Last Updated: January 1, 2024

This EEA, UK and Switzerland Privacy Notice (“Notice”) explains how Paylocity complies with certain privacy rights specifically available to individuals located in the European Economic Area (including the EU) (“EEA”), United Kingdom (“UK”), or Switzerland. This Notice should be read together with our Privacy Statement, Cookie Policy, and our Terms of Service.

Lawful Bases for Processing Personal Information

The laws of your country require us to rely on certain conditions to process your information. When we process your information, we rely on the following conditions or “lawful bases”:

• Consent;
• Performance of our agreement to provide Services to you;
• Legitimate interests in providing the Services where those interests do not override your fundamental rights and freedoms related to data privacy; or
• Compliance with legal obligations to which we are subject.

Your Rights

• Right of Access. You have the right to obtain confirmation as to whether we are processing personal data about you, and if so, request a copy of the personal data. If you would like a copy of the personal data that we hold about you, please send a description of the personal data you would like a copy of and proof of your identity to our email as set forth below.
• Right of Portability. You have the right to receive personal data concerning you in a structured, common, and machine-readable format or request transmission of the data to a third party, if the conditions in Article 20 of the GDPR are met.
• Right to Correction. You have the right to correct any inaccuracies in the personal data that we hold about you and, where applicable, to complete any incomplete personal data that we hold.
• Right to Erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified. The right to erasure does not apply in certain circumstances, including where the processing is necessary for the establishment, exercise, or defense of legal claims.
• Right to Restriction. You have the right to restrict our processing of your personal data if one of the conditions in Article 18 of the GDPR applies.
• Right to Object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. We will no longer process the data, unless there are compelling legitimate grounds for our processing that override the interests, rights, and freedoms of the data subject, or the processing serves the purpose of asserting, exercising, or defending legal claims. You can object to marketing activities for any reason.
• Withdrawal of Consent. If you have consented to our use of personal information for a specific purpose, you have the right to change your mind at any time.

International Transfer

Paylocity is an organization established in the United States of America (USA). For individuals located outside the United States, your personal information will likely be transferred to, stored, and processed in

the USA or other countries outside of where you live. When we conduct such transfers, we rely on various legal bases to lawfully transfer personal information, including the European Union Commission-approved Standard Contractual Clauses (SCCs) and the United Kingdom’s International Data Transfer Agreement (IDTA).

In addition, Paylocity Corporation, Blue Marble Payroll, LLC, VidGrid Inc., TraceHQ.com, Inc. and Samepage Labs Inc., comply with the EU-US Data Privacy Framework (EU-US DPF), the UK Extension to the EU-US DPF (UK-US Data Bridge), and the Swiss-U.S. Data Privacy Framework (Swiss-US DPF) as set forth by the U.S. Department of Commerce. These entities have certified to the U.S. Department of Commerce that they adhere to the EU-U.S. Data Privacy Framework Principles (EU-US DPF Principles) with regard to the processing of personal information received from the European Union in reliance on the EU-US DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. These entities have certified to the US Department of Commerce that it adheres to the Swiss-US Data Privacy Framework Principles (Swiss-US DPF Principles) with regard to the processing of personal information received from Switzerland in reliance on the Swiss-US DPF. If there is any conflict between the terms in this privacy policy and the EU-US DPF Principles and/or the Swiss-US DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Pursuant to the Data Privacy Frameworks, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the Data Privacy Frameworks, should direct their query to privacy@paylocity.com. If requested to remove data, we will respond within a reasonable timeframe.

We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@paylocity.com.

Paylocity Corporation, Blue Marble Payroll, LLC, VidGrid Inc., TraceHQ.com, Inc. and Samepage Labs Inc. are responsible for the processing of personal information they receive or subsequently transfer to a third party acting as an agent on their behalf. These entities comply with all applicable data protection laws, including Data Privacy Framework Principles, for all onward transfers of Personal Information from the EEA, UK and Switzerland, including the onward transfer liability provisions in the Data Privacy Framework Principles.

With respect to personal information received or transferred pursuant to the Data Privacy Framework Principles, Paylocity Corporation, Blue Marble Payroll, LLC, VidGrid Inc., TraceHQ.com, Inc. and Samepage Labs Inc. are subject to the regulatory enforcement powers of the US Federal Trade Commission. In certain situations, these entities may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the Data Privacy Framework Principles, Paylocity Corporation, Blue Marble Payroll, LLC, VidGrid Inc., TraceHQ.com, Inc. and Samepage Labs Inc. commit to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, Swiss and United Kingdom individuals with DPF inquiries or complaints should first contact:

Privacy Officer
Paylocity Corporation
1400 American Lane
Schaumburg, IL 60173
833-436-6011

privacy@paylocity.com

Paylocity has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers  for more information and/or to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2.

If you have questions about our Data Privacy Framework certifications, please contact us at privacy@paylocity.com.

Questions or Complaints

If you have any questions about our privacy practices or believe that we have infringed your rights, we encourage you to contact us directly at:

Privacy Office
Paylocity Corporation
1400 American Lane
Schaumburg, IL 60173
833-436-6011

privacy@paylocity.com

Users that reside in the EEA, Switzerland, or the UK have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. You can find the relevant  data protection authority name and contact details for the EEA here, UK here, and Switzerland here.