On January 1, 2020, the California Consumer Privacy Act of 2018 (CCPA) became operative. Under the CCPA, covered businesses that collect the personal information of California residents must provide notice regarding their data collection and sharing practices. In addition, the CCPA confers upon California residents the right to make certain requests with respect to their data.

The specific Personal Information that we collect, use, and disclose relating to a California resident covered by the CCPA will vary based on our relationship or interaction with that individual. For example, this Disclosure does not apply with respect to information that we collect about California residents who apply for or obtain our financial products and services for personal, family, or household purposes (i.e., information subject to the Gramm-Leach-Bliley Act (“GLBA”)). For more information about how we collect, disclose, and secure information relating to these customers, please refer to our Consumer Privacy Policy.

Keeping Personal Information secure is one of our most important priorities. Consistent with our obligations under applicable laws and regulations, we maintain physical, technical, electronic, procedural, and organizational safeguards and security measures that are designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access, whether it is processed by us or elsewhere.

Collection and Disclosure of Personal Information

In the past 12 months, we have collected the following categories of Personal Information about California residents:

  • identifiers, such as name and government-issued identifier (e.g., Social Security Number);
  • personal information, as defined by Cal. Civ. Code § 1798.80, such as contact information or financial information;
  • certain characteristics, such as sex and marital status;
  • commercial information, such as transaction information and purchase history;
  • biometric information, such as fingerprints and voiceprints;
  • internet or network activity information, such as browsing history and interactions with our website, applications, and emails;
  • geolocation data, such as device location and Internet Protocol (IP) location;
  • audio, electronic, visual, and similar information, such as call and video recordings;
  • professional and employment-related information, such as work history and prior employer;
  • education information; and
  • inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s preferences and characteristics.

We collected such Personal Information from the following sources:

  • Directly from California residents or their representatives;
  • Service providers, consumer data resellers, and other third parties;
  • Public record sources (federal, state, or local government sources);
  • Affiliates;
  • Website/mobile app activity/social media; and
  • Institutions from consumer-directed third parties or institutions representing a consumer/prospect.

We have disclosed some of the above categories of Personal Information for business purposes to the following third parties:

  • Our affiliates and subsidiaries, including Navy Federal Financial Group;
  • Vendors and service providers that provide services to Navy Federal such as website hosting, data analysis, payment processing, information technology and related infrastructure, fraud prevention and data security, customer service, and marketing activities;
  • Other third parties authorized by our members to access their personal information, such as data aggregators, and those authorized to conduct transactions online and via mobile devices, and to support loan fulfillment services; and
  • Government entities as required by laws and regulations.

Use of Personal Information

In the past 12 months, we have used Personal Information relating to California residents for one or more of the following business purposes:

  • Performing services and offering products, including maintaining or servicing accounts, providing member service, and processing transactions;
  • Engaging in advertising or marketing activities;
  • Preventing, detecting, and responding to security incidents;
  • Undertaking activities, including internal research and analysis, to derive consumer insights and to maintain or enhance the quality of our products and services;
  • Maintaining the integrity and the functionality of our information technology systems; and
  • Complying with legal requirements.

Sale of Personal Information

It is Navy Federal’s policy not to sell Personal Information, and we have not done so in the past 12 months. Because Navy Federal does not sell your Personal Information, we do not offer an opt-out under the CCPA.

Rights Under the CCPA

If you are a California resident, you have the right to:

  1. request that we disclose to you the following information covering the 12 months preceding your request (“request to know”):

    • the categories of Personal Information that we collected about you and the categories of sources from which we collected such Information;
    • the business or commercial purpose for collecting Personal Information about you;
    • the categories of Personal Information about you that we disclosed to third parties for a business purpose and the categories of third parties to whom we disclosed such Personal Information; and
    • the specific pieces of Personal Information we collected about you.
  2. request that we delete Personal Information that we collected from you, subject to applicable exceptions (“request to delete”). As stated above and in our Online Privacy Policy, we do not sell your Personal Information.
  3. be free from unlawful discrimination for exercising your rights under the CCPA.

Authorized Agents

You also have the right to use an authorized agent to make a request under the CCPA on your behalf. California residents who have a relationship with Navy Federal may rely on a valid general power of attorney already on file that appoints the Authorized Agent as Attorney-in-Fact. California residents who do not have a valid general power of attorney already on file, or do not have a relationship with Navy Federal, must designate their authorized agent using the limited CCPA Power of Attorney Form.

Parents/legal guardians making requests on behalf of their minor children will need to complete the Parent/Legal Guardian Cover Sheet and include a certified copy of the birth certificate or legal document to provide proof of their status.

Completed limited CCPA POA Forms and Parent/Legal Guardian Cover Sheets may either be:

  1. mailed to Navy Federal Credit Union, P.O. Box 2464, Merrifield, VA 22116-2464; or
  2. dropped off at a Navy Federal branch located in California.

How to Make Requests

If you are a California resident (or an authorized agent thereof), you may make a request for the disclosures described above or make a request to delete Personal Information we collected from you using one of the below methods. Please read each description carefully, since some methods have limited eligibility.

  1. Using our online portal. This method is only available for those with a relationship with Navy Federal (e.g., members, authorized users, or joint owners of deposit accounts) and online banking credentials. You may submit a request for yourself or on behalf of someone else if that person also has a relationship with Navy Federal.
  2. Calling us toll-free at 1-888-842-6328. This method is only available if you or the person on whose behalf you are acting has a relationship with Navy Federal.
  3. In-person at a Navy Federal branch located in California. (Branch Locator). You may use this method whether or not you have a relationship with Navy Federal.
  4. Mail a notarized copy to Navy Federal Credit Union, P.O. Box 2464, Merrifield, VA 22116-2464. You may use this method whether or not you have a relationship with Navy Federal.

Use the downloadable/printable version of our CCPA Request Form to make requests by mail or in-person.

Verification Process

Upon submission of your request, we will take steps to verify your identity and, if applicable, the authorized agent. Those steps may vary, however, depending on your relationship with Navy Federal and the intake method.

Further, in rare cases we may require you to visit a Navy Federal branch or acknowledge your identity before a notary public. If required for CCPA purposes, Navy Federal branches located in California that offer notary services will do so free of charge.

Responses

We will work to process all verified requests within 45 days. If we need an extension in order to process your request, we will reach out to you.

In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or confirm that the Personal Information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. Additionally, we may not honor your request where an exception applies, such as where the disclosure of Personal Information would adversely affect the rights and freedoms of another individual or where the Personal Information that we maintain about you is not subject to the CCPA’s rights.

We will advise you in our response if we are not able to honor your request. We will not provide Social Security Numbers, driver’s license numbers or government-issued identification numbers, financial account numbers, healthcare or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

Contact for More Information

For any questions or concerns regarding the CCPA or Navy Federal’s CCPA request process, please call us at 1-888-842-6328.

Date Last Updated: June 26, 2020

Disclosures