California Privacy Policy

Applicability

This Notice explains how we collect, share, use, and protect Personal Information and data we receive through our business activities, websites, mobile applications, and other online services and communication channels, including via email, telephone, or our branches (collectively, our "Services").

The Personal Information we collect, use, and disclose about you will vary based upon our relationship or interaction with you. The CCPA, and this Notice, do not apply to Personal Information that we collect about you when you apply for or obtain our financial products and services. Personal Information we collect when you apply for or obtain our financial products and services is subject to the Gramm-Leach-Bliley Act (“GLBA”) and the Fair Credit Reporting Act (“FCRA”).

Consumer Privacy Notice

If you apply for or obtain our financial products and services, we may use and share any Personal Information that we collect from or about you according to the terms of our Consumer Privacy Notice. The Consumer Privacy Notice provides certain restrictions on our ability to use and share your Personal Information, and it provides you certain choices with respect to the use and sharing of your Personal Information. The Consumer Privacy Notice shall supersede this Notice and our Online Privacy Policy in the event of any conflict.

Personal Information We May Collect

The categories outlined below describe the Personal Information related to California residents or their devices to which this Notice is applicable and that we may have collected within the last twelve (12) months.

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers
• Information that identifies, relates to, describes, or is capable of being associated with a particular California resident including, but not limited to the signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information
• Characteristics of protected classifications under California or federal law, such as sex and marital status
• Commercial information, such as records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies
• Biometric information
• Internet or other electronic network activity information, such as browsing history, search history, and information regarding a California resident's interaction with an internet website application or advertisement
• Geolocation data, such as device location and Internet Protocol (IP) location
• Audio, electronic, visual, thermal, or similar information such as call and video recordings
• Professional or employment-related information, such as work history and prior employer
• Education information, directly related to a student, and maintained by an educational agency or institution by a party acting for the agency or institution
• Inferences drawn from any of the Personal Information listed above to create a profile about a California resident reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes; and
• The following categories of Sensitive Personal Information
  • Personal Information that reveals:
    • A California resident's Social Security, driver's license, state identification card, or passport number
    • A California resident's account log-in, online loan application, or financial/servicing account in combination with any required security or access code, password, or credentials allowing access to an account
    • A California resident's precise geolocation (means within 1,850 feet of a particular person)
    • A California resident's racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
    • The contents of a California resident's mail, email, and text messages unless the business is the intended recipient of the communication
• The processing of biometric information for the purpose of identifying a California resident,
• Information concerning an individual’s health, sex life; sexual orientation,
• Union membership, and
• Personal Information of California residents less than 16 years of age.

We may coordinate with contracted third parties to collect Personal Information on our behalf, when they are engaged in one or more of the business practices described below:

• Delivering advertising and marketing, including on non-affiliated persons' or entities' sites and mobile apps
• Facilitating events and event management, including virtual and/or in-person events (e.g., hotels, restaurants, virtual platforms, audio/visual capabilities, food/beverage, transportation services, etc.), and
• Referral sources, whether for purposes of identifying candidates for employment, identifying new consumer or customer opportunities, or recommending vendors or contractors

Sources From Which We Collect Personal Information

We collect Personal Information from the following sources:

• Directly from you or your representatives
• Service Providers, Consumer Data Resellers, Consumer Lead Sellers, Credit Reporting Agencies and other similar persons or entities
• Public Record Sources (Federal, State or Local Government Sources)
• Information from our Affiliates, and
• Website/Mobile App Activity/Social Media – or your use of any features or resources available on or through an app or website. When you use an app or visit a website, your device and browser may automatically disclose certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting and other technical communications information), which may constitute Personal Information. Note: you can opt out of this sharing by implementing the Global Privacy Control browser setting.

How We Use Personal Information

We collect and use Personal Information from or concerning you for the following business and/or commercial purposes:

• To provide you with our products and services including maintaining or servicing accounts, providing customer service, processing applications and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, providing research services, facilitating event management and execution, or providing other similar services
• To provide our products and services in ways not already described in the categories above
• To communicate with you via any means (including via email, telephone, text message, social media, post or in person) subject to our ensuring such communications are provided to you in compliance with applicable law; and maintaining and updating your contact information where appropriate
• To operate and manage our websites and applications; provide content to you; display advertising and other information to you; and communicate and interact with you via our websites and applications
• To manage our communications systems, operate our IT security, and conduct IT security audits
• To manage record keeping and to comply with related legal obligations
• To manage our business operations including sales; finance; corporate audit; and vendor management
• To conduct market or customer satisfaction research; and/or to engage with you for the purpose of obtaining your opinion on our products and services
• To maintain electronic security (including login records and access details, where you access our electronic systems)
• To detect, investigate and prevent breaches of policy, and criminal offences, in accordance with applicable law
• To comply with our legal and regulatory obligations under applicable law
• To establish, exercise and defend legal rights
• To identify issues with existing products and services and plan improvements to existing products and services
• To engage in risk management such as audit, compliance, and control development and implementation
• To detect, prevent and investigate fraud

How We Use Sensitive Personal Information

We may use or disclose Sensitive Personal Information for purposes consistent with the CCPA (“Permitted SPI Purposes”), as follows:

• To provide the products and services that an average California resident who engages with us would reasonably expect
• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information
• To defend against and prosecute those responsible for malicious, deceptive, fraudulent, or illegal actions directed at AnnieMac
• To ensure physical safety
• For short-term, transient use, such as non-personalized advertising shown as part of your current interactions with us, where we do not:
  • disclose Sensitive Personal Information to another third party, or
  • use it to build a profile about you or otherwise alter your experience outside your current interaction with us
• To perform services, including maintaining or servicing accounts, processing or fulfilling transactions, verifying a California resident’s information, processing payments, or providing financing, analytic services, or storage
• To verify or maintain the quality or safety of a product, service, or device that we own, manufacture, had manufactured, or control; or to improve, upgrade, or enhance the service or device that we own, or manufacture, had manufactured, or controlled.
• To collect or process Sensitive Personal Information that we do not use for the purpose of inferring characteristics about a California resident

Other Categories of Personal Information and Other Uses

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you with notice. If required by law, we will also seek your consent before using your Personal Information for a new or unrelated purpose.

We may collect, process, and disclose aggregated or de-identified consumer information for any purpose, without restriction. When we collect, process, or disclose aggregated or de-identified consumer information, we will maintain and use it in de-identified form and will not to attempt to reidentify the information, except to determine whether our de-identification processes satisfies any applicable legal requirements.

Our Disclosure of Personal Information

With respect to each category of Personal Information that we disclosed for a business or commercial purpose in the past 12 months, the categories of persons or entities to whom we disclosed that Personal Information are:

• You and, where appropriate, your family, your associates and your representatives
• Our Affiliates
• Service Providers and Contractors who provide services to us such as credit reporting agencies, website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure, customer service, email delivery, auditing, marketing, supporting research activities, credit financing, and event management
• Other Service Providers and Contractors who provide services to us such as payment, banking and loan servicing, storage, legal expertise, tax expertise, real estate expertise, appraisal expertise, and notaries and auditors
• Other Service Providers and Contractors who enable our consumers and customers to conduct transactions online and via mobile devices, and support our mortgage and fulfillment services
• Third parties or Affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of our businesses
• Government Agencies as required by laws and regulations
• Other persons or entities you may use or with which you direct us to intentionally interact or to which you may use or direct us to intentionally disclose your Personal Information

Our Retention of Personal Information

We will retain your Personal Information for the period necessary to achieve the purposes addressed in this Notice. We determine the period we will retain your Personal Information based on the following:

• We will retain copies of your Personal Information in a form that permits identification for as long as:
  • We maintain an ongoing relationship with you (e.g., while you are still receiving services from us); or
  • Your personal information is necessary in connection with purposes addressed in this Notice plus:
• Any retention period required under applicable law or a retention policy established in accordance with applicable law

In addition, we may retain your Personal Information for additional periods in connection with any anticipated or actual legal claims and we may continue to retain your personal information for such additional periods as are necessary in connection with such claims.

Once the periods above have concluded, each to the extent applicable or permitted by applicable law, we will 1) permanently delete or destroy the relevant personal information, or 2) archive your personal information so that it is beyond use; or 3) anonymize the relevant personal information.

Rights of California Residents

If you are a California resident, you have one or more of the following rights:

• Receive this Notice at or before the point of collection of your Personal Information.
• Request we disclose to you free of charge the following information:
  • the categories of Personal Information about you we have collected
  • the categories of sources used to collect the Personal Information
  • the purpose of collecting Personal Information about you
  • the purpose of sharing Personal Information about you
  • the categories of recipients with whom we share your Personal Information, including for cross-context behavioral advertising purposes, and
  • the specific pieces of Personal Information we have collected about you
• Request we correct inaccurate Personal Information that we maintain about you
• Request we delete Personal Information we collected from you, unless the CCPA recognizes an exception
• Opt-out of our sale or sharing of personal information to third parties. Please note that your right to opt out does not apply to our sharing of personal information with service providers, who are parties we engage to perform a function on our behalf and are contractually obligated to use the personal information only for that function.
• Not be subject to retaliation because you exercise any of your rights under the CCPA

Automated Decision-Making Technology

If we use automated decision-making technology (“ADMT”) to make significant decisions about you, you may have rights to:

• Obtain certain information about how we use ADMT, that is specific to you (your "ADMT access right")
• Opt-out of our ADMT use (your "ADMT opt-out right") unless we provide you with a method to appeal the decision to a human reviewer with the authority to overturn the decision (your "ADMT appeal right") or another exception applies

ADMTs are technologies that process your Personal Information and use computation to execute a decision and either replace or substantially replace human decision-making, resulting in decisions made without human involvement. Decisions are significant when they result in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Advertising is not a significant decision.

Exercising Your Rights

You may submit a request to exercise your rights by clicking here or by calling us at 1-888-531-0380.

To protect your personal information, we will verify your identity before we act on your request. We may ask you to provide personal identifiers we can match against information we may have collected from you previously, and to confirm your request using the email address or telephone number stated in the request.

We will only honor a request made by you or a person authorized to make a request on your behalf. Before acting on a third-party request made on your behalf, we will require proof of authorization such as a legally enforceable power of attorney and verifiable proof of identity.

How We Respond to Requests

We will confirm receipt of your request within ten (10) business days. We will make a good faith effort to respond to a verified consumer request within forty-five (45) days of its receipt and verification. If we require more time (up to an additional forty-five (45) days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver a written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. We may have a reason under the law why we do not have to comply with your request, or why we may comply in a more limited way than you anticipated. For example, if your information is not protected by the CCPA because we obtained the information during the loan application process and it is subject to the GLBA and FCRA. We will explain any reasoning to you in our response.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Sale of Personal Information

We do not offer an opt-out from the sale of personal information because we do not sell personal information as defined by the CCPA (and have not done so in the last 12 months).

Individuals Under 16 Years of Age

We do not knowingly collect or share personal Information from children under 16 without parental consent.

Contact Us

Please contact us about this California Consumer Privacy Act Policy or our Services at 1-888-531-0380 or ccpa_request@annie-mac.com.