CALIFORNIA CONSUMER PRIVACY ACT

Learn about the CCPA

Learn more about the California Consumer Privacy Act (CCPA), what information we collect, and your rights pertaining to that data.

California Consumer Privacy Act

 

The California Consumer Privacy Act (“CCPA”) provides rights for California residents to receive information from SF Fire Credit Union about the information we collect and use about you.

This CCPA Privacy Notice addendum also provides information to California residents about what information you can obtain from us. 

For California residents, this Privacy Policy is adopted in accordance with the California Consumer Privacy Act of 2018 (CCPA) and the California Online Privacy Protection Act (CalOPPA), and any terms defined in the CCPA and CalOPPA have the same meaning when used in this Privacy Policy.

As used in this Privacy Policy, “personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include: (i) publicly available information from government records; (ii) deidentified or aggregated consumer information; or (iii) personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA) and the Gramm-Leach-Bliley Act (GLBA).

 


Your rights and choices

 

If you are a California resident, this section describes your rights and choices regarding how we collect, share, use, and protect your personal information, how to exercise those rights, and limits and exceptions to your rights and choices under the CCPA.

Exceptions

In the following instances, the rights and choices in this section do not apply to you:

• If you are not a California resident.

• If we collected personal information covered by certain financial sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994. How we collect, share, use and protect your personal information covered under the GLBA or FIPA is covered under our federal GLBA privacy policy, and our California notice, Important Privacy Choices for Consumers.

• Aggregated consumer information.

• Deidentified personal information.

• Publicly available information.

Access to specific information and data portability rights

If the above exceptions do not apply, and you have not made this request more than twice in a 12-month period, you have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months from the date we receive your request. Once we receive and confirm your request and verify that the request is coming from you or someone authorized to make the request on your behalf, we will disclose to you or your representative:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting or selling that personal information.
  • The categories of third parties to whom we sold or disclosed the category of personal information for a business or commercial purpose.
  • The business or commercial purpose for which we sold or disclosed the category of personal information.
  • The specific pieces of personal information we collected about you in a form that you can take with you (also called a “data portability request”).

 


Right to know what is collected

 

SF Fire CU may collect one or more of the types of information about you based on information you provided to us:

Identifiers:

A real name or alias; postal address; signature; home phone number or mobile phone number; bank account number, credit card number, debit card number, or other financial information; physical characteristics or description; email address; account name; Social Security number; driver’s license number or state identification card number; passport number; or other similar identifiers.

Protected classification characteristics under state or federal law:

Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Commercial information:

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Biometric information

Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Internet or other similar network activity:

Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.

Geolocation data:

Physical location or movements. For example, city, state, country, and ZIP code associated with your IP address or derived through Wi-Fi triangulation; and, with your permission in accordance with your mobile device settings, and precise geolocation information from GPS-based functionality on your mobile devices.

Professional or employment-related information:

Current or past job history, performance evaluations, disciplinary records, workplace injury records, disability accommodations, and complaint records.

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)

Educational records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Inferences drawn from other personal information:

Profile reflecting a person’s preference, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

 

Categories of sources of information we collect

We obtain the categories of personal information listed above from one or more of the following categories of sources:

From you or your authorized agent:

We may collect information directly from you or your authorized agent. For example, when you provide us your name and Social Security number to open an account and become a member. We also collect information indirectly from you or your authorized agent. For example, through information we collect from our members in the course of providing services to them.

From our website and applications that you access on your mobile device:

We collect certain information from your activity on our website (www.sffirecu.org) and your use of applications on your mobile device.  We may collect your IP address, device and advertising identifiers, browser type, operating system, Internet service provider (“ISP”), pages that you visit before and after visiting our website, the date and time of your visit, information about the links you click and pages you view on our website, and other standard server log information.  We may also collect your mobile device’s GPS signal, or other information about nearby Wi-Fi access points and cell towers.

The role of cookies and other online tracking technologies:

We, or our service providers, and other companies we work with may deploy and use cookies, web beacons, local shared objects and other tracking technologies for various purposes, such as fraud prevention and to promote our products and services to you. Some of these tracking tools may detect characteristics or settings of the specific device you use to access our online services.

“Cookies” are small amounts of data a website can send to a visitor’s web browser.  They are often stored on the device you are using to help track your areas of interest.  Cookies may also enable us or our service providers and other companies we work with to relate your use of our online services over time to customize your experience.  Most web browsers allow you to adjust your browser settings to decline or delete cookies, but doing so may degrade your experience with our online services.

Clear GIFs, pixel tags or web beacons—which are typically one-pixel, transparent images located on a webpage or in an email or other message—or similar technologies may be used on our sites and in some of our digital communications (such as email or other marketing messages).  They may also be used when you are served advertisements, or you otherwise interact with advertisements outside of our online services.  These are principally used to help recognize users, assess traffic patterns and measure site or campaign engagement.

Local Shared Objects, sometimes referred to as “flash cookies” may be stored on your hard drive using a media player or other software installed on your device.  Local Shared Objects are similar to cookies in terms of their operation but may not be managed in your browser in the same way.  For more information on managing Local Shared Objects, go to: https://helpx.adobe.com/flash-player/kb/disable-local-shared-objects-flash.html.

“First party” cookies are stored by the domain (website) you are visiting directly.  They allow the website’s owner to collect analytics data, remember language settings, and perform useful functions that help provide a good experience.  “Third-party” cookiesare created by domains other than the one you are visiting directly, hence the name third-party. They may be used for cross-site tracking, retargeting and ad-serving. We also believe cookies fall into the following general categories:

Essential Cookies:

These cookies are technically necessary to provide website functionality. They are a website’s basic form of memory, used to store the preferences selected by a user on a given site. As the name implies, they are essential to a website’s functionality and cannot be disabled by users. For example, an essential cookie may be used to prevent users from having to log in each time they visit a new page in the same session.

Performance and Function Cookies:

These cookies are used to enhance the performance and functionality of a website, but are not essential to its use. However, without these cookies, certain functions (like videos) may become unavailable.

Analytics and Customization Cookies:

Analytics and customization cookies track user activity, so that website owners can better understand how their site is being accessed and used.

Advertising Cookies:

Advertising cookies are used to customize a user’s ad experience on a website. Using the data collected from these cookies, websites can prevent the same ad from appearing again and again, remember user ad preferences, and tailor which ads appear based on a user’s online activities.

Online Advertising & Online Behavioral Advertising:

You will see advertisements when you use many of our online services.  These advertisements may be for our own products or services (including pre-screened offers of credit) or for products and services offered by third parties.  Which advertisements you see is often determined using the information we or our affiliates, service providers and other companies that we work with have about you, including information about your relationships with us (e.g., types of accounts held, transactional information, location of banking activity).  To that end, where permitted by applicable law, we may share with others the information we collect from and about you.

Online behavioral advertising (also known as “OBA” or “interest-based advertising”) refers to the practice of collecting information from a computer or device regarding a visitor’s web-browsing activities across non-affiliated websites over time in order to deliver advertisements that may be of interest to that visitor based on their browsing history.

Through OBA, we hope to deliver advertisements that are most likely to be of interest to you using information about your other web-browsing activities (e.g., the web pages you visit, search terms you enter, and the way you move through our online services on your computer or device) or your personal profile (e.g., demographic or location information).  Certain companies we work with may set cookies and use related tracking technologies, such as the clear GIFs discussed above, throughout our online services or in our communications to support these OBA efforts.

If you do not want us to share your information with companies we work with for OBA purposes, you can opt out by completing our Notice of Right to Opt-Out Request Form.

Another way to limit OBA is through your browser settings.  Many modern browsers permit you to limit third-party tracking and behavioral advertising cookies. 

Bear in mind that because cookies are stored by your browser, if you use different browsers on your computer, or multiple computers and devices that have browsers and you do not wish to have cookies collect information for OBA purposes, you will need to opt out of OBA from each browser on each of the computers and devices that you use. 

Please note that even if you opt out of OBA, you may still receive advertisements from us; they just won’t be customized based on your web-browsing activities on third-party websites.

Third-party service providers in connection with our services or our business purposes

We collect information from third-party service providers that interact with us in connection with the services we perform or for our operational purposes.  For example, a credit report we obtain from a credit bureau to evaluate a loan application.  Another example is a third-party service provider that provides us information to help us detect security incidents and fraudulent activity.

Information we collect from third-parties for a commercial purpose

We collect information from third-parties for our commercial purposes.  We partner with a limited number of third-party analytics and advertising firms. These third parties may use cookies or code processed by your browser to collect public information about your visits to our and other websites in order to provide customized experiences, advertisements or services.  These parties may also collect information directly from you by contacting you telephonically, via email or through other communication channels.  We do not disclose any information about you to such third-parties except as permitted by applicable laws and regulations, and we require such third-parties to follow applicable laws and regulations when they collect information from you to transfer such information to us.

 


Right to request information regarding personal information collected and disclosed

We may use or disclose personal information we collect for one or more of the following operational or other notified purpose (“business purpose”):

  • To fulfill or meet the reason for which the information is provided. For example, you apply for a loan, and we use the information in your loan application to give you the loan.
  • To provide you with information, products or services that you request from us.
  • To provide you with email alerts, event registrations or other notices concerning our products or services, or events or news, that may be of interest to you.
  • To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
  • To improve our website and present its contents to you.
  • For testing, research, analysis to improve our products and services and for developing new ones.
  • To protect the rights, property or safety of us, our employees, our members or others.
  • To detect security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
  • To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
  • As described to you when collecting your personal information.
  • To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, in which personal information held by us is among the assets transferred.

We also use your personal information to advance our commercial or economic interests (“commercial purpose”), such as advertising our membership, products and services, or enabling or effecting, directly or indirectly, a commercial transaction.

At your request, the Credit Union will provide a report regarding the information we have collected, used, disclosed and/or sold to others in the prior 12 months about you which will cover:

  • The categories of personal information collected about you;
  • The specific pieces of personal information we have about you;
  • Categories of sources from which personal information is collected;
  • Our purpose for collecting or sharing personal information;
    Identification; and
  • Categories of third-parties with whom the Credit Union sharesyour personal information.

 


Right to request deletion of personal information

 

You can request that SF Fire CU delete personal information it has collected and maintains about you.

We may deny your deletion request if retaining the information is necessary for us or our service providers to: 

  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you. 
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity. 
  • Debug to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law. 
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us. 
  •  Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Upon submission, and so long as we have no right or obligation to keep your personal information despite your right to request deletion, The Credit Union is required by law to have you confirm your previously submitted request to delete your information.

Once you provide that confirmation, we will start the process of deleting your personal information, and we will also instruct all our service providers that maintain your personal information on our behalf to also delete your personal information from their records.

 


Sharing personal information

We disclose your personal information to third parties for our business purposes.When we disclose personal information for a business, we enter a contract that describes the purpose and requires the recipient to keep that personal information confidential and not to use it for any purpose except performing the contract. 

The general categories of third-parties that we share with are as follows: 

  • Our third-party service providers;
  • Our affiliated websites and businesses in an effort to bring you improved service across our family of products and services, when permissible under relevant laws and regulations
  • Other companies to bring you co-branded services, products or programs
  • Third parties that help us advertise products, services or membership with us to you;
  • Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you;
  • Third parties or affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of our financial institution or affiliated business;
  • Other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.

 


Right to know the Credit Union's sale of your personal information

 

SF Fire Credit Union does not sell personal information it collects from members or prospects.

 


Right to opt-out of sale of personal information

 

While the Credit Union does not sell our member's personal information to others, you have the right to direct businesses that do sell your information to stop selling your personal information and to refrain from doing so in the future. 

 


Right to non-discrimination

 

SF Fire Credit Union shall not discriminate against you by altering the price of any of its products or services because you chose to exercise any of your rights under the CCPA.

 


Exercising your right to opt out, right to know, request to delete, and request correct

To exercise your right to know, right to a report, and deletion rights described on this page, please submit a verifiable consumer request to us by either: 

• Calling us at (888) 499-FIRE (3473)

• Submitting this form

• Visiting one of our branches