, or to comply with legal requirements.
Fulfil the purposes for which you provided your personal information or that were described to you at collection, and as the CCPA otherwise permits.
Improve our programs, services, marketing, and candidate and client relationships and experiences.
Notify you about changes to our programs or services.
Administer our systems and conduct internal operations, including for troubleshooting, data analysis, testing, research, statistical, and survey purposes.
Protect our Company, employees, program participants, clients, or operations.
Measure the effectiveness of our recruiting and marketing campaigns.
Manage your relationship with us, including reaching you, when needed, about your inquiry, application, or account.
Perform data analytics and benchmarking, for example, to understand program demand and candidate pipelines.
Administer and maintain the Company's systems and operations, including for safety and security purposes.
Engage in corporate transactions requiring review of consumer records, such as for evaluating potential Company mergers and acquisitions.
Comply with all applicable laws and regulations, including those applicable to government contractors.
Exercise or defend the legal rights of the Company and its employees, affiliates, clients, contractors, and agents.
Respond to law enforcement requests and as required by applicable law or court order.

Sensitive Personal Information Use and Disclosure Purposes

We may use or disclose sensitive personal information for the following statutorily approved reasons ("Permitted SPI Purposes"):

Performing actions that are necessary for our consumer relationship and that an average consumer in a relationship with us would reasonably expect.
Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
Defending against and prosecuting those responsible for malicious, deceptive, fraudulent, or illegal actions directed at the Company.
Ensuring physical safety.
Short-term, transient use, where we do not disclose the sensitive personal information to another third party or use it to build a profile about you or otherwise alter your experience outside your current interaction with the Company.
Services performed for the Company, including maintaining or servicing accounts, verifying consumer information, or providing analytic services, storage, or similar services for the Company.
Activities required to verify or maintain the quality or safety of, or to improve, upgrade, or enhance, a service that we own or control.
Collecting or processing sensitive personal information that we do not use for the purpose of inferring characteristics about a consumer.

We do not use or disclose sensitive personal information for purposes other than the Permitted SPI Purposes.

Additional Categories or Other Purposes

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. If required by law, we will also seek your consent before using your personal information for a new or unrelated purpose.

We may collect, process, and disclose aggregated or deidentified consumer information for any purpose, without restriction. When we collect, process, or disclose aggregated or deidentified consumer information, we will maintain and use it in deidentified form and will not attempt to reidentify the information, except to determine whether our deidentification processes satisfy any applicable legal requirements.

Disclosing, Selling, or Sharing Personal Information

Business Purpose Disclosures

We may disclose the personal information we collect to service providers and contractors for the business purposes described in the Personal Information Collection, Use, and Disclosure Purposes section and in the chart below, such as to support our business functions. For example, we may disclose your contact and professional information to the applicant tracking platform we use to manage candidate inquiries, or information from your visits to our website to an analytics provider to help us understand how the website is used.

We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, prohibit using the disclosed information for any purpose except performing the contract, and meet the CCPA's other contract requirements for engaging service providers or contractors.

The chart below identifies the categories of entities to whom we have disclosed our consumers' personal information for a business purpose over the preceding 12 months, along with the personal information categories disclosed and the disclosure's business purposes.

Category of Business Purpose Disclosure Recipients	Personal Information Categories Disclosed	Sensitive Personal Information Categories Disclosed	Business Purpose Disclosures
Website hosting, IT, cloud storage, and security providers	A. Identifiers; B. California Customer Records; F. Internet or network activity; G. Geolocation (general); I. Professional information	None	To host and secure our websites and systems and store our records.
Applicant tracking, customer relationship management, and email and text-messaging platform providers	A. Identifiers; B. California Customer Records; C. Protected Classes (limited); F. Internet or network activity; I. Professional information	None	To manage candidate and client inquiries, applications, and communications, and to deliver the emails and text messages you have agreed to receive.
Data analytics providers	A. Identifiers (online identifiers and IP address); F. Internet or network activity; G. Geolocation (general)	None	To understand how visitors use our websites and to measure the performance of our content and campaigns.
Background check, drug screening, and security clearance processing providers	A. Identifiers; B. California Customer Records; I. Professional information	None (disclosures to these providers occur only after you enter our formal hiring or program process, with your separate authorization, and are governed by our Employee and Applicant Privacy Notice)	To conduct screening required for the position or program you have been offered.
Professional advisors, including lawyers, auditors, and insurers	A. Identifiers; B. California Customer Records; I. Professional information	None	To obtain professional advice and services and to comply with legal obligations.

Disclosures at your direction. When you express interest in an engagement with one of our clients, we may disclose your professional information to that client and its designees to evaluate and facilitate the placement. Because these disclosures are made at your direction and as part of the service you have requested, they are not sales or sharing under the CCPA.

Selling or Sharing Personal Information

We do not sell your personal information, including sensitive personal information, to third parties and have not sold it in the preceding 12 months. We do not share your personal information with third parties for cross-context behavioral advertising purposes and have not shared your personal information in the preceding 12 months.

We do not knowingly collect, sell, or share personal information about consumers under 16 years of age.

Your Rights and Choices

If you are a California resident, the CCPA grants you the following rights regarding your personal information:

Right to Know and Data Portability Requests

You have the right to request that we disclose certain information to you about our collection and use of your personal information (the "right to know"), including the specific pieces of personal information we have collected about you (a "data portability request"). Our response will cover the 12-month period preceding the request, although we will honor requests to cover longer periods that do not extend past January 1, 2022, unless doing so would be impossible or involve disproportionate effort. You may exercise your right to know twice in any 12-month period. Once we receive your request and confirm your identity (see How to Exercise Your Rights), we will disclose to you:

The categories of personal information we collected about you and the categories of sources from which we collected it.
The business or commercial purpose for collecting your personal information.
The categories of persons, including third parties, to whom we disclosed your personal information for a business purpose, and the categories of your personal information disclosed to each category of persons.
When your right to know submission includes a data portability request, a copy of your personal information, subject to any permitted redactions.

Right to Delete and Right to Correct

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions and limitations (the "right to delete"). Once we receive your request and confirm your identity, we will delete your personal information from our systems unless an exception allows us to retain it. We will also notify our service providers and contractors to take appropriate action.

You also have the right to request correction of personal information we maintain about you that you believe is inaccurate (the "right to correct"). We may require you to provide documentation, if needed, to confirm your identity and support your claim that the information is inaccurate. Unless an exception applies, we will correct personal information that our review determines is inaccurate and notify our service providers and contractors to take appropriate action.

Right to Limit Sensitive Personal Information Use and Disclosure

You have a right to ask businesses that use or disclose your sensitive personal information to limit those actions to just the CCPA's Permitted SPI Purposes (the "right to limit"). As we do not use or disclose sensitive personal information beyond the CCPA's Permitted SPI Purposes, we do not currently provide this consumer right.

Personal Information Sales or Sharing Opt-Out and Opt-In Rights

You have the right to request that businesses stop selling or sharing your personal information at any time (the "right to opt-out"), including through a user-enabled opt-out preference signal. Similarly, the CCPA prohibits businesses from selling or sharing the personal information of consumers it actually knows are under 16 years old without first obtaining consent. As we do not sell or share consumers' personal information, we do not currently provide these consumer rights. If you use a browser or extension that sends an opt-out preference signal such as the Global Privacy Control, we will treat it as a valid request to opt out of any sale or sharing as required by law.

Automated Decision-Making Technology (ADMT) Rights

When a business uses automated decision-making technology (ADMT) to make significant decisions about you, including decisions about employment or independent contracting opportunities or education enrollment, you may have rights to obtain information about how the business uses ADMT and to opt out of or appeal the decision. We do not use ADMT to make significant decisions about consumers. Where automated tools assist our recruiting or program-admission process, a SkillStorm employee reviews the relevant information and makes every final decision. Accordingly, we do not provide ADMT access, opt-out, or appeal rights.

Right to Non-Discrimination

You have the right not to be discriminated or retaliated against for exercising any of your privacy rights under the CCPA.

How to Exercise Your Rights

Exercising the Rights to Know, Delete, or Correct

To exercise the right to know (including data portability), delete, or correct described above, please submit a verifiable request to us by either:

Calling us at 904-438-3440.
Emailing us at privacy@skillstorm.com.
Completing the request form at www.skillstorm.com/privacy-request.

Please describe your request with sufficient detail so we can properly understand, evaluate, and respond to it. You or your authorized agent may only submit a request to know, including for data portability, twice in a 12-month period.

Verification Process and Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct related to your personal information. To designate an authorized agent, provide the agent with signed written permission to act on your behalf, which we may ask the agent to produce, and we may also ask you to verify your identity directly with us or confirm that you provided the agent permission. We may request specific information from you or your authorized agent to confirm your or their identity before we can process your request, which will generally consist of matching two or three pieces of information you provide against information we maintain, depending on the sensitivity of the request.

We cannot respond to your request to know, delete, or correct if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in the request to verify the requestor's identity or authority to make the request. You do not need to create an account with us to submit a request.

Responding to Your Requests to Know, Delete, or Correct

We will confirm receipt of your request within ten business days. If you do not receive confirmation within the ten-day timeframe, please contact us at privacy@skillstorm.com.

We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response to the email address associated with your request, or by mail at your option. Our substantive response will tell you whether or not we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.

Any disclosures we provide will cover information for the 12-month period preceding the request's receipt date. We will consider requests to provide longer disclosure periods that do not extend past January 1, 2022, unless providing the longer timeframe would be impossible or involve disproportionate effort.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, such as a commonly used spreadsheet or document format.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

How We Protect Your Personal Information

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal information from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal information transmitted to, through, using, or in connection with our services. In particular, email, texts, and chats sent to or from us may not be secure, and you should carefully decide what information you send to us through these channels. Any transmission of personal information is at your own risk. The safety and security of your information also depends on you, and you are responsible for taking steps to protect your personal information against unauthorized use, disclosure, and access.

Changes to This California Notice

We reserve the right to update this California Notice at any time, and we review it at least once every 12 months. If we make any material changes, we will update the notice's effective date and post the updated notice on our website. We encourage you to check our website to review the current California Notice in effect.

Contact Information

If you have any questions or comments about this California Notice, the ways in which we collect and use your information described here, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at:

Phone: 904-438-3440 Website: www.skillstorm.com/privacy-request Email: privacy@skillstorm.com Postal Address: SkillStorm Commercial Services, LLC, Attn: Legal Department (Privacy), 10151 Deerwood Park Blvd., Building 100, Suite 425, Jacksonville, Florida 32256

If you need to access this California Notice in an alternative format due to a disability, please contact us at privacy@skillstorm.com or 904-438-3440.