CCPA/CPRA Privacy Policy

Privacy Policy for California Residents

Last Updated: March 26, 2024

This Privacy Policy for California Residents (“California Privacy Policy”) supplements the information contained in Lendmark’s Terms of Use and Online Privacy Policy and discusses our collection and use of “personal information”, as defined under the CCPA (as defined below). This California Privacy Policy applies solely to all visitors, users, and others who reside in the State of California that use or interact with our personal lending and other financial services, website, physical branches, and other applications (“consumers” or “you”).

Lendmark Financial Services, LLC, its subsidiaries and affiliates (“We”, “us”, “our” or “Lendmark”) adopts this California Privacy Policy to comply with applicable California data privacy and protection laws and regulations, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), and any implementing regulations adopted by the California Privacy Protection Agency (collectively referred to as the “CCPA”). Capitalized terms not defined herein shall have the same meaning as the CCPA when used in this California Privacy Policy. “Personal Information” in both capitalized or lower case form shall have the same meaning as “personal information” ascribed to it under the CCPA.

Please note that Lendmark is a financial institution subject to the Gramm-Leach-Bliley Act (“GLBA”). The CCPA excludes certain personal information from its scope including, without limitation, personal information collected, processed, sold, or disclosed subject to the GLBA. Therefore, for example, if you have submitted an application for a loan with Lendmark or are a customer of Lendmark, any information you provided in that application and in connection with your Lendmark account is subject to the GLBA and exempt from the CCPA. For additional information regarding our collection, use, and disclosure of personal information subject to the GLBA, and information relating to your choices with respect to this information, please see our GLBA Privacy Notice.

Accessibility

A Spanish version of this California Privacy Policy is available at: https://www.lendmarkfinancial.com/es/disclosures/cpra

I. Notice at Collection

Data Categories Collected by Us

We currently collect the following categories of personal information listed in the chart below:

Category of Personal Information	Description	Collected (Yes/No)
Identifiers	Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, Social Security number, or other similar identifiers. Sold or Shared? We do not sell or share this category of personal information.	Yes
Personal information described in Cal. Civ. Code § 1798.80(e)	Examples: A name, signature, Social Security number, address, telephone number, employment, employment history, bank account number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories. Sold or Shared? We do not sell or share this category of personal information.	Yes
Protected classification characteristics under California or federal law	Examples: Age (40 years or older), gender, race, ethnicity or national origin, marital status, or veteran or military status. Sold or Shared? We do not sell or share this category of personal information.	Yes
Commercial Information	Examples: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Sold or Shared? We do not sell or share this category of personal information.	Yes
Biometric information	Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data	No
Internet or other similar network activity	Examples: Browsing history, search history, information on a consumer's interaction with our website, application, or advertisement. Sold or Shared? We do not sell or share this category of personal information.	Yes
Geolocation data	Examples: Physical location or movements. Sold or Shared? We do not sell or share this category of personal information.	Yes
Sensory data	Examples: Audio, electronic, visual, thermal, olfactory, or similar information. Sold or Shared? We do not sell or share this category of personal information.	Yes
Professional or employment-related information	Examples: Current or past job history. Sold or Shared? We do not sell or share this category of personal information.	Yes
Non-public education information	Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. Sold or Shared? We do not sell or share this category of personal information.	Yes
Inferences	Examples: Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	No
Sensitive Personal Information	Examples: Social Security number, driver’s license number, state identification number, passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation information; racial or ethnic origin, religious, or philosophical believes, or union membership; contents of mail, email, and text messages unless the business is the intended recipient of the communication. **We only collect Sensitive Personal Information for legitimate business purposes appropriate for the use and disclosure of Sensitive Personal Information as defined in the CCPA, and not otherwise use it to infer characteristics about you. Sold or Shared? We do not sell or share this category of personal information.	Yes**

Retention Period: We will retain and use these categories of personal information for an appropriate period of time as is necessary to fulfill the purposes for which it was collected, to comply with our business requirements and legal obligations, to provide our Services, and other purposes to the extent provided in this California Privacy Policy. We will take reasonable steps to delete the personal information when (1) we have a legal obligation to do so; (2) we no longer have a purpose or obligation for retaining the information; or (3) if you ask us to delete the information unless there is an applicable exception to deleting the information under the CCPA. We are required to maintain records of Consumer requests submitted under the CCPA, which may include these categories of personal information, and how we responded to such requests for at least twenty-four (24) months. Such information related to Consumer requests is retained only for recordkeeping purposes.

Business or Commercial Purposes: We use the categories of personal information listed above provide our products and services to you, to operate, manage, and maintain our business, and to accomplish the following business and commercial purposes, including the following:

• To fulfill or meet the reason for which the information is provided;
• To provide you with information, products or services that you request from us directly or indirectly;
• To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you;
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections;
• To provide customer service, maintain and servicing accounts, verifying customer information, processing payments, providing financing, providing analytic services, or providing similar services on behalf of the business;
• To improve our website and present its contents to you;
• To establish and maintain your user account with us;
• To authenticate you;
• For short-term, transient use including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the consumer’s personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business
• To detect fraud and prevent loss, or as necessary or appropriate to protect the rights, property, or safety of us, our users and customers, or others;
• To audit related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
• To debug to identify and repair errors that impair existing intended functionality;
• To allow you to contact us and facilitate your communication with us;
• To respond to your feedback, requests, questions, or inquiries;
• To provide offers to eligible users or customers;
• To provide advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA; and
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

Other Processing Activities: As permitted by applicable law, we may use all of the personal information that we collect in order to:

• Comply with federal, state, or local laws;
• Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities;
• Cooperate with law enforcement agencies concerning conduct or activity that we, a service provider, or a third party reasonably and in good faith believe may violated federal, state, or local law;
• Cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury;
• Exercise or defend legal claims; and
• Collect, use, retain, sell, or disclose consumer information that is deidentified or aggregate consumer information.

Additional Data Collection and Uses: We will not collect categories of personal information other than those discussed above and we will not use your personal information for any other purposes that are incompatible with those disclosed above without providing you notice as may be required under the CCPA.

Exclusions from Personal information: Personal information does not include:

• Publicly available information or lawfully obtained, truthful information that is a matter of public concern;
• Personal information that is deidentified;
• Personal information that is aggregated;
• Information excluded from the scope of the CCPA including, but not limited to:
  • Personal information collected, processed, sold, or disclosed subject to the GLBA or the California Financial Information Privacy Act;:
  • Personal information bearing on an activity involving the collection, maintenance, disclosure, sale, communication, or use of such information by an agency, furnisher, or user subject to regulation under the Fair Credit Reporting Act (FCRA); or
  • Personal information collected, processed, sold, or disclosed subject to the California Financial Information Privacy Act and implementing regulations or the Driver’s Privacy Protection Act of 1994.

II. Data Practices During Last 12 Months

Personal Information Collected: As described in this California Privacy Policy, we have collected the categories of personal information listed below during the preceding 12 months:

• Identifiers
• Categories of personal information described in Cal. Civ. Code § 1798.80(e)
• Characteristics of protected classifications under California or federal law
• Commercial information
• Internet or other similar network activity
• Geolocation data
• Sensory data
• Professional or employment-related information
• Non-public education information
• Sensitive Personal Information

Categories of Sources: We have collected the categories of personal information identified in this California Privacy Policy from the following categories of sources:

• Directly from you. For example, from forms you complete, applications you submit, or products or services you obtain from us.
• Indirectly from you. For example, from lead generation companies or cookies.
• Service Providers and Contractors. For example, credit reporting agencies or credit and verification providers.
• Government entities. For example, from government records.

Business and Commercial Purpose for Collecting: We have collected the categories of personal information identified for the purposes listed in the “Business or Commercial Purposes” section above.

Categories of Personal information Disclosed for a Business Purpose: We have disclosed the following categories of personal information to service providers or contractors for a business purpose, or upon your consent to third parties during the preceding 12 months:

• Identifiers
• Personal information described in Cal. Civ. Code § 1798.80(e)
• Characteristics of protected classifications under California or federal law
• Commercial information
• Internet or other similar network activity
• Geolocation data
• Sensory data
• Professional or employment-related information
• Non-public education information
• Sensitive Personal Information

Business and Commercial Purpose for Disclosing: We have disclosed the categories of personal information identified for the purposes listed in the “Business or Commercial Purposes” section above.

Prior to disclosing any personal information to a service provider or contractor for a business purpose, we enter into a written contract which describes, without limitation, the specific business purposes which the personal information can be used by the service provider or contractor to perform the services specified in the contract, requires the service provider or contractor to both keep any personal information confidential, prohibits the service provider or contractor receiving the personal information from retaining, disclosing, or using the personal information outside the direct business relationship, prohibits the service provider or contractor from selling or sharing any personal information, provides us the right to take reasonable and appropriate steps to ensure that they use personal information in accordance with contractual terms, among other regulatory requirements.

The categories of personal information identified above were disclosed to the following categories of third-party recipients: (1) corporate parents, subsidiaries, and affiliates; (2) advisors (accountants, attorneys); (3) investors; (4) service providers or contractors (data analytics, data storage, mailing, marketing and advertising, payment processing, website and platform administration, technical support, security monitoring; and operating systems and platforms); and (5) third parties to which you have authorized us to disclose your Personal Information in connection with services, products or online platforms that we made available for your use or access. With respect to these third parties, please review the Cookies section of our Online Privacy Policy located here.

Categories of Personal Information Sold or Shared to Third Parties: We have not sold or shared any categories of personal information to third parties in the preceding 12 months. We do not knowingly sell or share the personal information of Consumers under 16 years of age.

No Financial Incentive: We do not offer financial incentives or any price or service difference in exchange for the retention or sale of your personal information.

III. California Consumer Rights

Consumer Rights

The CCPA provides consumers with certain rights regarding their personal information. These rights do not apply in all instances and are subject to certain exceptions as a matter of law. By way of example, these rights do not apply where we collect or sell a consumer’s personal information if: (1) we collected that information while the consumer was outside of California, (2) no part of a sale of the consumer’s personal information occurred in California, and (3) no personal information collected while the consumer was in California is sold. You may submit these requests to us as described below, and we honor these rights where they apply.

1. Right to Know: As described below, you have the right to request that we disclose personal information that we have collected, sold, or shared about you. This includes a request for the following:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information is collected;
• The categories of personal information that we have sold, shared, or disclosed for a business purpose about you;
• The categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose;
• The specific pieces of personal information we have collected about you;
• The business or commercial purpose(s) for which the personal information was collected, disclosed, sold, or shared.

Our response to a Request to Know may be limited to the 12-month period preceding receipt of the request if it would be impossible, involve disproportionate effort, or the request is for data for a specific time period. We are prohibited from disclosing Social Security numbers, driver’s license numbers, other government-issued identification numbers, financial account numbers, health insurance numbers, medical identification numbers, account passwords, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics. However, we will inform you whether we have collected that type of information. We will respond to requests to know by the same Consumer no more than twice in a twelve (12) month period.

1. Right to Delete: You have the right to request that we delete any personal information that we have collected, sold, or shared about you. However, we are not required to honor a deletion request if an exemption applies under the law.
2. Right to Opt-Out of Sale/Sharing: You have the right to direct a business that sells or shares personal information about you to third parties to stop doing so. We do not sell or share any personal information as defined by the CCRA. Therefore, we include this disclosure of information for informational purposes only.
3. Right to Non-Discrimination: We will not discriminate against you, in terms of price or services that we offer, if you submit one of the rights requests listed above.
4. Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you. Our goal is to keep your personal information accurate, current, and complete.
5. Right to Limit: In limited circumstances, a Consumer has the right to limit the use and disclosure of Sensitive Personal Information to that use which is necessary to perform our services or as otherwise permitted by law. Our use of your Sensitive Personal Information is solely for Business Purposes, and not for those purposes for which a Consumer may exercise right to limit the use or disclosure under the CCPA. Therefore, we include this disclosure for informational purposes only.

These rights to not apply to personal information collected or disclosed under certain exemptions under CCPA. This includes, but is not limited to, personal information collected, processed, sold, or disclosed subject to the GLBA. Therefore, rights such as the Right to Know and Right to Delete do not apply to personal information collected, processed, sold, or disclosed pursuant to these exemptions.

IV. How to Exercise your Consumer Rights.

Submission Instructions: You may submit a request to know by: (1) calling toll-free 1-866-413-8340; (2) visiting one of our branches; or (3) submitting a CCPA Request Form through our website (www.lendmarkfinancial.com/contact).

Response Process: Upon receiving a request to know, request to delete, or request to correct, we will confirm receipt of the request within ten (10) business days and provide information about how we will process your request. The information provided will describe our verification process and when you should expect a response from us. In general, we will respond to the request within forty-five (45) calendar days from the day we receive it; but, if necessary, we may take up to an additional forty-five (45) calendar days to respond to your request. If an extension is needed, we will notify you of the extension and explain the reasons that responding to your request will take more than forty-five (45) calendar days.

Once verification is complete, we will associate the information provided by you in the verifiable consumer request to any personal information previously collected by us about you. We will promptly take steps to disclose and deliver, free of charge to you, the information requested. We will provide an individualized response to requests regarding categories of personal information as required by applicable law, but, we may refer you to our general practices outlined in this California Privacy Policy when our response would be the same for all consumers and all the information that is otherwise required to be in a response is presented here.

Delivery: Except as otherwise provided by applicable law, the information will be provided in writing or through our website. We will respond by mail. If we do not take action on your request, we will, without delay and, at the latest, within the time period permitted for our response, inform you of the reasons that we did not take action and any rights you may have to appeal the decision.

Verification Procedures: We are required by the CCPA to verify the identity of individuals who submit a request to know, request to delete, or request to correct. In accordance with our internal policies and in compliance with the CCPA, we will take steps to verify your identity before granting you access to such Personal Information or acting on your request to exercise your rights, as outlined below:

To determine whether the individual making the request is the consumer about whom we collected information, we will verify your identity by matching the identifying information provided by you in the request to the personal information that we already maintain about you. As part of this process, you will be asked to provide your full name, address, and phone number. We will inform you if we cannot verify your identity.

a. If we cannot verify the identity of the person making the request for specific pieces of information, we are prohibited from disclosing any specific pieces of personal information to the requestor. However, if denied in whole or in part for this reason, we will evaluate the request as if it is seeking the disclosure of categories of personal information about the consumer.

b. If there is no reasonable method by which we can verify the identity of the requestor to the degree of certainty required, we will state this in our response an explain why we have no reasonable method by which we can verify the identity of the requestor.

If we cannot verify your identity based on the information already maintained, we may request additional information from you. We will try to limit the information collected, and we will only use this information to verify your identity and for security or fraud-prevention purposes. Except as required by law, we will delete any new personal information collected for the purposes of verification as soon as practical after processing the request.

Authorized Agents: You may designate an authorized agent to make requests on your behalf by sending us written authorization in writing at Privacy Policy Manager, 2118 Usher Street, Covington, GA 30014. If you use an authorized agent to submit a request to know or a request to delete, we may require you to: (1) provide the authorized agent with written permission to do so; and (2) verify your identity directly with us. However, we will not require these actions if you have provided the authorized agent with power of attorney pursuant to the California Probate Code. We may deny a request from the agent that does not submit proof that they have been authorized by the consumer to act on their behalf.

Excessive Requests: If requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, we may either (1) charge a reasonable fee, or (2) refuse to act on the request and notify the consumer of the reason for refusing the request. If we charge a fee, the amount will be based upon the administrative costs of providing the information or communication or taking the action requested.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights including, but not limited to, by:

a. Denying you goods or services.

b. Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

c. Providing you a different level or quality of goods or services.

d. Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

California Shine the Light

Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us once a calendar year information about the information we shared, if any, with other businesses for direct marketing uses. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing, if any, will be included in our response. As part of the California Online Privacy Protection Act, all users of our website or application Apps or Sites may make any changes to their information at any time by contacting us by mail to: Privacy Policy Manager, 2118 Usher Street, Covington, GA 30014

Changes and Updates to This California Privacy Policy

We reserve the right to amend, add to, change, update, or modify this California Privacy Policy at our discretion and at any time. When we make changes to this California Privacy Policy, we will post all changes to this California Privacy Policy on this page. Any such changes, updates, or modifications shall be effective immediately upon posting. The date on which this policy was last modified is identified at the beginning of this California Privacy Policy. Your continued use of our website, applications, or services after the “Last Updated” date will constitute your acceptance of and agreement to such changes and to our collection and sharing of your information according to the terms of the then-current policy.

Contact Information

If you have any questions or comments about this California Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to lodge a complaint with us, you may contact us using the information below and we will do our best to assist you. Please note, if your communication is sensitive, you may wish to contact us by postal mail or telephone:

In Writing: Privacy Policy Manager, 2118 Usher Street, Covington, GA 30014

By Telephone: 1-866-413-8340