Utah Community Federal Credit Union (UCCU) California Consumer Privacy Act (CCPA) Disclosure

Lasted updated March 2023.

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), including:

• the right to request the specific pieces of personal information Utah Community Federal Credit Union (hereinafter UCCU, us, or we) collected about you; the categories of personal information we collected; the categories of sources used to collect the personal information; the business or commercial purposes for collecting your personal information; and the categories of third parties with whom we share your personal information each as it pertains to our activities in the preceding twelve (12) months
• the right to request, on legitimate grounds, deletion of your personal information that we collected
• the right to have someone you authorize make a request on your behalf
• the right to data portability:  the right to obtain copies of your personal information in a readily usable format that’ll allow you to transmit the information from one entity to another
• the right, in certain circumstances, to correct inaccurate personal information we collected about you
• the right not to be discriminated against for exercising any of these rights

We also must provide in this disclosure certain details about our collection and handling of categories of personal information. The information that follows shows the types of personal information we may collect about California residents who are subject to the CCPA, the sources from which we collect it, and the ways in which we use and disclose it.

Categories of Personal Information We Collect:

• personal identifiers, including but not limited to those listed in other California statutes and  email address, first and last name, alias, Social Security number, passport number, other government issued number, driver’s license number, phone number, postal address, account number, member number, online identifier, IP address, signature, physical characteristics or description, insurance policy number, education, employment, employment history, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.
• usage data, including but not limited to your device’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our products or services that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data
• protect classification characteristics, including but not limited to age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)
• biometric Information, including but not omitted to genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data
• professional or employment: title; salary; employment files; references
• education information: details of your education and qualifications
• financial details: bank account numbers; debit/credit card numbers; cardholder or accountholder name and details; transaction details
• commercial information: records of personal property; products and service purchased, obtained or considered; purchasing or consuming histories or tendencies
• geolocation data: any information used to identify your physical location
• communications, recordings, images: audio, electronic, visual
• tracking technologies, including but not limited to cookies, beacons, tags, scripts and other technologies to collect and track information and your usage of our products and services. A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if You do not accept cookies, you may not be able to use some parts of our products and services. Cookies can be “Persistent” or “Session” cookies. Persistent cookies remain on your personal computer or mobile device when you go offline, while Session cookies are deleted as soon as you close your web browser.
• inferences: any derivation of information, data, assumptions, or conclusions drawn from certain of the above categories used to create a profile reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

Our Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• directly from you – for example, from the forms you complete through our locations, products, or services, or from your purchases on our products or services
• indirectly from you – for example, from observing your activity on our sites, apps, products, or services
• automatically from you – for example, through cookies we or our service providers set on your device as you navigate through our products and services
• from service providers – for example, third-party vendors to monitor and analyze the use of our products and services, third-party vendors for payment processing, or other third-party vendors that we use to provide products and services to you

Use of Information

We may use or disclose personal information we collect for “business purposes” or “commercial purposes” (as defined under the CCPA), which may include the following examples:

• to operate and provide you with our products and services
• to provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our products and services
• to fulfill or meet the reason you provided the information – for example, if you share your contact information to ask a question, we may use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery.
• to operate our sites and provide physical and online security.
• to conduct research requested by you or necessary to provide or monitor our products or services.
• to communicate with you and market to you via any means (including email, telephone, text message, social media, or other methods) subject that such communications are in compliance with applicable laws
• to update your contact information where appropriate
• to defend or assert legal rights, to comply with legal requirements, and to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations
• as described to you when collecting your personal information or as otherwise set forth in the CCPA
• for internal administrative and auditing purposes
• to manage risk, including audits, compliance, controls and other risks
• to detect, prevent, and investigate fraud
• to detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities

Disclosure of Information

Categories of Third Parties to Whom Personal Information is Disclosed

• you and, where appropriate, your family, your associates and your representatives
• anti-fraud services and providers
• companies with whom UCCU engages in joint marketing to offer you products and services
• accountants, auditors, financial advisors, lawyers and other outside professional advisors, subject to confidentiality
• data aggregation services
• auditors, accreditation, and governing bodies
• third party service providers (such as payment services providers; shipping companies; etc.)
• credit reporting agencies
• governmental, legal, regulatory, or other similar authorities and/or local government agencies, upon request or where required
• other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties
• any relevant third party acquirer(s), in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganization, dissolution or liquidation)

Retention

We will retain copies of your personal information in a form that permits identification as long as we maintain an ongoing relationship with you (e.g., while you remain an employee, or where you are still receiving services from us); or your personal information is helpful in connection with purposes set out in this disclosure. We may delete your personal information when permitted by law. If any relevant legal claims are anticipated/brought, we may continue to process your personal information for periods as are necessary in connection with that claim.

When the periods above have passed, we will either 1) permanently delete or destroy your relevant personal information, or 2) archive information in a form that is anonymous and cannot identify you.

Sale of Personal Information

UCCU does not offer an opt-out from the sale of personal information because UCCU does not engage in the sale of personal information as contemplated by the CCPA. As noted elsewhere in this disclosure, we disclose personal information to other businesses for a variety of reasons, including but not limited to joint marketing. While we often benefit from such disclosure, we do not disclose personal information for the sole purpose of receiving compensation for that information.

Changes to this Disclosure

We may change this disclosure from time to time. When we do, we will let you know by appropriate means such as by posting the revised disclosure on our CCPA web site with a new “Last Updated” date. Any changes to this disclosure will become effective when posted unless indicated otherwise.

Rights Under the CCPA

If you are a California resident, you have the right to:

1. request that we disclose to you the following information covering the 12 months preceding your request (“request to know”):
2. the categories of personal information that we collected about you and the categories of sources from which we collected such information;
3. the business or commercial purpose for collecting personal information about you;
4. the categories of personal information about you that we disclosed to third parties for a business purpose and the categories of third parties to whom we disclosed such personal information; and
5. the specific pieces of personal information we collected about you.

2.   request that we delete personal information that we collected from you, subject to applicable exceptions (“request to delete”). As stated above, we do not sell your personal information.

3.   be free from unlawful discrimination for exercising your rights under the CCPA.

You also have the right to designate an authorized agent to make a request under the CCPA on your behalf. If you wish to designate an authorized agent, UCCU requires a valid power of attorney with express powers under the CCPA.

In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. Additionally, we may not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another individual or where the personal information that we maintain about you is not subject to the CCPA’s rights.

We will advise you in our response if we are not able to honor your request. We will not provide Social Security Numbers, driver’s license numbers or government-issued identification numbers, financial account numbers, healthcare or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

How to Make Requests

If you are a California resident (or an authorized agent thereof), you may make a request for the disclosures described above or make a request to correct or delete personal information we collected from you using one of the below methods.

1. Members or others who have a relationship with UCCU may submit a request by calling (800) 453-8188 ext. 8235.
2. Mail a notarized copy of a request to Utah Community Federal Credit Union, Attention Compliance Department, 360 West 4800 North, Provo, UT  84604.
3. In-person submission of a request at a UCCU branch.
4. Visit uccu.com/ccparequest and follow the instructions found there.

Upon submission of your request, we will take steps to verify your identity. Those steps may vary, however, depending on your relationship with UCCU. We will work to process all verified requests within 45 days or faster as required by the CCPA. If we need an extension to process your request, we will reach out to you.