How does Alight collect your personal information?

We collect Personal Information about you when you interact with us, including when you visit and use the Sites. We also collect Personal Information about you from your employer, its service providers or otherwise publicly available sources. Alight also automatically collects information about the devices you use to interact with the Sites.

Data protection laws in different jurisdictions distinguish between “controllers” and “processors” of Personal Information. While other jurisdictions and laws use similar terminology, the concept remains the same. Alight may be a controller (meaning, the entity deciding over how Personal Information is being processed) or a processor (meaning, the entity that processes Personal Information on behalf of the controller), depending on the nature of the relationship with clients and/or individuals.

What type of information does Alight collect?

Depending on the Sites you visit, or the services Alight provides to you, we may collect information from or about you listed in the below categories including, but not limited to, the following:

Identifiers, such as your name, alias, (business, professional or personal) email address, date of birth, (business, professional or personal) phone number or mobile number, (business, professional or personal) postal address, IP address or other unique online identifiers, username, password, account PIN, employee ID, driver’s license number, passport number or similar, financial information (such as bank account number or salary), insurance details, national identification number or other similar identifiers, employment history including previous employers and job titles/positions, background information (such as your academical and professional qualifications, education, details included in your CV/résumé (which might include details of any memberships or interests constituting sensitive personal information), and employment references, details about your immigration/visa status, criminal offence information and any other information you voluntarily provide. We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.
Information Subject to Protection under California Law, such as the Identifiers above, your signature, bank account number, and we may use our Service Providers to collect your credit card number or debit card number. We may provide this information to our service providers, business partners, or third parties as required by law.
Characteristics of Protected Classifications, such as your racial or ethnic origin or sexual orientation. For more information, please see the “Sensitive Information” description below.
Geolocation Data, but not your precise geolocation. We collect location information provided by a mobile or other device interacting with the Sites or associated with your IP address or other online or device identifier. We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.
Biometric Information. Alight does not collect or process Biometric Information for the purpose of unique identification of an individual.
Audio, electronic, visual, thermal, olfactory, or similar information, we may collect voiceprints and other audio files of your voice, visual recordings such as in a webinar recording, CCTV when you are on our premises or a picture on an ID entry card.
Sensitive Information related to life, health, financial details, physical characteristics and description, race, gender, marital status, sexual orientation, professional liability and workers compensation insurance programs, employee benefit program participation and coverage information, membership of a trade organization or union, or veteran/military status. We do not use or disclose your sensitive personal information for any purpose other than as permitted by applicable law. We may provide this information to our service providers, business partners, or third parties as required by law.
Internet or other Electronic Network Activity Information when you access our Sites, we may automatically collect information about your devices, including, but not limited to, IP address, device type, browser type, browsing history, search history, geographic location and information regarding your interaction with our Sites. We may collect this information through the lawful use and deployment of cookies and other online tracking technologies as set forth in the Cookie Notice on the Site you visit. When using the Alight mobile application, we collect certain information from your device such as device make and model.
Professional Information, such as date of hire, employment status, pay history, tax withholding information, performance records, leave information, and date of termination. We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.
User Profiles, we may aggregate the information that we collect about you or that your employer provides in order to provide you with information on the Sites, deliver and enhance the services we provide to you, and secure our Sites against fraud. We do not share or sell the user profiles that we create with third parties. We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.

Where we collect and process sensitive information (as described above), and where applicable, we rely on one of the exceptions listed in Art.9(2) of the European Union's General Data Protection Regulation ("GDPR") to permit that processing, including the affected person's consent. Otherwise, we process your Personal Information as necessary for the performance of a contract, in compliance with our legal obligations or any other identified legitimate interest.

Your Choice to Provide Information: When you fill out a contact form, we may ask you to provide us with information such as name, contact information, company, job title, and country of residence. You may choose not to provide Personal Information to Alight by refraining from, among other things, using the Sites. You also may refrain from submitting information directly to us. However, if you do not provide personal information when requested, we may not be able to provide you with the full range of our products and services, or with information about our products and services, promotions, and other opportunities. Where you receive our services through your employer, we recommend that you contact your employer directly about the processing of your Personal Information.

How does Alight use your personal information?

We may use the Personal Information we collect for the following business purposes:

To provide information and services requested by you or your employer;
Provide services on behalf of your employer;
To carry out employer, third party service provider, and user communications, services, billing and administration;
To send you communications in accordance with the services provided by Alight to you on behalf of your employer;
To provide you with information about our products and services in accordance with your marketing preferences (including calls and emails);
To respond to customer service inquiries;
To enable you to post your resume, search job postings, and contact or be contacted by prospective employers to the extent such activities are in accordance with our services;
To implement third party services for us or behalf of your employer;
To manage our everyday business needs and operations, such as administering and improving the Sites and our services;
Undertake troubleshooting and detect malfunctions within the Sites and services we provide as well as improving user-experience;
To prevent fraud, enforce our Terms of Use, comply with applicable laws and Alight's reporting obligations (including sharing information, where applicable, with statutory authorities, government institutions, law enforcement agencies and other official bodies), securing our Sites and your account and enforcing our agreements;
To conduct processing necessary to fulfill other contractual obligations to your employer;
To manage our internal operations.

If you are an Alight employee (full- or part time including a contractor), we may use your information to support HR administration and management including maintaining and processing records necessary to manage the employment or worker relationship.

Job Applicants

We use your information to manage all parts of the applicant administration process including evaluating resumes, interviewing, selecting and hiring staff and conducting background check investigations.

In certain circumstances, and to comply with applicable laws and regulations, we may need to collect, or request, some Sensitive Personal Information for legitimate recruitment-related purposes: for example, information about your racial/ethnic origin, gender and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations; or information about your physical or mental condition to consider accommodations for the recruitment process and/or subsequent job role. For the most part, the provision of this information will be entirely voluntary, however, where the processing of this information is required, we will make this clear at the relevant time you may provide, on a voluntary basis, other Sensitive Personal Information during the recruitment process.

If you are accepted for a role or position at Alight, the information collected during the recruitment process will form part of your ongoing employee record and will be processed in accordance with our privacy policies.

We will not use your information for automated individual decision-making as contemplated under Article 22 of the GDPR.

Legal Basis for Processing your Personal Data: Your information will be processed by us in accordance with Alight's policies or as requested by your employer. We will process Personal Information only when we have a legal basis to do so. The legal basis we rely on will be one of the following:

You have consented to the processing of your Personal Information, for example, when you applied to a job posting or agreed to receive marketing material;
The processing is necessary to perform a contract with you, your employer or plan sponsor, or fulfill a request that you have made;
The processing is necessary to comply with a legal obligation that applies to Alight; or
The processing is necessary for purposes that are in Alight's legitimate interests, such as protecting the security of the Sites, conducting market research to improve our products and services, improving the functioning of the Sites, providing you promotional materials about products in which you have expressed an interest.

In order to process any special category of Personal Information under the GDPR (or similar laws and regulations), we rely on the consents that we or your employer obtain from you in order to provide you with the services or any other applicable basis for processing that applies to your employer.

If we intend to use Personal Information for a purpose other than the purpose for which we collected the data, we will provide you with information about this secondary purpose, the legal basis for processing and, where required, obtain your consent, before we engage in further processing.

How does Alight protect your personal information?

Alight has implemented physical, technical, and administrative security safeguards, designed to protect personal information from loss, misuse, alteration, exfiltration, or destruction; taking into account the sensitivity of the information and the purpose for which it was collected. However, no method of data storage or transmission is 100% secure. You are responsible for maintaining the security of your password or other forms of authentication involved in accessing password-protected or secured Sites.

Alight’s technical and organizational security measures includes ISO 27001 certification and adherence to the EU Cloud Code of Conduct (ID: 2020LVL02SCOPE014).

Our Sites may contain links to other sites that are outside of our control and are not covered by this Policy. If you access other sites using the links provided, the operators of those sites may collect information from you which will be used by them in accordance with their own privacy policies. We encourage you to read the privacy policies on other websites you visit. Alight is not responsible for the content or privacy practices of linked sites or any use of those sites.

Does Alight transfer personal information to other countries

Information that you provide to us may be stored on servers and with third-party service providers in the United States and other countries in which we do business and whose data protection laws may differ from the jurisdiction in which you live. When we transfer the personal information of users who are located in the EU to a location outside of the European Economic Area for processing, we use an approved transfer mechanism such as the European Commission approved standard contractual clauses. To learn more about the transfer mechanism that we use to effect such transfer, you may contact us at privacy.info@alight.com.

Your Rights

Depending on the nature of your relationship with Alight and where you reside, we provide you the ability to exercise your rights regarding our collection, use, storage, and sharing of your information. Please note that for some of these rights, we will need to verify your identity before we are able to respond to your request, including using commercially reasonable efforts to confirm your identity including by matching the information provided in your request with the information we have on file about you. Depending on the sensitivity of the information involved in the request, we may also utilize more stringent verification methods to protect against fraud and ensure your request is fulfilled in a transparent and secure manner.

To exercise any of the rights described below, you can complete the online form, or write to us at the address provided below (see “Contact Us” below), and we will respond as soon as possible in accordance with all applicable laws and regulations.

Right to Access and Data Portability: The right to access and data portability applies differently depending on where you live. If you are a California resident, you have a right to know the categories and specific pieces of Personal Information we have collected about you, including a description of the categories of sources from which we have collected that information, the business or commercial purpose for collecting or sharing that information, and the categories of third parties with whom we have shared that information. You may also designate an authorized agent to submit a request on your behalf by submitting proof of written authorization along with your request. If you are living within the European Economic Area (EEA), you have the right to obtain confirmation as to whether your Personal Information is being processed, and if so, the right to access your Personal Information. If we maintain your Personal Information, you can also request that we provide you a copy of your data in a structured, commonly used, and machine readable format and request the transfer of certain of your Personal Information to another party under certain conditions.

Right to Correct/Rectification: Regardless of where you live, you have a right to correct or amend the information we have about you.

Right to Non-Discrimination: We will not discriminate against individuals for exercising any of their data rights under applicable law. This means that if you exercise any of your rights in connection with your Personal Information, we will not deny you goods or services; charge you different prices or rates for goods or services; or provide different levels or quality of goods or services to you.

Right to Delete / Erasure: The right to delete / erasure also applies differently depending on where you live. If you are a California resident, you have a right to ask that we delete your information subject to appropriate exceptions. You may also designate an authorized agent to submit a request on your behalf by submitting proof of written authorization along with your request. If you live in the EEA, where the conditions provided by the applicable legislation are met, and subject to applicable law, you may request that we erase your Personal Information.

Right to Object to Processing: If you live in the EEA, you may object to the processing of your personal information in certain circumstances when we (i) process your information for the purposes of our legitimate interests, (ii) use your personal information for direct marketing; or (iii) use your personal information for statistical purposes.

Right to Restrict Processing: If you are located in the EEA, you have the right to request restriction of your Personal Information under certain circumstances

Right to Withdraw Consent: If you are located in the EEA, and when our legal basis for processing your information is your consent, you may withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

California Notice of Sale: We do not sell the personal information of California residents, nor have we sold California resident personal information in the past 12 months. We have no actual knowledge of selling the personal information of minors under the age of 16.

Notice to Residents of Nevada: We do not sell any personal information we collect to any third parties. If we were to do so in the future, we will update this Statement, and provide Nevada residents with the opportunity to opt-out of the sale of their personal information.

Complaints: If you have concerns about the way in which we have handled your information, please contact us (see “Contact Us” below) so that we can try to resolve the issue. If you are located in the EEA, you also have the right to lodge a complaint with the supervisory authority applicable in the jurisdiction in which you are located, and with relevant judicial authorities.

If you live in Australia, you may complain to the Office of the Australian Information Commissioner. Contact details can be found at www.oaic.gov.au.

You can access, correct, update, and request deletion of your Personal Information via your online account, by telephoning the call center dedicated to your employer or plan sponsor, or by directing your query to your employer. We (or your employer, where applicable) will respond to your request within 30 days.

Alternatively, you may request assistance by submitting your request here. We may sometimes need to verify your identify before we fulfil your request.