Information Use Policy NATIONAL RURAL ELECTRIC COOPERATIVE ASSOCIATION Policy The National Rural Electric Cooperative Association, its Affiliates 1, and its Voting and Non- Voting Members (collectively, NRECA ) offer numerous products, programs and services ( Services ) to members of NRECA ( Member(s) or Employer(s) ) and their employees ( Employees ). NRECA is committed to protecting Employees privacy. This Information Use Policy ( Policy ) is designed to assist you, the Employee, and Members, in understanding how NRECA collects and uses the Information you or your Employer provide to us and to assist you in making informed decisions when using NRECA Services. This Policy applies to any Information (as defined below) collected by NRECA, including Information collected through NRECA web sites. You as an Employee and your Employer have the right to Opt Out of the use of Information collected by NRECA at any time, with the exception of Information used for the purpose of administration of certain Services, such as the Plans (as defined in footnote 1). We refer to this as your right to Opt Out. If you elect to Opt Out, then your Information will only be used for the purpose of Services that you subscribe to individually, or that your Employer subscribes on your behalf, such as the Plans. If you elect not to Opt Out of permitting NRECA to utilize Information, you agree that NRECA shall not be liable for NRECA s use of your Information, and to communicate to you about NRECA s Services, to the extent permitted by law. NRECA s commitment As an Employee of a Member, you or your Employer may have entrusted to NRECA s care not only your hard-earned money but your personal and financial data as well. NRECA recognizes that its relationship with you is based on trust, and that you expect NRECA to act responsibly and in your best interests. Because your personal and financial data are your private information, NRECA holds itself to the highest standards in their safekeeping and use. NRECA treats different types of Employee Information in distinct ways, whether it is Personal Employee Information 2, Employer Information about Employees 3, or Plan Administration Information 1 Affiliates for the purposes of this Policy include Electric Life Insurance Company (ELCO), NRECA United Inc., Cooperating Insurance Services (CIS), Cooperative Benefits Administrators, Inc. (CBA), Cooperative Energy Services (CIS), RE Investment Corporation (REI), RE Advisors Corporation (REA), NRECA International Limited, NRECA International Foundation, Wood Quality Control, Inc., the Homestead Funds, Touchstone Energy, and the three NRECA-sponsored employee benefit plans, including the 401(k) Pension Plan, Group Benefits Program, and Retirement Security Plan (collectively the Plans ). 2 The term Personal Employee Information means data specific to an Employee, or their dependents, that is not generally necessary for employment purposes but which may be Information Use Policy Page 1
about Employees 4 (collectively Information ). NRECA uses Information primarily to communicate, educate, and complete transactions that you request or to make you aware of other Services that NRECA offers or sponsors to Members and their Employees. The information NRECA collects You or your Employer provide Information when you enter the data at your employer or at home, or when you or your Employer enters Information on one of the NRECA systems, or when you or your Employer contact NRECA to use one of the many Services that NRECA makes available. You or your Employer may also provide Information when you request literature or a transaction that involves NRECA. In addition to Information you or your employer provide to NRECA, NRECA may receive Information about you that you authorize third parties to provide to us. NRECA also may obtain Information from third parties in order to verify your identity, to prevent fraud, or to help NRECA identify Services that may benefit you. We and our e-mail service providers may determine whether you receive and open our e-mails by using pixel tags, also known as web beacons, which are tiny transparent graphic images embedded in a web page or e-mail to measure usage and activity. This enables us to gauge the effectiveness of communications. Information collected from any source may include, among other things, your name and home or work address, e-mail, phone, gender; Social Security or taxpayer identification number, dates of birth, divorce, retirement or divorce; dates of hire, disability or termination; compensation (identified or de-identified), assets, income, account balances, investment activity, and accounts at other institutions. Some of this Information is shared between NRECA, its Affiliates, and its Members and some of the Information is never shared between NRECA, its Affiliates and its Members except for the purpose of administering your accounts or benefits. The Information we collect about you may be transferred to or stored by NRECA, its Affiliates or its Members in the United States or elsewhere, as permitted by law. necessary for Plan Administration purposes, including: employee s home phone, home fax, home e-mail, home address, personal cell phone, marital status, data of birth, and gender; plan eligibility status; subscription information, and retirement or projected retirement date(s). 3 The term Employer Information about Employees refers to data maintained by a Member as a result of the employment relationship, including subgroup ID, an Employee s first, middle and last name; work phone and cell phone, work fax, work e-mail, work address; employment status, hire and fire dates, job and location code, union classification, and job code compensation (deidentified). 4 The term Plan Administration Information About Employees refers to data that is specific to an Employee that is intended to be used exclusively for the purposes of administration of the Plans or other financial services operations, including Social Security numbers, dependent information, compensation (identified), payroll frequency, plan eligibility dates, disability status, account balances, claims and related information (and any Protected Health Information as defined by HIPAA), Medicare indicator, or any other related information. Information Use Policy Page 2
Termination NRECA reserves discretion to terminate an Employers or Employees or a Members or a sponsor s access to Services, and Information related thereto, at any time for any reason in NRECA s sole discretion as applicable, to the extent permitted by law. How NRECA handles personal Information Here are some examples of how NRECA handles your Information: In order to carry out the requirements of the Services, either directly or through your Employer, provided by NRECA, NRECA will utilize Information to operate the Services. For example, in order to complete certain transactions or account changes that you direct in your 401(k) Plan, it may be necessary to provide Information to employees of NRECA. However, in the case of some Affiliates, such as the Plans, NRECA will not utilize any Plan Administration Information for any purpose other than those entities. In order to complete certain third-party transactions or account changes that you direct, it may be necessary to provide Information to third-party companies, individuals, or groups that help operate and administer programs for NRECA. For example, if you ask to transfer assets from another financial institution to NRECA s 401(k) Pension Plan or the Homestead Funds, NRECA will need to provide certain Information about you to that company to complete the transaction. Employer Information about Employees requested by Voting, Non-Voting Members, sponsors may be distributed to facilitate Employees access to certain Services provided by NRECA, its members, affiliates, and sponsors. Information provided when Employees request Services or respond to surveys conducted by NRECA will be made available to appropriate NRECA employees in order to respond and implement requests for Services. In order to alert you to other Services that NRECA offers or sponsors, NRECA may share your Information with the Affiliates, to the extent permitted by law. This would include, for example, sharing your Information within NRECA to make you aware of NRECA funds or other investment offerings, or the retirement planning services offered through NRECA, or the other financial services products available through NRECA. As another example, there are many companies that help NRECA operate programs for your benefit. In certain instances, NRECA may contract with nonaffiliated companies to perform services for us. Where necessary, NRECA will disclose information NRECA have about you to these third parties. In all such cases, NRECA provides the third party with only the Information necessary to carry out its assigned responsibilities, and only for that purpose. And NRECA requires these third parties to treat your private Information with the same high degree of confidentiality that NRECA does. Any necessary Information will be disclosed to any appropriate NRECA employees or external authorities in order to identify and pursue remedies against Employees who attempt to damage, misuse, or otherwise interfere with NRECA s various Services. Your Information will often be maintained for long periods of time, depending on the Service to which you or your Employer subscribed. In many instances, retention of such Information is necessary as a result of federal requirements. For example, Information necessary to operate the Retirement Security Plan will often be maintained in perpetuity to ensure that the Plan Administrator can provide records concerning an Employee s Information Use Policy Page 3
benefit at a later date. Retention of such Information may involve third-parties, who are subject to the same strict privacy policies as NRECA. Finally, NRECA will release Information about you if you direct us to do so, if NRECA is compelled by law to do so, or in other legally limited circumstances (for example, to prevent fraud). How NRECA protects privacy online NRECA s concern for the privacy of Employees of Members naturally extends to those who use any of NRECA s websites and systems, which will have their own Terms of Use designed to further ensure protection of your Information. Here is a summary of some of the web site privacy measures: NRECA s website uses some of the most secure forms of online communication available, including data encryption, Secure Sockets Layer (SSL) protocol, and user names and passwords. These technologies provide a high level of security and privacy when you access your Information, initiate online transactions, or send secure messages. NRECA offers customized features that require the use of "cookies" and similar data files tiny pieces of information that NRECA asks your browser to store. Certain sections of NRECA s site require cookies to be enabled to enhance website performance. For example, cookies enable NRECA to personalize and improve your user experience and help enhance site navigation. Cookies also help NRECA to understand how people use its site so that NRECA can improve site structure and functionality. However, NRECA make very limited use of these cookies and data files. NRECA doesn t use them to pull data from your hard drive or to view data in cookies or other similar data files created by other websites. NRECA will not share the Information in these data files or give others access to it except to help NRECA better serve your needs and in accordance with this privacy policy. When you visit NRECA s website, NRECA may collect, either directly or through thirdparty service providers, certain technical and navigational Information, such as computer browser type, internet protocol address, pages visited, and average time spent on our website. This information may be used, for example, to alert you to software compatibility issues or to resolve technical or service problems, or it may be analyzed to improve NRECA s web design and functionality and our ability to serve you and your accounts. In certain cases, NRECA may use third-party service providers to place advertisements for it on other websites, and to help NRECA measure brand awareness and the effectiveness of its online advertising. These service providers may use cookies and pixel tags to collect limited technical, web navigation, and other Information, such as the advertisement presented, your IP address, operating system and browser type, the web page from which you linked to our site (if any), and pages visited or generated on NRECA s site. NRECA and its service providers may use data collected on this site to serve ads to you on other sites as you browse the web. NRECA does not provide any Information about its users or clients to these service providers, and they do not collect such Information for us. All Information collected on our website is used exclusively by NRECA, or by its service providers on NRECA s behalf, and is not shared with unaffiliated third parties. Information Use Policy Page 4
How NRECA handles personal Information Within NRECA, access to Information about you is restricted to those NRECA employees who need to know the Information in order to perform their jobs, such as servicing your accounts or notifying you concerning Services. To protect your Information, NRECA maintains physical, electronic, and procedural safeguards in keeping with industry standards and practices, and NRECA reviews and adjusts these safeguards regularly in response to advances in technology. Additionally, many of the Affiliates, such as the Plans, have their own dedicated Privacy and Security policies and procedures specifically designed to protect your Information. What you can do: Opt-out If you wish to allow NRECA to use your Information to provide certain Services to you, such as sending you information regarding NRECA Services that may be of interest to you for example, RE Magazine, invitations to conferences, meeting and training opportunities, newsletters, and promotional materials, you do not need to do anything. If you do not wish to allow NRECA to use your Information, other than for those Services to which you subscribe, you have the right to opt-out of such use of your Information for any reason. Some of your Information, particularly that Information necessary to provide benefits and execute financial transactions, would then be used only for that and no other purpose. Be advised, however, that if you elect to opt-out of receipt of materials about NRECA and its Services, it may be more difficult for NRECA its Affiliates, and its Members to provide certain Services to you or to maintain accurate Information. For example, if you decline to allow NRECA, its Affiliates and its Members to use your home address, it may be more difficult to update and synchronize address changes when they occur. If you would like to opt-out and prohibit NRECA, its Affiliates, and its Members from using your Information to provide Services to you, other than the ones to which you or your Employer subscribe (such as the Plans), you should call the Member Contact Center at 866-673-2299. At any time, you have the right to change your mind by calling the Member Contact Center. Security Policy NRECA has implemented best business practice technical, administrative, and physical security methodologies in order to protect Information against loss, unauthorized access, destruction, misuse, modification, and improper disclosure of all Information collected and maintained by NRECA. As a critical part of that security methodology, NRECA monitors any and all Information. While no information is absolutely safe, in an electronic environment or otherwise, by implementing best business practice security methodology, NRECA has taken reasonable steps to secure Information collected, retained and used. As indicated in this Policy, NRECA is not responsible for information security breaches caused by the illegal or unauthorized acts of any individual. Information available or exchanged by NRECA and its Affiliates is subject to any third-party security policies, such as in the case of health benefits, the HIPAA Security requirements. Unless an Employee elects to Opt-Out, the user agrees to be bound by the terms of any and all security and privacy policies of NRECA or its Affiliates. Limitations TO THE EXTENT PERMITTED BY LAW, NRECA, ITS AFFILIATES AND ITS MEMBERS SHALL NOT BE RESPONSIBLE OR LIABLE FOR THE ACCURACY, USEFULNESS OR AVAILABILITY OF ANY INFORMATION POSTED, TRANSMITTED OR MADE Information Use Policy Page 5
AVAILABLE TO NRECA, AND SHALL NOT BE RESPONSIBLE OR LIABLE FOR ANY DECISIONS OR ACTIONS YOU MAY TAKE BASED ON INFORMATION PROVIDED. THIS DISCLAIMER INCLUDES IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. (If you live in a state which does not permit disclaimers of implied warranties, this part of our disclaimer may not apply to you.) TO THE EXTENT PERMITTED BY LAW, IN NO EVENT SHALL NRECA, ITS AFFILIATES OR ITS MEMBERS BE LIABLE FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF YOUR INFORMATION, PROVIDED SUCH USE IS IN ACCORDANCE WITH ALL APPLICABLE FEDERAL REQUIREMENTS. Applicable Law, Jurisdiction & Venue The Policy is governed by, and will be interpreted under, the laws of the Commonwealth of Virginia, without regard to choice or conflicts of law rules. Any legal action regarding the Policy shall be commenced and heard in the Circuit Court of Arlington County, Virginia or the United States District Court for the Eastern District of Virginia, as applicable. If you do not Opt Out using the attached form, then you irrevocably waive any right you may have to commence any action against NRECA, its Affiliates and its Members in any other court and irrevocably waive any rights or defenses in any action before the above noted courts based on lack of personal jurisdiction or improper or inconvenient venue. Updates NRECA reserves discretion to update this Policy at any time without notice. Questions If you have any questions about this Policy, please contact the Office of General Counsel at: NRECA, VLS9-116, 4301 Wilson Blvd, 933, Arlington VA 22203-1860; (E-mail) nreca@nreca.coop. Information Use Policy Page 6