Privacy Policy

Effective Date: 05-13-2026

Last Updated: 05-13-2026

This Privacy Policy describes how Ōnin Staffing, LLC, and its subsidiaries and affiliates (collectively, “Ōnin Group,” “Company,” “we,” or “us”) collect and process personal information about consumers who visit our Website or otherwise interact with our services. This Privacy Policy provides a comprehensive description of our online and offline practices regarding our collection, use, sale, sharing, and retention of personal information, along with a description of the rights consumers have regarding their personal information.

Several states, including California, have enacted consumer privacy laws that grant their residents specific rights regarding personal information. We’ve structured this Privacy Policy to meet the requirements of the California Consumer Privacy Act (“CCPA”), which imposes the most detailed disclosure obligations among current state privacy laws, and we extend the core privacy rights described in this policy to all of our consumers regardless of where they reside. Where a specific right or obligation arises solely under a particular state law, we’ve noted that below. Any terms defined in the CCPA have the same meaning when used in this policy.

This Privacy Policy applies to information we collect on our website at oninstaffing.com (our “Website”), in email, text, and other electronic messages between you and the Website, and when you interact with our advertising and applications on third-party websites and services if those applications or advertising include links to this policy.

This Privacy Policy doesn’t apply to our collection and use of personal information in an employment capacity. Employees, job applicants, contractors, interns, or other workers seeking more information about our employment-related personal information policies and practices should contact Onin Human Resources.

1. Personal Information Collected

We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). Personal information doesn’t include:

• (a) Publicly available information, including from government records, through widely distributed media, or that the consumer made publicly available without restricting it to a specific audience.
• (b) Lawfully obtained, truthful information that is a matter of public concern.
• (c) Deidentified or aggregated consumer information.
• (d) Information excluded from the CCPA’s scope, including health or medical information covered by the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA).

1.1 Personal Information Categories Chart

The chart below identifies the categories of personal information we’ve collected from consumers within the last 12 months and the criteria we use to determine how long we retain each category.

1.2 Sensitive Personal Information Categories Chart

Sensitive personal information is a subtype of personal information consisting of the specific categories listed in the chart below. The CCPA treats this information as sensitive personal information when it’s collected or used to infer characteristics about a consumer.

The chart below identifies which sensitive personal information categories, if any, we’ve collected from consumers to infer characteristics about them in the last 12 months.

2. Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• (a) Directly from you, such as from the forms or other information you provide to the Company, including when you contact us about our staffing services, submit a job application, or request information.
• (b) Indirectly from you, such as from your interactions with the Company’s Website, including browsing activity, search queries, and information collected through cookies and similar tracking technologies.
• (c) From our service providers, such as data analytics providers (including Google Analytics), advertising networks, and customer service support providers.
• (d) From third-party advertising and social media platforms that place cookies or tracking technologies on our Website, such as Google, HubSpot, LinkedIn, Mapline, Podbean, and Microsoft.
• (e) Inferences generated by the Company’s or our service providers’ computer systems based on the information described above.

3. How We Use Personal Information

3.1 Personal Information Collection, Use, and Disclosure Purposes

We may use and disclose the personal information we collect to advance the Company’s business and commercial purposes, specifically to:

• (a) Present our Website and its contents to you and provide you with information, products, or services that you request from us, including our staffing services.
• (b) Meet our obligations and enforce our rights arising from any contracts with you, including for billing or collections, or to comply with legal requirements.
• (c) Fulfill the purposes for which you provided your personal information or that were described to you at collection, and as the CCPA otherwise permits.
• (d) Improve our products, services, marketing, and customer relationships and experiences.
• (e) Notify you about changes to our Website or any products or services we offer or provide through it.
• (f) Administer our systems and conduct internal operations, including for troubleshooting, data analysis, testing, research, statistical, and survey purposes.
• (g) Protect our Company, employees, or operations.
• (h) Estimate audience size and usage patterns, store information about your preferences, and recognize you when you return to our Website.
• (i) Manage your relationship with us, including online account creation, maintenance, and security, and reaching you when needed about your account.
• (j) Perform data analytics and benchmarking.
• (k) Engage in corporate transactions requiring review of consumer records, such as for evaluating potential mergers and acquisitions.
• (l) Comply with all applicable laws and regulations.
• (m) Exercise or defend the legal rights of the Company, its employees, affiliates, customers, contractors, and agents.
• (n) Respond to law enforcement requests and as required by applicable law or court order.

3.2 Sensitive Personal Information Use and Disclosure Purposes

We don’t use or disclose sensitive personal information for purposes other than the CCPA’s statutorily approved reasons (“Permitted SPI Purposes”). Because we limit our use of sensitive personal information to the Permitted SPI Purposes, we don’t currently offer a right to limit sensitive personal information use.

3.3 Additional Categories or Other Purposes

We won’t collect additional categories of personal information or use the personal information we’ve collected for materially different, unrelated, or incompatible purposes without providing you notice.

We may collect, process, and disclose aggregated or deidentified consumer information for any purpose without restriction. When we collect, process, or disclose aggregated or deidentified consumer information, we’ll maintain and use it in deidentified form and won’t attempt to reidentify the information, except to determine whether our deidentification processes satisfy applicable legal requirements.

4. Disclosing, Selling, or Sharing Personal Information

4.1 Business Purpose Disclosures

We may disclose the personal information we collect to service providers and contractors for the business purposes described in Section 3.1 and in the table below, such as to support our business functions. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, prohibit using the disclosed information for any purpose except performing the contract, and meet the CCPA’s other contract requirements for engaging service providers or contractors.

The chart below identifies the categories of entities to whom we’ve disclosed our consumers’ personal information for a business purpose over the preceding 12 months, along with the personal information categories disclosed and the disclosure’s business purposes.

4.2 Sharing Personal Information

We don’t sell your personal information to third parties and haven’t sold personal information in the preceding 12 months.

We do share certain personal information with third parties for cross-context behavioral advertising purposes. When you visit our Website and consent to the placement of advertising and analytics cookies, information about your browsing activity and device may be made available to third-party advertising and analytics platforms. Under the CCPA, this constitutes “sharing” of personal information, and similar state privacy laws may classify it as “targeted advertising.” You have the right to opt out of this activity regardless of your state of residence (see Section 5.4).

Our personal information sharing doesn’t include information about consumers we know are under age 16.

In addition to advertising networks and social media platforms, certain embedded third-party services on our Website collect visitor data and use it for their own advertising purposes. When these services use personal information collected from our visitors for advertising beyond what’s needed to provide their core functionality on our Website, that activity constitutes sharing under the CCPA and targeted advertising under other applicable state privacy laws.

The chart below identifies the categories of third parties with whom the Company has shared consumers’ personal information for cross-context behavioral advertising purposes over the preceding 12 months, along with the personal information categories shared and the purposes for sharing that information.

4.3 Cookies and Tracking Technologies. (QUESTION)

Our Website uses cookies and similar tracking technologies to collect information about your browsing activity. Cookies are small data files placed on your device that help us understand how visitors use our Website and improve your experience.

We use the following categories of cookies:

• (a) Necessary cookies, which are required for the Website to function properly and can't be turned off.
• (b) Preference cookies, which allow the Website to remember choices you've made (such as your language or region) and provide enhanced features.
• (c) Statistics cookies, which help us understand how visitors interact with the Website by collecting and reporting information about usage patterns. We use Google Analytics for this purpose.
• (d) Marketing cookies, which are used to track visitors across websites and display advertising that is relevant to you. These cookies are placed by third-party advertising platforms, including Google Ads, LinkedIn, and HubSpot. Our Website also uses embedded third-party services that place their own cookies when you interact with specific features. Mapline, which powers our branch location finder, places performance and marketing cookies, including Microsoft/Bing tracking cookies that the platform uses for its own retargeting and advertising purposes. Podbean, which hosts our podcast player, places cookies across multiple categories, including necessary, functional, analytics, and advertising cookies, with advertising data shared with Google and Microsoft/Bing for conversion tracking. Both services’ cookies are managed through our Cookiebot consent banner and won't load until you’ve provided consent.

We use Cookiebot as our consent management platform. When you visit our Website, the experience you see may vary based on your location.

• (a) If you’re visiting from California, you’ll see an option to accept cookies along with a ‘Do Not Sell or Share My Personal Information’ link that allows you to opt out of the sharing of your personal information through advertising and analytics cookies. You can also view specific cookies and their categories before making a choice. No non-essential cookies are placed until you make a selection.
• (b) If you’re visiting from outside California, you’ll see a consent banner that allows you to accept or decline different categories of cookies before they’re placed on your device.

Regardless of your location, you can manage your cookie preferences at any time through the cookie preference center accessible via the ‘Your California Privacy Choices’ link in our Website footer. This includes cookies placed by embedded third-party services such as our branch locator and podcast player.

For more information about how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.

5. Your Rights and Choices

We believe all of our consumers should have meaningful control over their personal information. The rights described below are required by the CCPA for California residents, and many of these same rights are provided by other state consumer privacy laws. We extend these core privacy rights to all consumers who visit our Website or otherwise interact with our services, regardless of state of residence. Where applicable law provides additional or different rights for residents of a specific state, we’ve noted that in Section 5.7.

5.1 Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information (the “right to know”), including the specific pieces of personal information we’ve collected about you (a “data portability request”). Our response will cover the 12-month period preceding the request, although we’ll honor requests to cover longer periods that don’t extend past January 1, 2022, unless doing so would be impossible or involves disproportionate effort. You may exercise your right to know twice in any 12-month period. Once we receive your request and confirm your identity (see Section 6), we’ll disclose to you:

• (a) The categories of personal information we collected about you, and the categories of sources from which we collected your personal information.
• (b) The business or commercial purpose for collecting your personal information and, if applicable, sharing your personal information.
• (c) If applicable, the categories of persons, including third parties, to whom we disclosed your personal information, including separate disclosures identifying the categories of your personal information that we disclosed for a business purpose to each category of persons and shared with each category of third parties.
• (d) When your right to know submission includes a data portability request, a copy of your personal information, subject to any permitted redactions.

5.2 Right to Delete and Right to Correct

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions and limitations (the “right to delete”). Once we receive your request and confirm your identity, we’ll delete your personal information from our systems unless an exception allows us to retain it. We’ll also notify our service providers, contractors, and other recipients to take appropriate action.

You also have the right to request correction of personal information we maintain about you that you believe is inaccurate (the “right to correct”). We may require you to provide documentation, if needed, to confirm your identity and support your claim that the information is inaccurate. Unless an exception applies, we’ll correct personal information that our review determines is inaccurate and notify our service providers, contractors, and other recipients to take appropriate action.

5.3 Right to Limit Sensitive Personal Information

As we don’t use or disclose sensitive personal information beyond the CCPA’s Permitted SPI Purposes, we don’t currently provide this consumer right. For more on the Permitted SPI Purposes, see Section 3.2.

5.4 Personal Information Sharing Opt-Out and Opt-In Rights

You have the right to request that we stop sharing your personal information for cross-context behavioral advertising at any time (the “right to opt-out”), including through a user-enabled opt-out preference signal. The CCPA also prohibits us from sharing the personal information of consumers we actually know are under 16 years old without first obtaining consent from consumers who are between 13 and 15 years old or the consumer’s parent or guardian for consumers under age 13 (the “right to opt-in”).

We can’t share your personal information after we receive your request to opt-out unless you later consent to the sharing of your personal information. For more on exercising your opt-out rights, see Section 6.2.

5.5 Automated Decision-Making Technology (ADMT) Rights

We don’t currently use automated decision-making technology (ADMT) to make significant decisions about consumers through our Website. Accordingly, we don’t currently provide ADMT access, opt-out, or appeal rights. We’ll update this policy if our practices change.

5.6 Right to Non-Discrimination

You have the right not to be discriminated or retaliated against for exercising any of your privacy rights described in this policy.

5.7 Additional State-Specific Privacy Rights

In addition to the rights described above, residents of certain states may have additional rights under their state’s consumer privacy laws.

California. The rights described in Sections 5.1 through 5.6 are provided to California residents under the CCPA (Cal. Civ. Code §§ 1798.100 to 1798.199.100). California residents may exercise the right to know twice in any 12-month period, and we’ll respond to verifiable requests within the timeframes specified in Section 6. California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) also permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us using the methods in Section 10.

Other States. Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with consumer privacy laws in effect may have rights to confirm whether we process their personal information, access and delete certain personal information, correct inaccuracies, request data portability, and opt out of personal data processing for targeted advertising, sales, or profiling. The exact scope of these rights varies by state. To exercise any of these rights, please contact us using the methods described in Section 6. If we decline your request, you may appeal that decision by contacting us using the methods in Section 6.1, identifying the original request, and explaining the basis for your appeal. We will respond to your appeal within 45 days. If we deny your appeal, we will provide you with information on how to contact your state’s attorney general to submit a complaint.

Nevada. Nevada residents have a limited right to opt out of certain personal information sales. Residents who wish to exercise this opt-out right may submit a request using the contact methods in Section 10. However, we don’t currently sell data triggering that statute’s opt-out requirements.

6. How to Exercise Your Rights

6.1 Exercising the Rights to Know, Delete, or Correct

To exercise the right to know (including data portability), delete, or correct described above, please submit a verifiable request to us by either:

• (a) Calling us at 877-280-5664.
• (b) Emailing us at info@oningroup.com.
• (c) Writing to us at: The Ōnin Group, Attn: IT Department, 3800 Colonnade Pkwy, #300, Birmingham, AL 35243.

Please describe your request with sufficient detail so we can properly understand, evaluate, and respond to it. You or your authorized agent may only submit a request to know, including for data portability, twice in a 12-month period.

6.2 Exercising the Right to Opt-Out

You can submit your request to opt-out of personal information sharing for cross-context behavioral advertising through:

• (a) The “Your California Privacy Choices” link on our Website footer, which provides an interactive mechanism to opt out of both sharing and the use of advertising cookies.
• (b) Emailing info@oningroup.com.
• (c) Calling 877-280-5664.
• (d) Sending a request to The Ōnin Group, Attn: IT Department, 3800 Colonnade Pkwy, #300, Birmingham, AL 35243.

You can also submit your request to opt-out of personal information sharing through an opt-out preference signal. We recognize the Global Privacy Control (GPC) signal as a valid opt-out preference signal. If your browser or device sends a GPC signal, we’ll treat it as a valid request to opt-out of sharing your personal information for cross-context behavioral advertising for that browser or device.

The GPC signal applies only to the specific browser or device transmitting the signal. It doesn’t automatically extend to any account you may have with us or to information we’ve collected through offline interactions. If you would like to opt out of sharing for your account or for information collected offline, please submit a separate request using the methods described above. Our Website doesn’t currently respond to “Do Not Track” browser signals. We recommend using the GPC signal or the opt-out mechanisms described in this Section 6.2 to manage your sharing preferences.

6.3 Verification Process and Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct related to your personal information. You may designate an authorized agent to make a request on your behalf by providing the agent with written permission signed by you. When an authorized agent submits a request, we may require the agent to provide proof of that written authorization (such as a signed letter or power of attorney), and we may independently verify your identity before processing the request. To submit a request through an authorized agent, the agent should contact us using the methods described in Section 6.1.

We can’t respond to your request to know, delete, or correct if we can’t verify your identity or authority to make the request and confirm the personal information relating to you. We’ll only use personal information provided in the request to verify the requestor’s identity or authority to make the request.

For requests to opt-out, we’ll ask for the information necessary to complete the request, which may include your name, email address, or other identifying information.

6.4 Responding to Your Requests

We will confirm receipt of your request within ten business days. If you don’t receive confirmation within that timeframe, please contact us at info@oningroup.com.

We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we’ll inform you of the reason and extension period in writing. Our substantive response will tell you whether or not we’ve complied with your request. If we can’t comply with your request in whole or in part, we’ll explain the reason, subject to any legal or regulatory restrictions.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another without hindrance.

We don’t charge a fee to process or respond to your verifiable request unless it’s excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we’ll tell you why we made that decision and provide you with a cost estimate before completing your request.

6.5 Response and Timing on Opt-Out Requests

In response to your request to opt-out, we’ll process your request as soon as feasibly possible, but no later than 15 business days from the date we receive the request. We’ll only use personal information provided from your request to comply with the request.

We’ll also notify our service providers, contractors, and certain other downstream recipients of your request to opt-out and instruct them to comply with your request and forward the request to their own downstream recipients, if applicable.

Once you make a request to opt-out, we’ll wait at least 12 months before asking you to reauthorize personal information sharing. However, you may change your mind and opt back in at any time by contacting us using the methods described above or by adjusting your cookie preferences through our Website’s cookie consent mechanism.

7. How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we can’t guarantee the security of your personal data transmitted to, through, using, or in connection with our Website.

The safety and security of your information also depends on you. Where we’ve given you (or where you’ve chosen) a password for access to certain parts of our Website, you’re responsible for keeping this password confidential. We ask you not to share your password with anyone.

Any transmission of personal data is at your own risk.

8. Children Under the Age of 16

Our Website isn’t intended for children under 16 years of age. No one under age 16 may provide any personal information to or on the Website. We don’t knowingly collect personal information from children under 16. If you’re under 16, don’t use or provide any information on this Website or through any of its features. If we learn we’ve collected or received personal information from a child under 16 without verification of parental consent, we’ll delete that information. If you believe we might have any information from or about a child under 16, please contact us at info@oningroup.com.

9. Privacy Policy Changes

We reserve the right to update this Privacy Policy at any time as we continue to develop our compliance program in response to legal developments under the CCPA and other applicable state privacy laws. If we make any material changes to this Privacy Policy, we’ll update the policy’s effective date and post the updated policy on our Website. We encourage you to check our Website periodically to review the current Privacy Policy in effect.

10. Contact Information

If you have any questions or comments about this policy, the ways in which we collect and use your information described here, your choices and rights regarding such use, or wish to exercise your rights under applicable state privacy law, please don’t hesitate to contact us at:

Phone: 877-280-5664

Email: info@oningroup.com

Postal Address:

The Ōnin Group

Attn: IT Department

3800 Colonnade Pkwy, #300

Birmingham, AL 35243

If you need to access this Privacy Policy in an alternative format due to a disability, please contact info@oningroup.com or 877-280-5664.