NRG U.S. EMPLOYEE AND CONTRACTOR PRIVACY POLICY

2.  How We Collect Personal Information

We will collect information from several sources including:

• Directly from you when you respond to our employment offer, submit information via our websites or applications, complete forms we provide to you, make a complaint, exercise your employment rights, provide documents, or otherwise communicate with us.
• From other employees, for example, when collecting feedback from colleagues [as part of regular employee reviews].
• From your activities at work based on timecards, access card logs, phone usage, computer, and Internet usage, location tracking devices, and accident reports.

3. How We Use Your Personal Information

• We only use Personal Information when necessary for the performance of our employment relationship with you, or when the use is necessary to comply with a legal obligation that applies to us as your employer. We may use your information for the following legitimate business purposes.[1]

1. Managing our employment relationship with you including:
2. evaluating an applicant’s qualifications and suitability for employment;
3. administering pre- and post-employment tests and training activity;
4. conducting criminal and other background checks;
5. completing the employment onboarding process;
6. timekeeping, payroll, direct deposit authorization, and expense report administration;
7. administration of benefits, leaves of absence, and maintaining emergency contact information;
8. employee training and development;
9. workers’ compensation claims management;
10. performing workforce analytics, data analytics and benchmarking; or
11. other talent purposes.

• Preparing and maintaining legally required records, such as I-9 forms, EEO-1 forms, and affirmative action plans.
• Conducting accounting activities, workplace investigations, and internal audits.
• Meeting tax obligations, complying with applicable law, and complying with health and safety obligations.
• Maintaining commercial insurance policies and coverages, including for workers’ compensation and other liability insurance.
• Deducting and remitting trade union membership dues, if applicable.
• Managing and monitoring employee access to company facilities, equipment, and systems.
• Preventing and detecting unlawful and inappropriate use of company credit cards, systems and assets and countering loss of company data.
• Investigating and enforcing compliance with company policies and procedures.
• Detecting and preventing unlawful and inappropriate use of company resources and countering loss of company data.
• Detecting, protecting against, responding to security incidents, malicious, deceptive, fraudulent, or illegal activity; and then prosecuting those responsible for that activity.
• Exercising or defending the legal rights of the company, its employees, or affiliates.
• Conducting business management and planning including internal administration with our affiliated entities.
• Engaging in corporate transactions, such as evaluating potential mergers and acquisitions, which require review of employee records.

We use Personal Information for the purposes it was collected and for purposes described in this Policy. If we need to use information for an unrelated purpose, we will provide some form of notification and seek consent when required to by law. We may use your Personal Information without your knowledge or consent when required to do so by law or regulation.

We do not use your Personal Information for automated decision making.

4.  Data Sharing

We may share your Personal Information with certain of our trusted affiliates, contractors, and vendors (collectively, "third-party service providers") who provide services to us or on our behalf, or otherwise support our employment relationship with you. Such third-party service providers include, but are not limited to, payroll processors and benefits administration providers.

As part of protecting your personal information, we require all our third-party service providers to implement appropriate security measures consistent with our policies and data security obligations. We do not permit our third-party service providers to use your Personal Information for purposes unrelated to the terms of their engagement with us. As such, we only permit them to use your Personal Information for those purposes specified in accordance with our instructions.

We may also share your Personal Information for the following additional purposes where permitted or required by applicable law:

• Complying with court orders, subpoenas, lawful discovery requests and as otherwise permitted or required by law or regulation. We may be required by law at times, to provide certain information to government or law enforcement agencies, or to parties to civil lawsuits.
• Detecting and preventing fraud or other illegal or unauthorized activities.
• During emergency situations or where necessary to protect the safety of persons.
• Where the personal information is publicly available.
• If a business transfer or change in ownership occurs.
• For additional purposes with your consent where such consent is required by law.

5.  Data Security

Protecting your information is one of our top priorities. We have implemented reasonable and appropriate physical, administrative, and technical safeguards, and security measures to protect against the loss, misuse, or alteration of Personal Information under our control. In addition, we limit access to Personal Information to those employees, agents, contractors, and other third parties who have a legitimate business need for such access.  In the event your information is compromised, we will notify you in the most expedient time reasonable under the circumstances and where required by law.

6.  Data Storage, Retention and Disposal

The information we collect may be processed and stored in the United States or in other countries where we or our affiliates or third-party service providers process our data. We take steps to ensure that data is processed according to this Policy and to ensure Personal Information is adequately protected in accordance with applicable law.

Except as otherwise permitted or required by applicable law or regulation, we will only retain your information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Under some circumstances we may anonymize your information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent. Once you are no longer an employee of the company we will retain or destroy your Personal Information in accordance with our records retention policy and applicable laws and regulations.

7.   Your Rights as an Employee

It is important that the Personal Information we hold about you is accurate and current. Please keep us informed if your information changes during your employment by emailing talentbusinessoperations@nrg.com   

8.  Policy Changes

We reserve the right to make changes to this Policy from time to time without prior notice. If we modify this Policy, we will update the "Last modified" date at the top of this Policy. We may take other steps to notify you of any updates, including if other steps are required by applicable law.

If at some time in the future, we wish to use your information for new unanticipated uses not previously disclosed in our Policy, we will provide a more direct way of notifying you of changes to this Policy and obtain your consent as required by law.

9.  Additional Information for California Residents

This section supplements the above Policy and applies solely to California residents.  We have issued this notice to comply with the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA) and implementing regulations.

11. How we Share Your Personal Information

We do not sell your Personal Information and do not share your Personal Information for targeted advertising purposes.  We do not share your sensitive Personal Information for purposes other than for the purposes of managing and facilitating your employment or contract relationship with us.

12. Your California Rights

The California law provides California residents with specific rights regarding their Personal Information.

• Right to Know: you may have the right to request information about the Personal Information we have collected about you, the purpose of our collection, and the source of the data.  You may also have the right to know with whom we have shared your Personal Information, for what purpose, and what Personal Information has been shared. 
• Right to Access: you may have the right to request information about how we process your Personal Information and to obtain a copy of that Personal Information.
• Right to Portability: you may have Personal Information and to obtain a copy of that Personal Information in a structured, commonly used, and machine-readable format and to have that information transmitted to another organization in certain circumstances.
• Right to Correction:  you may have the right to request that we modify or correct errors in the Personal Information that we have collected from you.  However, please note that we may not accommodate a request to change Personal Information if we believe that doing so would violate any law, legal requirement or rights of another person, or cause the information to be incorrect.
• Right to Deletion: you may have the right to request the deletion of your Personal Information that we have collected from you.

13. Rights around Automated Decision-Making Technology

Automated decision-making technology may be used to infer information about your work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, and movement.  You have the right to request information about such automated decision- making technology and processing, and its results.  You also have the right to opt-out of decision-making technology and profiling and the right to opt-out of cross-context behavioral advertising.  However, please know that NRG does not use your Personal Information for automated decision making.

14. How to Exercise Your Rights

If you have any questions regarding the information contained in this Policy or would like to exercise your California rights, please contact NRG Talent:

Submit an online request here.

Send an email to talentbusinessoperations@nrg.com .

Write to us at: 

NRG Energy

Privacy Compliance Coordinator

P.O. Box 3765

Houston, TX 77253-3765

(844)460-0309

When submitting a request, we may require additional information from you or take other steps to verify your identity and your right to access the Personal Information we hold about you. This is done to protect your privacy and maintain security. We may charge you a reasonable fee in instances that require a disproportionate effort, but we will advise you of any fee in advance. We may decline to process requests that are frivolous or unreasonably repetitive or burdensome, risk the privacy or impact the rights of others, or are extremely impractical.

15.  Non-Discrimination

California law ensures that you are free from discrimination or retaliation when you exercise your California privacy rights, and we will not discriminate or retaliate against you for exercising any rights.