SUPPLEMENTAL STATE PRIVACY NOTICE
Last Updated: September 2022
This Supplemental State Privacy Notice (“Notice”) applies to residents of California, Virginia, Colorado, Utah, Connecticut and Nevada. This Notice supplements the rights contained in our Privacy Statement, Customer Privacy Notice, and in our Terms and Conditions. To the extent of any inconsistency between these documents, the standard affording the higher privacy right to the customer or consumer prevails, unless otherwise specified.
This Notice explains how Credit Corp Solutions Inc. (“Credit Corp”, “we”, “us” or “our”) handles Personal Information (as defined below) that we collect online, through our website located at www.creditcorponline.com, including our payment portal (collectively, the “Site”), and through our offline interactions with you, such as from telephone, facsimile, postal mail, personal delivery or other means or media and explains how to exercise your rights under certain state laws. “Personal Information” means information which identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
This Notice does not apply to Personal Information collected and processed about Credit Corp employees, job applicants or independent contractors, or to certain types of information exempted from applicable state laws including but not limited to:
- Publicly available information, being that which is lawfully made available from federal, state, or local government records; or
- Information which has been de-identified, or is aggregate consumer information;
- information which is collected, processed, sold, or disclosed pursuant to the Federal Gramm-Leach-Bliley Act (‘GLBA’) and implementing regulations;
- Information governed by:
- the Fair Credit Reporting Act (‘FCRA’);
the California Financial Information Privacy Act (‘FIPA’). Most of the information that Credit Corp collects is subject to the GLBA as Credit Corp is a financial institution as that term is defined by U.S. Code Ann. §6809(3)(A) and is covered by the GLBA pursuant to U.S. Code Ann. §6809(4)(A)(i-iii). Information subject to the GLBA and processed by Credit Corp is not covered by this Notice because it is not subject to the applicable state laws.
- Data Collection Notice
We have collected, used, disclosed, sold and shared the following categories of Personal Information from consumers within the last twelve (12) months:
|
Category |
Examples |
Disclosed for a Business or Commercial Purpose? |
Categories of Third Parties to Whom the Information was Disclosed |
Sold or Shared? |
Categories of Third Parties to Whom the Information was Sold or Shared |
Purpose(s) for Selling or Sharing
|
|
Identifiers |
Real names, aliases, sequence post nominals (such as Jr. Snr.), dates of birth, residential and mailing addresses and history, unique personal identifiers, online Identifiers, Internet Protocol (‘IP’) addresses, email addresses, account numbers, account names, Social Security numbers, Medicare numbers, driver's license numbers, passport numbers or other similar identifiers. |
Yes |
|
No, except for IP addresses as described in the “Internet or other electronic network activity information” category, below. |
N/A |
N/A |
|
Personal Information pursuant to California Customer Records Statute (Cal. Civ. Code § 1798.80(e) |
Names, signatures, social security numbers, physical characteristics or descriptions, addresses, telephone numbers, passport numbers, driver's license or state identification card numbers, insurance policy numbers, education, employment, employment history, bank account numbers, credit card numbers, debit card numbers, or any other financial information, medical information, or health insurance information. |
Yes |
No |
N/A |
N/A |
|
|
Characteristics of protected classifications under California or federal law |
Records relating to race, religion, creed, color, national origin, ancestry, physical disability, mental disability, medical condition, marital status, gender or gender identification, sexual orientation, citizenship, age, military or veteran status, or genetic information. |
Yes (excluding genetic information) |
No |
N/A |
N/A |
|
|
Commercial Information |
Information relating to personal property, products or services purchased, obtained or considered, or other purchasing, consuming histories and tendencies and payment or financial history. |
Yes |
No |
N/A |
N/A |
|
|
Internet or other electronic network activity information |
Internet Protocol (“IP”) addresses, Media Access Control (“MAC”) addresses, online identifiers, computer type and operating system type and version, screen resolution, internet browser type and version, browsing history, search history, web site interaction history, device type and network service provider, unique device identifiers associated with the device you use to access the site and cookies stored on your computer or device. |
Yes |
|
Yes |
|
|
|
Geolocation data |
Identification or estimation of your real-world geographical location, based on your cell phone, internet-connected computer terminal or other device. |
Yes |
Yes |
|||
|
Audio, electronic, visual, thermal, olfactory, or similar information |
Voice/audio recordings, electronic, visual or similar information. |
Yes, (excluding thermal and olfactory information) |
No |
N/A |
N/A |
|
|
Professional or employment-related information. |
Employer name, employment status, role, tenure, employment income, profession, professional qualifications, work history |
Yes |
No |
N/A |
N/A |
|
|
Certain inferences drawn from any of the above information |
Information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes. |
Yes |
Yes |
|
|
We have collected, used, disclosed, sold and shared the following categories of Sensitive Personal Information from consumers within the last twelve (12) months:
|
Category |
Disclosed for a Business or Commercial Purpose? |
Categories of Third Parties to Whom the Information was Disclosed |
Sold or Shared? |
Categories of Third Parties to Whom the Information was Sold or Shared |
Purpose(s) for Selling or Sharing |
|
Personal information that reveals social security, driver’s license, state identification card, or passport number |
Yes |
|
No |
N/A |
N/A |
|
Personal information that reveals account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account |
Yes |
No |
N/A |
N/A |
Sources of Personal Information:
We collect the categories of Personal Information, including Sensitive Personal Information, listed above from the following categories of sources:
- directly from you – such as by telephone, mail, email or through the Site, including but not limited to the chat function;
- indirectly from you. For example, from observing your interactions with the Site and our services;
- from third parties. For example, from service providers and business partners, including payment processing and data vendors;
- from publicly available sources, such as property records, court records or other government records;
- from our clients and their agents; and
- from our agents or attorneys.
Retention of Personal Information:
We will retain the Personal Information, including Sensitive Personal Information, listed above for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable laws or regulation.
Business Purposes for Collecting Personal Information:
We regularly use or disclose, and have previously used and disclosed, Personal Information, including Sensitive Personal Information, that we collect for one or more of our business or commercial purposes, including:
- to perform our obligations or exercise our rights under any contract entered into with, or assigned to, Credit Corp;
- to complete the transaction for which the Personal Information was collected;
- to correspond with you, such as through our chat function on the Site, to provide you with alerts and other notices, events or news updates or information about our products and/or services that we think may be of interest to you;
- to perform services on behalf of a business, such as servicing or collecting on accounts owed to that business, including processing payments or transactions and providing customer service;
- to review and respond to complaints that you raise in relation to our products or services or those of our customers;
- for quality assurance and compliance purposes;
- to provide you information that you request we provide, or that we are required to provide by law;
- to monitor, detect and prevent security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
- to debug our products, services or Site to identify and repair errors that impair existing intended functionality or improve, upgrade or enhance Credit Corp Services to you or our customers;
- to comply with any legal obligation;
- to respond to law enforcement requests as required by applicable law, court order or government regulation;
- to protect, as may be appropriate, our rights, property or safety, or that of our customers, employees or agents;
- as described to you at the time of collecting your Personal Information;
- to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets to be transferred or assigned;
- to contact you about products or services that we, or a related entity provides that might be of interest to you;
- to conduct audits related to our current interactions with you or our customers;
- to evaluate how you and other users interact with our Site, including to develop and carry out marketing activities in order to keep our customers informed about our products and services;
- to personalize your customer experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and advertisements delivered through our Site and/or through email;
- for analysis and Credit Corp Service development;
- to deliver location-based features on our Site;
- any other business purpose for which you provide consent.
Credit Corp shall not collect additional categories of Personal Information or use Personal Information collected for materially different, unrelated or incompatible purposes without first providing you with notice, including informing you of your right to opt out of the sale or sharing of your data.
- CALIFORNIA RESIDENTS
The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, (collectively, the “CPRA”) provides California residents with specific rights regarding their Personal Information.
This section describes how you can exercise those rights and our process for handling your requests.
Right to Know and Access Your Information
You have the right to request that we disclose certain information to you about our collection and use of your Personal Information. Specifically, you have the right to request the following:
- the categories of Personal Information that we collected about you;
- the categories of sources of that Personal Information;
- the specific pieces of Personal Information we have collected about you;
- our business or commercial purpose or purposes for collecting, selling or sharing that Personal Information;
- the categories of third parties with whom we disclose that Personal Information;
- the categories of Personal Information about you which we have sold or shared and the categories of third parties to whom the Personal Information was sold or shared, by category or categories of Personal Information for each category of third party recipients;
- the categories of Personal Information about you that we disclosed for a business purpose and the categories of persons to whom it was disclosed for a business purpose; and
- any financial incentive offered by us for the collection, sale or deletion of your Personal Information.
Right to Request Deletion of Personal Information
If you are a California resident, you have the right to request that Credit Corp delete all or a part of the Personal Information that we collected from you and hold in relation to you, subject to some exceptions.
Upon receipt of a deletion request under the CPRA, Credit Corp will review its records to determine whether we or our vendors or agents hold any applicable Personal Information about you, and whether such information is within the scope under the CPRA. We will notify you whether your requested information has been deleted.
We may not agree to delete your Personal Information if it is necessary for us or our service providers to maintain the information for any of the following purposes:
- to complete the transaction for which the Personal Information was collected, provide a good or service requested by you, or reasonably anticipated by the consumer within the context of our ongoing business relationship with you, or otherwise perform a contract between Credit Corp and you;
- to help ensure security and integrity to the extent the use of your Personal Information is reasonably necessary and proportionate for those purposes;
- to debug Credit Corp Service and to identify and repair errors that impair existing intended functionality;
- to exercise free speech, ensure the right of another customer to exercise that customer's right of free speech or exercise another right provided for by law;
- to comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.);
- to engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if you previously provided informed consent;
- to enable solely internal uses that are reasonably aligned with your expectations based on your relationship with Credit Corp and compatible with the context in which you provided the information; and
- to comply with a legal obligation.
If we do not agree to delete your Personal Information, we will advise you of the reasons why it has not been deleted and any rights of appeal that you may have. We will generally do this within 45 calendar days of your verifiable request.
If you have not provided sufficient information for us to verify your identity, however we have been able to reasonably identify you, we will treat your request to delete your Personal Information as a request to opt-out of the sale or sharing of your Personal Information.
Right to Opt-Out of the Sale or Sharing of Personal Information
Credit Corp does not currently sell Personal Information for monetary consideration. However, the collection of data through certain third-party cookies for analytics and targeting advertising purposes may be considered a “sale” and is considered “sharing” under the CPRA. While we do not sell your Personal Information for monetary consideration, we do use third party cookies for analytics and targeted advertising purposes. For example, we use Google Analytics to collect information about your usage of the Site.
You may prevent your data from being collected and used by Google Analytics by opting out through the Google Analytics Opt-out Browser Add-on. To opt-out of having your information sold and shared with third-party website analytics and digital advertising service providers for this purpose, visit our “Do Not Sell or Share My Personal Information” web page.
Credit Corp does not have actual knowledge that it sells or shares Personal Information about minors under the age of eighteen (18).
Right to Correct Inaccurate Personal Information
You have the right to request that we correct inaccurate Personal Information about you, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information.Limiting the Use and Disclosure of Sensitive Personal Information Request Rights
You have the right to direct us to limit our use of your Sensitive Personal Information (1) to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services; (2) for certain business purposes; and (3) as authorized by the implementing regulations of the CPRA . We do not use or disclose your Sensitive Personal Information for purposes other than the aforementioned purposes .
Financial Incentives
Credit Corp does not offer any incentives, including payment, to customers as compensation for the collection of Personal Information, the sale of Personal Information or the deletion of Personal Information.
Non-Discrimination
California residents have the right to be free from discrimination based on their exercise for their rights pursuant to the CPRA. Credit Corp will not discriminate against you for exercising your rights under the CPRA, including by charging, or suggesting that it may charge, you a different price or provide, or suggest that it may provide, different quality of goods or services due to you exercising, having exercised or intending to exercise your rights under the CPRA.
Authorized Agents
A California resident may appoint an individual or company to act as your authorized agent to exercise any of their rights under the CPRA. For us to be able to interact with this authorized agent, we will require the appropriate authority, as detailed in this Notice. In addition to the providing the appropriate authority, your agent will need to verify your identity as outlined in this Notice.
Contact and More information
For more information about this Notice, you may contact us directly at the information provided below.
If you are a California resident, you may exercise your rights to request access, data portability, deletion, opt-out, and correction of Personal Information, or to request a limitation on the use and/or disclosure of your Sensitive Personal Information under the CPRA by:
- By Website: https://www.creditcorponline.com/
- Emailing us at: customercare@creditcorponline.com;
- Calling us toll free on: 1-800- 483 2361; or
- Writing to us at: Credit Corp Solutions Inc;
Customer Care Department
2nd floor 121 S Election Rd, Draper, UT 84020
Your verifiable request must describe your request with sufficient detail to allow us to properly understand, evaluate and respond to it.
To meet our obligations to protect your privacy, we will need to verify your identity before complying with your requests to know and access, delete and correct Personal Information. The information we ask you to provide to initiate a request may differ depending upon the type of request, the type, sensitivity and value of the Personal Information that is the subject of the request, and the risk of harm to you that may occur as a result of unauthorized access or deletion, among other factors. We reserve the right to deny your request if we cannot verify your identity or as permitted under the CPRA. Where we deny your request in whole or in part, we will endeavor to inform you of the denial and provide an explanation of our actions and the reasons for the denial.
Only you or your authorized agent may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. If you are a third party making a request on behalf of a California resident, you will be required to provide sufficient authority, executed by the individual to whom the request relates unless we already hold an effective authority on our files.
Credit Corp will not use the information that you provide when making a request under the CPRA for any other purpose, other than confirming your identity and processing and responding to your CPRA request. However, we may be required to provide this if compelled by law.
Response Timing
Credit Corp will generally respond to a verifiable consumer request within forty-five (45) calendar days of receipt. If we require additional time to respond to your verifiable consumer request or if we are unable to comply with your request, we will inform you in writing as to the reason and the duration of the extension period (up to ninety (90) days).
- COLORADO, CONNECTICUT, VIRGINIA AND UTAH RESIDENTS
Colorado, Connecticut, Virginia and Utah have comprehensive privacy laws that are similar to the CPRA and provide state residents with certain privacy rights. However, these state laws exempt financial institutions governed by the GLBA. As Credit Corp is considered a financial institution under the GLBA, we are exempt from the comprehensive privacy laws of Colorado, Connecticut, Virginia and Utah.
- NEVADA RESIDENTS
Under Nevada law, Credit Corp does not sell your Personal Information. However, if you are a Nevada resident, you may submit a request that we not sell any Personal Information we have collected about you by emailing us at: customercare@creditcorponline.com.
- Changes to this Notice
We may update this Notice from time to time. Where we do this, we will publish the updated version on our webpage and provide any notice that may be required by applicable law. If the Notice is substantively or materially changed, such as where Credit Corp’s privacy practices change in such a manner that impacts residents of the states mentioned in this Notice, we will provide you with notice of such changes.