Privacy Notice for California Workforce Members

Effective Date: January 1, 2020 | Last Updated: August 1, 2026

This Privacy Notice for California Workforce Members (the "Notice") applies to California residents who are job applicants, current or former employees, officers, directors, owners, independent contractors, or other members of Mobile Modular and its parent company McGrath RentCorp ("Mobile Modular," "we," "us," or "our") workforce, and to their emergency contacts and beneficiaries when Mobile Modular collects their personal information. This Notice is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA").

This Notice describes the categories of personal information we collect, the purposes for collection and use, the categories of sources and recipients, our retention practices, and the rights available to California residents. It supplements other Mobile Modular policies and notices and does not create or alter any employment contract or benefit plan.

1. Personal Information We Collect and Use

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular individual or household. "Sensitive personal information" is a defined subset of personal information. The table below describes the categories Mobile Modular has collected during the preceding 12 months and may continue to collect, depending on the individual's relationship with Mobile Modular and the requirements of the position or assignment.

CCPA Category	Examples of Information	Business Purposes
A. Identifiers	Name, alias, postal address, email address, telephone number, online identifier, IP address, username, employee or applicant ID, signature, Social Security number, driver’s license, state ID, passport, permanent resident or alien registration number, and other work-authorization documentation.	Recruiting; identity and work-authorization verification; payroll, benefits, tax and equity administration; communications; travel; access control; security; legal compliance.
B. California Customer Records information	Contact information, signature, Social Security number, physical characteristics or description, insurance information, education, employment history, bank account and direct-deposit information, and health-insurance information.	Employment administration; payroll and benefits; expense reimbursement; background screening; accommodations; leave administration; legal and reporting obligations.
C. Protected classifications	Age; and, where voluntarily provided or legally required, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, disability, sex, gender, gender identity or expression, pregnancy or related conditions, sexual orientation, veteran or military status, and other protected characteristics.	Benefits administration; equal employment opportunity, affirmative action and pay-data reporting; accommodations and leave; workforce analytics; legal compliance.
D. Commercial information	Records of company purchases, travel, expenses, corporate card use, and transactions involving company property or benefits.	Expense and travel administration; auditing; fraud prevention; asset management; business operations.
E. Biometric information	Where used, biometric identifiers or templates for timekeeping, identity verification, access control, or security. Mobile Modular will provide any additional notice or consent required by applicable law before collection.	Timekeeping; identity verification; physical or information-security access; fraud prevention.
F. Internet or network activity	Browsing and search history on Mobile Modular systems, interaction with websites or applications, device and system logs, email and network activity, and security-monitoring information.	Operate and secure IT systems; investigate incidents; enforce policies; maintain business continuity; legal compliance and e-discovery.
G. Geolocation data	Approximate or precise location or movements when generated through company devices, vehicles, applications, access systems, or travel and safety programs.	Safety, dispatch and fleet operations; time and attendance; asset protection; travel; security; legal compliance.
H. Sensory information	Audio, electronic, visual, thermal, or similar information, including photographs, badge images, video surveillance, recorded meetings or calls where permitted, and other workplace recordings.	Security and safety; training; communications; incident investigation; quality assurance; legal compliance.
I. Professional or employment information	Application materials, resumes, references, background-screening results, job history, compensation, attendance, training, performance, disciplinary records, workplace investigations, licenses, certifications, and separation information.	Recruiting; workforce and performance management; compensation; succession and training; investigations; legal compliance.
J. Education information	Education history, degrees, transcripts, certifications, and training records.	Recruiting; qualification verification; workforce development; legal or contractual requirements.
K. Inferences	Inferences drawn from workforce information, such as skills, preferences, aptitudes, performance trends, or suitability for a role, assignment, training, or development opportunity.	Workforce planning; recruiting; performance and talent management; training and development. Any legally regulated automated decisionmaking use will be addressed by a separate notice when required.
L. Sensitive personal information	Government identifiers; account credentials; precise geolocation; racial or ethnic origin, religious beliefs, union membership; contents of communications when Mobile Modular is not the intended recipient; genetic data; biometric information used for identification; and information concerning health, sex life, or sexual orientation, to the extent collected.	Payroll, benefits, tax and work authorization; account security; safety and fleet operations; accommodations and leave; equal employment and reporting obligations; investigations; legal claims; other permitted employment purposes.

Personal information does not include information excluded from the CCPA’s definition, including lawfully available government-record information, information made available to the general public as defined by law, or deidentified or aggregate information. Mobile Modular does not use or disclose sensitive personal information to infer characteristics about workforce members except as disclosed and permitted by law.

2. Categories of Sources

Mobile Modular may obtain personal information directly from you; from your references, emergency contacts, beneficiaries, dependents, or authorized representatives; from prior employers, educational institutions, recruiters, background-screening providers, benefits providers, payroll and financial institutions, insurers, medical or occupational-health providers, government agencies, customers, vendors, and professional advisers; from publicly available sources; and automatically through Mobile Modular devices, networks, systems, applications, facilities, vehicles, and security tools.

3. Disclosure of Personal Information

During the preceding 12 months, Mobile Modular may have disclosed the categories listed in Section 1 for business purposes to service providers and contractors that support recruiting, payroll, benefits, background screening, travel, expense management, training, IT, cybersecurity, data hosting, records management, insurance, workers’ compensation, occupational health, legal services, auditing, and other workforce or business operations. Mobile Modular may also disclose information to affiliated companies; government agencies and law enforcement; courts and litigants when legally required; benefit-plan administrators; customers or business partners when necessary for an assignment; and parties to a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

Mobile Modular does not sell workforce personal information and does not share workforce personal information for cross-context behavioral advertising. Mobile Modular also does not knowingly sell or share the personal information of individuals under 16. Because Mobile Modular does not use or disclose sensitive personal information for purposes that trigger the CCPA right to limit, Mobile Modular does not currently provide a "Limit the Use of My Sensitive Personal Information" link for workforce data. If these practices change, Mobile Modular will provide the notices and choices required by law.

4. Retention of Personal Information

Mobile Modular retains personal information only for as long as reasonably necessary and proportionate to the disclosed purposes, including to administer the employment or contractor relationship, satisfy legal, tax, accounting, reporting, safety, security, and recordkeeping obligations, resolve disputes, enforce agreements, and establish, exercise, or defend legal claims. Retention periods vary by record type and are governed by Mobile Modular’s records-retention schedule and any applicable legal hold.

Record Type	Retention Period or Criteria
Applicant and recruiting records	Generally retained for the legally required period after the hiring decision, and longer when needed for recurring applications, claims, audits, or legal holds.
Personnel, payroll, benefits, tax, equity, and leave records	Retained during the relationship and for the applicable statutory, tax, benefits, audit, and claims period after separation.
Security, access, network, location, audio, and video records	Retained for the operational or security period appropriate to the system, unless needed longer for an investigation, incident, claim, or legal hold.
Background checks and eligibility records	Retained for the period required or permitted by employment, immigration, transportation, safety, and other applicable laws.
Investigation, discipline, claims, and litigation records	Retained through final resolution and for the applicable limitation, appeal, enforcement, and legal-hold period.

5. California Privacy Rights

Subject to applicable exceptions, California residents may have the following rights regarding their personal information:

• The right to know the categories and specific pieces of personal information Mobile Modular has collected, the categories of sources, the business or commercial purposes, and the categories of third parties to whom information was disclosed, sold, or shared.
• The right to delete personal information Mobile Modular collected from you, subject to statutory exceptions, including when retention is necessary to administer the employment relationship, comply with law, or establish or defend legal claims.
• The right to correct inaccurate personal information maintained by Mobile Modular.
• The right to receive responsive personal information in a portable and, where technically feasible, readily usable format.
• The right to opt out of sale or sharing. Mobile Modular does not sell or share workforce personal information as those terms are defined by the CCPA.
• The right to limit certain uses and disclosures of sensitive personal information. Mobile Modular does not currently engage in uses or disclosures of workforce sensitive personal information that trigger this right.
• The right not to receive discriminatory treatment or retaliation for exercising CCPA rights.

These rights do not apply to information outside the scope of the CCPA or where an exception applies. Mobile Modular may deny or limit a request and will explain the basis for doing so when required by law.

6. How to Submit a Request

You or your authorized agent may submit a request to know, access, delete, or correct personal information through either of the following methods:

• Email: tara.wescott@mgrc.com

Current employees may also contact Human Resources through Mobile Modular’s internal HR channel. Please describe the request and provide sufficient information for Mobile Modular to identify the relevant records. Mobile Modular will acknowledge and respond within the time required by law.

Verification. Mobile Modular will verify requests by matching information provided with information maintained in its records and may request additional information when reasonably necessary. Mobile Modular will use verification information only for identity verification, fraud prevention, and security. A request for specific pieces of personal information may require a signed declaration under penalty of perjury. Mobile Modular will not require you to create an account solely to submit a request.

Authorized Agents. An authorized agent may submit a request on your behalf. Mobile Modular may require proof that the agent has permission to act for you and may separately verify your identity or confirm the authorization, unless the agent presents a valid power of attorney under California law.

7. Automated Decisionmaking Technology

If Mobile Modular uses automated decisionmaking technology subject to the CCPA to make a significant decision concerning hiring, compensation, promotion, demotion, termination, work allocation, or another covered employment decision, Mobile Modular will provide a separate pre-use notice and any applicable opt-out, appeal, and access rights by the legally required compliance date. This Notice does not itself state that Mobile Modular uses such technology for a covered significant decision.

8. Security

Mobile Modular uses reasonable administrative, technical, and physical safeguards designed to protect personal information. No security measure is perfect, and workforce members must comply with Mobile Modular information-security, acceptable-use, records-management, and incident-reporting requirements.

9. Changes to this Notice

Mobile Modular may update this Notice from time to time. When changes are material, Mobile Modular will provide an updated notice through appropriate channels, such as email, the applicant portal, the employee intranet, or paper notice. Mobile Modular will not collect additional categories of personal information or use personal information for materially different purposes without providing any notice required by law.

10. Contact Information

Questions about this Notice or Mobile Modular’s privacy practices may be directed to Human Resources at tara.wescott@mgrc.com. Complaints may also be submitted through the same channel. Nothing in this Notice limits any right to contact the California Privacy Protection Agency, the California Attorney General, or another governmental authority.