US States Privacy Notice

US States Privacy Notice

This US States Privacy Notice (“State Notice”) supplements the information in our Privacy

Policy and applies to California, Colorado, Connecticut, Virginia and Utah residents

(“Consumer” or “you”) and California resident job applicants, employees, contractors, or former employees (“Employee or you”) as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”); Colorado Privacy Act

(“CPA”); Texas Data Privacy and Security Act (“TDPSA”); and the Utah Consumer Privacy Act (“UCPA”). All together these statutes are referred to as “State Privacy Laws”

State privacy laws require a business that collects Consumer’s Personal Information (defined below) to inform you of the categories of Personal Information to be collected and the purposes for which the categories of Personal Information shall be used.

Subject to limitations provided in this State Notice, California, Colorado, Texas and Utah consumers have additional privacy rights. California CCPA also extends these rights to employees who are California residents.

Other laws may govern data we gather about you or that you provide to us including, but not limited to:

• Information to or from a consumer reporting agency if that information is to be reported in, or used to generate, a consumer report as defined by subdivision (d) of Section 1681a of Title 15 of the United States Code, and use of that information is limited by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)

• Information collected, processed, sold, or disclosed pursuant to the federal Gramm– Leach–Bliley Act (Public Law 106–102) and implementing regulations, information processing if conducted by a Gramm–Leach–Bliley Act Institution, or the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code).

Limitations and Exemptions

California consumer Personal Information collected in relation to a mortgage loan is exempt from the CCPA consumer rights because this information is governed by the Gramm-Leach- Bliley Act, the Fair Credit Reporting Act, the California Financial Information Privacy Act or other state and federal laws which exempt this data.

Colorado, Texas and Utah consumer Personal Information, including but not limited to data collected in relation to a loan, is exempt from the consumer rights under CPA, TDPSA, and UCPA, when collected by financial institutions subject to the Gramm-Leach-Bliley Act.

Shine the Light Law

We do not disclose personal information obtained through the Services to third parties for their direct marketing purposes. Accordingly, we have no obligations under California Civil Code § 1798.83.

Information We Collect

Universal Lending Corporation (“Company” or “we”) collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“Personal Information”).

Consumer Personal Information

Consumer Personal Information collected pursuant to this State Notice is collected for a

Business Purpose (see below) and may be shared with service providers if necessary to perform a Business Purpose. We may have collected the following categories of Personal Information from consumers within the last 12 months:

Category	Examples	Does the Company collect this Category of Information?	Categories of Sources from which the Information was Collected	Business Purpose	Categories of third parties with whom the business shares this information
A. Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES	Consumer Directly, Lead Providers	Mortgage loan origination and related services*	Website hosting providers; payment processors; order fulfillment providers; government authorities, and See below***
B. Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), and personal Information as defined in CPA, TDPSA, and UCPA.	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, any other financial information, or medical information. Some Personal Information included in this category may overlap with other categories.	YES	Consumer Directly, Lead Providers	Mortgage loan origination and related services* Security, maintaining product and site quality or to enhance services**	Website hosting providers; payment processors; order fulfillment providers; government authorities, and See below***
C. Protected classification characteristics under State or federal law	Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, veteran or military status, genetic information.	YES	Consumer Directly, Lead Providers	Mortgage loan origination and related services*	Affiliates; notaries and auditors; investors; government authorities
D. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES	Consumer Directly, Government Entities, Lead Providers	Mortgage loan origination and related services*	See below***
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, gait, or other physical patterns, and sleep, health, or exercise data.	NO	N/A	N/A	N/A
F. Internet or other similar network activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES	Consumer Directly, Lead Providers	Mortgage loan origination and related services* Security, maintaining product and site quality or to enhance services**	Affiliates; data aggregators (Google Analytics; Facebook); marketing systems, investors
G. Geolocation data	If you interact with us online we may gain access to the approximate, and sometimes precise, location of the device or equipment you are using.	YES	Consumer Directly, Lead Providers	Mortgage loan origination and related services* Security, maintaining product and site quality or to enhance services**	Affiliates; data aggregators (Google Analytics; Facebook); marketing systems, investors
H. Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	NO	N/A	N/A	N/A
I. Professional or employment-related information	Current or past job history or performance evaluations.	YES	Consumer Directly, Government Entities, Lead Providers	Mortgage loan origination and related services*	See below***
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	YES	Consumer Directly, Government Entities, Lead Providers	Mortgage loan origination and related services*	Affiliates; payment processors; order fulfillment providers; customer service providers; notaries and auditors; investors; government authorities
Nonpublic personal information described in Gramm-Leach-Bliley Act (GLBA) as personally identifiable information (i) provided by a consumer to a financial institution, (ii) resulting from a transaction or any service performed for the consumer, or (iii) otherwise obtained by the financial institution.	Examples include bank or asset account numbers, tax returns, income documents, credit reports, underwriting findings, fraud detection reports	YES	Consumer Directly, Government Entities, Lead Providers	Mortgage loan origination and related services*	Affiliates; payment processors; order fulfillment providers; customer service providers; notaries and auditors; investors; government authorities
K. Inferences drawn from other Personal Information	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO	N/A	N/A	N/A
L. Sensitive Personal Information	Personal Information that reveals a consumer’s social security, driver’s license, state identification card, or passport number. A consumer’s account log-in, financial account, debit card, or credit card in combination with any required security or access code, password, or credentials allowing access to an account. A consumer’s precise geolocation, racial or ethnic origin, religious or philosophical beliefs, or union membership. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. A consumer’s genetic data. The processing of biometric information for the purpose of uniquely identifying a consumer.	YES	Consumer Directly, Lead Providers	Mortgage loan origination and related services* Security, maintaining product and site quality or to enhance services**	Affiliates; payment processors; order fulfillment providers; customer service providers; notaries and auditors; investors; government authorities

 

* Related services may include, but are not limited to real estate services, insurance, escrow and other closing services, notary, appraisal, other consumer credit services, home warranty, and other services related to home purchase, home ownership, or related consumer transactions.

** Certain information may also be used to prevent, detect or investigate security events or fraud, for short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the Company, to verify or maintain the quality or safety of a product, service, or device that is owned, or controlled by the Company, and to improve, upgrade, or enhance the service or device that is owned, or controlled by the Company, for purposes that do not infer characteristics about the consumer.

*** While we do not sell your data, we may share that data with our Affiliates (as defined in our Privacy Notice), joint marketing partners and third parties assisting with the fulfillment of your loan, real estate, or other transaction on our behalf; such partners and third parties include credit card companies, financial services providers, realtors, builders and other residential real estate companies, home-related product or service providers, title companies, appraisers, insurance companies, customer service providers, notaries, auditors, underwriting services, printing companies, software providers, investors, and purchasers of our loans. This sharing is done pursuant to federal law and is exempt from the State requirements.

We do not disclose or use sensitive personal data for any other purposes than provided above.

California Employees

Employee Personal Information collected pursuant to this State Notice is collected for a

Business Purpose and may be shared with service providers if necessary to perform a Business Purpose (see below). We may have collected the following categories of Personal Information from consumers within the last 12 months:

Category	Examples	Does the Company collect this Category of Information?	Categories of Sources from which the Information was Collected	Business Purpose	Categories of third parties with whom the business shares this information
A. Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES	Job applicants or employees directly, our websites, and or using web technologies, third parties, service providers, credit reporting agencies or government agencies.	Job application or employment related activities*	See below**
B. Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, any other financial information, or medical information. Some Personal Information included in this category may overlap with other categories.	YES	Job applicants or employees directly, our websites, and or using web technologies, third parties, service providers, credit reporting agencies or government agencies.	Job application or employment related activities* Security, Access, and maintaining site quality***	See below**
C. Protected classification characteristics under California or federal law	Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, veteran or military status, genetic information.	YES	Job applicants or employees directly, our websites, and or using web technologies, third parties, service providers, credit reporting agencies or government agencies.	Job application or employment related activities*	See below**
D. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO	N/A	N/A	N/A
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, gait, or other physical patterns, and sleep, health, or exercise data.	YES	Job Applicants or Employees Directly	Job application or employment related activities*	See below**
F. Internet or other similar network activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES	Job applicants or employees directly, our websites, and or using web technologies	Security, Access, and maintaining site quality***	See below**
G. Geolocation data	Physical location or movements.	NO	N/A	N/A	N/A
H. Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	YES	Job Applicants or Employees Directly	Job application or employment related activities*	See below**
I. Professional or employment-related information	Current or past job history or performance evaluations.	YES	Job applicants or employees directly, our websites, third parties, service providers	Job application or employment related activities*	See below**
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	YES	Job applicants or employees directly, our websites, third parties, service providers, educational institutions.	Job application or employment related activities*	See below**
K. Inferences drawn from other Personal Information	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES	Job applicants or employees directly, our websites, third parties, service providers	Job application or employment related activities*	See below**
L. Sensitive Personal Information	Personal Information that reveals a consumer’s social security, driver’s license, state identification card, or passport number. A consumer’s account log-in, financial account, debit card, or credit card in combination with any required security or access code, password, or credentials allowing access to an account. A consumer’s precise geolocation, racial or ethnic origin, religious or philosophical beliefs, or union membership. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. A consumer’s genetic data. The processing of biometric information for the purpose of uniquely identifying a consumer.	YES	Job applicants or employees directly, our websites, and or using web technologies, third parties, service providers, credit reporting agencies or government agencies.	Job application or employment related activities*	See below**

* Related services may include job application processing, hiring and background screening, human resource-related administrative functions, benefits (including administration of benefits involving dependents and beneficiaries), employee career management, company correspondence and/or gifts, emergency response and contact information, employee relations, employment authorization, Equal Employment Opportunity Commission requirements, equity awards, expense reimbursement, Federal and State leave requirements, fulfillment of specific role based responsibilities, leaves of absence, call recording monitoring for training and quality, obtaining e-signatures, payroll access to ULC networks, applications and company information assets, performance reviews, pre-employment assessment, regulatory compliance, security and building access, special accommodations, state licensing requirements, tax purposes, training and education, work equipment distribution, and workplace monitoring.

** While we do not sell your data, we may share that data with affiliates, professional service providers, regulators and legal authorities and agencies. We also do not disclose or use personal data for any other purposes than provided above.

*** Certain information may also be used to prevent, detect or investigate security events or fraud, for short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the company, to verify or maintain the quality or safety of a product, service, or device that is owned, or controlled by the company, and to improve, upgrade, or enhance the service or device that is owned, or controlled by the company, for purposes that do not infer characteristics about the consumer

State Privacy Rights

Subject to the limitations provided in this State Notice, below is a summary of additional rights provided to consumers and/or job applicants, employees, and former employees under various state laws. This summary may not constitute your entire set of privacy rights. To be certain of your privacy rights, you may wish to contact the appropriate agency in your state that is charged with overseeing privacy rights of consumers, job applicants, employees, or former employees.

Data Subject Right	Data Subjects	States
Right to Know About Personal Information Collected, Disclosed, or Sold. You have the right to request that a business disclose what Personal Information it collects, uses, discloses, and sells.	Consumers, Job Applicants, Employees, Former Employees	CA, CO, UT, CA
Right to Access Personal Information. You have the right to request access to the Personal Information it has collected about you in the previous 12 months.	Consumers Job Applicants, Employees, Former Employees	CA, CO, UT, TX, CA
Right to Correct Personal Information You have the right to request correction of inaccurate Personal Information.	Consumers, Job Applicants, Employees, Former Employees	CA, CO, CA
Right to Request Deletion of Personal Information. You may have the right to request the deletion of your Personal Information collected or maintained by the Company.	Consumers Job Applicants, Employees, Former Employees	CA, CO, UT, CA
Right to Opt-Out of the Sharing or Sale of Personal Information. You may have the right to opt-out of the sharing or sale of their Personal Information by a business. Note that the Company does not, and will not, sell your Personal Information.	Consumers Job Applicants, Employees, Former Employees	CA, CO, UT, TX, CA
Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights. You have the right not to receive discriminatory treatment by the Company for the exercise of the privacy rights conferred by State privacy laws.	Consumers, Job Applicants, Employees, Former Employees	CA, CO, UT, TX, CA
Right to limit Processing of Sensitive personal Information. You have the right to limit our processing of your Sensitive Personal Information to only uses that are necessary to provide or perform the services that you request. The Sensitive Personal Information that we collect is only used to provide or perform the services for which the information is necessary and that would be reasonably expected by you. For Texas and Utah residents, your right to be notified about the processing of sensitive data or right to consent to use or disclose such data and opt out is limited by Information collected, processed, sold, or disclosed pursuant to the federal Gramm–Leach–Bliley Act (Public Law 106–102).	Consumers, Job Applicants, Employees, Former Employees	CA, UT, TX, CA
Right to Appeal Decisions. You may have the right to appeal the denial of a request or the right to be informed of the reasons for the Company not taking action. In Texas, if your request is denied on appeal, you have the right to pursue recourse with the Texas Attorney General’s Office here.	Consumers, Employees	CO, CA, UT, TX
Opt-Out of Profiling. Texas residents have the right to opt out of the processing of the personal data for the purpose of profiling in furtherance of a decision that produces a legal or similarly significant effect. Under TDPSA, “Profiling” means automated decision-making that uses your personal information to analyze or predict your economic situation, health, personal preferences, and other behaviors. If a situation arises in which ULC expects to use profiling in a way that would have a legal or other significant effect, an opportunity to opt-out will be provided in advance.	Consumers	TX

 

Instructions for Submitting a Verifiable Consumer Request

Opt-out for non-cookie PI: If you want to limit our Processing of your non-cookie PI (e.g., your email address) for Targeted Advertising, or opt-out of the Sale/Sharing of such data, make an opt-out request through our web form here.

Opt-out for cookie PI: If you want to limit our Processing of your cookie-related PI for Targeted Advertising, or opt-out of the Sale/Sharing of such PI, you need to exercise a separate opt-out request on our cookie management tool here. This is because we have to use different technologies to apply your opt-out of cookie PI and to non-cookie PI. You can also access our cookie management tool by clicking on the “Your Privacy Choices” link on the footer of our website. Our cookie management tool enables you to exercise such an opt-out request and enable certain cookie preferences on your device. You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device that you use.  Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our cookie management tool.  Beware that if you use ad blocking software, our site footer “Your Privacy Choices” links may not appear when you visit our services and you may have to use the link above to access the tool.  

Opt-out preference signals (also known as global privacy control or GPC): Some of the U.S. Privacy Laws require businesses to process GPC signals, which is referred to in California as opt-out preference signals (“OOPS”), which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the Sale and Sharing of personal information. To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC.  We have configured the settings of our consent management platform to receive and process GPC signals on our website, which is explained by our consent management platform here. We process OOPS/GPC with respect to Sales and Sharing that may occur in the context of Collection of cookie PI by tracking technologies online by Third-Party Digital Businesses, discussed above, and apply it to the specific browser on which you enable OOPS/GPC. We currently do not, due to technical limitations, process OOPS/GPC for opt-outs of Sales and Sharing in other contexts (e.g., noncookie PI).  We do not: (1) charge a fee for use of our service if you have enabled OOPS/GPC; (2) change your experience with any product or service if you use OOPS/GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the

OOPS/GPC.

Our Process for Verifying a Request

After submitting a request, we will verify your identity by matching the identifying information provided by you to the Personal Information already maintained by us, or, in cases where your request requires a higher degree of certainty, we may use a third-party identity verification service or ask for a photo ID or for more information. 

If we determine that your request is subject to an exemption or exception, we will notify you of our determination. If we determine that your request is not subject to an exemption or exception, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request.

We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized disclosure, deletion, or correction as applicable. To do so, we will ask you to verify data points based on information we have in our records concerning you.

Authorized Agents

You may use an authorized agent to submit a request to know or a request to delete under applicable law. If you use an authorized agent to submit a request to know or a request to delete, you must provide the Company with written permission from you giving the authorized agent permission to submit the request on your behalf, and you may be required to verify the authorized agent’s identity with the Company. The Company may deny a request from an agent that does not submit proof that they have been authorized by the consumer to act on their behalf.

Additional Information

For more information about our general privacy policy, click here  

Date this State Notice was last updated: September 13, 2024.