California Consumer Privacy Act Applicant Notice and Policy

We take the privacy of your data seriously.

We value the trust you put in us and understand that protecting your personal information is critical to earning and keeping that trust. The California Consumer Privacy Act (CCPA) gives California residents the power to request to know, delete, and correct the personal info we have on file for them.

Submit a CCPA Request

or call 844-940-CCPA

California Consumer Privacy Act Disclosure

This California Consumer Privacy Act Disclosure (“Disclosure”) is meant to supplement the CrossCountry Mortgage, LLC (“CrossCountry”) online Privacy Statement, https://crosscountrymortgage.com/privacy-policy/, and explain how CrossCountry collects, uses, and discloses personal information relating to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”). This Disclosure applies solely to visitors, users, applicants, and others who reside in the State of California (hereinafter referred to as a “consumer” or “consumers”). Any terms used in this Disclosure, but not defined herein, have the same definition as used in the CCPA.

Background

The CCPA applies to consumers’ personal information, or information that identifies, relates to, or could be reasonably linked, directly or indirectly, with a California resident. Consumers’ personal information does not include information subject to the Gramm-Leach-Bliley Act (“GLBA”). Information subject to GLBA includes, without limitation: information provided to CrossCountry during the mortgage application process, information that results from the mortgage transaction; or, information CrossCountry otherwise obtains in connection with providing the mortgage.

The personal information CrossCountry collects, uses, and discloses varies based upon the relationship and/or interactions with an individual. For example, personal information collected from a consumer who visits the CrossCountry website and submits a mortgage application online may differ from personal information collected from a consumer who does business with CrossCountry in-person.

Information Collected

CrossCountry collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or device. CrossCountry may collect the following categories of personal information from consumers. Categories of personal information collected in the last twelve (12) months are indicated by the term ‘YES’ in the ‘Collected’ column:

Category	Examples	Collected
A. Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (CA Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO
E. Biometric Information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	YES
F. Internet or similar network activity	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	YES
G. Geolocation data	Physical location or movements.	YES
H. Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	YES
I. Professional or employment related information	Current or past job history or performance evaluations.	YES
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99))	Education records related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	YES
K. Inferences drawn from other personal information	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES

 

CrossCountry mortgage will only retain personal information for the length of time needed to fulfill the purpose for which it was collected.

Collection Sources

CrossCountry obtains the categories of personal information listed above from the following categories of sources:

• Information you provided directly to us.
• Directly and indirectly from activity on our website (www.crosscountrymortgage.com). For example, a consumer’s IP address, kind of web browser and computer used, and locality including the state or country from which the consumer accessed the site.
• Collected via CrossCountry's website technologies.
• Online job platforms.
• Social Networks.
• Public record sources including Federal, state or local government.

Use of Personal Information

CrossCountry may collect or disclose consumer personal information for one or more of the following business purposes:

• To manage and administer employee services, such as employee benefits, processing payroll. To conduct employee-related analytics; conduct performance reviews; and establish, maintain, and terminate employees' relationships with CrossCountry Mortgage.
• To evaluate our current recruiting processes.
• To evaluate eligibility for initial and continued employment, including processing and verifying information provided pursuant to a job application, and performing background checks of new applicants and existing employees.
• To conduct training, take disciplinary action, and address work-related incidents.
• To document your receipt and acceptance of agreements presented to you.
• To comply with recordkeeping obligations and policies.
• To maintain internal employee directories and to facilitate work-related communications with employees.
• To respond to employment-related incidents and process work-related benefit claims.
• As necessary or appropriate to protect the rights, property or safety of CrossCountry and our consumers or others. For example, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• To establish or defend legal claims and allegations.
• To verify an employee’s compliance with employment-related training or certification requirements.
• To seek advice from attorneys, auditors and other professional advisors.
• As described to consumers in any notice provided at or before the time of collection of personal information, or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by CrossCountry is among the assets transferred, or personal information held by CrossCountry is used to assess assets or personal information held by another.

Note: CrossCountry will not collect additional categories of personal information or use the collected personal information for materially different, unrelated, or incompatible purposes without providing notice to consumers.

Disclosing Personal Information

CrossCountry has disclosed the following categories of personal information to third parties for a business purpose in the previous twelve (12) months:

• A. Identifiers;
• B. Personal information categories;
• C. Protected classification characteristics;
• F. Internet or similar network activity;
• G. Geolocation data;
• H. Sensory data;
• I. Professional or employment related information
• J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)); and,
• K. Inferences drawn from other personal information.

CrossCountry has disclosed each of these categories of consumer personal information for business purposes to the following categories of third parties:

Category	Category of Third Party Information Provided To
A. Identifiers	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.
B. Personal information categories listed in the California Customer Records statute (CA Civ. Code § 1798.80(e)).	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.
C. Protected classification characteristics under California or federal law.	Service Providers, Vendors, or Contractors.  Government, Regulatory, and Legal Entities.
F. Internet or similar network activity	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.
G. Geolocation data	Service Providers, Vendors, or Contractors. Technology Providers.
H. Sensory data	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.
I. Professional or employment related information	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99))	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.
K. Inferences drawn from other personal information	Service Providers, Vendors, or Contractors. Government, Regulatory, and Legal Entities.

 

Sale and Sharing of Personal Information

CrossCountry has not sold or shared personal information subject to the CCPA in the last twelve (12) months, including personal information of minors under the age of 16.

Sensitive Personal Information

CrossCountry does not use or disclose sensitive personal information other than:

• To provide the products and services requested by you.
• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.
• To ensure the physical safety of natural persons.
• To perform services on behalf of CrossCountry.
• To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

Consumer Rights and Choices Under CCPA

The CCPA provides California residents with specific rights regarding their personal information. This section describes consumers’ CCPA rights and explains how to exercise those rights.

Right to Know/Right to Access Personal Information

California consumers have the right to request that CrossCountry disclose certain information about the collection and use of personal. Before CrossCountry discloses information, it will ask for information to verify the requestors identity.  Once CrossCountry receives and confirms a verifiable consumer request, we will disclose the following:

• The categories of personal information CrossCountry collected about the consumer.
• The categories of sources for the personal information CrossCountry collected about the consumer.
• The CrossCountry business or commercial purpose for collecting or sharing that personal information.
• The categories of third parties with whom CrossCountry shares that personal information.
  • If CrossCountry disclosed consumer personal information for a business purpose, the business purpose and the categories of personal information that each category of recipient received.

Additionally, if a consumer requests specific pieces of personal information collected by CrossCountry and provides the requested identifying information, CrossCountry will disclose the specific pieces of personal information to the requestor.

Note: CrossCountry may not disclose the requested information if it cannot verify a requestor’s identity. CrossCountry may not disclose certain information covered by one or more exemption from the CCPA, as discussed earlier in this Disclosure. Under no circumstances will CrossCountry disclose a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answers.

Deletion Request Rights

Consumers may request the deletion of personal information collected and retained by CrossCountry. Upon receipt and confirmation of a verifiable consumer request, CrossCountry will delete (and/or direct CrossCountry service providers to delete) consumer personal information from applicable records, unless an exception applies.  If CrossCountry denies a consumer deletion request, it will inform the consumer and explain the basis for the denial.

Correction Request Rights

Consumers may request the correction of inaccurate personal information collected and retained by CrossCountry. Upon receipt and confirmation of a verifiable consumer request and supporting documentation (if necessary), CrossCountry will correct (and/or direct CrossCountry service providers to correct) the inaccurate consumer personal information in all applicable records, unless an exception applies.  CrossCountry will inform the consumer whether it has complied with a consumer correction request. A consumer’s request to correct may be denied if CrossCountry determines that the contested information maintained by CrossCountry is more likely than not accurate based on the totality of relevant circumstances. If CrossCountry denies a consumer correction request, it will inform the consumer and explain the basis for the denial.

Non-Discrimination Rights

CrossCountry will not discriminate against any California resident, including consumers, employees, applicants, or independent contractors, for exercising any CCPA rights. Except to the extent permitted by the CCPA, CrossCountry will not:

• Deny you goods or services;
• Charge different prices or rates for goods or services based upon provision of personal information, including through granting discounts or other benefits, or imposing penalties;
• Provide different levels or quality of goods or services; or,
• Suggest that a consumer may receive a different price or rate for goods or services or a different level or quality of goods or services.

How to Exercise Rights

A consumer may exercise the rights described above by submitting a request to CrossCountry by either:

• Calling us at 844-940-CCPA (2272) or
• Completing the online webform - California Privacy Request

A consumer must describe the request with enough detail so that CrossCountry may properly understand, evaluate, and respond to the request.  A consumer may request to know and access personal information no more than twice within any 12-month period.

CrossCountry will respond only to requests that are verifiable consumer requests.  As a result, CrossCountry will seek to verify a consumer’s identity upon receipt of any request. CrossCountry will ask information from the requestor that enables identification, such as the consumer’s email address or the last four digits of the consumer’s social security number.  CrossCountry also may use a third-party verification provider to verify a consumer’s identity. 

Correction Request: As part of a request to correct inaccurate information that CrossCountry maintains about a consumer, the consumer submitting the request must provide any documentation that rebuts the accuracy of the contested information maintained by CrossCountry.

Authorized Agents: An authorized person may submit a CCPA request on behalf of a consumer using the telephone number or online webform shown above. An authorized agent will be required to provide their contact information, the verification information of the consumer on whose behalf they are making the CCPA request, any documentary evidence as part of a correction request, and to submit evidence of authorization to act on behalf of the consumer in the form of either:

• A document signed by the signed by the consumer giving the authorized agent permission to act on behalf of the consumer (CCM may also contact the consumer directly to verify their identity and that authorization has been given)
• A power of attorney pursuant to Probate Code sections 4121 to 4130

CrossCountry cannot respond to a request or provide a consumer with personal information if it cannot verify the identity of the consumer, the authority of a third party to make the request, and/or confirm the requested personal information relates to the consumer.  Making a request does not require the creation of an account with CrossCountry.  CrossCountry will only use personal information provided in a request to verify the requestor's identity or authority to make the request.

Response Timing and Format

CrossCountry strives to respond to each verifiable consumer request within 45 days of its receipt.  If CrossCountry requires more time, it will inform the requestor of the reason and extension period in writing.  If the requestor has a pre-existing account with CrossCountry, CrossCountry may deliver its written response by means of that account.  If the requestor does not have a pre-existing account, CrossCountry may deliver its written response either by mail or electronically.  For request to know and access personal information requests, CrossCountry will select a format to provide a consumer’s personal information that is readily useable and allows the consumer to transmit the information from one entity to another entity without hindrance.

CrossCountry does not charge a fee to process or respond to a verifiable consumer request unless the request is excessive, repetitive, or manifestly unfounded.  If CrossCountry determines a request warrants a fee, CrossCountry will inform the consumer of the decision and provide a cost estimate before completing the request.

Changes to This Disclosure

CrossCountry reserves the right to amend this Disclosure at its discretion and at any time. When CrossCountry makes changes to this Disclosure, it will notify consumers by posting a link to the updated Disclosure to its website homepage.  Consumers should check back periodically for any updates.

How to Contact Us

For questions or comments about this Disclosure, our Privacy Statement, the ways in CrossCountry collects and uses consumer personal information, consumer choices and rights regarding such use, or exercising rights under California law, please contact CrossCountry at:

Phone:             844-940-CCPA (2272)
US Mail:
CrossCountry Mortgage, LLC
Attn: Sarah Watts
2160 Superior Avenue
Cleveland, OH 44114

Or please contact CrossCountry by sending an email to: [email protected]

This policy was last updated 06/30/2023.