Mobile Banking Privacy Policy

CEFCU’s Privacy Policy for CEFCU Mobile Banking Application

Last updated on October 28, 2023

CEFCU’s Privacy Policy for CEFCU Mobile Banking Application (“Privacy Policy”) describes Our policies and procedures that apply to the access, collection, use, sharing, and disclosure of Your Personal and Sensitive Information when You use the Service and tells You about Your privacy rights and how the law protects You.

We access, collect, use, share, and disclose Your Personal and Sensitive Information solely to provide and improve the Service. By using the Service, You agree to the access, collection, use, sharing, and disclosure of Your Personal and Sensitive Information in accordance with this Privacy Policy.

This Privacy Policy DOES NOT apply to information that:

• We collect offline or on cefcu.com.
• You provide to or is collected on websites You may access through the Service.
• You provide to or is collected by any third party other than a Service Provider.

These third parties may have their own privacy policies, which we encourage You to read before providing information on or through them.

Application Permissions

In order to provide certain features of the Application, the Application will request Your prior permission to access Your Device as follows:

Permission to Access and Collect Information from Your Device’s:	Purpose for Permission	What Happens If You Don’t Give or You Revoke Your Permission?
Contacts
Read your contacts.	Person to Person payment. Recipient contact information used to facilitate payment transfer.	You won’t be able to select recipient contact information, requiring manual entry of contact information.
Location
Approximate location (network-based).	Maps. Location is used to populate map and to improve and customize Our Service.	Map will default to a location that may not be device location.
Precise location (GPS and network-based).	Maps. Location is used to populate map and to improve and customize Our Service.	Map will default to a location that may not be device location.
Photos/Media/Files
Read the contents of your device storage, including images.	eStatements, Secure Message attachments. Attachments received through download are saved on device.	Device may not be able to confirm available storage to download, save and/or access the attachment and/or document requested.
Modify or delete the contents of your device storage, including images.	eStatements, Secure Message attachments. Attachments received through download are saved on device.	Device may not be able to confirm available storage to download, save and/or access the attachment and/or document requested.
Upload the contents of your device storage, including images.	Secure Message attachments.	Device may not be able to confirm available storage to upload/access the attachment image requested.
Storage
Read the contents of your device storage, including images.	eStatements, Secure Message attachments. Attachments received through download are saved on device.	User may not be able to download and/or save attachment and/or document requested.
Modify or delete the contents of your device storage, including images.	eStatements, Secure Message attachments. Attachments received through download are saved on device.	User may not be able to download and/or save attachment and/or document requested.
Upload the contents of your device storage, including images.	Secure Message attachments.	Device may not be able to confirm available storage to upload/access the attachment image requested.
Camera
Take pictures, (images) and videos	Mobile Check Deposit. Picture taken for Mobile Check Deposit is used/shared to process item. Verify identity for using Plaid (e.g., connecting your financial accounts). Note: CEFCU does not receive nor retain the biometric data you submit to Plaid. Please see the Privacy and security policies | Plaid and Privacy and security policies | Plaid.	You won’t be able to take a picture of an item; therefore, you won’t be able to use Mobile Check Deposit to deposit Your check or verify your identity for connecting your accounts.
Wi-Fi connection information
View Wi-Fi connections	Access internet connection. The Application requires internet connection to update information	If network status is unavailable or Device is offline, the Application will not be able to load/start.
Other	Update application and send/receive information. Account information is sent/received.	If network status is unavailable or Device is offline, the Application will not be able to load/start.
Receive data from Internet	Update application and send/receive information. The Application requires internet connection to update information.	If network status is unavailable or Device is offline, the Application will not be able to load/start.
View network connections	Access internet connection. The Application requires internet connection to update information.	If network status is unavailable or Device is offline, the Application will not be able to load/start.
Full network access	Access internet connection. The Application requires internet connection to update information	If network status is unavailable or Device is offline, the Application will not be able to load/start.
Prevent device from sleeping	Allow user to stay in session. Application has a timeout set – allows	Device status may enter rest mode but Application runs in background and eventually will timeout.

You can enable or disable Your permissions to access and collect information from Your Device at any time, through Your Device’s settings.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• "Account" means a unique account created for You to access the Service or parts of the Service.
• "Application" means the software program provided by CEFCU downloaded by You on any electronic device, named CEFCU Mobile Banking.
• "CEFCU" (referred to as either "CEFCU", "We", "Us" or "Our" in this Privacy Policy) refers to Citizens Equity First Credit Union.
• "Country" refers to the United States.
• "Cookies" are small files that are placed on Your computer, mobile device, or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• "Device" means any device that can access the Service such as a computer, a cell phone, or a digital tablet.
• "Personal and Sensitive Information" is any information that relates to an identified or identifiable individual, including but not limited to personally identifiable information, financial and payment information, authentication information, phonebook, contacts, device location, SMS and call related data, inventory of other apps on the device, microphone, camera, and other sensitive device or usage data.
• "Service" refers to the Application and the Application’s Website.
• "Service Provider" means any natural or legal person who processes data on behalf of CEFCU. It refers to third-party companies or individuals employed by CEFCU to facilitate the Service, to provide the Service on behalf of CEFCU, to perform services related to the Service, or to assist CEFCU in analyzing how the Service is used.
• "Usage Data" refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• "You" means the individual accessing or using the Service, or CEFCU, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal and Sensitive Information

Types of Personal and Sensitive Information We Collect in the Service

Personal and Sensitive Information You Provide to Us

While using the Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Usage Data
• User ID and password

Personal and Sensitive Information Collected Via Technology

While using the Service, We may automatically collect certain information that may include, but is not limited to:

• Usage Data.
• Device data, such as the type of Device You use, the Internet Protocol address of Your Device, Your Device’s operating system type and version, the type and version of Internet browser You use, Your unique Device identifiers, Your Device’s manufacturer and model, Your Device’s screen resolution, Your Device’s RAM and disk size, Your Device’s CPU usage, the type of Your Device (e.g., phone, tablet, or computer), Your Device’s language settings, Your Device’s mobile carrier, Your Device’s radio/network information (e.g., WiFi, LTE, 3G), general location information such as city, state, or geographic area, and other diagnostic data.
• Online activity data, such as pages or screens You viewed, how long You spent on a page or screen, the time and date of Your visit, the website You visited before browsing to the Service, navigation paths between pages or screens, information about Your activity on a page or screen, access times, and duration of access.
• Cookies, which are text files that websites store on a visitor’s Device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping You navigate between pages efficiently, remembering Your preferences, enabling functionality, and helping us understand user activity and patterns.
• Local storage technologies, like HTML5 and Flash, that provide cookie-equivalent functionality but can store larger amounts of data, including on Your device outside of Your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
• Location Information. If You have enabled location services on Your phone and agree to the collection of Your location when prompted by the Services, we will collect Your location information when You use the Services; for example, to provide our fraud detection services. If You do not want us to collect this information, You may decline the collection of Your location when prompted or adjust the location services settings on Your device.

If you choose to link your external financial accounts to your CEFCU account(s), we or a third party on our behalf may collect information including your name, mobile phone number, external financial institution’s name and routing number, the connected account type(s) and number(s) and related account information (e.g., data about credit, loan or investment accounts; account transactions, balance). We may also collect your payroll and tax data; Social Security number, email address, date of birth, and address. To verify your identity in connection with this service, Plaid, Inc. may collect your identity document image, photograph, or video image of your face including a scan of your facial geometry. See the section Connecting Your Financial Accounts, below, for additional information.

Use of Your Personal and Sensitive Information

CEFCU may use Your Personal and Sensitive Information collected through Your use of the Service for the following purposes:

• To provide the financial services You request through the Service.
• To provide and maintain the Service, including to monitor the usage of the Service.
• To manage Your Account: to manage Your registration as a user of the Service. The Personal and Sensitive Information You provide can give You access to different functionalities of the Service that are available to You as a registered user.
• To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To enable you to connect your external financial accounts and related services.
• To manage Your requests: To attend and manage Your requests to Us.
• For other purposes: We may use Your Personal and Sensitive Information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and to evaluate and improve our Service, products, services, marketing, and Your experience.

Sharing Your Personal and Sensitive Information

We may share Your Personal and Sensitive Information in the following situations:

• With Service Providers and vendors: We may share Your Personal and Sensitive Information with Service Providers to monitor and analyze the use of our Service, for payment processing, to contact You and to connect your financial accounts (based on your request).
• For business transfers: We may share or transfer Your Personal and Sensitive Information in connection with, or during negotiations of, any merger, sale of CEFCU assets, financing, or acquisition of all or a portion of Our business to another company.
• With Affiliates: We may share Your Personal and Sensitive Information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.
• With business partners: We may share Your Personal and Sensitive Information with Our business partners to offer You certain products, services or promotions.
• With other users: when You share Your Personal and Sensitive Information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.
• With Your consent: We may disclose Your Personal and Sensitive Information for any other purpose with Your consent.

If you choose to connect your external financial accounts, we will disclose your personal information and relevant account information to third parties, including Plaid, Inc., as necessary to facilitate that service and for related purposes.

Service Providers, Affiliates, and Business Partners Privacy Protection

All third parties, including Service Providers, Affiliates, and business partners, who may have access to Your Personal and Sensitive Information provide the same or equal protection of such information as stated in this Privacy Policy and required by the App Store Review Guidelines.

Retention of Your Personal and Sensitive Information

CEFCU will retain Your Personal and Sensitive Information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal and Sensitive Information to the extent necessary to comply with our legal obligations (for example, if we are required to retain Your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

CEFCU will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of the Service, or We are legally obligated to retain this data for longer time periods.

We will delete your Personal and Sensitive Information when We are no longer required to retain that information or, for California residents, if You request We delete that information in accordance with the requirements of and subject to the limitations of CEFCU’s Privacy Policy for California Residents.

Connecting Your Financial Accounts. We make available a service that enables you to connect your external financial accounts to your CEFCU account(s) for convenience, if you choose to do so. We use Plaid, Inc. to provide this service. When Plaid collects your personal information, including biometric data, to provide this service, it does so as a data controller.

To facilitate connecting your accounts, we share with Plaid certain personal information we maintain about you (e.g., your name, phone number(s) and physical address), and that we have obtained from the financial institutions related to your connected account(s).

To prevent fraud, verify your identity, and provide related security services to CEFCU, Plaid may collect, process, retain or share with their service provider/subcontractor, your identity document image, photograph, or video image of your face including a scan of your facial geometry. Plaid will compare your derived facial geometry from the image on your identity document to your derived facial geometry in the photograph or video image that you provide to help verify your identity. You can find Plaid’s Biometric Policy here: Privacy and security policies | Plaid. To use this service, you must sign the Plaid Biometric Policy Release. For additional information on how Plaid collects, uses, and shares your data when you use Plaid, Inc. products or services, visit Plaid Inc.’s End User Privacy Policy Privacy and security policies | Plaid. CEFCU does not receive nor retain the biometric data you submit to Plaid.

Transfer of Your Personal and Sensitive Information

Your information, including Your Personal and Sensitive Information, is processed at CEFCU's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, Country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

CEFCU will take all steps reasonably necessary to ensure that Your Personal and Sensitive Information is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal and Sensitive Information will take place to an organization or a country unless there are adequate controls in place including the security of Your Personal and Sensitive Information.

Disclosure of Your Personal and Sensitive Information

Business Transactions

If CEFCU is involved in a merger, acquisition, or asset sale, Your Personal and Sensitive Information may be transferred. We will provide notice before Your Personal and Sensitive Information is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, CEFCU may be required to disclose Your Personal and Sensitive Information if required to do so by law or in response to a valid summons, subpoena, or order by public authorities (e.g., a court or a government agency).

Other legal requirements

CEFCU may disclose Your Personal and Sensitive Information in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of CEFCU
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect You or Us against legal liability

Security of Your Personal and Sensitive Information

The security of Your Personal and Sensitive Information is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal and Sensitive Information, We cannot guarantee its absolute security.

Detailed Information on the Processing of Your Personal and Sensitive Information

The Service Providers We use may have access to Your Personal and Sensitive Information. These third-party vendors collect, store, use, process, and transfer information about Your activity on Our Service in accordance with their Privacy Policies.

Analytics

We may use third-party Service providers to monitor and analyze the use of our Service.

Email Marketing

We may use Your Personal and Sensitive Information to contact You with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.

Children's Privacy

The Service is not intended for use by anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal and Sensitive Information, please contact Us. If We become aware that We have collected Personal and Sensitive Information from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your Personal and Sensitive Information and Your Country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

The Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party's site. We strongly advise You to review the privacy policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

California Residents

(View complete CEFCU Mobile Banking Privacy Policy)

California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our Application that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to dirrera@cefcu.com or write us at: Citizens Equity First Credit Union, Compliance Department, P.O. Box 1715, Peoria, IL 61656-9989.

The following California Privacy Policy provisions ("CCPA Section") apply solely to individuals who are residents of the State of California (hereinafter, "consumers" or "you"). This CCPA Section describes our policies and practices regarding the collection, use, and disclosure of personal information we collect about you, including personal information we obtain when you access or use the Site, or through other channels including but not limited to phone and email conversations, social media interactions on our websites, viewing our emails, visiting one of our locations, or through our authorized services providers.

This CCPA Section supplements and amends the information contained in the Policy with respect to California residents. Any terms defined within the CCPA have the same meaning when utilized within this CCPA Section. The other provisions of the Policy continue to apply except as modified in this CCPA Section.

Please read this CCPA Section carefully before using the Site or otherwise submitting information to us. By visiting the Site or otherwise submitting information, you indicate your understanding that the collection, use, and disclosure of your information is subject to the terms of this CCPA Section and our Terms of Use [link]. Except as otherwise noted, any capitalized terms not defined in the CCPA Section have the meaning set forth in the Policy.

IF YOU DO NOT CONSENT TO THE COLLECTION, USE, AND SHARING OF YOUR INFORMATION AS DESCRIBED IN THIS CCPA SECTION, PLEASE DO NOT PROVIDE US WITH SUCH INFORMATION.

This CCPA Section does not apply to "nonpublic personal information" subject to the Gramm-Leach-Bliley Act ("GLBA"). Nonpublic personal information generally means any information that is not publicly available and that a consumer, as defined by GLBA, provides to a financial institution to obtain a financial product or service from the institution; results from a transaction between the consumer and the institution involving a financial product or service; or, a financial institution otherwise obtains about a consumer in connection with providing a financial product or service. For information on our privacy practices regarding nonpublic personal information, please see our GLBA Privacy Notice.

1. Personal Information We Collect

   As described below, we may collect or have collected in the preceding 12 months the following categories of personal information ("PI" or "personal information"). We may add to the categories of PI we collect and the purpose we use PI. In that case, we will inform you by posting an updated version of this CCPA Section on the Site.

   • Identifiers. Examples include real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.
   • Personal information described in subdivision (e) of California Civil Code Section 1798.80. Examples include name, characteristics or description, address, telephone number, account number, credit card number.
   • Characteristics of protected classifications under California or federal law. This category includes characteristics of protected classifications under California or federal law.
   • Commercial information. This includes services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
   • Internet or other electronic network activity information. Examples include browsing history, search history, a consumer's interaction with an internet website, application, or advertisement
   • Geolocation data. This might include location information while using one of our apps.
   • Audio, electronic, visual, thermal, olfactory, or similar information. This category includes, without limitation, information collected from voicemail messages, while speaking with one of our service representatives, and/or by video camera.
   • Professional or employment-related information. This category includes, without limitation, information regarding your employer and title, job applications, and information related to managing the employment relationship.
   • Education information. This category includes, without limitation, information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, Sec. 1232g; 34 C.F.R. Part 99).
   • Sensitive personal information. This category includes personal information that reveals a consumer's social security, driver's license, state identification card, or passport number; personal information that reveals a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; personal information that reveals a consumer's precise geolocation; personal information that reveals a consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership; personal information that reveals the contents of a consumer's mail, email, and text messages unless we are the intended recipient of the communication; personal information that reveals a consumer's genetic data; the processing of biometric information for the purpose of uniquely identifying a consumer; personal information collected and analyzed concerning a consumer's health; personal information collected and analyzed concerning a consumer's sex life or sexual orientation, and data related to citizenship or immigration status.
   • Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

   • Personal information does not include:

     • Publicly available information.
     • Lawfully obtained, truthful information that is a matter of public concern.
     • Deidentified or aggregated consumer information.
     • Information excluded from the CCPA's scope, such as certain health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data, and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act (GLBA), or the California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

2. Categories of Sources from Which Personal Information Is Collected.

   • You. We may collect your personal information when you contact or communicate with us, interact with our chatbot or website or mobile application, input information on forms provided by us on our website, submit applications and forms provided by us, submit an application for employment, or during the employment relationship.
   • News outlets.
   • Social media and related services. We may collect information about you through your social media services consistent with your settings on those services.
   • Third Parties. We may collect information about you from third-party sources that are lawfully entitled to share your data with us including your representative or authorized agent, financial institutions (e.g., for linking accounts), our affiliates, credit bureaus, and service providers that collect information or services on our behalf.
   • Information Collected Indirectly or Automatically. As you navigate through and interact with our Site, we may compile statistical information concerning your usage of the Site. To do so, we may collect certain information about your equipment, IP address or browsing actions and patterns. We may also collect your mobile device's GPS signal.

3. Business or Commercial Purposes for Which We Collect Your Personal Information. See “Use of Your Personal and Sensitive Information” above.

4. Disclosing Personal Information.

   In general, we will not disclose your personal information except with your consent and as described in this Policy and our GLBA Privacy Notice. We may disclose your personal information for the same reasons that we may use it, as described in this Policy, which includes disclosing it to our affiliates and non-affiliates, as we deem necessary to carry out those purposes. We endeavor to choose affiliates and non-affiliates whose standards for the protection of data match ours. We may or have disclosed the following categories of personal information to services providers and contractors in the preceding 12 months:

   • Identifiers and personal information described in subdivision (e) of California Civil Code Section 1798.80
   • Characteristics of protected classifications under California or federal law
   • Commercial information
   • Internet or other electronic network activity information
   • Geolocation data
   • Audio, electronic, visual, thermal, olfactory, or similar information
   • Professional or employment-related information
   • Education Information
   • Sensitive personal information
   • Inferences

5. Selling or Sharing Personal Information.

   • We do not sell or share your PI as those terms are defined in the CCPA.
   • We do not have actual knowledge that we have sold or shared personal information of minors under age 16.
   • Because we do not sell or share your PI as those terms are defined in the CCPA, we do not process opt-out preference signals.

6. Sensitive Personal Information.

   We do not use or disclose your sensitive personal information for purposes other than those specified in Section 7027(m) of the California Consumer Privacy Act Regulations. We may only disclose your sensitive personal information as follows:

   • To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
   • To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
   • To resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions.
   • To ensure the physical safety of natural persons.
   • For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer's current interaction with us, provided that the personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer's experience outside the current interaction with us.
   • To perform services on our behalf.
   • To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us.
   • To collect or process sensitive personal information where the collection or processing is not for the purpose of inferring characteristics about a consumer.

7. Consumer Rights. The CCPA provides California consumers with the following rights, subject to certain exceptions:

   Right to Request Deletion

   You have the right to request that we delete your PI from our records, subject to certain exceptions.

   Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will delete and direct any service providers, contractors, and third parties to delete your PI from their records.

   CEFCU is not required to comply with your request to delete your PI if it is necessary for CEFCU (or its service provider) to maintain your PI to:

   • Complete the transaction for which the PI was collected, provide a good or service requested by you, or reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform a contract between CEFCU and you.
   • Help to ensure security and integrity to the extent the use of the consumer's PI is reasonably necessary and proportionate for those purposes.
   • Debug to identify and repair errors that impair existing intended functionality.
   • Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
   • Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
   • Engage in public or peer-reviewed scientific, historical, or statistical research that confirms or adheres to all other applicable ethics and privacy laws, when CEFCU's deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if you have provided informed consent.
   • To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with CEFCU and compatible with the context in which the consumer provided the information.
   • Comply with a legal obligation.

   Right to Know

   You have the right to request that we disclose the following to you as it relates to the 12-month period preceding CEFCU's receipt of your verifiable consumer request (see below):

   • The categories of PI we have collected about you.
   • The categories of sources from which the PI was collected.
   • The business or commercial purpose for collecting, selling, or sharing PI.
   • The categories of PI we disclosed or sold for a business purpose.
   • The categories of third parties we disclosed PI to, by the category of PI.
   • The specific pieces of PI we collected about you.

   Right to Request Correction

   You have the right, subject to certain limitations, to request that we correct any inaccurate personal information we maintain about you. Upon receipt of a verifiable consumer request, and as required by the CCPA, we will take appropriate steps to respond to your request.

   Right to Withdraw Your Consent

   In the limited circumstances where we process your personal information in reliance on your affirmative consent, you may freely withdraw that consent at any time.

   We will not retaliate against you for the exercise of privacy rights conferred by the CCPA.

8. Submitting Consumer Rights Requests

   To exercise the rights described in this CCPA Section, please submit a verifiable consumer request to us by either calling us at 1-888-556-7376 or by visiting https://www.cefcu.com/forms/contact/ccpa.

   Verifiable Consumer Requests

   We reserve the right to only respond to verifiable consumer requests. A verifiable consumer request is one made by any individual who is:

   • the consumer who is the subject of the request,
   • a consumer on behalf of the consumer's minor child, or
   • by a natural person or person registered with the California Secretary of State authorized to act on behalf of a consumer.

   If we request, you must provide us with sufficient information to verify your identity and/or authority to act on behalf of a consumer. In general, we may ask you to provide identifying information that we already maintain about you or we may use a third-party verification service. In either event, we will try to avoid asking you for sensitive PI to verify your identity. We may not be able to respond to your request or provide you with PI if we cannot verify your identity or authority to make the request and confirm the PI relates to you. However, making a verifiable consumer request does not require you to create an account with us.

   Additionally, you will need to describe your request with sufficient detail to allow us to review, understand, assess, and respond. We will not use the PI we collect from an individual to determine a verifiable consumer request for any other purpose, except as required by law.

   We reserve the right to charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will attempt to notify you as to why we made that decision and provide a cost estimate before completing your request. We will attempt to respond to a verifiable consumer request within forty-five (45) days of receipt, but we may require up to ninety (90) days to respond, under which circumstances we will notify you of the need for an extension.

   If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the receipt of your verifiable consumer request. With respect to Personal Information collected on and after January 1, 2022, and to the extent expressly permitted by applicable regulation, you may request that such disclosures cover a period beyond the 12 months referenced above, provided doing so would not be impossible or require a disproportionate effort by us. The response we provide will also explain the reasons we cannot comply with a request, if applicable. To the extent permitted by the CCPA, we will respond to no more than two requests during any 12-month period.

   Authorized Agents

   You may authorize a natural person or a business registered with the California Secretary of State to act on your behalf with respect to your rights under this CCPA Section. Unless you have provided the authorized agent with a qualifying power of attorney, you must provide your authorized agent written permission (signed by you) to act on your behalf, and we may require you to verify your identity directly with us or directly confirm with us that you provided the authorized agent permission to act on your behalf. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on the Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions regarding this Policy or the privacy of your personal information, please contact us at:

Phone: 1-888-556-7376
Postal Address:
Citizens Equity First Credit Union
Compliance Department
P.O. Box 1715
Peoria, IL 61656-9989