REV 06/2023
This CALIFORNIA PRIVACY POLICY AND NOTICE AT COLLECTION ("Policy" and/or "Notice") of Credit First National Association ("we," "us," or "our") applies solely to residents of the State of California ("consumers" or "you"). We adopt this Policy and Notice to comply with the California Consumer Privacy Act of 2018 ("CCPA") and other California privacy laws. Any terms defined in the CCPA have the same meaning when used in this Policy and Notice. The general Privacy Policy on our website is also applicable to you, but to the extent any information in the general Privacy Policy conflicts with this Policy, the information in this Policy shall apply to you.
This Policy and Notice explains how we collect, use, and disclose personal and sensitive information subject to the CCPA. It also describes the privacy rights of California residents under the CCPA and how they can exercise those rights.
Personal Information We Collect
We collect information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household ("personal information"). In particular, we may collect the following personal information from you:
Category | Examples |
---|---|
Identifiers. | Real name, alias, postal address, unique personal or online identifier, Internet Protocol address, email address, account name, Social Security number, government-issued ID, passport number or other similar identifiers. |
Purpose of Collection/Usage of Identifiers | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; verify your identity; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); enforce CFNA obligations and rights arising from agreement between CFNA and you; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; evaluate or conduct a merger, divestiture, or restructuring; and protect the rights, property, or safety of CFNA or other parties. | |
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | Name, signature, Social Security number, physical characteristics or descriptions, address, telephone number, passport number, driver's license or state identification card number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories. |
Purpose of Collection/Usage of Personal Information | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; verify your identity; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); enforce CFNA obligations and rights arising from agreement between CFNA and you; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; evaluate or conduct a merger, divestiture, or restructuring; and protect the rights, property, or safety of CFNA or other parties. | |
Protected classification characteristics under California or federal law. | Age (40 years or older), race, color, religion, national origin, sex, sexual orientation, marital status, physical or mental disability, or income derived from any public assistance program. |
Usage of Protected Classifications | |
We may use the personal information in this category to: assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. | |
Commercial information. | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
Usage of Commercial Information | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; verify your identity; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); enforce CFNA obligations and rights arising from agreement between CFNA and you; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. | |
Internet or other similar network activity. | Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. |
Usage of Internet or Network Activity | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. | |
Geolocation data. | Physical location or movements. |
Usage of Geolocation Information | |
We may use the personal information in this category to: deliver, manage, and support products and services; market our products and services; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. | |
Sensory data. | Audio, electronic, visual, thermal, olfactory, or similar information. |
Usage of Sensory Data | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; assess and manage risk; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; enforce CFNA obligations and rights arising from agreement between CFNA and you; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. | |
Professional/Employment data. | Professional or employment information. |
Usage of Professional or Employment Data | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; assess and manage risk; audit compliance with various regulations; ensure the security and integrity of the information collected; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); testing, research, analysis, and product development; and protect the rights, property, or safety of CFNA or other parties. | |
Inferences drawn from other personal information. | Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. |
Usage of Inferences | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. |
Sensitive Personal Information We Collect
We collect information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household ("personal information"). In particular, we may collect the following sensitive personal information from you:
Category | Examples |
---|---|
Identifiers. | Real name, alias, postal address, unique personal or online identifier, Internet Protocol address, email address, account name, Social Security number, government-issued ID, passport number, or other similar identifiers. |
Purpose of Collection/Usage of Identifiers | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; verify your identity; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); enforce CFNA obligations and rights arising from agreement between CFNA and you; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; evaluate or conduct a merger, divestiture, or restructuring; and protect the rights, property, or safety of CFNA or other parties. | |
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | Name, signature, Social Security number, physical characteristics or descriptions, address, telephone number, passport number, driver's license or state identification card number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories. |
Purpose of Collection/Usage of Personal Information | |
We may use the personal information in this category to: deliver, manage, and support products and services; manage relationships and maintain accounts; verify your identity; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); enforce CFNA obligations and rights arising from agreement between CFNA and you; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; evaluate or conduct a merger, divestiture, or restructuring; and protect the rights, property, or safety of CFNA or other parties. | |
Protected classification characteristics under California or federal law. | Age (40 years or older), race, color, religion, national origin, sex, sexual orientation, marital status, physical or mental disability, or income derived from any public assistance program. |
Usage of Protected Classifications | |
We may use the personal information in this category to: assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. | |
Geolocation data. | Physical location or movements. |
Usage of Geolocation Information | |
We may use the personal information in this category to: deliver, manage, and support products and services; market our products and services; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; and protect the rights, property, or safety of CFNA or other parties. |
Personal information does not include:
Sources of Information Collected:
Information Collected:
In the past twelve (12) months, we have collected the categories of personal information listed above relating to California residents. While some of the information that we collect may be considered sensitive personal information, we use and disclose the sensitive personal information for those purposes that are authorized by law. We may process your sensitive personal information in order to perform the service or provide the products you request from us or to verify customer information. You have the right to Limit the Use of Your Sensitive Personal Information as described below.
Disclosure of Personal Information to Third Parties:
We may disclose or share personal information to or with a third party for a business or commercial purpose and have done so in the preceding twelve (12) months.
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
We disclose your personal information for a business purpose to the following categories of third parties:
The disclosure of personal information was to deliver, manage, and support products and services; manage relationships and maintain accounts; verify your identity; assess and manage risk; manage fraud and financial crimes; audit compliance with various regulations; ensure the security and integrity of the information collected; meet legal, regulatory, or compliance requirements; market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); enforce CFNA obligations and rights arising from agreement between CFNA and you; improve and/or debug CFNA website and/or mobile application; testing, research, analysis, and product development; respond to law enforcement, regulatory, or judicial requests; evaluate or conduct a merger, divestiture, or restructuring; and protect the rights, property, or safety of CFNA or other parties.
Selling or Sharing of Personal Information:
In the preceding twelve (12) months, we have not sold any personal information to a third party.
In the preceding twelve (12) months, we have shared the following categories of personal or sensitive information to a third party.
We shared your personal or sensitive information to the following categories of third parties.
The disclosure of personal or sensitive information was to market our products and services in a non-personalized manner; market our products and services in a personalized manner (cross-context behavioral advertising); improve and/or debug CFNA website and/or mobile application; and testing, research, analysis, and product development.
Selling or Sharing of Personal Information of Minors under 16 Years of Age:
We do not knowingly disclose or sell the personal information of minors under 16 years of age.
Retention of Personal Information:
The personal information we collect will be retained for as long as reasonably necessary for the purposes set out in this Notice and consistent with our retention policies in accordance with applicable laws and applicable industry standards. When determining these retention periods, we consider the length of time personal information is required to be retained to provide the services; satisfy legal and compliance obligations and for audit purposes; address any complaints regarding the services; and defend or bring potential legal claims.
Your General Rights Request Information and Choices Under the CCPA:
Only you or a person that you authorize to act on your behalf may make a verifiable consumer request related to your or your household's personal information. You may also make a verifiable consumer request on behalf of your minor child. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request. If an authorized agent submits a request on behalf of a consumer, the authorized agent must provide proof that you have provided the authorized agent permission to process the request on your behalf.
We will use your information and/or your authorized agent's information, as follows: to verify your or your authorized agent's identify prior to processing the request: name, last four (4) digits of your Social Security number, Date of Birth, address, phone number, and/or email to verify your identity. Information provided will be compared to company records and validated against a third-party verification database.
Your authorized agent may submit a request on your behalf as described below.
Once we receive and confirm a verifiable consumer request, we may process the request as described below.
Response Timing and Format:
We will try to fully respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our response to you electronically via the email address or address provided on the request form. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For access requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance unless you do not have an email address.
We do not charge a fee to process or respond to your verifiable consumer request.
Right to Know:
The CCPA provides consumers who are California residents with specific rights regarding their personal information. You may request that we disclose to you the following information we have collected over the last twelve (12) months:
We are not obligated to provide you with this information more than twice within a 12-month period.
Right to Correct:
California residents also have the right to submit a request to correct inaccurate personal information maintained by us. In many instances, processing those corrections are best made by logging into your online account. If you provide us with documentation, it will only be used or maintained for the purpose of correcting the information and complying with our recordkeeping requirements under the CCPA. We may require additional information prior to processing your request.
Right to Delete:
California residents also have the right to submit a request to delete their personal information collected, subject to certain exceptions. For example, we may deny your request if retaining the information is necessary for us to complete a transaction you requested or comply with our legal obligations.
For your Rights requests, we may decline to honor your request in certain instances. For example, we may decline to honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. In other instances, we may decline to honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer, or where the personal information that we maintain about you is not subject to the CCPA.
You will be required to respond to an email generated from us to confirm the deletion request. If we do not receive your confirmation to delete your information, your request will be denied.
Once we receive and confirm your verifiable consumer request, we will delete and direct our service providers, contractors, or third parties to delete your personal information from records retained, unless an exception applies.
We may deny your deletion request for certain reasons as set forth in the CCPA, which will be described to you if all or a portion of your deletion request is denied.
If you are a California resident and would like to exercise your rights to know, correct, or delete your personal information as described above, please submit your request by using the web form at the following link or call 855.218.6524.
https://www.cfna.com/legal/ccpa-rights-request-form
OR
(Select "Privacy and Legal" in the footer, then select "California Consumer Privacy Act — Rights Request — Read More")
Once we receive your request, we may verify your identity through your account or by requesting additional information sufficient to confirm your identity, such as photos of your government ID.
Do Not Sell or Share My Personal Information or Limit the Use of My Sensitive Personal Information:
The CCPA grants California residents the right to opt out of the sale or sharing of their personal information, including cross-context behavioral advertising (also known as targeted ads), and the right to limit the use and disclosure of their sensitive personal information. Please submit your request by using the web form at the following link or call 855.218.6524.
https://www.cfna.com/legal/ccpa-rights-request-form
OR
(Select " Your California Privacy Choices" in the footer and complete the request form)
Non-Discrimination:
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
Changes to this California Consumer Privacy Act Notice:
We reserve the right to change this CCPA Privacy Policy and Notice at Collection in our discretion and at any time. When we do, we will post the revised CCPA Policy and Notice at Collection on our website, and we may notify you by e-mail. This CCPA Notice was last updated and became effective on the date posted at the top of this California Privacy Policy and Notice at Collection.
Contact Information:
If you have any questions or comments about the California Privacy Policy and Notice at Collection, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at 855.218.6524 or Privacy@cfna.com.