Skip to main content Skip to footer site map

California Privacy Policy

Effective Date: 1/1/2023

This California Privacy Policy supplements the information contained in our Privacy Policy and is adopted to comply with the California Consumer Privacy Act (CCPA) 2018, Cal. Civil Code Section 1798.100 et. seq., as amended, and related regulations, as may be further amended from time to time (“CCPA Policy”). This CCPA Policy applies solely to visitors, users, Client’s employees, and/or others who reside in the State of California ("consumers") and to Clients. Any terms defined in the CCPA have the same meaning when used in this CCPA Policy. All other capitalized terms shall have the same meaning as those designated in the Paychex Privacy Policy. This CCPA Policy explains how Paychex, and our subsidiaries and affiliates, (“Paychex,” “we,” “us,” or “our”) collect, use. disclose and retain Personal Information, otherwise known as our Information Practices, and how consumers may exercise their rights under CCPA.

Paychex as a Service Provider

This CCPA Policy governs Personal Information collected, processed, or disclosed by Paychex as a Service Provider for our Clients and for our own purposes. Paychex will collect and process Personal Information as instructed or permitted by our Clients or in accordance with this CCPA Policy. For more information regarding this process, please see our CCPA FAQs.

What Information is Collected

The CCPA defines Personal Information as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household” but does not include certain exempt information, publicly available information, or deidentified or aggregated information. Paychex’ Information Practices include the collection and use of Personal Information as described in the Privacy Policy and as set forth below. This CCPA Policy applies to our Information Practices both online and offline. Paychex retains this information as set forth in the Privacy Policy. (See, Data Retention).

Our Purposes for the Collection and Use of Personal Information

We may collect Personal Information directly from Clients, affiliates, business partners, agents, vendors and consumers. Our collection of Personal Information is limited to the business and commercial purposes as described below:

  1. To facilitate current, prospective, or former employer requested Services, transactions, investments, distributions and/or benefits
  2. Administer and improve our Site
  3. Facilitate applicant tracking and recruitment
  4. Facilitate billing and collections
  5. Contact Clients and consumers with information on Services, new Services or products, or upcoming events, including via SMS or MMS text messaging if mobile phone number is provided for that purpose
  6. Offer advanced analytics and insights to help Clients with business planning and decision making
  7. Market our Services to Clients and consumers or for auditing our interactions
  8. Detect fraud or theft or for other security purposes
  9. Comply with legal, reporting, and regulatory requirements
  10. Maintain, manage, or service accounts
  11. Provide customer service or support
  12. Verify consumer identity as well as eligibility to receive Services, information, and products
  13. Research and develop technological improvements
  14. Send transactional communications as part of our Services
  15. Improve, upgrade, or enhance our Services
  16. Administer quality and safety maintenance for our Site or Services
  17. For other purposes that are compatible with this Privacy Policy or where permitted by applicable law
  18. In any other way we may describe when you provide the information, or for which you provide authorization

Sources of Collection of Personal Information

We collect Personal Information from the following sources:

  • When a Client provides it to Paychex to facilitate the processing of the Services
  • From you when you utilize the Site or Services
  • From applications, forms, webinars, surveys, and other information you provide us
  • If you provide us with comments or suggestions, request information about our Services, or contact our customer service or support departments via phone, email, chat or other forms of communication
  • From consumer and business reporting agencies regarding your creditworthiness or credit history
  • Between Paychex and third party vendors
  • From information you may provide via Social Media. For information regarding safe and productive participation in our social media community, view our Social Media Guidelines

Categories of Third Parties with Whom We Disclose Personal Information

We may use, disclose, or transmit Personal Information we collect to other service providers or other third parties for business purposes, to provide our Services, or for other purposes as provided by the CCPA as described below:

  1. Our affiliates, partners, or subsidiary organizations
  2. Government agencies to fulfill legal, reporting and regulatory requirements
  3. Attorneys, accountants and auditors
  4. Credit reporting agencies to supply vendor references on Client’s behalf or to provide credit related Services as requested by you
  5. Our employees, affiliated companies, subsidiaries, contractors, agents and third-party vendors to perform Services related to your account, to offer additional Services, perform analysis to determine qualification to receive future services, collect amounts due, or for our business operations
  6. Third-party providers for services that you may sign-up for via our Site or Services
  7. Banking and brokerage firms to process payroll-related and/or securities transactions
  8. To a buyer or successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred
  9. Credit bureaus and similar organizations, law enforcement or government officials. We reserve the right to release information if we are required to do so by law or if, in our business judgment, such disclosure is reasonably necessary to comply with any court order, law, or legal process, in a fraud investigation, an audit or examination
  10. Health and welfare providers in support of benefit Services
  11. Cloud providers, customer management platforms, security providers, and similar Services in connection with providing products, Services and in the support of daily operations
  12. Any other entity disclosed by Paychex when you provide the information, or for which you provide authorization

The chart below describes the categories of Personal Information collected in the previous twelve months, the business or commercial purposes for such collection, and the categories of third parties with whom we have disclosed Personal Information in the previous twelve months.

Category of Personal Information that We May Collect and Transmit Examples Collected During the Past 12 Months Business or Commercial Purpose(s) Categories of Third Parties with Whom We Disclosed Personal Information During Past 12 Months
Personal Information Full name, address, telephone number, social security number, date of birth, driver's license number, passport numbers, financial, bank account, geolocation data, medical and beneficiary information, signatures, vaccination related information, and similar identifiers Yes 1-18 A-L
Sensitive Personal Information Social security number, driver’s license, state ID card, passport number, a consumer account login, financial account, debit card or credit card number in combination with any: required security code, password, credentials allowing access to an account, a consumer’s precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of: a consumer’s mail, email and text messages (unless the business is the intended recipient), consumer’s genetic data, processing of biometric information for the purpose of uniquely identifying a consumer, Information collected and analyzed concerning a consumers health, sex life and sexual orientation Yes 1-4,6-12,14-18 A-L
Protected Personal Characteristics Age (40 years or older), race, color, ancestry, sex, gender identity, sexual orientation, national origin, marital status, veteran or military status, medical information (including medial conditions, disabilities), and similar identifiers Yes 1-4,6,7,9-12,14,15,17,18 A-C, E, F, H-L
Profession and Employment Related Information (job applicants) Employment history, job title(s), work descriptions, locations, dates worked, performance evaluations, and similar information Yes 1-7,9-12,14,15,17,18 A-C, E, F, H, I, K, L
Education Information (non-public) Institution name, degree, GPA, years attended, professional certifications, visa sponsorship and similar information No
Internet and Other Electronic Identifiers Unique user ID, browsing history, cookie data, IP address, unique device information, session logs, analytics logs, geolocation data, and similar identifiers Yes 1-3,5,7-13,15-18 A, C, E, F, H - L
Inference Information Profile reflecting preferences, characteristics or predispositions, product and service interests, order histories, search histories and similar information Yes 1,2,5,7,14,15,17,18 A, E, F, H, K, L
Biometric Information Iris, finger, facial scan, or voice used in the creation of identification templates for time products and voice assistance services Yes 1,8,10-12,15-18 A-C, E, H, I, L
Geolocation Data Physical location, Device coordinates/location, or movements Yes 1,10-12,15-18 A-C, E, H, I, L
Sensory Information Images, visual, thermal, olfactory information, audio or video recordings related to the services Yes 1,2,7-13,15-18 A-C, E, H, I, L

Categories of Personal Information Sold or Shared to Third Parties

Paychex does not sell or share Personal Information with Third Parties. We only make business purpose disclosures as detailed above and pursuant to written contracts that describe the purposes of use, require the recipient to keep Personal Information confidential, and prohibit using the disclosed information for any purpose except performing the contract.

Consumer Rights under CCPA

The CCPA provides consumers with specific rights regarding their Personal Information. This section explains how those rights may be exercised. Paychex is receiving requests directly from consumers on behalf of its Clients. As a Service Provider to our Clients, we may not be able to execute all requests. Consumers may wish to reach out to their employer or former employer when making such requests.

  1. Consumers have the right to request to certain information about our collection and use of Personal Information (the "Right to Know") or access to specific pieces of personal information (“Specific Request to Know”). Consumers may only submit two requests per a twelve-month period.
  2. Consumers have the right to request correction of Personal Information (“Right to Correct”). We have processes in place to allow consumers to correct Personal Information. Please see this information in our Privacy Policy (See, How to Access and Correct your Information). As of January 1, 2023, you may call our Consumer Request line* if you have additional questions regarding the ability to correct information.
  3. Consumers have the right to request deletion of Personal Information, subject to certain exceptions (the "Right to Delete"). Once we receive a request and confirm the consumer’s identity we will review the request to determine if an exception allowing us to retain the information applies. We may deny a deletion request if retaining the Personal Information is necessary for us to:
    • Complete the transaction(s) for which we collected the Personal Information including to provide Services to our Clients, provide a good or service that was requested, take actions reasonably anticipated within the context of our ongoing business relationship with our Clients, or otherwise to fulfill our contractual obligations; and/or
    • As otherwise allowed by the CCPA.
  4. We will not discriminate against consumers for exercising CCPA rights including refusing Services or offering different pricing models.

How To Exercise Rights Under CCPA

As of January 1, 2023 California consumers or authorized agents may submit a request in one of the following ways:

  1. By using our CCPA Request Form*
  2. By calling our CCPA Request line*

If you’re making a request as an Authorized Agent, the CA consumer must fill out and sign the CCPA Authorized Agent Form*, and you will need to attach a copy of the completed form to your request. If the request is submitted by someone with a power of attorney (POA), the POA may be submitted instead of the Authorized Agent Form.

When submitting a request under CCPA, we are required to reasonably validate the requestor to appropriately secure Personal Information. If we cannot validate the requestor based on the information provided, we will notify the requestor that we are unable to fulfill the request. We will only use Personal Information provided in the request to verify the requestor's identity or authority to make it. We will confirm receipt of a request within ten (10) business days. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period. We do not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will detail why we made that decision and provide a cost estimate before completing the request. If you have any other questions regarding this process, please see our CCPA FAQS.

Updates to this CCPA Policy

Please refer to this CCPA Policy regularly as it may be revised due to legislative changes, changes in technology or our privacy practices or new uses of customer information not previously disclosed in this CCPA Policy. Revisions are effective upon posting. If you have any comments, concerns or questions about this CCPA Policy, please contact Privacy_Office@paychex.com.

This CCPA Policy does not apply to current or former employees or independent contractors of Paychex.

Last Updated November 21, 2022

*Links and information to be provided on 1/1/2023

California Consumer Privacy Act (CCPA) FAQs

  • What is the California Consumer Privacy Act (CCPA)?

    What is the California Consumer Privacy Act (CCPA)?

    The California Consumer Privacy Act (CCPA) is California’s data privacy law that went into effect in January 2020 and provides California (CA) consumers with certain rights regarding their personal information. As of January 1, 2023, those rights are expanding to include the personal information of CA employees.

    If you’re a CA consumer, you have the right to make certain requests about the personal information collected, used, or disclosed about you.

  • How is Paychex involved?

    How is Paychex involved?

    Paychex is a leading provider of integrated human capital management solutions for payroll, benefits, human resources, and insurance services. If you’re coming to us with a CCPA request, that means you’re connected to a business that uses or used us as a service provider and directed us to collect your personal information.

  • What is a “service provider” under the CCPA?

    What is a “service provider” under the CCPA?

    A service provider is a person or entity that processes personal information on behalf of a business pursuant to a written contract. A service provider may receive information directly from a business or may collect information directly from a consumer on the business' behalf.

  • What types of requests can be made?

    What types of requests can be made?

    CA consumers may submit the following types of requests to Paychex as a service provider:

    1. Request to Know Categories of personal information collected
    2. Request to Know Specific personal information collected
    3. Request to Delete personal information
  • Who can make a request?

    Who can make a request?

    You must be a CA consumer to submit a request. Paychex is not accepting requests from consumers who do not live in CA. You can make a request yourself, or you can designate an authorized agent to make this request for you.

    Note: If you’re making a request as an authorized agent, the CA consumer must fill out and sign an Authorized Agent Form*, and you’ll need to attach a copy of the completed form to your request. If the request is submitted by someone with a power of attorney (POA), the POA may be submitted instead of the Authorized Agent Form.

  • How can I make a request?

    How can I make a request?

    You may not submit a request before January 1, 2023. As of January 1, 2023, you may use the following methods:

    To submit your request, you must complete and submit a CCPA Request Form*. We’ll use the information submitted in your request to verify your identity and to respond to your request. To make sure we can identify you, we recommend that you use the information we have in our system. If you have online access to one of our applications, you can log in and review your information. If you receive paper documents, check stubs, or W-2s from us you can review it there, too.

    As of January 1, 2023, you may also submit a request by calling our Consumer Request line. Note: We’ll need to gather all the same information contained on the CCPA Request Form during that call, so make sure you have your personal information ready.

  • What can I expect after I submit my request?

    What can I expect after I submit my request?

    After you submit a request, you’ll receive an email confirmation of receipt. That email will contain a Request ID number that you’ll want to retain in case you need to reach out to us with any questions on your request. We’ll attempt to provide a response within 45 days. If we can’t fully respond by that deadline, we’ll reach out and make you aware of next steps.

  • What if I received a response that you could not find me?

    What if I received a response that you could not find me?

    We may not be able to find you in our system(s) because we no longer have any of your personal information, or we may not have sufficient information to be able to verify you. If you believe that we recently collected your personal information, double check to ensure that you submitted your request accurately and that it matches the data that’s in our system(s). If not, you may want to submit a new request with the correct information.

  • Can I submit one of the above requests on behalf of my employee(s)?

    Can I submit one of the above requests on behalf of my employee(s)?

    No. Your employee(s) should submit their own request unless they have a POA or Authorized Agent form. This allows us to securely and directly validate the identity of the person making the request and confirm that the person we’re communicating with is authorized to receive a response to the request. This streamlined approach also removes the need for you to make such requests on behalf of your employee(s). If a CA employee contacts you with a CCPA consumer request for information about data collected as part of your Paychex services, please direct them to the Paychex Privacy Policy.

  • How do I correct information in your system that is not accurate?

    How do I correct information in your system that is not accurate?

    If you have online access to one of our applications, you may be able to change this information yourself. Otherwise, you may need to contact your employer or former employer as we got this information through them. Therefore, they need to work with us directly on the correction.

  • Why did I get a letter saying that you cannot delete my information?

    Why did I get a letter saying that you cannot delete my information?

    We strive to keep data only so long as we need it for business, legal, or regulatory purposes. If you received a letter saying we’re unable to delete your information, it may mean that we need to keep your personal information for one of those purposes so we cannot fulfill your request right now. It could also mean that your personal information was already destroyed, erased, aggregated, and/or deidentified. We receive your personal information because of the services we provide to employers, so you may want to contact that company directly to gain more information regarding your personal information.

  • How can I learn more about how you collect and process my information?

    How can I learn more about how you collect and process my information?

    You can learn more about our processes by exploring the resources below: