Crest may collect personal information that identifies, relates to, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with particular consumers, households or devices, including you and persons other than the individual(s) proposed for coverage (“Personal Information”). Personal Information does not include publicly available information from government records, deidentified or aggregated consumer information, and certain information protected by other specific federal or state statutes including, but not limited to, the Gramm-Leach-Bliley Act (GLBA) or California’s Insurance Information and Privacy Protection Act (IIPPA).
We may share your Personal Information by disclosing it to a third party for permitted business purposes. In particular, we may have collected and shared the following categories or types of Personal Information from consumers with the following categories or types of third parties (“business purpose disclosures”) within the last twelve (12) months:
Category or Type | Examples | Collected | Business Purpose Disclosures |
---|---|---|---|
A. Identifiers | A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, date(s) of birth, or other similar identifiers. | YES | Insurance companies and third-party agents/brokers; vendors we engage in connection with our services; our affiliates in connection with services provided to you or in which you have expressed an interest |
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) | A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. | YES | Insurance companies and third-party agents/brokers; vendors we engage in connection with our services |
C. Protected classification characteristics under California or federal law | Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). | YES | |
D. Commercial information | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | YES | Insurance companies and third-party agents/brokers; vendors we engage in connection with our services |
E. Biometric information | Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. | NO | |
F. Internet or other similar network activity | Internet or other similar network activity Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. | YES | Vendors who provide support in operating, assessing and to improve the performance of our Site |
G. Geolocation data | Physical location or movements. | NO | |
H. Sensory data | Audio, electronic, visual, thermal, olfactory, or similar information. | YES | Insurance companies and third-party agents/brokers; vendors we engage in connection with our services |
I. Professional or employment-related information | Current or past job history or performance evaluations. | YES | Insurance companies and third-party agents/brokers; vendors we engage in connection with our services |
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)) | Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. | YES | Insurance companies and third-party agents/brokers; vendors we engage in connection with our services |
K. Inferences drawn from other personal information | Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | NO |
Crest may receive the categories of Personal Information listed above about you and other individuals proposed for coverage from the following sources:
• Directly from you, including, but not limited to: when you request a quote; through applications or other forms and records received by us (for example, we may ask you to provide Personal Information to us when you enroll for insurance coverage and when you purchase an insurance policy through us); through insurance transactions you conduct with us or our affiliates (for example, we may ask you to provide Personal Information to us when you conduct insurance business with us or our affiliates through postal mail, telephonically, electronically or by other means); through claims information you provide in the event of a claim; through consumer reporting agencies; and when you interact with us on social media platforms such as Facebook and Twitter.
• Indirectly from you and other consumers through your use of the Site, such as from observing your actions on our Website (the “Site”). This information may include the type of device you are using, your IP address, the pages you visit while navigating the Site, and how long you visit certain pages. This information is collected for a variety of purposes, including enhancing or improving the Site or the services we offer to you
Crest may use the Personal Information collected about you for one or more of the following purposes:
• Fulfill the reason you provided the Personal Information
• Underwrite, sell, solicit, and negotiate insurance products and services.
• Provide you with support and respond to inquiries.
• Contact you regarding your account, your orders, upcoming and/or failed payments, renewals and endorsements, or for any other important reason.
• Provide you with a requested quote or offer goods and services of a third party vendor.
• Determine eligibility and process applications for products and services.
• Inform you with products and services we may offer.
• Communicate, create, service, secure and bill accounts or clients.
• Obtain and update insurance or credit information with appropriate third parties, such as credit reporting agencies.
• Monitor and administer accounts and the services thereto.
• Process requests, purchases, transactions and payments and prevent transactional fraud.
• Fulfill contractual obligations.
• Comply with or satisfy a legal or regulatory requirement.
• Fulfill or meet any other reasons you provided the information.
• Fulfill any additional commercial purposes, with your consent as required by law.
• Provide, support, personalize and develop our Site, products and services.
• Enhance or improve the Site or the services we offer to you.
• Help maintain the safety, security and integrity of our Site, products and services, databases and other technology assets, and business.
We do not sell Personal Information to any third parties and have not done so in the preceding twelve (12) months.
Deidentified Patient Information
We may use or disclose de-identified information exempt from the CPPA to third parties for commercially legitimate business purposes.
Your Rights and Choices
The CCPA provides consumers (California residents) with specific rights regarding their Personal Information. This section describes your CPPA rights and explains how to exercise those rights.
Right to Know and Data Portability
You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past twelve (12) months (the “right to know”). Once we receive your request and confirm your identity, we will disclose to you:
Right to Request Deletion
You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions (the “right to delete”). Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
We will delete or deidentify Personal Information not subject to one of these exceptions from our records and will direct our service providers to take similar action.
Exercising Your Rights to Know or Delete
To exercise your rights to know or delete described above, please submit a request by either:
Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your Personal Information. To designate an authorized agent, you must provide the authorized agent with a signed permission to make the request, directly verify their own identity with Crest and directly confirm to Crest that they are an authorized agent.
You may also make a request to know or delete on behalf of your child by signing and returning a consent form to Crest.
You may only submit a request to know twice within a 12-month period. Your request to know or delete must:
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.
You do not need to create an account with us to submit a request to know or delete, although we may communicate with you about your request through a pre-established account, if applicable. However, in order to safeguard the personal information in our possession, if we cannot verify your identity or authority to act on another’s behalf, we will be unable to comply with your request. We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make it.
Response Timing and Format
We will confirm receipt of your request within ten (10) business days. Please contact us if you do not receive confirmation within the 10-day timeframe.
We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.
If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Personal Information Sales Opt-Out and Opt-In Rights
If you are age 16 or older, you have the right to direct a business that sells your personal information to third parties not to sell your personal information (the “right to opt-out”). Because we do not sell your personal information, we do not provide any mechanism for you to exercise the right to opt out.
Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
Minors
We do not knowingly collect online information from children under the age of 13. If we are notified that we have collected personal information of a child under the age of 13 as defined by the Children’s Online Privacy Protection Act (“COPPA”), we will delete the information as quickly as possible. We never sell the personal information of minors under 16 years of age and would not do so in the future without affirmative authorization of the consumer if between 13 to 16 years of age, or the parent or guardian of a consumer less than 13 years of age.
Changes to This Privacy Notice
We reserve the right to amend or change this Notice at our discretion and at any time. When we amend or make changes to this Notice, we will post the updated notice on our Site and update the notice’s effective date. Any changes will be effective immediately upon the posting of the revised Notice unless otherwise specified. Your continued use of the Site after the posting of amendments or changes constitutes your consent to and acceptance of those changes.
Contact Us
If you have any questions about this Notice, the ways in which Crest collects and uses your information described here, our privacy practices, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at: 1-888-881-5765; info@crestins.com