tracking

Oregon Consumer Privacy Act Notice and Policy

We take the privacy of your data seriously.

We value the trust you put in us and understand that protecting your personal information is critical to earning and keeping that trust. The Oregon Consumer Privacy Act (OCPA) gives Oregon residents the power to request to

  • Confirm, obtain, delete, and correct the personal data we have on file for them;
  • Request a list of the third parties to whom we have disclosed the personal data of Oregon consumers; and
  • Opt out of
    • The processing of your personal data for the purposes of targeted advertising;
    • The sale of your personal data; and
    • The use of automated processing of your personal data to make decisions that produce legal or other significant effects

Submit an OCPA Request

Oregon Consumer Privacy Act Disclosure

This Oregon Consumer Privacy Act Disclosure (“Disclosure”) is meant to supplement the CrossCountry Mortgage, LLC (“CrossCountry”) online Privacy Statement, https://crosscountrymortgage.com/privacy-policy/, and explain how CrossCountry collects, uses, and discloses personal data relating to Oregon residents covered by the Oregon Consumer Privacy Act (“OCPA”). This Disclosure applies solely to visitors, users, applicants, and others who reside in the State of Oregon (hereinafter referred to as a “consumer” or “consumers”). Any terms used in this Disclosure, but not defined herein, have the same definition as used in the OCPA.

CrossCountry Mortgage, LLC currently operates under the following names in the state of Oregon:

  • BestRateUSA
  • CrossCountry Mortgage, LLC
  • Valere Financial
  • Veterans Lending Group

Background

The OCPA applies to data, derived data or any unique identifier that is linked to an Oregon resident or to a device that is linked to an Oregon resident. Consumers’ personal data does not include information subject to the Gramm-Leach-Bliley Act (“GLBA”). Personal data subject to GLBA includes, without limitation: information provided to CrossCountry during the mortgage application process, information that results from the mortgage transaction; or information CrossCountry otherwise obtains in connection with providing the mortgage.

The personal data CrossCountry collects, processes, and discloses varies based upon the relationship and/or interactions with an individual. For example, personal data collected from a consumer who visits the CrossCountry website and submits a mortgage application online may differ from personal data collected from a consumer who does business with CrossCountry in-person.

Personal Data Collected

CrossCountry collects data that that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household. CrossCountry may collect the following categories of personal data from consumers. Categories of personal information collected by CrossCountry are indicated by the term ‘YES’ in the ‘Collected’ column:

Category Examples Collected
A. Identifiers A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. YES
B. Protected classification characteristics under Oregon or Federal law. Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). YES
C. Commercial information Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. YES
D. Internet or similar network activity Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. YES
E. Geolocation data Physical location or movements. YES
F. Sensory data Audio, electronic, visual, thermal, olfactory, or similar information. YES
G. Professional or employment related information Current or past job history or performance evaluations. YES
H. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)) Education records related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. NO
I. Inferences drawn from other personal information Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. NO
J. Sensitive data Data that reveals a consumer’s racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a victim of crime or citizenship or immigration status; that accurately identifies within a radius of 1,750 feet a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer by means of technology that includes, but is not limited to, a global positioning system that provides latitude and longitude coordinates; or is genetic or biometric data YES

 

CrossCountry Mortgage will only retain personal data for the length of time needed to fulfill the purpose for which it was collected.

Processing of Personal Data

CrossCountry may collect, process, or disclose consumer personal data for one or more of the following business purposes:

  • To fulfill or meet the reason for which the consumer provides the information. For example, if a consumer provides information to a loan officer, CrossCountry will use that information to assist in the preparation and submission of a loan application.
  • To provide consumers with information including loan products and pricing.
  • To provide consumers with email alerts or other notices concerning our products, services, events, or news that may be of interest.
  • To carry out our obligations and enforce our rights arising from any contracts entered between consumers and CrossCountry, including for billing and collections.
  • To improve the CrossCountry website and better present content to consumers. For example, auditing related to a current interaction and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
  • For testing, research, analysis and product development.
  • As necessary or appropriate to protect the rights, property or safety of CrossCountry and our consumers or others. For example, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
  • To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
  • To establish or defend legal claims and allegations.
  • To seek advice from attorneys, auditors and other professional advisors.
  • As described to consumers in any notice provided at or before the time of collection of personal information, or as otherwise set forth in the CCPA.
  • To evaluate or conduct a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by CrossCountry is among the assets transferred, or personal information held by CrossCountry is used to assess assets or personal information held by another.

Note: CrossCountry will limit its collection of personal data to only the personal data that is adequate, relevant, and reasonably necessary to serve the purposes stated above. CrossCountry will not process personal data for purposes that are not reasonably necessary for and compatible with above purposes unless CrossCountry obtains the consumer’s consent.

Sensitive Data

CrossCountry only processes sensitive data about a consumer to the extent required to comply with state and federal law. CrossCountry will not process a consumer’s sensitive data without the consumer’s consent.

Disclosing Personal Data To Third Parties

CrossCountry has disclosed the following categories of personal data with third parties:

  • A. Identifiers;
  • D. Internet or similar network activity; and
  • G. Geolocation data

CrossCountry has disclosed the above categories of consumer personal information with the following categories of third parties:

  • Marketing and Analytics Companies for the purpose of marketing our products and services to Oregon consumers.

Targeted Advertising and Profiling Personal Data

CrossCountry does not process personal data for the purpose of targeted advertising.

CrossCountry profiles personal data via automated processing that produces effects of legal effects or effects of similar significance. You or your authorized agent may submit a request to opt out of this type of data processing by completing the online webform - Oregon Privacy Request.

Consumer Rights and Choices Under OCPA

The OCPA provides Oregon residents with specific rights regarding their personal information. This section describes consumers’ OCPA rights and explains how to exercise those rights.

Right to Confirm Processing of and Obtain Personal Data

Oregon consumers have the right to request that CrossCountry provide certain information about the collection and processing of personal data. Before CrossCountry provides a consumer’s personal data to the consumer, it will ask for information to verify the requestor’s identity. Once CrossCountry receives and confirms an authenticated consumer request, we will provide the following:

  • The categories of personal data CrossCountry collected about the consumer.
  • A copy of all of the consumer’s personal data that CrossCountry has processed or is processing.

Note: CrossCountry may not disclose the requested data if it cannot verify a requestor’s identity. CrossCountry may not disclose certain data covered by one or more exemption from the OCPA, as discussed earlier in this Disclosure.

Deletion Request Rights

Consumers may request the deletion of personal data collected and retained by CrossCountry. Upon receipt and confirmation of a verifiable consumer request, CrossCountry will delete (and/or direct CrossCountry service providers to delete) consumer personal data from applicable records, unless an exception applies under the OCPA.

Correction Request Rights

Consumers may request the correction of inaccurate personal information collected and retained by CrossCountry. Upon receipt and confirmation of an authenticated consumer request and supporting documentation (if necessary), CrossCountry will correct (and/or direct CrossCountry service providers to correct) the inaccurate consumer personal information in all applicable records, unless an exception applies under the OCPA. CrossCountry will inform the consumer whether it has complied with a consumer correction request. A consumer’s request to correct may be denied if CrossCountry determines that the contested information maintained by CrossCountry is more likely than not accurate based on the totality of relevant circumstances.

Right to Request a List of The Third Parties to Which We Have Disclosed Personal Data

Consumers may request a list of specific third parties, other than natural persons, to which CrossCountry has disclosed personal data. Upon receipt and confirmation of a authenticated consumer request, CrossCountry will provide a list of specific third parties to which CrossCountry has disclosed any personal data, unless an exception applies under the OCPA.

Right to Opt-Out of the Sale of Personal Data

Consumers and their authorized users may opt out of the sale of the consumer’s personal data. Upon receipt of a request to opt out of the sale of personal data from a consumer or their authorized agent, CrossCountry will comply with the request, unless an exception applies under the OCPA.

Right to Opt-Out of Automated Data Processing that Produces Significant Effects

Consumers and their authorized users may opt out of the processing of that consumer’s personal data that CrossCountry uses to profile the consumer in furtherance of decisions that produce legal effects or effects of similar significance. Upon receipt of a request to opt out of the processing of a consumer’s data for this purpose, CrossCountry will comply with the request, unless an exception applies.

Non-Discrimination Rights

CrossCountry will not discriminate against Oregon consumers, employees, applicants for exercising any rights under the OCPA. Except to the extent permitted by the OCPA, CrossCountry will not:

  • Deny you goods or services;
  • Charge different prices or rates for goods or services based upon provision of personal information, including through granting discounts or other benefits, or imposing penalties;
  • Provide different levels or quality of goods or services; or,
  • Suggest that a consumer may receive a different price or rate for goods or services or a different level or quality of goods or services.

How to Exercise Rights

The following OCPA rights can be exercised by completing the online webform - Oregon Privacy Request

  • Right to Confirm and Obtain Personal Data
  • Right to Delete Personal Data
  • Right to Correct Personal Data
  • Right to Request a List of The Third Parties to Whom We Have Disclosed Personal Data
  • Right to Opt-Out of Automated Data Processing that Produces Legal or Other Significant Effects

Note: For the Right to Opt-Out of the Sale of Personal Data, consumers may submit a request by clicking on the “Do Not Sell or Share My Personal Information” button found in the banner at the bottom of this webpage. Authorized agents and consumers who are natural persons may submit a request to Opt-Out of the Sale of Personal Data by via the online webform - Oregon Privacy Request.

Right to Confirm Processing of and Obtain Personal Data, Delete Personal Data, or Correct Personal Data: CrossCountry will respond only to requests that are authenticated consumer requests. As a result, CrossCountry will seek to authenticate a consumer’s identity upon receipt of any request. CrossCountry will ask information from the requestor that enables identification, such as the consumer’s email address or the last four digits of the consumer’s social security number. CrossCountry also may use a third-party verification provider to verify a consumer’s identity.

As part of a request to correct inaccurate data that CrossCountry maintains about a consumer, the consumer submitting the request must provide any documentation that rebuts the accuracy of the contested data maintained by CrossCountry.

Authorized Agents: An authorized person may submit an opt-out request on behalf of a consumer using the webform shown above. An authorized agent who is a natural person will be required to provide their contact information, the verification information of the consumer on whose behalf they are making the OCPA request, any documentary evidence as part of a correction request, and evidence of their authorization to act on behalf of the consumer in the form of either:

  • A document signed by the signed by the consumer giving the authorized agent permission to act on behalf of the consumer (CrossCountry may also contact the consumer directly to verify their identity and that authorization has been given)
  • A valid power of attorney

CrossCountry cannot respond to a request or provide a consumer with personal data if it cannot verify the identity of the consumer, the authority of a third party to make the request, and/or confirm the requested personal data relates to the consumer. Making a request does not require the creation of an account with CrossCountry. CrossCountry will only use personal data provided by or on behalf of a consumer in a request to verify the requestor’s identity and/or authority to make the request.

Response Timing and Format

CrossCountry strives to respond to each authenticated consumer request within 45 days of its receipt. If CrossCountry requires more time, it will inform the requestor of the reason and extension period in writing. If the requestor has a pre-existing account with CrossCountry, CrossCountry may deliver its written response by means of that account. If the requestor does not have a pre-existing account, CrossCountry may deliver its written response either by mail or electronically. For request to confirm processing of/obtain personal data requests, CrossCountry will select a portable format to provide a consumer’s personal data that is readily useable and allows the consumer to transmit the information from one entity to another entity without hindrance.

CrossCountry does not charge a fee to process or respond to an authenticated consumer request submitted once during any 12-month period. CrossCountry may charge a reasonable fee to cover the administrative costs of complying with a second or subsequent request within the 12-month period, unless the purpose of the second or subsequent request is to verify that CrossCountry has corrected inaccuracies in, or deleted, a consumer’s personal data in compliance with the consumer’s initial request. If CrossCountry determines a request warrants a fee, CrossCountry will inform the consumer of the decision and provide a cost estimate before completing the request.

Request Denials and Right to Appeal

If CrossCountry denies a consumer request, it will notify the consumer in writing and explain the basis for the denial. The consumer may appeal the denial by responding to the notification of denial with additional information for consideration within 14 calendar days of the date of notification. CrossCountry will approve or deny the appeal within 45 days after the date on which CrossCountry receives the appeal and will notify the consumer in writing of CrossCountry’s decision and the reasons for the decision. If CrossCountry denies the appeal, the notice will provide or specify information that enables the consumer to contact the Attorney General to submit a complaint.

Changes to This Disclosure

CrossCountry reserves the right to amend this Disclosure at its discretion and at any time. When CrossCountry makes changes to this Disclosure, it will notify consumers by posting a link to the updated Disclosure to its website homepage. Consumers should check back periodically for any updates.

How to Contact Us

For questions or comments about this Disclosure, our Privacy Statement, the ways in CrossCountry collects and processes consumer personal data, consumer choices and rights regarding such use, or exercising rights under Oregon law, please contact CrossCountry by sending an email to: [email protected]

This policy was last updated 06/28/2024.