This Notice is effective as of January 1, 2021.

WHO WE ARE
flexPATH Strategies, LLC (“we”, “us” or “flexPATH”) provides investment management services to retirement plans and third-party investment vehicles chosen my retirement plans for their participants. .

This Privacy Notice (“Notice”) describes how flexPATH collects, handles and processes personal information in relation to access or all of the services, websites and apps we offer (collectively, the “Services”), The Notice is a statement of our practices and of rights regarding your personal information and is not a contractual document, and does not create any rights or obligations on either party, beyond those which already exist under data protection laws. This Notice is intended to meet the requirements of the CCPA as amended. Bolded terms not otherwise defined in this Notice have the same meaning as set forth under the CCPA.

This Notice covers those applicable Services offered by flexPATH in California to consumers and their households, however this Notice does not apply, and excludes Services of our companies, as follows:

• For offices and operations conducted outside of California
• For offices and operations with separate privacy policies or that do not incorporate this Notice.
• When we act as a business associate to covered entities in connection with receiving Protected Health Information as defined under the Health Information Portability and Accountability Act (“HIPAA”)
• When we collect personal information subject to the Gramm Leach Bliley Act (“GLBA”), such as when you apply for or obtain a financial product or service from us
• When we act “service provider” (as defined under the CCPA) since we are processing personal information only on behalf of our clients, often pursuant to a written engagement or formal broker of record engagement, and then only to provide our service pursuant to such engagement
• To personal information that was collected from a consumer in connection with being a job applicant, employee or independent contractor
• To personal information that is part of certain business-to-business communications

PERSONAL INFORMATION WE COLLECT, USE AND SHARE
We collect personal information about California consumers as summarized in the table below.

* We work closely with other businesses and companies that fall under NFP affiliates and subsidiaries, which may or may not be NFP branded.
** We will not sell your personal information to third parties other than to the extent reasonably necessary to proceed with the consideration, negotiation, or completion of a merger, reorganization, or acquisition of our companies’ business, or a sale, liquidation, or transfer of some or all of our companies’ assets. In these situations, we will use reasonable efforts to ensure any such purchaser uses personal information transferred in accordance with this Notice.

Other than as noted above, we do not sell personal information and have not done so since December 31, 2020.

When required by applicable law, when we share personal information with corporate third-parties we will ensure that such third parties maintain a comparable level of protection of the personal information as set out in this Notice by using contractual or other means. To the fullest extent permitted by applicable law, we exclude all liability arising from the use of your personal information by third parties.

Children’s Information
We do not knowingly collect online information from children under the age of 13. Our Services are marketed towards corporate entities and adults. If we are notified that we have collected personal information, as defined by the Children’s Online Privacy Protection Act (“COPPA”), of a child under the age of 13, we will delete the information as expeditiously as possible.

CALIFORNIA CONSUMER PRIVACY RIGHTS

California consumers have the following rights. Please note that the CCPA limits these rights by, for example, prohibiting us from providing certain sensitive information in response to an access request and limiting the circumstances in which we must comply with a deletion request. If we deny your request, we will communicate our decision to you.

• Notice. You will be told categories of personal information collected and purpose for collection (as set forth in this Notice)
• Access. You can request (i) categories, specific pieces and sources of, (ii) business purpose for, and (iii) third parties that receive your specific personal information
  • Your right to access and receive specific information on your personal information may be subject to additional verification procedures as contemplated or required by CCPA
  • Consumers can empower an “authorized agent” to submit requests on your behalf. We will require the authorized agent to have a written authorization confirming that authority
• Deletion. You can request personal information be deleted, subject to certain limitations described further in the HOW WE STORE AND KEEP YOUR INFORMATION SECURE section below
• Disclosure. You have the right to be told if personal information sold or further disclosed
  • Disclosure of personal information is described in the PERSONAL INFORMATION WE COLLECT, USE AND SHARE section above
• Selling Restrictions. Consumers have the right to opt-out of any selling of your personal information. We do not sell personal information

You also have the right of non-discrimination for access to our Services should you exercise any applicable rights under the CCPA. You also have a right to submit requests for these rights, including through a toll-free number. See HOW TO CONTACT US Section below.

HOW WE STORE AND KEEP YOUR INFORMATION SECURE

We implement technical, organizational, administrative and physical measures to help ensure a level of security appropriate to the risk to the personal information we collect, use, disclose and process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to help ensure the security of the processing. Please be aware that, despite our ongoing efforts, no security measures are perfect or impenetrable. We restrict access to your personal information to those who require access to such information for legitimate, relevant business purposes. We seek contractual commitments of confidentiality, security and proper use from third-party service providers we engage to process personal information.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period that enables us to:

• maintain business records for analysis and/or audit purposes;
• comply with our record retention requirements under the law and corporate policies;
• defend or bring any existing or potential legal claims; and
• deal with any complaints regarding the Services.

 We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the personal information.How to Contact Us
To write to us regarding this Website Privacy Policy and our personal information handling practices, please contact the Privacy Office as follows:

The flexPATH subsidiary providing you Services is primarily responsible for the personal information collected in relation to that Service, and your relationship managers at such firms can serve as a contact for your questions or concerns.

The privacy office for flexPATH may be contacted as follows:

Email:
privacyoffice@nfp.com

Address:
flexPATH Strategies, LLC
c/o Privacy Office
1250 Capital of Texas Highway, Suite 600
Austin, TX 78746

Toll-Free Phone:
(866) 824-3817

CHANGES TO THIS NOTICE

We reserve the right to make changes to this Notice at any time consistent with applicable local laws. Such changes, as long as they do not have a fundamental impact on the nature of our processing of your personal information or otherwise have a substantial impact on you, will be posted on our website. We encourage you to review the website and Notice periodically for any updates or changes.