Employee Privacy Notice & Policy

Trust & Will, Inc. ("Trust & Will," the "Company," "we," "us," or "our") provides this Employee Privacy Notice and Policy ("Notice") to our employees, interns, job applicants, and other individuals whose Personal Information we collect in an employment, service, or governance context (collectively, "Employees" or "you"). It describes the categories of Personal Information we collect, why we collect it, how long we keep it, and the rights available to you, along with our practices for workplace monitoring, use of artificial intelligence, and handling of Sensitive Personal Information.

This Notice describes our general privacy practices that apply to all Employees. Depending on where you live or work, you may have additional rights under state or local law. Those state-specific requirements and rights are described in Appendix A. Nothing in this Notice limits any right available to you under the laws of your state or locality.

1. SCOPE AND APPLICABILITY

This Notice applies to Personal Information we collect about you in connection with your employment, application, or contractor engagement with Trust & Will.

This Notice does not cover:

Personal Information we collect about you as a customer of Trust & Will's estate-planning services, which is governed by our consumer Privacy Policy; or
Health-plan information (medical, dental, and other ancillary plan data) held by our insurance carriers and plan administrators, which is governed by their separate HIPAA Notices of Privacy Practices. Additional plan-related notices, including for our tax-advantaged benefit plans, are available through our HRIS system.

2. DEFINITIONS

For purposes of this Notice, the following definitions apply:

"Personal Information" or "PI" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household.
"Sensitive Personal Information" ("SPI") means a subset of Personal Information that includes: Social Security, driver's license, state identification, or passport number; account log-in credentials; a financial-account, debit-card, or credit-card number in combination with any required security or access code; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; the contents of your mail, email, or text messages (unless we are the intended recipient); genetic data; biometric information processed to identify you; and information concerning your health, sex life or sexual orientation, or citizenship or immigration status.
"Service Provider" means a person or entity that processes Personal Information on behalf of Trust & Will pursuant to a written contract.

3. CATEGORIES OF PERSONAL INFORMATION COLLECTED

The specific Personal Information we collect depends on your role, location, and the nature of your engagement.

We collect and use Personal Information for the following employment-related purposes (each, a “Purpose”):

(a) Recruiting, hiring, and onboarding

(b) Employment administration and workforce management (including but not limited to payroll, compensation, benefits, leave, performance, training, workforce planning, employee events, professional development, and separation)

(c) Legal and regulatory compliance (including equal employment opportunity, tax reporting, immigration verification, accommodation, and recordkeeping)

(d) IT administration and security

(e) Workplace investigations and dispute resolution

(f) AI-assisted workflows

Each category below identifies which of these Purposes applies to the Personal Information collected.

3.1 Identifiers

What we collect: Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, and other similar identifiers.
Purposes: (a), (b), (c), (d), (e), and (f)

3.2 Characteristics of Protected Classifications

What we may collect: Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information.
Purposes: (b) and (c)

3.3 Commercial Information

What we may collect: Records of expenses, corporate-card transactions, and benefits-related purchases.
Purposes: (b)

3.4 Biometric Information

What we may collect: For most access and authentication, we rely on biometric features built into your own devices (for example, fingerprint or facial recognition to unlock a company laptop or to authenticate you). In those cases, the biometric stays on your device, and we do not collect or store it. In limited cases, a service provider may capture and store facial-recognition data to verify identity when provisioning or operating certain secure systems, such as payroll.
Purposes: (b) and (d)
Notice and consent (where we collect): Where we or a service provider collect and store biometric data, we or the service provider will comply with any laws requiring notice and/or consent for the collection and/or storage of biometric data. Any applicable specific state requirements are provided in Appendix A.

3.5 Internet or Network Activity

What we collect: Browsing and search history and interactions with websites, applications, and advertisements when you use Company systems or networks.
Purposes: (d) and (e)

3.6 Geolocation Data

What we may collect: IP-based location information from Company-issued devices or personal devices where company-managed apps are in use.
Purposes: (c) and (d)

3.7 Audio, Visual, and Similar Information

What we may collect: Photographs, video recordings from video conferencing platforms, transcripts or notes generated by automated notetaking or transcription tools during live conversations, audio recordings of calls, and voicemail messages, with consent where required by applicable law.
Purposes: (b), (d), and (e)

3.8 Professional or Employment-Related Information

What we collect: Job application and resume information, employment history, job title, department, manager, work location, compensation and benefits information, performance evaluations, disciplinary records, training records, attendance records, leave records, and separation information.
Purposes: (a), (b), and (c)

3.9 Education Information

What we collect: Educational institutions attended, degrees and certifications, transcripts, and professional licenses.
Purposes: (a) and (b)

3.10 Sensitive Personal Information

We collect the following categories of Sensitive Personal Information:

(a) Social Security, driver's license, state ID, or passport number

(b) Account log-in credentials for Company systems

(d) Citizenship or immigration status (for I-9 eligibility verification)

(e) Health information (for benefits, leave, and accommodation)

(f) Geolocation (IP-based location information from Company-issued devices or personal devices where company-managed apps are in use, where applicable)

(g) Biometric information (facial recognition, for identity verification and authentication)

We may collect:

(h) Racial or ethnic origin (voluntarily provided, for EEO reporting)

How we use it: We use Sensitive Personal Information only for limited operational purposes, such as providing payroll, benefits, and HR services, verifying identity, and maintaining security. We do not use or disclose Sensitive Personal Information to infer characteristics about you.

3.11 Sources of Personal Information

We collect Personal Information from the following sources: directly from you; from your use of Company systems and devices; from service providers (such as background-check and benefits providers); from government agencies; and from publicly available sources.

3.12 Information About Others

To administer benefits and respond to emergencies, we also collect Personal Information you provide about your dependents, beneficiaries, and emergency contacts (such as name, contact details, date of birth, and, for benefits enrollment, Social Security number). We encourage you to share this Notice with those individuals. We use their information only for those purposes.

4. SALE AND SHARING OF PERSONAL INFORMATION

Trust & Will does not disclose your Personal Information to third parties for their own direct-marketing purposes. If our practices ever change, we will update this Notice and, where required by applicable law, give you the opportunity to opt out before any sale or sharing begins.

5. CATEGORIES OF SERVICE PROVIDERS AND THIRD PARTIES

We disclose your Personal Information to the categories of recipients below for the business purposes described in this Notice. Most are Service Providers that process Personal Information on our behalf under written contracts requiring appropriate data-protection obligations; government agencies are recipients to whom we disclose Personal Information only when required by law.

(a) HR platform (HRIS): our human resources information system, which processes Personal Information for payroll, tax withholding, benefits, time tracking, HR administration, and related payments.

(b) Benefits administrators: insurance carriers, third-party administrators, retirement plan providers, and other benefits-related providers.

(c) Benefits brokers and consultants: benefits advisory and brokerage firms that provide plan analytics, benchmarking, and reporting.

(ed) Background-check providers: consumer reporting agencies that conduct pre-employment background checks with your consent.

(e) AI providers: providers of AI and AI-workflow services that process Personal Information as described in Section 7.

(f) IT providers: providers of cloud computing, software-as-a-service, device management, security, and other IT services.

(g) Professional advisors: legal counsel, accountants, auditors, and consultants.

(h) Government agencies: federal, state, and local agencies to which we disclose Personal Information as required by law (for example, the IRS, California EDD, USCIS, EEOC, and OSHA).

(i) Business transfer recipients: in the event of a merger, acquisition, restructuring, sale of assets, bankruptcy, or similar transaction, your Personal Information may be disclosed or transferred as part of that transaction.

Our requirements for Service Providers, including contractual data-protection obligations and prohibitions on unauthorized use or disclosure of Personal Information, are set out in our Vendor Management Policy in Drata.

6. WORKPLACE PRIVACY AND MONITORING

Trust & Will monitors its systems and workplaces to maintain a secure and productive environment. This Section describes those practices. They apply to all Employees regardless of location; specific state requirements are described in Appendix A.

6.1 Right to Privacy

We design our monitoring practices to balance legitimate business needs with your reasonable privacy expectations. Employees may have privacy rights under the laws of their state or locality; those requirements are described in Appendix A.

6.2 Telephone Monitoring and Recording

As a standard practice, we do not record or transcribe telephone calls, video conferences, or other communications without notifying all parties and giving them the opportunity to consent before recording or transcription begins. This includes the use of automated notetaking, transcription, or similar capture tools during live conversations. Several states where we have employees require all-party consent to record or capture the content of communications, and we generally apply this standard company-wide. In limited circumstances, such as a workplace investigation, we may record or monitor communications without prior notice to the extent permitted by applicable law.

6.3 IT Systems Monitoring

You should have no expectation of privacy in communications or data sent, received, or stored on Company systems. The systems we may monitor include, but are not limited to:

Company email
Internet activity on Company networks and devices
Company-issued computers, mobile devices, and other equipment
Company cloud applications
Company collaboration platforms, including messaging and video-conferencing tools

Additional details:

Use for employment decisions: Information obtained through monitoring may be used for employment decisions, including discipline, where it reveals a policy violation or misconduct.

6.4 Video Surveillance

Security cameras or other surveillance equipment may be present in common areas of Company offices or the buildings in which they are located for security and safety purposes. Some systems may be operated by building management outside of Trust & Will's control. Cameras are not placed in areas where employees have a reasonable expectation of privacy under applicable law.

6.5 Personal Social Media

We will not require or request that you or an applicant disclose a username or password for a personal social media account, access a personal account in our presence, divulge personal social media content, add the Company or any individual to a personal account's list of contacts, or change the privacy settings on a personal account. These protections apply to personal accounts only. Nothing in this section limits our ability to:

(a) View or consider publicly available information

(b) Request access to or information about accounts you use for Company business or that the Company provides

(c) Ask for links to public professional or portfolio profiles where relevant to your role, such as a social-media or marketing position

(d) Voluntarily encourage engagement with Company content or alignment of your professional profile with our brand guidelines

This section also does not apply, to the extent permitted by law, to investigations of misconduct or legal violations. Additional state-specific social-media requirements, where applicable, are in Appendix A. The protections in this Section also satisfy similar laws in: Colorado (C.R.S. § 8-2-127), Maryland (Lab. & Emp. § 3-712), Michigan (MCL §§ 37.271–37.278), Nevada (NRS § 613.135), New Jersey (N.J. Stat. §§ 34:6B-5 to -10), Tennessee (Tenn. Code §§ 50-1-1001 to -1004), Utah (Utah Code § 34-48-201), Vermont (21 V.S.A. § 495l), and Washington (RCW §§ 49.44.200, 49.44.205).

7. ARTIFICIAL INTELLIGENCE

Trust & Will uses artificial intelligence ("AI") to support various business functions. This Section describes how we use AI that processes your Personal Information in the employment context.

7.1 Personal Information Processed Through AI

The following categories may be processed through AI tools:

Identifiers (name, email address, employee ID)
Professional or employment-related information (job title, department, performance data)
Education information (degrees, certifications)
Internet or network activity (usage patterns, productivity metrics)
Inferences (skills assessments, performance predictions)

7.2 State-Specific AI Disclosure Requirements

Where required by law, this Notice informs you that we use AI in connection with employment decisions, and we do not use AI in a way that discriminates against any protected class. Specific state requirements are described in Appendix A.

7.3 AI Providers

Our third-party AI providers act as Service Providers or sub-processors under data protection agreements that include appropriate safeguards for your Personal Information.

7.4 No-Training Commitment

Where contractually available, we obtain commitments from our AI providers that your Personal Information will not be used to train their AI models.

8. YOUR PRIVACY RIGHTS

Depending on where you live or work, you may have specific privacy rights under state law, such as the right to know what Personal Information we have collected, the right to request deletion or correction, and other rights. These rights, along with how to exercise them, are described in Appendix A for each applicable state.

9. SOCIAL SECURITY NUMBER CONFIDENTIALITY

We protect Social Security numbers in accordance with applicable federal and state law.

10. DATA SECURITY

We maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information we collect, to protect it from unauthorized access, destruction, use, modification, or disclosure. If a security breach affects your Personal Information, we will comply with all applicable federal and state breach-notification requirements.

10.1 Data Disposal

We securely destroy personal information when it is no longer needed for the purpose for which it was collected, unless retention is required by law.

11. CONTACT INFORMATION

If you have questions about this Notice or want to exercise your privacy rights, contact the People Ops team:

Email: people-ops@trustandwill.com
Slack: #company-HR-support or DM @HR-support

For general questions about this Notice, include "Privacy Inquiry" in the subject line. To exercise a privacy right described in Appendix A, include "Privacy Request" in the subject line so we can route your message promptly.

12. CHANGES TO THIS NOTICE

We may update this Notice at any time. When we make a material change, we will notify Employees using one or more of the following methods: posting the updated Notice on the Company intranet, sending an email, or announcing the change in a Company-wide communication (for example, Slack or an all-hands meeting). Where a state law requires individualized written notice to employees in a particular jurisdiction, we will provide it.

The "Last Updated" date at the top of this Notice shows when it last changed. We encourage you to review it periodically. Your continued employment after a change takes effect constitutes acknowledgment of the updated Notice. If you have questions about any change, contact the People Ops team (see Section 11).

Your acknowledgment of this Notice, whether through our HRIS system or continued employment, does not constitute consent to the collection or processing of your Personal Information, which is based on the employment relationship and applicable legal bases.

Appendix A: State-Specific Provisions

These provisions describe specific legal requirements and privacy rights that apply to employees who live and work in the listed jurisdictions, in addition to the general practices described in the body of this Notice.

California

Notice at collection (Cal. Civ. Code § 1798.100(a); 11 CCR § 7012): This Notice serves as both a Notice at Collection and a Privacy Policy under California law. The categories of Personal Information described in Sections 3.1 through 3.10 of this Notice correspond to the categories defined in Cal. Civ. Code § 1798.140(v). The categories of Sensitive Personal Information described in Section 3.10 correspond to Cal. Civ. Code § 1798.140(ae). The term "Service Provider" as used in this Notice corresponds to Cal. Civ. Code § 1798.140(ag).
Retention: We retain each category of personal information listed in this notice for as long as reasonably necessary to fulfill the purpose for which it was collected, comply with applicable legal retention obligations, or support an active investigation or legal hold. Specific retention periods vary by category and are maintained in our internal data retention schedule.
Automated decision systems in employment (California Civil Rights Department regulations): We may use AI-powered tools to process employee data in connection with the purposes described in this Notice. We do not use artificial intelligence or automated-decision systems in a way that discriminates against a protected class. We retain records relating to any automated-decision system we may use for four years, consistent with the retention practices described above. Under these regulations, liability extends to employer agents, including AI vendors.
Inferences (Cal. Civ. Code § 1798.140(v)(16)): We may draw inferences from the Personal Information described in Sections 3.1 through 3.9 and 3.10 to create a profile reflecting your abilities and aptitudes, to the extent relevant to employment decisions. Purposes include performance management, talent development, succession planning, workplace investigations, and workforce analytics.
Right to know (Cal. Civ. Code §§ 1798.110, 1798.115): You may request that we disclose: the categories of Personal Information we have collected about you; the categories of sources; the business or commercial purpose for collecting it; the categories of third parties to whom we disclose it; and the specific pieces of Personal Information we have collected about you.
Right to delete (Cal. Civ. Code § 1798.105): You may request that we delete Personal Information we collected from you. Because this is an employment context, we will often need to keep records to meet legal obligations, complete the purpose for which we collected them, administer your pay and benefits, maintain security, or handle a legal claim, and we may deny a request to the extent a statutory exception applies. We will tell you if we deny a request and explain why.
Right to correct (Cal. Civ. Code § 1798.106): You may request that we correct inaccurate Personal Information we maintain about you, taking into account the nature of the information and the purpose of processing.
Right to opt out of sale or sharing (Cal. Civ. Code § 1798.120): You have the right to opt out of the sale or sharing of your Personal Information. As explained in Section 4, we do not sell or share your Personal Information, so there is nothing to opt out of unless our practices change.
Right to limit use of Sensitive Personal Information (Cal. Civ. Code § 1798.121; 11 CCR § 7027(m)): You have the right to limit our use of Sensitive Personal Information. As explained in Section 3.10, we use Sensitive Personal Information only for the limited operational purposes permitted under 11 CCR § 7027(m), so this right does not apply to our processing.
Right to non-retaliation (Cal. Civ. Code § 1798.125): We will not take any adverse employment action against you for exercising these rights.
How to submit requests: Submit a request by emailing people-ops@trustandwill.com with the subject line "Privacy Request," or by messaging @HR-support or #company-HR-support on Slack. Please give us enough information to verify your identity and locate your Personal Information; we may ask for more to confirm your identity before we respond.

Response timelines (Cal. Civ. Code § 1798.130): We will respond to a verifiable request within 45 days. If we need more time, we may take up to an additional 45 days and will tell you the reason in writing within the first 45-day period.
Authorized agents: You may designate an authorized agent to submit a request for you by giving the agent written permission. We may ask you to verify your identity directly with us and to confirm that you authorized the agent.

Social Security numbers (Cal. Civ. Code §§ 1798.85-1798.86): In addition to the protections in Section 9, California law imposes specific restrictions on the use and display of Social Security numbers.

Colorado

Biometric data (C.R.S. § 6-1-1314): Where we or a Service Provider collect biometric data, we obtain consent before collection and use it only for purposes permitted under Colorado law. Our biometric data retention and destruction practices are maintained in our internal data management policy.

Illinois

Artificial intelligence in employment (Illinois Human Rights Act, P.A. 103-0804): This Notice informs you that we use AI in connection with recruitment, hiring, promotion, renewal, selection for training or apprenticeship, discharge, discipline, tenure, and the terms and conditions of employment. We do not use AI in a way that discriminates against a protected class or use ZIP codes as a proxy for a protected class. Applicants receive AI-use notice through our recruiting process and within the job application.
Biometric data (BIPA, 740 ILCS 14): Where we or a service provider collect biometric data, we provide written notice and obtain your written release before collection, destroy it when the purpose is satisfied or within 3 years of your last interaction (whichever is first), and do not sell or profit from it.
Personal social media (820 ILCS 55/10): In addition to Section 6.5, we will not require you to invite the employer to join a group affiliated with a personal account.
Social Security numbers (815 ILCS 505/2RR): In addition to the protections in Section 9, Illinois law prohibits requiring an individual to use his or her Social Security number as an employee number.

Maryland

Facial recognition in interviews (Lab. & Emp. § 3-717): We will not use a facial recognition service to create a facial template during an applicant's interview unless the applicant signs a waiver stating the applicant's name, the interview date, and that the applicant consents to the use of facial recognition during the interview.

Michigan

Social Security numbers (MCLA § 445.81 et seq.): Michigan requires employers to create a written privacy policy that ensures SSN confidentiality, prohibits unlawful disclosure, limits access, describes disposal procedures, and establishes penalties for violations. Section 9 of this Notice satisfies that requirement. Michigan also prohibits displaying more than four sequential digits of a Social Security number on identification badges, cards, or permits.

New Jersey

Social Security numbers (N.J.S.A. 56:11-44 et seq.): New Jersey prohibits displaying four or more consecutive digits of a Social Security number on any card, badge, or tag, or on any item mailed to an individual. The protections in Section 9 satisfy this requirement.
Algorithmic discrimination (N.J.S.A. 10:5-1 et seq): New Jersey holds employers responsible for discriminatory outcomes produced by AI tools used in recruiting, screening, hiring, and other employment practices, including tools developed by third parties. We evaluate AI tools used in employment decisions for potential discriminatory impact and do not use AI in a way that discriminates against any protected class.

New York

Electronic monitoring (Civil Rights Law § 52-c): New York law requires that employees receive written notice that their electronic communications may be monitored, that they acknowledge receipt of that notice, and that the notice be posted conspicuously. This Notice satisfies all three requirements.

Required Notice: Any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems, may be subject to monitoring at any and all times and by any lawful means.

Personal social media (Labor Law § 201-i): In addition to Section 6.5, we will not require you to reproduce photographs, video, or other content from a personal account.
Social Security numbers (Lab. Law § 203-d): New York prohibits employers from visibly printing Social Security numbers on any identification badge or card, including time cards, and from placing Social Security numbers in files with unrestricted access.
Fingerprints (Lab. Law § 201-a): We will not require you to provide your fingerprint as a condition of employment.

Texas

Biometric data (CUBI, Tex. Bus. & Com. Code § 503.001): Where we or a service provider capture a biometric identifier, we provide notice and obtain consent beforehand and destroy it within a reasonable time and no later than one year after the purpose expires.
Artificial intelligence (Texas Responsible AI Governance Act, Tex. Gov’t Code Ch. 3308): Texas law prohibits the intentional use of AI systems to discriminate against a protected class in violation of state or federal law. We do not use AI in a way that discriminates against any protected class.

Washington

Biometric data (RCW 19.375): Washington law requires notice and consent before enrolling a biometric identifier in a database for a commercial purpose. The statute defines commercial purpose narrowly to exclude security purposes. Our use of biometric data for identity verification and device authentication falls outside the statute's scope. Where we or a Service Provider collect biometric data for a purpose within the statute's scope, we provide notice and obtain consent before collection.

Updated: September 2026