This U.S. Privacy Policy ("Policy") describes how Specialty Program Group LLC, and its subsidiaries listed here (collectively "SPG") use your "Personal Information" (as defined below) both during and after our direct business relationship with you. This Policy applies to Personal Information that we may from time to time collect, use, and disclose in the course of SPG's business operations including (1) performing insurance brokerage or other insurance or financial industry services on your behalf, (2) making available our mobile applications and websites, including specialtyprogramgroup.com, (3) performing insurance, risk management, or employee benefits work on behalf of our Commercial Clients, and (4) contacting us, visiting a SPG location, registering for or attending a SPG event or using other services that link to this Policy. This Policy may be supplemented by additional privacy policies, terms, and notices relevant to the service and provided to you at or before the collection of your Personal Information. We take very seriously our privacy responsibilities to you, and we are committed to treating your Personal Information in a manner that is consistent with applicable law and this Policy. Please read this Policy carefully.
7. Your Privacy Rights and How to Exercise Them
Governments are increasingly granting consumers certain rights regarding their Personal Information. SPG honors requests in accordance with and to the extent required by applicable consumer privacy laws, which may vary depending on where you live. Depending on your state of residence, your rights may include:
(A) Right to Know: You have the right to request that we provide you (i) the categories or specific pieces of Personal Information we collected about you; (ii) the categories of sources from which we collected your Personal Information; (iii) the business or commercial purposes for which we collected, sold, or shared your Personal Information; (iv) the categories of Personal Information we disclosed to Service Providers or third parties for a business purpose and the categories of Service Providers and third parties to whom we disclosed it; and (v) the categories of third parties to whom we sold/shared your Personal Information and the categories of Personal Information sold/shared to each category of third party.
(B) Right to Access: You have the right to access and inspect Personal Information about you or be provided with a copy of the information we hold about you. SPG may take additional steps to verify your identity before it provides access to Personal Information that is sensitive, or the unauthorized disclosure of which could create a substantial risk of potential harm to the subject of the data.
(C) Right to Correct: If you believe that Personal Information about you is inaccurate, then you may request that SPG correct the information. When you make this request, please (i) identify the specific information that you believe is inaccurate, (ii) provide the information that should replace the inaccurate data, and (iii) provide documentation related to your proposed correction. We will correct the information if we determine, based on the totality of the circumstances, that the correction you requested is more likely than not accurate. SPG may decide to delete the allegedly inaccurate information instead of correcting it.
(D) Right to Deletion: You have the right to request that we delete Personal Information we collected about you. Under applicable consumer privacy laws, SPG is not required to honor a deletion request in certain situations, such as where SPG needs to maintain the information to: (i) complete a requested or reasonably anticipated transaction, (ii) prevent security incidents or fraud, (iii) comply with litigation holds and establish, exercise, or defend legal claims, and (iv) comply with SPG's regulatory and licensing obligations.
(E) Data Portability: You have the right under the laws of certain jurisdictions to request that Personal Information about you be provided in an electronic format to you or a third party of your choice.
(F) Disclosing the Recipients of Personal Information: Consumers in certain jurisdictions have the right to request that SPG disclose to them the categories of third parties to whom SPG has disclosed their Personal Information. In limited jurisdictions, SPG may be required to provide you with a list of specific third parties that have received Personal Information about you.
(G) Right to Restrict Processing/Right to Limit Use and Disclosure of Sensitive Personal Information: Some jurisdictions allow you to request that SPG limit the use of your Sensitive Personal Information to only certain specified purposes such as (i) providing to you the goods and services you reasonably expect, (ii) complying with legal obligations, exercising legal claims or rights, and defending legal claims, (iii) preventing security incidents or fraud, or (iv) verifying or maintaining the quality or safety of goods or services we provide. Other jurisdictions require SPG to obtain your consent to process Sensitive Personal Information about you; the definitions of Sensitive Personal Information vary by jurisdiction. SPG processes these types of requests subject to any exceptions permitted by law. If you reside in a jurisdiction that requires us to obtain your consent before processing Sensitive Personal Information on your behalf, SPG may take additional steps to contact you before treating your request as a revocation of consent to avoid unintended consequences, such as the cessation of processing your Personal Information for a SPG product or service that you requested. You may choose to withdraw your consent at any time; however, we may be unable to provide the product or service you requested without the necessary information.
(H) Right to Opt-Out from the Sale or Sharing of Personal Information/Do Not Sell or Share My Personal Information Request: You have the right to direct us to not sell or share for marketing and/or targeted advertising purposes your Personal Information with affiliates or non-affiliates. We will process requests subject to any applicable exceptions and extensions permitted by law.
(I) Right to Opt-Out of Automated Decision-Making and Profiling: Consumers in certain jurisdictions have the right to direct SPG to not process their Personal Information for automated decision-making or profiling that produces legal or other consequential effects. For instance, SPG and its insurance carrier partners may conduct assessments using models and information technology solutions: (i) to determine whether you are eligible to receive the insurance-related product or service you requested and (ii) to calculate your premiums. This process may involve information about your behaviors or making calculated predictions about you which are related to the product or service you requested. If you exercise this right prior to the application process, SPG may not be able to process your application for a product or service.
(J) Opt-Out of SPG Sharing Creditworthiness Information with SPG Affiliates: You may request that SPG not share with its affiliates information that bears on your eligibility for credit or insurance, including information about your credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. This opt-out right does not extend to the sharing of (i) information about first-hand transactions or experiences between you and SPG, or (ii) opinions based solely upon those first-hand transactions or experiences.
(K) Opt-Out of Receiving Marketing Communications from SPG via Email: You have the right to unsubscribe from receiving communications of a marketing nature from SPG via email.
(L) Opt-Out of Receiving Automated Phone Calls and Text Messages from SPG: You have the right to request that SPG refrain from calling you or sending text messages to you using automated dialing systems.
(M) Right to Appeal: If we deny, in full or in part, your request to exercise a privacy right, and if you live in a jurisdiction that affords you the right, you may appeal SPG's decision. To initiate an appeal, send an email to privacy.compliance@specialtyprogramgroup.com that includes in the subject line the phrase "Privacy Appeal" and your state of residence; in the body of the email, please identify the decision you are appealing and the grounds of your appeal. If SPG denies your appeal, you may contact your state Attorney General to inquire about additional appeal rights.
(N) Right of Non-Discrimination: You have the right to not be discriminated against for exercising your privacy rights.
To exercise any of these privacy rights, to make a related request, or to ask any question concerning this Privacy Policy, please contact us via any of the following methods:
Please include your name, address, telephone number, and email address whenever you contact us. Depending upon the nature of your request, SPG may require you to provide additional information to verify your identity and authority to access or direct the processing of the Personal Information that is the subject of the request. SPG may deny certain privacy requests with respect to your Personal Information if we cannot verify your identity. You may also use an authorized agent to submit a request to exercise your privacy rights on your behalf. If you have an authorized agent submit a request on your behalf, SPG will require (i) you to provide the authorized agent with written permission to act on your behalf, and (ii) your agent to verify their identity directly with SPG. SPG may deny a privacy-related request from an agent that does not meet these requirements.
Situations Where Rights Cannot Be Granted
There may be situations where we cannot grant a particular request --- for example, if you ask us to delete your transaction data but we are legally obligated to keep a record of that transaction to comply with law or if we are unable to verify your identity through standard and reasonable means. We may also decline to grant a request where doing so would undermine our legitimate use of data for anti-fraud and security purposes, such as when you request deletion of an account that is being investigated for security concerns. Other reasons your privacy request may be denied could be that granting the request would jeopardize the privacy of others; that the request is substantively frivolous or vexatious; or that granting the request would be highly impractical in the context of our legitimate business purposes. If we are unable to fulfill your privacy request to access, review, delete or correct your Personal Information, we will provide you with an explanation
SPECIALTY PROGRAM GROUP LLC -- CALIFORNIA PRIVACY NOTICE
Privacy Notice for California Residents
Effective Date: August 1, 2024
This Privacy Notice for California Residents (this "Notice") supplements the information contained in the SPG Privacy Policy (the "Policy") and is provided on behalf of Specialty Program Group LLC and its subsidiaries listed here.
This Notice provides our "notice at collection" and provides certain mandated disclosures about our treatment of California residents' information, both online and offline. We adopt this Notice to comply with the California Consumer Privacy Act of 2018 as supplemented by the California Privacy Rights Act of 2020 (collectively, the "CCPA") and any terms defined in the CCPA have the same meaning when used in this Notice (unless separately defined in this Notice or the Policy). This Notice applies solely to residents of the State of California as defined in the CCPA ("California Residents") who do business with us directly and/or visit the mobile apps and websites of Specialty Program Group LLC and its subsidiaries ("our websites").
Updates to this Notice and Accessibility
We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated Notice on the websites and update the Notice's effective date. We encourage you to look for updates and changes to this Notice when you access our websites. Your continued use of our websites and mobile applications following the posting of changes constitutes your acceptance of such changes with respect to your use of the websites and mobile applications.
Accessibility
If you have special needs with regard to accessing the content of this Notice, we recommend that you or someone on your behalf, contact us by email at: privacy.compliance@specialtyprogramgroup.com. Please indicate "Accessibility Request" in your subject line to help us to identify this request.
Definition and Exclusions of Personal Information and Sensitive Personal Information under the CCPA and at Specialty Program Group LLC
Generally, Personal Information under the CCPA and in this Notice means information that identifies (whether directly or indirectly) you, such as your name, postal address, email address, and telephone number. Due to the nature of our business, Personal Information we collect may also include:
- your name, Social Security Number, driver's license, or other government-issued identification;
- assets and income, occupation and employment status, dependent information and other relevant financial information;
- information relating to any of your past claims, driving history, certifications, license details, previous insurance policy details, previous accident and claims history including any driving convictions;
- information from reporting agencies and state and federal government agencies, such as state motor vehicle departments;
- information from other sources, such as medical or health care providers and other third parties with which you or we maintain a relationship including credit reference agencies, vetting and data validation agencies, advisory service providers, insurers, underwriters, reinsurers, other insurance brokers, business partners;
- your account activity and premium payment history;
- benefits information such as benefits elections, pension entitlement information, date of retirement and any relevant matters impacting your benefits;
- information about your interest in and attendance at SPG sponsored events, including feedback responses;
- information from social media interactions with SPG's social media presence, feedback forms or surveys;
- credit card, bank account or other account information as may be required to facilitate your payment of insurance premium or similar amounts, which payment generally is made through systems maintained by third parties, such as insurance carriers;
- passive tracking information from our websites or the Internet, including information obtained through the use of internet "cookies" as detailed in the "Cookie Notice and Notice of Other Web Technologies" of our U.S. Privacy Policy; and
- inferences drawn from other Personal Information, precise geolocation data, and sensory data such as audio or visual information.
Personal Information as defined under the CCPA does not include:
- Publicly available information from government records as defined under Civil Code Section 1798.140;
- Deidentified or aggregated consumer information;
- Health or medical information to the extent covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
- Personal information to the extent covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA) and the Driver's Privacy Protection Act of 1994.
Certain types of Personal Information are considered "Sensitive Personal Information" under the CCPA. Specifically, Sensitive Personal Information is a specific type of Personal Information defined specifically as its own category under California law in the CCPA as information that reveals a consumer's:
- Social Security, driver's license, state identification card, or passport number;
- Account login, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
- Precise geolocation;
- Racial or ethnic origin, religious or philosophical beliefs, or union membership;
- Mail, email, and text message content, unless the business is the intended recipient of the communication;
- Genetic data; and/or
- Biometric information, which may reference certain physiological, biological, or behavioral characteristics; or DNA information; which could potentially establish an individual's identity. Retina scans, fingerprints or voice recordings could also be considered such information.
Personal Information We Collect
The following categories of Personal Information and/or Sensitive Personal Information may have been collected from California Residents within the last twelve (12) months. Personal Information that falls under the definition of Sensitive Personal Information under the CCPA has been noted in the second column below.
| Category |
California Sensitive Personal Information may be considered to be within this Category (YES or NO) |
Examples of Personal Information |
Collected |
| A. Identifiers |
YES |
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. |
YES |
| B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80I). |
YES |
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. |
YES |
| C. Protected classification characteristics under California or federal law. |
YES |
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). |
YES |
| D. Commercial information. |
NO |
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
YES |
| E. Biometric information. |
YES |
Genetic, physiological, behavioral and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns and sleep, health, or exercise data. |
NO |
| F. Internet or other similar network activity. |
NO |
Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. |
YES |
| G. Precise geolocation data. |
YES |
Physical location or movements within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. |
YES |
| H. Sensory data. |
YES |
Audio, electronic, visual, thermal, or similar information. |
YES |
| I. Professional or employment-related information. |
NO |
Current or past job history. |
YES |
| J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). |
YES |
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. |
YES |
| K. Inferences drawn from other personal information. |
YES |
Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes. |
YES |
Sources of Personal Information We Collect
We may obtain the categories of Personal Information listed above from the following categories of sources:
- Directly from you -- for example, from insurance applications or in connection with your other communications with us.
- From third parties -- for example, from insurance carriers and other industry service providers, other insurance brokers, and other third parties with which you maintain a relationship, such as an employer, financial service or medical or health providers, or any industry provider from which we purchase or acquire industry assets or operations. This may occasionally include referral sources.
- Indirectly from you -- for example, from observing your actions on our websites, including through the use of "cookies" as described on our websites, as permitted, or described in those other third-party sites' own privacy policies, or as may otherwise be developed over time based on your interactions with us.
Use of Personal Information
We may from time to time use your Personal Information for the following reasons:
- to fulfill or meet the reason you provided the information and for our everyday business purposes, such as to obtain quotations for insurance or other insurance or financial industry services (including those procured proactively and/or in connection with the movement of a book of business from one provider to another) on your behalf; to obtain insurance (or similar products) on your behalf or to facilitate the performance of related services by other industry service providers; to maintain or service your account or insurance, including by reporting claims of loss to other industry service providers, such as insurance carriers and adjusters; to evaluate our performance or offerings; to allow risk management or actuarial evaluation of prospective or existing placements; to confer with medical professionals if necessary regarding a relevant claim; and to make reports to credit bureaus. We may also save your information to facilitate new quotations or placements.
- for legal reasons, such as to make required or advisable reports to insurance regulatory, law enforcement or other similarly situated authorities including government authorities; to respond to and comply with court orders, applicable law, and other legal requirements; and to defend ourselves against claims and to enforce our rights or protect our employees or property.
- for our own marketing purposes, so that we may offer you our products and services, including through the use of targeted or similar advertising on the internet.
- for joint marketing purposes, so that we and any third-party product or service provider may together offer you products and services;
- for our affiliates' everyday business purposes, such as to process or service transactions or to provide or receive shared organizational services.
- for our affiliates' marketing purposes so that they may offer you their products and services.
- for our and our affiliates' fraud prevention purposes, where necessary to prevent and detect fraud.
- for non-affiliated third parties, whenever you consent to such sharing, when the information cannot reasonably identify you, when business partners or third-party companies play a related or expected role in an insurance transaction, or as needed for SPG to participate in insurance support organizations.
- for our internal and external auditors, where necessary for company audits, complaint investigation or investigation of a security threat.
- for other purposes, as may be permitted by law, as described to you when collecting your Personal Information or as otherwise set forth in the CCPA.
- to evaluate, negotiate or effect a business transaction (e.g., a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets), in which Personal Information held by us about our consumers or website users is among the assets evaluated or transferred.
Sharing of Personal Information under the CCPA
Under the CCPA, the Sharing of Personal Information means sharing, disclosing, disseminating, making available or otherwise communicating a consumer's Personal Information to a third party for uses such as targeted advertising for the benefit of the business.
California residents have certain rights under the CCPA around limiting the Sharing of their Personal Information.
The CCPA addresses two distinct categories of information disclosure by businesses, differentiating the Sharing of Personal Information for a Commercial Purposes from the Disclosure of Personal Information for a Business Purpose, as described below.
Sharing of Personal Information for a Commercial Purpose
The CCPA defines the Sharing of Personal Information for a Commercial Purpose as including the sale or sharing of a customer's Personal Information for monetary or other consideration paid to the sharing business.
In accordance with that definition, in the preceding twelve (12) months, SPG has Shared Personal Information for a Commercial Purpose as disclosed within the Policy, including specifically as described in our Cookie Notice and Notice of Other Web Technologies in relation to sharing personal information for cross-contextual behavioral advertising or targeted advertising.
As provided by the CCPA, California consumers have the right to opt-out of the "sale" of personal information to third parties. To opt-out of the "sale" or "sharing" of personal information related to targeted advertising, interest based advertising and cross context behavioral advertising, take the following steps:
- Turn off Social Media, Targeting and Advertising cookies by using the cookie consent mechanism available on our websites or by enabling the Global Privacy Control ("GPC") signal on your browser; and
- Complete and submit a request using the SPG Consumer Privacy Request Portal
Your cookie selections are specific to the particular device, browser, and website you use. If you use another device or browser, you will need to opt out on each device and browser. Blocking or deleting cookies from your browser may remove your opt-out settings, requiring you to opt-out again.
Disclosure of Personal Information for a Business Purpose
The CCPA excludes from the definition of Sharing Personal Information any use of Personal Information which was requested by you (the customer), including the expected and typical use of that information by a third party for the reasonably necessary purposes to achieve the requested service. Such an information transfer is considered the Disclosure of Personal Information for a Business Purpose under the CCPA.
In the preceding twelve (12) months, we may have Disclosed the following categories of Personal Information for a Business Purpose:
Category A: Identifiers
Category B: California Customer Records Personal Information categories
Category C: Protected classification characteristics under California or federal law
Category D: Commercial information
Category F: Internet or other similar network activity
Category H: Sensory Data
Category I: Professional or employment-related information
Category J: Non-public education information
Category K: Inferences drawn from other Personal Information
We may Disclose to the following categories of third parties your Personal Information for a Business Purpose to perform services on your behalf and to provide you with the insurance products and services you expect from us:
- Service providers.
- Insurance carriers and other industry service providers.
- Other third parties with which you or we maintain a relationship regarding your insurance.
Sales of Personal Information
In the preceding twelve (12) months, we have sold or shared Personal Information as defined by the CCPA, as described herein and in our Cookie Notice and Notice of Other Web Technologies in the Policy in relation to sharing personal information for cross-contextual behavioral advertising or targeted advertising.
Global Privacy Control (GPC) Signal
You have the right to opt out of the use of your personal information for targeted advertising purposes. You may download one of the supported browsers or extensions to send the Global Privacy Control ("GPC") signal, which will transmit your request to opt-out of targeted advertising automatically. A list of GPC enabled available browsers or extensions is available here: https://globalprivacycontrol.org/#download.
Your computers or devices also have tools within their browser settings that allow you to manage your acceptance of cookies. These can include the ability to disable or block cookies, remove cookies, automatically accept cookies or to notify you when a cookie is received. Generally disabling or rejecting cookies can impact your user experience; Certain features of our website may not be available if all cookies are disabled, and therefore, disabling, particularly of strictly necessary cookies, may not be available.
Information Specific to Employment Data of Specialty Program Group LLC
In addition, for recruitment and/or employment purposes, in the past twelve (12) months we have collected or may have collected and retained the following categories of Personal Information as necessary from California residents. Personal Information that falls under the definition of Sensitive Personal Information under the CCPA has been noted in the second column below:
| Category |
California Sensitive Personal Information may be considered to be within this Category (YES or NO) |
Examples of Personal Information |
Collected |
| Additional personal details, contact details and identifiers. |
YES |
Additional personal details for recruitment/employment purposes, such as national identification number, Social Security number, insurance information, marital/civil partnership status, domestic partners, dependents, emergency contact information, and military history; professional/personal calendar availability/scheduling information for meeting/communication purposes. |
YES |
| Education information and professional or employment-related information. |
NO |
Information about your education and professional or employment-related information, such as your employment history. |
YES |
| Sensitive data for recruitment purposes. |
YES |
Certain types of sensitive information when permitted by local law or with your consent, such as health/medical information (including disability status), trade union membership information, religion, race or ethnicity, minority flag, and information on criminal convictions and offences. We collect this information for specific purposes, such as health/medical information in order to accommodate a disability or illness (subject to legal limits on the timing of collection of such information and other applicable limitations) and to provide benefits; background checks and diversity-related Personal Information (such as race or ethnicity) in order to comply with legal obligations and internal policies relating to diversity and anti-discrimination. |
YES |
| Documentation required under immigration laws. |
YES |
Data on citizenship, passport data, and details of residency or work permit (a physical copy and/or an electronic copy). |
YES, as to employees, some job candidates, and contractors of Specialty Program Group LLC |
| Financial information for payroll/benefits purposes. |
YES |
Your banking and other relevant financial details we need for payroll/benefits purposes. |
YES |
| Talent management information. |
YES |
Information necessary to complete a background check, details on performance decisions and outcomes, performance feedback and warnings, e-learning/training programs, performance and development reviews (including information you provide when asking for/providing feedback, creating priorities, updating your input in relevant tools), driver's license and car ownership information, and information used to populate biographies. |
YES |
| Requested recruitment information. |
NO |
Information requested to provide during the recruitment process, to the extent allowed by applicable law. |
YES |
| Recruitment information you submit. |
NO |
Information that you submit in résumés / CVs, letters, writing samples, or other written materials (including photographs). |
YES |
| Information generated by us during recruitment. |
NO |
Information generated by interviewers and recruiters related to you, based on their interactions with you or basic Internet searches where allowed under applicable law. |
YES |
| Recruitment information received from third parties. |
NO |
Information related to you provided by third-party placement firms, recruiters, or job-search websites, where applicable. |
YES |
| Audiovisual information processed during recruitment. |
YES |
Photograph, and images/audio/footage captured on CCTV or other video systems when visiting our office or captured in the course of recruitment events or video recruitment interviews. |
YES |
| Recommendations. |
NO |
Recommendations related information provided on your behalf by others. |
YES |
| Employment history and background checks. |
YES |
Information about your prior employment, education, and where applicable and allowed by applicable law, credit history, criminal records or other information revealed during background screenings. |
YES |
| Diversity related information. |
YES |
Information about race / ethnicity / religion / disability / gender and self-identified LGBT status, for purposes of government reporting where required by law, as well as to understand the diversity characteristics of our workforce, subject to legal limits. |
YES |
| Assessment information. |
YES |
Information generated by your participation in psychological, technical or behavioral assessments. You will receive more information about the nature of such assessments before your participation in any of them. |
YES |
Retention of Your Information
SPG retains certain records of your Personal Information as necessary to operate our business and comply with our legal and regulatory obligations. Such records are retained for legally defined retention periods that may extend beyond the period for which we provide the Services to you. We have implemented appropriate measures to confirm that Personal Information is securely disposed when no longer required.
Your Rights and Choices
The CCPA at Section 7011 (e)(2) provides California Residents with specific rights regarding their Personal Information:
(A) Access. The right to know what Personal Information the business has collected about the consumer, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom the business discloses Personal Information, and the specific pieces of Personal Information the business has collected about the consumer;
(B) Deletion. The right to delete Personal Information that the business has collected from the consumer, subject to certain exceptions;
(C) Correction. The right to correct inaccurate Personal Information that a business maintains about a consumer;
(D) Opt-out of Sale or Sharing. If the business sells or shares Personal Information, the right to opt-out of the sale or sharing of their Personal Information by the business;
(E) Limitation on the Use of Sensitive Personal Information. If the business uses or discloses sensitive Personal Information for reasons other than those set forth in section 7027, subsection (m), the right to limit the use or disclosure of sensitive Personal Information by the business; and
(F) Non-discriminatory Treatment. The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by the CCPA, including an employee's, applicant's, or independent contractor's right not to be retaliated against for the exercise of their CCPA rights.
The following sections describe these CCPA rights in further detail and explain how to exercise those rights.
Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past twelve (12) months. Once we receive and confirm your verifiable consumer request for Access rights (see "Exercising Access, Data Portability and Deletion Rights"), we will disclose to you to the extent reasonably available, and to the extent that we can continue to protect your data while providing such disclosure:
- The categories of Personal Information we collected about you.
- The categories of sources for the Personal Information we collected about you.
- Our business or commercial purpose for collecting or selling that Personal Information.
- The categories of third parties with whom we share that Personal Information.
- The categories of Personal Information shared for a business purpose for each category of recipients.
- The specific pieces of Personal Information we collected about you (also called a data portability request).
In addition to the rights listed above, you may request limitations on the use of your Sensitive Personal Information consistent with the terms and limitations described in the CCPA, and pursuant to Civil Code Section 1798.120 et.seq. Limited use of Sensitive Information may continue to include those uses which the average consumer would reasonably expect in context, and for uses which are reasonably necessary and proportionate for our business.
Deletion Request Rights
You have the right to request that we delete any of your Personal Information that we collected from you and retained. Once we receive and confirm your verifiable consumer request (see "Exercising Access, Data Portability and Deletion Rights"), we will delete your Personal Information from our records, unless an exception applies.
We may deny your deletion request in whole or in part for other reasons and exceptions described in the CCPA.
Exercising Access, Data Portability and Deletion Rights
To exercise the access, data portability and deletion rights described above, please submit a verifiable consumer request to us by:
To protect your information and privacy, only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. Please indicate in your subject line "California Privacy Rights Request" so that we can better respond to you. Designated agents making any request will be required to provide signed permission for the agent to submit a request. In addition, when an authorized agent submits a request, we may also require that you verify your own identity directly to us or confirm with us that you have requested that the agent to submit the request. You may also make a verifiable consumer request on behalf of your minor child.
You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:
- Provide sufficient information as we may request that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative of such person, which may include personal and/or commercial identifiers, such as an insurance policy number. Depending on the sensitivity of the information you are requesting, we may ask for additional information to verify your identity.
- Describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it.
We cannot provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. We will only use Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.
Response Timing and Format
We will acknowledge receipt of your request within ten (10) days. We will endeavor to respond in substance to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the extension period which may not exceed an additional forty-five (45) days beyond the original forty-five (45) day period.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily usable and should allow you to transmit the information from one entity to another entity without significant hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
Other California Privacy Rights
California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our website who are California Residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please write us at the mailing address shown beneath the heading "Contact Information for Requests under this Notice."
Contact Information for Requests under this Notice
If you have any questions or comments about this Notice, the ways in which we collect and use your Personal Information described herein, and in the Policy, your choices, and rights regarding such use, or wish to exercise your rights under California law, please contact us at:
Postal Address:
Chief Legal Officer
Specialty Program Group LLC
150 N Riverside Plaza, 17th Floor
Chicago, IL 60606
Or by:
Please indicate the purpose of your Email in the subject line, for instance "California Privacy Rights Request," so that we can identify your Email properly.
Situations Where Rights Cannot Be Granted
There may be situations where we cannot grant a particular request --- for example, if you ask us to delete your transaction data but we are legally obligated to keep a record of that transaction to comply with law, or if we are unable to verify your identity through standard and reasonable requirements. We may also decline to grant a request where doing so would undermine our legitimate use of data for anti-fraud and security purposes, such as when you request deletion of an account that is being investigated for security concerns. Other reasons your privacy request may be denied could be that granting the request would jeopardize the privacy of others; that the request is substantively frivolous or vexatious; or that granting the request would be highly impractical in the context of our legitimate business purposes.
