CCPA Consumer Privacy Notice
Updated/Effective May 26, 2020
Updated/Effective May 26, 2020
Your privacy is important to us. This California Consumer Privacy Act (CCPA) Privacy Notice describes how Educational Employees Credit Union (“EECU”, “we”, “us”, “our”) collects, shares, uses, and protects personal information subject to the CCPA collected through your online and offline interactions with us.
For California residents, this CCPA Privacy Notice (“Privacy Notice”) is adopted to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this Privacy Notice. The CCPA does not apply to certain information subject to other state or federal privacy laws, such as the Gramm-Leach-Bliley Act. Most of the personal information EECU collects may not be subject to the CCPA.
This Privacy Notice includes references and links to our Federal Privacy Policy and other privacy policies which serve different purposes under various laws and regulations that apply to us
Under the CCPA, Personal Information (PI) is information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device. (Note that some categories overlap.) In the preceding 12-months, we have collected the following categories of personal information.
| Category of PI | Examples |
| A. Identifiers | These include: real name, alias, postal address, signature, home or mobile phone number, bank account number, credit card number, debit card number, or other financial information, physical characteristics or description, email address, account name, Social Security number, driver's license number or state identification card number, passport number, or other similar identifiers. |
| B. Protected Classification Characteristics Under California State or Federal Law | These include: age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status. |
| C. Commercial Information | These include: records of personal property, products or services purchased, obtained, or considered, other purchasing or consuming histories or tendencies. |
| D. Biometric Information | These include: genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, face prints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. |
| E. Internet or Other Similar Network Activity | These include: browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. |
| F. Geolocation Data | These include: physical location or movements. For example, the location associated with your IP address and, with your permission in accordance with your mobile device settings, precise geolocation information from GPS-based functionality on your mobile devices. |
| G. Sensory Data | These include: audio, electronic, visual, thermal, olfactory, or similar information. |
| H. Non-public Education Information | These include: education records such as grades, transcripts, class lists, student identification codes, student financial information, or student disciplinary records. |
| I. Inferences Drawn From Other Personal Information | These include: profile reflecting a person’s preference, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. |
We obtain the categories of personal information listed above from one or more of the following categories of sources:
We may collect information directly from you or your authorized agent. For example, when you provide your name and Social Security number to open an account and become a member. We also collect information indirectly from you or your authorized agent. For example, through information we collect from our members in the course of providing services to them.
We collect certain information from your activity on our website activity at myEECU.org and your use of applications on your mobile device. We may collect your IP address, device and advertising identifiers, browser type, operating system, Internet service provider (“ISP”), the date and time of your visit, information about the links you click and pages you view on our website, and other standard server log information. We may also collect your mobile device’s GPS signal, or other information about nearby Wi-Fi access points and cell towers.
We, or our service providers, and other companies we work with may deploy and use cookies, web beacons, local shared objects and other tracking technologies for various purposes, such as fraud prevention and to promote our products and services to you. Some of these tracking tools may detect characteristics or settings of the specific device you use to access our online services.
“Cookies” are small amounts of data a website can send to a visitor’s web browser. They are often stored on the device you are using to help track your areas of interest. Cookies may also enable us or our service providers and other companies we work with to relate your use of our online services over time to customize your experience. Most web browsers allow you to adjust your browser settings to decline or delete cookies, but doing so may degrade your experience with our online services.
Clear GIFs, pixel tags or web beacons—which are typically one-pixel, transparent images located on a webpage or in an email or other message—or similar technologies may be used on our sites and in some of our digital communications (such as email or other marketing messages). They may also be used when you are served advertisements, or you otherwise interact with advertisements outside of our online services. These are principally used to help recognize users, assess traffic patterns and measure site or campaign engagement.
Local Shared Objects, sometimes referred to as “flash cookies” may be stored on your hard drive using a media player or other software installed on your device. Local Shared Objects are similar to cookies in terms of their operation but may not be managed in your browser in the same way. For more information on managing Local Shared Objects, click here.
“First party” cookies are stored by the domain (website) you are visiting directly. They allow the website’s owner to collect analytics data, remember language settings, and perform useful functions that help provide a good experience. “Third-party” cookies are created by domains other than the one you are visiting directly, hence the name third-party. They may be used for cross-site tracking, retargeting and ad-serving. We also believe that cookies fall into the following general categories:
You will see advertisements when you use many of our online services. These advertisements may be for our own products or services (including pre-screened offers of credit) or for products and services offered by third parties. Which advertisements you see is often determined using the information we or our affiliates, service providers and other companies that we work with have about you, including information about your relationships with us (e.g., types of accounts held, transactional information, location of banking activity). To that end, where permitted by applicable law, we may share with others the information we collect from and about you.
Online behavioral advertising (also known as “OBA” or “interest-based advertising”) refers to the practice of collecting information from a computer or device regarding a visitor’s web-browsing activities across non- affiliated websites over time in order to deliver advertisements that may be of interest to that visitor based on their browsing history. We do not engage in OBA.
We collect information from third-party service providers that interact with us in connection with the services we perform or for our operational purposes. For example, a credit report we obtain from a credit bureau to evaluate a loan application. Another example is a third-party service provider that provides us information to help us detect security incidents and fraudulent activity.
We collect information from third-parties for our commercial purposes. We partner with a limited number of third- party analytics and advertising firms. These third parties may use cookies or code processed by your browser to collect public information about your visits to our and other websites in order to provide customized experiences, advertisements or services. These parties may also collect information directly from you by contacting you telephonically, via email or through other communication channels. We do not disclose any information about you to such third-parties except as permitted by applicable laws and regulations, and we require such third-parties to follow applicable laws and regulations when they collect information from you to transfer such information to us.
EECU may use or disclose personal information collected for one or more of the following business purposes:
We also use your personal information to advance our commercial or economic interests (“commercial purpose”), such as advertising our membership, products and services, or enabling or effecting, directly or indirectly, a commercial transaction.
EECU may disclose your personal information to third-parties for our business purposes. When we disclose personal information for a business purpose, we enter into a contract that describes the purposes and requires the recipients to keep that personal information confidential and not use it for any purpose except for the performance of the contract. The general categories of third-parties that we share with are as follows:
In the preceding 12-months, we have disclosed the following categories of personal information for a business purpose and, for each category, the following categories of third-parties with whom such personal information was shared:
| Category of Personal Information (From the categories listed in Section 1) |
Category of Third-Parties (From the categories of third-parties listed in this Section 4) |
| A. Identifiers | 1, 2, 7 |
| B. Protected Classification Characteristics Under California State or Federal Law | 1, 2, 7 |
| C. Commercial Information | 1, 2, 3, 7 |
| D. Biometric Information | |
| E. Internet or Other Similar Network Activity | 1, 2, 7 |
| F. Geolocation Data | 1, 7 |
| G. Sensory Data | 1, 7 |
| H. Non-public Education Information | |
| I. Inferences Drawn From Other Personal Information | 3 |
EECU does not sell your personal information and we have not done so in the preceding 12-months.
If you are a California resident, the CCPA provides you with certain rights and choices regarding your personal information. Those rights, how to exercise them, and the limits and are described in this section.
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request we will disclose:
The specific pieces of personal information we collected about you in a form that you can take with you (also called a “data portability request”).
To exercise the right to know, data portability, and deletion rights described above, you may submit a verifiable consumer request to us by:
You may make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must include:
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Only you, or an authorized agent can make a verifiable consumer request related to your personal information. An authorized agent is a person or legal entity registered with the California Secretary of State that you have authorized to act on your behalf. If we receive a request through your authorized agent, we may require your written or verbal permission for the authorized agent to submit the request on your behalf, verification of identity from the authorized agent, and/or a copy of a power of attorney pursuant to California Probate Code sections 4000 to 4465. You may make a verifiable consumer request on behalf of your minor child.
We attempt to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you in writing of the reason and the extension period. We may provide the information to you by mail or electronically via email.
Any disclosures we provide will only cover the 12-month period preceding our receipt of the verifiable consumer request. If applicable, the response we provide will explain the reasons we cannot comply with a request. For data portability requests, we will provide your personal information in a format that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request.
The rights and choices described above do not apply to you if you are not a California resident, if the collected personal information is de-identified or publicly available information or if the personal information is covered by certain privacy laws such as the Fair Credit Reporting Act (FCRA) or the Gramm-Leach-Bliley Act (GLBA). How we collect, share, use and protect your personal information covered under the GLBA is described in our Federal Privacy Policy.
We will not discriminate against you for exercising any of your CCPA rights or rights under applicable laws. Unless permitted by law, we will not:
Currently, the standards regarding DNT signals and appropriate responses are not defined. As a result, we do not respond to DNT signals.
We reserve the right to amend this CCPA Privacy Notice at our discretion and at any time. When we make changes to this notice, we will notify you by email or by posting a notice on our website.
Our website is not intended for children under the age of 13. We do not knowingly collect, maintain, or use personally identifiable information from our website about children under the age of 13 without parental consent. For more information about the Children’s Online Privacy Protection Act (COPPA), visit the Federal Trade Commission website: www.ftc.gov.
Our website may include links to websites that are owned or operated by other companies ("third-party websites"). When you use a link online to visit a third-party website, you will be subject to that website’s privacy and security practices, which may differ from ours. You should familiarize yourself with the privacy policy, terms of use and security practices of the linked third-party website before providing any information on that website. We are not responsible for the third-party website’s use, collection, sale or sharing of your personal information.
We use reasonable physical, electronic, and procedural safeguards that comply with federal standards to protect and limit access to personal information. This includes device safeguards and secured files and buildings.
Note that information you send to us electronically may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential information (such as your Social Security number) to us.
If you have questions or comments about this notice, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to make a CCPA request, contact us by calling our Member Service Center at (800) 538-3328, by mail at P.O. Box 5242, Fresno, CA 93755-5242, or by sending us a secure message through Online Access.
***