California Consumer Privacy Notice
This California Consumer Privacy Notice (“CCPA Notice”) applies to residents of California to the extent that the California Consumer Privacy Act of 2018 (CCPA) applies to Navy Federal Credit Union.
The specific Personal Information that we collect, use, and disclose relating to a California resident in different contexts covered by the CCPA will vary based on our relationship or interaction with that individual. For example, this CCPA Notice does not apply with respect to information that we collect about California residents who apply for or obtain our financial products and services for personal, family, or household purposes (i.e., information subject to the Gramm-Leach-Bliley Act (“GLBA”)). For more information about how we collect, disclose, and secure information relating to these customers, please refer to our Consumer Privacy Policy. Personal Information that is subject to this CCPA Notice is referred to herein as “CCPA Personal Information”. We may use the information described below for any of the purposes described in this CCPA Notice or for our business, security, or operational purposes compatible with the context in which the Personal Information was collected, unless limitations are listed in this CCPA Notice or described elsewhere at the time of collection of the information.
Collection of CCPA Personal Information
The following table provides examples of the types of CCPA Personal Information we may collect about California residents in different contexts. In many cases, we may not collect all of the following information from each individual. Our collection of CCPA Personal Information depends on the circumstances of our interaction with you.
| Context of Collection of CCPA Personal Information | Types of CCPA Personal Information Collected | Primary Purpose for Collection and Use of CCPA Personal Information |
|---|---|---|
| Applicant and Business Contact Information | If you apply for a job with Navy Federal or otherwise communicate with us about a business opportunity, we may collect name, phone number, email address, and physical address. | We use this information to contact you and communicate with you about the business opportunity, about your application for employment, and/or to schedule interviews. |
| Application and Interview Information | If you apply for a job with Navy Federal or otherwise contact us about a business opportunity, we may collect information about your current role, education history, employment history, qualifications, certifications, and professional memberships. We may also collect information that you provide directly to us during conversations, during formal interviews, or in your application materials. | We use this information to evaluate your application for employment and determine if you are qualified for the role for which you have applied or for other roles in Navy Federal. |
| Background Information | If you apply for a job with Navy Federal or otherwise contact us about a business opportunity, we may collect information about you from references and background checks. | We use this information to verify your suitability for a role, and to ensure that you are qualified or equipped for the role for which you have applied. |
| Cookies and First-Party Tracking | We may use cookies and clear GIFs. “Cookies” are small pieces of information that a website sends to a computer’s hard drive while a website is viewed. See the How You Can Control Your Information section for more information. | We use this information to make our website operate efficiently. |
| Cookies and Third-Party Tracking | We may use tracking technology on our websites, mobile sites or apps that collects analytics, records how you interact with the website or apps, or allows us to participate in behavior-based advertising. This means that a third party uses technology (e.g., a cookie) to collect information about your use of our website so that they can report analytics to us or provide advertising about products and services tailored to your interests. That third party might also collect information over time and across different websites in order to serve advertisements on our website or other websites. See the How You Can Control Your Information section for more information. | We use this information to understand how users interact with our website and apps and to tailor advertisements about products and services to your interests. |
| Demographic Information | If you apply for a job with Navy Federal, we may collect information you provide voluntarily to us about your gender/gender identity, race, ethnicity, veteran status, national origin, citizenship, gender expression, sexual orientation, religion, disability, or accommodation requests. | We use this information to carry out our business diversity and inclusion strategy. In some cases, we may be required by law to collect this information. |
| Eligibility to Work | If you apply for a job with Navy Federal, we may collect information about your country of birth, immigration status, government identification documents (including drivers licenses, ID cards, passports, and residency permits), and, in some cases, your Social Security Number (or equivalent). | We use this information to determine if you are eligible to work if required by law to collect this information at the application stage. |
| Email Interconnectivity | If you receive email from us, we may use certain tools to capture data related to when you open our message, click on any links or banners it contains, and make purchases. | We use this information to understand how you interact with our communications to you. |
| Feedback/Support | If you provide us feedback or contact us for support we may collect your name and email address, as well as any other content that you send to us, in order to reply. | We use this information to communicate with you and act upon your feedback or issues. |
| Geolocation Information | When you use our apps and websites, we may collect your location from the GPS, Wi-Fi, and/or cellular technology in your device to determine your location and your distance from a branch. | We use this information to understand our users, to provide them tailored services, and for security reasons. |
| Mobile Devices | We may collect information from your mobile device such as unique identifying information broadcast from your device when visiting our website or apps. | We use this information to identify specific users and understand how users interact with us on their mobile devices. |
| Pre-Employment Test Results | If you apply for a job with Navy Federal, we may collect information about your results on any tests that are prerequisites for your employment with Navy Federal. | We use this information to evaluate your application for employment and determine if you are qualified or equipped for the role for which you have applied. |
| Social Media Information | Where permitted by law to do so, we may collect information from your social media presence (e.g., your LinkedIn profile) or when you message us through a social media platform. | We use this information to learn more about your qualifications for employment and to communicate with you as appropriate. |
| Website Interactions | We may use technology to monitor how you interact with our website. This may include which links you click on, or information that you type into our online forms. This may also include information about your device or browser. | We use this information to understand how you interact with our website to better improve it, and to understand your preferences and interests in order to select offerings that you might find most useful. We also use this information to detect and prevent fraudulent activity. |
| Web Logs | We may collect information, including your browser type, operating system, Internet Protocol (IP) address (a number that is automatically assigned to a computer when the internet is used), domain name, click-activity, referring website, and/or a date/time stamp for visitors. | We use this information to understand how you interact with our website to better improve it, and to understand your preferences and interests in order to select offerings that you might find most useful. We also use this information to detect and prevent fraudulent activity and general security reasons. |
We collect the categories of CCPA Personal Information described above from the following sources:
- Directly from California residents or their representatives;
- Service providers, consumer data resellers, and other third parties;
- Public record sources (federal, state, or local government sources);
- Affiliates;
- Website/mobile app activity/social media;
- Institutions from member-directed third parties or institutions representing a member/prospect; and
- Former employers, professional references, background check service providers, and other similar sources.
How We Share and Disclose CCPA Personal Information
In addition to the specific situations discussed elsewhere in this Privacy Policy, we may disclose CCPA Personal Information in the following situations:
- Affiliates and Acquisitions: We may share information with our corporate affiliates (e.g., subsidiaries or other companies under common control). If another company acquires, or plans to acquire, our company, business, or assets, we will also share information with that company, including at the negotiation stage.
- Service Providers: We may share your information with service providers. Among other things, service providers may help us to administer our website, conduct surveys, provide technical support, process payments, and assist in the fulfillment of services.
- Legal Obligations: We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products to or the provision of services by a third-party intermediary.
- Your Consent: We may disclose your information to other third parties when we have your consent or direction to do so.
In addition to the information above, California law requires that organizations disclose whether specific categories of Personal Information defined in the CCPA have been disclosed to third parties for a “business purpose,” or “sold” or transferred for “valuable consideration” in the preceding 12 months. The table below indicates which of these specified categories we may collect and transfer in a variety of contexts.
| Category of CCPA Personal Information | Category of Recipients Disclosed to for a Business Purpose | Category of Recipients Shared to for Cross-Context Behavioral Advertising |
|---|---|---|
| Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, email address, or account name. |
| Advertising and marketing networks |
| Government-Issued Identification such as Social Security Number, driver’s license number or state-issued identification number, or passport number. |
| Not shared |
| Financial Information such as bank account number, credit card number, and debit card number. |
| Not shared |
| Characteristics of protected classifications such as sex or marital status. |
| Advertising and marketing networks |
| Commercial information such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
| Advertising and marketing networks |
| Internet or other electronic network activity information such as browsing history, search history, and information regarding an individual’s interaction with an internet website, application, or advertisement. |
| Advertising and marketing networks |
| Geolocation data such as device location and IP location. |
| Advertising and marketing networks |
| Audio, electronic, visual, thermal, olfactory, or similar information. |
| Not shared |
| Professional or employment-related information. |
| Not shared |
| Non-public education information (as defined in the Family Educational Rights and Privacy Act). |
| Not shared |
| Inferences drawn from any of the information listed above. |
| Advertising and marketing networks |
| Additional categories of Personal Information described in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as signature, physical characteristics or description, and insurance policy number. |
| Not shared |
California law also requires organizations to disclose additional information with respect to certain categories of sensitive Personal Information they collect. Please see the chart below for further information about how Navy Federal collects and shares sensitive CCPA Personal Information. Please note that the chart describes categories of sensitive CCPA Personal Information collected in a variety of contexts (e.g., an application for employment) and that not all categories will apply to every California resident.
| Categories of Sensitive CCPA Personal Information We May Collect | Purposes for Which It Is Collected | Is Information Sold or Shared for the Purpose of Cross-Context Behavioral Advertising? | Length of Time Company Intends to Retain Information |
|---|---|---|---|
| Social security, driver’s license, state identification card, or passport number. |
| No | Until no longer needed to comply with our legal obligations. |
| Biometric information for the purpose of uniquely identifying a consumer or applicant. |
| No | Until deletion of the account or until no longer needed to comply with our legal obligations. |
| Account login in combination with any required security or access code, password, or credentials allowing access to an account. |
| No | Until deletion of the account or until no longer needed to comply with our legal obligations. |
| Racial or ethnic origin, religious or philosophical beliefs, or union membership. |
| No | Until no longer needed to comply with our legal obligations. |
| Health Information |
| No | Until no longer needed to comply with our legal obligations. |
| Precise Geolocation Information |
| No | Until no longer needed to comply with our legal obligations. |
How We Protect and Retain CCPA Personal Information
Keeping CCPA Personal Information secure is one of our most important priorities. Consistent with our obligations under applicable laws and regulations, we maintain physical, technical, electronic, procedural, and organizational safeguards and security measures that are designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access, whether it is processed by us or elsewhere.
We will only retain your CCPA Personal Information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for CCPA Personal Information, we consider the amount, nature, and sensitivity of the CCPA Personal Information, the potential risk of harm from unauthorized use or disclosure of your CCPA Personal Information, the purposes for which we process your CCPA Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances, we may anonymize or deidentify your CCPA Personal Information so that it can no longer be associated with you, in which case we may use such information without further notice to you. To the extent we maintain and use CCPA Personal Information in an anonymized or deidentified form, we will not attempt to reidentify the information, except for the purpose of determining whether our anonymization/deidentification processes satisfy our legal obligations.
Rights Under the CCPA
California law provides California residents with the right to make certain choices about your CCPA Personal Information:
- Access: You may have the right to request access to CCPA Personal Information and information regarding the source of that information, the purposes for which we collected it, and the third parties and service providers with whom we shared it. You can also request information concerning the categories of Personal Information (if any) we share with third parties or affiliates for those parties to use for direct marketing. In certain limited circumstances, you may also request to receive access to your data in a portable, machine-readable format.
- Deletion: You may have the right to request that such CCPA Personal Information be deleted. Note that in many situations, we may be permitted or required by law to maintain copies of your information.
- Modification: You may have the right to request modification to CCPA Personal Information that we retain about you. We generally rely on you to update and correct your CCPA Personal Information. Note that we may keep historical information in our backup files as permitted by law.
- Opt-Out of Sale of Information: It is Navy Federal’s policy not to sell CCPA Personal Information, and we have not done so in the past 12 months. Because Navy Federal does not sell your CCPA Personal Information, we do not offer an opt-out under the CCPA.
- Opt-Out of Sharing Personal Information for Cross-Context Behavioral Advertising: You have a right to opt out of sharing personal information for cross-context behavioral advertising purposes. We respond to and abide by opt-out preference signals sent by the Global Privacy Control (GPC) when enabled in your browser or browser extension. We process enabled GPC signals in a “frictionless manner” under California law. You can exercise your right to opt out by enabling GPC in your browser. GPC is a browser setting that allows you to enable a privacy signal for websites to utilize when you visit. When we detect an enabled GPC signal from a capable browser or extension, our web services will not share personal information for certain targeted advertising purposes in accordance with applicable laws. Please note that your preferences will apply only to the specific browser from which you opt out. You will need to opt out separately on all your browsers. If you disable cookies, change web browsers, or use a different device, you may need to opt out again. Our web services do not function differently in response to browser "Do Not Track" signals, but you may opt out of targeted advertising as described above.
- Objection to Certain Processing of Sensitive Information: In some cases, you may object to our use or disclosure of the sensitive CCPA Personal Information we collect. For more information about the types of Sensitive Data that we collect, see the How We Share and Disclose CCPA Personal Information section above.
Please note, not all of the rights described above are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity. We will not discriminate against individuals who exercise their privacy rights under applicable law.
Authorized Agents
You also have the right to use an authorized agent to make a request under the CCPA on your behalf. California residents who have a relationship with Navy Federal may rely on a valid general power of attorney already on file that appoints the Authorized Agent as Attorney-in-Fact. California residents who do not have a valid general power of attorney already on file, or do not have a relationship with Navy Federal, must designate their authorized agent using the limited CCPA Power of Attorney Form.
Parents/legal guardians making requests on behalf of their minor children will need to complete the Parent/Legal Guardian Cover Sheet and include a certified copy of the birth certificate or legal document to provide proof of their status.
Completed limited CCPA POA Forms and Parent/Legal Guardian Cover Sheets may either be:
- mailed to Navy Federal Credit Union, P.O. Box 2464, Merrifield, VA 22116-2464; or
- dropped off at a Navy Federal branch located in California (Branch Locator).
How to Make Requests
If you are a California resident, you or your authorized agent can use any of the following methods to make a request to exercise the rights described above.
For Members, Consumers, and Applicants:
- Using the Public Portal.
- Calling us toll-free at 1-888-842-6328.
- Visiting one of our branches in California.
Verification Process
Upon submission of your request, we will take steps to verify your identity and, if applicable, the authorized agent. Those steps may vary, however, depending on your relationship with Navy Federal and the intake method.
Further, in rare cases, we may require you to visit a Navy Federal branch or acknowledge your identity before a notary public. If required for CCPA purposes, Navy Federal branches located in California (Branch Locator) that offer notary services will do so free of charge.
Responses
We will work to process all verified requests within 45 days. If we need an extension in order to process your request, we will reach out to you.
In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or confirm that the CCPA Personal Information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. Additionally, we may not honor your request where an exception applies, such as where the disclosure of CCPA Personal Information would adversely affect the rights and freedoms of another individual or where the Personal Information that we maintain about you is not subject to the CCPA’s rights.
We will advise you in our response if we are not able to honor your request. We will not provide Social Security Numbers, driver’s license numbers or government-issued identification numbers, financial account numbers, healthcare or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.
Contact for More Information
For any questions, comments, or complaints regarding our privacy practices, or if you need to access this Privacy Policy in an alternative format due to having a disability, please call us at 1-888-842-6328.
Date Last Updated: December 27, 2023