Privacy and Security Effective Date: February 11, 2020 Your privacy is important to the YMCA Retirement Fund (“Fund”, “we”, us” or “our”). This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect personal information. The Fund collects identifiable information (name, email address, phone number, or other identifiers) provided by you. Beyond that, you do not have to give us personal information to visit our site. Personally identifying information you provide will be used to access your records, for you to use our interactive planning worksheets, or for purposes described to you at the point of collection (collectively “Services”). Please be aware that although we use security technologies such as two-factor authentication, confidentiality of Internet transmissions is not guaranteed. It is your choice to assume the risk of an unauthorized person learning your password, User ID, email address or other personal information you provide. Also, please keep written records, such as passwords and user IDs, in a confidential location. The YMCA Retirement Fund collects general information about visitors in order to analyze visitors’ interests and improve this site. The Fund will not knowingly give, sell, or transfer any personal information to a third party. No attempts are made to identify individual visitors unless illegal behavior is suspected. The Fund and its service providers monitor network traffic to identify unauthorized attempts to upload or change information or damage this site. We focus on Web security so that this site remains available to you and other participants. The YMCA Retirement Fund may enable “cookies” in order to assist you in using our interactive planning worksheets. A cookie is a small web file that a site transfers to your device’s hard drive through your web browser that enables the site to recognize your browser and remember certain information. Your browser will only return this cookie information to our site; no other site can request it. You may disable the use of cookies by modifying your browser settings. Occasionally the YMCA Retirement Fund will email you notices about your account and programs available to you. Some programs will be accessible on the Fund’s website or on other websites. If you do not wish to receive these notices, you may unsubscribe at any time by replying to our email message and typing “unsubscribe” in the subject line. YMCA Retirement Fund may change some of the services that it provides from time to time. As a result, we reserve the right to update or modify this Policy at any time and from time to time without prior notice. If we make any material changes to the way we process your personal information, we will notify you before such changes are effective. We recommend you review this Policy periodically. This Policy became effective on the date indicated at the top of this page. Your continued use of the YMCA Retirement Fund website indicates your agreement with all the terms and conditions of use contained herein and any notices of changes or revisions to this Policy. USE OF YOUR PERSONAL INFORMATION We may use the information that we collect or receive about you for various purposes. a. To Provide You With Our Services. We use your information to provide you services with respect to the YMCA Retirement Fund. Your information may be available or provided to third-party service providers that are contractually obligated to protect your information. b. To Maintain, Improve, and Personalize Our Services. We use your information for our everyday business operations such as auditing, administration, and analytics. Your information may also be used to improve our Services or to personalize your Services. c. To Communicate with You. We use your information to communicate with you. We may also contact you with offerings or other communications that may be of interest to you. If we send you marketing emails, each email will contain instructions permitting you to “opt-out” of receiving future marketing or other communications. d. For Account Purposes. We care about keeping you secure and safe while using our Services. Keeping you safe requires us to process your personal information. We use such information to combat spam, malware, malicious activities, and security risks; improved and enforce our security measures; and monitor and verify your identity so that unauthorized users do not gain access to your information. e. To Maintain Legal and Regulatory Compliance. Our Services are subject to certain laws and regulations which may require us to process your personal information. f. For Our Business Purposes. We may use your information for any other purpose disclosed to you at the time we collect or receive the information, or otherwise with your consent. We may share your information with our affiliates (entities that control or are under the control of the YMCA Retirement Fund) for business purposes. We will require these entities to comply with the terms of this Policy with regard to their use of your information. CONTACT US FOR QUESTIONS OR INFORMATION If you have any questions or concerns relating to this Policy or our privacy practices please contact us. YMCA Retirement Fund 120 Broadway New York, NY 10271 I. LINKED SITES The YMCA Retirement Fund does not imply approval of linked sites, warrant the accuracy of any information set out in those sites, or endorse any material/product described and/or offered therein. All websites operate under and are the responsibility of their respective owners, who should be contacted directly with any questions about their content. II. TWO-FACTOR AUTHENTICATION TERMS AND CONDITIONS By logging into your account on yretirement.org, you agree to the YMCA Retirement Fund Two-Factor Authentication Terms and Conditions (“2FA Terms”). The 2FA Terms are in addition to and do not change or modify, any other policy or agreement that you have with the YMCA Retirement Fund. You authorize the YMCA Retirement Fund to communicate with you (directly or through a third-party) by email, text, and/or voice call (as you have selected), to provide you with a single-use verification code to log into your account on yretirement.org. You are responsible for any message or data charges that you incur through the use of 2FA. Check with your service provider for details on specific fees and charges that may apply. In addition, you are responsible for timely updating any phone number(s) and email address(es) that you have on file with the YMCA Retirement Fund. It is your sole responsibility to safeguard your electronic devices receiving these emails, texts, and/or voice calls. The email, text, or voice call that delivers your verification code is initiated when you log into your account on yretirement.org. If you receive a verification code at any other time or have questions about the security of the verification code that you receive, please immediately contact the Customer Service Department via Live Chat or call us directly at 800-RET-YMCA (800-738-9622), Monday through Friday from 9:00am to 5:00pm ET. If you wish to change the method (email, text, or voice call) that you elected for receiving verification codes, log into your account on yretirement.org, go to your Personal Information screen, and update your 2FA “Pick Your Delivery Method” election. The YMCA Retirement Fund reserves the right to update or modify the 2FA Terms at any time and from time to time without prior notice by posting the amended 2FA Terms on yretirement.org. We recommend that you review the 2FA Terms periodically. By logging into your account on yretirement.org after such posting, you agree to any posted changes or modifications to the 2FA Terms.