ComprePension Privacy Policy

Introduction

ComprePension (“ComprePension,” “we,” “our,” or “us”) is committed to protecting the privacy, confidentiality, integrity, and security of information processed through the ComprePension pension administration platform.

ComprePension provides secure, web-based pension administration and participant self-service capabilities to retirement systems, plan sponsors, employers, pension administrators, and their authorized participants.

This Privacy Policy explains how information may be collected, received, used, disclosed, retained, and protected when individuals access or use the ComprePension platform.

For many implementations, ComprePension processes participant information on behalf of the pension plan, retirement system, employer, or other organization sponsoring the retirement program (“Plan Sponsor”). In these circumstances, the Plan Sponsor determines the purposes for which participant information is processed, and ComprePension processes that information in accordance with its contractual obligations and authorized instructions.

 

Information We Process

Depending upon the services provided by a Plan Sponsor, ComprePension may process information such as:

• Name and contact information
• Employee or participant identification numbers
• Date of birth
• Employment information
• Hire and termination dates
• Years of service and service credit
• Compensation and eligible earnings
• Pension plan participation
• Vesting information
• Retirement eligibility dates
• Pension benefit information
• Beneficiary information
• Benefit calculation inputs and results
• Retirement elections
• Uploaded pension and retirement documents
• Email address and account information
• Authentication and security information
• User activity and audit information
• Technical information associated with use of the portal

ComprePension will seek to process only information reasonably necessary to provide authorized pension administration and related services.

 

Sources of Information

Plan Sponsors and Employers. Participant, employment, payroll, service, pension, and related information may be provided by the organization sponsoring or administering the retirement plan.

Participants. Users may provide information directly when registering, updating permitted personal information, submitting retirement information, uploading documents, or interacting with portal functionality.

Authorized Service Providers. Information may be received from authorized actuarial, administrative, payroll, benefits, technology, or other service providers when necessary to administer the retirement program.

Portal Activity. ComprePension may generate security logs, authentication records, audit trails, transaction records, and other operational information when individuals use the platform.

 

How Information Is Used

ComprePension may process information to:

• Administer pension and retirement benefits
• Display participant benefit information
• Determine retirement eligibility
• Calculate pension benefit estimates
• Support what-if retirement calculations
• Generate retirement forms, statements, letters, and PDF documents
• Support retirement processing
• Maintain participant records
• Provide authorized pension administration functionality
• Generate reports and analytics
• Support actuarial and pension administration processes
• Authenticate users and manage account security
• Maintain audit trails and investigate security events
• Provide technical and participant support
• Maintain platform availability and performance
• Meet contractual, regulatory, and legal obligations

 

Pension Estimates and Calculations

ComprePension may provide pension benefit calculations and retirement estimates based upon participant information, plan provisions, assumptions, and calculation rules configured for the applicable retirement plan.

Unless expressly designated otherwise by the applicable Plan Sponsor, estimates displayed through the portal are provided for informational and planning purposes and should not be interpreted as a final determination of benefits. Final benefits remain subject to applicable plan documents, participant records, eligibility requirements, administrative review, and approval by the appropriate retirement plan authority.

 

How Information May Be Shared

ComprePension does not sell participant personal information. Information may be disclosed only when reasonably necessary to provide authorized services, including to:

• The participant’s Plan Sponsor
• Authorized pension administrators
• Authorized actuarial consultants
• Authorized benefits administrators
• Approved technology and cloud service providers
• Authorized customer support personnel
• Auditors or professional advisors where appropriate
• Government or regulatory authorities when legally required

Service providers receiving access to information are expected to process that information only for authorized purposes and in accordance with applicable contractual and security requirements.

 

Cloud Hosting and Data Location

ComprePension may operate within Microsoft Azure cloud infrastructure. For hosted client implementations, the applicable hosting region and geographic requirements are established through the contractual agreement with the Plan Sponsor. Where contractually required, client production information may be maintained within approved United States cloud regions.

 

Information Security

ComprePension maintains administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, misuse, or destruction. Security measures may include:

• Encryption of information in transit using TLS 1.2 or higher
• Encryption of information at rest
• Role-Based Access Control (RBAC)
• Least-privilege access
• Multi-factor authentication where applicable
• Microsoft Entra ID integration where applicable
• Secure authentication and session management
• Network security controls
• Security logging and monitoring
• Audit trails
• Managed vulnerability and patching processes
• Secure backup procedures
• Disaster recovery capabilities
• Incident response procedures
• Periodic access reviews
• Security awareness training

No information system can guarantee absolute security. ComprePension therefore maintains layered security controls and operational processes designed to manage information security risk.

 

User Accounts and Authentication

Users are responsible for maintaining the confidentiality of their account credentials and complying with applicable account security requirements. Users should not share passwords, authentication codes, or account access with another person. If a user suspects unauthorized access to an account, the user should immediately notify the applicable Plan Sponsor or designated ComprePension support contact.

 

Audit Logging

ComprePension may maintain audit records for security, administration, troubleshooting, compliance, and operational purposes. Audit information may include:

• Successful and unsuccessful authentication events
• Account activity
• Administrative actions
• Data changes
• Document activity
• Calculation activity
• Import activities
• Security-related events

Access to audit information is restricted to authorized personnel.

 

Cookies and Similar Technologies

ComprePension may use cookies or similar technologies necessary to provide secure portal functionality, maintain authenticated sessions, protect against security threats, remember authorized preferences, and support application performance. ComprePension does not use pension participant information for third-party behavioral advertising.

 

Data Retention

Information is retained in accordance with applicable:

• Client contractual requirements
• Pension plan administration requirements
• Records retention requirements
• Legal and regulatory obligations
• Security and audit requirements
• ComprePension retention policies

Information that is no longer required will be securely deleted, destroyed, returned, or otherwise handled in accordance with applicable contractual and retention requirements.

 

Termination of Client Services

Upon termination or expiration of services, client information will be handled according to the applicable agreement between ComprePension and the Plan Sponsor. Depending upon contractual requirements, information may be returned, transferred, archived for an authorized retention period, or securely deleted. Backup copies may remain temporarily within protected backup systems until expiration through established backup retention processes.

 

Individual Privacy Requests

Depending upon applicable law and the relationship between ComprePension and the Plan Sponsor, individuals may have rights regarding their personal information. Requests may include:

• Access to information
• Correction of inaccurate information
• Questions concerning information use
• Requests concerning retention or deletion
• Privacy complaints

Because ComprePension frequently processes information on behalf of a Plan Sponsor, participants may be directed to submit certain privacy or record-correction requests directly to their employer, retirement system, pension plan, or other Plan Sponsor. ComprePension will reasonably cooperate with Plan Sponsors in responding to authorized privacy requests.

 

Children’s Privacy

ComprePension is designed for authorized retirement plan administration and participant services and is not intended for independent use by children. Information relating to dependents, beneficiaries, or survivors may be processed when necessary for legitimate retirement plan administration purposes.

 

Third-Party Services and Links

The portal may provide access or links to authorized third-party services. Those organizations may maintain their own privacy policies and practices. ComprePension is not responsible for the independent privacy practices of third-party websites or services that are outside ComprePension’s control.

 

Security Incidents

ComprePension maintains incident response procedures for identifying, investigating, containing, remediating, and recovering from information security incidents. When an incident involving client information requires notification, ComprePension will coordinate notifications with the affected Plan Sponsor in accordance with applicable contractual and legal requirements.

 

Changes to This Privacy Policy

ComprePension may periodically update this Privacy Policy to reflect changes in platform functionality, business practices, security requirements, contractual obligations, or applicable laws. The updated policy will identify its effective or revision date. Material changes may be communicated through the portal or other appropriate channels.

Participants with questions concerning their pension records, benefit eligibility, or plan-specific information should contact their Plan Sponsor or pension administrator.