Intuit Global Contingent Worker Privacy Statement

This Statement covers any Contingent Worker, for which Intuit has collected Personal Information about them. “Contingent Worker,” means any individual who works with or has worked on Intuit’s behalf but is not an Intuit employee, including:

• Agency workers, also called temporary workers or contractors;
• Independent contractors, also known as freelancers, consultants or contractors;
• Individuals who work for outside service providers (OSPs), including managed services like our cafes and security vendors; and,
• Employees of our outside Care partners.

The Intuit entity with which you or your supplier or agency has a contract (“Intuit,” “we,” “us,” “our”) is the controller of your Personal Information (defined below) for purposes of this Statement. “Controller” means the Intuit entity that is primarily responsible for managing your information. Contact us if you have questions about which Intuit entity is the controller of your Personal Information (defined below).

We may receive information about you, including information that identifies you or has the potential of identifying you as an individual natural person (“Personal Information”), such as your name, address, phone number, or email address, and other information about you throughout the time that you work with Intuit.

Ways We Collect Information:

We may collect Personal Information when you provide it to us directly. We may also collect Personal Information about you as part of our relationship with you as a Contingent Worker. We also may receive information about you from your supplier or other third parties, as permitted under applicable law.

If we are not able to collect and use certain Personal Information, we may not be able to work with you. 

How We Use It:

We use information about our Contingent Workers, including Personal Information, to carry out our business functions and in connection with the purposes below, as permitted under applicable law. We may also collect additional information for each of the purposes described below.

• Administer Your Work with Intuit: We may collect and use your Personal Information to administer and facilitate the work that you do with us. For example, we may use your Personal Information to know when you are working on projects with us and where you are located, track payments made to your supplier, track expenses we pay related to work that you are doing with us, assess compliance with Intuit’s Contingent Worker Policy, track performance and quality of deliverables, and communicate with you and/or about you to the company you work for. This information may include, as applicable, your photo, gender, financial account information, receipts or other expense information, attendance or absence information during your assignment, evaluations about the quality of your work, and feedback we may receive about you. In certain limited cases, this information may include sensitive health information if you or a supplier share that information with Intuit.
• Perform Investigations: We may obtain and use your information to assess complaints or concerns made by or about you and to perform investigations independently or in partnership with your supplier. This information may include any complaints made by or about you, disciplinary reports and findings, and information about your conduct. Depending on the event, and as permitted by applicable law, some of this information may include sensitive Personal Information, such as medical condition, if you or a supplier share that information with Intuit.

• Monitoring: We collect and use your Personal Information to monitor and provide for the security of Intuit systems, data and other confidential information, maintain the security and safety of Intuit’s facilities and staff, and to protect Intuit’s business interests, as permitted by applicable law. This information may include your email or web browsing activity and data access activity when on Intuit devices and/or using Intuit networks and systems and badging activity at Intuit facilities. For more information about how we monitor Intuit systems and devices, please see Intuit’s Acceptable Use and Monitoring Policy available on the Intuit intranet, Insight.

• Legal Requirements: We may collect and use your information to comply with our legal obligations (such as obligations under statutes or regulations) and otherwise as required or permitted by law. This information may include files you may have stored on an Intuit computer or device or on Intuit systems or apps, such as email files.
• Aggregated Information: We may also aggregate your Personal Information, and share that information with third parties. Such aggregated information will not identify you personally.

Although Contingent Workers have limited choices in how we use their Personal Information, we may offer choices to affected Contingent Workers when we intend to use Personal Information for a purpose not previously disclosed in this Statement or any other notice.

We may share your Personal Information in the following ways:

Within Intuit: We share information internally within Intuit and among Intuit’s affiliates and subsidiaries to administer and facilitate the work that you do with us and our business functions, as described in this Statement, and as required under applicable law. All Intuit and Intuit affiliate and subsidiary employees and Contingent Workers who handle Contingent Worker Personal Information are required to comply with Intuit's privacy and security policies. These policies are available on Intuit’s intranet site, Insight. As used in this Statement, “affiliates and subsidiaries” means companies related by common ownership or control.

Third Party Service Providers and Agents: Intuit uses third party service providers that help us administer and facilitate the work you do with us and our other business functions. These service providers may collect and/or use your information, including information that identifies you personally, to assist us in achieving the purposes discussed above. We require our service providers to agree to safeguard the Personal Information that they receive about you.

Third Parties Who Provide You Services: In some cases, Intuit may provide third-party services to you, such as on-site fitness centers. These third parties may establish a relationship with you directly. In these instances, the third party’s use and sharing of your Personal Information will be covered by the third party’s privacy statement. Be sure to review the privacy statement of the third party when you decide to establish a relationship with them.

Merger or Sale of Our Business: In the event of a merger, asset sale, financing, liquidation, bankruptcy, or the acquisition of all or part of our business to another company, we may share information we may have about you with that company and its advisors before and after the transaction date.

Response to Legal Requests: We may share information we may have about you with third parties when we reasonably believe disclosure is required or permitted in order to comply with a subpoena, court order or other applicable law, regulation or legal process.

Protection of Intuit and Others: We may share information we may have about you when we believe it is appropriate to protect the rights, property, or safety of Intuit, our services, our customers, our Contingent Workers, our employees or others.

Aggregate Information: We may share your information in a form that does not identify you individually, such as in aggregate and/or de-identified form, internally within Intuit and among Intuit’s affiliates and subsidiaries or with certain third parties for purposes such as research, reporting and benchmarking.

Legal Basis for Processing Personal Information

Our legal basis for collecting and using the Personal Information described in this Statement will depend on the Personal Information concerned and the specific context in which we collect it. We collect and use your Personal Information where we need the Personal Information to perform a contract with you (such as to administer your work relationship with us), where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or where we may have a legal obligation or may otherwise need the Personal Information to protect your vital interests or those of another person. In some limited cases and when applicable, we may collect and use your Personal Information where we have your consent.

If you have questions about the legal basis we use to collect and use your Personal Information, please contact us using the contact methods in the “How to Contact Us” section of this Statement.

How You Can Exercise Rights Regarding Your Personal Information

We provide Contingent Workers reasonable means to access, rectify, or object to Intuit’s processing of their Personal Information, request data portability or request damages. You may contact us using the contact information provided in the "How to Contact Us" section below.

This section applies to Contingent Workers based in the EEA or other regions where you have data rights under applicable data protection laws. 

If you live in the EEA, your rights may include:

• Right to Access – The right to be informed of and access the Personal Information we process about you, including, in certain circumstances, a right to know what Personal Information we collected, or disclosed about you, including the specific pieces of Personal Information held. 
• Right to Erasure – The right to request deletion of your Personal Information, subject to certain exceptions.
• Right to Rectification – The right to request that we amend or update inaccurate or incomplete personal data.
• Right to Restrict Processing – The right to request that we temporarily or permanently stop processing all or some of your Personal Information.
• Right to Object – The right to object to Intuit processing Personal Information, such as when automated decision making is used.
• Right to Data Portability – The right to request a copy of your Personal Information in electronic format and the right to further request that we send such Personal Information to another party.
• Right to Lodge a Complaint – The right to lodge a complaint with the applicable supervisory authority. Although you are not legally required to do so, we ask that you first contact us so we can make reasonable efforts to address your complaint.

If you live in California, your rights may include:

• Right to Know – The right to know what categories and specific pieces of Personal Information we collect, the purposes for which we collect Personal Information, the sources from which we collect Personal Information, and whether Personal Information is disclosed, sold, or shared with third parties.
• Right to Erasure – The right to request deletion of your Personal Information, subject to certain exceptions.
• Right to Correction – The right to request that we correct inaccurate or incomplete Personal Information.
• Right to Opt Out – The right to opt out of the sale or sharing of your Personal Information, and the right to opt out of automated-decision making technology.
• Right to Non-Discrimination – The right not to receive discriminatory treatment for exercising your rights.
• Right to Limit Use of Sensitive Personal Information – The right to limit the use and disclosure of your sensitive Personal Information.

If you are a Contingent Worker in France, you also have the right to give directives about the processing of your Personal Information after your death.

To make a request, please contact HR Connect using the methods described in the “How to Contact Us” section below. We will consider and act upon any such requests in accordance with applicable data protection laws.

When applicable, if we are relying on your consent to process your Personal Information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal.

Please be aware that Contingent Workers may have limited choices in their ability to request deletion of their Personal Information due to Intuit’s legal obligations to retain certain information.

We will retain and use any Personal Information we may have about you in compliance with Intuit's records and information management policies. For example, we may retain Personal Information to comply with our obligations under applicable laws and regulations, resolve disputes, and enforce our agreements. We will retain Personal Information we may have about you no longer than is necessary to carry out the purposes provided in this Statement and/or as required or permitted by applicable law.

Intuit uses appropriate technical and organizational measures to protect the Personal Information of its Contingent Workers. For example, we limit access to your Personal Information to members of Intuit’s and Intuit’s affiliates' and subsidiaries’ personnel with a need to know in connection with their job duties, such as select personnel within the human resources, finance, legal, insurance, information security, and IT departments.

We may transfer, process and store Personal Information, including sensitive Personal Information, we may have about our Contingent Workers outside their country of residence, including countries where we and our third-party service providers operate, in accordance with and as permitted by applicable law and regulations. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective). This means that Personal Information about Contingent Workers based outside of the United States may be transferred to Intuit Inc. in the United States, among Intuit's affiliates and subsidiaries located in other countries, and to third-party service providers located in the United States and other countries, for the purposes identified under Section 2. For information about where our third-party service providers store your Personal Information, please contact us as described in the “How to Contact Us” section. We have taken appropriate safeguards to require that your Personal Information will remain protected in accordance with this Statement.

For Contingent Workers based in the EEA, these include reliance on the Privacy Shield Framework or implementing the European Commission's Standard Contractual Clauses.

This Section provides additional provisions that apply to residents of California. In the event of a conflict between this section and the remainder of this Statement, this section shall take precedence for California residents. In this section only, capitalized terms not defined in this Statement shall have the meanings set forth in the California Consumer Privacy Act (“CCPA”). Some of this information may constitute sensitive personal information defined by the CCPA. Where our processing of this sensitive personal information is not for a permissible business purpose, we will provide you an opportunity to limit the processing of that information. For example, collection of that information may be opt-in only. 

For details on the information we process, please refer to the CCPA Right to Know chart.

Although not relied on for data transfers, Intuit Inc. complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework, as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland, to the United States. We are subject to the investigatory and enforcement powers of the Federal Trade Commission. You can find more information about Intuit’s and Mailchimp’s EU-U.S. and Swiss-U.S. Privacy Shield certification here.

This section applies to Applicants and Workforce Members based in the EEA, California or other regions where there are applicable data protection laws. 

To make a request, please contact HR Connect using the methods described in the “How to Contact Us” section below. We will consider and act upon any such requests in accordance with applicable data protection laws. If you are a California resident, you may only make a request to exercise your rights on behalf of yourself. You also have a right to submit requests to exercise your rights through an authorized agent. An authorized agent must be registered with the Secretary of State in California to conduct business in California. If you choose to use an authorized agent, you must (a) provide signed permission to that authorized agent to submit requests on your behalf, (b) verify your identity directly with us, and (c) directly confirm with us that you granted permission to the authorized agent to submit the request on your behalf. For clarity, you are required to verify the identity of both yourself and the authorized agent.  

In order to verify your request, you must provide sufficient information to allow us to reasonably verify you are the person about whom we collected Personal Information. You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to your request. 

When we receive your request to exercise your rights: (a) we will acknowledge receipt of your request; (b) we will try to match the Personal Information you provide in making the request with Personal Information we already maintain about you; (c) if required to verify your identity, we may ask you to provide additional information, including Personal Information; (d) we will consider various factors when determining how to verify your identity, such as the sensitivity and value of the data, the risk of harm, the likelihood of fraud, etc.

We will only use Personal Information we collect during the verification process for the purpose of verifying your identity. If we are unable to verify your identity as required by applicable laws and regulations, we will decline to comply with your request, and let you know why. 

We will respond to your requests within the time periods prescribed by applicable law. If we require additional time, we will inform you of the reason and extension period. 

When applicable, if we are relying on your consent to process your Personal Information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal.

Please be aware that you may have limited choices in your ability to request deletion of Personal Information due to Intuit’s legal obligations to retain certain information.

Questions or Comments: If you have questions or comments about this Statement or our privacy practices, please contact your supplier or agency or contact us using one of the below methods.

Exercising Your Data Rights: California based Contingent Workers may use our self-service functionality for access requests via the Worker Privacy Page on Insight or Easy Care.  

If you are based in the EEA or United Kingsom, please contact HR Connect by phone at your local number posted on the HR Connect page on the Intuit intranet, Insight, or listed below or email at hrconnect@intuit.com. You can also use the online chat or case submission features accessible through the HR Connect page on Insight, where available. For Contingent Workers who speak French, you may request a French speaking HR Connect agent by phone.

• 0207-8240-000 or 00-800-2847-1577 (EEA)
• 000-800-109-1010 (India)
• 001-800-2847-1577 (Singapore)
• 0011-800-2847-1577 (Australia)
• 014-800-2847-1577 (Israel)
• 800-819-1620 or 800-264-6169 (US & Canada)

Complaints or Disputes: If you have complaints or disputes about this Statement or our privacy practices, please contact:

• HR Connect by phone at your local number posted on the HR Connect page on Insight or above or email at hrconnect@intuit.com. You can also use the online chat or case submission features available on the HR Connect page on Insight.
• The Intuit Integrity Line by phone. You can find the Intuit Integrity Line phone number for your country by visiting the Intuit Integrity Line website and choosing your country from the dropdown list. 

We will respond to your complaint in the time period required by applicable law. In some regions, including the European Economic Area, you may also have a right to lodge a complaint with your local data protection authority (DPA). See Intuit's Privacy Shield Certification page.

All changes are effective immediately upon posting a notice. You can see when this Statement was last updated by checking the ”Effective Date” date displayed at the top of this Statement. As required under applicable law, we will provide you notice of changes to the way we process your Personal Information via Intuit’s intranet pages and/or email and will obtain your consent as required by applicable law. We encourage you to review such pages periodically to review the current Statement in effect.

For questions or to report a concern about the statement, contact HR Connect.

Date of last Review and Update - Statement: February 22, 2023