Overview

At The Crete Group, we consider privacy a fundamental aspect of our fiduciary responsibility as a Pooled Plan Provider (“PPP”). This Privacy Notice explains how we collect, use, and share information in connection with our Pooled Employer Plans (“PEPs”) and related retirement plan services. We may update this Notice periodically to reflect changes in our practices or applicable law.

Information We Collect

We collect information about participating employers, plan participants, and beneficiaries to administer retirement plan services. Information may include names, Social Security numbers, compensation data, employment information, investment elections, and contact details. We may also collect technical information such as IP addresses and portal usage data for security and performance purposes.

Sources of Information

We receive information directly from employers and participants, from our service providers such as FuturePlan (Third Party Administrator), and recordkeepers Lincoln Financial Group and Vestwell, and through secure data

exchanges necessary for plan operation.

How We Use Information

We use information to administer plan accounts, process transactions, fulfill fiduciary and regulatory obligations, maintain records, communicate with plan sponsors and participants, and improve our administrative and digital systems.

Information Sharing

We share information only as necessary to operate the plan and comply with applicable law. We may share data with FuturePlan, Lincoln Financial Group, Vestwell, payroll providers, auditors, and legal or regulatory authorities. Each third-party partner is contractually required to protect confidentiality and use information solely for plan-related purposes.

Data Security

We employ administrative, physical, and technical safeguards including encryption, multi-factor authentication, and access controls to protect information. While no system can guarantee absolute security, we continually assess and improve our data protection measures. Data Retention Personal information is retained for as long as necessary to meet legal, fiduciary, and operational requirements, including recordkeeping and compliance obligations.

Your Rights

Participants and employers may request access, correction, or clarification regarding their personal data. Requests can be submitted to our compliance team at the contact information below.

Contact Information

The Crete Group — 420 SW 9 St Topeka KS 66614 www.thecretegroup.com For plan-specific inquiries, contact your recordkeeper directly: • Lincoln Financial Group –www.lincolnfinancial.com • Vestwell – www.vestwell.com • FuturePlan – www.futureplan.com