California Privacy Policy

Rev. Date: January 2024

CALIFORNIA CONSUMER PRIVACY ACT PRIVACY POLICY

We are required to provide California residents with a comprehensive description of our online and offline privacy policy and practices regarding the collection, use, disclosure, and retention of your personal information (our "Information Practices"); to inform you of your rights regarding your personal information; and to provide you with any information necessary for you to exercise those rights.

Your Rights Regarding Your Personal Information

1. Right to Know. You have the right to know the personal information that we collect, use, and disclose about you, including the categories of personal information; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting personal information; the categories of third parties to whom we disclose personal information; and the specific pieces of personal information that we have collected about you. Subject to certain exceptions, we will provide you with all of your personal information that we have collected or maintained. This will include any personal information that our service providers or contractors have collected pursuant to their written contract with us.
2. Right to Delete. You have the right to request us to delete any personal information that we have collected about you. Subject to certain exceptions, we will delete the personal information that we have collected about you from our records, and we will direct any service provider or contractor to delete your personal information from their records.
3. Right to Correct. You have the right to request us to correct any inaccurate personal information that we maintain about you. Subject to certain exceptions, we will correct the personal information that we maintain about you on our existing system, and we will direct any service provider or contractor that maintain the personal information at issue pursuant to their written contract with us to make the necessary corrections on their systems.
4. Right to Not Receive Discriminatory Treatment. You have the right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by the California Consumer Privacy Act ("CCPA"). A price or service difference is discriminatory and prohibited ifwe treat you differently because you exercised a right conferred by the CCPA or its issuing regulations. A price or service difference is non-discriminatory if it is reasonably related to the value of your data.

Types of Personal Information

Collected Personal Information

Categories of Personal Information. We collected the following categories of personal information in the preceding 12 months:

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers.
• Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under California or federal law.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Biometric Information
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement.
• Geolocation Data
• Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information Professional or Employment-Related Information.
• Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
• Inferences drawn from any of the information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Categories of Sources. We collected your personal information from the following type of people or entities:

• Direct from the consumer
• Our Website (www.ngfcu.com) and your use of Applications on your mobile device.
• The use of Cookies and Other Online Tracking Technology.
  • We, our service providers, or other companies we work with may deploy and use cookies, web beacons, local shared objects, and other tracking technologies for various purposes, such as fraud prevention and to promote our products and services to you. Some of these tracking tools may detect characteristics or settings of the specific device you use to access our online services. "Cookies" are small amounts of data a website can send to a visitor's web browser. They are often stored on your device to help track your areas of interest. Cookies may also enable us, our service providers, or other companies we work with to relate your use of our online services over time to customize your experience. Most web browsers allow you to adjust your browser settings to decline or delete cookies, but doing so may degrade your experience with our online services. Clear GIFs, pixel tags, web beacons, or similar technologies may be used on our sites and in some of our digital communications (such as email or other marketing messages). They may also be used when we send you advertisements, or you otherwise interact with advertisements outside of our online services. These are principally used to help recognize users, assess traffic patterns, and measure site or campaign engagement. Local Shared Objects, sometimes referred to as "flash cookies" may be stored on your hard drive using a media player or other software installed on your device. Local Shared Objects are similar to cookies in terms of their operation but may not be managed in your browser in the same way. "First party" cookies are stored by the domain (website) you are vising directly. They allow the website's owner to collect analytics data, remember language settings, and perform useful functions that help provide a good experience. "Third-party" cookies are created by domains other than the one you are visiting directly, hence the name third-party. They may be used for cross-site tracking, retargeting and ad-serving. Cookies generally fall into the following general categories:
  • Essential Cookies: These are technically necessary to provide website functionality. They are a website's basic form of memory, used to store preferences selected users on a given site. They are essential to a website's functionality and cannot be disabled by users. For example, an essential cookie may be used to prevent users from having to log in each time they visit a new page in the same session.
  • Performance and Function Cookies: These are used to enhance performance and functionality but are not essential to its use. Without these cookies, certain functions (like videos) may become unavailable.
  • Analytics and Customization Cookies: These track user activity so website owners can better understand how their site is being accessed and used.
  • Advertising Cookies: These are used to customize a user's ad experience on a website. Using the data collected from these cookies, websites can prevent the same ad from appearing again and again, remember user ad preferences, and tailor which ads appear based on a user's online activities.

Business or Commercial Purposes. We collected your personal information for these business or commercial purposes:

• Performing services on behalf of the institution, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the institution.
• Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.

Personal Information Is Not Sold or Shared. We have not sold or shared your personal information to any third parties in the preceding 12 months.

Disclosed Personal Information

Categories of Personal Information. We disclosed the following categories of personal information to third parties in the preceding 12 months:

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers.
• Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under California or federal law.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement.
• Geolocation Data
• Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information Professional or Employment-Related Information.
• Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.

Categories of Third Parties. For each type of personal information identified above, we disclosed that type of information to the following third parties:

 

Business or Commercial Purposes. We disclosed your personal information for these business or commercial purposes:

• Performing services on behalf of the institution, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the institution.

How to Submit A Request Regarding Your Personal Information

You can submit to us a verifiable request to know, request to delete, or request to correct your personal information. We will verify that you are the person who we have collected information about by requiring you to provide a current, government issued ID such as a driver's license or passport. At our discretion, we may choose to ask you account verifying questions in addition or as a substitute for providing your photo ID.

Access to Specific information.

If exceptions do not apply, you or your authorized representative have the right to request this information twice in a 12-month period. The information we provide will cover the previous 12-month period.

If the request is valid and authorized, we will disclose the following to you or your representative.

• Categories of personal information we have collected about you,
• The categories of sources of the personal information collected about you, and
• Our business or commercial purpose for collecting such information.

Right to Delete Personal Information.

Since we are a federally-chartered financial institution, information obtained in the course of its business is subject to the Federal Gramm-Leach-Bliley Act, Consumer Financial Protection Bureau Regulation P (12 CFR Part 1016), the California Financial Information Privacy Act (California Financial Code 4050 et seq) and other federal/state laws that require information be maintained for specific periods of time. Records subject to these laws and regulations cannot be deleted upon consumer request, but only after record retention requirements for specific laws and regulations. In some cases, the information must be permanently retained.

Also, we share the information with credit reporting agencies in accordance with the Federal Fair Credit Reporting Act and various state laws. This information is also not subject to deletion requests.

Since the we do not sell personal information, there is no right to delete or opt-out of the sale of personal information.

Receipt of Requests. No later than 10 business days after receiving your request(s), we will confirm that we received your request(s) and provide you with information on how we will process your request(s). We will respond to your request to know, request to delete, or request to correct no later than 45 calendar days after receiving your request(s). Ifwe cannot verify your identity within this time period, we may deny your request(s) in whole or in part and will inform you that your identity cannot be verified. If we need more time, we will inform you of the reason for the delay during this time period and may extend the time to respond up to an additional 45 calendar days. Our response will cover the 12-month period preceding our receipt of your request.

You can submit your request to know, request to delete, and request to correct by calling us toll-free at 800.633.2848 for our Call Center. You can also submit your request(s) by using any of the following methods:

• Visiting our online form at: www.ngfcu.com
• Mailing a request to: NGFCU California Privacy Request
  Attn: Compliance Department.
  Box 47009
  Gardena, CA 90247

Authorized Agents. We may allow an authorized agent to make a request to know, request to delete, or request to correct on your behalf. We may require written proof that you have given the agent permission to submit a request on your behalf, require the agent to verify their identity with us, or require you to confirm with us that you have provided the agent permission to submit the request. If you are an authorized agent, you may make these requests by following these instructions: we reserve the right to determine if the representative has your specific permission to request this information on your behalf

Contact Information

For information about our privacy policy and Information Practices, you can contact us by calling us at 800.633.2848, and ask to speak with the Chief Compliance Officer regarding our privacy policy.

Additional Information

The sharing of this information is permitted by both federal and state law for the purposes of completing transactions requested by the consumer. Examples of such sharing to complete transactions include providing name, address and similar information to check printing companies for printing consumer's checks, informing a business that the consumer has/has not available funds when using a debit or credit card to pay for a transaction, sharing required information with a state's motor vehicle department to obtain certificate of title showing consumer's ownership of a vehicle.

 

NOTICE AT COLLECTION

We are required to provide California residents with timely notice, at or before the point of collection, about the categories of personal information to be collected from you and the purposes for which the personal information is collected or used. For example, upon receiving the Notice at Collection, you can use the information in the notice as a tool to choose whether to engage with us, or to direct us not to sell or share your personal information and to limit the use and disclosure of your sensitive personal information, if applicable. We will not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing you prior notice. Our privacy policy can be found at www.ngfcu.com.

Categories of Personal Information. The following categories of personal information are to be collected:

• Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers.
• Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under California or federal law.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement.
• Geolocation Data
• Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information Professional or Employment-Related Information.
• Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.

We will retain each category of personal information for as required by law.

Purpose for Collection. The purpose(s) for which the categories of personal information identified above are collected or used include:

• Performing services on behalf of the institution, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the institution.
• Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer's current interaction with the institution, provided that the consumer's personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer's experience outside the current interaction with the institution.