Crest Insurance Group dba Crest Insurance Agency CCPA Privacy Notice

  • Effective Date: January 1, 2021
  • Last updated on March 1, 2021
PURPOSE
This California Resident Privacy Notice supplements the information contained in Crest Insurance Group dba Crest Insurance Agency’s (“Crest”) Privacy Policy and applies solely to consumers and all visitors, users and others who reside in the State of California (hereafter “consumers” or “you”). This Notice is adopted to comply with the California Consumer Privacy Act of 2018 (CCPA) and any terms defined in the CCPA have the same meaning when used in this Notice.
Collection and Sharing of Personal Information

Crest may collect personal information that identifies, relates to, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with particular consumers, households or devices, including you and persons other than the individual(s) proposed for coverage (“Personal Information”). Personal Information does not include publicly available information from government records, deidentified or aggregated consumer information, and certain information protected by other specific federal or state statutes including, but not limited to, the Gramm-Leach-Bliley Act (GLBA) or California’s Insurance Information and Privacy Protection Act (IIPPA).

We may share your Personal Information by disclosing it to a third party for permitted business purposes. In particular, we may have collected and shared the following categories or types of Personal Information from consumers with the following categories or types of third parties (“business purpose disclosures”) within the last twelve (12) months:

Category or TypeExamplesCollectedBusiness Purpose Disclosures
A. IdentifiersA real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, date(s) of birth, or other similar identifiers.YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services; our affiliates in connection with services provided to you or in which you have expressed an interest
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
C. Protected classification characteristics under California or federal lawAge (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).YES 
D. Commercial informationRecords of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
E. Biometric informationGenetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.NO 
F. Internet or other similar network activityInternet or other similar network activity Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.YESVendors who provide support in operating, assessing and to improve the performance of our Site
G. Geolocation dataPhysical location or movements.NO 
H. Sensory dataAudio, electronic, visual, thermal, olfactory, or similar information.YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
I. Professional or employment-related informationCurrent or past job history or performance evaluations.YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.YESInsurance companies and third-party agents/brokers; vendors we engage in connection with our services
K. Inferences drawn from other personal informationProfile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.NO 

Crest may receive the categories of Personal Information listed above about you and other individuals proposed for coverage from the following sources:

• Directly from you, including, but not limited to: when you request a quote; through applications or other forms and records received by us (for example, we may ask you to provide Personal Information to us when you enroll for insurance coverage and when you purchase an insurance policy through us); through insurance transactions you conduct with us or our affiliates (for example, we may ask you to provide Personal Information to us when you conduct insurance business with us or our affiliates through postal mail, telephonically, electronically or by other means); through claims information you provide in the event of a claim; through consumer reporting agencies; and when you interact with us on social media platforms such as Facebook and Twitter.

• Indirectly from you and other consumers through your use of the Site, such as from observing your actions on our Website (the “Site”). This information may include the type of device you are using, your IP address, the pages you visit while navigating the Site, and how long you visit certain pages. This information is collected for a variety of purposes, including enhancing or improving the Site or the services we offer to you

Collection and Sharing of Personal Information

Crest may use the Personal Information collected about you for one or more of the following purposes:

• Fulfill the reason you provided the Personal Information
• Underwrite, sell, solicit, and negotiate insurance products and services.
• Provide you with support and respond to inquiries.
• Contact you regarding your account, your orders, upcoming and/or failed payments, renewals and endorsements, or for any other important reason.
• Provide you with a requested quote or offer goods and services of a third party vendor.
• Determine eligibility and process applications for products and services.
• Inform you with products and services we may offer.
• Communicate, create, service, secure and bill accounts or clients.
• Obtain and update insurance or credit information with appropriate third parties, such as credit reporting agencies.
• Monitor and administer accounts and the services thereto.
• Process requests, purchases, transactions and payments and prevent transactional fraud.
• Fulfill contractual obligations.
• Comply with or satisfy a legal or regulatory requirement.
• Fulfill or meet any other reasons you provided the information.
• Fulfill any additional commercial purposes, with your consent as required by law.
• Provide, support, personalize and develop our Site, products and services.
• Enhance or improve the Site or the services we offer to you.
• Help maintain the safety, security and integrity of our Site, products and services, databases and other technology assets, and business.

We do not sell Personal Information to any third parties and have not done so in the preceding twelve (12) months.

Deidentified Patient Information

We may use or disclose de-identified information exempt from the CPPA to third parties for commercially legitimate business purposes.

Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their Personal Information. This section describes your CPPA rights and explains how to exercise those rights.

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past twelve (12) months (the “right to know”).  Once we receive your request and confirm your identity, we will disclose to you:

  • The categories of Personal Information we collected about you.
  • The categories of sources for the Personal Information we collected about you.
  • Our business or commercial purpose for collecting or selling that Personal Information.
  • The categories of third parties with whom we share that Personal Information.
  • If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
    • sales, identifying the Personal Information categories that each category of recipient purchased; and
    • disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
  • The specific pieces of Personal Information we collected about you.

Right to Request Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions (the “right to delete”).  Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies.  We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

  • Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or recall conducted in accordance with federal law, or otherwise perform our contract with you.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify Personal Information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Exercising Your Rights to Know or Delete

To exercise your rights to know or delete described above, please submit a request by either:

Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your Personal Information.  To designate an authorized agent, you must provide the authorized agent with a signed permission to make the request, directly verify their own identity with Crest and directly confirm to Crest that they are an authorized agent.

You may also make a request to know or delete on behalf of your child by signing and returning a consent form to Crest.

You may only submit a request to know twice within a 12-month period. Your request to know or delete must:

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative, as described above.
  • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

You do not need to create an account with us to submit a request to know or delete, although we may communicate with you about your request through a pre-established account, if applicable. However, in order to safeguard the personal information in our possession, if we cannot verify your identity or authority to act on another’s behalf, we will be unable to comply with your request. We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make it.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days.  Please contact us if you do not receive confirmation within the 10-day timeframe.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Personal Information Sales Opt-Out and Opt-In Rights

If you are age 16 or older, you have the right to direct a business that sells your personal information to third parties not to sell your personal information (the “right to opt-out”).  Because we do not sell your personal information, we do not provide any mechanism for you to exercise the right to opt out.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.  Unless permitted by the CCPA, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Minors

We do not knowingly collect online information from children under the age of 13. If we are notified that we have collected personal information of a child under the age of 13 as defined by the Children’s Online Privacy Protection Act (“COPPA”), we will delete the information as quickly as possible.  We never sell the personal information of minors under 16 years of age and would not do so in the future without affirmative authorization of the consumer if between 13 to 16 years of age, or the parent or guardian of a consumer less than 13 years of age.

Changes to This Privacy Notice

We reserve the right to amend or change this Notice at our discretion and at any time.  When we amend or make changes to this Notice, we will post the updated notice on our Site and update the notice’s effective date.  Any changes will be effective immediately upon the posting of the revised Notice unless otherwise specified. Your continued use of the Site after the posting of amendments or changes constitutes your consent to and acceptance of those changes.

Contact Us

If you have any questions about this Notice, the ways in which Crest collects and uses your information described here, our privacy practices, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at: 1-888-881-5765; info@crestins.com