Privacy policy

Effective 12 August 2026. This policy covers benefitsmailportal.com and the document delivery service operated under it.

Who is responsible

Cedar Ridge Benefits Services, Inc., 7140 Metcalf Avenue, Suite 320, Overland Park, KS 66204, United States. For a client campaign, the employer or plan administrator that engaged us decides what is sent and to whom; we process the data on their instruction. Questions: [email protected].

Data we process

• Employee data supplied in the eligibility file: employee ID, name, work email address, plan name, effective date and the notice type.
• Documents produced from that data, and the record of what was sent to whom.
• Delivery and access logs: queued, delivered, opened, downloaded, bounced, plus the IP address and browser used to open a retrieval link.
• Correspondence with client contacts and with employees who write to our support desk.
• Account and billing data for the employer or brokerage that contracts with us.

Why we process it

• To perform the delivery service described in the client contract.
• To meet the plan’s documentation obligations, where a notice is required by law or by the plan rules.
• To keep the service secure and to investigate delivery or access problems.

Who receives it

Sub-processors listed on the security page: Amazon Web Services (hosting), Mailgun Technologies (outbound email delivery and bounce handling) and Twilio (one-time retrieval codes by SMS). Our staff, and auditors under confidentiality obligations, may access data where necessary to run a campaign.

We do not sell personal information and we do not share it for advertising. Data is disclosed to authorities only where we are legally compelled, and we tell the client unless prohibited from doing so.

How long we keep it

• Documents: 24 months from the send date, then deleted.
• Eligibility files: 30 days after campaign close, unless the contract sets a longer period.
• Access and delivery logs: 12 months.
• Billing records: as required by tax and accounting rules.

Your choices

To see what a campaign sent to you, to correct a misspelled name or a wrong address, or to ask for a document to be removed, contact the employer or plan administrator that sent it — they hold the record and give us the instruction. You may also write to [email protected] and we will pass the request on and confirm that we did.

Optional reminders can be switched off at your request through your plan administrator. Notices required by the plan cannot be switched off while the plan is active.

Security

Encryption, access control, logging and retention are described on the security page. Confirmed incidents affecting personal data are reported to the client contact within 72 hours.

Changes

When this policy changes, the effective date above changes with it and the previous version remains available on request. Material changes affecting client campaigns are notified to account contacts by email.