California Consumer Privacy Act (CPPA) Policy

Last Updated and Effective Date: 10/01/2024

This California Consumer Privacy Act (CCPA) Notice (“Notice”) is provided by MIDFLORIDA Credit Union (MIDFLORIDA, “we” or “us”). This Notice explains how we collect, use, and disclose personal information about California residents. The Notice also explains certain rights that California residents have under the California Consumer Privacy Act.

For California residents, this Privacy Policy is adopted in accordance with the California Consumer Privacy Act of 2018 (“CCPA”), and the California Online Privacy Protection Act (“CalOPPA”), and any terms defined in the CCPA and CalOPPA have the same meaning when used in this Privacy Policy.

The specific Personal Information that we collect, use, and disclose relating to a California resident covered by the CCPA will vary based on our relationship or interaction with that individual. For example, this Disclosure does not apply with respect to information that we collect about California residents who apply for or obtain our financial products and services for personal, family, or household purposes (i.e., information subject to the Gramm-Leach-Bliley Act (“GLBA”)). For more information about how we collect, disclose, and secure information relating to these customers, please refer to our Online Privacy Policy.

Keeping Personal Information secure is one of our most important priorities. Consistent with our obligations under applicable laws and regulations, we maintain physical, technical, electronic, procedural, and organizational safeguards and security measures that are designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access, whether it is processed by us or elsewhere.

Collection and Disclosure of Personal Information

In the past 12 months, we have collected the following categories of Personal Information about California residents (please note that some categories overlap):

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers;
• Protected classification characteristics, such as sex and marital status;
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• Biometric information, such as fingerprints and voiceprints;
• Internet or network activity information, such as browsing history and interactions with our website, applications, and emails;
• Geolocation data, such as device location and Internet Protocol (IP) location;
• Sensory data, such as, audio, electronic, visual, and similar information, such as call and video recordings;
• Professional and employment-related information, such as work history and prior employer;
• Education information; and
• Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s preferences and characteristics.

We collected such Personal Information from the following sources:

• Directly from You or Your Authorized Agents;
• Service providers, consumer data resellers, and other third parties;
• Public record sources (federal, state, or local government sources);
• Affiliates;
• From our website /mobile app activity/social media; and
• Institutions from consumer-directed third parties or institutions representing a consumer/prospect.

We have disclosed some of the above categories of Personal Information for business purposes to the following third parties:

• Our affiliates and subsidiaries, including MIDFLORIDA Insurance Services, LLC, and Southeast Trust LLC.;
• Vendors and service providers that provide services to MIDFLORIDA such as payment processing, information technology and related infrastructure, fraud prevention and data security, customer service, and marketing activities;
• Other third parties authorized by our members to access their personal information, such as data aggregators, and those authorized to conduct transactions online and via mobile devices, and to support loan fulfillment services; and
• Government entities as required by laws and regulations.

Use of Personal Information

In the past 12 months, we have used Personal Information relating to California residents for one or more of the following business purposes:

• Performing services and offering products, including maintaining or servicing accounts, providing member service, and processing transactions;
• Engaging in advertising or marketing activities;
• Preventing, detecting, and responding to security incidents;
• Undertaking activities, including internal research and analysis, to derive consumer insights and to maintain or enhance the quality of our products and services;
• Maintaining the integrity and the functionality of our information technology systems; and
• Complying with legal requirements.

Sale of Personal Information

It is MIDFLORIDA’s policy not to sell Personal Information, and we have not done so in the past 12 months. Because MIDFLORIDA does not sell your Personal Information, we do not offer an opt-out under the CCPA.

Rights Under the CCPA

If you are a California resident, you have the:

1. Right to Know About Personal Information Collected, Disclosed, or Sold
You have the right to request that we disclose what Personal Information we collect, use, disclose, and sell. The categories of Personal Information collected in the preceding 12 months, sources from which the Personal Information is collected, and the business purpose for collection of Personal Information is discussed above in the Personal Information section.

2. Right to Request Deletion of Personal Information
You have the right to request the deletion of Personal Information that we collected from you, subject to applicable exceptions.

3. Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

Authorized Agents

You also have the right to designate an authorized agent to make a request under the CCPA on your behalf. If you wish to designate an authorized agent, MIDFLORIDA requires a valid power of attorney with express powers under the CCPA.

How to Make Requests

As a California resident, you or your authorized agent may make a request details about Personal Information collected and/or shared by calling 1-866-913-3733, sending a secure message through online banking, or completing a Request Form and sending via U.S. Mail at:  MIDFLORIDA Credit Union, PO Box 8008, Lakeland, FL  33802-8008.

Verification Process

Upon submission of your request, we will take steps to verify your identity. Those steps may vary, however, depending on your relationship with MIDFLORIDA and the intake method.

Responses

We will work to process all verified requests within 45 days. If we need an extension in order to process your request, we will reach out to you.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request.

Do Not Track (“DNT”) Signals

We do not employ tracking signals on our website and, therefore, we are not able to recognize DNT signals. If tracking mechanisms are utilized for future releases of our website, we will update this Privacy Policy to disclose how we respond to DNT signals.

Contact for More Information

For any questions or concerns regarding the CCPA or MIDFLORIDA’s CCPA request process, please call us at 1-866-913-3733.