Privacy Notice at Collection for Pennymac Office Visitors Who are California Residents

This California Consumer Privacy Act of 2018 (“CCPA”) Privacy Policy supplements the information contained in PennyMac Loan Services, LLC (“Pennymac”)’s online “Privacy Policy” for PennyMac Loan Services, LLC and its affiliates with Pennymac in its name (collectively, “Pennymac”, “we,” “us,” “our”). We adopt this privacy policy to comply with the CCPA, and it applies solely to persons who reside in the State of California (“consumer” or “you”).

The CCPA provides California residents with privacy rights related to the personal information businesses collected about you and your household. The purpose of this privacy policy is to provide you with a description of our business practices regarding the collection, use, sale, sharing, and retention of your personal information and of your rights regarding your personal information.

Under the CCPA, you have the right to know what personal information Pennymac collects, uses, sells, shares, retains, the right to request the deletion of your personal information collected, and the right to opt-out of the sale or sharing of your personal information. However, these rights only extend to information covered by the CCPA, and because the CCPA does not cover all consumer information in all scenarios, only certain information is subject to the above referenced rights.

Exceptions:

The CCPA contains certain exceptions. For example, privacy rights established under the CCPA (including the right to know, right to delete, and right to correct) do not apply to personal information collected or disclosed pursuant to the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA). Such personal information may include, but is not limited to:

• Identifiers (such as name, mailing address, email address, online identifier, internet protocol address, account number, telephone number, driver’s license number, passport number, social security number, date of birth); and
• Consumer records (such as age, gender, marital status, annual income, employment or professional related information, account transactions, payment history, claims history, and consumer reports).

Information we may collect:

Length of Time We Intend to Retain Each Category (or the criteria used to determine the period of time)

Pennymac will retain each of the above categories of Personal Information for 5 years post the end of the business day. However, the retention period may vary based upon the following:

• As required by a law
• As required for legal purposes (statutes of limitations, litigation, regulatory investigations or audits)
• The time period required to fulfill necessary use and processing.

Categories of Sources From Which Personal Information is Collected

1. Directly from you, when you provide us with your personal information. For example, when you complete the screening questions on the iPad at one of our California PennyMac locations.

How We May Use Your Data

1. For security purposes, so that we have a record of who visited a PennyMac facility.

Categories Of Third Parties With Whom We May Disclose Your Personal Information

1. Suppliers who provide products or services to PennyMac.
2. Outside counsel, when needed.
3. Legal, regulatory, or other similar authorities and/or agencies, when required.

Why We Might Disclose Your Personal Information to Third Parties

1. To support business operations

In the preceding 12 months, PennyMac has disclosed to a Supplier the following categories of personal information (see examples of each category above):

1. Identifiers;
2. Categories of personal information described in the California Customer Records Act (Cal. Civ. Code section 1798.80(e));
3. Characteristics of protected classifications under California or federal law;
4. Sensory data; and
5. Inferences drawn from any personal information.

Sale or Sharing of Personal Information

Pennymac does not sell or share personal information. For the purposes of this policy, “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.

Pennymac has not sold or shared the personal information of consumers under 16 years of age.

Sensitive Personal Information

Pennymac does not collect sensitive personal information from California residents strictly visiting a Pennymac office.

Right to Know

You have the right to request that Pennymac disclose the personal information Pennymac has collected about you, including the categories of personal information, categories of sources from which the personal information was collected, the purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.

Right to Access

You have the right to request that Pennymac disclose the personal information Pennymac has collected about you, including the categories of personal information, categories of sources from which the personal information was collected, the purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.

Right to Request Deletion

You have the right to request the deletion of the personal information we collected about you. However, we may deny your request if there are any conflicts with our corporate record retention requirements, federal or state law, or if it falls under any other CCPA exception.

Right to Request Correction

You have the right to request that Pennymac correct inaccurate personal information Pennymac maintains about you.

Right to Opt-Out of the Sale of Personal Information

You have the right to opt-out of the sale of your personal information. PennyMac does NOT sell personal information.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

PennyMac does not discriminate against you for exercising your CCPA privacy rights.

Authorized Third Party

If you are an authorized third party (such as an attorney-in-fact) making a request on behalf of someone else, please contact us using one of the methods provided below.

How to Submit Your Request If You are a Resident of California

To submit a request to know, access, delete, or correct your information, click on “Submit a Request” or call us toll-free at (866) 601-3518.

Pennymac will verify your identity using the personal information you provide, which must include your name, address, and email address.

HOW OPT-OUT PREFERENCE SIGNALS ARE PROCESSED

You may also submit a request to opt-out of the sharing of your online information through an opt-out preference signal. Pennymac automatically processes opt-out preference signals based on your browser.

Contact Information:

If you have any questions or concerns about our privacy policies and practices, you may contact Pennymac using the information below.

A link to Pennymac’s consumer privacy policies may be found at pennymac.com/privacy

This privacy policy was last updated on March 25, 2024, and is subject to change.

Rev. 03/2024