Empower Personal Dashboard Privacy Policy

California Consumer Privacy Act (“CCPA”) Disclosures

Who does the CCPA apply to?

The CCPA provides certain rights to California residents (“you” or “your”). A description of our information privacy practices relating to the personal information of our California employees, applicants, and independent contractors is covered under a separate privacy policy which can be found here. 

What rights do I have under the CCPA?

Broadly speaking, the CCPA grants California residents the following rights:

1. a right to request that a business disclose the personal information that the business collects, uses, discloses, sells, and shares about you;
2. a right to request that a business correct inaccurate personal information that the business maintains about you;
3. a right to request that a business delete the personal information that the business has collected from you, subject to certain exceptions;
4. a right to request that a business limits the use and disclosure of your sensitive personal information;
5. a right to opt out of having your personal information sold or shared (as the term is defined in the CCPA) by a business; and
6. a right not to receive discriminatory or retaliatory treatment by a business for exercising your rights under the CCPA.

What personal information does Empower collect about California residents in connection with the Empower Personal Dashboard?

Empower collects and processes personal information in connection with the Empower Dashboard as required or permitted by law. Personal information means information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, device or household. Personal information does not include data that has been deidentified, data that is publicly available information, or information that is subject to certain federal laws that are excluded from the CCPA’s scope such as personal information subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), The Fair Credit Reporting Act (FCRA), the Driver’s Privacy Protection Act of 1994, or the California Financial Information Privacy Act (FIPA).

The chart below describes the categories of personal information that Empower may collect, as well as the categories of sources from which the information was collected.

Please note that we also disclose the types of information we collect earlier in our Privacy Policy. However, the CCPA requires that we provide this information with reference to certain categories described in the CCPA, so we are restating the information here. We retain personal information until all applicable legal and business obligations are fulfilled.

Note that we do not collect education, biometric, geolocation information, or inference data to create profiles about you from your personal information described above.

Sensitive Personal Information is a subcategory of Personal Information. The chart below describes the categories of Sensitive Personal Information that Empower has collected over the course of our relationship with you as well as the categories of sources from which the information was collected. We retain Sensitive Personal Information until all applicable legal and business obligations are fulfilled.

Categories of Sources of Information

(Y) Most of the personal information that we have is provided by you either (a) through our website, including information you enter into our website as well as information provided by your web browser or device, or (b) when speaking to an Empower advisor or customer service agent.
(SP) We receive information from service providers, such as data analytics providers, financial account aggregators and independent securities brokerage trading and clearing custodians or banking institutions, who help us provide services to you.
(TP) In some instances, we purchase information from third parties, such as direct mail collection agencies and affiliate marketing vendors. For example, we may purchase addresses for direct mail campaigns and sales leads from referral partners.

Business or Commercial Purpose for Collecting the Personal Information

We collect personal information for one or more of the following business or commercial purposes:

• Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Debugging to identify and repair errors that impair existing intended functionality.
• Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.
• Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
• Undertaking internal research for technological development and demonstration.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Categories of Third Parties with Whom We Disclose Personal Information

We disclose the information described above with service providers, such as independent securities brokerage trading and clearing custodians and Empower Cash program account partners, to the extent necessary to provide the services you have requested and for the business purposes described above.

Deidentified or Pseudonymous Data

We maintain and use deidentified data in such a way that any information can no longer be linked to you or any device associated with you. After data has been deidentified, i) we maintain and use such deidentified data without attempting to reidentify the data or re-associate it with specific individuals; ii) we take reasonable measures to ensure that the information cannot be reassociated with you or your household; and iii) we have implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information.

As described in our privacy policy, we may, from time to time, use anonymized or deidentified data to perform analysis on personal finance and related topics. Such findings may be shared with external publishers or published by us. We also authorize some of our service providers to use anonymized or deidentified information to provide services to us or improve their services generally.

Explanation of Your Rights

Right to Know what Personal Information is being Collected, Sold, or Disclosed for a Business Purpose

Subject to applicable exemptions in the CCPA, you have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal information. Once we receive and confirm your verifiable consumer request, to the extent required by the CCPA, we will disclose to you:

• The categories of personal information we collected about you;
• The categories of sources from which the personal information was collected;
• The business or commercial purpose for which we collected or sold the personal information;
• The categories of third parties with whom we share personal information;
• The categories of personal information that we sold, and for each category identified, the categories of third parties to whom we sold the particular category of personal information;
• The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of personal information; and
• The specific pieces of personal information we have collected about you.

Right to Request Deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will deidentify or delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Right to Correct Inaccurate Personal Information

You have the right to request correction of your personal information that is inaccurate. Once we receive your verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information as described in your request. You may be required to provide additional documentation if necessary to determine the accuracy of your personal information.

How Can I Exercise My Right to Opt Out of the Sale or Sharing of My Personal Information?

Empower does not sell or share any consumers’ personal information in any way that would require an opt-out; this includes the personal information of minors, as defined by law.

How Can I Exercise My Right to Limit the Use of my Sensitive Personal Information?

We limit the collection, use, and disclosure of your sensitive personal information to that which is necessary to provide our services to you or for another permitted purpose under the CCPA such as detecting security incidents and we do not use this information to infer characteristics about you. Our service providers are contractually obligated to limit their use and disclosure of your sensitive personal information to that which is necessary for the business purpose set forth in our contract with them.   Since we already limit the use of your sensitive personal information, an opt-out is not necessary.

How Can I Exercise My Rights Under the CCPA?

If you have an Empower dashboard account:

• Log into your account and go to Settings. Under the Privacy section, you will be able to request a report of the categories of information or specific information that we have collected about you or request that we delete your personal information.
• To correct any inaccurate personal information, please log onto your Empower dashboard account to manually update the applicable field for your Profile under “Settings” and/or contact support-epw@empower.com; additionally, if you are a Client, you can also contact your financial advisor. In most cases, we will be able to authenticate your request using your dashboard login. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

If you do not have an Empower dashboard account:

• Fill out a Privacy Request Form. 
• You will need to provide your full name, phone number, and email so that we can authenticate your request and locate your personal information If you previously had an Empower dashboard account, please provide the email and phone number you used to log into your dashboard.
• We will authenticate your request by matching the information you provide against any information that we have collected about you. However, in some cases, we may not have collected sufficient information about you to authenticate your request. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.
• Empower may deny your request in the event compliance with a request is not required due to applicable exemptions.

You may also exercise your CCPA rights by calling us toll-free at 855-855-8005.

How Can I Designate an Authorized Agent to Exercise My Rights Under the CCPA?

You may use an authorized agent to submit a request on your behalf. To do so, the authorized agent must provide a copy of your signed authorization to privacymatters@empower.com. You will also be required to verify your identity directly with us and confirm that you have provided the authorized agent with your permission to submit a request on your behalf.

Nondiscrimination & Nonretaliation

We will not discriminate or retaliate against you for exercising any of your CCPA rights. To the extent prohibited by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior consent, which you may revoke at any time.

Contact Information

If you have any questions about your rights under the CCPA, please contact privacymatters@empower.com.

Privacy Policy available for download here

Revised: February, 2023

Virginia Consumer Data Protection Act (“VCDPA”) Disclosures

Who does the VCDPA apply to?

The VCPDA provides certain rights to Virginia residents acting in an individual or household context (“you”). A description of our information privacy practices relating to the personal information of our Virginia  employees, applicants, and independent contractors is covered under a separate privacy policy which can be found here.

What rights do I have under the VCDPA?

Broadly speaking, the VCDPA grants you the following rights:

1. a right to confirm and access the processing of your personal data
2. a right to request that inaccuracies of your personal data be corrected
3. a right to request the deletion of personal data provided by you or obtained about you
4. a right to obtain a copy of personal data you provided in a portable and readily usable format to the extent technically feasible (also called a data portability request).
5. a right to opt out of certain processing activities as described in the ‘Right to Opt Out” section of this notice.
6. a right to appeal a decision made pursuant to a request to exercise these rights
7. Empower will not discriminate against you for exercising your consumer privacy rights.

Categories of Personal Data Collected and Processed

Empower collects and processes personal data as required or permitted by law. Personal data (also referred to as personal information) means any information that is linked to you or reasonably linkable to you such as your name, email or mailing address, phone number, account credentials (User id and passwords), social security number, government ID numbers and other information that can be used to identify you personally. Personal data does not include data that has been deidentified, data that is publicly available information, or data that is subject to certain federal laws that are excluded from the VCDPA’s scope such as personal data regulated under the federal Family Educational Rights and Privacy Act (FERPA), the federal Fair Credit Reporting Act (FCRA), the federal Driver’s Privacy Protection Act of 1994, or protected health information under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The chart below describes the categories of personal data we collect along with how we collect this information.  

Note that we do not collect education information, biometric data, geolocation information, or inference data to create profiles about you from the personal data described above.

Business or Commercial Purpose for Collecting Your Personal Data

We collect personal data for one or more of the following business or commercial purposes:

• Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Debugging to identify and repair errors that impair existing intended functionality.
• Short-term, transient use, provided that the personal data is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.
• Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
• Undertaking internal research for technological development and demonstration.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Categories of Personal Data Shared with Third Parties

The chart below describes what personal data may be shared with third parties.

Categories of Third Parties with Whom We Share Your Personal Data

We share the information described above with service providers, such as independent securities brokerage trading and clearing custodians, our marketing partners and Empower Capital Cash program account partners, to the extent necessary to provide the services you have requested and for the business purposes described above.

Deidentified or Pseudonymous Data

We maintain and use deidentified data in such a way that any information can no longer be linked to you or any device associated with you. After data has been deidentified, i) we maintain and use such deidentified data without attempting to reidentify the data or re-associate it with specific individuals; ii) we take reasonable measures to ensure that the information cannot be reassociated with you or your household; and iii) we have implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information.

As described in our privacy policy, we may, from time to time, use anonymized or deidentified data to perform analysis on personal finance and related topics. Such findings may be shared with external publishers or published by us. We also authorize some of our Service Providers to use anonymized or deidentified information to provide services to us or improve their services generally.

Right to Opt Out

You have the right to opt out of the sale of your personal data and the processing of your personal data for the purposes of targeted advertising or certain instances of profiling. We do not “sell” your personal data or engage in “targeted advertising” and “profiling” (as these terms are defined in the VCDPA) in any way that would require an opt out.

How do I Exercise my Rights Under the VCDPA?

If you have an Empower dashboard account:

• Log into your account and go to Settings. Under the Privacy section, you will be able to request a report of the categories of information or specific information that we have collected about you or request that we delete your personal data.
• To correct any inaccurate personal information, please log onto your Empower dashboard account to manually update the applicable field for your Profile under “Settings” and/or contact support-epw@empower.com; additionally, if you are a Client, you can also contact your financial advisor.
• To submit an appeal related to any of your rights granted under the VCDPA, please email us at privacymatters@empower.com with your request for appeal and any additional information that may be relevant to the request.  
• In most cases, we will be able to authenticate your request using your dashboard login. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

If you do not have an Empower dashboard account:

• Fill out a Privacy Request Form.
• You will need to provide your full name, phone number, and email so that we can authenticate your request and locate your Personal Data If you previously had an
• Dashboard account, please provide the email and phone number you used to log into your dashboard.
• We will authenticate your request by matching the information you provide against any information that we have collected about you. However, in some cases, we may not have collected sufficient information about you to authenticate your request. For example, if you are a site visitor but have never been a User, Cash Customer or Advisory Client, we will not have sufficient information about you to authenticate your request. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

Appeal Process

Upon receiving your request, we will respond to you within 45 days or notify you if the response period is being extended in accordance with applicable laws. If we decline to take action on your verifiable request, we will provide you with a notice that includes our reason for not taking action and instructions for submitting an appeal. Should you wish to submit an appeal, you will have 60 days from the date of the notice to do so. You may submit your appeal by emailing us at privacymatters@empower.com.

Contact Information

If you have any questions about your rights under the VCDPA, please contact us at privacymatters@empower.com.