BSI Financial || Your Privacy Rights in California

BSI Financial Services Privacy Notice for California Residents

This Privacy Notice for California Residents supplements the information contained in BSI Financial Services’ (“BSI”) General Privacy Notice. This additional information applies solely to all visitors, users, and others who reside in the State of California ("consumers" or "you"). We adopt this notice to comply with the California Privacy Rights Act (CPRA) which takes effect on January 1, 2023, which amends and expands upon the rights provided to California consumers in the Consumer Privacy Act of 2018 (CCPA), and any terms defined in the CCPA and CPRA have the same meaning when used in this notice. The CCPA and CPRA, however, do not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act (“GLBA”).

INFORMATION WE COLLECT

BSI collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("personal information"). In particular, BSI has collected the following categories of personal information from its consumers within the last twelve (12) months in connection with origination or servicing of our borrowers’ loans:

Identifiers, such as real name, alias, postal address, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.
Protected classification characteristics under California or federal law such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
Internet or other similar network activity such as browsing history (as it relates to this website or BSI’s web portal), information on a consumer's interaction with a website, application, or advertisement (as it relates to this website or BSI’s web portal).
Professional or employment-related information such as current or past job history (as it relates to information provided or obtained in connection with a loan or loss mitigation application).

NOTE: Most of the personal information we collect has been collected in the context of providing financial products and services, and is therefore not subject to the CPRA.

Personal information, as defined in the CPRA, does not include:

Publicly available information from government records.
Deidentified or aggregated consumer information.
Information excluded from the CPRA’s scope, like:

health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

CATEGORIES OF SOURCES

BSI obtains the categories of personal information from the following categories of sources:

Directly from you. For example, from forms you complete or products and services you purchase, and in connection with validation of such information you have provided.
From Clients about individuals associated with the Clients.
From Service Providers.

The categories of third parties to whom we disclose Personal Information for our business purposes described in this privacy Notice are:

Service Providers who provide services such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure, customer service, email delivery, auditing, marketing and marketing research activities
Joint marketing agreement partners

USE OF PERSONAL INFORMATION

In the past 12 months, we have used Personal Information relating to California residents to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives, including the following:

Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.
Fulfilling or satisfying the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry.
Verifying your identity.
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance the service controlled by the business.
Debugging to identify and repair errors that impair existing intended functionality.
Complying with laws and regulations and to comply with other legal process, court orders and law enforcement requirements.
As described to you when collecting your personal information or as otherwise set forth in the CPRA.
In connection with a Joint Marketing Agreement as defined under GLBA.
For resolving complaints and disputes.
Reporting information to credit reporting agencies.

BSI will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

SHARING PERSONAL INFORMATION

BSI may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We share your personal information with the following categories of third parties:

Service providers
Joint marketing agreement partners

BSI does not share information related to cross-contextual behavioral advertising.

In the preceding twelve (12) months BSI has disclosed the following categories of personal information for a business purpose:

Identifiers
California Customer Records personal information categories
Protected classification characteristics under California or federal law
Professional or employment-related information

We disclosed your personal information for a business purpose to the following categories of third parties:

Service providers.
Other institutions in connection with a Joint Marketing Agreement.

SALE OF PERSONAL INFORMATION

In the past 12 months, BSI has not sold Personal Information subject to the CPRA, including Personal Information of minors under the age of 16. For purposes of this Notice, sold means the disclosure of Personal Information to a third-party for monetary or other valuable consideration.

NO RETALIATION FOR EXERCISING RIGHTS

BSI does not discriminate or retaliate against California residents who choose to exercise their rights under the CPRA. This means we will not

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

YOUR RIGHTS AND CHOICES

The CPRA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CPRA rights and explains how to exercise those rights.

DELETION REQUEST RIGHTS

While California residents do have the right to request financial institutions delete certain personal information, BSI only collects and retains your personal information in the context of providing necessary mortgage servicing functions and is obligated to preserve certain information for compliance purposes, and that information is therefore not subject to deletion.

LIMITING USE AND DISCLOSURE OF SENSITIVE PERSONAL INFORMATION (SPI) RIGHTS

While California residents do have the right to limit the use and disclosure of sensitive personal information (SPI), BSI only uses and discloses SPI in the context of providing necessary mortgage servicing functions and is obligated to preserve certain information for compliance purposes and that information is therefore not subject to deletion.

ACCESSING INFORMATION ABOUT AUTOMATED DECISION-MAKING TECHNOLOGY

California residents do have the right to know if a business uses automated decision-making technology & if it does, the logic behind such automated decision-making technology. Should such technology be used, residents have a right to opt-out.

BSI does not use automated decision-making technology.

HOW LONG WILL BSI RETAIN MY PERSONAL INFORMATION

BSI will retain your personal information necessary to carry out its business purposes in connection with the servicing of your mortgage account for seven (7) years following the termination of the business relationship, in accordance with our contractual and regulatory obligations.

REQUESTING CORRECTION OF INACCURATE INFORMATION

California consumers have the right to request that a business make corrections to any inaccurate information they identify.

EXERCISE OF RIGHTS

To request the correction of inaccurate information, please submit a verifiable consumer request to us by use of the web form linked here: California Privacy Request.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information.

RESPONSE TIMING AND FORMAT

If we receive a verifiable request to correct inaccurate personal information, we will confirm receipt of such request within 10 business days and provide information about how we will make the correction.

We will respond to a verifiable request to correct inaccurate personal information within forty-five (45) calendar days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail.

CONTACT US

If you would like to update or correct your information or modify your communication preferences, or if you have questions regarding our Policy or the use of information collected, you can contact us:

By email:

bsiprivacy@bsifinancial.com

By telephone

Toll Free: (800)-327-7861

by writing to us at:

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable request to correct does not require you to create an account with us. We will only use personal information provided in a verifiable request to correct to verify the requestor’s identity or authority to make the request.

CHANGES TO OUR PRIVACY NOTICE

BSI reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Effective date: January 1, 2023
Last reviewed on: December 20, 2022