Online Privacy Policy

Effective as of January 1, 2020

Last updated September 1, 2020

The California Consumer Privacy Act (CCPA) requires that we provide California residents with a privacy policy that contains a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of California residents regarding their personal information. This California Privacy Policy supplements our Online Privacy Policy and is intended solely for, and is applicable only as to, California residents. If you are not a California resident, this policy does not apply to you and you should not rely on it.

The CCPA defines "personal information" to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available, deidentified or aggregate information. For purposes of this California Privacy Policy we will refer to this information as "Personal Information."

The CCPA's privacy rights described below do not apply to Personal Information that is collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act and its implementing regulations or the California Financial Information Privacy Act. Because we are subject to those laws and regulations, much of the Personal Information that we collect is exempt from the CCPA. Your choices and rights with respect to our use and sharing of that information are subject to our U.S. Consumer Privacy Notice.

The CCPA's privacy-related rights also do not apply to certain types of Personal Information that is subject to the Federal Credit Reporting Act (FCRA). Some of our services are subject to the FCRA and, therefore, exempt from the CCPA on that basis.

If you are a California resident, you have the right to request that we disclose what Personal Information we have collected about you in the 12-month period preceding your request. This right includes the right to request any or all of the following:

1. Specific pieces of Personal Information that we have collected about you;
2. Categories of Personal Information we have collected about you;
3. Categories of sources from which the Personal Information was collected;
4. Categories of Personal Information that we sold (if applicable) or disclosed for a business purpose about you;
5. Categories of third parties to whom the Personal Information was sold (if applicable) or disclosed for a business purpose; addition
6. The business or commercial purpose for collecting, or, if applicable, selling Personal Information.

The CCPA defines "sell" to mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a California resident's Personal Information to another business or a third party for monetary or other valuable consideration.

• How to Submit a Request to Know

You may submit a request to know through our interactive webform available here or by contacting us toll-free at 1-866-508-4326.

As mentioned above, if you are a California resident who has a financial product or service with us, much of the Personal Information that we collect is exempt from the CCPA and, therefore, is not subject to the rights discussed in this California Privacy Policy. Your choices and rights with respect to our use and sharing of that information are subject to our US. Consumer Privacy Notice.

• Collection of Personal Information

We currently collect and, in the 12 months prior to the "last updated" date of this California Privacy Policy, have collected the following categories of Personal Information about California residents directly from them and from third-party lead generators and credit bureaus:

• Identifiers such as name, email address, Social Security number, Internet protocol address, online identifier, account name; driver's license or othe rtypes of state ID card number, and passport number
• Postal address
• Phone number
• Signature
• Bank account number
• Credit and debit card number
• Insurance policy number
• Other financial information (e.g., credit history)
• Professional or employment-related information, including employment history (e.g., occupation and employer name)
• Education information
• Commercial information (personal property records and records of products or services purchased, obtained, considered)
• Protected classifications (race, color, gender, age (40 years or older), national origin, ancestry, disability, citizenship status, marital status, and military service)
• Geolocation data
• Medical condition (genetic characteristics and cancer or a record of history of cancer)
• Any information in the consumer's application and claims history, including appeals records, if information is linked or reasonably linkable to consumer or household, including via device, by business or service provider
• Unique personal identifiers (cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; internet protocol address; customer number, unique pseudonym or user alias; telephone numbers or othe rforms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device)
• Internet or other electronic network activity information (e.g., browsing history and search history)

As discussed, many of these categories of Personal information are exempt from the CCPA. Your choices and rights with respect to our use and sharing of that information are subject to our U.S. Consumer Privacy Notice.

In addition to the purposes stated in the section "Collecting and Using Information" within our Online Privacy Policy, we currently collect and have collected the above categories of Personal Information for the following business or commercial purposes:

• Maintaining or servicing accounts;
• Providing customer service;
• Verifying customer information;
• Providing financing;
• Providing analytics services;
• Undertaking internal research for technological development and demonstration; and/or
• Enabling or effecting, directly or indirectly, a commercial transaction.
• Disclosure of Personal Information

In the 12 months preceding the "last updated" date of this California Privacy Policy, we disclosed for a business purpose the Personal Information listed above to the following categories of third parties:

• Service providers and vendors (e.g., email, hosting, maintenance, backup, analysis, etc.);
• Business partners who provide services to us to facilitate our providing of financial products to consumers; addition
• Government agencies

We did not sell Personal information to third parties in the 12 months preceding the "last updated" date of this California Privacy Policy.

We do no knowingly collect or sell the Personal Information of minors under 16 years of age.

If you are a California resident, you have the right to request that we delete the Personal Information about you that we have collected. However, we are not required to comply with a request to delete if it is necessary for us to maintain the Personal Information in order to, for example, complete a transaction, detect security incidents, comply with a legal obligation, or otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

• How to Submit a Request to Delete

You may submit a request to delete through our interactive webform available here or by contacting us toll-free at 1-866-508-4326.

As mentioned above, if you are a California resident who has a financial product or service with us, much of the Personal Information that we collect is exempt from the CCPA and, therefore, is not subject to the rights discussed in this California Privacy Policy. Your choices and rights with respect to our use and sharing of that personal information are subject to our U.S. Consumer Privacy Notice.

If we determine that your request is subject to an exemption or exception, we will notify you of our determination. If we determine that your request is not subject to an exemption or exception, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request.

We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized disclosure or deletion as applicable.

For requests to know categories of Personal Information and for requests to delete Personal Information that is not sensitive and does not pose a risk of harm by unauthorized deletion, we will verify your identity to a “reasonable degree of certainty” by verifying at least two data points that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

For requests to access specific pieces of Personal Information or for requests to delete Personal Information that is sensitive and poses a risk of harm by unauthorized deletion, we will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

If you are a California resident, you have the right to direct businesses to stop selling your Personal Information.

We do not sell Personal Information as it is defined in the CCPA.

We will not discriminate against California residents if they exercise any of the rights provided in the CCPA as described in this California Privacy policy. As such, we will not deny goods or services to that California resident; charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; provide a different level or quality of goods or services to the California resident; or suggest that the California resident will receive a different price or rate for goods or services or a different level or quality of goods or services. However, we are permitted to charge a California resident a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by the individual’s data.

If you are submitting a request on behalf of a California resident, please submit the request through one of the designated methods discussed above. After submitting the request, and if the request is not subject to an exemption or exception, we will require additional information to verify your authority to act on behalf of the California resident.

We are committed to ensuring that our privacy policies are accessible to individuals with disabilities. If you wish to access this California Privacy Policy is an alternative format, please contact us as described below.

To contact us for questions or concerns about our privacy policies or practices please contact us at:

Compliance Manager, Flat Branch Home Loans

101 S. Fifth Street, Suite 200

Columbia, MO 65201

compliance@fbhl.com

Flat Branch Home Loans mobile app is powered by Simple Nexus. User images in the mobile app are uploaded to https://api.simplenexus.com/.