Privacy Statement

California Privacy Notice & Policy

Effective Date: January 1, 2020

This PRIVACY NOTICE & POLICY FOR CALIFORNIA RESIDENTS is provided by Flagstar Bank, FSB (collectively, “Flagstar” “we,” “us,” or “our”) and applies solely to residents of the State of California (“consumers” or “you”).

California Consumer Privacy Act (“CCPA”)

Any terms defined in the CCPA and the proposed regulations have the same meaning when used in this disclosure.

Information We Collect

We collect offline and online personal information that consumers provide us. For CCPA purposes, personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. (“personal information”, “PI”).

We have collected the following categories of personal information within the last twelve (12) months and may use or disclose the personal information for one or more business or commercial purposes:

Category	Examples of Personal Information	Categories of Sources from which the Personal Information is Collected	Business or Commercial Purpose	Categories of third parties with whom your Personal Information is shared
Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.	From you From your devices when you interact with our websites, mobile applications and systems From you when you apply for and receive products and services From Flagstar employees when you interact with them and provide PI From brokers, correspondents, appraisers, legal counsel, government-sponsored entities, investors, prior servicers, credit bureaus and other public records From beneficiaries, counterparties and other third parties related to a transaction	To provide products and services to consumers including to maintain your account and process your transactions To verify your identity and authenticate you or your authorized agent such as when you request access to your account information or when you conduct online transactions To manage our business including performing accounting, auditing and other internal functions To assist us in fraud security or technical issues prevention or investigation or otherwise manage risks To comply with legal obligations and regulations, recordkeeping requirements, legal investigations, and contractual obligations To respond to an emergency	With service providers acting on our behalf such as information technology providers, auditors, marketing companies With credit bureaus With other financial companies for joint marketing purposes such as to bring you co-branded services or products With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities With beneficiaries, counterparties and other third parties related to a transaction With other parties if Flagstar is involved in any merger, acquisition, sale of company assets, transition of service to another provider
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	From you From your devices when you interact with our websites, mobile applications and systems From you when you apply for and receive products and services From Flagstar employees when you interact with them and provide PI From brokers, correspondents, appraisers, legal counsel, government-sponsored entities, investors, prior servicers, credit bureaus and other public records From beneficiaries, counterparties and other third parties related to a transaction	To provide products and services to consumers including to maintain your account and process your transactions To verify your identity and authenticate you or your authorized agent such as when you request access to your account information or when you conduct online transactions To manage our business including performing accounting, auditing and other internal functions To assist us in fraud security or technical issues prevention or investigation or otherwise manage risks To comply with legal obligations and regulations, recordkeeping requirements, legal investigations, and contractual obligations To respond to an emergency	With service providers acting on our behalf such as information technology providers, auditors, marketing companies With credit bureaus With other financial companies for joint marketing purposes such as to bring you co-branded services or products With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities With beneficiaries, counterparties and other third parties related to a transaction With other parties if Flagstar is involved in any merger, acquisition, sale of company assets, transition of service to another provider
Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	From you From your devices when you interact with our websites, mobile applications and systems From Flagstar employees when you interact with them and provide PI From brokers, correspondents, appraisers, legal counsel, government-sponsored entities, investors, prior servicers, credit bureaus and other public records From beneficiaries, counterparties and other third parties related to a transaction	To manage our business including performing accounting, auditing and other internal functions To comply with legal obligations and regulations, recordkeeping requirements, legal investigations, and contractual obligations	With service providers acting on our behalf such as information technology providers, auditors, marketing companies With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities
Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	From you From your devices when you interact with our websites, mobile applications and systems From Flagstar employees when you interact with them and provide PI From brokers, correspondents, appraisers, legal counsel, government-sponsored entities, investors, prior servicers, credit bureaus and other public records From beneficiaries, counterparties and other third parties related to a transaction	To provide products and services to consumers including to maintain your account and process your transactions To manage our business including performing accounting, auditing and other internal functions To comply with legal obligations and regulations, recordkeeping requirements, legal investigations, and contractual obligations	With service providers acting on our behalf such as information technology providers, auditors, marketing, companies With credit bureaus With other financial companies for joint marketing purposes such as to bring you co-branded services or products With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities With beneficiaries, counterparties and other third parties related to a transaction With other parties if Flagstar is involved in any merger, acquisition, sale of company assets, transition of service to another provider
Biometric information	Finger prints, facial recognition	From you Observed	To provide products and services to consumers including to maintain your account and process your transactions To verify your identity and authenticate you or your authorized agent such as when you request access to your account information or when you conduct online transactions	With service providers acting on our behalf such as information technology providers, auditors, marketing companies
Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	From your devices when you interact with our websites, mobile applications and systems	To provide products and services to consumers including to maintain your account and process your transactions To verify your identity and authenticate you or your authorized agent such as when you request access to your account information or when you conduct online transactions To assist us in fraud, security or technical issues prevention or investigation or otherwise manage risks	With service providers acting on our behalf such as information technology providers, auditors, marketing companies With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities
Geolocation data	Physical location or movements.	From a GPS enabled device	To provide products and services to consumers including to maintain your account and process your transactions To verify your identity and authenticate you or your authorized agent such as when you request access to your account information or when you conduct online transactions To assist us in fraud, security or technical issues prevention or investigation or otherwise manage risks	With service providers acting on our behalf such as information technology providers, auditors, marketing companies With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities
Sensory data	Audio	From you	To provide products and services to consumers including to maintain your account and process your transactions To verify your identity and authenticate you or your authorized agent such as when you request access to your account information or when you conduct online transactions To assist us in fraud, security or technical issues prevention or investigation or otherwise manage risks	With service providers acting on our behalf such as information technology providers, auditors, marketing companies With other parties relative to legal obligations such as to bring legal action regarding injury or interference with the rights and property of Flagstar, to respond to law enforcement or governmental entities

Sharing Personal Information

We may disclose your personal information to a third party, our affiliates or agent, or service providers for a business purpose as described above. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to keep that personal information confidential and not use it for any purpose except for fulfilling requirements and services being performed under contract.

Your Rights

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes those rights.

Requests to Access Your Personal Information (Right to Know)

California consumers have the right to request that we disclose certain information to them about our collection, use, and disclosure of their personal information over the past 12 months.

As part of our verification process of your request we ensure reasonable measures are in place to detect fraudulent requests and prevent unauthorized access to your personal information. We are required to verify your identity, and the identity of your authorized agent, if the request is submitted via an agent by associating the information provided in the request to any personal information previously collected by us.

Once we confirm your verifiable request we will disclose to you, consistent with your request:

The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
Our business purpose for collecting that personal information.
The categories of third parties with whom we share that personal information.
Specific pieces of personal information we collected about you, if requested.

Requests to Delete Your Personal Information (Right to Request Deletion)

California consumers have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

If we deny your deletion request, we will notify you in writing of the reason.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

Submitting Requests to Know or Delete

To exercise the rights described above, you may either:

Call us Toll-Free at (800) 634-6486
Submit your request online

Only you or your authorized agent may make a verifiable consumer request related to your personal information. If you use an authorized agent to submit a request on your behalf, we may require that you (1) provide the authorized agent written permission to do so and (2) provide a copy of the authorization or provide a copy of a power of attorney that complies with California Probate Code sections 4000 to 4465 so that we can verify the identity of the authorized agent.

In verifying requests, we employ reasonable measures to detect fraudulent requests and prevent unauthorized access to your personal information. To meet our obligations, we are required to verify your identity, and the identity of your authorized agent, if the request is submitted via an agent, by associating the information provided in your request to personal information previously collected by us. If we suspect fraudulent or malicious activity, we may decline a request or request that you provide further verifying information.

You may only make a verifiable consumer request twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information that allows us to verify you are the person about whom we collected personal information and, if applicable, provide necessary documentation about your authorized agent.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request.

Flagstar may not be obligated to provide access to or delete the personal information we have collected about you if your request conflicts with federal or state law or other lawful obligations by which we are bound, or is subject to an exemption in the CCPA.

Responding to Requests

Upon receiving your request to know or a request to delete, we will process your request or notify you if the request requires an extension or will be denied. If we only comply with your request in part, we will explain the reasons why. We attempt to process requests within 45 days after receipt. If we require additional time beyond 45 days, we will inform you of the reason and the extension period.

If you have an account with us, we may deliver our response to that account. If you do not have an account with us, we will deliver our response by mail or electronically.

Generally, we do not charge a fee to process or respond to your requests. However, if we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

“Shine the Light Law”

If you are a California resident, you may have the right to request and receive certain information about disclosure of your personal information to third parties for their direct marketing purposes, and your choices with respect to such disclosures. Because it is our policy not to share your personal information with unaffiliated third parties for their own direct marketing purposes, we are exempt from having to meet this requirement. If you still wish to learn more about our compliance with this requirement, please contact us using the information provided in the “Contact Us” section below.

Changes to this Privacy Notice and Policy

We reserve the right to amend this privacy notice and policy at our discretion and at any time. When we make changes to this Privacy Notice and Policy, we will notify you through a notice on our website homepage.

If you have any questions or comments about this Privacy Notice & Policy the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, or need this disclosure in another format, please contact us at privacy@flagstar.com.