Effective: January 1, 2023

Aflac Incorporated and the Aflac group of insurance companies (“Aflac”, “we” or “us”) offers this Privacy Notice (“Notice”) to describe our practices for handling personal information associated with our former, current, and potential employees, job applicants, contractors, sales agents, brokers, temporary and other workers, interns, and their family members and dependents (collectively, “you” or “your”). This Notice describes the personal information that we collect and process about you, the purposes of the processing, the ways in which we may disclose such information, and the rights that you may have regarding the processing of personal information.

This Notice provides California residents with additional information regarding our collection, use, and disclosure of their personal information.

California Consumer Privacy Act (CCPA): Subject to certain exceptions, the CCPA, as amended by the California Privacy Rights Act, gives California residents certain privacy rights with respect to some of the personal information we collect. These rights are:

• The right to notice of the personal information we collect.
• The right to know the categories, sources and specific pieces of personal information we have collected about you, including our business or commercial purpose for collecting, selling or sharing the information, the categories of personal information that we sell or share, the categories of personal information that we disclose for business purposes, and the categories of third parties with whom we disclose that personal information.
• The right to delete some or all of the personal information we collect, subject to certain exceptions.
• The right to correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the processing purposes.
• The right to opt-out of our sale or sharing of your personal information, as those terms are defined under the CCPA.
• The right to limit the use and disclosure of sensitive personal information, as those terms are defined under the CCPA, which are necessary to provide you services and other purposes permitted under the CCPA,
• The right not to be discriminated against for exercising these rights.

Your rights under the CCPA are limited and may not apply in certain situations.

Sources of personal information we collect

In association with your current or former relationship with Aflac, or while assessing a potential relationship, we may process personal information about you, your dependents, beneficiaries, and other individuals. We may collect such information from you, your application or other forms completed during our relationship, your references, driver’s licenses or other identification documents, other workers, previous employers, service providers that process personal information solely on our behalf, recruitment agencies, benefit providers, professional and certification organizations, background check providers, and social media. We also collect personal information regarding your use of and access to Aflac information resources (e.g., communications resources, internet, networks, websites, and applications) and access to Aflac facilities, such as entry logs, and video recordings of certain areas (e.g., entry to facilities).

Types of personal information we collect

The types of personal information we may collect include:

• Identifiers, such as your name, social security number, staff member ID, home and business address, telephone/email addresses, social media handle, device identifiers, username, employee ID, emergency contact details, passport number/national ID number, and other government identifiers.
• Additional Personal Identifiers, such as your signature, physical characteristics or description, insurance policy number, banking details, tax information, compensation details, withholdings, salary, benefits, and expenses, or any other financial information, medical information, and health, life or other insurance information, including your claims history
• Protected classifications under federal or state laws, such as gender, age (including date of birth), marital status, military service, national origin, work authorization status or citizenship (for work eligibility purposes), address, photograph, passport, and disability status.
• Internet or other electronic network activity information associated with Aflac IT systems, networks, and resources – such as IP addresses, log files, electronic communications and files, network connections, and login credentials.
• Geolocation data, such as information associated with the devices or equipment you use in the course of your relationship with us.
• Video recordings in certain work areas, security footage of you on our premises, and photographs for identification purposes.
• Recordings of communications for quality control, recordkeeping, and training purposes.
• Professional or employment-related information, such as job title/position, office location, employment contract, dates of service, positions held, performance and disciplinary records, grievance procedures, travel and expenses, work location preferences, investigations, complaints, sickness/holiday records, academic/professional qualifications, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law), reference information, and information relating to background checks.
• Education information, such as degrees or certifications held, trainings and development programs attended, and assessments.
• Biometrics, such as fingerprints or facial scans for purposes of facilitating access to facilities, devices, or applications.
• Sensitive personal information that reveals government identification numbers, login credentials, personal communications received or sent using our information resources, trade union membership, biometrics, sexual orientation, and health information (e.g., for benefits or accommodations purposes).
• Inferences drawn from the above categories of personal information collected about you.

Purposes for collecting personal information

Recruitment

If you apply for or are recommended for a role at Aflac, we collect, use, and disclose personal information for recruitment purposes – in particular, to determine your qualifications for a role at Aflac and to reach a recruitment decision. This includes assessing your skills, qualifications and background for a particular role, verifying your information, conducting our reference checks or background checks and checking visa status and/or eligibility to work (where applicable) and to generally manage the hiring or contracting process and communicate with you about it.

If you accept a role at Aflac, the information collected during the recruitment process will form part of your ongoing record.

If you are not offered a position, we may retain personal information to allow us to consider you for other suitable openings within Aflac in the future and consistent with applicable law.

Employment or work-related purposes

If you are employed by Aflac or have a worker-related purpose with Aflac, we process personal information for the following purposes:

• Workforce management, including new hire onboarding, appraisals, promotions, succession planning and career development; administering payroll; providing other compensation; providing healthcare, life insurance, and other benefit administration; social security, pensions and savings plans; training (including distribution of Aflac policies and training materials to employees); maintaining leave, transfers, and secondments; entering into and complying with employment agreements; maintaining directories; conducting investigations and resolving disciplinary or grievance issues; administering business travel; asset allocation; and
• Communications and emergencies, including facilitating communication with employees, providing references, protecting the health and safety of employees and others, facilitating communication in an emergency.
• Operating and managing the IT and communications systems, including for security and business continuity purposes.
• Maintaining the safety and security of our facilities, assets, you, and others.
• Budgeting, financial management and reporting.
• Managing mergers, acquisitions, and re-organizations.
• Responding to legal process such as subpoenas.
• Pursuing legal rights and remedies and addressing litigation and managing internal complaints or claims.
• Complying with legal and other requirements, such as tax, record-keeping, reporting, and audit obligations.
• Monitoring and addressing compliance with applicable laws and Aflac policies and procedures.
• Receiving and responding to inquiries, reports, or complaints.
• Conducting audits, compliance with government inspections and other requests from government or other public or regulatory authorities, and complying with internal policies and procedures.

Disclosures of personal information

We may disclose your personal information for our business purposes to the following categories of recipients:

• Service providers: We disclose all categories of personal information collected to service providers that perform services to help us administer HR and staff member compensation and benefits, facilitate our recruiting efforts, assist us with facilitating our employment relationship with you, operate and maintain our IT resources, provide data or physical security, and otherwise operate our business. Unless otherwise specified, these companies will only use your personal information in the ways described in this Notice.
• Benefit providers: We arrange for you to receive certain benefits from third parties, such as insurance or financial benefit companies. We may disclose all categories of personal information collected with those parties to facilitate the provision of those services.
• Consultants: We may provide all categories of personal information collected to consultants and advisors that help us operate and improve our business.
• Aflac affiliates: We may disclose all categories of personal information collected within our Aflac family of companies for employment, recruiting, security, and internal reporting purposes. Unless otherwise specified, Aflac affiliates will only use your information in the ways described in this Notice.
• Recipients of legal disclosures: We may disclose all categories of personal information collected to law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation. We may all categories of personal information collected disclose as we deem reasonably necessary to support lawful investigations or requests, or as reasonably necessary to protect our rights or the rights of you or any other party.
• In the context of a transaction: We may disclose all categories of personal information collected to potential transaction partners, service providers, advisors, and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another Aflac or we sell or transfer all or a portion of our assets or business.

Purposes for collecting, use, and disclosure of sensitive personal information: i) to provide products and services requested by you, including employment or worker related purposes; (ii) to prevent, detect, and investigate security incidents; (iii) to resist malicious malware, deceptive, fraudulent, or illegal activities directed at us and to prosecute those responsible for such actions (as reasonably necessary and proportionate) (iv) to ensure the physical safety of natural persons (as reasonably necessary and proportionate); (v) for short-term transient use, including but not limited to, nonpersonalized advertising as part of your interaction with us (excludes disclosure to a third-party, building of profiles about you, or altering your experience outside of current interaction with us); (vi) to perform services on our behalf, including but not limited to maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying your information, processing payments, providing analytic services, providing storage, or providing similar services; (vii) to verify and maintain the quality or safety of a product, service, or device owned or controlled by us, to improve, upgrade, the service or device owned or controlled by us (as reasonably necessary and proportionate).

Retention: We retain your personal information for as long as necessary to achieve the purposes for which we collected the information and as needed to comply with our legal obligations.

Your California Privacy Rights

You may have certain rights in relation to your personal information under California law, as described below and subject to certain exceptions.

• Right to know: You have a right to request information about the personal information that we collect, use, disclose, sell and share about you, such as categories of personal information we collected about you; categories of sources for the personal information we collected about you; our business or commercial purpose for collecting, selling, or sharing that personal information; categories of third parties to whom we have disclosed that personal information; specific pieces of personal information we have collected about you; categories of personal information that we sold, and for each category identified, the categories of third parties to whom we sold that particular category of personal information; and categories of personal information that the business disclosed for a business purpose and for each category identified, the categories of third parties to whom it disclosed that particular category of personal information. Once we receive and confirm your verifiable request, we will disclose to you upon request.
• Right to deletion: You have a right to request that we delete personal information associated with you that we have collected about you. Once we receive and confirm your verifiable request, we will delete (and notify our service providers and/or contractors to delete) your personal information from our records, unless an exception applies.
• Right to correct: You have a right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing of the personal information. Once we receive and confirm your verifiable request, we will use commercially reasonably efforts to correct the inaccurate information.
• Right to Opt-Out of the Sale or Sharing of Personal Information: You have the right to request that we not share your personal information to third parties in exchange for monetary or other valuable consideration or to not share your personal information for cross-contextual behavioral advertising with third parties. If you would like us to record a preference to not sell or share your personal information, please click here: DO NOT SELL OR SHARE MY PERSONAL INFORMATION.
• Your Right to Limit the Use and Disclosure of Sensitive Personal Information: You have the right to request that we limit the use and disclosure of sensitive personal information for purposes other than those necessary to provide our services and those purposes otherwise permitted under the CCPA. If you would like us to record a preference to limit the use and disclosure of sensitive personal information, please click here: LIMIT THE USE OF MY SENSITIVE PERSONAL INFORMATION.

In the event you would like to exercise one of your rights or if you are an authorized agent submitting a request on behalf of a California resident, please submit your request by clicking here and completing the online form, by mail, or initiate an individual rights request by calling our toll-free number 1-855-768-9730. We will ask you to verify your identity for requests to know, requests to delete, and requests to correct by providing us with the following information:

• For requests made online: We will require you to upload a photo identification card (passport, driving license) so that we can correctly match it with data we have previously collected about you. We will also require you to attest that you are the person you claim to be.
• For requests made by phone: In order to submit your request over the phone, you must have a valid phone number and a valid email address.
• For requests made by mail: You must submit proof of your identity. You may mail a request to Aflac at Aflac Worldwide Headquarters, Attn: Privacy Office, 1932 Wynnton Road, Columbus, GA 31999
• Additional data we may request to verify your identity: When we request additional information from you to verify your identity, we may request other account information, answers to security questions, your name, government identification number, date of birth, contact information, or other personal identifying information.

Please note that we may require additional information from you in order to honor your request, and we may decline your request as permitted under applicable law. You may also make a request on behalf of your minor child. You may only make a verifiable request for access or data portability twice within a 12-month period.

Updates to this Notice

This Notice may be updated periodically to reflect any necessary changes in our privacy practices. We encourage you to check back at this website periodically in order to be aware of the most recent version of this Notice.

Contact details and additional information

Please address any questions or requests relating to this Notice to 1-855-768-9730 or write us at:

Aflac Worldwide Headquarters
Attn: Privacy Office
1932 Wynnton Road
Columbus, GA 31999

For additional information regarding our privacy practices, please refer to our Privacy Center.