Privacy Notice for California Employees, Applicants, and Independent Contractors

Empower Retirement, LLC and its affiliates (“Empower”, “us”, or “we”) take data privacy very seriously and are committed to protecting and respecting the privacy, security, and integrity of the personal information of our California employees, applicants, and independent contractors (“you” our “your”). In this policy, the terms “Empower,” “we”, “us” and “our” refer to each and all of the Empower family of companies listed in our online Privacy Policy. This notice describes how we collect, use, disclose, and retain your personal information. The information that we collect, and how we use it, depends on your relationship with us and may change as your relationship evolves with us. This Privacy Notice is organized based on the different types of workforce relationships as described below.

• Applicant: individuals who have expressed interest in applying for a job at Empower, have applied for a job at Empower, or are in the hiring process but have not yet been formally offered an employment position with Empower.

• Employee:  an individual currently employed by Empower.

• Independent Contractor: an individual who is self-employed and is contracted to provide services to Empower, or as otherwise defined by applicable law.

You may fall into more than one category concurrently depending on your relationship with us. For example, if you are an Applicant, you may become an Employee if that application results in the acceptance of a job offer. Any information that you provide as a customer or consumer of any services or products provided by Empower are separately covered by the applicable Terms of Use, online Privacy Policy, and/or client agreement. After your relationship with us ends, the terms of this notice shall continue to be applicable to your data for as long as we retain your data.

Categories of Personal Information We Collect

Empower collects your “personal information” or “personal data” (ie: information that when used alone or with other relevant data may be capable of personally identifying you, or as defined by applicable law). The table below describes the personal information we have collected and disclosed in the preceding 12 months and may continue to collect and disclose. In addition to the sources and categories of third parties listed below, we may also have obtained this information from our affiliates or if it was held by a business that we acquired. Likewise, we may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business. We do not “sell” or “share” your personal information as those terms are defined in the CCPA. We retain your personal information until all applicable legal and business obligations are fulfilled.

Sources for collecting your personal information

We obtain information directly from you and other sources. For example, we obtain information from forms you complete in the course of your employment with Empower (ie: employment application, onboarding documents, enrollment in benefits, records of professional development, etc.)  We may collect personal information from conversations or correspondence you have with a Human Resources representative or supervisor. We may also observe your actions from the internet or network activity from a company-owned device, as described above. In addition, we obtain some categories of personal information listed above directly from third parties. For example, prior to extending an offer of employment we conduct various background checks to confirm your eligibility of employment.

Disclosure of your personal information

We may disclose your personal information to a third party for the business purposes described above, such as determining employment eligibility, providing employee benefits, to ensure the security of our personnel and assets, and to comply with applicable laws. The chart below describes the categories of third parties with whom we share your personal information.

Deidentified or pseudonymous data

We maintain and use deidentified data in such a way that any information can no longer be linked to you or any device associated with you. After data has been deidentified, i) we maintain and use such deidentified data without attempting to reidentify the data or re-associate it with specific individuals; ii) we take reasonable measures to ensure that the information cannot be reassociated with you or your household; and iii) we have implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information. Such data is used for research and benchmarking purposes. We contractually obligate all recipients of the deidentified data to comply with applicable laws pertaining to deidentification and we monitor compliance with any contractual commitments.

Your rights and choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Right to know what personal information is being collected, sold, or disclosed for a business purpose

Subject to applicable exemptions in the CCPA, you have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal information.

Specifically, you have the right to request the following:

• The categories of personal information we collected about you;

• The categories of sources from which the personal information was collected;

• The business or commercial purpose for which we collected or sold the personal information;

• The categories of third parties with whom we share personal information;

• The categories of personal information that we sold, and for each category identified, the categories of third parties to whom we sold the particular category of personal information;

• The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of personal information; and

• The specific pieces of personal information we have collected about you.

Right to correct inaccurate personal information

You have the right to request correction of your personal information that is inaccurate. Once we receive your verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information as described in your request. You may be required to provide additional documentation if necessary to determine the accuracy of your personal information.

Right to opt out of the sale and sharing of your personal information

Empower does not sell your personal information in any way that would require an opt out. This includes the personal information of minors, as defined by law.

Right to limit the use and disclosure of sensitive personal information

We limit the collection, use, and disclosure of your sensitive personal information for permitted purposes under the CCPA and we do not use this information to infer characteristics about you.  Our service providers are contractually obligated to limit their use and disclosure of your sensitive personal information to that which is necessary for the business purpose set forth in our contract with them. Since we already limit the use of your sensitive personal information, an opt-out is not necessary.

Right to request deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will deidentify or delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Exercising your rights to know, correct, and delete

To submit a request please fill out the Privacy Request Form and email it to us at privacymatters@empower.comor call our toll-free number at 888-507-2828

You will need to provide your full name, phone number, email, and address so we can authenticate your request and locate your information. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must include sufficient detail that allows us to properly understand, evaluate, and respond to it.

When making a request, in order to maintain the security of your personal information and verify your identity, we may require you to call our service center or log in to your account to answer a few identity-related questions, including providing additional information about yourself. We may deny your request in the event there is an exception under applicable law or our record retention policy that pertains to your request, or if we are not able to verify your identity.

Designating an authorized agent

You may use an authorized agent to submit a request on your behalf. To do so, the authorized agent should provide a copy of your signed authorization to privacymatters@empower.com.  You will also be required to verify your identity directly with us or confirm that you provided the authorized agent with permission to submit a request on your behalf.

Responding to requests and your appeal rights

Upon receiving your request, we will confirm receipt of your request as required by applicable law. Such confirmation will include our verification process and when you should expect a response. We will respond to a verifiable consumer request as required by law. If we require more time (if permitted by applicable law), we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

If we decline to take action on your verifiable request, we will provide you with a notice that includes our reason for not taking action and instructions for submitting an appeal. Should you wish to submit an appeal, you will have 60 days from the date of the notice to do so. You may submit your appeal by emailing us at privacymatters@empower.com.

We will confirm receipt of a request to know, request to correct, or a request to delete as required by applicable law. Such confirmation will include our verification process and when you should expect a response. We endeavor to respond to a verifiable consumer request within 45 days of its receipt or as required by law. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Nondiscrimination & Nonretaliation

We will not discriminate or retaliate against you for exercising any of your CCPA rights.

Modifications to our Privacy Policy

We may change our privacy practices from time to time as the need arises. When we do, we will post the revised notice to our website. If there are material changes to this Privacy Policy, notice will be provided as permitted under applicable law including by electronic notice on our website, by posting a notice of the changes to your account, and/or through electronic delivery.

Requests, Questions, or Complaints

To submit privacy-related questions, requests, or complaints, please call our toll-free number at 855-756-4738 or send us an email at privacymatters@empower.com. Please do not put any confidential or personal account information in an email request. In addition, you may contact us by mail to the address below:

Empower

Attn: Vice President, Privacy Compliance

8525 E Orchard Rd, 2T3

Greenwood Village, CO 80111

Privacy notice available for download here.

Last updated: March 31, 2025