California Consumer Privacy Notice

Categories of Sources of Personal Information

In the past 12 months, we may have collected personal information of California residents from the following sources:

• Directly from you
• Affiliates
• Business partners
• Service providers
• Consumer data resellers
• Third parties that you have authorized or directed to share information with us
• Government entities from which public records are obtained

Purposes for Using Personal Information

Most of the information we use is in the context of providing financial products and services and is therefore not subject to the CCPA. The purposes for which we collect and use Personal Information depend on, among other things, our relationship or interaction with a member. We may use personal information relating to California residents for one or more of the following business purposes:

• Providing and maintaining our products and services
• Servicing our members
• Verifying your identity
• Detecting and preventing fraud
• Protecting against security risks
• Advertising and marketing
• Conducting research and data analysis
• Maintaining our facilities, systems, and infrastructure
• Improving our products and services
• Carrying out our legal and business purposes, such as complying with federal, state, or local laws, responding to civil, criminal, or regulatory lawsuits or investigations, exercising our rights or defending against legal claims, resolving complaints and disputes, performing compliance activities, performing institutional risk control, and otherwise operating, managing, and maintaining our business
• As otherwise disclosed to you at or before the point of collecting your personal information

We may also use personal information relating to California residents for one or more of the specific “business purposes” listed in the CCPA:

• Certain auditing and measurement purposes, such as counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with applicable standards
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
• Debugging to identify and repair errors that impair existing intended functionality
• Short-term, transient use
• Performing services on behalf of Frontwave or its service providers, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of Frontwave or its service providers
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service that is owned or controlled by Frontwave, and to improve, upgrade, or enhance the service that is owned or controlled by Frontwave.

Sources of Personal Information

The sources from which we collect Personal Information depend on, among other things, our relationship or interaction with California residents. The information below lists the categories of sources from which we collect Personal Information in different contexts.

• From California residents directly, or other individuals acting on their behalf, through physical (e.g., paper application), audible (e.g., phone), or electronic (e.g., website, social media) sources.
• Public records or widely available sources, including information from the media, and other records and information that are made available by federal, state, or local government entities.
• Outside companies or organizations that provide data to support activities such as fraud prevention, underwriting, and marketing.
• Outside companies or organizations from whom we collect Personal Information to support human resource and workforce management activities.
• Outside companies or organizations from whom we collect personal data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples include companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.

Categories of Third Parties with Whom We Share Personal Information

The categories of third parties with whom we share Personal Information depend on, among other things, our relationship or interaction with each individual. The information below lists the categories of third parties with whom we share Personal Information in different contexts.

• Outside companies or organizations with whom we share Personal Information as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples include companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.
• Companies or individuals that represent California residents such as an accountant, financial advisor, or holding power of attorney.
• Government agencies including to support regulatory and legal requirements.
• Outside companies or organizations, including service providers, to whom we provide Personal Information to support human resource activities and workforce management.
• Outside companies or organizations, in connection with routine or required reporting, including consumer reporting agencies and other parties.

Rights Under the CCPA

If you are a California resident, you may request that we disclose to you the following information covering the twelve (12) months preceding your request:

• The categories of personal information described above that we have collected about you and the categories of sources from which we collected such personal information
• The business or commercial purposes for collecting such personal information
• The categories of personal information about you that we have disclosed to third parties for a business purpose and the categories of third parties to whom we have disclosed such personal information
• The specific pieces (e.g., copies) of personal information we have collected about you

California residents also have the right to submit a request for deletion of personal information under certain circumstances, although there may be legal or other reasons that Frontwave will retain your information.

In some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. In other instances, we may decline to honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer or where the personal information that we maintain about you is not subject to the CCPA. Nonetheless, you have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

Responding to Requests

Privacy and data protection laws, other than the CCPA, apply to much of the Personal Information that we collect, use, and disclose. When these laws apply, Personal Information may be exempt from, or outside the scope of, Access Requests and Deletion Requests. As a result, in some instances, we may decline all or part of an Access Request or Deletion Request related to this Personal Information. This means that we may not provide some or all of this Personal Information when you make an Access Request. Also, we may not delete some or all of this Personal Information when you make a Deletion Request.

As examples, our processing of or response to an Access Request or Deletion Request may not include some or all of the following Personal Information:

• Consumer Accounts. Personal Information connected with consumer accounts used for personal, family, or household purposes. We have other privacy notices describing use and sharing of this data, for example, the Federal Privacy Notice, available at frontwavecu.com/privacy-policy.
• Employment. Personal Information about an individual who is a current or former employee or job applicant, and we use that Personal Information within the context of that individual’s role as a current or former employee or job applicant.
• Business-to-Business Relationships. Certain Personal Information we collect in the course of providing a product or service to another business, or in the course of receiving a product or service from another business.

The types of Personal Information described above are examples. We have not listed all types of Personal Information that may not be included when we respond to or process Access Requests or Deletion Requests..

In addition to the above examples, we may not include Personal Information when we respond to or process Access Requests or Deletion Requests when the CCPA recognizes another exception. For example, we will not provide the Personal Information about another individual where doing so would adversely affect the data privacy rights of that individual. As another example, we will not delete Personal Information when it is necessary to maintain that Personal Information to comply with a legal obligation.

How to Make Requests

If you are a California resident and you would like to make an Access Request or a Deletion Request, download and follow the instructions on this form.

Changes to This California Consumer Privacy Act Disclosure

We may change or update this CCPA Disclosure in the future. When we do, we will post the revised CCPA Disclosure on this website. This CCPA Disclosure was last updated and became effective on the date posted at the top of this page.