California Consumer Privacy Rights Notice

 
 

Additional Notice for California Residents

At Popular, Inc, we are mindful of our responsibilities under the California Consumer Privacy Act (“CCPA”) (Cal. Civ. Code § 1798.100 et seq.) regarding your personal information. This disclosure applies only to California residents who are subject to the CCPA as it pertains to the categories of personal information we may collect, the sources from which we collect it, and the ways in which we use and disclose it.

CCPA does not apply to personal information about California residents collected pursuant to Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulation. For more details on why, what, and how we collect your personal information subject to the standards of GLBA, and what we do with it, please refer to our privacy policy here.

How We Collect, Use, and Share Personal Information

1. Personal Information Collected in the Last Twelve Months

We collect information from consumers who are California residents in accordance with our Privacy Policy. In particular, we have collected the following categories of “Personal Information,”1 as such term is defined in California Civil Code § 1798.140(o), from California residents within the last twelve months:

  1. Identifiers: Includes a real name, postal address, email address, unique personal identifier, online identifier, token identifier, account name, social security number, driver’s license number, passport number, other government issued number. All of these would be collected when and to the extent that you provide it to us to create an account with us, purchase our products, interact with us on social media, or sign up to learn more about our products and services.
  2. Personal Information in Customer Records: Includes any information that identifies, relates to, describes, or is capable of being associated with a particular consumer or household, including, the “identifiers” listed in (A), and the following: signature, physical characteristics or description, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information when and to the extent that you provide it to us when you create an account or purchase any of our products or services.
  3. Protected Classification Characteristics: Includes the following categories protected under California or federal law: date of birth/age (40 and over), gender, race, color, national origin, citizenship, marital status, physical or mental disability, veteran or military status, religion or creed, medical condition, pregnancy or childbirth and related medical conditions, sexual orientation, genetic information (including familial genetic information), when and to the extent that you provide it to us.
  4. Commercial Information: Includes records of our products or services that you have purchased, obtained, or considered.
  5. Internet or other similar Network Activity Information: Includes, but is not limited to, browsing history on our websites, search history, information on a consumer’s interaction with our websites or applications.
  6. Geolocation Data: Includes information such as physical location or movements.
  7. Sensory Data: Includes audio information such as recordings of when you called into our customer service line; visual recordings or images such as the ones obtained through Closed-Circuit Television (CCTV) at our local branches or other premises; and electronic information in the form of Internet or other electronic network activity information, as described above.
  8. Professional or Employment-Related Information: Includes current or past professional or employment-related information, including job history, performance evaluations, position details, or references.
  9. Non-Public Education Information: Includes education information and qualifications that are not publicly available.
  10. Inferences drawn from other Personal Information: Includes information such as profiles reflecting a person’s preferences, behavior, attitudes, abilities, and aptitudes.

For each of these categories, we obtain your Personal Information from a variety of sources, including from:

  • Our customers and consumers, with respect to both online and offline interactions you may have with us or our service providers and other entities with whom you transact;
  • others with whom you maintain relationships who may deal with us on your behalf;
  • the devices you use to access our websites, mobile applications, and online services;
  • credit bureaus;
  • identity verification and fraud prevention services;
  • marketing and analytics providers;
  • public databases;
  • social media platforms; and
  • other sources consistent with this Privacy Policy.

Please note that Personal Information does not include:

  • publicly available information from government records,
  • de-identified or aggregated consumer information, and
  • Personal Information covered by certain sector-specific, federal or state privacy laws.

2. Our Use of Personal Information for Business Purposes in the Last Twelve Months

We use the Personal Information we collect, as identified in the categories listed in Section 1 above, for the business purposes listed below:

  1. Financial, Legal and Compliance Management: Audits, accounting, and supporting our everyday operations, including to meet risk, legal, and compliance requirements;
  2. Fraud Prevention: Reporting relating to particular transactions and interactions, including online interactions, you may have with us or others on our behalf;
  3. Security: Detecting and protecting against security incidents, and malicious, deceptive, fraudulent or illegal activity, and prosecuting the same;
  4. IT Operations: Debugging to identify and repair errors in our systems;
  5. Customer Services: Providing services on your or our behalf, or on behalf of another, including maintaining or servicing accounts, providing customer service, fulfilling transactions, verifying identity information, processing payments, and other services;
  6. Research: Conducting internal research to develop and improve technology;
  7. Improving Products and Services: Conducting activity to verify, enhance, and maintain the quality or safety of services or devices which we may own, control, or provide;
  8. Operation of our Sites: Preparing statistics and performing analysis to support our operations;
  9. Marketing/Prospecting: Short-term, transient use, including contextual customization of ads; conducting marketing and surveys regarding our products and services; and
  10. Legal Proceedings: Receiving and responding to law enforcement requests and as required by applicable law, court order, or governmental regulations.

We may also use the Personal Information we collect for:

  • other operational processes,
  • purposes for which we provide you additional notice, or
  • purposes compatible with the context in which the Personal Information was collected.

3. Sharing of Personal Information in the Last Twelve Months

  1. Disclosures of Personal Information on California Consumers for Business Purposes

    Within the last twelve months, we have disclosed Personal Information identified in Section 1 above only at your express request, for exempt activities such as transactions subject to GLBA and our business-to-business activities, or for the business purposes described above.

    For more information on the service providers with whom we share information, please see Reasons we can share your personal information.

    Whenever we disclose Personal Information for a business purpose, we execute a contract that describes such purpose and requires the recipient to keep the Personal Information confidential and prohibit its use for any purpose other than to perform the obligations under the contract.

  2. No Sale of Personal Information

    We do not engage in the sale of the Personal Information within the meaning of the CCPA. As noted elsewhere in this disclosure, we share personal information with other businesses for a variety of reasons. While we often benefit from such exchanges, we do not share personal information for the sole purpose of receiving compensation for that information.


Privacy Rights and Choices for California Residents

If you are a California resident, you may have certain rights related to your Personal Information under the CCPA. You may exercise these rights free of charge except as otherwise provided by applicable law. We will endeavor to respond to your request promptly upon verification and as required by applicable law.

As required under applicable law, we take steps to verify your identity before granting you access to information or acting on your request to exercise your rights. We may require you to provide information sufficient to allow us to reasonably verify you are the person about whom we collected Personal Information, or an authorized agent, and to describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it. For example, we may request that you provide contact details to be verified with the email address recorded in our files (and subsequently verified by you). We may limit our response to your exercise of the above rights as permitted under applicable law.

1. Right to Know / Portability

You have the right to request that we disclose to you, in connection with our activities in the last twelve (12) months:

  • Specific pieces of Personal Information we have collected about you;
  • Categories of Personal Information we have collected about you;
  • Categories of sources from which the Personal Information was collected;
  • Our business or commercial purpose for collecting Personal Information;
  • Categories of third parties with whom we have shared Personal Information; and
  • Categories of Personal Information that we have disclosed for a business purpose, if any.
  • You also have the right to obtain copies of your Personal Information in a readily usable format.

2. Right to Deletion

You have the right to request that we delete (and direct our service providers to delete) Personal Information we have collected about you and retained, subject to certain exceptions. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

  • complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
  • detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
  • debug products to identify and repair errors that impair existing intended functionality;
  • exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
  • comply with the California Electronic Communications Privacy Act;
  • engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
  • enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
  • comply with a legal obligation; or
  • make other internal and lawful uses of that information that are compatible with the context in which you provided it.

3. Right to Opt-Out

You have the right to direct us to not sell your Personal Information. Please note that Popular does not offer a right to opt-out because we do not engage in the sale of Personal Information as contemplated by the CCPA.

4. Right to Non-Discrimination for Exercising a California Privacy Right

We will not discriminate against you because of your exercise of any of the above rights, or any other rights under the CCPA. This means that we may not deny you goods or services, charge you different prices or rates for services or provide you with a different level or quality of services (or suggest that we will do so), in response to a request made under the CCPA.

We may, however, charge different prices or rates, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by your Personal Information.

5. How to Submit a Request

To exercise one or more of the above rights, you or someone you authorize, may submit a request by:


6. Agent Authorization

You may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. As permitted by law, we may require additional information to prove your agent’s relationship to you. We may refuse a request if the agent does not provide adequate proof of their authorization. You may also make a verifiable consumer request on behalf of your minor child, but you must also provide proof that you are that child’s parent or legal guardian.

Other California Privacy Rights

7. California “Shine the Light” Law (Civil Code Section § 1798.83)

Under the Shine the Light Law, a California resident may ask us to refrain from sharing your Personal Information with third parties for their direct marketing purposes. We do not share Personal Information of California Consumers with third parties for their marketing purposes.

Contact Information Regarding this California Notice

You may contact us with questions or concerns about our privacy policies or practices and your choices and rights under California law by:


You must put the statement “Your California Privacy Rights” in the body of your request, as well as your name, address and email address, phone number and alternate phone number. Please note that we will not accept status inquiries via email or by facsimile, and we are not responsible for notices that are not labeled or sent properly, or that do not have complete information.