JOB APPLICANT PRIVACY POLICY

Xponential Fitness is committed to protecting and preserving your privacy. This Job Applicant Privacy Policy describes the personal information we collect about you — what it is, where we get it, and how we use or share it — as well as how job applicants (collectively, “Xponential Applicants,” “you”) may exercise your rights established under applicable law.

Overview of this Job Applicant Privacy Policy

This Policy describes:

• Categories of Personal Information we may collect from or about you;
• The sources of that Personal Information;
• The purpose(s) for which we collect and use that Personal Information; and
• Xponential Applicants’ privacy rights and how to exercise those rights.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. It does not include publicly available information (i.e., information from government records) or de-identified or aggregated information.

How We Collect, Use, and Disclose Personal Information

Xponential Fitness collects Personal Information from Xponential Applicants in different ways and for different purposes, including as described below. This Section explains the categories and sources of Personal Information we have collected from Xponential Applicants in the past twelve (12) months, the purposes for that collection, and the third parties to whom we may disclose such information.

Categories of Personal Information we may have collected in the last 12 months about Xponential Applicants

• Identifiers, such as: name, postal address, email address, social security number, driver’s license number, passport number, or other similar identifiers;
• Professional or Employment-related Information, such as: previous employment, work history, and professional license;
• Education Information, such as: education or student records;
• Characteristics of Protected Classifications, such as: age, race, color, ancestry, national origin, marital status, religion, sex, veteran or military status, medical condition, and mental or physical disability, and other demographic data;
• Internet or Other Electronic Network Activity Information, such as: browsing history, search history, and information regarding your interaction with an internet website application
• Inferences, such as the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.

Note that some of the information included in the list above may constitute Sensitive Personal Information, such as your social security, driver’s license, state identification card, or passport number.

Sources of Personal Information

The categories of sources from which we collect or receive Personal Information include you, government entities and other sources, publicly available sources, credit agencies or bureaus, service providers or other third parties (e.g., in the instance Xponential Fitness receives an employment referral).

Business purposes for the collection and use of Personal Information

We may collect, use, or disclose your Personal Information for the business purposes described below:

• To perform employment-related functions, such as providing Human Resources services, administering payroll, compensation, reimbursement, insurance programs, managing professional development, enforcing employment agreements and Xponential Fitness policies;
• To recruit and evaluate job applicants, such as conducting background and reference checks, determining eligibility for employment;
• To comply with applicable laws and regulatory requirements, or as requested by government or regulatory authorities or law enforcement;
• To maintain the security and integrity of our data, systems, and other assets, including maintaining internal records, to enforce our written policies and procedures, and to protect Xponential Fitness, its employees, and other third parties from harm;
• To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity;
• To consult with our attorneys, accountants and auditors, and other advisors;
• In connection with pending litigation; and
• In connection with a merger, divestiture, acquisition, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

Disclosure of Personal Information

Xponential Fitness may disclose your Personal Information to our affiliate companies, business partners, service providers, contractors, government agencies, law enforcement, or other entities, consistent with the business purposes described above.

No Sale of Personal Information

Xponential Fitness does not sell or share the Personal Information (including sensitive Personal Information) of Xponential Applicants.

Xponential Employees’ Privacy Rights

Applicable law provides Xponential Applicants with certain rights regarding their Personal Information. This Section explains those rights. Please see below for information on how to exercise these rights.

• Right to know about and access your Personal Information. An Xponential Applicant has the right to know what categories, and to request copies of, your Personal Information that Xponential Fitness has collected, used, disclosed, sold, or shared in the preceding twelve (12) months. You may only make a consumer request to know about or access your Personal Information twice within a twelve (12)-month period.
• Right to delete your Personal Information. An Xponential Applicant may have the right to request that Xponential Fitness delete certain of your Personal Information that we have collected; however, this right does not apply to Personal Information that is subject to an exception under, or which is otherwise not required by, applicable law.
• Right to correct your Personal Information. An Xponential Applicant may have the right to request that inaccurate Personal Information maintained by Xponential Fitness be corrected, taking into account the nature of the Personal Information and the purposes for processing such information.
• Right to opt-out of the sale or sharing of your Personal Information. Xponential Applicants have the right to opt-out of the sale or sharing of your personal information, but Xponential Fitness does not sell or share Xponential Employee Personal Information.
• Right to limit the use and disclosure of sensitive Personal Information. An Xponential Applicant may have the right to request that Xponential Fitness limit the use of your sensitive Personal Information. (This right does not apply if sensitive Personal Information is collected or processed without the purpose of inferring characteristics about you.) Xponential Fitness does not collect or process your sensitive Personal Information for the purpose of inferring characteristics about you.

Non-Discrimination for exercising CCPA rights

Xponential Fitness will not discriminate or retaliate against any Xponential Applicant for exercising any of the rights described above.

How to submit a request

If you would like to exercise any of the rights identified above, you may submit a request by sending an email to hr@xponential.com or by calling us at 949-346-3000 (ask to be transferred to HR).

Submitting a request through an authorized agent

You may have the option to designate an authorized agent to submit a request to exercise the above rights on your behalf, so long as the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us. In California, if you would like to designate an agent, your agent must register as such with the California Secretary of State and submit a copy of this registration, along with your consumer request, to us. We may need to contact you directly to verify the request.

How we verify your request

We can only fulfill your privacy rights requests if we are able to verify your identity, or the authority of your agent to make the request on your behalf, and confirm that the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We may request that you provide certain information to verify your identity.

Depending on the type of request or the information requested by you, we may require additional information in order to verify your identity and fulfill your request. If we cannot successfully verify your identity, we will inform you of that fact.

We will respond to your request within forty-five (45) calendar days. However, in certain circumstances, we may require additional time to process your request. We will advise you within forty-five (45) calendar days after receiving your request if such an extension is necessary and why it is needed. Any disclosures we provide will only cover the twelve (12)-month period preceding our receipt of your request. If we cannot fulfill your request, our response to you will also explain the reason why we cannot fulfill your request.

We do not charge a fee to process or respond to your consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will explain the basis of that determination and provide you with a cost estimate before completing your request.

Contact For More Information

If you have any questions or concerns about this Employee Privacy Policy or our privacy practices, please contact us at hr@xponential.com.