FOR CALIFORNIA RESIDENTS ONLY

Effective January 1, 2023

Your Rights and Choices

The California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (collectively “CPRA”) provides consumers residing in California (“California Consumers” or “you”) with specific rights regarding their personal information. This Notice supplements the Mutual of Omaha Mortgage Online Privacy Policy (“Policy”) and applies solely to California Consumers. This Notice describes the practices of Mutual of Omaha Mortgage, Inc. and its subsidiaries and affiliates that link to the Policy (“Mutual Mortgage,” “we,” “us,” or “our”) regarding the collection, use, disclosure, sale, sharing, and retention of personal information we will collect from you and have collected from California Consumers in the past twelve (12) months. This Notice also explains your rights regarding your personal information and how you can exercise those rights.

Scope of This Notice

As part of running our business, we collect personal information from various types of California Consumers. We do not collect, sell, share, or disclose the personal information of any covered California Consumers under the age of 16.  In this Notice, personal information has the meaning described below and excludes certain information subject to other laws.

Personal Information is defined for purposes of this Notice and the CPRA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you as an individual or your household. Personal information includes, for example, information collected directly from you if you use certain services available on our sites or personal information that you voluntarily provide, such as information you provide in response to a questionnaire or survey, if you apply for a job on our Careers sites, or to do business with us. We may also collect or receive personal information about you through or from our business partners, service providers, marketing partners, and other third parties that perform services for us or for you, or to market our products and services to you. Please see the “Personal Information We Collect, Use, and Disclose” section of this Notice to learn more about how we may collect your personal information.

Under the CPRA, and for the unique consumer rights described below, personal information does not include:

• Publicly available information, such as information from government records, information we reasonably believe you made available to the general public or have not restricted to a specific audience;
• De-identified or aggregated consumer information we maintain in deidentified form and do not attempt to reidentify except as required or permitted by law;
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); and
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act (“GLBA”), the California Financial Information Privacy Act (“FIPA”), and the Driver’s Privacy Protection Act of 1994.

We separately provide notices pursuant to other state and federal laws, such as FCRA, GLBA, FIPA, and other applicable state specific financial privacy laws in connection with financial products and services subject to those laws.

Personal Information We Collect, Use, and Disclose

We collect personal information from various types of California Consumers, including persons who may receive information about products or services; brokers and other business partners; and representatives of other businesses we work with. The type of information we may collect, the sources of that information, our purposes for collecting, using, and disclosing that information, and other factors vary depending on the type of California Consumer you are. We do not knowingly collect, sell, share, or disclose the personal information of any covered California Consumers under the age of 16.

Business Purposes for Collecting, Using, and/or Disclosing Personal Information

We may collect, use, and/or disclose, and in the past 12 months we have collected, used, and/or disclosed, personal information for various business purposes. These purposes may include those described in the Policy as well as the following:

Mortgage Services. We use personal information to offer our mortgage services, including:

1. Establishing, maintaining, supporting, and servicing loans originated, applied for, or established with us;
2. Providing services, products, or information you may have requested from us; and
3. Performing services such as maintaining or servicing mortgages, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, or providing similar services on our own behalf or on the service provider’s

Security And Fraud Detection. We use personal information for our security and fraud detection services including: detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity.

Debugging. We use personal information to engage in debugging to identify and repair errors that impair existing intended functionality.

Improvement Of Products And Services. We use personal information to verify, maintain, and improve our products and services.

Internal Research. We use personal information for our internal research related to technological development and demonstration.

Advertising And Marketing Services. Generally speaking, we collect, use, and/or disclose personal information for the following business purposes:

Marketing To You.  For example, this may include determining what products and services you may be interested in; marketing products and services to you; providing mortgage product information; screening for mortgage product eligibility and qualification; and audio and electronic information, such as call recordings for marketing.

Enhancing Your Experience With Us On Our Website.  For example, this may include identifying website visits, ad interaction, and search history; recommending mortgage products based on preferences; delivering jurisdiction-specific website content; tailoring your experience on our website; and drawing inferences from personal information to tailor your experience on our website and identify the products you might be interested in.

Marketing Enhancement. For example, this may include conducting data analytics; reporting lead conversions; optimizing online searching, and identifying consumer mortgage product interest.

Legal Obligations. We use personal information to comply with legal and compliance obligations.

Audits. We use personal information to audit current interactions with you and related transactions (e.g., counting and verifying ad impressions, auditing compliance).

Commercial And Economic Interests. We use personal information to advance our commercial or economic interest, including but not limited to onboarding, maintaining, and offboarding investors, brokers, and vendors and supporting broker and vendor customer service, marketing, and other business purposes.

Recruiting And Hiring. We may use your personal information to conduct background checks, verify education and employment history, and other similar activities in connection with recruiting and/or hiring you as an employee or contractor.

Merger, Acquisition, And/Or Bankruptcy. We may use your personal information as part of a merger, acquisition, bankruptcy, or other transaction where a third party assumes control of us.

Who We May Collect Your Personal Information From or Disclose It To For a Business or Commercial Purpose

We may collect your personal information from or disclose it to, and in the preceding 12 months we have collected your personal information from or disclosed it to:

• Security And Fraud Detection Providers
• Web And Data Analytics Service Providers
• Internet Service Providers
• Social Network Providers
• Financial And Payment Technology Providers
• Consumer Reporting Agencies
• Background Check Companies
• Identity Verification Service Providers
• Asset Verification Service Providers
• Government Entities
• Landlords/Utility Companies
• Operating Systems And Platforms Providers
• Service Providers (I.E., Companies Who Are Assisting Us In Fulfilling Our Contracts And Carrying Out Our Business)

Categories of Personal Information We Collect, Use, and/or Disclose for a Business or Commercial Purpose

Selling or Sharing Your Personal Information for a Business or Commercial Purpose

Mutual Mortgage does not sell your personal information for money – no one can buy the personal information we or those acting on our behalf collect from and about you and we do not act as a data broker. However, we may use and disclose, and in the preceding 12 months we used and disclosed, certain personal information in order to market products and services and provide mortgage information to potential new customers. Even though they involve no exchange of money, these disclosures may constitute selling for purposes of the CPRA. We may make these disclosures of certain personal information as permitted by law to digital marketing companies, analytics providers, content and customer relationship management system providers, call centers, automated marketers, and mortgage comparison providers. Personal information we provide these third parties may include names, telephone numbers, addresses, email addresses, IP addresses, online identifiers, and commercial information such as products considered. 

We may share, and in the preceding 12 months we have shared, certain personal information to third parties for targeted marketing as permitted by law, such as names, telephone numbers, addresses, email addresses, IP addresses, online identifiers, and commercial information such as products considered to digital marketing companies and analytics providers.

Click here to learn about and exercise your right to opt-out of selling and sharing of your personal information.

Retention of Personal Information

We will retain your personal information that we handle subject to this Notice as long as is reasonably necessary to fulfill the purposes for which it was collected. In doing so, we will consider the type of products and services requested by or provided to you, the nature and length of our relationship with you or the business entity you are associated with, and mandatory retention periods under applicable law. We will also retain your information, including after your relationship with us ends, as long as necessary to enforce or comply with our legal or contractual rights and obligations, to resolve disputes and defend claims, and to reserve our legal rights.

Your Privacy Choices

Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

Right to Know

You may have the right to request that we disclose certain information to you about our collection and use of your personal information (and direct our service providers and contractors to do the same), including:

• The categories of personal information collected;
• The categories of sources of the personal information collected;
• Our purposes for collecting, sharing, or selling your personal information;
• The categories of personal information disclosed for a business purpose, if any, and the categories of persons to whom the categories of personal information was disclosed.
• The specific pieces of personal information we collected about you;
• The categories of personal information we shared for targeted marketing purposes, if any, and the categories of third parties to whom the personal information was disclosed for that purpose; and
• The categories of personal information we sold, if any, and the categories of third parties to whom the personal information was sold.

Right to Delete

You may have the right to request that we delete any of your personal information collected from you and retained by us (and direct our service providers, contractors, and third parties to do the same).

We may deny your deletion request if retaining the personal information is reasonably necessary for us (or our service provider(s), contractor(s), or third parties) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• Help ensure security and integrity of your personal information;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
• Debug products to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code 1546 et. seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deleting the personal information may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Comply with a legal obligation; and
• Make other internal and lawful uses of the personal information that are compatible with the context in which you provided it.

Other legal limitations and exceptions may also apply.

Right to Correct

You may have the right to request we correct inaccurate personal information that we maintain about you (and direct our service providers and contractors to do the same). Alternatively, we may delete the inaccurate personal information if doing so does not negatively impact you, or if you consent.

Opt-Out Rights

You may have the right to request we opt you out of selling and sharing your personal information (and direct our third parties and their business partners to do the same).

You may submit a request by clicking here and completing our California Consumer Rights Request form, by contacting us at the following toll-free number: 844-413-6884, or by enabling an opt-out preference signal in your device or browser.

An opt-out preference signal is a setting or extension in a browser or device that a web user sets to prevent the selling or sharing of personal information on sites the browser or device visits. You can use an opt-out signal by downloading a browser or browser extension and enabling the signal feature. To learn more, click here. We will process your signal as a request to opt information associated with your device, browser, and/or consumer profile out of selling and sharing with third parties.

We will consider only those requests submitted using these two options.

Exercising Your Rights

How to Submit a Request to Exercise Your Rights

To exercise any of the rights described above, you may submit a request either by clicking here and completing the linked California Consumer Rights Request form or by contacting us at the following toll-free number: 1-844-413-6884. Except requests to opt-out of selling and sharing, we will consider only those requests submitted using these two options. For a request to opt-out of selling and sharing, we will also recognize an opt-out preference signal enabled on your device or browser as described above in “Opt-Out Rights.”

Exercising Your Rights to Know, Delete, and Correct

Only you or your authorized agent may make a verifiable consumer request to know, delete, or correct your personal information. If you use an authorized agent to submit a verified consumer request on your behalf, you will be required to provide additional information as described below.

For verifiable requests to know: Our response will cover the preceding 12 months, unless you request longer (with certain limitations). You may make a verifiable consumer request to know only twice within a 12-month period.

In order to verify your identity to process your request, we will request your full name, street address, city, zip code, phone number, and email address. For us to treat your request as a verifiable consumer request, you must:

• Provide sufficient information, commensurate to the type or sensitivity of the information you are requesting, that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request in sufficient detail that allows us to properly understand, evaluate, and respond to

We cannot respond to your request or provide you with personal information if we are unable to: (a) verify your identity or authority to make the request, (b) confirm the personal information we have in our systems relates to you, or (c) locate your information in our systems. If the information you provided us does not match our records, in certain circumstances we may request additional information from you. If the information you provided us does match our records, your request is verifiable (a “verifiable consumer request”).

In certain circumstances, an authorized agent may submit a rights request for you. An authorized agent is a natural person or business entity you have given permission to submit a request on your behalf. An authorized agent must submit a request using one of two designated methods described above. We must be able to verify the authorized agent has the authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney; or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement by you authorizing the authorized agent to submit a verifiable consumer request on your behalf.   Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request to know, to delete, or to correct within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CPRA rights.

2022 Reporting Requirements Under the CCPA

The metrics below reflect, by type of request, the total number of consumer requests received, completed, and denied during the 2022 calendar year.

*This includes, but is not limited to, requests that were denied because we were unable to verify the identity of the requestor.

Changes to Our Privacy Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated Notice on the website and update the Notice’s effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.

The effective date of the rights for California residents described in this Notice is January 1, 2023. Changes to the Policy will not affect our use of previously provided personal information.

Contact Information

If you have any questions about this Notice, the ways in which we may collect and use your personal information described in this Notice, and your choices and rights regarding such use, please feel free to contact us as follows:

• Sending an e-mail request to: mmcompliance@mutualmortgage.com
• Sending a letter via US Mail to:

3131 Camino Del Rio N., Suite 1100. Mutual of Omaha Mortgage, Inc San Diego, CA 92108

Last Updated: August 4, 2023