Privacy policy

Helping people plan and achieve financial security is our passion. One of our core values is doing the right thing and we believe in protecting privacy and personal data.

We do not sell customers’ personal information to anyone for any purpose.
We only share customers’ personal information with affiliated companies and third parties as needed to deliver services authorized by the retirement plan sponsor and/or an individual customer.

Ultimately, the most valuable asset we have is the trust of our customers. At Empower, we believe that protecting privacy is part of maintaining that trust.

In this privacy policy, we will cover:

What data we collect.
How we use data.
How we share data.
Deidentified or pseudonymous data.
Children.
Security.
Website and mobile application use.
Cookies and web beacons.
Do not track and global privacy control.
Analytics.
Interest-based advertising and communications.
Additional privacy rights under applicable state laws
- Privacy request form
Modifications to our privacy policy.
Requests, questions, or complaints.
About us.
Gramm-Leach-Bliley Notice.

Welcome to the Empower website.

Empower takes data privacy very seriously and is committed to protecting and respecting the privacy, security, and integrity of your personal ;information. This policy sets out key information regarding Empower and how your personal information will be collected, used, and protected.

Please note that certain portions of this policy may, or may not, be applicable to you based on the services and products in which you are enrolled and applicable laws. This policy is supplemented by specific notices, set out in links within this policy, that provide additional information pertaining to your relationship with Empower or addressing the requirements of the jurisdiction in which you live. In this policy, the terms “Empower,” “we”, “us” and “our” refer to each and all of the Empower family of companies listed at the end of this policy.

What data we collect

Empower collects your “personal information” or “personal data” (ie: information that when used alone or with other relevant data may be capable of personally identifying you, or as defined by applicable law). The information that we collect, and how we use it, depends on your relationship with us and may change as your relationship evolves with us. This Privacy Policy is organized based on those different types of relationships as described below.

Visitors: individuals who visit our public website without logging into an account or using our services.
Users: individuals who establish an account with us or otherwise use our service offerings, including our financial dashboard software. Together with our Terms of Use, this Privacy Policy governs the use of the Empower Personal Dashboard.
Retirement Plan Participants: individuals who are enrolled in a retirement plan. Note that in this capacity, Empower is acting as a service provider to provide plan retirement services to your current or former employer (“plan sponsor”).
Retail Customers: individuals who are enrolled directly with Empower for financial services. These products and services include but are not limited to: IRA ;products, Empower brokerage, managed portfolios, Empower Personal Cash, and advisory services. Please note that data held by Empower for these “retail” products and services are subject to the data protection requirements of Gramm-Leach-Bliley and as such, may be exempt from some data privacy laws.
Insurance Customers: individuals who have engaged in or purchased insurance products from Empower.
Advisory Clients: individuals who open an Empower Personal Strategy account and become advisory clients of Empower Advisory Group, LLC. become clients of our Wealth Management and Empower Advisory Services and establish an Empower managed investment account.
California Employees, Job Applicants, and Independent Contractors: for information on how we collect, process, and protect your personal information as well as privacy rights applicable to you, please refer to our Privacy Notice for California Employees, Job Applicants, and Independent Contractors.

You may fall into more than one category concurrently depending on your relationship with us. For example, if you are a Personal Cash Customer you may also be a Visitor before logging into your dashboard, wherein you will also be a User. After your relationship with us ends, the terms of this policy shall continue to be applicable to your data for as long as we retain your data.

The table below describes the personal information we have collected and shared in the preceding 12 months and may continue to collect and share.

Identifiers

This may include your real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

To whom does this apply:

This applies to visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites.
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you.
From our service providers and other third parties.
From your plan sponsor (your employer or former employer).
From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law.
From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account).
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our service providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

Financial information*

This may include contact and financial information such as your name, signature, social security number, address, telephone number, bank account number, or other financial information.

To whom does this apply:

We may collect this information from visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites.
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you.
From our service providers and other third parties.
From your plan sponsor (your employer or former employer).
From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law.
From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account).
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our Service Providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

*this includes categories listed in the California Records Statute [Cal. Civ. Code § 1798.80(e)]

Characteristics of protected classifications under state or federal law

This may include, for example, your age, marital status, gender, race, and medical conditions.

To whom does this apply:

We may collect this information from visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites.
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you.
From our service providers and other third parties.
From your plan sponsor (your employer or former employer).
From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law.
From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account).
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our service providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

Commercial Information This includes records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
To whom does this apply: This applies to visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients. Retention: We retain this information until all applicable legal and business obligations are fulfilled.
SOURCE OF COLLECTION	SHARING/DISCLOSURES	BUSINESS PURPOSE
We collect this information from the following sources: From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites. From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you. From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you. From our service providers and other third parties. From your plan sponsor (your employer or former employer). From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law. From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account). We may have also obtained this information from our affiliates or if it was held by a business that we acquired.	We do not “sell” or “share” this information, as these terms are defined under applicable law. We disclose this information to the following categories of third parties: Plan Sponsors or their agents Our Service Providers Our banking provider (if you are an Empower Personal Cash customer) Our custodial brokerage providers (if you are an advisory client) Nonaffiliated third parties Third-Party Identity Verification Providers and Fraud Analysis Providers Persons acting as a fiduciary or representative capacity on your behalf Our affiliates and subsidiaries We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business. For more information on these types of recipients, please see “How We Share Data”	We collect this information for the following business or commercial purposes: To provide our services and products to you or the plan sponsor of your retirement plan. To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability. To comply with federal, state, or local laws, rules, and other applicable legal requirements. To comply with a properly authorized civil, criminal or regulatory investigation or subpoena. For institutional risk control, or for resolving customer disputes or inquiries. To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction. To undertake internal research for technological development and demonstration. To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business. For purposes otherwise permitted or required by law.

Biometric information

We collect voice recordings and voiceprint data.

To whom does this apply:

This applies to retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you when you call our service center.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our Service Providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

Internet or other similar network activity

This includes, but is not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement. For example, we collect your IP address and cookies from your browser to recognize you and deliver a consistent experience when you visit our site and to measure the effectiveness of our marketing. We also collect information about how you interact with our website as well as your preferences when you elect to receive or opt-out of cookies, communications involving email, texting, or telephone calls; these preferences apply to Empower communications with you and are not shared with nor transferable to third parties.

To whom does this apply:

We may collect this information from visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites.
From our service providers and other third parties.
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

While we do not share your personal information to third parties for monetary gain, some data privacy laws have a broader definition of “sale” and “share” that may be applicable to use of certain third-party cookies, tags, pixels or web beacons (collectively, “cookies”) on our websites or mobile applications. In this context, Empower and our advertising partners use cookies and the advertising identifier associated with your mobile or internet-connected device.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our Service Providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

Geolocation data

We collect your IP address from you when you visit our websites.

To whom does this apply:

This applies to visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites.
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you.
From our service providers and other third parties.
From your plan sponsor (your employer or former employer).
From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law.
From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account).
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our Service Providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

Audio, electronic, visual, thermal, olfactory, or similar information We collect voice recordings, voiceprint data, and pictures to verify your identity.
To whom does this apply: This applies to retirement plan participants, retail customers, insurance customers, and advisory clients. Retention: We retain this information until all applicable legal and business obligations are fulfilled.
SOURCE OF COLLECTION	SHARING/DISCLOSURES	BUSINESS PURPOSE
From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you. From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you. From our service providers and other third parties. From your plan sponsor (your employer or former employer). From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law. We may have obtained this information from our affiliates or if it was held by a business that we acquired From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account). We may have also obtained this information from our affiliates or if it was held by a business that we acquired.	We do not “sell” or “share” this information, as these terms are defined under applicable law. We disclose this information to the following categories of third parties: Plan Sponsors or their agents Our Service Providers Our banking provider (if you are an Empower Personal Cash customer) Our custodial brokerage providers (if you are an advisory client) Nonaffiliated third parties Third-Party Identity Verification Providers and Fraud Analysis Providers Persons acting as a fiduciary or representative capacity on your behalf Our affiliates and subsidiaries We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business. For more information on these types of recipients, please see “How We Share Data”	We collect this information for the following business or commercial purposes: To provide our services and products to you or the plan sponsor of your retirement plan. To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability. To comply with federal, state, or local laws, rules, and other applicable legal requirements. To comply with a properly authorized civil, criminal or regulatory investigation or subpoena. For institutional risk control, or for resolving customer disputes or inquiries. To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction. To undertake internal research for technological development and demonstration. To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business. For purposes otherwise permitted or required by law.

Professional or employment-related information This may include information such as your job title, date of hire, employer name, and industry.
To whom does this apply: This applies to retirement plan participants, retail customers, insurance customers, and advisory clients. Retention: We retain this information until all applicable legal and business obligations are fulfilled.
SOURCE OF COLLECTION	SHARING/DISCLOSURES	BUSINESS PURPOSE
From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you. From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you. From our service providers and other third parties. From your plan sponsor (your employer or former employer). From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law. We may have obtained this information from our affiliates or if it was held by a business that we acquired From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account). We may have also obtained this information from our affiliates or if it was held by a business that we acquired.	We do not “sell” or “share” this information, as these terms are defined under applicable law. We disclose this information to the following categories of third parties: Plan Sponsors or their agents Our Service Providers Our banking provider (if you are an Empower Personal Cash customer) Our custodial brokerage providers (if you are an advisory client) Nonaffiliated third parties Third-Party Identity Verification Providers and Fraud Analysis Providers Persons acting as a fiduciary or representative capacity on your behalf Our affiliates and subsidiaries We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business. For more information on these types of recipients, please see “How We Share Data”	We collect this information for the following business or commercial purposes: To provide our services and products to you or the plan sponsor of your retirement plan. To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability. To comply with federal, state, or local laws, rules, and other applicable legal requirements. To comply with a properly authorized civil, criminal or regulatory investigation or subpoena. For institutional risk control, or for resolving customer disputes or inquiries. To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction. To undertake internal research for technological development and demonstration. To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business. For purposes otherwise permitted or required by law.

Inferences drawn from personal information

This includes inferences about your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes to create a profile about you.

To whom does this apply:

This applies to visitors, users, retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you.
From our service providers and other third parties.
From your plan sponsor (your employer or former employer).
From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law.
We may have obtained this information from our affiliates or if it was held by a business that we acquired
From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account).
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our Service Providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

Sensitive personal information

Certain information may be considered sensitive personal information depending on your state of residence. We may collect the following sensitive personal information: government identifiers, certain financial account information, status as a victim of a crime, demographic information that may be considered sensitive, your citizenship status (in order to verify eligibility as an Empower Personal Cash Customer), and biometric data. We limit our collection, use, and disclosure of this category of personal information to that which is necessary to provide our services to you or for another permitted business purpose under applicable data privacy laws such as detecting security incidents. We do not use this information to infer characteristics about you.

To whom does this apply:

This applies to retirement plan participants, retail customers, insurance customers, and advisory clients.

Retention:

We retain this information until all applicable legal and business obligations are fulfilled.

SOURCE OF COLLECTION

SHARING/DISCLOSURES

BUSINESS PURPOSE

We collect this information from the following sources:

From you or your representative when you communicate with us through web, email, phone, or other correspondence, complete applications and forms for various products or services, or provide other information on our websites.
From your device when you browse our websites or mobile applications and from tracking technologies in emails that we or our suppliers send to you.
From activity in your account (for example, data from the administration of your investments, balances, trades, and elections). If you enroll in account aggregation services, we may also collect information from the accounts that you linked, as approved by you.
From our service providers and other third parties.
From your plan sponsor (your employer or former employer).
From our suppliers, consumer and insurance reporting companies, data providers, and other third parties as permitted by law.
From other sources to complete transactions initiated by you or your representative (for example, to transfer balances from another retirement account into a new retirement account).
We may have also obtained this information from our affiliates or if it was held by a business that we acquired.

We do not “sell” or “share” this information, as these terms are defined under applicable law.

We disclose this information to the following categories of third parties:

Plan Sponsors or their agents
Our Service Providers
Our banking provider (if you are an Empower Personal Cash customer)
Our custodial brokerage providers (if you are an advisory client)
Nonaffiliated third parties
Third-Party Identity Verification Providers and Fraud Analysis Providers
Persons acting as a fiduciary or representative capacity on your behalf
Our affiliates and subsidiaries

We may also disclose this information in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of our business.

For more information on these types of recipients, please see “How We Share Data”

We collect this information for the following business or commercial purposes:

To provide our services and products to you or the plan sponsor of your retirement plan.
To detect security incidents; protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
To comply with federal, state, or local laws, rules, and other applicable legal requirements.
To comply with a properly authorized civil, criminal or regulatory investigation or subpoena.
For institutional risk control, or for resolving customer disputes or inquiries.
To protect the confidentiality or security of our records pertaining to you, the service or product, or a specific transaction.
To undertake internal research for technological development and demonstration.
To verify, maintain, or improve the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business.
For purposes otherwise permitted or required by law.

We do not collect nonpublic personal education information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).

How we use data

Empower uses your personal information to respond to your requests and inquiries and to provide you with services and products you receive from us. In the event you are enrolled in a retirement plan that is administered by Empower pursuant to a services agreement with the plan sponsor of your retirement plan (your employer or former employer), Empower will process your data to perform its services to the plan sponsor. If you contract directly with Empower or its affiliates for other services offered by Empower to individual customers, such as advisory services, financial products or financial wellness services, Empower will use your data to process transactions and perform its obligations in connection with such services. Empower will also use your data as permitted by law to make you aware of other financial products or services that may be of interest to you. Empower may use your data on an anonymized basis to conduct and publish aggregated research about the retirement or investment industries.

Empower will use your data for other purposes as permitted by law, including to protect your interests and ours in the detection, prevention and mitigation of fraud, to meet the requirements of applicable laws and regulations, to comply with requests of regulators with jurisdiction over our services, and for product development and delivery.

How we share data

We limit the information we share and the parties we share it with. What we share depends on the types of products or services you have procured and applicable law.

Further, personal information may be shared as necessary to effect, administer, or enforce a transaction you request or authorize, with your consent, at your direction, or as allowed by applicable law. Your health information will not be shared except as required or permitted by law. The chart below describes the categories of third parties with whom we share your data.

Sharing Category	What do we share and why?
Plan Sponsors	If you are enrolled in a retirement plan offered by a plan sponsor (your employer or former employer), your personal information may be shared with the plan sponsor and with that plan sponsor’s third-party administrators, advisors, service providers, and other third parties as authorized or directed by the plan sponsor.
Our service providers	Like most businesses, we use third-party service providers to deliver some of the services mentioned in this Privacy Policy. In doing so, we provide some of your data (including your personal information) to those third-party service providers, on a need-to-know basis. Our contracts with those service providers require them to safeguard your information and prohibit them from using your data for any purpose other than to provide services to us or to improve their services.
Empower Personal Cash account service provider	If you are an Empower Personal Cash customer, you will own a program account provided through the bank provider. The bank provider for our Empower Personal Cash customer program accounts is UMB Bank, National Association (“UMB”), and we will share detailed account information with UMB. Our contract with UMB requires them to treat your information as confidential information. UMB’s Privacy Policy is available here
Identity verification and fraud analysis providers	We will share some of your personal information and detailed account information with third-party identity verification providers and fraud-analysis providers for the sole purpose of verifying your identity and preventing fraudulent transactions. These providers are required under contract with us to safeguard your information and not provide it to any third parties except as required to provide the services or as otherwise required by law, regulation, or court order.
Your brokerage account(s)	If you are an Advisory Client of Empower, you will have a custodial brokerage account that will hold your personal portfolio. Our custodial brokerage provider for our Advisory Clients’ accounts is Pershing, and we will share detailed advisory account information with them. You will have direct visibility, access, and interaction with Pershing while you are an Empower Advisory Client. Pershing’s Privacy Policy is available here
Affiliate sharing	Certain personal information may be shared among our affiliates as permitted by law to provide our services to you, to make it easier to do business with us, and for their everyday business purposes. We do not share your personal information with affiliates for their marketing purposes. From time to time, we may make you aware of products and services that are available from our affiliates. Our affiliates are listed below in this policy and include, but are not limited to, our broker-dealer, our advisory service provider, and our trust company.
Nonaffiliated third parties	Your personal information may be shared with nonaffiliated third parties to provide services on our behalf. These third parties agree to maintain the confidentiality of the personal information and use it solely to provide their services to us.
Security, legal, and regulatory sharing	We also reserve the right to disclose information about you that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability; (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity; (iii) investigate and defend ourselves against any third-party claims or allegations; (iv) protect the security or integrity of the services we provide and any facilities or equipment used to make those services available; (v) comply with any law or regulatory requirement, including pursuant to a subpoena, court order, or other legal process; or (vi) protect our property or other legal rights (including, but not limited to, enforcement of our agreements) or the rights, property, or safety of others.

Deidentified or pseudonymous data

We maintain and use deidentified data in such a way that any information can no longer be linked to you or any device associated with you. After data has been deidentified, i) we maintain and use such deidentified data without attempting to reidentify the data or re-associate it with specific individuals; ii) we take reasonable measures to ensure that the information cannot be reassociated with you or your household; and iii) we have implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information. Such data is used for research and benchmarking purposes. We contractually obligate all recipients of the deidentified data to comply with applicable laws pertaining to deidentification and we monitor compliance with any contractual commitments.

Children

Empower does not knowingly collect personal information from children under the age of 16 without seeking prior parental consent (if required by applicable law). We only use or disclose personal information about a child to the extent permitted by law, to seek parental consent pursuant to local law and regulations or to protect a child. The definitions of "child" or "children" may be slightly different as set forth in various applicable laws.

Security

We use physical administrative, and technical safeguards designed to protect the confidentiality, integrity and availability of your personal information. Any third-party service providers with whom we share your personal information agree to maintain the confidentiality and security of the personal information and use it solely to provide their services to us. In addition, Empower provides the Empower Security Guarantee to its customers and participants as described here.

Website and mobile application use

When you access our websites or mobile applications, we or our third-party suppliers use a variety of technologies, such as tags and web beacons, that automatically collect data (such as: without limitation, your device type, browser type, internet protocol address, operating system used, number of visits, average time spent on the site and pages viewed). This data is used to operate the websites more efficiently, maintain the security of your online session, improve our websites’ design and navigation, and perform online advertising (where permitted by law). If you have created an account with us, we may combine the data collected through the tracking systems described herein with other information we know about you, as permitted by law. We use this information internally to provide you with a better user experience and to offer you products and services that may be of interest to you.

Some of our websites include links or navigation to third-party sites. These third-party sites may include informational sites, sites providing financial wellness tools and services, or services offered to you solely by a third party, as further described in the disclosures provided on such sites.

Cookies and web beacons

A cookie is a piece of information that is stored on your computer, tablet, phone or other device by your web browser. Web beacons (also known as clear gifs, web bugs or pixels) are small graphics with a unique identifier and are embedded invisibly on web pages. Empower and third- party service providers we hire may use such cookies and web beacons (collectively referred to below as “cookies”) to track the online movements of users of our websites and mobile applications, and to collect other data such as IP address, type of device used, and browser information. Empower and its third-party service providers use such data to customize your experience on our website and personalize our communications with you. With respect to emails that are sent to you, we or our service providers also use cookies and web beacons to determine when you receive and open our emails, whether you click any links in the email, and other information about the device from which you access the email, as permitted by law.

If you do not want to have cookies on your computer or device, you can use the link at the bottom of the webpage that is titled “Do not sell or share my personal information” to access a cookie manager in which you may refuse or deny certain types of cookies. Additionally, you can use the settings or tools offered on your browser to delete cookies that have already been stored. If you refuse or delete cookies, you may notice an impact on your use of Empower’s (and its affiliates’) websites; for example, you may not be able to sign in and access your account without additional authentication, or we may not be able to recognize you, your device, or your online preferences.

Do not track and global privacy control

Some web browsers have the ability to activate a “do not track” signal. At this time, Empower does not respond to “do not track” signals; however, you may exercise your right to opt out of the sale and sharing of your personal information through the use of the Global Privacy Control (“GPC”) signal which allows you to communicate your privacy preference without having to make individualized opt out requests. To learn more about the GPC and how you can use it to opt out of the sale or sharing of your personal information, you can visit their website here. If you've enabled the GPC signal in your browser, we will honor your opt out request as communicated via the GPC signal. Please note that these opt outs are specific to the device or browser you're using so you'll need to opt out again when you use a different device or browser, change your browser settings, or clear your cookies.

Analytics

We use a tool called “Google Analytics” to help us understand how you interact with our website and mobile applications, to market our products and services to you, and to improve the user experience, , or regarding your receipt and access to information in emails we send to you. Google Analytics collects information such as how often users visit our websites, what pages they visit when they do so, and what other sites they used to navigate to this site. For more information about how Google uses data, see the site “How Google uses information from sites or apps that use our services,” here.

Interest-based advertising and communications

Empower advertises its products and services on its websites and mobile applications and on websites not affiliated with Empower, and we contract with third-party advertisers to place those advertisements. Empower and its suppliers may also send you advertising and communications that are tailored to you or that provide you with products or services that may be of interest to you, based on information that we or that such third-party service providers have collected about you. Such advertising may include advertising on websites not affiliated with Empower, such as social media. Our third-party advertising providers might use information collected from cookies or beacons about your use of our websites to provide interest-based advertisements based on your online activity as permitted by applicable law. If you would like information about how to opt-out of such interest- based advertising, you may find more information through the Network Advertising Initiative here.

Additional privacy rights under applicable state laws

Under state data privacy laws, you may have additional privacy rights as described below. As of the date of this privacy notice, this includes residents of California, Connecticut, New Hampshire, Oregon, Texas, and Virginia (“you” or “your”).

Right to access: Subject to exemptions under applicable law, you have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal data.

Specifically, you have the right to request the following:

The categories of personal information we collected about you;
The categories of sources from which the personal information was collected;
The business or commercial purpose for which we collected or sold the personal information;
The categories of third parties with whom we share personal information;
The categories of personal information that we sold, and for each category identified, the categories of third parties to whom we sold the particular category of personal information;
The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of personal information; and
The specific pieces of personal information we have collected about you.

Right to correct: You have the right to request correction of your personal data that is inaccurate. Once we receive your verifiable request, we will use commercially reasonable efforts to correct the inaccurate personal data as described in your request. You may be required to provide additional documentation if necessary to determine the accuracy of your personal data.

Right to delete: You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable request, we will deidentify or delete (and direct our service providers to delete) your personal data from our records, unless an exception applies.

Right to limit use and disclosure of sensitive personal information: If you are a California resident you also have the right to limit the collection and processing of your sensitive personal information. We limit the collection, use, and disclosure of your sensitive personal information to that which is necessary to provide our services to you or for another permitted purpose under applicable law (such as detecting security incidents) and we do not use this information to infer characteristics about you. Our service providers are contractually obligated to limit their use and disclosure of your sensitive personal information to that which is necessary for the business purpose set forth in our contract with them. Since we already limit the collection and use of your sensitive personal information, an opt out is not necessary.

Right to opt out: You have the right to opt out of the sale of your personal data as well as the processing of your personal data for the purposes of targeted advertising and certain instances of profiling. If you reside in a state that requires an opt out for targeted advertising (as such term may be defined under applicable law), we will not engage in such activities, and will not engage in “profiling” in any way that would require an opt out.

If you wish to opt out of the sale or sharing of your personal data pertaining to Empower’s use of third-party cookies as described here, you may do so by clicking on the “do not sell or share my personal information” link at the bottom of this webpage, or if you are using a mobile app, by opting out in the Privacy Preference Center under the “Settings” section of your Profile. In the future if you change browsers, devices, or clear your cookies, you will need to opt out again as described above. You may also opt out of the sale and sharing of your personal information through the Global Privacy Control as described here.

Please note that Empower will continue to share your data with service providers as permitted by law and described in this Privacy Policy.

EXERCISING YOUR RIGHTS

If you have an Empower dashboard account, you can access a report of your personal data or correct any inaccuracies in your personal data through your dashboard account. You can do this by logging into your account and going to the privacy section under Settings or you can contact [email protected]; additionally, if you are an Advisory Client, you can also contact your financial advisor.

For all other requests or if you do not have an Empower dashboard account, you may fill out a Privacy Request Form and email it to [email protected] or call our toll-free number at 855-756-4738. You will need to provide your full name, phone number, email, and address so we can authenticate your request and locate your information. In certain circumstances, if we believe it is necessary to authenticate your request and protect the security of your information, we may require additional information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must include sufficient detail that allows us to properly understand, evaluate, and respond to it.

When making a request, in order to maintain the security of your personal information and verify your identity, we may require you to call our service center or log in to your account to answer a few identity-related questions, including providing additional information about yourself. We may deny your request in the event there is an exemption under applicable law that pertains to your request or if we are not able to verify your identity.

DESIGNATING AN AUTHORIZED AGENT

You may use an authorized agent to submit a request on your behalf. To do so, the authorized agent should provide a copy of your signed authorization to [email protected]. You will also be required to verify your identity directly with us or confirm that you provided the authorized agent with permission to submit a request on your behalf.

RESPONDING TO REQUESTS AND YOUR APPEAL RIGHTS

Upon receiving your request, we will confirm receipt of your request as required by applicable law. Such confirmation will include our verification process and when you should expect a response. We will respond to a verifiable consumer request as required by law. If we require more time (if permitted by applicable law), we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

If we decline to take action on your verifiable request, we will provide you with a notice that includes our reason for not taking action and instructions for submitting an appeal. Should you wish to submit an appeal, you will have 60 days from the date of the notice to do so. You may submit your appeal by emailing us at [email protected].

NONDISCRIMINATION

We will not discriminate or retaliate against you for exercising any of your rights under applicable consumer privacy laws. To the extent prohibited by applicable law, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by applicable law that can result in different prices, rates or quality levels. Any legally permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior consent, which you may revoke at any time.

Notice to Nevada residents

We are providing you this notice under Nevada state law. You may be placed on our internal Do Not Call List by contacting us.

In addition to contacting us, Nevada residents can contact the Bureau of Consumer Protection, Office of the Nevada Attorney General, in writing at 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; by calling (702) 486-3132; or by emailing: [email protected].

Modifications to our privacy policy

We may change our privacy practices from time to time as the need arises. When we do, we will post the revised notice to our website. If there are material changes to this Privacy Policy, notice will be provided as permitted under applicable law including by electronic notice on our website, by posting a notice of the changes to your account, and/or through electronic delivery.

Requests, questions, or complaints

To submit privacy-related questions, requests, or complaints, please call our toll-free number at 855-756-4738 or send us an email at [email protected]. Please do not put any confidential or personal account information in an email request. In addition, you may contact us by mail to the address below:

Empower

Attn: Vice President, Privacy Compliance

8525 E Orchard Rd, 2T3

Greenwood Village, CO 80111

About us

The policy is applicable to the following family of companies and brands:

Empower Retirement, LLC
Empower Annuity Insurance Company of America
Empower Life & Annuity Insurance Company of New York
Empower Plan Services, LLC
Empower Advisory Group, LLC
Empower Financial Services, Inc.
The Canada Life Assurance Company (US operations)
Great-West Life & Annuity Insurance Company of South Carolina
Empower Capital Management, LLC
Empower Funds, Inc.
Empower Trust Company, LLC.
Empower Holdings, LLC
Empower Annuity Insurance Company
TBG Insurance Services Corporation
MC Insurance Agency Services, LLC
Mullin TBG Insurance Agency Services, LLC
COMOSA REIT Corp.
Empower Personal Wealth, LLC
Personal Capital Services Corporation
Empower Services Holdings US, LLC
PAFI, LLC
PAFL, LLC

Rev. March 31, 2025

You may download a PDF version of this Privacy Policy here.