General

Carolina Investigative Research, Inc. (“CIR”) respects your concerns about maintaining the privacy of your personal data that is submitted to us by our clients in connection with the employment background and credential verification services that CIR provides to such clients. These clients are the current and prospective employers of individuals who have submitted personal data in connection with their current or prospective employment. This Privacy Policy covers all the information practices of CIR and describes the principles CIR will follow with regard to information submitted by our clients via the CIR web site and to other data that we collect from third parties and other sources in connection with the services we provide. These principles will be implemented by all CIR personnel regardless of their location. All data shall be collected, stored and used in compliance with applicable law, which may include the Fair Credit Reporting Act (“FCRA”), the European Union Data Protection Directive and other national laws.

CIR also respects the privacy of the personal data it processes on behalf of Carolina Investigative Research (“CIR”), for residents of the Member States of the European Union and in other countries where CIR has registered with data protection authorities, and to data they collect in those jurisdictions. This data is submitted in connection with the employment background and credential verification services that CIR provides to its clients. CIR’s clients are the current and prospective employers of individuals who either submit data through the CIR web site or who download forms from the CIR web site for the purpose of submitting personally identifying information in connection with those services. The privacy policy applicable to CIR may be found at the CIR section of the baionline.net site, after the user logs in to the site, and only applies to the data submitted by CIR’s clients’ prospective and current employees who reside in the Member States of the European Union and in other countries where CIR has registered with data protection authorities, and to data they collect in those jurisdictions.

CIR Is Committed to Privacy and Data Protection Around the World:

CIR acknowledges both the duty of trust and care that we have to maintain the privacy of personal data we collect and store and our legal obligations as a consumer reporting agency and as certifying that CIR complies with the “Safe Harbor” principles of the Department of Commerce, which apply to personal data collected in the European Union.

As a global company which does a considerable amount of business in the electronic marketplace, we believe that it is our responsibility to set industry-leading standards in our approach to the protection of personal data. We comply with federal, state and country-specific legal requirements applicable to the protection and dissemination of personal data.

Aggregated Information

Through this web site, CIR collects and stores non-personal information in aggregate form. The data are collected and stored for internal statistical purposes.

CIR also collects and stores individual data to maintain and issue a unique session ID for individuals while they are at this site.

Non-personal information includes:

• the browser type with which you access the Internet;
• the date and time you accessed the CIR site;
• the Internet address of the web site from which you linked directly to the CIR site; and
• information you view while visiting the CIR web site.

Personal Information

Whenever data is entered into or retrieved from the CIR website and with regard to data we collect from third parties and other sources for purposes of performing pre-employment screening and credential verification services, we apply the following principles:

Use and Transfer of Information:

Our clients provide us with your personal information through our web site in connection with our preparing a report for such clients. Such personal information may include your history of employment and other credentials related to your prospective employment. CIR will use such information only for the purposes of performing pre-employment screening and credential verification services, including to verify the accuracy of the personal information and to check on references. In addition to the data that is submitted to CIR by our clients, CIR may collect data from third parties, such as contact information, public records, biographical information, credit and other lawful checks. CIR may prepare interview notes, comments from references and a record of our contact with individuals. We may provide all such information to our client (your current or prospective employer) in one or more reports. CIR may also collect email correspondence from visitors to this site who send email to CIR.

In connection with these services, CIR may transfer personal data to CIR for the purposes of data processing. CIR complies with the European Union Data Protection Directive and applicable national laws, and is registered with all of the Data Protection Authorities of the countries in which it does business. In connection with our providing services, we may, in some instances, employ other companies and individuals, as our subcontractors, to perform functions on our behalf. All such contractors are contractually obligated to use and maintain the confidentiality of personal information in a manner consistent with this Privacy Policy. These companies may not share any such information with any third party, other than CIR’s subcontractors or clients. Except as described in this Privacy Policy, we will not use or otherwise disclose any of the personal data that you provide or that we collect from third parties or other sources.

Confidentiality:

We will never sell or provide personal data to a third party, except as provided in this Privacy Policy, without your express consent. Although we may hold or process your personal data that our client submits or that we collect from third parties or other sources. We may, however, disclose personal data in response to a court order or other legal obligation.

In the highly unlikely event that a liquidator, administrator or receiver is appointed over CIR or all or any part of our assets, we may transfer your information to a third-party purchaser of the business if that purchaser undertakes to only use your personal data as set out in this Privacy Policy.

Retention:

Pursuant to the FCRA, we must maintain any reports which we generate for a minimum period of two years. Reports generated using data collected in or originating from a European Union Member State shall not be kept longer than necessary for the purpose of meeting our obligations to our client and the law.
CIR will store data received from CIR for a period of six months, after which time the data will be purged. CIR preserves written copies of certain information that is submitted in conjunction with the above described services for a period of twelve months after CIR provides the information to its client, after which time the copies are destroyed.

Choice:

If you are a U.S. resident and you do not wish to have your personal data made available to our client (your current or prospective employer), please do not submit any such information to us through our client. By submitting information through, you are agreeing to CIR’s disclosure of information that is submitted about you to our client and to our sharing that information with CIR for the purpose of data processing, as described above, and to our subcontractors.

If you are an EU resident or reside in other countries where CIR has registered with data protection authorities, and to data they collect in those jurisdictions, you may choose not to submit personal information to CIR through its web site or through forms downloaded from its web site for that purpose. You have been provided a consent form either by CIR or by CIR’s client. By filling out and submitting the consent form, you expressly agree to provide personally-identifying information, and you consent to our use of that information in accordance with CIR’s privacy policy.

Accuracy:

Although we make every effort to ensure that the data we collect and store about you is as accurate as possible, CIR does not vouch for, and is not responsible for, the accuracy of data about you that may be supplied by our clients or any other third-party sources of information.
As provided in this Privacy Policy, you may have access (as described below) to personal data about you, including for the purpose of correcting any inaccuracies, pursuant to the FCRA and/or the European Union Data Protection Directive.

Access:

All subjects of consumer reports have the right of access to any reports CIR produces and maintains on them. You may contact CIR, as set out at the end of this Privacy Policy, at any time to determine whether we hold any personal information about you and to obtain access to that information. We will only afford you access to your data upon proof of identity, including proper verification and confirmation that you are the individual who is entitled to request access. If, for good reason, we are unable to provide you with access to your data or to correct data, we will let you know. Otherwise, we will mail to you if you are a U.S. resident a copy of the report about you within 7 days, as it has been provided to your current or prospective employer, at no charge (as mandated by the Fair Credit Reporting Act). CIR stores all personal information in electronic form.

If you are an EU resident or a resident of any other country where CIR conducts business and is registered with data protection authorities, you may contact us to determine whether we hold personal data about you, at any time for purposes of reviewing your personal information, for a nominal fee, which CIR uses to cover administrative costs, of not greater than the equivalent of $15 USD. If you wish to have access to that information or to correct information that you have already received from us, please communicate with the Carolina Investigative Research contact listed below. If for good reason, we are unable to provide you with access to your data or to correct your data, we will let you know. Where an employee referee has so determined, we will not be able to provide you with access to such information. If you request access to your data, we will mail you within 48 days a copy of the report about you, as it has been provided to your current or prospective employer.

Security:

CIR will take all appropriate measures to assure the security of personal data. CIR’s web site and any data transmitted to or from it are protected by a secure socket layer (SSL) key which encrypts the data. All data is stored on our servers in a secure, encrypted manner. Access to those servers is strictly limited to network administrators and other authorized personnel of CIR, who have been trained to protect against loss, misuse, unauthorized access, disclosure, alteration or destruction of personal data under CIR’s control. We take pride in our technology and our security policies.

CIR reserves the right to amend this Privacy Policy at any time without notice. If we decide to change this Privacy Policy, we will post those changes here so that you will always know how we will use the information that is collected about you. Regardless of any amendments to this Privacy Policy, we will never use your information in a material new way (a way not stated in the current privacy policy) without first providing you a direct and meaningful opportunity to opt-out or otherwise prevent that new use.

For More Information:

Ann Lane, President
Carolina Investigative Research Inc
106 D Fountain Brook Circle
Cary NC 27511
919-460-7799

(Effective 04/2005)