FIRST ORION SUPPLEMENTAL HR PRIVACY NOTICE

July 15, 2025

This Supplemental HR Privacy Notice (the “Supplemental Notice”) supplements the First Orion HR Privacy Notice – Global and applies to the personal information of certain employees, prospective employees, and contractors of First Orion Corp. (“First Orion”, “we”, “us” and “our”) who are located in the United States. This Supplemental Notice also applies to information provided to us about employees’ relatives or others that is used for emergency contact or benefits administration purposes.

Please read this Supplemental Notice to learn how we collect and process your personal information when you are employed by First Orion, engaged to provide services to First Orion, or apply for a job with First Orion. Under applicable U.S. state privacy laws, including but not limited to, the California Consumer Privacy Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act, (collectively, “State Privacy Laws”) you may have the right to know and understand the categories of personal information we collect about you, and the purposes for which we use such personal information. First Orion does not sell or otherwise disclose this personal information for monetary or other consideration to any third parties.

1. Categories of Personal Information We Collect

As permitted by applicable law, First Orion may collect the following categories of personal information for the purposes described below:

1. Identifiers, such as name, alias, unique identifier, email address, IP address, physical address, telephone number, bank account number, Social Security number, driver’s license, passport number, date of birth, medical information and health insurance information.
2. Characteristics of protected classifications, such as age, race, color, ancestry, national origin, marital status, medical condition, sex, financial information, citizenship status, veteran or military status.
3. Biometric information, such as fingerprint or faceprint imagery from which an identifier can be extracted.
4. Sensory data, such as audio and visual information that may be obtained through video interviews or meetings, CCTV footage, or security access control systems information.
5. Internet or Network Activity, such as company device usage, login records, or activity logs.
6. Professional or employment-related information, such as employment history, job application form, CV, references, educational history, professional qualifications, employment contract, information about skills, abilities, and responsibilities, performance evaluations information and employment termination information, and history of professional development (including any certifications, professional licenses and specialized training).

We may also collect personal information included in job interview notes, responses to screening questions, assessment results and any other information you provide in connection with the recruitment process.

2. Sources of Personal Information

We collect personal information you voluntarily provide to us during the application process or when you otherwise contact us. We may also automatically collect certain information, such as IP addresses and device identifiers.

We may combine personal information you voluntarily provide to us with information we collect from other sources, such as: recruiters, prior employers, educational institutions, pre-employment screening and background check services, credentialing and licensing organizations, publicly available sources, such as public social media profiles, and other sources as directed by you.

3. Business Purposes for Collecting Personal Information

We use the categories of personal information above for the following business purposes:

1. Recruitment of employees and processing and managing job applications: We use your personal information to process your job application, evaluate your qualifications, schedule and conduct interviews, and communicate with you.
2. Conducting pre-employment screening and background checks: In accordance with applicable law, we may use your personal information to conduct employment screening and background checks.
3. Compensation and expense management: We use your personal information to conduct payroll processing, salary administration, expense reimbursement, for Social Security and tax administration, and to manage First Orion’s compensation programs such as determining bonuses, equity, and other forms of employee compensation.
4. Benefits administration: We use the personal information we collect from you to administer benefits we provide, such as medical, dental, vision, retirement benefits, and other employee benefit programs.
5. General human resources management: We use the personal information we collect from you to provide general HR management services, including employee on-boarding, termination and separation, travel administration, and return-to-work screening (including any medical screening as required or permitted by applicable law).
6. Training and professional development: We use your personal information to provide employment-related training and assistance with professional licensing and development.
7. Internal employment processes: We use your personal information to conduct internal investigations, conduct surveys, resolve disputes, prevent or detect fraud or security incidents, conduct employee performance reviews, enforce our polices and code of conduct, protect the rights and safety of employees or others, and manage whistleblower programs.
8. Compliance with legal requirements and enforcement of our legal rights: We use your personal information to comply with applicable laws, regulations and legal processes (such as responding to subpoenas or court orders) and to respond to legal claims, resolve disputes, enforce our legal rights contained in employment or other contracts, and comply with legal or regulatory recordkeeping requirements.

4. Disclosure of Personal Information

We may share your personal information for the business purposes described in this Supplemental Notice with the following parties:

1. Affiliates and subsidiaries: We may share your personal information with our affiliates and subsidiaries.
2. Service Providers: We may share your personal information with service providers, such as recruiters, pre-employment screening services, third-party benefits administrators, payroll processors, background check providers and others.
3. Governmental authorities: As required by law or legal process, we may share your personal information with federal or state regulatory agencies, law enforcement, courts and other governmental authorities.
4. Professional advisors: We may share your personal information with our professional advisors, such as auditors and law firms.
5. Parties involved with business transfers: We may share your personal information with third parties in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

5. Employee Privacy Rights

Subject to verification of identity and the applicability of State Privacy Laws, you may have the following rights.

1. Right to Know: You can request information about the categories and specific pieces of personal information we have collected about you.
2. Right to Delete: You may request the deletion of personal information, subject to certain exceptions.
3. Right to Correct: You may request that we correct inaccurate personal information.
4. Right to Access and Portability: You may request a copy of your personal information.
5. Right to Opt Out of Sale/Sharing: Not applicable, as we do not sell/share employee data.

In accordance with our policies and procedures, we will not discriminate or retaliate against you if you choose to exercise any of your rights under State Privacy Laws.

To exercise your rights, or if you have any questions or concerns regarding this Supplemental Notice or the collection of your personal information, please contact: privacy@firstorion.com or (501) 358-4061.

First Orion Corp.
520 Main Street, Suite 400
North Little Rock, AR 72114
Attention: Privacy Officer