Vireo Worker Privacy Notice

Effective Date: September 2026

1. Overview

This privacy notice (“Notice”) applies to the collection and use of personal information (defined below) in the context of a California resident’s role as a work (whether as an employee, owner, director, or independent contractor) (“you”, or “your”) by Vireo Health, Inc. and Vireo Health, Inc. affiliates that provide products and services directly to consumers, including, but not limited to, Vireo Growth, Deep Roots Harvest, Proper Brands, WholesomeCo, Eaze, Everest, EveryDay Weed, Green Goods, Green Dragon, LivWell, R. Greenleaf, Schwazze, Standing Akimbo, Star Buds, Bridgewell, and Hawthrone and any Vireo Health subsidiaries that do not otherwise publish a separate worker privacy notice (collectively, “Vireo,” “we,” “us,” or “our”). This Notice only applies and the rights herein are restricted to California residents, unless otherwise required by applicable law.

This Notice describes:

The categories of personal information we collect about you;
The categories of sources from which we collect your personal information;
The purposes for which your personal information is used;
The categories of third parties to whom we may disclose your personal information;
The rights you have regarding your personal information; and
How to contact us if you have any questions regarding your personal information.

In this context, personal information generally means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (e.g. your name, telephone number, Employee ID number, or information defined as personal information under California privacy laws)¹. Processing means any activity relating to personal information, including, by way of example, collection, storage, use, consultation, disclosure, sharing and transmission.

In summary, we collect and process personal information about you in order to hire or engage you, pay you, provide you with and administer benefits (to the extent applicable), to pay taxes (to the extent applicable), and to ensure your safety and well-being.

This Notice is not an employment contract. If you are an employee, employment with Vireo is on an “at-will” basis, meaning that either you or Vireo may terminate your employment at any time, with or without cause or notice.

If you are an independent contractor, nothing in this Notice is meant to indicate that there is an employment relationship between you and Vireo or that all the data provided in this Notice is collected.

This Notice only applies to your role as a worker of Vireo. For consumer privacy policies, please reference our Privacy Policy.

Continue

2. What types of personal information do we collect and where do we get it from?

Your personal information that we collect may include the categories set forth in the chart below, in accordance with the principles outlined in this Notice. These categories and the definitions set forth in the table below are as defined by California’s privacy laws.

These categories also represent the categories of personal information that we have collected over the past 12 months and shared with our service providers, affiliates. Note that the categories listed below are defined by California state law. Inclusion of a category in the list below indicates only that we may collect some information within that category. It does not necessarily mean that we collect all information listed in a particular category. Information denoted with an * indicates sensitive personal information, which is further discussed in Paragraph 3.

Category of personal information collected	Categories of sources from which personal information is collected	Purpose of collecting/processing
Personal identifiers. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number*, or other similar identifiers.	You (directly or indirectly). Third party service providers (e.g., benefits providers). Government agencies and actors, and/or other third parties (e.g., former employers). Publicly available job or networking sites on which you post this information.	To administer your relationship with us, including meeting our legal obligations and providing you with benefits and services, as applicable.
Information About You. Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, your name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance notice number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
Characteristics of classes protected under federal or California law, including: familial status, disability, sex, national origin, religion, color, race, sexual orientation, gender identity and gender expression, marital status, veteran status, medical condition, ancestry, source of income, age, or genetic information.		To administer your relationship with us, including meeting our legal obligations, demonstrating the organization’s diversity and inclusion, and providing you with benefits and services, as applicable.
Usage Information. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet web site, application, or advertisement.²	You, typically through your use of cookies and similar technologies. Your interaction with Vireo’s devices and equipment.	To administer your relationship with us, including meeting our legal and compliance obligations and pursuing the efficient management and operation of our business, quality control and training purposes, manage productivity, to help detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and for compliance management.
Geolocation information.	Your interaction with Vireo’s devices and equipment.
Recordings. Audio, electronic, visual, thermal, olfactory, or similar information.	Internal and external CCTVs and geolocation monitors/devices Recording of customer service and/or sales calls. Your interaction with Vireo’s devices and equipment.
Professional or employment-related information.	You (directly or indirectly). Third party service providers (e.g., benefits providers). Government agencies and actors, and/or other third parties (e.g., former employers). Publicly available job or networking sites on which you post this information.	To administer your relationship with us, verify credentials, and to pursue the efficient management of our business.
Inferences drawn from other personal information: Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	You, typically through the use of online assessments. Publicly available job or networking sites.	To administer your relationship with us, including training and coaching purposes, to operate our business, and in order to help detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and for compliance management.
Biometric information.*³	Your interaction with equipment and/or mobile devices owned or managed by Vireo or by our service providers under our instructions.	To help detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and for compliance management.

3. Sensitive Personal Information

We do not use or disclose sensitive personal information we collect for purposes other than those generally permitted under California law, including as needed to perform our services, verify and maintain the quality and safety of our services, and resist fraud or illegal actions. Your sensitive personal information that we collect may include the categories set forth in the chart below, in accordance with the principles outlined in this Notice. These categories and the definitions set forth in the table below are as defined by California’s privacy laws.

Category of sensitive personal information collected	Categories of sources from which sensitive personal information is collected	Purpose of collecting/processing
Social security number, driver’s license number or other state ID number, and passport information.	You (directly or indirectly). Third party service providers (e.g., benefits providers). Government agencies and actors, and/or other third parties (e.g., former employers). Publicly available job or networking sites on which you post this information.	Social security number – to administer your relationship with us, particularly as it relates to taxation and background checks. Passport information – to verify your right to work, and it may be used to book travel for you or for other legal/regulatory obligations. Driver’s license number or other state ID – to verify identity as required under applicable laws, and if driving is a requisite for performance of your job duties, to ensure your suitability to drive and for insurance purposes.
Racial or ethnic origin, and religious or philosophical beliefs.		To administer your relationship with us, demonstrating the organization’s diversity and inclusion, and to meet our legal obligations.
Precise geolocation	Your interaction with equipment and/or mobile devices owned or managed by Vireo or by our service providers under our instructions.	To help detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and for compliance management. To administer your relationship with us and to operate our business.
Health Information i.e., personal information collected and analyzed concerning your health.	You (directly or indirectly). Third party service providers (e.g., benefits providers).	To manage our workforce, including to ascertain whether you may have been exposed to a virus in connection with a pandemic.
Mail, email, and text messages contents (except where we are the intended recipient of the communication).	Your interaction with equipment and/or mobile devices owned or managed by Vireo or by our service providers under our instructions.	To administer your relationship with us, including performance management, and in order to help detect security incidents, and for compliance management.
Genetic data.	You (directly or indirectly). Third party service providers (e.g., benefits providers).	To provide you with benefits and services, as applicable.
Personal information collected and analyzed concerning your sexual orientation.
Biometric information⁴	Your interaction with equipment and/or mobile devices owned or managed by Vireo or by our service providers under our instructions.	To help detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and for compliance management. To administer your relationship with us and to operate our business.

4. How we process your personal information

As noted in the above tables, we process personal information about you, in accordance with applicable law and this Notice, for the purposes of administering your relationship with us, administering our workforce generally, and running our business operations.

Processing for these general purposes includes, but is not limited to, processing for the following specific purposes:

To operate, manage, and maintain our business.
To manage the various aspects of your employment relationship.⁵
To manage your contractor relationship, as applicable.
To facilitate internal technical support.
To engage in corporate transactions requiring review of employee records, such as for evaluating potential mergers and acquisitions of Vireo.
To perform call and video monitoring (e.g., CCTV).
To assist an attorney, accountant, auditor, or similar professional advisor working on behalf of or with Vireo to evaluate Vireo’s legal or financial rights or capabilities.
To comply with a court or administrative order, subpoena, warrant, discovery request, or other lawful due process.
To provide assistance to a public body or law enforcement agency concerning an offense under federal or state law (i) to determine whether the offense has taken place, or (ii) to prepare for the laying of a charge or the prosecution of the offense.
To provide assistance to a third party to evaluate or execute a merger, acquisition, debt financing, sale of asset(s), or similar transaction, or within the context of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets.
To protect confidential information and trade secrets.
To detect and prevent fraud, and facilitate security.
To otherwise accomplish our business purposes and objectives, and comply with the law, legal process, and internal processes.

5. Who do we use your personal information

The broad classes of third parties to which we may transfer personal information about you in the above categories include:

Third Party Service Providers. We disclose your information, including your personal information, to third-party service providers for purposes of administering your relationship with us, including meeting our legal obligations, enforcing our legal rights, and providing you with benefits and services, as applicable. We also disclose your personal information to third-party service providers to pursue the efficient management of our business, as well as to help detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; and for compliance management.
Other Third Parties Where You Have Used or Directed Us to Disclose Your Personal Information. You may use or direct us to disclose your personal information to third parties. For example, you may use or direct us to disclose your personal information to our bank to provide you your earned wages via direct deposit.
Sharing For Protection of Us, You, and Others. We may share personal information with our tax advisors, legal advisors, and auditors, as well as when required or appropriate to: comply with law enforcement requests and legal process, such as a court order or subpoena; respond to your requests; or protect your, our, or others’ rights, property, or safety.
Merger or Sale. If all or a portion of Vireo, the site, or Vireo’s assets are sold or transferred, personal information and other information collected about you may be treated as an asset and transferred in accordance with this Privacy Notice.
Your Permission. We may also otherwise disclose your personal information with your permission.

We do not and do not intend to “sell” personal information about you or “share” it for cross-context behavioral advertising, as defined under applicable privacy law. We also have not done so for the last 12 months. In addition, we do not share the personal information with third parties for their direct marketing or advertising purposes.

For purposes of this Notice, “sold” means the disclosure of personal information for monetary or other valuable consideration and “cross-context behavioral advertising” means targeted advertising based on personal information obtained from your activity across businesses, distinctly‐branded websites, applications, or services, other than our websites and services with which you intentionally interact.

We will endeavor to ensure that all non-governmental third parties to which we transfer personal information about you agree, as part of their contract with us, to treat personal information about you in accordance with applicable privacy laws.

6. Data Retention

We store personal information about you in physical files or on computer systems operated by or under the instruction of Vireo, and/or in hard copy form at our premises or at off-site storage locations leased to Vireo.

In general, we aim to keep personal information only for as long as necessary and only for the reason(s) we collected it. It may be necessary to keep personal information longer than our official retention periods for legal or regulatory reasons, including litigation.

The same personal information about you may be included in more than one record and used for more than one purpose, each of which may be subject to different retention periods based on the factors listed above.

In addition, any personal information contained in any work-related correspondence (such as emails) or other records may be retained for longer periods depending on the retention period of the file in which your personal information is held.

7. Data Security

The security of your information is important to us. We have implemented reasonable security measures to protect the information, including without limitation, use of firewalls, encryption, cybersecurity controls, application controls and monitoring. No method of electronic storage or transmission over the Internet is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee complete security.

8. Your Privacy Rights

Right to Know – You may be entitled to request that we disclose to you personal information we have collected about you, the categories of sources from which we collected the information, the purposes of collecting the information, the categories of third parties with whom we have shared the information, the categories of personal information that we have shared with third parties for a business purpose, the categories of information sold, and the categories of third parties information is sold to. In some instances, you may have the right to receive the information about you in a portable and readily usable format. Before providing any of this information, we must be able to verify your identity.
Right to Opt-Out – You may have the right to opt-out of information sharing that constitutes “selling” or “sharing” personal information under California law.
Right to Limit –You may have the right to direct us to limit our use of your sensitive personal information to certain purposes.
Right to Deletion – Subject to certain conditions, you may be entitled to request that we delete personal information about you. Before deleting personal information, we must be able to verify your identity. We will not delete personal information about you when the information is required to fulfill a legal obligation, is necessary to exercise or defend legal claims, or where we are required or permitted to retain the information by law. For example, we cannot delete certain personal information about you while continuing to provide you with certain products and services or where we are legally required to retain certain information.
Right to Correction – You may be entitled to request that we correct inaccurate personal information. Before collecting personal information, we must be able to verify your identity. We will not correct personal information about you when the information is required to fulfill a legal obligation, is necessary to exercise or defend legal claims, or where we are required or permitted to retain the information as-is by law.

Data solely retained for data backup purposes is principally excluded from these rights until it is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose.

If you chose to exercise any of these rights, to the extent that they apply, privacy law prohibits us from discriminating or retaliating against you on the basis of choosing to exercise your privacy rights.

Please note that under applicable privacy law, we are only obligated to respond to personal information requests from the same California resident up to two times in a 12-month period. In addition, under applicable privacy law, and for the protection of your personal information, we may be limited in what personal information we can disclose.

Before providing information you request in accordance with these rights, we must be able to verify your identity. In order to verify your identity, you will need to submit information about yourself, including your name, contact information, and proof of identity. We will match this information against information we have previously collected about you or provided to you to verify your identity and your request. If we are unable to verify your identity as part of your request, we will not be able to satisfy your request. We are not obligated to collect additional information in order to enable you to verify your identity. For deletion requests, you will be required to submit a verifiable request for deletion and then confirm separately that you want personal information about you deleted.⁶

Information collected for purposes of verifying your request will only be used for verification. You can submit requests related to your personal information by submitting your request through our contact page.

9. Changes to this Notice

We may change this Notice at any time. The Notice, and any updates to the Notice, will be posted on this page. You may visit this page to view the most current version of the Notice. The date the Notice was last revised will appear at the top of the page as the effective date.

10. Contact Details

If you have any questions, concerns, complaints or suggestions regarding our Notice or the personal information collected about you, please contact us through our contact page.

Notes

California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et. seq., including as amended by the California Privacy Rights Act of 2020, and all regulations issued thereunder.↑ Back
As stated in Vireo’s Acceptable Use Notice, Vireo also reserves the right to monitor your internet or other similar network activity to the extent you use Vireo’s information systems or Vireo-owned electronic communication devices, or to the extent you use your personally-owned electronic communication devices to access Vireo’s information systems. This extends to personal (non-Vireo-owned) email boxes accessed through Vireo-owned or operated information systems or electronic communication devices.↑ Back
This includes physiological, biological or behavioral characteristics that can be used, singly or in combination with each other or with other identifying information, to establish individual identity.↑ Back
This includes physiological, biological or behavioral characteristics that can be used, singly or in combination with each other or with other identifying information, to establish individual identity.↑ Back
Examples include facilitation of onboarding, performance management, verification of identity and eligibility to work, disciplinary process management, employee relocation, background checks and drug tests, to the extent permitted by law, communication, reimbursements, payroll and benefits administration, health and safety management, trainings, attendance and time tracking, management of worker’s compensation claims, and compliance with federal, state, and local laws.↑ Back
If you would like to appoint an authorized agent to make a request on your behalf, you must provide the agent with written, signed permission to submit privacy right requests on your behalf. Alternatively, your authorized agent may provide evidence of having power of attorney or acting as a conservator for you.↑ Back

Reviews

Love love love this place! Great prices, great selection of products but the most important are 2 phenomenal ladies who work there KAELYN and ASIYA! Their advice is always so...

I’m so happy to have a dispensary open up in Henderson close to me. I have had great experiences with other locations and so grateful to have continued amazing service...

Hands down one of the best dispensaries in town. The budtenders actually KNOW their stuff and Miss Kim rocks Bonus: they carry Bangers 🔥 Always stocked and always fresh.

I’ve been to plenty of dispensaries across Las Vegas and California and met budtenders ranging from super knowledgeable to completely clueless. But I’ve never had such an awesome experience as...

Very clean store with great deals and lots of different of products! Jacey and Andrew were very helpful and friendly. Quick service! 5 stars!

I always have a great experience here at The Source. Their staff is always welcoming and helpful. My visit this time was definitely brightened by Tessa who was such a...

Excellent customer service! Tessa helped us out on the floor and answered all of our questions. Very knowledgeable and friendly, made sure we got everything that we needed. Then V...

One of the best dispensaries in town. Always super clean and friendly. Quality flower thats cheap. If you get Misz Kim as a budtender you’re in greats hands! (All the...

The Source continues to impress me every time I walk through the door. The entire staff is consistently friendly, helpful, and genuinely attentive, creating an environment where you feel welcomed...

Never ever do I have a problem at this place. Always an easy transaction and everyone is personable. Somehow though, I’m always paired with Michelle, she is incredibly knowledgeable and...

I had a great experience picking up my online order here. Tristan greeted me right away and made sure everything was correct. The vibe is always good – fast, easy,...

I love this dispensary! I’ve been going here since I first got my medical card around 5 years ago and the staff and vibe has always been amazing. Shout out...

Always an amazing time and I always get so much help with choosing the right product for me and Miguel is a an amazing guy, top tier 10/10 would recommend....

Love this place! Love the location. Staff is So nice and friendly…Casey is so Amazing. Definitely my new fav dispensary 😘

I want to thank Jacey, Haley, Edwin, and Brian for such a great experience at the source here in Pahrump. They really care about their customers Help me out on...

Always a great experience; the staff is friendly, they have frequent sales for holidays and the design is simple but clean. I usually see Michelle, who is a lovely cashier...

1. Overview

2. What types of personal information do we collect and where do we get it from?

3. Sensitive Personal Information

4. How we process your personal information

5. Who do we use your personal information

6. Data Retention

7. Data Security

8. Your Privacy Rights

9. Changes to this Notice

10. Contact Details

Notes

Links

Ways to Shop

Reviews

Download the App

Download the App

Locations

Company

Accessibility Statement

Our commitment and approach to maintaining an accessible website

1. Overview

2. What types of personal information do we collect and where do we get it from?

3. Sensitive Personal Information

4. How we process your personal information

5. Who do we use your personal information

6. Data Retention

7. Data Security

8. Your Privacy Rights

9. Changes to this Notice

10. Contact Details

Notes

Links

Ways to Shop

Reviews

Follow Us

Download the App

Download the App

Locations

Company

Follow Us

Accessibility Statement

Our commitment and approach to maintaining an accessible website