Privacy

Last updated: August 31, 2026

1. Introduction and About This Policy

This Privacy Policy (“Policy”) explains how Employee Navigator LLC, a Delaware limited liability company with offices located at 7700 Wisconsin Avenue, Suite 900, Bethesda, Maryland 20814 and its affiliates (collectively, “Employee Navigator,” “we,” “us,” or “our”), collect, use, disclose, and otherwise process personal information in connection with:

• the Website: the public-facing website located at employeenavigator.com and related marketing pages;
• the Web Application: the password-protected Employee Navigator application(s) hosted on and accessed through the Website; and
• the Mobile Application: the Employee Navigator mobile application(s) made available through the Apple App Store and/or Google Play.

Together, the Website, the Web Application, and the Mobile Application are the “Services.” Capitalized terms used but not defined in this Policy (including “Employee Navigator Solutions,” “Authorized User,” “Broker,” “Administrator,” “Individual,” and “Guest”) have the meanings given to them in the Employee Navigator Terms of Use (the “Terms of Use”).

This Policy is incorporated into and supplements the Terms of Use.

2. The Two Roles Employee Navigator Plays

Privacy laws distinguish between a party that decides why and how personal information is processed (a “controller”) and a party that processes personal information on another party’s behalf and instructions (a “processor” or “sub-processor”). Employee Navigator plays different roles depending on how you interact with the Services.

2.1  When we act as a controller

When you visit the public Website, Web Application or Mobile Application without logging in or otherwise provide information (such as business contact information) to Employee Navigator outside of the Services  — for example, to view marketing pages, read our blog, request a demo, subscribe to a newsletter, apply for a job, or contact us — Employee Navigator determines the purposes and means of processing your personal information and therefore acts as a controller.

2.2  When we act as a processor or sub-processor (logged-in use)

With respect to all use of the Web Application and the Mobile Application by any user who is logged in (whether as a Broker, Administrator, Individual, or Guest), Employee Navigator acts as a data processor or sub-processor and processes personal information solely on behalf of, and in accordance with the documented instructions of, the organization that made the Services available to you.

The organization that makes the Services available to you, which is typically your employer or benefits broker (each, a “Customer” or “Company”) is the controller of the personal information processed within the logged-in Services (“Customer Personal Information”). Our processing of Customer Personal Information is governed by the agreement between Employee Navigator and the applicable Customer, including, where applicable, the then-current version of the Data Processing Addendum found at https://www.employeenavigator.com/dpa, and not by the controller sections of this Policy.

The table below summarizes the types of activity associated with the Services and Employee Navigator’s role as a controller, processor or sub-processor when interacting with such personal information.

Important for logged-in Individuals: If you are an employee or other Individual using the logged-in Services, Employee Navigator does not decide what benefits, HR, payroll or other information is collected about you or how it is used. Those decisions are made by your employer, broker or other Customer acting as controller. If you want to exercise privacy rights over Customer Personal Information, or have questions about how it is used, please contact that organization directly. We will support the Customer in responding to your request as required by our agreement with it and applicable law.

3. Scope of This Policy

• Applies to: personal information Employee Navigator processes as a controller through the public Website and Mobile Application or offline,
• Does not apply to: the privacy practices of Brokers, Administrators, employers, carriers, partners, or other third parties who act as controllers; their use of your information is governed by their own privacy notices and agreements.
• Does not apply to: third-party websites, products, or services linked to or integrated with the Services, which are governed by those third parties’ own privacy policies.

4. Information We Collect as a Controller

When we act as a controller through the public Website and Mobile Application (when not logged in) or when collecting business contact information, we may collect the following categories of personal information:

4.1  Information you provide to us

• Contact and business details: name, business email address, telephone number, company/agency name, job title, and similar details you submit through “Book a Demo,” contact, sales, support, or newsletter sign-up forms.
• Recruitment information: information you submit if you apply for a job with us, such as your resume, cover letter, work history, experience, employment authorization, salary expectations and contact details.
• Communications: the content of messages, feedback, and correspondence you send to us, including support requests.

4.2  Information we collect automatically

• Device and usage data: IP address, browser type, operating system, device identifiers, referring/exit pages, pages viewed, and dates/times of access.
• Cookies and similar technologies: as described in Section 6. Some of these are collected through analytics providers.

4.3  Information from third parties

• Marketing and lead sources: business contact information from marketing partners, referral sources, and publicly available sources, used to support our marketing and sales activities.

5. How We Use Information as a Controller

Where we act as a controller, we use personal information to:

• provide, operate, secure, and improve the public Website;
• respond to demo requests, sales inquiries, support questions, and other communications;
• send administrative messages and, where permitted, marketing communications about our products and services (you may opt out at any time);
• evaluate and process employment applications;
• analyze usage trends and measure the effectiveness of our content and campaigns;
• detect, prevent, and respond to fraud, abuse, security risks and/or incidents, and other harmful or unlawful activity;
• comply with applicable law, legal process, or governmental request;
• enforce our Terms of Use and other agreements;
• protect the rights, property, or safety of Employee Navigator, our users, or others.

6. Cookies and Tracking Technologies

The Website uses cookies, pixels, SDKs, and similar technologies to enable core functionality, remember your preferences, understand how the Website, Web Application and Mobile Application are used, and (where applicable) support marketing. You can manage cookies through your browser settings and, where offered, our cookie-preference tools. Disabling certain cookies may affect the functionality of the Website, Web Application and Mobile Application.

7. How We Share and Disclose Information

We may share personal information as follows, consistent with our role:

• Service providers / sub-processors: vendors that host, support, secure, or help operate the Services and our business. For the logged-in Services, our then-current infrastructure sub-processors are listed at https://www.employeenavigator.com/dpa-subprocessors.
• At the direction of the controlling organization: for logged-in Customer Personal Information, we disclose information only as instructed by the applicable Customer or as permitted under our agreement with it (for example, sharing an Individual’s data with their Broker and/or Administrator, consistent with the Terms of Use).
• Third-party products and integrations: where a Customer or user chooses to use third-party products, services, or integrations offered through the Services, personal information may be shared with those third parties to provide the requested functionality.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, sale of assets or other transaction, subject to appropriate confidentiality protections.
• Legal and safety: to comply with applicable law, legal process, or governmental request; to enforce our agreements; and to protect the rights, property, or safety of Employee Navigator, our users, or others.
• Aggregated / de-identified data: we may use and share aggregate, non-personal, or de-identified information that cannot reasonably be used to identify you.

We do not sell your personal information for monetary or other valuable consideration, and we do not “share” your personal information for cross-context behavioral advertising, as those terms are defined under the CCPA. See Section 12 for additional California disclosures.

8. Data Retention

As a controller, we retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. As a processor/sub-processor, we retain Customer Personal Information in accordance with the applicable Customer’s instructions and our agreement with it.

9. How We Protect Information

Employee Navigator maintains administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee security. Authorized Users are responsible for maintaining the confidentiality of their credentials and, where available, using multi-factor authentication, as further described in the Terms of Use.

10. Children’s Privacy

The Services are not directed to children (as defined by the Children’s Online Privacy Protection Act (“COPPA”)), and we do not knowingly collect personal information from children through the Services. As described in the Terms of Use, the Services do not direct content to children and are not intended to collect personal information from children, and are therefore not subject to COPPA.

11. Your Privacy Rights

11.1  Rights regarding information we control

Depending on where you live and subject to applicable law, you may have the right to request access to, correction of, deletion of, or a copy of the personal information we hold about you as a controller, to opt out of certain processing (such as targeted advertising, where applicable), and to appeal a decision we make about your request. To exercise these rights, contact us using the details in Section 15. For California-specific rights, see Section 12. We will not discriminate against you for exercising your rights.

11.2  Rights regarding logged-in Customer Personal Information

For personal information processed within the logged-in Web Application or Mobile Application, the controlling organization (typically your employer or broker) is responsible for responding to your privacy-rights requests; please reach out to them directly. If you submit a request to us regarding such information, we will, consistent with our agreements and applicable law, either refer your request to the relevant Customer or assist that Customer in responding.

12. Your California Privacy Rights (CCPA/CPRA)

This Section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). It supplements the rest of this Policy. Terms such as “personal information,” “sensitive personal information,” “sell,” “share,” “business,” “service provider,” and “contractor” have the meanings given to them in the CCPA.

12.1  How this Section applies and our role

• When we act as a “business.”  For personal information we collect and determine the purposes and means of processing (described as acting as a controller, above) — primarily information collected through the public Website and in connection with our marketing, sales, support, and recruitment activities — Employee Navigator is a “business” under the CCPA, and the disclosures and rights in this Section apply.
• When we act as a “service provider” or “contractor.”  For all logged-in use of the Web Application and Mobile Application, Employee Navigator processes Customer Personal Information as a service provider or contractor on behalf of the applicable Customer (the business/controller). We process that information only to perform the Services under our written contract, and we do not retain, use, or disclose it for any purpose other than those permitted by the CCPA. California residents who wish to exercise CCPA rights over that information should contact the Customer directly; we will assist the Customer as required by our contract and applicable law.
• Information exempt from the CCPA. Certain information is exempt from some or all of the CCPA, including personal information collected, processed, or disclosed pursuant to the Gramm-Leach-Bliley Act (GLBA) and implementing regulations.

12.2  Categories of personal information, sources, purposes, and disclosures

In the preceding twelve (12) months, acting as a business, we have collected the following statutory categories of personal information. This restates, in CCPA terms, the information described in Section 4.

Categories of sources. We collect this information (i) directly from you (e.g., forms you submit); (ii) automatically through your use of the Website or Mobile Application (e.g., cookies and similar technologies); and (iii) from third parties such as marketing partners, referral sources, and publicly available sources, as described in Section 4.

Business and commercial purposes. We use each category for the business and commercial purposes described in Section 5, including providing and securing the Website and Mobile Application, responding to inquiries, marketing, recruitment, analytics, fraud and security, and legal compliance.

Categories of recipients. We disclose personal information to the categories of recipients described in Section 7, including service providers and contractors that perform functions on our behalf. We disclose personal information to these recipients for the business purposes described above.

12.3  Sensitive personal information

Where we act as a business, we limit our use and disclosure of sensitive personal information to the purposes permitted under the CCPA (for example, to provide the Services you request, to ensure security and integrity, and to detect and prevent fraud). Because we do not use or disclose sensitive personal information to infer characteristics or for other purposes that would trigger the CCPA’s “right to limit,” that right may not apply; however, where it does apply, we honor valid requests to limit as described in Section 12.7. Sensitive personal information processed within the logged-in Services is handled on behalf of, and under the instructions of, the applicable Customer.

12.4  Sale and sharing of personal information

We do not sell your personal information for monetary consideration. We also do not “share” your personal information for cross-context behavioral advertising, and we do not sell or share the personal information of consumers we know to be under 16 years of age. In the preceding twelve (12) months, we have not sold or shared personal information as those terms are defined under the CCPA. If this changes, we will update this Policy and provide the opt-out mechanism described in Section 12.7 before any such activity begins.

12.5  Retention

We retain each category of personal information for as long as reasonably necessary to fulfill the purposes described in Section 8, unless a longer period is required or permitted by law. We determine the appropriate retention period based on criteria such as the nature and sensitivity of the information, the duration of our relationship with you, and our legal, accounting, and reporting obligations.

12.6  Your California privacy rights

Subject to the CCPA and its exceptions, California residents have the following rights with respect to personal information for which we act as a business:

• Right to know / access. To request the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it.
• Right to delete. To request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct. To request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale/sharing. To direct us not to sell or share your personal information. As stated in Section 12.4, we do not currently sell or share personal information.
• Right to limit use of sensitive personal information. To direct us to limit the use and disclosure of sensitive personal information to permitted purposes, where that right applies (see Section 12.3).
• Right to non-discrimination and no retaliation. We will not discriminate or retaliate against you for exercising any of your CCPA rights.

12.7  How to exercise your California rights

You (or an authorized agent acting on your behalf) may submit a request by contacting us using the details in Section 15, including by emailing us at privacy@employeenavigator.com. Authorized agents must provide proof of authorization, and we may require you to verify your own identity directly with us.

To protect your information, we will take reasonable steps to verify your identity before responding, generally by matching information you provide with information we maintain. We will respond to verifiable consumer requests within the timeframes required by the CCPA (generally within 45 days, with the possibility of an extension of up to an additional 45 days, with notice).

12.8  Other California disclosures

• “Shine the Light.”  California Civil Code § 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.
• Financial incentives. We do not offer financial incentives or price or service differences in exchange for the collection, sale, or retention of personal information.
• Accessibility. If you need this Policy in an alternative format, please contact us using the details in Section 15.

13. Where Information Is Processed

Employee Navigator and its primary sub-processors process personal information in the United States. If you access the Services from outside the United States, you understand that your personal information may be transferred to, stored in, and processed in the United States and other jurisdictions that may have data-protection laws different from those in your location.

14. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice on or through the Services. Your continued use of the Services after an update becomes effective indicates your acknowledgment and acceptance of the updated Policy, except where additional consent is required by applicable law.

15. How to Contact Us

If you have questions about this Policy or our privacy practices, or if you would like to exercise a privacy right, please contact us at Employee Navigator LLC, Attn: Legal Department, 7700 Wisconsin Avenue, Suite 900, Bethesda, Maryland 20814 or at privacy@employeenavigator.com.

If you are a logged-in Individual with questions about how your benefits, HR, or payroll information is used, please contact your employer, broker or other organization that provides you with access to the Services, as that organization is the controller of that information.