Outsourcing Privacy Notice

LAST UPDATED: DECEMBER 2023

THIS NOTICE DESCRIBES HOW PERSONAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

WHO WE ARE

Willis Towers Watson, our affiliated entities, subsidiaries, and successors in interest (collectively, "WTW," "we," "our," or "us") provide some or all the following services: benefits enrollment; benefits administration; pension administration; and the creation and hosting of websites (collectively, "Services"), on behalf of employers who offer healthcare, retirement, or similar employee benefit plans. Our clients who provide health, retirement, or similar plans for the benefit of their employees are referred to as "Plan Sponsors."

The Plan Sponsor of your benefit plan(s) has hired WTW to provide these Services (including, as appropriate, this website) to you. For most participants, the Plan Sponsor is your current or former employer. The Services provide benefits enrollment, eligibility, administration, and other support related to the benefits programs made available to you by the Plan Sponsor.

SCOPE AND PURPOSE OF THIS NOTICE

WTW is committed to privacy and transparency in our information practices. This Privacy Notice ("Notice") describes how we receive, collect, process, and share your personal information in our role as a "data processor" or "service provider" in delivering the Services, which include, but are not limited to, this website, our telephone service centers, and benefit administration, and electronic communications such as HTML-formatted email messages that may be sent to you.

This Notice describes our overall privacy and data protection practices related to the Services. Please note that our collection, use, disclosure, and processing of personal information about individuals will vary depending upon the circumstances. As a result, in some cases, different or additional notices about our data collection and processing practices may be provided and/or may apply to our processing of certain personal information. Our exact practices will depend on and will always be limited by the terms of our contract with the Plan Sponsor.

OUR ROLE

When providing the Services, WTW acts as a "data processor" or "service provider" under applicable privacy and data protection laws. This means that we will only process personal information on behalf of, and subject to the limitations and instructions that we receive from, the Plan Sponsor. If our contract with our client is more restrictive than the terms of this Notice, the more restrictive contract terms will apply.

In most cases, the Plan Sponsor will be the responsible "controller" or "business" under applicable privacy laws with respect to your personal information. If you have questions or would like more information about how your personal data is processed more generally (e.g., outside of the Services we provide), please contact the Plan Sponsor and/or review their privacy notice.

HOW WE COLLECT, USE AND DISCLOSE PERSONAL INFORMATION

"Personal information" includes other similar terms under applicable privacy laws such as "personal data" or "personally identifiable information." In general, personal information is information that identifies, relates to, describes, or is reasonably capable of being associated with, or could be linked (directly or indirectly) with a particular individual or identifiable person.

The types of personal information we may collect include, but are not limited to:

Name, contact information, and related identifiers (such as name, postal address, email address, unique personal identifier, Internet Protocol address, account name, social security number, social insurance number, driver's license, or state identification number);
Customer records (such as paper and electronic customer records containing personal information, such as name, signature, telephone number, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, and health insurance information);
Characteristics of protected classifications (such as gender, age, and disability);
Usage data (such as information regarding your interaction with our websites and applications);
Audio/visual data (such as call recordings (if you call our service center) and photographs (if you submit identification documents to us));
Professional or employment-related information (such as worksite, job classification, salary history, and job end or termination date);
Information about education-related history or background (such as student status);
Genetic information (if you provide genetic information to us, such as results of paternity tests, in connection with verification of dependent status).

Some of the information we collect is provided by the Plan Sponsor to confirm whether you, your spouse or partner, and/or dependents are eligible for benefits. You may be asked to provide additional information or to update or correct information about yourself, your spouse or partner, your dependents, and beneficiary designations.

If you submit any personal information relating to other people to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Notice and applicable laws.

How We May Collect Personal Information

We may collect personal information in a variety of ways, including, but not limited to:

Through the Plan Sponsor: such as through data files from the Plan Sponsor.
Through the Services: such as when you model your benefits or provide or change your personal information through the website.
Offline: such as through mail or when you contact our telephone service center, if applicable.
From Other Sources: from third parties engaged by the Plan Sponsor to provide benefits-related services.

How We May Use Personal Information

Our uses of personal information will be subject to and consistent with our contractual agreements with the Plan Sponsor. The purposes for which we may process personal information will vary depending upon the circumstances in which we interact with you. In general, we use personal information that we collect about you to provide the Services (for example, to determine your benefit eligibility, validate election information, and otherwise facilitate your enrollment) and to comply with legal obligations. In addition, to the extent permitted by our contract with the Plan Sponsor, we may utilize personal information in the following ways:

To respond to your inquiries and fulfill your requests, such as to send you plan disclosures or benefit information. Your personal information may be shared with third-parties (a printer or other service provider, for instance) involved in fulfilling the order or request.
To determine your beneficiary.
To send administrative information to you such as information regarding the Services and changes to our terms, conditions, and policies.
To personalize the content and information provided to you.
For our internal use to build or improve the quality of our Services.
For fraud monitoring and prevention and security purposes.
To audit and improve our Services, including in support of training and quality control efforts.
As we believe to be necessary: (a) to comply with the law or a legal obligation; (b) to comply with legal process (such as a subpoena or court order); and (c) to protect the rights, privacy, safety, and property of ourselves and others.
To contact you regarding the Services by using an automated telephone dialing system and/or artificial or prerecorded voice.

Aggregated and de-identified information. Subject to any contractual agreement with the Plan Sponsor, we may use de-identified and/or aggregated information and reports related to the Services to assess, improve, and develop our business, products, and services, prepare benchmarking reports on our industry, and for other research, marketing, and analytics purposes. Any information contained in such reports is not relatable or identifiable to a particular individual or Plan Sponsor. We do not share any personal information with third parties in such cases.

How Personal Information May Be Disclosed

Your personal information may be disclosed or transferred, in accordance with our contract with the Plan Sponsor, as follows:

To the Plan Sponsor.
To our affiliated companies, vendors, and service providers who perform functions in support of the Services, such as website hosting, data analysis, payment processing, address search, fulfillment, information technology and related infrastructure provision, customer service, email delivery, and auditing.
To vendors and third parties selected by the Plan Sponsor to provide you with services associated with your benefits and/or provide professional services to the Plan. Use of your personal information by the Plan Sponsor or such vendors and third parties is governed by the privacy policies of the Plan Sponsor or the vendors and third parties, not this Notice.
To other individuals and third parties as directed by the Plan Sponsor or by you.
To a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
As we believe to be necessary: (a) to comply with the law or a legal obligation; (b) to comply with legal process (such as a subpoena or court order); or (c) to protect the rights, privacy, safety, and property of us and others.

COOKIES

Cookies are small text files that a website transfers to your device to store and sometimes collect information about your usage of our websites, such as time spent on the websites, pages visited, language preferences, and other traffic data. We use the information for security purposes, to facilitate navigation, to display information more effectively, to personalize your experience while using our websites, and to recognize your computer to assist your use of the websites. We also gather statistical information about use of the websites to improve their design and functionality, understand how they are used, and assist us with resolving questions regarding them.

There are different types of cookies, for example:

Cookies served directly by WTW ('first party cookies') and cookies served on our behalf, for example by data analytics companies ('third party cookies').
Cookies which endure for different periods of time, including those that last only as long as your browser is open (referred to as 'session cookies'). These are deleted automatically once you close your browser. Other cookies are 'permanent cookies', meaning that they survive after your browser is closed. For example, they recognize your device when you open your browser and browse the internet again.

Below is a description of the different types of cookies and similar technologies that may be used on the websites:

This section applies to the extent any Personal Information (which is information that identifies you as an individual or relates to an identifiable individual or household) is collected through cookies or similar technologies.

Strictly Necessary Cookies. Strictly necessary cookies enable you to navigate the websites and to use their services and features. Without these necessary cookies and similar technologies, the websites will not perform as smoothly for you as we would like them to and we may not be able to provide the websites or certain services or features.

Functional Cookies. Functional cookies collect information about your use of the websites and enable us to improve the way they work. For example, functional cookies show us which are the most frequently visited pages on the websites, help us record any difficulties you have with the websites, and show us whether our enrollment campaigns are effective. This allows us to see the overall patterns of usage on the websites. We use the information to analyze traffic on the websites.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit allaboutcookies.org.

THIRD PARTY SERVICES

The Services may include links to websites for the Plan Sponsor and other third parties such as insurance carriers, government agencies, and financial service providers. If you access these links, you will be leaving the Services. Your use of such third-party sites is governed by the privacy policies of those third parties, not by this Notice. This Notice does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including the Plan Sponsor or any third party operating any site or service to which the Services may link. The inclusion of a link on the Services does not imply endorsement of the linked site or service by us or by our affiliates.

SECURITY

We have implemented security measures to protect personal information we collect. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of your account has been compromised), please immediately notify us in accordance with the Contacting Us section below. To fight spam and abuse on some of our systems, we use Google reCAPTCHA Enterprise which is subject to Google's Privacy Policy and Terms of Use.

YOUR DATA PRIVACY RIGHTS

Certain individuals may have a legal right to review, correct, update, or delete personal information pursuant to applicable privacy and data protection laws. As indicated above, WTW acts as a "data processor" or "service provider" under applicable privacy and data protection laws. For this reason, in most cases the Plan Sponsor, not WTW, is legally responsible for fulfilling any legal rights requests you might have. In accordance with applicable law, we will cooperate and facilitate any authenticated data rights requests which we may receive through a Plan Sponsor.

Data may be accessed and, in some cases, corrected through our self-service website. You may also be able to access data and make data corrections through a toll-free telephone number established for the purpose of administering your benefits. If you do not want to, or you are unable to, self-serve through our website or the toll-free telephone number (if any) established for the purpose of administering benefits, you may exercise your rights by contacting the Plan Sponsor, subject to applicable law.

If you reside in Canada, you have the right to request access to any additional information that we hold about you subject to limited exceptions under applicable law. If you believe that any information that is held about you is inaccurate, you may also request a correction.

Applicable privacy and data protection laws vary from state to state and may limit the fulfillment of a rights request. For example, the Plan Sponsor may limit a rights request so that it can retain certain information for recordkeeping purposes and/or to complete any transactions that began prior to the request for a change or deletion.

RETENTION PERIOD

We will retain your personal information as directed by the Plan Sponsor and otherwise for the period necessary to fulfill the purposes outlined in this Notice, for our own compliance reasons, or longer where required by law.

USE OF SERVICES BY MINORS

The Services are not directed to individuals under the age of sixteen (16), and we request that individuals under age 16 not provide personal information through the Services.

Because of the nature of our Services, we do not solicit or intentionally receive information from children under the age of 16, except that we do collect information regarding dependent children that pertains to their benefits coverage and to beneficiary designations.

CROSS-BORDER TRANSFER

To the extent allowed by our agreement with the Plan Sponsor, your personal information may be collected, stored, and processed in any country where we have facilities or in which we engage service providers. By using the Services, you acknowledge that we may transfer your personal information to countries outside of your country of residence which may have laws and data protection rules that are different from those of your country of residence. While your information is in another jurisdiction, it may be accessed by the local courts, law enforcement, and national security authorities. To receive information regarding our policies and procedures with respect to service providers in different countries, please email or write to us at the address in the Contacting Us section below.

SENSITIVE INFORMATION

We ask that you not send us, and not disclose, any sensitive personal information (for example, information related to racial or ethnic origin, political opinions, religion or other beliefs, or criminal background) on or through the Services or otherwise.

UPDATES TO THIS NOTICE

We may change this Notice from time to time. The "LAST UPDATED" legend at the top of this page indicates when this Notice was last revised. We encourage you to refer to this Notice often for the latest information about our personal information practices. By continuing to utilize the Services, you are agreeing to the terms contained in the last revised Notice.

INFORMATION FOR CALIFORNIA RESIDENTS

In providing the Services, we do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act (CCPA).

If you wish to submit a consumer rights request under the CCPA, please do so through the Plan Sponsor. We will cooperate with and facilitate these requests to the extent required by law.

INFORMATION FOR RESIDENTS OF QUEBEC

As provided above, your personal information may be collected, stored, and processed in any country where we have facilities or in which we engage service providers. Consequently, we may transfer your personal information outside of Quebec. See CROSS BORDER TRANSFER for additional information. If you are a resident of Quebec and you have any questions about this Notice or how your personal information may be used or disclosed, please contact Sarah Flint at privacy@willistowerswatson.com or by mail at 1500-130 King St W, Toronto, ON M5X 2A2.

CONTACTING US

Except as otherwise provided above, if you have any questions about this Notice or how your personal information may be used or disclosed, please contact us at privacy@willistowerswatson.com or toll-free at 888-471-4502. Because email communications are not always secure, please do not include credit card or other sensitive information in your emails to us.

For all other inquiries, please refer to the contact information on this website or the service center contact information provided by your Plan Sponsor.