California Privacy Notice & Policy

Effective Date: January 1, 2023

Notice at Collection and Privacy Policy for California Residents

This Notice at Collection and Privacy Policy for California Residents (“California Privacy Notice & Policy”) explains how Flagstar Bank, N.A., (collectively, “Flagstar” “we,” “us,” or “our”) collect, use, disclose, sell, share, and/or retain personal information (“Information Practices”) subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). This Privacy Notice & Policy applies solely to California residents (“consumers” or “you”).

The CCPA does not apply to certain information collected by us or our affiliates, such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this California Privacy Notice and Policy does not apply to information that we collect about individuals who seek, apply for, or obtain our financial products and services for personal, family, or household purposes, which is subject to our Privacy Policy.

California Consumer Privacy Act (“CCPA”)
Any terms defined in the CCPA and the proposed regulations have the same meaning when used in this disclosure.

Notice at Collection

The following notice identifies the categories of personal information to be collected from you and the purposes for which the personal information will be used, including whether that information is sold or shared.

The categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and the categories of third parties with whom we disclosed the personal information above are in reference to our practices in the last 12 months.

Retention Periods
We retain information for different periods of time depending on the purposes for which we collect and use it. We will delete or de-identify information when it is no longer needed to fulfill the purposes listed for each category above, unless a longer retention period is required to comply with applicable legal and regulatory requirements. There may be technical or other operational reasons where we are unable to fully delete or de-identify your information. Where this is the case, we will take reasonable measures to prevent further processing your information.

Notice of Sale and/or Share
Our use of tracking technologies may be considered a sale or sharing with third parties for cross-context behavioral advertising (e.g. targeted advertising) under California law. You can opt-out of being tracked by these third parties by clicking the “Do Not Sell or Share My Personal Information” link and selecting your preferences.

California Privacy Policy
The purpose of this privacy policy is to provide you with a comprehensive description of our online and offline practices regarding our Information Practices. You have certain rights to control the use of your personal information. This privacy policy describes your rights as it relates to our Information Practices as to your personal information and how you can exercise those rights.

The table above includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.

What We Sell to Third Parties or Share with Third Parties for Cross-Context Behavioral Advertising and Right to Opt-Out
We may have sold or shared with third parties for cross-context behavioral advertising personal information to third parties in the preceding 12 months. The categories of personal information we may have shared with web analytics providers and third-party cookie and tracking technology providers to provide personalized ads are: Identifiers, Internet or Other Similar Network Activity, and Geolocation Data. We do not sell or share your sensitive personal information.

The purpose of the notice of Right to Opt-Out is to inform you that you have the right to direct us to stop selling or sharing your personal information, which is called the “Right to Opt-Out.”

You may exercise your Right to Opt-Out by clicking “Do Not Sell or Share My Personal Information” to use the interactive form.

Once you make an opt-out request, we will comply within 15 business days.

We do not have actual knowledge that we sell the personal information of minors under 16 years of age.
 
Your Rights
The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes those rights.
 
Requests to Access Your Personal Information (Right to Know)
California consumers have the right to request that we disclose certain information to them about our collection, use, sale, sharing and disclosure of their personal information over the past 12 months.
 
As part of our verification process of your request we ensure reasonable measures are in place to detect fraudulent requests and prevent unauthorized access to your personal information. We are required to verify your identity, and the identity of your authorized agent, if the request is submitted via an agent by associating the information provided in the request to any personal information previously collected by us.
 
Once we confirm your verifiable request we will disclose to you, consistent with your request:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• the business or commercial purpose for collecting, selling, or sharing with third parties for cross context behavioral advertising (e.g. targeted advertising)
• The categories of third parties with whom we disclose that personal information.
• Specific pieces of personal information we collected about you, if requested.

Requests to Delete Your Personal Information (Right to Request Deletion)
California consumers have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.
 
If we deny your deletion request, we will notify you in writing of the reason.

Requests to Correct Your Inaccurate Personal Information (Right to Request Correction)
You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used for the purpose of correcting your personal information and complying with our recordkeeping requirements. We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six (6) months, unless you provide new or additional documentation that the information at issue is inaccurate.

As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “Submitting Requests.”

Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights.
 
Submitting Requests
To exercise the rights described above, you may either:

• Call us Toll-Free at (800) 634-6486
• Submit your request online

Only you or your authorized agent may make a verifiable consumer request related to your personal information, or a request to opt-out of the sale or sharing of your personal information. If you use an authorized agent to submit a request on your behalf, we may require that you (1) provide the authorized agent written permission to do so and (2) provide a copy of the authorization or provide a copy of a power of attorney that complies with California Probate Code sections 4000 to 4465 so that we can verify the identity of the authorized agent.
 
In verifying requests, we employ reasonable measures to detect fraudulent requests and prevent unauthorized access to your personal information. To meet our obligations, we are required to verify your identity, and the identity of your authorized agent, if the request is submitted via an agent, by associating the information provided in your request to personal information previously collected by us. If we suspect fraudulent or malicious activity, we may decline a request or request that you provide further verifying information.
 
You may only make a verifiable consumer request twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to verify you are the person about whom we collected personal information and, if applicable, provide necessary documentation about your authorized agent.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request.
 
Flagstar may not be obligated to provide access to or delete the personal information we have collected about you if your request conflicts with federal or state law or other lawful obligations by which we are bound, or is subject to an exemption in the CCPA.
 
Responding to Requests
Upon receiving your request to know or a request to delete, we will process your request or notify you if the request requires an extension or will be denied. If we only comply with your request in part, we will explain the reasons why. We attempt to process requests within 45 days after receipt. If we require additional time beyond 45 days, we will inform you of the reason and the extension period.
 
If you have an account with us, we may deliver our response to that account. If you do not have an account with us, we will deliver our response by mail or electronically.
 
Generally, we do not charge a fee to process or respond to your requests. However, if we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
 
“Shine the Light Law”
 
If you are a California resident, you may have the right to request and receive certain information about disclosure of your personal information under this policy to third parties for their direct marketing purposes, and your choices with respect to such disclosures. If you wish to learn more about our compliance with this requirement, please contact us using the information provided in the “Contact Us” section below.
 
Changes to this California Privacy Notice and Policy
We reserve the right to amend this privacy notice and policy at our discretion and at any time. When we make changes to this Privacy Notice and Policy, we will notify you through a notice on our website homepage.
 
Contact Us
If you have any questions or comments about this California Privacy Notice & Policy the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, or need this disclosure in another format, please contact us at [email protected].