Last Revised: May 18, 2026

This Biometric Information Privacy Policy applies to all associates of National Gypsum Services Company d/b/a National Gypsum Company (“NGC”) and all corporate affiliates of NGC (each, a “Corporate Affiliate,” and collectively with NGC, the “Company”).

As of the date hereof, each of the following entities is a Corporate Affiliate:

Gold Bond Building Products, LLC; Gold Bond Canda, Ltd.; NG Corporate, LLC; PermaBASE Building Products, LLC; ProForm Finishing Products, LLC; and Unifix Inc., and the subsidiaries of each such entity, if any.

Definitions:

“Biometric Identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.

“Biometric Information” means any information, regardless of how it is captured, converted, stored or shared, based on an individual’s Biometric Identifier used to identify an individual.

Purpose for Collection of Biometric Information: The Company uses time clocks that capture a limited amount of fingerprint information in its timekeeping process to authenticate the identity of the Company’s associates and record the time that associates work each day (the “Time Clocks”). The Time Clocks are provided by a third-party service provider that is under contract with the Company (the “Time Clock Service Provider”). The Time Clock Service Provider collects, captures or otherwise obtains Biometric Information of the Company’s associates in connection with the use of the Time Clocks.

How the Time Clocks Work: Each associate of the Company will enroll a fingerprint in the Time Clock and subsequently scan the same fingerprint each time such associate clocks in or out of work. The Time Clocks capture a scan of the associate’s fingerprint during the initial enrollment. The enrolled fingerprint will be converted and stored as a data record that consists of a string of characters. The timekeeping process does not store an image of the fingerprint itself.

Purposes for which the Company Will Use Your Biometric Information: The Company and Time Clock Service Provider will use the collected Biometric Information for the following business purposes:

• to authenticate the associate’s identity;
• to record the time the associate works each day; and
• for payroll purposes.

Biometric Information will not otherwise be disclosed or disseminated, unless required by law or with the consent of the applicable associate. No party will be permitted to sell, lease, trade or otherwise profit from any Biometric Information.

Storage of Biometric Information: Biometric Information will be stored, transmitted and protected using a reasonable standard of care and in a manner that is the same as or more protective than the manner in which other confidential and sensitive information is stored, transmitted and protected.

Retention of Biometric Information: An individual’s Biometric Information will be retained until the earlier of (i) the date on which the initial purpose for collecting or obtaining such Biometric Information has been satisfied, such as the termination of such individual’s employment with the Company, or (ii) the date that is three (3) years from the individual’s last interaction with the Company. At such time, the Company will direct the Time Clock Service Provider to permanently destroy such individual’s Biometric Information.