CPRA Notice For California Residents

CPRA Notice For California Residents

EFFECTIVE January 1, 2025

This California Privacy Rights Act (“CPRA”) Online Privacy Notice and Notice at the Time of Collection (“CPRA Notice”) is applicable to the personal and sensitive information collected by Corix Insurance Services, LLC and its affiliates (collectively, “Corix”), about California residents (defined by the CPRA as “Consumers”) to the extent the personal information is subject to the CPRA; in addition to other applicable policies, practices, and privacy notices (such as our Online Privacy Notice) that may relate to specific business relationships you have with Corix or to certain products or services.

Pursuant to the CPRA, we act as a “Service Provider” with respect to the personal and sensitive information that we receive from Customers.

This CPRA Notice does not apply to Consumers’ personal information exempted from the CPRA, such as deidentified or aggregated Consumer information or personal information collected pursuant to sector-specific privacy laws such as: (1) the federal Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations or the California Financial Information Privacy Act (“FIPA”); or (2) certain medical and health information covered by HIPAA (if and where applicable). Corix Employees, who are California residents, should refer to Corix’s internal policies, including Corix’s Employee CPRA Privacy Policy and Notice at Time of Collection with respect to the privacy of employee data.

Contents

  • Categories of Information We Collect, Use, Disclose, or Sharesome text
    • Personal Information We Collect
  • CPRA Privacy Rightssome text
    • Access
    • Deletion
    • Correction
    • Opt Out of Targeted Advertising
    • Opt out of Automated Decision-Making Technology
  • Submitting Requests and Verification of Your Identity
  • Changes to This CPRA Notice
  • Contact Information

Categories of Information We Collect, Use, Disclose, or Share

California law indicates that “Businesses” should disclose for California residents whether certain categories of information are collected, used, or disclosed for an organization’s “business purpose”, made available to third-parties in exchange for valuable consideration (“sold”) or “shared” for purposes of cross-context behavioral advertising (as those terms are defined under California law). You can find a list of the categories of information we collect and how we share the information below. In the preceding twelve (12) months, we have collected the following categories of personal information. Note that not all categories may be collected about every individual:

Personal Information We Collect
Category of PI Disclosures for a Business Purpose Sharing for Cross-Context Behavioral Advertising
Identifiers, such as real name and/or alias, contact information (such as mailing address, email address), online identifiers (such as IP address, etc.) or similar identifiers, signature, physical characteristics, or description.

  • Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.

  • Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention.

  • Third-parties that provide us with information technology services, such as internet service providers, operating systems and platforms, data centers/hosts/cloud service providers.

  • Third-parties that assist us with information technology and security programs.

  • Third-parties that assist us with fraud prevention, detection, and mitigation.

 Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.
Government issued ID (such as social security number, driver’s license number, passport number)

  • Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention.

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation.

 None
Financial information, such as credit card number, debit card number, and other payment or financial information.

  • Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention.

  • Third-parties that provide us with information technology services, such as internet service providers, operating systems and platforms, data centers/hosts/cloud service providers.

  • Third-parties that assist us with information technology and security programs.

  • Third-parties that assist us with fraud prevention, detection, and mitigation.

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation.

 None
Medical / health insurance information, such as information regarding an individual’s medical history, or treatment.

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation.

 None
Protected Characteristics, such as age, sex, race, ethnicity, physical, or mental handicap, etc.

  • Third-parties who provide marketing and data analytics services, such as social media platforms used to deliver our ads; website/email optimization providers; marketing communications providers (e.g., email, SMS, post); and data analytics providers

  • Third-parties who provide us with information technology services, such as internet service providers, operating systems and platforms, data centers/hosts/cloud service providers

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation

 None
Commercial information, such as products or services purchased, obtained or considered, preferences or consuming histories or tendencies.

  • Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.

  • Third-parties that provide us with information technology services, such as internet service providers, operating systems and platforms, data centers/hosts/cloud service providers.

  • Third-parties that assist us with information technology and security programs.

  • Third-parties that assist us with fraud prevention, detection and mitigation.

 Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.
Network activity, such as browsing / search history, information on a consumer's interaction with a website, application, or advertisement.

  • Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.

  • Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention.

  • Third-parties necessary to complete transactions and provide our products and services, insurance carriers.

  • Third-parties that provide us with information technology services, such as internet service providers, operating systems and platforms, data centers/hosts/cloud service providers.

  • Third-parties that assist us with information technology and security programs.

  • Third-parties that assist us with fraud prevention, detection and mitigation.

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation.

 Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.
Geolocation data, such as precise physical location. Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers. None
Sensory data (i.e. audio, electronic, visual, thermal, olfactory, or similar information).

  • Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.

  • Third-parties that provide us with information technology services, such as internet service providers, operating systems and platforms, data centers/hosts/cloud service providers.

  • Third-parties that assist us with information technology and security programs.

  • Third-parties that assist us with fraud prevention, detection and mitigation.

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation.

 None
Professional / employment-related information, such as education, occupation and employment history.

  • To evaluate your job application or as part of your employment with us.

  • Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.

  • Third-parties that assist us with fraud prevention, detection and mitigation.

  • Government entities, law enforcement, lawyers, auditors, consultants and other parties as required by law, including litigation.

 None
Inferences drawn from any of the above information.

  • Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

  • Advertising networks.

  • Third-parties that provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, marketing communications providers (e.g., email, SMS, post), and data analytics providers.

CPRA Privacy Rights

The CPRA provides California residents with specific rights regarding their personal information; this section describes these CPRA rights and explains how to exercise them.

Access

You may request confirmation on whether we are processing your personal information and request access to the personal information we have about you, including related information, or a copy of that information, by following the instructions (in the Submitting Requests section below). Once we receive your request and confirm your identity, we will disclose to you:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting that personal information.
  • The categories of third-parties with whom we share that personal information.
  • If we disclosed your personal information for a business purpose, two separate lists disclosing:some text
    • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

In certain circumstances, you may request portability of your personal information. If required by law, we will grant you reasonable access to the personal information we have about you.

Deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your request and confirm your identity (see Submitting Requests), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us, or our Service Providers, to:

  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another Consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act.
  • Enable solely internal uses that are reasonably aligned with Consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
  • Comply with our data retention obligations under applicable law.
  • Comply with our reporting obligations under applicable law.
  • Comply with our obligation to preserve information in the event of a lawsuit, regulatory inquiry, or other similar legal matter.

We will delete or de-identify personal information not subject to one of these exceptions from our records and will direct our Service Providers to take similar action.

Correction

You may request correction of any inaccuracies in your personal information. Note that we rely on you to update and correct your personal information. Account holders may modify or delete certain information in their account profile by logging into their account. If you’re unable to update or correct your personal information, please submit a request by following the instructions in the Submitting Requests section below.

Opt Out of Targeted Advertising

You have the right to know about and opt out of any type of targeted or cross-behavioral advertising. We share information with Service Providers and Contractors with which we have a contractual agreement and do not sell to a third-party for cross-context behavioral advertising purposes. You may opt out of targeted advertising by clicking the “Do Not Share My Personal Information” link on our homepage and we won’t disclose your personal information for these purposes.

Opt Out of Automated Decision-Making Technology

We do not profile or use any form of automated processing on your personal information in furtherance of decisions that produce legal or similarly significant effects within the meaning of applicable US privacy law.

Submitting Requests and Verification of Your Identity

We will not discriminate against you for exercising any of your CPRA privacy rights described above, however your experience of our products and services may be different because we cannot deliver them in the same manner had you not exercised your rights. To the extent that your personal information is in-scope for CPRA’s privacy rights, you have the right to request that we exercise your rights. In some cases, we may limit or deny your request if the law permits or requires us to do so, or if we are unable to adequately verify your identity.

Please note that to protect your information we must be able to verify your identity before we can process your request to exercise any of the foregoing privacy rights. We may conduct the verification process by email or phone, and we may ask you to provide information such as your name, contact information, and any additional relevant information based on your relationship with us.

In some circumstances, certain individuals may designate an authorized agent to submit requests to exercise certain privacy rights on their behalf. To do so, you must provide that authorized agent written and signed permission to submit the request on your behalf and verify your own identity directly with us. Note that we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

You may make such a request via one of the methods outlined below:

Through Your Account

Call Us: (415) 488-6728

E-mail Us: corixprivacy@corixinsurance.com

Write to Us: Corix Insurance Services, LLC
Attn: Legal Department
250 Montgomery Street, Suite 650
San Francisco, CA 94104

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact: corixprivacy@corixinsurance.com.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable Consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes to This CPRA Notice

We reserve the right to amend this CPRA Notice at our discretion and at any time in order to address future developments of Corix, the Services, the CPRA or implementing regulations, or changes in industry or legal trends. We will post the revised CPRA Notice on this page, and otherwise comply with any requirements of CPRA regarding changes to this CPRA Notice. You can determine when the CPRA Notice was revised by referring to the “Last Updated” legend on the top of this page. Any changes will become effective upon the posting of the revised CPRA Notice on the Website. By continuing to use our Services following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this CPRA Notice, in whole or part, you can choose to discontinue your use of our Services.

Contact Information

If you have any questions or comments about this CPRA Notice, or Corix’s privacy notices or practices, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us via one of the methods outlined below:

Call Us: (844) 400-1199

E-mail Us: corixprivacy@corixinsurance.com

Write to Us: Corix Insurance Services, LLC
Attn: Legal Department
250 Montgomery Street, Suite 650
San Francisco, CA 94104