Vestwell Privacy Policy

Updated: October 2025

Vestwell Holdings Inc. and our subsidiaries (referred to as "Vestwell") are committed to protecting the privacy of individuals who visit, access, or use our websites, the Vestwell platform, or the Gradifi Powered by Vestwell platform (collectively, our “Sites”). This Privacy Policy explains what information we collect, why we collect it, how we use that information, and the choices we offer relating to the information we collect from or about you. Some of the information we may collect from you constitutes non-public “Personal Information.” Our collection, sharing, and use of Personal Information is governed by the privacy notice that we deliver to you pursuant to applicable state or federal law.

When you visit our Sites, enter into an agreement with us for our services, register for a Vestwell account, attend one of our events, engage with any of our social media content, or subscribe to our blog, you agree to the terms of this Privacy Policy as well as any other agreements you accept when registering for a Vestwell account. We will review and update this Privacy Policy so please review it periodically to be sure you are still comfortable with its terms. We reserve the right to use and disclose aggregated or deidentified information for any commercially reasonable purpose.

1. What Information We Collect About You

We collect information about you in various ways. Some of this information may be considered “Personal Information” under applicable law. Personal Information is information that identifies, relates to, describes, or can be reasonably linked, directly or indirectly, to you as a particular individual or household. Personal Information does not include information that is lawfully made available through federal, state, or local government records, or information that we have a reasonable basis to believe is lawfully made available to the general public, including through widely distributed media, by you, or by a person to whom you have disclosed the information, unless you have restricted the information to a specific audience.

We collect this information from you directly, from your current or prior employer or a third party (such as a payroll company) acting on their behalf. We may also obtain Personal Information from third parties that we have partnered with or have engaged as service providers who help with our operations, such as data analytics providers, marketing or advertising providers, fraud prevention providers, or vendors that provide services on our behalf. If you interact with us on social media or use certain features, such as plugins, widgets, or other tools made available by social media platforms or networks (including but not limited to Instagram, Facebook, Twitter, Google, YouTube, and LinkedIn) in connection with our services, we collect Personal Information that you disclose to us, or that the social media platforms disclose to us. For more information about the privacy practices of those social media platforms, please review the privacy policies and settings of the social media platforms and networks that you use. Lastly, we may obtain Personal Information about you from other sources, such as proprietary search services, consumer reporting agencies, our clients or other individuals who have referred you to our services. We may also create information based on our analysis of the foregoing with other information we have collected from you.
The Personal Information that you provide and that we collect or receive from you depends on the context of your interaction with us and our Sites, the choices you make when you use our Site, and the services that you receive from us. One or more categories of information may apply to you. We have collected these categories of Personal Information for at least the last twelve (12) months.

Plan Sponsors, Participants, Beneficiaries, and Alternate Payees who use Vestwell’s recordkeeping and other services to support their workplace retirement plans

In order to perform our contractual responsibilities, Vestwell receives information from you or someone acting on your behalf, such as your employer, a Third Party Administrator, or your employer’s payroll provider. This includes but is not limited to:

• Full legal name
• Contact information, such as your mailing address, telephone and/or mobile phone numbers, and email address
• Demographic information, such as your date of birth, marital status, or gender
• Social Security Number, Tax Identification Number, or Employer Identification Number
• Employment-related records, such as the name of your employer, job title, compensation, and date of hire
• Sensitive Personal Information, including drivers’ license, social security number, and precise geolocation.

If you are a beneficiary or alternate payee of a participant in a Plan supported by Vestwell, we may also collect Personal Information about you or information that is not otherwise publicly available that was provided to us by the participant.

Individuals who visit our Sites

Anytime you visit our Sites, we collect information about you automatically using various technologies. This information may not identify you personally, but it is linked to your computer or device. When you visit our Sites, we utilize browser storage mechanisms and information-gathering tools such as cookies, internet tags, web beacons, website analytics, and navigational data collection. This includes device-specific information (such as whether you are accessing the Sites from a mobile phone or laptop), the website URL that directed you to the Sites, your location and Internet Protocol address, the browser and/or operating system of your device, the date and time of access to the Sites, and the pages that you access and how long you accessed them while using the Sites. Our use of that information is not restricted under this Privacy Policy and we may combine it with other information we collect about you on our Sites or through other sources.

For example, when you visit our Sites to browse, read, or download information, we utilize commonly-used browser storage mechanisms and information-gathering tools.

• Browser Storage Tokens - We may use cookies, local storage, and other means to make interactions with our Sites easier and more meaningful for you. Cookies are small data files that are stored by your web browser when you interact with our Sites. When you visit our Sites, our servers send an encrypted token to your device. By themselves, these tokens do not personally identify you, but merely recognize your web browser. Unless you choose to identify yourself to us, you remain anonymous to us. We use tokens that are session-based and persistent-based. Session tokens exist only during one session. They disappear from your computer when you log out or your session becomes stagnant. Each time you log into your Vestwell account or visit our Sites, a session token containing an encrypted, unique identifier tied to your account is placed in your browser. If you have chosen to identify yourself to us, we use the session tokens containing encrypted information to uniquely identify you and to process your online transactions and requests. Persistent tokens may be stored locally, unlike session tokens, and remain on your computer after you close your browser or turn off your computer. Persistent tokens allow us to identify browsers that have previously visited our website. You may refuse to accept persistent tokens by activating the setting on your browser to refuse persistent browser storage. Unless you have adjusted your browser setting so that it will refuse persistent storage, our system will issue tokens when you log on to our website. We may use information from session and persistent tokens to provide you with information about Vestwell and our services.
• Web Beacons - These are small graphic images that can be embedded in content and ads on a webpage that track usage of the website and effectiveness of communication. These web beacons can then be used to recognize our cookies and to monitor certain user interactions with a website. We may use web beacons alone or in conjunction with tokens or cookies to compile information about website usage and interaction with emails from us. Web beacons are clear electronic images that recognize certain types of information on your computer, such as cookies, when you view a particular website tied to the web beacon, and a description of a website tied to the web beacon. We use web beacons to operate and improve our website and email communications. We may also use information from web beacons in combination with other data to provide you with information about us and our Services.
• IP Addresses - When you visit our Sites, contact us, or submit a transaction request to us, we may collect your Internet Protocol (“IP”) addresses to track and aggregate information for data analytics and for security and fraud tracking. Information related to your IP address may contain information about your domain provider, Internet provider, and general geographic location.
• Device Information - We may collect information about the device you use to access our Sites, such as the type and model, operating system (e.g. iOS or Android), carrier name, browser (e.g. Chrome, Safari), applications using our website, and identifiers assigned to your device, such as its iOS Identifier for Advertising (IDFA), Android Advertising ID (AAID), or unique device identifier (a number uniquely given to your device by your device manufacturer), sometimes referred to as a mobile carrier ID for mobile devices. We may also collect your location information, such as your zip code or the approximate geographic area provided by your Internet service provider (ISP), or location positioning information provided by the location services and GPS features of your device.

Individuals who register for or attend one of our events

We collect and receive information from you directly when you register for or attend one of our events, including your name and contact details, the marketing channel by which you learned about Vestwell, and any communication delivery preferences, including your consent to receive promotional materials from us, directly or indirectly, by phone, text message, email, or mail about our services. We use this information to provide future communications relating to the event or our services unless and until you opt out of such communications or revoke your consent. If we conduct our event with a third party event sponsor or partner, that third party may also receive and use your information.

Individuals who interact with our social media pages

We collect and receive information from you when you interact with our social media pages, accounts, or via posts you make on social media and other third-party platforms (“Social Media Platforms”). You may choose to engage with us on Social Media Platforms. If you choose to make any of your activities or other content available through a Social Media Platform, including on our pages, or you engage in other activities in connection with a Social Media Platform, your friends and followers on those Social Media Platforms that you have enabled, and potentially the general public, will be able to view those contributions and activities. Please remember that the manner in which Social Media Platforms use, store, and disclose your information is governed by the policies of such third parties. We are not responsible for the privacy practices or other actions of any Social Media Platform through which we may engage with you. This may include demographic information about users who “follow” our pages or information regarding how you engage with us, such as when you “like” our content.

2. How We Use the Information

We may use the information we collect from you in a variety of ways, including:

• To present our Site and its contents to you and to operate our Sites.
• To deliver the information, products, or services that you or your employer requested from us.
• To register your account and deliver access to your accounts to you.
• To reach out to you about and market or promote new information, products, or services to you. that we believe you may be interested in.
• To communicate with you, including notifying you about changes to our Sites or services.
• To help us improve our Sites and deliver a more personalized experience. This includes enabling us to store information about your preferences, speed up your searches, and recognize you when you return to our Sites.
• To carry out our obligations and enforce our rights arising from any contracts entered into with you. This includes for billing and collection and as we believe is necessary or appropriate to protect, enforce, or defend the legal rights, privacy, safety, or property of the Sites, our employees, agents, or other users or to comply with applicable law.
• To verify your identity, and detect and prevent fraud.
• In any other way we may describe when you provide the information, or otherwise at your direction or with your consent.
• As permitted by law or as we may notify you.

3. How We Share Information

We may share the information that we collect pursuant to this policy as follows:

• With our affiliates.
• With our service providers, business partners, and vendors. These parties may include companies that host our Sites, provide web analytics, perform data processing, distribute emails to you, or help us communicate with you. These service providers include, but are not limited to, vendors we use to transact with financial institutions, and to whom you grant access to transmit your information from your financial institution in accordance with such vendor’s privacy policy, when you connect your bank account and/or credit card to our Sites.
• With social media platforms, which may provide certain media or marketing features such as, plugins, widgets, or other tools in connection with our services. We may disclose Personal Information to Media Platforms to assist us in providing services to you and as otherwise described in this Privacy Policy.
• With analytics platforms, such as Google Analytics, for dashboards mapping trends of our website visitors
• Mutual funds and investment options in which you are invested through your Vestwell account.
• With retirement plan sponsors, employers, payroll providers, investment advisors, third-party administrators, mutual fund providers, or other service providers associated with your retirement plan or account with us.
• When you request any of our products or services. We will share your information to the extent necessary or appropriate to fulfill your request, including sharing information with identity verification and fraud detection service providers.
• When required to do so by law. For example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement agency’s or other authorized government or regulatory agencies’ request.

Vestwell may also share aggregated, anonymized, or de-identified information with third parties, such as about the demographics of users of our services. In addition, if Vestwell or any of our subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of, or dissolved, including through merger, consolidation, sale, or divestiture of assets, the relevant customer database, including Personal Information we may possess about you, and information collected pursuant to this policy, may, in whole or in part, be sold, transferred, or otherwise disclosed as part of that transaction or proceeding.

4. Cookies and Tracking Technologies

We and the third-party partners we engage may use cookies, web beacons, pixel tags, browser analysis tools, server logs, and other tracking technologies to automatically collect information, including Personal Information, from your browser. Our Sites use cookies and other tracking technologies for a variety of purposes, including functional, analytics, and advertising purposes. For example, we, our service providers, and other partners we engage use cookies and other tracking technologies:

• For functional purposes, such as to provide the Sites and their content to you.
• For analytics purposes, such as to provide us with information about what web pages a user visits and how much time a user spends on each page.
• To personalize your experience on our Sites (e.g., to recognize you by name when you return to our site, to save your password in password-protected areas, or to tailor content, product, or service offerings to you).

Some browsers allow you to modify browser settings to decline cookies and/or "opt-out" of tracking technologies. As each browser is different, it is solely your responsibility to determine whether to activate or deactivate those tracking technologies. Disabling those features may impair some of the functionality of the Sites and/or our services.

Occasionally, we engage third parties to track and analyze statistical usage and volume information from individuals who visit our Sites. We may also use other third-party cookies, pixels, software developer kits, libraries, and other similar technologies to track site and advertisement performance (collectively, “Third-Party Tracking Technologies”). We may gather information from Third-Party Tracking Technologies when you interact with or utilize our Sites or engage with us such as through email communications. Some Third-Party Tracking Technologies help us maintain the security of our Sites and your account, prevent crashes, fix bugs, save your preferences, and assist with essential site functions. The information provided to and received from these Third-Parties Tracking Technologies may include Personal Information, and we may associate this information with other Personal Information we have about you after we receive it; that combined information is considered Personal Information under this Privacy Policy.

Our Sites may use Google Analytics, a web analytics service offered by Google. You may learn more about Google’s practices with Google Analytics by visiting Google’s privacy policy at http://www.google.com/policies/privacy/partners.

We also utilize Facebook pixels to gather information about visitors to the Sites. Meta’s Privacy Policy explains how to change your device settings to opt out of Facebook tracking technologies.

These and other media platforms and Third Party Tracking Technologies use their technology to provide advertising about products and services tailored to your interests which may appear either on our Sites or on other third-party websites. When you click third-party links to such other sites and services (including by means of clicking on hyperlinks, logos, widgets, banners, or advertisements), you become subject to their terms of use and privacy policies. We encourage our Users to be aware when they leave our Sites to read the privacy policies of each website that collects Personal Information. We do not endorse, screen, or approve, and are not responsible for the privacy practices or content of such other websites or online applications.

To the extent these Third-Party Tracking Technologies are deemed to be a “sale” or “sharing” (which includes targeted advertising) of Personal Information, as defined under applicable data privacy laws, we will provide you with preferences to exercise control over such Third-Party Tracking Technologies along with options to opt-out, such as from your device or by exercising your rights as described in the “Your Choices” section of our Privacy Policy. Please note that some features of our Services may not be available to you as a result. Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not want them to track your online activities. Our Sites may reference or provide links to third-party websites, including social media bookmarking buttons that enable or require you to share certain content on or communicate with our Sites. Some of these sites may be co-branded with a Vestwell logo even though they are not operated or maintained by Vestwell. You may be directed through links to those sites while visiting our Sites. This Policy only applies to Vestwell’s privacy practices. Vestwell is not responsible for any activities of third-party websites. We do not control, nor are we responsible for, the privacy policies, operation, data collection, information practices, or use of third parties or their websites. When you use third-party links, these third parties may collect Personal Information about you or your online activities.

Outside of disclosing certain Personal Information as described in this Privacy Policy, we do not disclose Personal Information to any third parties outside of our or your organization, other than as necessary to provide you with our services or fulfill your requests.

5. How Does Vestwell Protect My Personal Information

Your privacy matters to Vestwell and we work hard to protect it. We protect your Personal Information by physical, electronic, and procedural safeguards. However, as with all online service providers, the security of your information depends in part on the security of your computer, device, internet service provider, and your activities, all of which are beyond Vestwell’s control. Your use of our Sites and services is also governed by our Platform Terms of Use, which are incorporated herein by reference. Vestwell does not send unsolicited communications asking for account information, such as your password.

6. How Long Does Vestwell Keep My Personal Information

Vestwell retains Personal Information for as long as necessary to provide our services, carry out the purposes described in this Privacy Policy, or as required to comply with applicable law.

7. For All End Users, Your Choices

Cookie preferences

You can generally manage your cookie preferences through your web browser. Most web browsers will tell you how to stop accepting new cookies and how to disable existing cookies. For more information regarding how to manage your preferences, please consult the information made available by your particular browser or visit www.allaboutcookies.org. Please note that if you choose not to accept cookies, you may be unable to use certain features of our Sites.

Google Analytics

With respect to Google Analytics, you can also view Google’s currently available opt-out options at https://tools.google.com/dlpage/gaoptout to opt-out of being tracked by Google Analytics.

Tracking technologies

We use tracking technologies to better understand how visitors engage with our site and to enhance overall performance and user experience. Clicks and page transitions are tracked through Google Tag Manager (GTM) to measure engagement and improve navigation.

Users can manage or opt out of cookies at any time by adjusting their preferences in the cookie settings banner or preference center displayed when visiting our site. You may also control cookies through your browser settings; however, disabling certain cookies may affect some site functionality.

Opting out of marketing communications

Except where “opt-in” consent is required by law, we will provide you an “opt-out” or unsubscribe option that clearly and conspicuously describes your right to opt out of future marketing communications from us. If you would like us to remove your name and information from marketing communications, please email us at Legal@vestwell.com. It may take up to 30 days to complete your request.

You have the right to direct us not to process your Personal Information for the purpose of (i) target advertising, (ii) the sale of Personal Information, or (iii) automated profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, to the extent we participate in these processing activities. You may opt-out of the processing of your Personal Information for the purpose of targeted advertising or the sale of your Personal Information. We do not use automated profiling in connection with Personal Information provided to us through the Services in furtherance of decisions that produce legal or similarly significant effects concerning you.

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize the processing of your Personal Information for the above purposes. You may change your mind and opt back into the processing of your Personal Information at any time by contacting us at legal@vestwell.com or contact us at (917) 979-5358. We will only use the Personal Information provided in an opt-out request to review and comply with the request. You do not need to create an account with us to exercise your opt-out rights.

If you are a resident of certain U.S. states, applicable law requires us to receive your opt-in consent before processing certain Sensitive Personal Information, including (1) Personal Information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; (2) the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; (3) Personal Information collected from a known child; or (4) precise geolocation data. If we process your Sensitive Personal Information as defined under these applicable laws in connection with the Services, we will ask for your opt-in consent before doing so.

8. Additional Information for Residents of Other States

Residents of California

Our California Privacy Notice and Notice of Collection is available at: https://files.vestwell.com/download/a5d12f82d69c11eebc2d66cdb1f414f2 and supplements this Privacy Policy. Additionally, for a description of the treatment of Personal Information we have from California residents (1) in their capacity as current or former employees, personnel, or independent contractors of Vestwell; (2) who are emergency contacts of, or benefits recipients related to, current or former employees, personnel, or independent contractors of Vestwell; or (3) in their capacity as current or former job applicants or prospective job applicants to Vestwell, please read our California Resident Applicant and Prospective Applicant Privacy Notice. California residents who interact with us in their capacity as representatives of individuals enrolled in an Achieving a Better Life Experience (“ABLE”) program or other Vestwell or state-sponsored savings products, please see our Privacy Notice for California Resident Authorized Legal Representatives for more information.

Residents of Colorado

If you live in Colorado you may have the following rights for data that is not collected pursuant to the Gramm Leach Bliley Act or the Fair Credit Reporting Act.

(1) The right to confirm whether Vestwell is processing your Personal Information, and accessing your Personal Information;
(2) The right to request we correct inaccuracies in your Personal Information;
(3) The right to request we delete your Personal Information;
(4) The right to request a copy of the Personal Information you provided to us; and
(5) The right to opt out of (i) processing of your Personal Information for targeted advertising purposes; (ii) the sale of your Personal Information; and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise rights (1) through (5)(i), please contact us at Legal@vestwell.com or call (917) 979-5358. For right 5 (ii-iii), please note that Vestwell does not use Personal Information for profiling in furtherance of decisions that produce legal or similarly significant effects nor does it sell your Personal Information. Therefore, the consumer rights that apply to such decisions are not applicable to Vestwell’s activities.

If you are a resident of Colorado, we will inform you, in writing, of any action taken or not taken in response to your appeal within forty-five (45) days of receipt of your appeal. If we require more time (up to another sixty (60) days), we will inform you of the reason and extension period in writing. If we deny your appeal, you can file a complaint with the Office of the Attorney General of Colorado at: Ralph L. Carr Judicial Building, 1300 Broadway, 10th Floor, Denver, CO 80203, by phone at (720) 508-6000, or online at https://coag.gov/file-complaint/

Residents of Connecticut

If you are a resident of Connecticut, you can file a complaint with the Office of the Attorney General of Connecticut at 165 Capitol Avenue, Hartford, CT 06106, Phone number: (860) 808-5420, Online: https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page More information about your rights as a Connecticut consumer may be found on Connecticut’s Attorney General website.

Residents of Delaware

If you are a resident of Delaware, you can file a complaint with the Delaware Department of Justice, Consumer Mediation Division at 820 N. French Street, 5th Floor, Wilmington, DE 19801 Phone number: (302) 577-8600 or (800) 220-5424 Online: https://attorneygeneral.delaware.gov/fraud/cmu/complaint/ More information about your rights as a Delaware consumer may be found on the Delaware’s Department of Justice, Fraud & Consumer Protection Division website.

Residents of Iowa

If you are a resident of Iowa, you can file a complaint with the Office of the Attorney General of Iowa, Consumer Protection Division at: Hoover State Office Building, 1305 E. Walnut Street, Des Moines, Iowa 50319-0106 Phone number: (515) 281-5926 or (888) 777-4590 Online: https://www.iowaattorneygeneral.gov/for-consumers/file-a-consumer-complaint/complaint-form More information about your rights as an Iowa consumer may be found on the Iowa’s Department of Justice, Attorney General website.

Residents of Montana

If you are a resident of Montana, you can file a complaint with the Montana Department of Justice’s Office of the Attorney General at: P.O. Box 201401, Helena, MT 59620-1401 Phone number: (406) 444-2026 Online: https://app.doj.mt.gov/OCPPortal/?q=node/395/ More information about your rights as a Montana consumer may be found on Montana’s Department of Justice website.

Residents of Nebraska

If you are a resident of Nebraska, you can file a complaint with the Nebraska Attorney General at: 2115 State Capitol, Lincoln, NE 68509 Phone number: (402) 471-2682 Online: https://www.nebraska.gov/apps-ago-complaints/?preSelect=CP_COMPLAINT More information about your rights as a Nebraska consumer may be found on Nebraska’s Attorney General website.

Residents of New Hampshire

If you are a resident of New Hampshire, you can file a complaint with the New Hampshire Department of Justice, Consumer Protection & Antitrust Bureau at 1 Granite Place South, Concord, NH 03301 Phone number: (603) 271-3658 Online: https://www.doj.nh.gov/citizens/consumer-protection-antitrust-bureau/consumer-complaints More information about your rights as a New Hampshire consumer may be found on the New Hampshire’s Department of Justice website

Residents of New Jersey

If you are a resident of New Jersey, you can file a complaint with the New Jersey Office of the Attorney General, Division of Consumer Affairs] at 124 Halsey Street, Newark, New Jersey 07101 Phone number: (973) 504-6200 Online: https://njconsumeraffairs.nj.gov/file-a-complaint/ More information about your rights as a New Jersey consumer may be found on New Jersey’s Office of Consumer Protection website.

Residents of Oregon

If you are a resident of Oregon, you can file a complaint with the Oregon Department of Justice at: 1162 Court St. NE, Salem, OR 97301-4096 Phone number: (877) 877-9392 Online: https://app.smartsheetgov.com/b/form/02fff1dd26bd4dc19a7297e83012eb4e More information about your rights as an Oregon consumer may be found on the Oregon’s Department of Justice’s website.

You may also have the following rights for data that is not collected pursuant to the Gramm Leach Bliley Act or the Fair Credit Reporting Act.

(1) The right to confirm whether Vestwell is processing your Personal Information, and the categories of personal data that is or has been processed;
(2) The right to request we correct inaccuracies in your Personal Information;
(3) The right to request we delete your Personal Information;
(4) The right to request a copy of the Personal Information you provided to us; and
(5) The right to opt out of (i) processing of your Personal Information for targeted advertising purposes; (ii) the sale of your Personal Information; and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise rights (1) through (5)(i), please contact us at Legal@vestwell.com or call (917) 979-5358. For right 5 (ii-iii), please note that Vestwell does not use Personal Information for profiling in furtherance of decisions that produce legal or similarly significant effects nor does it sell your Personal information. Therefore, the consumer rights that apply to such decisions are not applicable to Vestwell’s activities.

Residents of Tennessee

If you are a resident of Tennessee, you can file a complaint with the Office of the Attorney General of Tennessee at P.O. Box 20207, Nashville, TN 37202 Phone number: (615) 741-4737 Online: https://agtnprod.powerappsportals.us/DCA/ More information about your rights as an Tennessee consumer may be found on Tennessee’s Attorney General & Reporter website.

Residents of Texas

If you are a resident of the Texas, you can file a complaint with the Office of the Attorney General, Consumer Protection Division of Texas at PO Box 12548, Austin, TX 78711-2548 Phone number: (800) 621-0508 Online: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint More information about your rights as a Texas consumer may be found on Texas’ Attorney General website.

Residents of Utah

If you are a resident of Utah, you can file a complaint with the Division of Consumer Protection of the State of Utah Department of Commerce at PO Box 146704, Salt Lake City, UT 84114 Toll Free: (800) 721-7233 Phone number: (801) 530-6601 Fax number: (801) 530-6001 Online: https://dcp.utah.gov/wp-content/uploads/2023/12/Data-Privacy-Complaint-Form-Final-12.28.2023.pdf More information about your rights as a Utah consumer may be found on Utah’s Consumer Protection Division website.

Residents of Virginia

If you are a resident of the Commonwealth of Virginia, you can file a complaint with the Consumer Protection Section of the Office of the Attorney General of Virginia at: 202 North Ninth Street, Richmond, VA 23211 Toll Free: (800) 552-9963 Phone number: (804) 786-2042 Fax number: (804) 225-4378 Online: https://www.oag.state.va.us/consumercomplaintform/form/start More information about your rights as a Virginia consumer may be found on Virginia’s Attorney General website.

9. How to Contact Vestwell

Privacy matters to us. If you have reason to believe that we have not adhered to this Privacy Policy, or any other questions or complaints relating to our privacy practices, please contact Vestwell by email at help@vestwell.com or by mail at Vestwell Holdings Inc., Legal Department, 360 Madison Avenue, 15th Floor, New York, New York 10017 (917) 979-5358. All complaints are recorded, reviewed, and handled by the Vestwell Legal Department, which can also be reached at Legal@vestwell.com

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another forty-five (45) days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why and provide you with an estimate. The “Right to Appeal” below describes how you can appeal our refusal to take action on a request to exercise your rights.

If we refuse to take action on your request to exercise your rights, you may appeal our refusal. To appeal a refusal, please submit a copy of your request for an appeal and the original request to us as indicated in this Policy. Unless otherwise indicated in this policy, within sixty (60) days of our receipt of your request for an appeal, we will inform you, in writing, of any action taken or not taken in response to your appeal. We will include a written explanation of the reasons for the decisions. If we deny your appeal, you may contact your local privacy enforcement authority to submit a complaint based on the below information.

10. Children

Vestwell’s services and our Sites are not targeted or directed at children under the age of 13, and we do not intend to or knowingly collect or solicit Personal Information from children under the age of 13. Vestwell does process Personal Information about children from adult account holders, if necessary to perform our services. For example, if you have a savings account supported by Vestwell, we may collect information relating to the beneficiaries of that account, which may include children under age 13. Personal information about individuals under age 13 will be treated the same as Personal Information described in this Policy. The information of children under 13, however, will not be used for the marketing or promotion of new information, products, or services whatsoever.

11. International Use Statement

Vestwell and our services and Sites are based in the United States and our services and Sites are provided and targeted only to residents of the United States. Personal information provided to us may be transferred to or controlled and processed in the United States, but in certain circumstances, service providers or business partners may process data in or outside of the United States. By providing Vestwell with Personal Information or by using the Sites, our services, or the Vestwell Platform, you consent to this transfer and acknowledge that Personal Information stored or processed in the United States will be subject to the laws of the United States, including the ability of governments, courts, law enforcement, and/or regulatory agencies of the United States that have valid jurisdiction over Vestwell to obtain disclosure of your Personal Information. You also understand and agree that your Personal Information may be transferred to and processed in the United States and other countries that may not provide the same level of data protection and privacy as the United States or the country of your residence, and may have been deemed to have inadequate data protection and privacy laws. If you access the Sites from a location outside of the United States, you agree that your use of our Sites is subject to the terms of this Privacy Policy.

12. Privacy Policy Updates

We may need to update our Privacy Policy as technology changes and Vestwell evolves. If we make significant changes to this Privacy Policy, we'll post a prominent message on our websites.