BECU California Consumer Privacy Notice

Last Updated: September 3, 2024

Boeing Employees' Credit Union (BECU or we) is committed to respecting and protecting the privacy of our members and others who trust us with their personal information. This California Consumer Privacy Notice (California Privacy Notice) serves as BECU's Notice at Collection, as required by the California Consumer Privacy Act (CCPA).

As a financial institution, most of the personal information we collect, use, and transfer is exempt from the CCPA but other privacy laws may apply, such as the Gramm-Leach Bliley Act (GLBA), Fair Credit Reporting Act, Health Insurance Portability and Accountability Act, and California Financial Information Privacy Act. This California Privacy Notice also does not apply to publicly available information, deidentified data, and aggregated consumer information (all of which are terms defined in the CCPA) or to personal information about California residents who are employees, job applicants or independent contractors.

DEFINITIONS

In this California Privacy Notice, the following terms have the following meanings:

Business Purposes means performing our financial and related services for California Consumers, including managing and processing interactions and transactions with California Consumers; securing and debugging; advertising and marketing; quality assurance; research and development; and other business purposes as may be defined in CCPA from time to time.
California Consumers (or you) means BECU members and other individuals residing in California who are identified or identifiable by CCPA Personal Information.
CCPA Personal Information means information that is regulated by the CCPA (not GLBA) and identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California Consumer or a California Consumer's household.
Processing means any operation or set of operations that are performed on CCPA Personal Information, including collecting, combining, and storing CCPA Personal Information.

I. WHEN DOES THIS CALIFORNIA PRIVACY NOTICE APPLY?

This California Privacy Notice covers the twelve (12) months prior to the “Last Updated” date above. This California Privacy Notice is reviewed and updated (if necessary) at least once per year. If this California Privacy Notice conflicts with the BECU Online Privacy Notice, this California Privacy Notice will govern as to CCPA Personal Information, unless expressly stated otherwise. If BECU's Processing materially changes between updates to this California Privacy Notice, BECU will provide a supplemental notice when or before the changes apply.

II. TO WHICH CCPA PERSONAL INFORMATION PROCESSING DOES THIS NOTICE APPLY?

Information governed by the GLBA is exempt from the CCPA. If you are a California Consumer, BECU collects CCPA Personal Information from you or about you as follows:

Directly from you (e.g., when you complete online forms on our websites, provide feedback to us, and complete membership or credit applications);
From your computer and mobile devices when you use our websites or mobile app;
From our service providers when they provide BECU and you with services on our behalf;
From public sources of data; and
From other businesses and individuals, such as providers of identity verification and fraud prevention services.

Generally, BECU Processes CCPA Personal Information to provide our services and as otherwise related to the operation of our business. Subject to restrictions and obligations under CCPA, our service providers also may use your CCPA Personal Information for Business Purposes and other approved purposes and may engage their own service providers to help perform services for us.

III. WHAT CATEGORIES OF CCPA PERSONAL INFORMATION DOES BECU COLLECT AND DISCLOSE?

BECU may collect or receive (and may have collected or received during the 12-month period prior to the “Last Updated” date above) the categories of CCPA Personal Information listed below. These categories track the categories required by the CCPA but not all categories are collected or received for every California Consumer. Some CCPA Personal Information included in one category may overlap with other categories.

1. Personal Identifiers

Name, postal address, email address, phone number, date of birth, social security number, account name, government-issued identification numbers, and other information that directly identifies you.

Purpose for Use and Disclosure

To provide and perform our products and services;
For internal research and development;
To verify or maintain the quality or safety of our products or services;
For advertising and marketing;
To identify and correct errors;
To ensure security and integrity, such as by preventing fraud; and
Short-term transient use.

Categories of Recipients

We may disclose this category of information to the following recipients:

Service providers,such as identity-verification processors, shippers, and marketing services providers;
Business partners for marketing purposes;
To third parties if BECU is involved in any merger, acquisition, sale of company assets, or other similar events;
Credit bureaus financial background and other lawful purposes;
Other third parties in connection with providing our products and services, or with your consent; and
Government entities, when legally required.

2. Personal Records

Name, address, telephone number, and information about financial purchases.

Purpose for Use and Disclosure

To provide and perform our products and services;
For internal research and development;
To verify or maintain the quality or safety of our products or services;
For advertising and marketing;
To identify and correct errors;
To ensure security and integrity; and
Short-term transient use.

Categories of Recipients

We may disclose this category of information to the following recipients:

Service providers, such as identity-verification processors, shippers, and marketing services providers;
Business partners for marketing purposes;
To third parties if BECU is involved in any merger, acquisition, sale of company assets, or other similar events;
Credit bureaus , for financial background and other lawful purposes;
Other third parties in connection with providing our products and services, or with your consent; and
Government entities, when legally required.

3. Characteristics of Protected Classifications

Age, gender, and marital status.

Purpose for Use and Disclosure

To verify or maintain the quality or safety of our products or services;
For advertising and marketing;
To identify and correct errors;
To ensure security and integrity; and
Short-term transient use.

Categories of Recipients

Service providers, such as identity-verification processors, shippers, and marketing services providers;
Business partners for marketing purposes;
To third parties if BECU is involved in any merger, acquisition, sale of company assets, or other similar events;
Credit bureaus for financial background and other lawful purposes;
Other third parties in connection with providing our products and services, or with your consent; and
Government entities, when legally required.

4. Commercial Information

Account number, credit and debit card numbers, account balance, loan information, information about beneficiaries and joint account owners, transaction details, billing information or statements, and payment or transaction history.

Purpose for Use and Disclosure

To provide and perform our products and services;
For internal research and development;
To verify or maintain the quality or safety of our products or services;
For advertising and marketing;
To identify and correct errors;
To ensure security and integrity; and
Short-term transient use.

Categories of Recipients

We may disclose this category of information to the following recipients:

Service providers, such as identity-verification processors, shippers, and marketing services providers;
To third parties if BECU is involved in any merger, acquisition, sale of company assets, or other similar events;
Credit bureaus, for financial background and other lawful purposes;
Other third parties in connection with providing our products and services, or with your consent; and
Government entities, when legally required.

5. Biometric Information

Voiceprint or faceprint used to verify your identity.

Purpose for Use and Disclosure

With your prior consent only:

To verify and authenticate your identity;
To detect and prevent fraud; and
For other security purposes.

Categories of Recipients

We may disclose this category of information to the following recipients:

Service providers, such as biometric service vendors; and
Government entities, when legally required.

6. Internet or Other Electronic Network Activity Information

Internet Protocol (IP) address, device identifiers, mobile network information, web traffic logs, and details about your web browser.

Purpose for Use Disclosure

To provide and perform our products and services;
For internal research and development;
To verify or maintain the quality or safety of our products or services;
For advertising and marketing;
To identify and correct errors;
To ensure security and integrity; and
Short-term transient use.

Categories of Recipients

We may disclose this information to the following recipients:

Service providers, such as identity-verification processors, shippers, and marketing services providers;
Business partners for marketing purposes;
To third parties if BECU is involved in any merger, acquisition, sale of company assets, or other similar events;
Credit bureaus, for financial background and other lawful purposes;
Other third parties in connection to providing our products and services, or with your consent; and
Government entities, when legally required.

7. Geolocation Data

Purpose for Use and Disclosure

To provide and perform our products and services;
For internal research and development;
To verify or maintain the quality or safety of our products or services;
For advertising and marketing;
To identify and correct errors;
To ensure security and integrity; and
Short-term transient use.

Categories of Recipients

We may disclose this category of information to the following recipients:

Service providers, such as payment processors, identity-verification processors, call-center operators, shippers, and marketing providers;
Business partners for marketing purposes;
To third parties if BECU is involved in any merger, acquisition, sale of company assets, or other similar events;
Credit bureaus, for financial background and other lawful purposes;
Other third parties in connection to providing our products and services, or with your consent; and
Government entities, when legally required.

8. Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information

Purpose for Use and Disclosure

With your prior consent only:

To visually verify and authenticate your identity;
To detect and prevent fraud; and
For other security purposes.

Categories of Recipients

We may disclose this category of information to the following recipients:

Service providers, such as services providers that support our fraud detection efforts; and
Government entities, when legally required.

The CCPA has broad definitions of the terms “sell” and “share.” In the CCPA, sale means “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, CCPA Personal Information by the business to a third party for monetary or other valuable consideration.” The term sharing (including its variants) means (in general terms) disclosure and use of CCPA Personal Information for “cross-context behavioral advertising,” i.e., the targeting of BECU's online advertising on CCPA Personal Information obtained about the California Consumer's activity across non-BECU websites, applications, or services.

BECU does not sell CCPA Personal Information. BECU does not share biometric information or geolocation data for any reason (categories 5 and 7). We may share CCPA Personal Information in categories 1 – 4, 6 and 8 (above).

As permitted by and defined in CCPA, we do not treat publicly available information, deidentified data and aggregated consumer information as CCPA Personal Information.

We reserve the right to convert (or permit others to convert) CCPA Personal Information to deidentified data or aggregate consumer information. We will not attempt to reidentify data that we maintain as deidentified data.

Retention periods vary because each category has several types of CCPA Personal Information and uses. BECU will retain CCPA Personal Information as long as necessary to achieve the purpose(s) for which it was collected, as permitted by CCPA.

IV. WHAT CONSUMER PRIVACY RIGHTS ARE AVAILABLE AND HOW CAN YOU EXERCISE THEM?

If you are a California Consumer, BECU provides you with the privacy rights described in this Section IV subject to our verification requirements, and only with respect to CCPA Personal Information.

1. Privacy Rights

a) Right to Know / Access

You are entitled to access CCPA Personal Information up to twice per 12-month period.

1) Categories of CCPA Personal Information

You have a right to submit a request for any of the following for the 12-month period prior to the request date:

The categories of CCPA Personal Information we collect from or about you or otherwise Process.
The categories of sources from which your CCPA Personal Information was collected.
BECU's Business Purposes or commercial purposes for collecting and, if applicable, “sharing” your CCPA Personal Information. (BECU does not sell CCPA Personal Information so an opt-out of sale right is not applicable.
The categories of third parties to which BECU disclosed your CCPA Personal Information.
A list of the categories of CCPA Personal Information disclosed for a Business Purpose and, for each, the categories of recipients, or that no disclosure occurred.
That no sale or share of your CCPA Personal Information occurred or, if applicable, a list of the categories of CCPA Personal Information about you that was “sold” or “shared” and, for each, the categories of recipient.

2) Specific Pieces of CCPA Personal Information

You may ask us to confirm if we are Processing your CCPA Personal Information and, if we are, to obtain a transportable copy (subject to applicable request limits) of your CCPA Personal Information that we have collected and are maintaining. For your specific pieces of CCPA Personal Information, as required by CCPA, BECU will apply the heightened verification standards as described below. We have no obligation to re-identify information or to keep CCPA Personal Information longer than we need it or are required to by CCPA to comply with access requests.

b) Right to Delete

You may request that BECU delete your CCPA Personal Information unless BECU has a basis for retaining it under CCPA. BECU may not have an obligation to delete your CCPA Personal Information that we did not collect directly from you.

c) Right to Correct

You have the right to request that we correct inaccuracies that you find in the CCPA Personal Information about you maintained by us. You also can make certain changes to your online account (e.g., name and password) in the account settings section of the account. Changing your account settings may not, however, change your CCPA Personal Information that exists in other places.

d) Right to Opt-Out of Sharing

You have the right, at any time, to direct BECU to not share your CCPA Personal Information to third parties. We use cookies and other technologies to provide features on our website. Additionally, third-party digital business may associate cookies and other tracking technologies that collect CCPA Personal Information about you on BECU's websites or otherwise Process CCPA Personal Information that we make available about you, including digital activity information. We understand that giving access to CCPA Personal Information on our websites or otherwise to third-party digital business could be deemed a sale and/or share, and thus BECU will treat such CCPA Personal Information (e.g., cookie ID, IP address and other online IDs and internet or other electronic activity information) collected by third-party digital businesses, where not limited to acting as our service provider (or contractor or processor), as a sale and/or share and subject to a Do Not Share opt-out request. We will not share your CCPA Personal Information for cross-context behavioral advertising if you make a Do Not Share request.

If you would like to make a Do Not Share request, please use BECU's privacy request form, call us at 800-233-2328, or contact us here.

The CCPA requires us to process certain types of signals, referred to as opt-out preference signals in California, which are signals sent by a technology tool enabled by individuals on their devices or browsers that communicate the individual's choice to opt-out of the sharing of CCPA Personal Information which. We currently look for and recognize global privacy control (“GPC”) signals. To use a GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. We process GPC signals with respect to sharing that may occur in the context of collection of CCPA Personal Information and apply it to the specific browser on which you enable the GPC. We do not) change your experience with any BECU product or service or change an extra fee if you use GPC or display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the GPC, except that we may display a message acknowledging the signal.

Certain web browsers may provide a do-not-track (DNT) option. You may be able to ask your browser to inform websites that you do not wish your activities to be tracked, either with cookies or other persistent identifiers, commonly called “DNT signals.” Because there is not yet a common understanding of how to interpret web browser-based DNT signals other than cookies, our websites do not currently respond to DNT signals.

We do not knowingly share the CCPA Personal Information of California Consumers under age 16, unless we receive affirmative (opt-in) authorization from either the California Consumer who is between age 13 and 16 or the parent or guardian of a California Consumer who is less than age 13. If you think BECU may have unknowingly collected CCPA Personal Information of a California Consumer under age 16, please contact us here.

BECU may disclose your CCPA Personal Information for the following purposes (which are not a sale or share): (i) if you direct BECU to disclose CCPA Personal Information; (ii) to comply with any California Consumer rights request you submit to BECU; (iii) disclosures among the entities that constitute BECU or as part of a corporate transaction; and (iv) as otherwise required or permitted by applicable law.

e) Right to Limit Sensitive Personal Information Processing

In the CCPA, “Sensitive Personal Information” is a subset of CCPA Personal Information that includes social security number, driver's license, financial account or card number, precise geolocation, racial and ethnic characteristics, religious and philosophical beliefs, union membership, contents of mail, email and text messages and genetic and biometric data. Most of the Sensitive Personal Information that BECU Processes is exempt from the CCPA. If you elect to provide us with information that qualifies as Sensitive Personal Information under CCPA, you have consented to our Processing of the Sensitive Personal Information.

2. How to Exercise Privacy Rights

To submit a request to exercise your privacy rights, or to submit a request as an authorized agent, visit BECU's privacy request form, call us at 800-233-2328, or contact us here. Please check for and respond to any follow-up inquiries we make. Please be aware that we do not accept or process requests through other means.

V. WHAT ELSE DO CALIFORNIA CONSUMERS NEED TO KNOW?

1. Non-Discrimination / Non-Retaliation

BECU will not discriminate or retaliate against you in a manner prohibited by CCPA for your exercise of your privacy rights. We may charge a different price or rate or offer a different level or quality of goods or services, to the extent that doing so is reasonably related to the value of the applicable CCPA Personal Information.

2. Notice of Financial Incentive Programs

BECU does not currently offer financial incentives to California Consumers that are subject to the CCPA. If we provide financial incentives for California Consumers in the future, we will provide notice and obtain consent as required by applicable law.

3. Our Rights and the Rights of Others

BECU may collect, use, and disclose your CCPA Personal Information as required or permitted by applicable law, which may override your rights under CCPA. BECU is not required to honor requests if doing so would infringe our or another party's rights, or conflict with applicable law.

4. California Shine the Light Law

California residents have the right to prevent disclosures of “personal information,” as defined by California's “Shine the Light” law, with third parties for those third parties' own direct marketing purposes. BECU does not, however, disclose personal information within the scope of this law.

VI. HOW TO CONTACT BECU

We love hearing from our members! If you have comments, questions, or concerns about our privacy practices or this California Privacy Notice, please contact us by visiting contact us here or reach out to us in the following ways:

By Postal Mail:

Privacy MS 1028-4
P.O. Box 97050
Seattle, Washington 98124

By Phone:

Business hours: Monday – Friday, 7 a.m. to 7 p.m. Pacific Time and Saturday, 9 a.m. to 1 p.m. Pacific Time
800.233.2328
https://www.becu.org/support/contact-us

BECU California Consumer Privacy Notice

DEFINITIONS

I. WHEN DOES THIS CALIFORNIA PRIVACY NOTICE APPLY?

II. TO WHICH CCPA PERSONAL INFORMATION PROCESSING DOES THIS NOTICE APPLY?

III. WHAT CATEGORIES OF CCPA PERSONAL INFORMATION DOES BECU COLLECT AND DISCLOSE?

1. Personal Identifiers

2. Personal Records

3. Characteristics of Protected Classifications

4. Commercial Information

5. Biometric Information

6. Internet or Other Electronic Network Activity Information

7. Geolocation Data

8. Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information

IV. WHAT CONSUMER PRIVACY RIGHTS ARE AVAILABLE AND HOW CAN YOU EXERCISE THEM?

1. Privacy Rights

2. How to Exercise Privacy Rights

V. WHAT ELSE DO CALIFORNIA CONSUMERS NEED TO KNOW?

1. Non-Discrimination / Non-Retaliation

2. Notice of Financial Incentive Programs

3. Our Rights and the Rights of Others

4. California Shine the Light Law

VI. HOW TO CONTACT BECU

By Postal Mail:

By Phone:

BECU.org