Crest Insurance Group dba Crest Insurance Agency CCPA Privacy Notice

  • Effective Date: January 1, 2023
  • Last updated on April 4, 2023
PURPOSE

These California Resident Privacy Notice terms and conditions (“Notice”) are effective January 1, 2023, with data collected from January 1, 2022, subject to compliance, and supplement the information contained in Crest Insurance Group dba Crest Insurance Agency’s (“Crest”) Privacy Policy, accessible on our website (“Site”) at https://www.crestins.com/privacy-policy/, and applies solely to consumers and all visitors, users and others who reside in the State of California (hereafter “consumers” or “you”). As this Notice is adopted to comply with the CCPA and CPRA, any terms defined in the CCPA and CPRA have the same meaning when used in this Notice.

Collection and Sharing of Personal Information

Crest may collect your personal information that identifies, relates to, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with particular consumers, households or devices, including you and persons other than the individual(s) proposed for coverage (“Personal Information”). Personal Information does not include publicly available information from government records, deidentified or aggregated consumer information, and certain information protected by other specific federal or state statutes including, but not limited to, the Gramm-Leach-Bliley Act (GLBA) or California’s Insurance Information and Privacy Protection Act (IIPPA).

We may share your Personal Information by disclosing it to a third party for permitted business purposes. In  particular, we may have collected and shared the following categories or types of Personal Information from consumers with the following categories or types of third parties (“business purpose disclosures”) within the last twelve (12) months:

 

Category or TypeRetention PeriodCollectedBusiness Purpose Disclosures
A. Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, date(s) of birth, or other similar identifiers.Up to 5 years (or as otherwise required by applicable state or federal laws)YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services; our affiliates in connection with services provided to you or in which you have expressed an interest
B.

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.

Up to 5 years (or as otherwise required by applicable state or federal laws)YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
C. Protected classification characteristics under California or federal law, such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).Up to 5 years (or as otherwise required by applicable state or federal laws)YES 
D. Commercial information, such as records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.Up to 5 years (or as otherwise required by applicable state or federal laws)YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
E.

Biometric information, such as genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Not ApplicableNO 
F. Internet or other similar network activity, such as browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.Up to 3 yearsYESVendors who provide support in operating, assessing and to improve the performance of our Site
G. Geolocation data, such as physical location or movements.Not ApplicableNO 
H. Sensory data, such as audio, electronic, visual, thermal, olfactory, or similar information.Up to 5 years (or as otherwise required by applicable state or federal laws)YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
I. Professional or employment-related information, such as current or past job history or performance evaluations. This does not apply to employees or independent contractors of Crest.Up to 5 years (or as otherwise required by applicable state or federal laws)YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
J.

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)), such as education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Up to 5 years (or as otherwise required by applicable state or federal laws)YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
K.

Inferences drawn from other personal information, such as profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Not ApplicableNO 

Sensitive Personal Information (“SPI”) is a subtype of Personal Information consisting of specific information categories. SPI has the same meaning as under CPRA Section 1798.140(ae). SPI does not include information that is publicly available. While we may collect SPI that falls within the Personal Information categories listed in the table above, the CCPA does not treat this information as sensitive because we do not collect or use it to infer characteristics about a person.

Crest may receive the categories of Personal Information or SPI listed above about you and other individuals proposed for coverage from the following sources:

  • Directly from you, including, but not limited to: when you request a quote; through applications or other forms and records received by us (for example, we may ask you to provide Personal Information to us when you enroll for insurance coverage and when you purchase an insurance policy through us); through insurance transactions you conduct with us or our affiliates (for example, we may ask you to provide Personal Information to us when you conduct insurance business with us or our affiliates through postal mail, telephonically, electronically or by other means); through claims information you provide in the event of a claim; through consumer reporting agencies; and when you interact with us on social media platforms such as Facebook and Twitter.
  • Indirectly from you and other consumers through your use of the Site, such as from observing your actions on our Site. This information may include the type of device you are using, your IP address, the pages you visit while navigating the Site, and how long you visit certain pages. This information is collected for a variety of purposes, including enhancing or improving the Site or the services we offer to you.

Data Retention

Various federal and state laws require Crest to maintain certain types of company records and data for a specific period of time. Company records and data may include, but are not limited to, data, documents, and records produced or received by Crest in any medium and form. Crest establishes the foregoing retention schedules to ensure legal compliance and accomplish other legitimate business or legal objectives. These schedules are general guidelines and may be superseded by applicable laws in certain circumstances.

In addition to the foregoing, company data that is reasonably calculated to lead to the discovery of admissible evidence in litigation or potential litigation (i.e., a dispute that could result in litigation) may be subject to a “litigation hold” and must be preserved until Crest determines the data is no longer needed. The litigation hold exception supersedes any previously or subsequently established destruction schedule for company data.

Use of Personal Information

Crest may use the Personal Information collected about you for one or more of the following purposes:

  • Fulfill the reason you provided the Personal Information
  • Underwrite, sell, solicit, and negotiate insurance products and services.
  • Provide you with support and respond to inquiries.
  • Contact you regarding your account, your orders, upcoming and/or failed payments, renewals and endorsements, or for any other important reason.
  • Provide you with a requested quote or offer goods and services of a third party vendor.
  • Determine eligibility and process applications for products and services.
  • Inform you with products and services we may offer.
  • Communicate, create, service, secure and bill accounts or clients.
  • Obtain and update insurance or credit information with appropriate third parties, such as credit reporting agencies.
  • Monitor and administer accounts and the services thereto.
  • Process requests, purchases, transactions and payments and prevent transactional fraud.
  • Fulfill contractual obligations.
  • Comply with or satisfy a legal or regulatory requirement.
  • Fulfill or meet any other reasons you provided the information.
  • Fulfill any additional commercial purposes, with your consent as required by law.
  • Provide, support, personalize and develop our Site, products and services.
  • Enhance or improve the Site or the services we offer to you.
  • Help maintain the safety, security and integrity of our Site, products and services, databases and other technology assets, and business.

 

We do not sell Personal Information to any third parties and have not done so in the preceding twelve (12) months.

 

Deidentified Patient Information

We may use or disclose de-identified information exempt from the CPPA to third parties for commercially legitimate business purposes.

Your Rights and Choices

California law provides some California residents with specific rights regarding their Personal Information as described below, subject to certain exceptions.

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past twelve (12) months (the “right to know”).  Once we receive your valid request and confirm your identity, we will disclose to you:

  • The categories of Personal Information we collected about you.
  • The categories of sources for the Personal Information we collected about you.
  • Our business or commercial purpose for collecting or selling that Personal Information.
  • The categories of third parties with whom we share that Personal Information.
  • If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
    • sales, identifying the Personal Information categories that each category of recipient purchased; and
    • disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
  • The specific pieces of Personal Information we collected about you.

Right to Request Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions (the “right to delete”).  Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies.  We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

  • Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or recall conducted in accordance with federal law, or otherwise perform our contract with you.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify Personal Information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Right to Correct Inaccurate Personal Information

You have the right to request that we correct inaccurate Personal Information that we maintain about you. If you submit a valid and verifiable request and we can confirm your identity and/or authority to make the request, we will use commercially reasonable efforts to correct inaccurate personal information, as directed.

Personal Information Sales Opt-Out and Opt-In Rights

If you are a California resident age 16 or older, you have the right to direct a business that sells or shares your Personal Information to third parties not to sell or share your Personal Information (the “right to opt-out”).  If you submit a valid request and we confirm your identity and/or authority to make the request, we will cease selling or sharing your personal data.  Because we do not sell your Personal Information for monetary compensation or other valuable consideration, we do not provide any mechanism for you to exercise the right to opt out for these activities.

Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right, at any time, to request that we limit the use of your SPI that we maintain about you to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services and to perform services on behalf of the business.  As a result, we provide you with the option to limit the use and/or disclosure of your SPI.  If you submit a valid and verifiable request and we can confirm your identity and/or authority to make the request, we will use commercially reasonable efforts to limit the use of your sensitive personal information.

Exercising Your Rights

To exercise your rights to know, access, delete, correct, or limit use described above, please submit a request by either:

Only you, or someone legally authorized to act on your behalf, may make a request to know, access, delete, correct, or limit use related to your Personal Information or SPI, as the case may be.  To designate an authorized agent, you must provide the authorized agent with a signed permission to make the request, directly verify their own identity with Crest and directly confirm to Crest that they are an authorized agent.

You may also make a request to know, access, delete, correct, or limit use on behalf of your child by signing and returning a consent form to Crest.

You may only submit a request to know twice within a 12-month period. Your request to know, access, delete, correct, or limit use must:

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or SPI or an authorized representative, as described above.
  • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information or SPI if we cannot verify your identity or authority to make the request and confirm the Personal Information or SPI relates to you.

You do not need to create an account with us to submit a request to know, access, delete, correct, or limit use, although we may communicate with you about your request through a pre-established account, if applicable. However, in order to safeguard the Personal Information in our possession, if we cannot verify your identity or authority to act on another’s behalf, we will be unable to comply with your request. We will only use Personal Information or SPI provided in the request to verify the requestor’s identity or authority to make it.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days.  Please contact us if you do not receive confirmation within the 10-day timeframe.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt.  If we require more time, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account.  If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.  For data portability (access) requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.  If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.  Unless permitted by the CCPA, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Minors

We do not knowingly collect online information from children under the age of 13. If we are notified that we have collected personal information of a child under the age of 13 as defined by the Children’s Online Privacy Protection Act (“COPPA”), we will delete the information as quickly as possible.  We never sell the personal information of minors under 16 years of age and would not do so in the future without affirmative authorization of the consumer if between 13 to 16 years of age, or the parent or guardian of a consumer less than 13 years of age.

Changes to This Privacy Notice

We reserve the right to amend or change this Notice at our discretion and at any time.  When we amend or make changes to this Notice, we will post the updated notice on our Site and update the notice’s effective date.  Any changes will be effective immediately upon the posting of the revised Notice unless otherwise specified. Your continued use of the Site after the posting of amendments or changes constitutes your consent to and acceptance of those changes.

Contact Us

If you have any questions about this Notice, the ways in which Crest collects and uses your information described here, our privacy practices, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at: 1-888-881-5765; info@crestins.com