EMPOWER ANNUITY INSURANCE COMPANY

Home Browse Search

4. CCPA Compliance. Each Party hereto agrees and certifies that such Party complies with all applicable sections of the California Consumer Privacy Act of 2018 and its implementing regulations, as amended or superseded (the "CCPA"), in connection with this Agreement. Empower will notify Plan Sponsor in the event it determines that it is no longer able meet its obligations under the CCPA. 4.1 Empower processes Personal Data to provide the Services under the Agreement for the following purposes: to maintain or service retirement accounts, provide participant service, education and support, to offer financial wellness programs to participants, to maintain online participant accounts, to provide call center services, to respond to inquiries, to provide benchmarking services to Plan Sponsor, and additional specific services as further described in Schedule A-1 (collectively, the "Business Purpose"). 4.2 Except as otherwise permitted by the CCPA, Empower will use, disclose, and retain Personal Data solely for the Business Purpose and will not use, disclose, or retain Personal Data for commercial purposes other than for the Business Purpose. Except as otherwise permitted under the CCPA, Empower will not use, disclose, or retain Personal Data processed in connection with the Services outside the direct business relationship with Plan Sponsor nor combine personal information that it received from, or on behalf of, Plan Sponsor with personal information that it received from another source or collected from its own interaction with the consumer, except as required to provide the Business Purpose or as otherwise permitted by applicable laws. 4.3 Empower will not sell or share Personal Data in any manner in violation of the CCPA. 4.4 Upon priorwritten notice to Empower, Plan Sponsor may take reasonable and appropriate steps to (i) ensure Empower uses the Personal Data collected is in a manner that complies with the CCPA and (ii) stop and remediate any unauthorized use of Personal Data by Empower. 4.5 Empower shall enable the Plan Sponsor to comply with consumer requests made pursuant to the CCPA to the extent compliance with such requests is required by the CCPA. 4.6 In the event the CCPA is pre-empted by Federal laws, the terms of this Section 4 shall no longer be applicable, and upon the request of either party hereto, the parties shall cooperate in good faith to reasonably amend or modify these terms to address future changes to Data Protection Laws that require such amendments. 4.7 Empower shall implement security practices and procedures appropriate to the nature of the Personal Information as set forth herein. 5. Subprocessing. Plan Sponsor hereby agrees that Empower may engage its Affiliates and third parties as Subprocessor in connection with the provision of Services under the Agreement. Empower shall carry out reasonable due diligence as appropriate to the nature of each Subprocessor's services to ensure that the Subprocessor can provide the level of protection for Personal Data required by this Program. Upon request, Empower shall make available a current list of any material Subprocessors that have access to Personal Data; the parties hereto agree that such list is the Confidential Information of Empower and subject to the confidentiality provisions of the Agreement. 6. Data Subject Rights. In the event that Empower receives a request from a Participant relating to an exercise by the Participant of the Participant's rights under applicable Data Protection Laws (such as a "right to know" or "right to delete" request), Empower will Direct such Participant to take the request to the Plan Sponsor. Empower will cooperate with any request by the Plan Sponsor to respond to requests to the extent required by applicable Data Protection Laws. City Y ounce - 19 -17 9/19/2023