Oregon Consumer Privacy Act Notice and Policy

CrossCountry Mortgage will only retain personal data for the length of time needed to fulfill the purpose for which it was collected. 

CrossCountry may collect, process, or disclose consumer personal data for one or more of the following business purposes: 

• To fulfill or meet the reason for which the consumer provides the information. For example, if a consumer provides information to a loan officer, CrossCountry will use that information to assist in the preparation and submission of a loan application. 

• To provide consumers with information including loan products and pricing. 

• To provide consumers with email alerts or other notices concerning our products, services, events, or news that may be of interest. 

• To carry out our obligations and enforce our rights arising from any contracts entered between consumers and CrossCountry, including for billing and collections. 

• To improve the CrossCountry website and better present content to consumers. For example, auditing related to a current interaction and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards. 

• For testing, research, analysis and product development. 

• As necessary or appropriate to protect the rights, property or safety of CrossCountry and our consumers or others. For example, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity. 

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. 

• To establish or defend legal claims and allegations. 

• To seek advice from attorneys, auditors and other professional advisors. 

• As described to consumers in any notice provided at or before the time of collection of personal information, or as otherwise set forth in the CCPA. 

• To evaluate or conduct a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by CrossCountry is among the assets transferred, or personal information held by CrossCountry is used to assess assets or personal information held by another. 

Note: CrossCountry will limit its collection of personal data to only the personal data that is adequate, relevant, and reasonably necessary to serve the purposes stated above. CrossCountry will not process personal data for purposes that are not reasonably necessary for and compatible with above purposes unless CrossCountry obtains the consumer’s consent. 

CrossCountry only processes sensitive data about a consumer to the extent required to comply with state and federal law. CrossCountry will not process a consumer’s sensitive data without the consumer’s consent. 

CrossCountry has disclosed the following categories of personal data with third parties: 

• A. Identifiers; 

• D. Internet or similar network activity; and 

• G. Geolocation data 

CrossCountry has disclosed the above categories of consumer personal information with the following categories of third parties: 

• Marketing and Analytics Companies for the purpose of marketing our products and services to Oregon consumers. 

CrossCountry does not process personal data for the purpose of targeted advertising. 

CrossCountry profiles personal data via automated processing that produces effects of legal effects or effects of similar significance. You or your authorized agent may submit a request to opt out of this type of data processing by completing the online webform – Oregon Privacy Request. 

The OCPA provides Oregon residents with specific rights regarding their personal information. This section describes consumers’ OCPA rights and explains how to exercise those rights. 

Right to Confirm Processing of and Obtain Personal Data 

Oregon consumers have the right to request that CrossCountry provide certain information about the collection and processing of personal data. Before CrossCountry provides a consumer’s personal data to the consumer, it will ask for information to verify the requestor’s identity. Once CrossCountry receives and confirms an authenticated consumer request, we will provide the following: 

• The categories of personal data CrossCountry collected about the consumer. 

• A copy of all of the consumer’s personal data that CrossCountry has processed or is processing. 

Note: CrossCountry may not disclose the requested data if it cannot verify a requestor’s identity. CrossCountry may not disclose certain data covered by one or more exemption from the OCPA, as discussed earlier in this Disclosure. 

Deletion request rights 

Consumers may request the deletion of personal data collected and retained by CrossCountry. Upon receipt and confirmation of a verifiable consumer request, CrossCountry will delete (and/or direct CrossCountry service providers to delete) consumer personal data from applicable records, unless an exception applies under the OCPA. 

Correction request rights 

Consumers may request the correction of inaccurate personal information collected and retained by CrossCountry. Upon receipt and confirmation of an authenticated consumer request and supporting documentation (if necessary), CrossCountry will correct (and/or direct CrossCountry service providers to correct) the inaccurate consumer personal information in all applicable records, unless an exception applies under the OCPA. CrossCountry will inform the consumer whether it has complied with a consumer correction request. A consumer’s request to correct may be denied if CrossCountry determines that the contested information maintained by CrossCountry is more likely than not accurate based on the totality of relevant circumstances. 

Right to request a list of the third parties to which we have disclosed personal data 

Consumers may request a list of specific third parties, other than natural persons, to which CrossCountry has disclosed personal data. Upon receipt and confirmation of a authenticated consumer request, CrossCountry will provide a list of specific third parties to which CrossCountry has disclosed any personal data, unless an exception applies under the OCPA. 

Right to opt-out of the sale of personal data 

Consumers and their authorized users may opt out of the sale of the consumer’s personal data. Upon receipt of a request to opt out of the sale of personal data from a consumer or their authorized agent, CrossCountry will comply with the request, unless an exception applies under the OCPA. 

Right to opt-out of automated data processing that produces significant effects 

Consumers and their authorized users may opt out of the processing of that consumer’s personal data that CrossCountry uses to profile the consumer in furtherance of decisions that produce legal effects or effects of similar significance. Upon receipt of a request to opt out of the processing of a consumer’s data for this purpose, CrossCountry will comply with the request, unless an exception applies. 

Non-discrimination rights 

CrossCountry will not discriminate against Oregon consumers, employees, applicants for exercising any rights under the OCPA. Except to the extent permitted by the OCPA, CrossCountry will not: 

• Deny you goods or services; 

• Charge different prices or rates for goods or services based upon provision of personal information, including through granting discounts or other benefits, or imposing penalties; 

• Provide different levels or quality of goods or services; or, 

• Suggest that a consumer may receive a different price or rate for goods or services or a different level or quality of goods or services. 

How to exercise rights 

The following OCPA rights can be exercised by completing the online webform – Oregon Privacy Request (https://crosscountrymortgage.com/ccpa/request/) 

• Right to confirm and obtain personal data 

• Right to delete personal data 

• Right to correct personal data 

• Right to request a list of the third parties to whom we have disclosed personal data 

• Right to opt-out of automated data processing that produces legal or other significant effects

Note: For the Right to Opt-Out of the Sale of Personal Data, consumers may submit a request by clicking on the “Do Not Sell or Share My Personal Information” button found in the banner at the bottom of this webpage. Authorized agents and consumers who are natural persons may submit a request to Opt-Out of the Sale of Personal Data by via the online webform – Oregon Privacy Request (https://crosscountrymortgage.com/ccpa/request/).  

Right to confirm processing of and obtain personal data, delete personal data, or correct personal data: CrossCountry will respond only to requests that are authenticated consumer requests. As a result, CrossCountry will seek to authenticate a consumer’s identity upon receipt of any request. CrossCountry will ask information from the requestor that enables identification, such as the consumer’s email address or the last four digits of the consumer’s social security number. CrossCountry also may use a third-party verification provider to verify a consumer’s identity. 

As part of a request to correct inaccurate data that CrossCountry maintains about a consumer, the consumer submitting the request must provide any documentation that rebuts the accuracy of the contested data maintained by CrossCountry. 

Authorized agents: An authorized person may submit an opt-out request on behalf of a consumer using the webform shown above. An authorized agent who is a natural person will be required to provide their contact information, the verification information of the consumer on whose behalf they are making the OCPA request, any documentary evidence as part of a correction request, and evidence of their authorization to act on behalf of the consumer in the form of either: 

• A document signed by the signed by the consumer giving the authorized agent permission to act on behalf of the consumer (CrossCountry may also contact the consumer directly to verify their identity and that authorization has been given) 

• A valid power of attorney 

CrossCountry cannot respond to a request or provide a consumer with personal data if it cannot verify the identity of the consumer, the authority of a third party to make the request, and/or confirm the requested personal data relates to the consumer. Making a request does not require the creation of an account with CrossCountry. CrossCountry will only use personal data provided by or on behalf of a consumer in a request to verify the requestor’s identity and/or authority to make the request. 

Response timing and format 

CrossCountry strives to respond to each authenticated consumer request within 45 days of its receipt. If CrossCountry requires more time, it will inform the requestor of the reason and extension period in writing. If the requestor has a pre-existing account with CrossCountry, CrossCountry may deliver its written response by means of that account. If the requestor does not have a pre-existing account, CrossCountry may deliver its written response either by mail or electronically. For request to confirm processing of/obtain personal data requests, CrossCountry will select a portable format to provide a consumer’s personal data that is readily useable and allows the consumer to transmit the information from one entity to another entity without hindrance. 

CrossCountry does not charge a fee to process or respond to an authenticated consumer request submitted once during any 12-month period. CrossCountry may charge a reasonable fee to cover the administrative costs of complying with a second or subsequent request within the 12-month period, unless the purpose of the second or subsequent request is to verify that CrossCountry has corrected inaccuracies in, or deleted, a consumer’s personal data in compliance with the consumer’s initial request. If CrossCountry determines a request warrants a fee, CrossCountry will inform the consumer of the decision and provide a cost estimate before completing the request. 

If CrossCountry denies a consumer request, it will notify the consumer in writing and explain the basis for the denial. The consumer may appeal the denial by responding to the notification of denial with additional information for consideration within 14 calendar days of the date of notification. CrossCountry will approve or deny the appeal within 45 days after the date on which CrossCountry receives the appeal and will notify the consumer in writing of CrossCountry’s decision and the reasons for the decision. If CrossCountry denies the appeal, the notice will provide or specify information that enables the consumer to contact the Attorney General to submit a complaint. 

Changes to this disclosure 

CrossCountry reserves the right to amend this Disclosure at its discretion and at any time. When CrossCountry makes changes to this Disclosure, it will notify consumers by posting a link to the updated Disclosure to its website homepage. Consumers should check back periodically for any updates. 

How to contact us 

For questions or comments about this Disclosure, our Privacy Statement, the ways in CrossCountry collects and processes consumer personal data, consumer choices and rights regarding such use, or exercising rights under Oregon law, please contact CrossCountry by sending an email to: [email protected] 

This policy was last updated 06/28/2024.