Introduction
Colorado Retirement Association is dedicated to protecting your privacy. This privacy and security notice (“Notice”) provides important information regarding CRA’s efforts to keep your information safe from disclosure as well as the responsibilities you have to ensure the privacy of your information. Accordingly, the Notice describes how CRA collects, uses, and shares information when you access cra-online.org (the “Website”) and the online services we offer.
Please read the Notice carefully. By accessing CRA’s Website, you affirm that you have read and agree to adhere to the terms and conditions of the Notice, the Security Disclosure, and the Copyright and Trademark Notice. If you do not agree to be bound by such terms and conditions, please exit and do not access the Website.
Your Information and How It is Collected
Information You Volunteer
To use some of the services offered on the Website, you may need to provide personal information about yourself. To access personal account information on the Website, you must complete a voluntary account registration process. During the initial voluntary registration process, you must provide your Social Security Number, a four-digit CRA Personal Identification Number (“PIN”), and e-mail address to create a User ID and password. To request a PIN online, you must provide your Social Security Number, name, and birthdate. The User ID and password combination allows you to setup a User Security Profile through which you access your account information. You may choose to provide additional information, such as an address or other personal information. If you chose to complete online forms through your account, you will be asked to provide other types of personal information.
During your visit to the Website, you may send an email to CRA. Your email address and the contents of your message will be collected. The information collected is not limited to text characters and may include audio, video, and graphic information formats included in the message. Although the system regards all messages it receives from users as confidential, please be advised that because the Internet is a public domain, messages sent to CRA outside of a CRA secured page could be intercepted or accessed by a third party.
During your visit to the Website, you may choose to contact CRA through the “Contact Us” online form. To do so, you will be required to provide your name, Social Security Number, birthdate, email address, and comments. You may also provide your address and phone numbers.
If you choose to engage with our blog or social media pages by posting a comment or sharing a post, we may collect the information that you post as well as your name and e-mail address. Please note that your comment will also be visible to the public, so you should never share information that you would like kept private. You can learn more about CRA’s social media guidelines on our Social Media Policies page.
Information Provided by Third Parties
CRA may receive certain information about you from third parties. For example, if you are a named beneficiary or when employers provide information about their employees.
Information CRA Automatically Collects About You as You Navigate the Website
When you visit the Website, CRA automatically collects and stores information about your device and visit, for example:
- Usage Information: The pages on the Website that you access, the frequency of access, and what you click on while on the Website. We may also collect information about your use of the online services, such as frequency of use.
- Location Information: We may collect source location information from our web application firewall.
- Device Information: We may collect information about the device you are using, such as hardware model, operating system, application version number, browser, and IP addresses.
- Mobile Device Information: In addition to the Device Information listed above, when you access the Website via a browser on your mobile device, we may collect mobile network information, its operating system and other device attributes.
How We Use Your Information
We may use the information that you voluntarily provide or that we automatically collect as a result of your use of the Website in the following ways:
- to provide you with services and to fulfill our obligations to you;
- to provide additional security and identity verification;
- to communicate with you about the Website or online services, to send you account information updates, or to respond to a communication you initiated with Customer Service; and
- to improve the Website by understanding how users are interacting with the content.
How We Share Your Information
We may share the information that you voluntarily provide or that we automatically collect as a result of your use of the Website in the following ways:
- with your consent or at your direction, such as when you chose to share information or publicly post content and reviews (for example, social media or blog posts);
- where we are legally required to do so, such as to comply with a court order or legal process, or to protect the rights, property, or safety of CRA, our users, or others; and
- if we believe it is necessary to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person.
Additionally, during your visit to the Website, you may complete a transaction, such as changing your named beneficiary. You will be entering information into CRA secured pages which CRA is bound to keep confidential under Colorado Revised Statute § 24-51-213(1). The information volunteered by you in completing the transaction will be shared as necessary to perform the statutory duties of CRA, to operate a program authorized by law, or as authorized by state or federal statute or regulation. CRA will need to share your information as necessary with CRA’s advisers, third-party administrators, and other agents. In each case, those parties are bound by confidentiality agreements with CRA.
CRA does not disclose personal information collected from the Website to third parties for the third parties’ direct marketing purposes.
User Responsibilities
It is your responsibility to protect your CRA PIN/User ID and password because they allow you to securely access your account information.
CRA strongly recommends the following:
- Do not disclose your CRA PIN/User ID and password to anyone.
- Enroll in multifactor authentication.
- Do not place your CRA PIN/User ID and password in an accessible location.
- Do not leave the computer unattended while logged on.
- Always log-off CRA’s secure site when you are done.
Notify CRA immediately if an unauthorized person obtains access to your CRA PIN/User ID and password or if unauthorized activity is discovered.
It is your responsibility to carefully review your account information and to immediately contact CRA if you believe there is a discrepancy.
Access to your account information is for your convenience. CRA may restrict or discontinue your account access at any time and without notice.
CRA does not support third-party aggregation services which access your account information from the web site in an automated manner. We are not responsible for the use or disclosure of any personal information accessed by any company or person to whom you provide your CRA User ID and password. If you provide your CRA User ID and password to a third-party aggregation services provider, we will consider that you have authorized all transactions or actions initiated by such access information you provide, whether or not you were aware of a specific transaction or action. If you decide to revoke the authority you have given to an aggregation website, we strongly recommend that you change your CRA password to ensure that the aggregation website cannot continue to access your account information.
We also strongly recommend that you use caution and ensure that the third-party aggregation services provider has appropriate policies and practices to protect the privacy and security of any information you provide or to which they are gaining access.
The Website is controlled, operated, and administered by CRA from its offices within the United States. If you are accessing the Website from a location outside of the United States, you acknowledge and consent to the collection, storage, processing, and transfer of your information to our facilities in the United States and to those third parties with whom we share it as described in the Notice.
Children’s Privacy
CRA does not knowingly collect personal information from or create profiles of children under 13 through the Website. No one under age 13 may provide any personal information to or on the Website. If you are under 13, please do not register on the Website, or send any information about yourself to us, including your name, address, telephone number or e-mail address. Users are cautioned, however, that the collection of personal information submitted in an e-mail will be treated as though it was submitted by an adult, and may, unless exempted from access by federal or state law, be subject to public access.
Cookies
Cookies are small files created by websites, including our Website, that reside on your computer’s hard drive and that store information about your use of a particular website. When you access our Website, we use Cookies to:
- Estimate our audience size and usage patterns;
- Store information about your preferences, allowing us to customize our Website according to your individual needs; and
- Recognize when you return to our Website.
Google Analytics
We use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses Cookies or other tracking technologies to help us analyze how users interact with the Website, compile reports on the Website’s activity, and provide other services related to Website activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a returning visitor, and any referring website. The technologies used by Google Analytics do not gather information that personally identifies you. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies.
“Do Not Track” Signals
There is currently no industry agreed upon response to a Do Not Track signal. At this time, our Website does not respond differently based on a user’s Do Not Track signal.
Third-Party Websites
CRA’s Website contains links to other websites for your information and convenience. Such third-party websites may include social media platforms. You can learn more about CRA’s social media guidelines on our Social Media Policies page. CRA has no control over the privacy practices or the content of such other websites. Please review the privacy information provided by these sites. The responsibility for the content and accuracy of information on sites accessed by linking from our Website rests with the entities providing the information. This includes any responsibility for updating information upon which visitors may rely. The inclusion of links from this site to others does not imply any endorsement by CRA of any product, service or vendor. Any mention of products, services, or vendors is for informational purposes only.
Website and Information Security
To help ensure that your information is protected and only available to you, CRA uses PINs, User IDs and passwords, multifactor authentication, Secure Sockets Layer (SSL), and third-party certification.
SSL Protocol provides a method that encrypts information passed between the CRA server(s) and your browser to prevent others from accessing your information. This method uses a “challenge handshake” (or other such secure handshake authentication) and public/private key encryption on both sides (the server and the client) to help ensure that only your browser can translate the information being sent by CRA.
Third-party certification refers to a neutral third-party who has verified the authenticity of a Website and has issued the owner(s) of that Website a unique certificate. CRA’s Website has been certified by a certificate provider.
Although we strive to do our best to protect your personal information, the transmission of information via the Internet is not completely secure. CRA cannot guarantee complete security of your personal information transmitted via our Website or e-mail. Any transmission of such information is at your own risk.
Accuracy of Your Information
CRA services rely on the accuracy of your information. If you believe any of your information in our possession is inaccurate, you can make a request by contacting us. We will require evidence of your identity before fulfilling such request.
Changes to this Notice
The Notice is subject to change at any time without notice, and such changes shall be effective immediately upon posting the revised Notice on the Website. You are responsible for regularly reviewing the Notice. Continued use of the Website after any such changes constitutes your acknowledgement and consent to the revised Notice.
Contact Us
If you have questions or concerns about CRA’s privacy practices described in this Notice, please contact us.
