Empower Personal Dashboard Privacy Policy

This Empower Personal Dashboard^TMPrivacy Policy (the “Privacy Policy”) describes the specific policies and procedures we use to collect, utilize, disclose, share and protect your Personal Information in your use of the Empower Dashboard. Empower Personal Wealth, LLC (“Empower”, “we”, “us” or “our”) is a Delaware corporation and a wholly owned subsidiary of Empower Annuity Insurance Company of America. Together with our Terms of Use, this Privacy Policy governs your use of the Empower Personal Dashboard. Please note that this Privacy Policy pertains only to your use of the Dashboard; Empower maintains a separate policy applicable to its other services and products that may be viewed at Empower Privacy policy.

Empower is committed to the protection of our Visitors, Users, Cash Customers and Advisory Clients (also referred to as “you” or “your”) privacy. We understand that keeping your information secure and confidential is critical to earning and keeping your trust.

How to Use this Empower Personal Dashboard Privacy Policy

This Privacy Policy governs your use of the Empower Personal Dashboard and describes how we collect and use your Personal Information and how we address other privacy matters such as deletion of your Personal Information upon request and optingout of marketing communications. We also describe methods for contacting Empower, if you have privacy questions, comments or feedback.

The information that we collect, and how we use it, depends on your relationship with us and may change as your relationship evolves with us. This Privacy Policy is organized based on those different types of relationships – Visitors, Users, Cash Customers, and Advisory Clients.

Visitors - Individuals who visit our public website without logging into an account or using our services
Users - Individuals who establish an account with us or otherwise use our service offerings, including our financial dashboard software
Cash Customers - Individuals who open an Empower Cash account
Advisory Clients - Individuals who become clients of our Wealth Management and financial advisory services and establish an Empower managed investment account

You may fall into more than one category concurrently depending on your relationship with us. For example, a Cash Customer may also be a Visitor before they log into their Empower dashboard, wherein they will also be a User.

How We Collect and Use Your Information

“Personal Information” means your personallyidentifiable information such as your name, email or mailing address, phone number, account credentials (User id and passwords), Social Security number, government ID numbers and other information that can be used to identify you personally.

We also collect and use other information that we obtain from your activities using our services. This includes information that you do not explicitly provide to us, but which may be implicitly provided to us as part of such activities. More information on this is provided below under the Visitors use case.

The following describes in further detail the information we collect at various stages of our relationship with you.

Visitors

When you visit any of our websites, including our blog, or download our apps, we consider you a Visitor. This section describes our privacy practices related to this use case.

What do we collect?	Why do we collect it?	Can you limit?
First-party cookies	To recognize you when you make a return visit and deliver overall a consistent experience	Most modern browsers allow you to delete or limit cookies.
Third-party tags and Cookies	To measure our marketing effectiveness	Most modern browsers allow you to delete or limit cookies, including third-party cookies; however, you may not be able to limit marketing tags entirely unless you do not visit our sites.
Internet Protocol (IP) address	As part of the basic function of the internet To measure who is visiting us and where they are from	The only way to avoid this is not visiting our sites.
Browser metadata such as browser type, version, your operating system, system language, etc.	As part of the basic function of the internet To ensure we maintain a positive website experience for most, used browsers	Browsers communicate this automatically however some third-party extensions may allow you to limit this.
Survey responses such as retirement goals, opinions on market trends, and contact information	To collect information about our products and services To gain insights into financial trends and opinions and conduct anonymized and aggregated research on these trends To provide aggregated survey results and promotional offers To market our products and services to you	Yes, answering survey questions is always optional.

Users

When you register, create a User Account on the Empower Dashboard, and begin using our services, we consider you a User. This section describes our privacy practices related to this use case. Keep in mind Users are also considered Visitors, so this section describes information that we collect in addition to what was described for Visitors.

What do we collect?	Why do we collect it?	Can you limit?
Email and Password	To establish your account and allow you secure access to it So we can email you about service updates, maintenance activities, security notifications, weekly summaries, and other account related information So we can email you about service and/or product offerings, surveys, and other marketing promotions To allow our support team to contact you if needed	No, this is required to have a functioning account. You can opt out of marketing emails; see the Opt-Out section.
Phone Number	To secure your account with our multifactor authentication To contact you via phone or text message to recommend services and/or product offerings To allow our support or security team to contact you if needed	No, we require this for security purposes. You can, however, request to be placed on our Do Not Call list. See the Opt-Out section.
[Optional] Financial Planning Information Includes information you provide about your financial planning goals, such as your age, income, retirement age, retirement plan information, risk tolerance, family information and other demographic or related information. This also includes any other information you provide within your User Account, such as the address of any property you own and the value of any manually entered accounts.	To provide you our free retirement planner service and design your personalized retirement plan To provide you our free Investment Checkup service and perform an analysis of your investments (or other product features) If you qualify, to provide you with a free financial consultation with one of our investment advisors To recommend Empower products and services that may be of interest to you To customize your User experience To conduct and publish anonymized, aggregated research on personal finance trends	Yes, these are optional services which you are free to use or not use.
[Optional] Financial account information For third-party financial accounts you link - this includes your account credentials, passwords, security questions, transactions, balances, assets held, statements, and other account information.	To provide you the holistic view of all of your finances in the Empower Dashboard To provide you our free financial planning tools, such as our Cash Flow tool, budget tool and others To allow background automatic refreshes of your data so that your Dashboard is always up to date To recommend Empower products and services that may be of interest to you To customize your User experience To conduct and publish anonymized, aggregated research on personal finance trends	Yes, these are optional services you are free to use or not use.
[Optional] Postal code information	To measure the efficacy of our marketing efforts in recommending Empower products and services that may be of interest to you	Yes, it is optional to input your postal code information.
Product use information	To monitor and maintain system performance To identify most popular features and inform new features development To personalize your experience with Empower To recommend Empower products and services	No, if you are a User, we will collect this information.

Empower Cash Customers

Personal Capital Services Corporation (“PCSC”) manages our Empower Personal Cash^TM program, which provides services to customers who have opened an Empower Personal Cash account. If you are opening an Empower Cash account, we consider you an Empower Cash Customer. Empower Cash Customers are also considered Users and Visitors and may also be Advisory Clients, so this section describes the information that we collect in addition to what is described in the section for Users and Visitors, respectively. For further privacy information relevant to Empower Cash Customers, please see the Privacy Notice at the end of this document.

What do we collect?

Why do we collect it?

Can you limit?

Detailed account Information

Name
Date of birth
Social Security number
Physical and mailing address
State ID, driver’s license, or passport number
Citizenship and country of birth
Income and other financial information
Occupation
Account & routing number plus contact, titling and fraud information for accounts you want to move funds to or from
Other required personal information

To verify your identity and develop a behavior profile to enable us to better prevent fraud
To facilitate the opening of an Empower Cash account on your behalf, with our selected bank partners
To enable our bank partners to comply with their customer identification programs to combat money laundering and prevent financial fraud
To provide ongoing information required to provide continuing services to you
To recommend Empower products and services that may be of interest to you
To satisfy legal and regulatory requirements

Yes, becoming an Empower Cash Customer is entirely voluntary. If you opt to become an Empower Cash Customer, this information is required.

Advisory Clients

Personal Capital Advisors Corporation (“PCAC”) provides discretionary and non-discretionary investment advisory services to retail investors, and operates as an investment adviser registered with the Securities and Exchange Commission (“the SEC”) under the Investment Advisers Act of 1940, as amended. Any investment advisory services are offered only by PCAC*. *Effective on or around April 3, 2023, PCAC will merge, or will have merged, as applicable, with Empower Advisory Group, LLC (known as “EAG”), an investment adviser registered with the SEC and affiliate of Empower (the “Merger”). Following the Merger, EAG shall be the provider of investment advisory services to PCAC’s Clients (as hereinafter defined). If you are opening a Wealth Management advisory account with us through the Empower Dashboard and utilizing our fee-based advisory service, we consider you an Advisory Client. Advisory Clients are also considered Users and Visitors and may also be Empower Cash Customers, so this section describes information that we collect in addition to what was described previously, as applicable. For further privacy information relevant to Advisory Clients, please see the Privacy Notice at the end of this document.

As part of our relationship with you as an Advisory Client, we will utilize the information we have on your financial dashboard in order to provide you with our holistic financial advice. We may also, at your request or as appropriate for your situation and needs, recommend third-party services to you.

What do we collect?

Why do we collect it?

Can you limit?

Detailed account information

Name
Social Security number
Mailing address
Tax planning information
Transferred securities information, such as cost basis
Your beneficiaries
Contact information for investment accounts or banks you want to move funds from
Your investment objectives, if not previously collected
Other required personal information

To open an account on your behalf with an independent securities brokerage trading and clearing custodian account or banking institution
To fund your accounts with your other investments assets or cash
To provide the independent broker or banking institution with ongoing information required to provide continuing services to you
To perform tax analysis on the movement of assets, if applicable
To design, implement, and manage your investment portfolio strategy
Providing you with account statements, trade confirmations, tax information and other notifications related to the Advisory Service
To satisfy legal and regulatory requirements

Yes, becoming an Advisory Client is entirely voluntary. If you opt to become an Advisory Client, this information is required.

What Information Do We Share and Why?

Empower’s core business is wealth management. This means that our objective is to win you over as an Empower Advisory Client. We share some information as described in the table below.

Personal Information

Sharing Category	What do we share and why?
Our service providers	Like most businesses, we use third-party service providers to deliver some of the services mentioned in this Privacy Policy. In doing so, we provide some of your data (including your personal information) to those third-party service providers, on a need-to-know basis. Our contracts with those service providers require them to safeguard your information and prohibit them from using your data for any purpose other than to provide services to us or to improve their services.
Empower Personal Cash account partners	If you are a Empower Cash Customer, you will own a program account provided through our banking partner and other participating program banks. Our banking partner for our Empower Cash Customer program accounts is UMB Bank, National Association (“UMB”), and we will share detailed account information with UMB. Our contract with UMB requires them to treat your information as confidential information. UMB’s Privacy Policy is available here.
Identity verification and fraud analysis	If you are an Empower Cash Customer or an Advisory Client, we will share some of your personal information and detailed account information with third-party identity verification providers and fraud-analysis partners for the sole purpose of verifying your identity and preventing fraudulent transactions. These providers are required under contract with us to safeguard your information and not provide it to any third parties except as required to provide the services or as otherwise required by law, regulation, or by court order.
Your brokerage account(s)	If you are an Advisory Client of Empower, you will have a custodial brokerage account that will hold your personal portfolio. Our custodial brokerage partner for our Advisory Clients’ accounts is Pershing, and we will share detailed advisory account information with them. You will have direct visibility, access, and interaction with Pershing while you are an Empower Advisory Client. Pershing’s Privacy Policy is available here.
Security, legal, and regulatory requirements	We also reserve the right to disclose information about you that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability; (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity; (iii) investigate and defend ourselves against any third-party claims or allegations; (iv) protect the security or integrity of the services we provide and any facilities or equipment used to make those services available; (v) comply with any law or regulatory requirement, including pursuant to a subpoena, court order, or other legal process; or (vi) protect our property or other legal rights (including, but not limited to, enforcement of our agreements) or the rights, property, or safety of others.

Anonymized Information

We may use anonymized information that is summarized or derived from information that you provide to us for research, benchmarking, and publication. Anonymized information is information that does not include any personally identifiable information and therefore is outside of the terms of this Policy.

Additional Privacy Information and Your Privacy Rights and Resources

Affiliate Use

We may share personal information among our affiliated companies for their everyday business purposes to provide services that you have requested. We do not share your personal information with affiliates for their marketing purposes. From time to time, we may make you aware of products and services that are available from our affiliates. For a list of the Empower Family of Companies, please see the Privacy Notice at the end of this document.

Our Use of Google Analytics

We use Google Analytics to help us understand how you interact with our website and mobile app, to market our products and services to you, and to improve the User experience. To do this, we share a unique identifier with Google. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, see “How Google uses data when you use our partners’ sites or apps” here. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Ad-On, here.

Our Use of Tags, Pixels, Cookies, and Other Trackers

Tags, pixels, and cookies are bits of code that we use to gather information to operate and measure engagement with our site. These generally fall into two categories:

User experience – Information that helps us determine which features are most popular with our users, provide content and offers that are relevant to a user’s financial situation or site engagement, market our products and services to you, and identify errors or other technical issues on our site.

Marketing attribution – Information that allows us to track the effectiveness of advertising we run on other sites and manage our affiliate marketing program, as well as to optimize marketing of our services and products. For example, marketing pixels operate by sending a small amount of information when triggered by specific events, such as when a user registers on our site after clicking through a promotional link on another site. To do this, the pixel uses a unique identifier that does not contain personally identifying information to connect that data (user registration) back to the action (clicking on the link).

To implement the features described above, Empower contracts with trusted service providers to place tags, web beacons, cookies, and similar technologies on the Empower site and applications, which collect technical and web navigational information, such as device type, browser type, IP address, and pages visited. These service providers are prohibited from using any personal information they collect on our behalf for any purpose other than providing services to Empower. Some of our service providers are members of the Network Advertising Initiative, an AdTech self-regulatory organization. You may learn more about the Network Advertising Initiative and the opt-out of interest-based advertising that they offer by visiting http://www.networkadvertising.org/managing/opt_out.asp and following the opt-out instructions therein.

How to Request Deletion of the Personal Information We Collect

Empower allows you to delete your Empower Dashboard account. You can consult our support article for instructions on how to do so. We will retain information on deleted accounts as required for legal, regulatory, and security purposes. If you use other services from Empower or its affiliates, deleting your Empower Dashboard account will not terminate or delete your account with respect to those other services.

Opt-out Information

If you request to be added to our opt-out lists from our communications activities arising from your use of the Empower Dashboard, we will keep your personal information on those opt-out lists until you request to be removed from such lists. We allow you to optout of the following:

Promotional or Product Notification emails - See reference
Advisor phone calls - Notify your advisor at the time of the call to place you on the Do Not Call List or reach out to our support team at donotcall-epw@empower.com.
Physical mailings - send your request to our support team at support-epw@empower.com to be added to the opt-out list
Short Message Service (SMS) messages - Empower supports industry standards for SMS Opt-out such as replying with “STOP” to optout of those messages.

For opt-out requests, please find contact information under “Privacy questions, comments or feedback?” below.

How We Respond to “Do Not Track” Signals

Some modern web browsers have the ability to activate a “Do Not Track” signal. At this time, Empower does not respond to “Do Not Track” signals as it does not engage in activities that require a response to such signals.

Email Records

Empower currently keeps business records, including emails you send to us that constitute business records, for a minimum of five (5) years or for any time period required to meet our regulatory requirements.

Data Residency

Our services and data are primarily hosted in the United States and are intended for individuals located within the United States.

US State Residents Privacy Notices

To exercise any of your rights described below, please find contact information under “Privacy questions, comments or feedback?” below.

Nevada Residents

We are providing you this notice under Nevada state law. You may be placed on our internal Do Not Call List by contacting us.

In addition to contacting us, Nevada residents can contact the Bureau of Consumer Protection, Office of the Nevada Attorney General, in writing at 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; by calling (702) 486-3132; or by emailing: BCPINFO@ag.state.nv.us.

Vermont Residents

Under Vermont law, we will not share any personal information we collect about Vermont residents with third parties, unless the law allows.

California Residents

For a full description of your rights as a California resident under the California Consumer Privacy Act (“CCPA”), as amended, please see our California Privacy Policy in Appendix A.

Virginia Residents

For a full description of your rights as a Virginia resident under the Virginia Consumer Data Protection Act (“VCDPA”), please see our Virginia Privacy Policy in Appendix B.

Protecting Children’s Privacy Online

Empower is not directed to individuals under the age of 13,), and those children should not provide personal information through our websites or applications. We do not knowingly collect information from children under 13 without parental consent. For more information about the Children’s Online Privacy Protection Act (COPPA), visit the Federal Trade Commission website.

Modifications to our Privacy Policy

We change our privacy practices from time to time as the need arises. When we do, we will revise this Privacy Policy, and we will post the revised document on our website. Our Privacy Policy is currently located at https://www.empower.com/hpc/privacy-policy.

When changes to this Privacy Policy are material, we will provide notice to Empower Cash Customers and Advisory Clients. Notice may be sent by email or by posting notice of changes in your account.

Privacy Questions, Comments or Feedback?
Please contact us.*
Requests or comments

To submit privacy-related questions, requests, or comments, please call our toll-free number at 855-756-4738 or send us an email at privacymatters@empower.com Please do not put any confidential or personal account information in an email request.

In addition, you may contact us by mail to the address below:

Empower
Attn: Chief Privacy Officer
8525 E Orchard Rd, 2T3
Greenwood Village, CO 80111

*Note that the privacy team may not respond to automated requests or other requests that do not appear to be legitimate in nature.

Last updated May 1, 2023

Appendix A to Empower Personal Dashboard Privacy Policy

California Consumer Privacy Act (“CCPA”) Disclosures

Who does the CCPA apply to?

The CCPA provides certain rights to California residents (“you” or “your”). A description of our information privacy practices relating to the personal information of our California employees, applicants, and independent contractors is covered under a separate privacy policy which can be found here.

What rights do I have under the CCPA?

Broadly speaking, the CCPA grants California residents the following rights:

A right to request that a business disclose the personal information that the business collects, uses, discloses, sells, and shares about you
A right to request that a business correct inaccurate personal information that the business maintains about you
A right to request that a business delete the personal information that the business has collected from you, subject to certain exceptions
A right to request that a business limits the use and disclosure of your sensitive personal information
A right to opt out of having your personal information sold or shared (as the term is defined in the CCPA) by a business
A right not to receive discriminatory or retaliatory treatment by a business for exercising your rights under the CCPA

What personal information does Empower collect about California residents in connection with the Empower Personal Dashboard?

Empower collects and processes personal information in connection with the Empower Dashboard as required or permitted by law. Personal information means information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, device, or household. Personal information does not include data that has been deidentified, data that is publicly available information, or information that is subject to certain federal laws that are excluded from the CCPA’s scope such as personal information subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), The Fair Credit Reporting Act (FCRA), the Driver’s Privacy Protection Act of 1994, or the California Financial Information Privacy Act (FIPA).

The chart below describes the categories of personal information that Empower may collect, as well as the categories of sources from which the information was collected.

Please note that we also disclose the types of information we collect earlier in our Privacy Policy. However, the CCPA requires that we provide this information with reference to certain categories described in the CCPA, so we are restating the information here. We retain personal information until all applicable legal and business obligations are fulfilled.

Category of Personal Information	Examples
*Identifiers* such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers. Categories of sources: Y, SP, TP	You provide this information when creating an Empower Dashboard account, adding accounts, or signing up for Wealth Management or an Empower Cash account. We may also obtain this information from service providers to verify your identity or provide services to you.
*Personal information* that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Categories of sources: Y, SP, TP	You provide this information when creating an Empower Dashboard account, adding accounts, or signing up for a Wealth Management or an Empower Cash account. We may also obtain this information from service providers to verify your identity or provide services to you. We do not store account numbers, credit or debit card numbers, or login credentials for accounts that you link to your dashboard. We do not generally collect descriptions of physical characteristics, insurance policy numbers, education, medical, or health insurance information, although, if you are a Wealth Management Client and disclose this information to your advisor, your advisor may make a note of it.
*Characteristics of protected classifications* under California or federal law. Categories of sources: Y	You may provide your age, sex, and marital status, if you use our free Retirement Planner service. If you are an Empower Cash customer, then you have confirmed to us that you are a U.S. citizen.
*Commercial information*, including records of personal property, products or services purchased, obtained, or considered; or other purchasing or consuming histories or tendencies. Categories of sources: Y, SP	If you have added accounts to your dashboard, we have collected transaction information reflected in those accounts. In addition, we have information about the investment and cash accounts you have opened with us.
*Internet or other electronic network activity* information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement. Categories of sources: Y	We collect your IP address and cookies from your browser to recognize you and deliver a consistent experience when you visit our site and to measure the effectiveness of our marketing. We also collect information about how you interact with our website.
Professional or employment-related information Categories of sources: Y	You may provide employment information when applying for an Empower Cash account or if you are a Wealth Management Client.

Note that we do not collect education, biometric, geolocation information, or inference data to create profiles about you from your personal information described above.

Sensitive personal information is a subcategory of personal information. The chart below describes the categories of sensitive personal information that Empower has collected over the course of our relationship with you as well as the categories of sources from which the information was collected. We retain Sensitive Personal Information until all applicable legal and business obligations are fulfilled.

Category of Sensitive Personal Information	Examples
*Government identifiers* such as your Social Security number, driver’s license, state identification card, or passport number. Categories of sources: Y, SP, TP	You provide this information when creating a Dashboard account, adding accounts, or signing up for a wealth management or Cash account. We may also obtain this information from service providers to verify your identity or provide services to you.
*Financial account information* such as your account log-in or financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account. Categories of sources: Y	You provide this information when creating an Empower Dashboard account, adding accounts, or signing up for a Wealth Management or an Empower Cash account, but we do not store this information permanently.
*Precise geolocation data,* which means data used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet except as otherwise set forth in applicable law or regulations	We don’t collect.
*Certain demographic information,* which includes racial or ethnic origin, religious or philosophical beliefs, or union membership	We don’t collect.
*Private communications,* which means the contents of a consumer’s mail, email and text messages, unless Empower is the intended recipient of the communication.	We don’t collect.
*Genetic Data*	We don’t collect.
*Processing of biometric information* *for the purpose of uniquely identifying a consumer.*	We don’t collect.
*Personal information collected and analyzed concerning a consumer’s health*	We don’t collect.
*Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation*	We don’t collect.

Categories of Sources of Information

(Y) Most of the personal information that we have is provided by you either (a) through our website, including information you enter into our website as well as information provided by your web browser or device, or (b) when speaking to an Empower advisor or customer service agent.
(SP) We receive information from service providers, such as data analytics providers, financial account aggregators, and independent securities brokerage trading and clearing custodians or banking institutions, who help us provide services to you.
(TP) In some instances, we purchase information from third parties, such as direct mail collection agencies and affiliate marketing vendors. For example, we may purchase addresses for direct mail campaigns and sales leads from referral partners.

Business or Commercial Purpose for Collecting the Personal Information

We collect personal information for one or more of the following business or commercial purposes:

Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
Detecting security incidents; protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity
Debugging to identify and repair errors that impair existing intended functionality
Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction
Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider
Undertaking internal research for technological development and demonstration
Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Categories of Third Parties with Whom We Disclose Personal Information

We disclose the information described above with service providers, such as independent securities brokerage trading and clearing custodians and Empower Cash program account partners, to the extent necessary to provide the services you have requested and for the business purposes described above.

Deidentified or Pseudonymous Data

We maintain and use deidentified data in such a way that any information can no longer be linked to you or any device associated with you. After data has been deidentified, i) we maintain and use such deidentified data without attempting to reidentify the data or re-associate it with specific individuals; ii) we take reasonable measures to ensure that the information cannot be reassociated with you or your household; and iii) we have implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information.

As described in our Privacy Policy, we may, from time to time, use anonymized or deidentified data to perform analysis on personal finance and related topics. Such findings may be shared with external publishers or published by us. We also authorize some of our service providers to use anonymized or deidentified information to provide services to us or improve their services generally.

Explanation of Your Rights

Right to know what personal information is being collected, sold, or disclosed for a business purpose

Subject to applicable exemptions in the CCPA, you have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal information. Once we receive and confirm your verifiable consumer request, to the extent required by the CCPA, we will disclose to you:

The categories of personal information we collected about you
The categories of sources from which the personal information was collected
The business or commercial purpose for which we collected or sold the personal information
The categories of third parties with whom we share personal information
The categories of personal information that we sold and, for each category identified, the categories of third parties to whom we sold the particular category of personal information
The categories of personal information that we disclosed for a business purpose and, for each category identified, the categories of third parties to whom we disclosed that particular category of personal information, and
The specific pieces of personal information we have collected about you

Right to request deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will deidentify or delete (and direct our service providers to delete from their records) your personal information from our records, unless an exception applies.

Right to correct inaccurate personal information

You have the right to request correction of your personal information that is inaccurate. Once we receive your verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information as described in your request. You may be required to provide additional documentation if necessary to determine the accuracy of your personal information.

How Can I Exercise My Right to Opt Out of the Sale or Sharing of My Personal Information?

Empower does not sell or share any consumers’ personal information in any way that would require an opt-out; this includes the personal information of minors, as defined by law.

How Can I Exercise My Right to Limit the Use of my Sensitive Personal Information?

We limit the collection, use, and disclosure of your sensitive personal information to that which is necessary to provide our services to you or for another permitted purpose under the CCPA, such as detecting security incidents, and we do not use this information to infer characteristics about you. Our service providers are contractually obligated to limit their use and disclosure of your sensitive personal information to that which is necessary for the business purpose set forth in our contract with them. Since we already limit the use of your sensitive personal information, an opt-out is not necessary.

How Can I Exercise My Rights Under the CCPA?

If you have an Empower Dashboard account:

Log in to your account and go to Settings. Under the Privacy section, you will be able to request a report of the categories of information or specific information that we have collected about you or request that we delete your personal information.
To correct any inaccurate personal information, please log on to your Empower dashboard account to manually update the applicable field for your Profile under “Settings” and/or contact support-epw@empower.com; additionally, if you are a Client, you can also contact your financial advisor. In most cases, we will be able to authenticate your request using your dashboard login. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

If you do not have an Empower Dashboard account:

Fill out a Privacy Request Form.
You will need to provide your full name, phone number, and email so that we can authenticate your request and locate your personal information If you previously had an Empower Dashboard account, please provide the email and phone number you used to log in to your dashboard.
We will authenticate your request by matching the information you provide against any information that we have collected about you. However, in some cases, we may not have collected sufficient information about you to authenticate your request. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.
Empower may deny your request in the event compliance with a request is not required due to applicable exemptions.

You may also exercise your CCPA rights by calling us toll-free at 855-855-8005.

How Can I Designate an Authorized Agent to Exercise My Rights Under the CCPA?

You may use an authorized agent to submit a request on your behalf. To do so, the authorized agent must provide a copy of your signed authorization to privacymatters@empower.com. You will also be required to verify your identity directly with us and confirm that you have provided the authorized agent with your permission to submit a request on your behalf.

Nondiscrimination & Nonretaliation

We will not discriminate or retaliate against you for exercising any of your CCPA rights. To the extent prohibited by the CCPA, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior consent, which you may revoke at any time.

Contact Information

If you have any questions about your rights under the CCPA, please contact privacymatters@empower.com.

Revised: May 1, 2023

Appendix B to Empower Personal Dashboard Privacy Policy

Virginia Consumer Data Protection Act (“VCDPA”) Disclosures

Who does the VCDPA apply to?

The VCPDA provides certain rights to Virginia residents acting in an individual or household context (“you”).

What rights do I have under the VCDPA?

Broadly speaking, the VCDPA grants you the following rights:

A right to confirm and access the processing of your personal data
A right to request that inaccuracies of your personal data be corrected
A right to request the deletion of personal data provided by you or obtained about you
A right to obtain a copy of personal data you provided in a portable and readily usable format to the extent technically feasible (also called a data portability request)
A right to opt out of certain processing activities as described in the Right to Opt Out section of this notice.
A right to appeal a decision made pursuant to a request to exercise these rights
Empower will not discriminate against you for exercising your consumer privacy rights

Categories of Personal Data Collected and Processed

Empower collects and processes personal data as required or permitted by law. Personal data (also referred to as personal information) means any information that is linked to you or reasonably linkable to you such as your name, email or mailing address, phone number, account credentials (User ID and passwords), Social Security number, government ID numbers, and other information that can be used to identify you personally. Personal data does not include data that has been deidentified, data that is publicly available information; or data that is subject to certain federal laws that are excluded from the VCDPA’s scope, such as personal data regulated under the federal Family Educational Rights and Privacy Act (FERPA), the federal Fair Credit Reporting Act (FCRA), the federal Driver’s Privacy Protection Act of 1994, or protected health information under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The chart below describes the categories of personal data we collect along with how we collect this information.

Category of Personal Data	How we collect
*Identifiers* such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	You provide this information when creating a dashboard, adding accounts, or signing up for a Wealth Management or Empower Cash account. We may also obtain this information from service providers to verify your identity or provide services to you.
*Personal information* that identifies, relates to, describes, or is capable of being associated with a particular individual, including, but not limited to, physical characteristics or description; telephone number; insurance policy number; education; bank account, credit card, or debit card number; or any other financial information, medical information, or health insurance information.	You provide this information when creating a dashboard, adding accounts, or signing up for a Wealth Management or an Empower Cash account. We may also obtain this information from service providers to verify your identity or provide services to you. We do not store account, credit, or debit card numbers or login credentials for accounts that you link to your dashboard. We do not generally collect descriptions of physical characteristics, insurance policy numbers, education, or medical or health insurance information, although if you are a Wealth Management Client and disclose this information to your advisor, your advisor may make a note of it.
*Characteristics of protected classifications* under applicable law.	You may provide your age, sex, and marital status if you use our free Retirement Planner service. If you are an Empower Cash customer, then you have confirmed to us that you are a U.S. citizen.
*Commercial information*, including records of personal property; products or services purchased, obtained, or considered; or other purchasing or consuming histories or tendencies.	If you have added accounts to your dashboard, we have collected transaction information reflected in those accounts. In addition, we have information about the investment and cash accounts you have opened with us.
*Internet or other electronic network activity* information, including, but not limited to, browsing history; search history; and information regarding your interactions with an internet website, application, or advertisement.	We collect your IP address and cookies from your browser to recognize you and deliver a consistent experience when you visit our site and to measure the effectiveness of our marketing. We also collect information about how you interact with our website.
Professional or employment-related information.	You may provide employment information when applying for an Empower Cash account or if you are a Wealth Management Client.
*Sensitive data,* which may include personal data revealing mental or physical health diagnoses, citizenship status, or immigration status	We do not generally collect sensitive data, although if you are a Wealth Management Client and you voluntarily disclose this information to your advisor, your advisor may make a note of it. If you are an Empower Cash customer, then you will need to confirm your citizenship status.

Note that we do not collect education information, biometric data, geolocation information, or inference data to create profiles about you from the personal data described above.

Business or Commercial Purpose for Collecting Your Personal Data

We collect personal data for one or more of the following business or commercial purposes:

Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
Detecting security incidents; protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity.
Debugging to identify and repair errors that impair existing intended functionality.
Short-term, transient use, provided that the personal data is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.
Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
Undertaking internal research for technological development and demonstration.
Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Categories of Personal Data Shared with Third Parties

The chart below describes what personal data may be shared with third parties.

Sharing Category	What do we share and why?
Our service providers	Like most businesses, we use third-party service providers to deliver some of the services mentioned in this Privacy Policy. In doing so, we provide some of your data (including your Personal Data) to those third-party service providers, on a need-to-know basis. Our contracts with those service providers require them to safeguard your information and prohibit them from using your data for any purpose other than to provide services to us or to improve their services.
Empower Cash program account service provider	If you are an Empower Cash Customer, you will own a program account provided through certain service providers; including our banking partner and other participating program banks. Our banking partner for our Empower Cash Customer program accounts is UMB Bank, National Association (“UMB”), and we will share Detailed Cash Account Information with UMB. Our contract with UMB requires them to treat your information as confidential information. UMB’s Privacy Policy is available here.
Identity verification and fraud analysis	If you are an Empower Cash Customer or an Advisory Client we will share some of your Personal Data, Detailed Cash Account Information and Detailed Investment Account Information (as applicable) with third-party identity- verification providers and fraud-analysis partners for the sole purpose of verifying your identity and preventing fraudulent transactions. These service providers are required under contract with us to safeguard your information and not provide it to any third parties except as required to provide the services or as otherwise required by law, regulation, or court order.
Your brokerage account(s)	If you are an Advisory Client of Empower, you will have a custodial brokerage account to hold your personal portfolio. Our custodial brokerage partner for our Advisory Clients’ accounts is Pershing, and we will share Detailed Advisory Account Information with them. You will have direct visibility, access, and interaction with Pershing while you are an Empower Advisory Client. Pershing’s Privacy Policy is available here.
Security, legal & regulatory requirements	We also reserve the right to disclose information about you that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability, (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity; (iii) investigate and defend ourselves against any third-party claims or allegations; (iv) protect the security or integrity of the services we provide and any facilities or equipment used to make those services available; (v) comply with any law or regulatory requirement, including pursuant to a subpoena, court order or other legal process; or (vi) protect our property or other legal rights (including, but not limited to, enforcement of our agreements); or the rights, property, or safety of others.

Categories of Third Parties with Whom We Share Your Personal Data

We share the information described above with service providers, such as independent securities brokerage trading and clearing custodians, our marketing partners, and Empower Capital Cash program account partners, to the extent necessary to provide the services you have requested and for the business purposes described above.

Deidentified or Pseudonymous Data

As described in our Privacy Policy, we may, from time to time, use anonymized or deidentified data to perform analysis on personal finance and related topics. Such findings may be shared with external publishers or published by us. We also authorize some of our Service Providers to use anonymized or deidentified information to provide services to us or improve their services generally.

Right to Opt Out

You have the right to opt out of the sale of your personal data and the processing of your personal data for the purposes of targeted advertising or certain instances of profiling. We do not “sell” your personal data or engage in “targeted advertising” and “profiling” (as these terms are defined in the VCDPA) in any way that would require an opt-out.

How do I Exercise my Rights Under the VCDPA?

If you have an Empower dashboard account:

Log in to your account and go to Settings. Under the Privacy section, you will be able to request a report of the categories of information or specific information that we have collected about you or request that we delete your personal data.
To correct any inaccurate personal information, please log onto your Empower dashboard account to manually update the applicable field for your Profile under “Settings” or contact support-epw@empower.com; additionally, if you are a Client, you can also contact your financial advisor.
To submit an appeal related to any of your rights granted under the VCDPA, please email us at privacymatters@empower.com with your request for appeal and any additional information that may be relevant to the request.
In most cases, we will be able to authenticate your request using your dashboard login. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

If you do not have an Empower dashboard account:

Fill out a Privacy Request Form.
You will need to provide your full name, phone number, and email so we can authenticate your request and locate your Personal Data If you previously had an Empower Dashboard account, please provide the email and phone number you used to log into your dashboard.
We will authenticate your request by matching the information you provide against any information that we have collected about you. However, in some cases, we may not have collected sufficient information about you to authenticate your request. For example, if you are a Visitor but have never been a User, Cash Customer, or Advisory Client, we will not have sufficient information about you to authenticate your request. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

Appeal Process

Upon receiving your request, we will respond to you within 45 days or notify you if the response period is being extended in accordance with applicable laws. If we decline to take action on your verifiable request, we will provide you with a notice that includes our reason for not taking action and instructions for submitting an appeal. Should you wish to submit an appeal, you will have 60 days from the date of the notice to do so. You may submit your appeal by emailing us at privacymatters@empower.com.