Krispy Kreme Applicant Privacy Policy

Last Updated: May 2025

The purpose of this Applicant Privacy Policy (“Policy”) is to inform job applicants (“Applicants” or “you”) of Krispy Kreme Doughnut Corporation (“Company,” “we,” “our,” or “us”) of our Personal Information handling practices and their data privacy rights.

For purposes of this Policy, “Personal Information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable person. Personal Information does not include deidentified and aggregated information (which includes data that is not reasonably capable of identifying you or being linked to you) and does not include certain publicly available information or consumer credit reports and background checks.

This Policy applies only to the Personal Information that we collect about you in connection with your application for employment.

1. Collection and Disclosure of Personal Information

We collect and retain different categories of Personal Information from Applicants. The following chart details which categories and specific types of Personal Information we collect and process, as well as which categories of Personal Information we disclose to third parties for our operational business and employment purposes, within the 12 months preceding the date this Policy was last updated:

2. Purposes for the Collection, Use, and Disclosure of Personal Information

Your Personal Information will be processed for the purposes listed below:

• To open and maintain your record, including:
  • Scheduling and conducting interviews;
  • Identifying Applicants, including by working with external recruiters;
  • Reviewing, assessing and verifying information provided, to conduct criminal and background checks (where relevant and pursuant to applicable law), and to otherwise screen or evaluate Applicants’ qualifications, suitability and relevant characteristics;
  • Extending offers, negotiating the terms of offers, and assessing salary and compensation matters;
  • Satisfying legal and regulatory obligations;
  • Communicating with Applicants regarding their applications and about other similar position(s) for which they may be interested;
  • Maintaining Applicants Personal Information for future consideration;
• To communicate with you;•To address our legal obligations, such as hiring eligibility and responding to subpoenas and court orders;
• To comply with applicable legal and regulatory requests and obligations (including investigations);
• To promote diversity initiatives and group affiliations;
• To establish or defend legal claims and allegations;
• To perform workforce analytics;
• For security purposes, including:
  • To prevent, detect or investigate fraud, suspected or actual illegal activity, violations of company policy or rules, or other misconduct;
  • To investigate security breaches and misuse of computer equipment and systems;
  • To protect our property from theft, vandalism and damage; and
• To seek advice from lawyers, auditors and other professional advisers.

3. Sources of Personal Information

We collect Personal Information you provide directly to us as well as information we obtain from other sources, such as third-party recruiting platforms, recruiters, background check providers (if permitted by local law), your former employers, references you provide, managers, and other information available about you through public sources, government/regulatory authorities, and widely distributed media.

4. Disclosure and Transfer of Your Personal Information

We disclose your Personal Information for the purposes set out in this Policy, to the following third parties for our operational and employment purposes:

• Affiliates, franchisees, and joint venture partners for purposes described in this Policy.
• Service providers, contractors or other like parties who provide services to us, including recruiting services and IT systems suppliers and support.
• Our business advisors, such as legal advisors, insurers, accountants and auditors, to the extent this is necessary for them to provide us with their professional services.
• Public and Governmental authorities to respond to requests and comply with applicable law.
• Unaffiliated third parties, if it is a part of a merger, divestiture or asset sale, insofar as it is necessary for the purposes of the merger, divestiture or asset sale.
• Unaffiliated third parties, if required by law or court order (e.g., tax authorities, social security agencies, enforcement agencies, or other governmental agencies).

We may partner with certain online recruiting and application management platforms to facilitate recruiting and hiring. Certain of your interactions with those platforms are governed by the privacy policies of those platforms. We do not control the information practices of those platforms. We encourage you to read and understand the privacy practices of those platforms.

5. Data Retention

We will retain Personal Information for the period necessary to fulfill the purposes outlined in this Policy or as permitted by law. The criteria used to determine our retention periods are: (1) duration of the application process; (2) as long as we have an ongoing relationship with you; (3) as required by a legal obligation to which we are subject; and (4) as advisable in light of our position (such as in regard to applicable statutes of limitation, litigation, or regulatory investigation).

6. Changes to this Policy

The “Last Updated” date at the top of this Policy indicates when this Policy was last updated. We review this Policy regularly and reserve the right to amend this Policy at any time in order to take account of changes in our recruitment, business, and legal requirements, and the manner in which we process Personal Information.

7. Contact Us

If you have any questions or requests, please feel free to contact us at 844-698-0864 or KKHR@krispykreme.com.

Because email communications are not always secure, please do not include sensitive information in your emails to us.

ADDITIONAL INFORMATION FOR CALIFORNIA APPLICANTS

This section applies to California residents pursuant to the California Consumer Privacy Act (“CCPA”), and supplements the information provided above to notify California residents of the processing of Personal Information.

Notice At Collection

1. Collection, Use, and Disclosure of Personal Information

We collect, use, and disclose Personal Information for the purposes outlined under to Section 1 (“Collection and Disclosure of Personal Information”) and Section 2 (“Purposes for the Collection, Use, and Disclosure of Personal Information”) above.

We do not “sell” or “share” your Personal Information, including your Sensitive Personal Information, as defined under the CCPA (“Sensitive Personal Information”). We have not engaged in such activities in the 12 months preceding the “Last Updated” date. Without limiting the above, we do not “sell” or “share” the Personal Information, including the Sensitive Personal Information, of minors under 16 years of age and have no actual knowledge of any such “sale” or “sharing.”

2. Purposes for the Collection, Use, and Disclosure of Sensitive Personal Information

We may collect and use your Sensitive Personal Information for purposes that include performing and providing services for our business, providing services as requested by you (such as opening and maintaining your records), and ensuring the security and integrity of our business, internal systems and facilities, conducting equal opportunity and diversity monitoring (where permitted or required by law), complying with legal obligations, and determining your eligibility to work and suitability for certain jobs or benefits (to the extent permitted or required by law).

Because we do not use your Sensitive Personal Information for purposes beyond these limited purposes (i.e., to provide human resources services and functions), there is no need for us to provide a Limit Use and Disclosure of Sensitive Personal Information right under California law.

3. Data Retention

We retain Personal Information and Sensitive Personal Information in line with the criteria outlined in Section 5 (“Data Retention”) above.

4. Sources of Personal Information

We collect Personal Information from you and other sources, as described in Section 3 (“Sources of Personal Information”) above.

5. Individual Rights and Requests

The CCPA affords California residents certain rights with respect to their Personal Information. Subject to certain exception and limitations, you have the following rights:

• Right to Delete. You have the right to request us to delete the Personal Information we have collected about you.
• Right to Correct. You have the right to request us to correct inaccurate Personal Information we maintain about you.
• Right to Know and Access. You have the right to know and access the Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.
• Right to Data Portability. You have the right to receive the information pursuant to a Right to Access request in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the Personal Information to a person without impediment, where the processing is carried out by automated means.

You may exercise your privacy rights by contacting us as outlined under Section 7 (“Contact Us”) above.

In some instances, we will need to verify your identity before honoring your privacy right request, as consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request. We may need to request first name, last name, state of residence, email, and phone number to verify your identity. If you make a request to delete, we may ask you to confirm your request before we delete your Personal Information.

We will try to comply with your privacy rights request as soon as reasonably practicable. We will not unlawfully discriminate against you for exercising your rights under the CCPA.

6. Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please Contact Us as outlined under Section 7 (“Contact Us”) above.