iHerb: Employee Privacy Notice

Effective Date: January 1, 2023

For the purposes of this notice:

• ”employee” refers to all employees, directors, officers and Board members of iHerb.  It also refers to consultants, independent contractors, contingent workers, and interns engaged by iHerb, even though they are not otherwise employees.

• “job applicant” refers to individuals who have submitted information to iHerb (e.g. resume or job application) in order to apply to be an iHerb employee.

This notice is not intended and shall not be read to create any express or implied promise or contract for employment, for any benefit, or for specific treatment in specific situations. Nothing in this Privacy Notice should be construed to interfere with iHerb’s ability to process employee data for purposes of complying with our legal obligations or investigating alleged misconduct or violations of company policy or law, subject to compliance with local law. To the extent that this Privacy Notice conflicts with local law, local law controls.

Also, this Privacy Notice does not cover your use of iHerb Services as a consumer. To learn more about privacy for iHerb consumers, please read our iHerb Privacy Policy.

Information We Obtain

• Identification information, such as name, gender, photograph, date of birth, employee identification number);
• Contact information, such as email and postal address, phone number for you and your reference, beneficiary, dependent, and emergency contact details);
• Employment information, such as job title/position, office location, hire dates, employment contracts, performance and disciplinary records, grievance procedures, sickness/holiday records, wage and benefit information, compensation history, performance information, insurance enrollment information;
• Educational and professional background, such as your resume or CV, prior employment details, performance-related information (e.g., evaluations and training), talent management information (e.g., education details, certifications, professional associations, skills, and awards and other achievements), historical compensation details, and references;
• National identifiers, such as national ID/passport, immigration status and documentation, visas, social security numbers (US only), national insurance numbers;
• Spouse, beneficiary and dependents information, marital status;
• Financial information, such as banking details, tax information, payroll information, withholding, salary, benefits, expenses, company allowances, stock and equity grants;
• IT information, including information required to provide access to iHerb’s IT systems and networks such as IP addresses, log files, login information, software/hardware inventories;
• Health information, such as information about short- or long-term disabilities or illnesses that you might share with your HRBP or manager, particularly in relation to any leave of absence you may need to take;
• Biometric information, such as fingerprints, facial recognition information, voice collected (if any) through time and attendance equipment or security systems, such as security badge scans, and any on-premise video monitoring of iHerb-sensitive facilities and locations for which further notice is provided;
• Pre-employment screening and background check information, including criminal records data (for vetting purposes, where permissible and in accordance with applicable law); and
• Any other information you choose to share with us (e.g., cover letter, photograph, articles, hobbies, social preferences, future career interests, comments, etc.).

We may obtain this information directly from you, when you apply for a job with iHerb on our careers site and/or when you are hired and throughout your employment with iHerb. We also may obtain the above information from third parties, such as recruiters who submit it to us on your behalf, from your social media profile on LinkedIn or other similar services, or when we perform background checks that are necessary for the role to be performed by the employee.  In most circumstances, we will get your permission before we collect personal information about you from a third party.

The information we request as part of the job application process is necessary to enter into a possible employment contract. Failure to provide this information may prevent us from evaluating or otherwise processing your application.

We may also collect certain demographic data that qualifies as sensitive personal information, such as race, ethnicity, sexual orientation, veteran status, and disability to help us understand the diversity of our workforce.  This information, when collected, is generally done so on a voluntary consensual basis, and employee and job applicants are not required to provide this information, unless it is necessary for us to collect such information to comply with our legal obligations.  If you are a U.S. resident, we also may ask for certain demographic information, such as your gender, ethnic background, veteran status and disability status. Providing this information is optional and is not required to apply for a job with iHerb. This personal information will not be considered in evaluating applicants’ qualifications for employment with iHerb.

If you are an employee, we process personal information about you (and your dependents, beneficiaries and other individuals associated with your employment) primarily for managing our employment relationship with you and managing your interactions with workplace facilities/information systems.

If you are a former employee, we process personal information about you primarily for legal compliance.

We will use your personal information only for the purposes for which it was collected, unless we reasonably need it for another compatible purpose and there is a legal basis for further processing. For example, relying upon our legitimate interest in recruiting candidates for roles at iHerb, we may process the personal information you provided while researching job openings. However, once you apply for and are successful in obtaining a role, we may process your personal information for the purpose of entering into an employment relationship with you.

If we ask you to provide any other personal information not described above that is necessary for the execution and performance of employment contract or the management of human resources in accordance with company policies, then the personal information we will ask you to provide, and the reason why we ask you to provide it, will be made clear to you at the point we collect it.

How We Use the Information About You

We use the information we obtain to manage our employment or contractual relationship with you, along with other business purposes.  Such uses include:

• evaluating and assessing your application and otherwise managing career opportunities with iHerb, including the verification of references and qualifications and, where permitted by law, administering background checks;

• administering payroll and benefits as well as processing employee work-related claims (e.g. worker compensation, insurance claims, etc.) and leave of absence requests;

• establishing training and/or development requirements;

• reviewing work performance and determining performance requirements;

• disciplinary actions or termination;

• establishing emergency contacts and responding to emergencies;

• complying with laws and regulations (e.g. labor and employment laws, health and safety, tax, anti-discrimination laws), under judicial authorization, or to exercise or defend legal rights;

• compiling internal directores, such as employee directories;

• to detect fraud or other types of wrongdoing;

• IT security and administration;

• to protect the life and safety of employees and others; and

• for other legitimate purposes reasonably required for day-to-day operations, such as accounting, financial reporting, staff augmentation and business planning.

We also use your information if we have a legitimate interest to do so, including staffing open positions at iHerb. For example, if your application for employment is not accepted, we may keep your information so we can inform you of future job openings at iHerb. You can always opt-out from the communication concerning future job openings by clicking on the unsubscribe link within the email you receive from us or by contacting us as indicated below.

We may also use such information to conduct internal analyses to understand job applicants who apply; to improve our recruitment process, including our diversity and equal opportunities efforts; and to comply with our legal obligations (e.g. health, safety, and anti-discrimination laws). We may also combine the information we collect or remove pieces of information to limit or prevent identification of any particular individual and use such information for internal research and operational purposes.

When we process sensitive information about you, we will ensure that one or more of the lawful bases for processing sensitive information applies, for example, processing necessary to satisfy our obligation in relation to employment law, processing related to data you have made public (e.g., if you tell us that you are ill), and processing which is necessary for the purpose of establishing, making, or defending legal claims. If you have questions about the nature of our processing or the lawful bases for which we do so, please contact us using the contact details provided below.

To the extent that we use processes that involve automated decision making or profiling when processing your personal information, we take steps to ensure that any automated decision-making or profiling practices are fair and not discriminatory.

We may also use your personal information for other lawful purposes which we will tell you about, and provided that we get your consent to that use, if required by law to do so.

Information We Obtain by Automated Means

These technologies help us: (1) remember your information so you will not have to re-enter it; (2) track and understand how you use and interact with our careers site; (3) tailor the careers site around your preferences; (4) measure the usability of our careers site and the effectiveness of our communications; and (5) otherwise manage and enhance our careers site and help ensure it is working properly.  To the extent required by applicable law, we will obtain your consent before placing cookies or similar technologies on your computer. For more information about cookies we use and to manage your cookie preferences, please click on the "Cookie Preferences" icon at the bottom of each page of our careers site. You can manage cookies through your web browser. Most browsers will tell you how to stop accepting new cookies, how to be notified when you receive a new cookie, and how to disable existing cookies. You can find out how to do this for your particular browser by clicking “help” on your browser’s menu or by visiting www.allaboutcookies.org. Please note, however, that without cookies you may not be able to take full advantage of all our careers site features.

Information Sharing

We may share your personal information with other iHerb subsidiaries, employees, contractors, consultants and service providers who require the data to assist iHerb to establish, manage or terminate your employment with iHerb and for the purposes described in this Privacy Notice. We also may share the personal information with our service providers who perform services on our behalf based on our instructions, including, but not limited to, employee benefit plan providers, payroll support services, employee travel management services, our service provider that operates the careers site on our behalf, and recruitment marketing agencies. We do not authorize our service providers to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements.  We may be required to share personal information when we contact your previous or current employer, with your authorization, to verify your employment history or your references.

Some of these recipients may be located in countries other than the country in which the information originally was collected. Those countries may not have the same data protection laws as the country in which you initially provided the information.

• If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”) or Switzerland, your personal information will be transferred to iHerb and its service providers in the United States. U.S. laws have not been recognized by the European Commission as providing for an adequate level of data protection. When we transfer your information to recipients in other countries (such as the U.S.), we will protect that information as described in this Privacy Notice and will comply with applicable legal requirements providing adequate protection for the transfer of personal information to recipients in countries other than the one in which you provided the information, including by implementing appropriate safeguards based on the European Commission’s Standard Contractual Clauses. Subject to applicable law, you may obtain a copy of these safeguards by contacting us as indicated in the How to Contact Us section below.

• If you are located in China, Japan, the Republic of Korea (South Korea) or anywhere else in the world, your personal information will be transferred to iHerb and its service providers in the United States. iHerb uses and requires its service providers to use appropriate privacy and security measures designed to protect your personal information and that, in such cases, the service providers have adopted and are handling your personal information to a standard that is not lower than your entitlement under your country’s data privacy, data protection and data security laws. Subject to applicable law, you may obtain a copy of these safeguards by contacting us as indicated in the How to Contact Us section below.

In addition, we may disclose personal information about you (1) if we are required to do so by law or legal process (such as a court order), (2) for the purposes of, or in connection with, any legal proceedings, or otherwise for the purposes of establishing, exercising or defending any legal rights, including, but not limited to, seeking legal advice from external lawyers and other advice from other professionals such as accountants, management consultants, etc.; (3) in response to a request by law enforcement authorities, (4) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity, (6) in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution or liquidation); or (7) otherwise with your consent.  Note that where legal requirements limit the sharing of your personal information, iHerb will respect such requirements.

Retention of Personal Information

Under some circumstances we may aggregate and de-identify your personal information so that it can no longer be associated with you. We reserve the right to use such aggregated, anonymous and/or de-identified information for any legitimate business purpose without further notice to you or your consent, subject to applicable law. Once you are no longer an employee of the company, we will retain and securely destroy your personal information in accordance with our document retention policy and applicable laws and regulations.

How We Protect Personal Information

Your Rights and Choices