Privacy Notice for California Employees, Applicants, and Independent Contractors

Empower Retirement, LLC and its affiliates (“Empower”, “us”, or “we”) take data privacy very seriously and are committed to protecting and respecting the privacy, security, and integrity of the personal information of our employees, applicants, and independent contractors (“you” our “your”). This notice describes how we collect, use, disclose, and retain your personal information. Personal information means information that, when used alone or with other relevant data, personally identifies, or is capable of personally identifying, you or your household, either directly or indirectly, or as otherwise defined by law. Personal information does not include publicly available information (as defined in the CCPA), data that has been deidentified, or information that is subject to certain laws that are excluded from the CCPA’s scope such as personal information subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), The Fair Credit Reporting Act (FCRA), the Driver’s Privacy Protection Act of 1994, or the California Financial Information Privacy Act (FIPA).

Categories of Personal Information We Collect

The chart below describes, in the preceding 12 months, the categories of personal information and sensitive personal information we have collected, the sources from whom or where it was collected, and the business purpose(s) for which it was collected. We will not use your personal information for materially different, unrelated, or incompatible purposes without providing you notice as required by law. We retain your personal information until all applicable legal and business obligations are fulfilled.

Categories of Personal Information Collected	Source of Collection	Business purpose for collecting
A. Identifiers. These may include your name, alias, address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, and other similar identifiers. *E, A, IC	From you or from third parties with your consent.	We collect this information to determine employment eligibility, provide benefits, for security purposes including to facilitate emergency communications, and to comply with applicable laws, and to facilitate our relationship with independent contractors. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). This may include your name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, and health insurance information. *E, A, IC	From you or from third parties with your consent.	We collect this information to determine employment eligibility, provide benefits, for security purposes including to facilitate emergency communications, and to comply with applicable laws. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
C. Characteristics of protected classifications under California or federal law. This may include, for example, your age, race, religion, national origin, citizenship, sex, marital status, medical conditions and information about any disabilities that require accommodation. *E, IC	From you or from third parties with your consent.	We collect this information to provide benefits, for security purposes including to facilitate emergency communications, and to comply with applicable laws. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
D. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. *E	From you or from third parties with your consent.	We collect this information to provide benefits. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
E. Biometric Information which refers to an individual’s physiological, biological or behavioral characteristics that is used or intended to be used to establish individual identity. Biometric Information may include, but is not limited to, facial recognition, fingerprint data or voiceprint data. *E	From you or from third parties with your consent.	We may collect this information for certain associates as required for licensing purposes and for security purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
F. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications, or advertisements. This may also include information about your use of our IT systems, email, messaging and other communications. *E, A, IC	From company-owned devices or networks.	We collect this information for security purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
G. Geolocation data. For example, for security purposes we track the location of logins to employee accounts and company-owned devices and access to company facilities. *E, A, IC	From company-owned devices or networks.	We collect this information for security purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
H. Audio, electronic, visual, thermal, olfactory, or similar information. For example, your image and/or voice may be captured by our security monitoring systems and we may track your badge access when you enter or leave our offices. In addition, we record certain calls for training and compliance purposes and use employee likeness for internal identification. *E, A, IC	From you or from third parties with your consent.	We collect this information for training and compliance purposes as well as for security purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
I. Professional or employment-related information. This includes both employment history as well as all information about your employment or contract relationship with us. *E, A, IC	From you or from third parties with your consent.	We collect this information to verify employment eligibility. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
J. Non-public education information subject to the federal Family Educational Rights and Privacy Act, such as student records.	We don’t collect.	Not applicable.
K. Inferences drawn from any of the information listed above for information regarding an individual’s abilities, aptitudes and characteristics. *E, A, IC	From the personal information listed above provided by you or a third party.	We collect this to evaluate qualifications for employment. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.

*Pertains to the following: E – employee; A – applicant; IC – independent contractor

Categories of Sensitive Personal Information We Collect

Sensitive Personal Information is a subcategory of Personal Information. The chart below describes, in the preceding 12 months, the categories of sensitive personal information we have collected, the sources from whom or where it was collected, and the business purpose(s) for which it was collected. We retain your sensitive personal information until all applicable legal and business obligations are fulfilled.

Categories of sensitive personal information	Sources	Business purpose
Government identifiers. This includes a consumer’s social security, driver’s license, state identification card, or passport number. *E, A, IC	From you or from third parties with your consent.	We collect this information to determine employment eligibility, provide benefits, for security purposes including to facilitate emergency communications, and to comply with applicable laws, and to facilitate our relationship with independent contractors. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you.
Financial account information. This includes account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.	We don’t collect.	Not applicable.
Precise geolocation data. This includes data used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1850 feet except as otherwise set forth in applicable law or regulations. *E, A, IC	From you when you access the company facilities.	We collect this for security purposes. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy.
Certain demographic information. This includes a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership. *E, A	From you, if you provide this voluntarily.	We collect this for diversity reporting and analytic purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you.
Private communications. This includes contents of a consumer’s mail, email and text messages, unless Empower is the intended recipient of the communication. *E	We don’t collect except for use of company owned devices.	We collect this for security and employment-related purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you.
Genetic data.	We don’t collect.	Not applicable.
Processing of biometric information for the purpose of uniquely identifying you. *E	From you or from third parties with your consent.	We may collect this information for certain associates as required for licensing purposes and for security purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you.
Personal information collected and analyzed concerning a consumer’s health. *E	From you.	We collect this for administering benefits. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you.
Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. *E	From you, if you provide this voluntarily.	We collect this for diversity reporting and analytic purposes. We may disclose this information to service providers, auditors and regulatory authorities, and other parties as set forth in our online Privacy Policy. We limit our collection, use, and disclosure of this category of personal information to those permitted business purposes under the CCPA such as detecting security incidents. We do not use this information to infer characteristics about you.

*Pertains to the following: E – employee; A – applicant; IC – independent contractor

Sources for collecting your personal information

We obtain information directly from you and other sources. For example, we obtain information from forms you complete in the course of your employment with Empower (ie: employment application, onboarding documents, enrollment in benefits, records of professional development, etc.) We may collect personal information from conversations or correspondence you have with a Human Resources representative or supervisor. We may also observe your actions from the internet or network activity from a company-owned device, as described above. In addition, we obtain some categories of personal information listed above directly from third parties. For example, prior to extending an offer of employment we conduct various background checks to confirm your eligibility of employment.

Disclosure of your personal information

We may disclose your personal information to a third party for the business purposes described above, such as determining employment eligibility, providing employee benefits, to ensure the security of our personnel and assets, and to comply with applicable laws. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We disclose your personal information with the following categories of third parties: service providers (including affiliates), vendors, auditors, and applicable regulatory authorities.

Deidentified or pseudonymous data

We maintain and use deidentified data in such a way that any information can no longer be linked to you or any device associated with you. After data has been deidentified, i) we maintain and use such deidentified data without attempting to reidentify the data or re-associate it with specific individuals; ii) we take reasonable measures to ensure that the information cannot be reassociated with you or your household; and iii) we have implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information. Such data is used for research and benchmarking purposes. We contractually obligate all recipients of the deidentified data to comply with applicable laws pertaining to deidentification and we monitor compliance with any contractual commitments.

Your rights and choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Right to know what personal information is being collected, sold, or disclosed for a business purpose

Subject to applicable exemptions in the CCPA, you have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal information. Once we receive and confirm your verifiable consumer request, to the extent required by the CCPA, we will disclose to you:

The categories of personal information we collected about you;
The categories of sources from which the personal information was collected;
The business or commercial purpose for which we collected or sold the personal information;
The categories of third parties with whom we share personal information;
The categories of personal information that we sold, and for each category identified, the categories of third parties to whom we sold the particular category of personal information;
The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of personal information; and
The specific pieces of personal information we have collected about you.

Right to correct inaccurate personal information

You have the right to request correction of your personal information that is inaccurate. Once we receive your verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information as described in your request. You may be required to provide additional documentation if necessary to determine the accuracy of your personal information.

Right to opt out of the sale and sharing of your personal information

Empower does not sell your personal information in any way that would require an opt out. This includes the personal information of minors, as defined by law.

Right to limit the use and disclosure of sensitive personal information

We limit the collection, use, and disclosure of your sensitive personal information for permitted purposes under the CCPA such as detecting security incidents and we do not use this information to infer characteristics about you. Our service providers are contractually obligated to limit their use and disclosure of your sensitive personal information to that which is necessary for the business purpose set forth in our contract with them. Since we already limit the use of your sensitive personal information, an opt-out is not necessary.

Right to request deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will deidentify or delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Exercising your rights to know, correct, and delete

To submit a request please fill out the Privacy Request Form and email it to us at privacymatters@empower.com , or send it by mail directed to the Chief Privacy Officer at 8525 E. Orchard Rd., 2T3, Greenwood Village, CO, 80111; you may also exercise your rights by calling us toll-free at 888-507-2828. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. Do not include any confidential information in any e-mail that you send pursuant to this paragraph. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must include sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may deny your request in the event that any exemptions in the CCPA are applicable to your request or we are not able to verify your identity.

Response timing and format

We will confirm receipt of a request to know, request to correct, or a request to delete as required by applicable law. Such confirmation will include our verification process and when you should expect a response. We endeavor to respond to a verifiable consumer request within 45 days of its receipt or as required by law. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Nondiscrimination & Nonretaliation

We will not discriminate or retaliate against you for exercising any of your CCPA rights. To the extent prohibited by the CCPA, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.
Retaliate against an employee, applicant for employment, or independent contractor, as defined under the CCPA, for exercising any CCPA rights.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior consent, which you may revoke at any time.

Any information that you provide as a customer or consumer of any services or products provided by Empower are separately covered by the applicable Terms of Use, online Privacy Policy and/or client agreement.

Privacy notice available for download here

Last Updated: September 1, 2023