BSI FINANCIAL SERVICES PRIVACY NOTICE FOR CALIFORNIA RESIDENTS
This Privacy Notice for California Residents supplements the information contained in BSI Financial Services’ (“BSI”) General Privacy Notice. This additional information applies solely to all visitors, users, and others who reside in the State of California ("consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA), the California Privacy Rights Act (CPRA) which took effect on January 1, 2023, and any amendments thereto. Any terms defined in the CCPA and CPRA have the same meaning when used in this notice. The CCPA and CPRA, however, do not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act (“GLBA”).
INFORMATION WE COLLECT
BSI collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("personal information"). In particular, BSI has collected the following categories of personal information from its consumers within the last twelve (12) months in connection with origination or servicing of our borrowers’ loans:
- Identifiers, such as real name, alias, postal address, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.
- Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.
- Protected classification characteristics under California or federal law such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
- Internet or other similar network activity such as browsing history (as it relates to this website or BSI’s web portal), information on a consumer's interaction with a website, application, or advertisement (as it relates to this website or BSI’s web portal).
- Professional or employment-related information such as current or past job history (as it relates to information provided or obtained in connection with a loan or loss mitigation application).
NOTE: Most of the personal information we collect has been collected in the context of providing financial products and services, and therefore may not be subject to deletion under the CCPA.
Personal information, as defined in the CCPA, does not include:
- Publicly available information from government records.
- Deidentified or aggregated consumer information.
- Information excluded from the CCPA’s scope, like:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
CATEGORIES OF SOURCES
BSI obtains the above-identified categories of Personal Information from the following categories of sources:
- Directly from you. For example, from forms you complete or products and services you purchase, and in connection with validation of such information you have provided.
- From Clients about individuals associated with the Clients.
- From Service Providers.
The categories of third parties to whom we disclose the above-identified categories of Personal Information for our business purposes described in this Privacy Notice are:
- Service Providers who provide services such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure, customer service, email delivery, auditing, marketing and marketing research activities
- Joint marketing agreement partners (we have historically shared this information as permissible under previous versions of the CCPA, however we no longer share such information as of the effective date of this document).
USE OF PERSONAL INFORMATION
In the past 12 months, we have collected and used Personal Information relating to California residents to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives, including the following:
- Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.
- Fulfilling or satisfying the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry.
- Verifying your identity.
- Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
- Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance the service controlled by the business.
- Debugging to identify and repair errors that impair existing intended functionality.
- Complying with laws and regulations and complying with other legal service of process, court orders and law enforcement requirements.
- As described to you when collecting your personal information or as otherwise set forth in the CCPA.
- In connection with a Joint Marketing Agreement as defined under GLBA.
- For resolving complaints and disputes.
- Reporting information to credit reporting agencies.
BSI will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
DISCLOSING PERSONAL INFORMATION
We disclose your personal information with the following categories of third parties:
- Service providers
- Credit Reporting Agencies
In the preceding twelve (12) months BSI has disclosed the following categories of personal information for a business purpose:
- Identifiers
- California Customer Records personal information categories
- Protected classification characteristics under California or federal law
- Professional or employment-related information
- Service providers.
- Other institutions in connection with a Joint Marketing Agreement. (As of the effective date of this document, BSI no longer shares information about your account with our Joint Marketing Partners for marketing purposes)
SALE OR SHARING OF PERSONAL INFORMATION
In the past 12 months, BSI has not sold or shared Personal Information subject to the CCPA, including Personal Information of minors under the age of 18. For purposes of this Notice, sold means the disclosure of Personal Information to a third party for monetary or other valuable consideration. Sharing means the sharing of Personal Information with a third party for cross-context behavioral advertising.
NO RETALIATION FOR EXERCISING RIGHTS
BSI does not discriminate or retaliate against California residents who choose to exercise their rights under the CCPA. This means we will not
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
YOUR RIGHTS AND CHOICES
The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
RIGHT TO KNOW AND DATA PORTABILITY
You have the right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or disclosing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You also have the right in some cases to receive a portable copy of your personal information. Once we receive your request and confirm your identity, we will provide you with required information. Collectively, this is referred to as the “Right to Know.”
DELETION REQUEST RIGHTS
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. While California residents do have the right to request financial institutions delete certain personal information, BSI mainly collects and retains your personal information in the context of providing necessary mortgage servicing functions and is obligated to preserve certain information for compliance purposes. Therefore, although you may make a request to delete this information, some information may not be subject to deletion.
LIMITING USE AND DISCLOSURE OF SENSITIVE PERSONAL INFORMATION (SPI) RIGHTS
While California residents do have the right to limit the use and disclosure of sensitive personal information (SPI), BSI only uses and discloses SPI in the context of providing necessary mortgage servicing functions and is obligated to preserve certain information for compliance purposes. We do not use or disclose sensitive personal information for purposes other than those specified in § 7027, subsection (m). As a result, you do not have the right to limit under the CCPA.
ACCESSING INFORMATION ABOUT AUTOMATED DECISION-MAKING TECHNOLOGY
California residents do have the right to know if a business uses automated decision-making technology (ADMT) and if it does, the logic behind such automated decision-making technology. Should such technology be used, residents have a right to opt-out.
BSI does not use automated decision-making technology.
HOW LONG WILL BSI RETAIN MY PERSONAL INFORMATION
BSI will retain your personal information necessary to carry out its business purposes in connection with the servicing of your mortgage account for seven (7) years following the termination of the business relationship, in accordance with our contractual and regulatory obligations.
REQUESTING CORRECTION OF INACCURATE INFORMATION
California consumers have the right to request that a business make corrections to any inaccurate information they identify.
EXERCISE OF RIGHTS
To submit a request to exercise your rights, please submit a request to us by use of the web form linked here: California Privacy Request.
You may also submit a request by calling us at (800)-327-7861 or emailing us at bsiprivacy@bsifinancial.com.
Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may designate an authorized agent to exercise your rights under the CCPA on your behalf. Pursuant to the CCPA, only a natural person or a business entity that a customer has authorized to act on their behalf may act as an authorized agent. When you use an authorized agent to submit a request to delete, request to correct, request to know, or request to access ADMT, we may require that you or the authorized agent provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (1) Verify your identity directly with the business; or (2) Directly confirm with the business that you provided the authorized agent permission to submit the request.
RESPONSE TIMING AND FORMAT
If we receive a verifiable request to know, request to delete, or request to correct inaccurate personal information, or a request to access ADMT, we will confirm receipt of such request within 10 business days and provide information about how we will make the correction.
The verifiable consumer request to know, delete, correct, or access ADMT must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We will respond to a verifiable request to correct inaccurate personal information within forty-five (45) calendar days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail.
CONTACT US
If you would like to update or correct your information or modify your communication preferences, or if you have questions regarding our Policy or the use of information collected, you can contact us:
By email:
By telephone
Toll Free: (800)-327-7861
by writing to us at:
BSI Financial Services
314 S. Franklin Street
Titusville, PA 16354
Attn: CA Privacy Opt Out
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable request to correct does not require you to create an account with us. We will only use personal information provided in a verifiable request to correct to verify the requestor’s identity or authority to make the request.
CHANGES TO OUR PRIVACY NOTICE
BSI reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.
Effective date: January 1, 2026
Last reviewed on: December 17, 2025