Oregon Residents

FOR OREGON RESIDENTS ONLY

Effective July 1, 2024

Your Rights and Choices

The Oregon Consumer Privacy Act (“OCPA”) provides consumers residing in Oregon (“Oregon Consumers” or “you”) with specific rights regarding their personal data. This Privacy Notice (“Notice”) supplements the Mutual of Omaha Mortgage Online Privacy Policy (“Policy”) and applies solely to Oregon Consumers. This Notice describes the practices of Mutual of Omaha Mortgage, Inc. and its subsidiaries and affiliates that link to the Policy (“Mutual Mortgage,” “we,” “us,” or “our”) regarding the collection, use, disclosure, sale, and retention of personal data we will collect from you and other Oregon Consumers. This Notice also explains your rights regarding your personal data and how you can exercise those rights.

Scope of This Notice

As part of running our business, we collect personal data from various types of Oregon Consumers. We do not collect, sell, or disclose the personal data of any covered Oregon Consumers under the age of 16. In this Notice, personal data has the meaning described below and excludes certain information subject to other laws.

“Personal data” is defined for purposes of this Notice and the OCPA as data, derived data or any unique identifier that is linked to or is reasonably linkable to you or your device that identifies, is linked to or is reasonably linkable to you or other Oregon Consumers in your household. Personal data includes, for example, data collected directly from you if you use certain services available on our sites or personal information that you voluntarily provide, such as information you provide in response to a questionnaire or survey. We may also collect or receive data about you through or from our business partners, service providers, marketing partners, and other third parties that perform services for us or for you, or to market our products and services to you. Please see the “Personal Data We Process” section of this Notice to learn more about the types of personal data we may process.

Under the OCPA, and for the unique consumer rights described below, personal data does not include:

• Publicly available data, such as data from government records, widely-distributed media, or data we reasonably believe you made available to the general public or have not restricted to a specific audience;
• Deidentified personal data we maintain in deidentified form and do not attempt to reidentify except as required or permitted by law;
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); and
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act (“GLBA”), and the Driver’s Privacy Protection Act of 1994

We separately provide notices pursuant to other state and federal laws, such as FCRA, GLBA, and other applicable state specific financial privacy laws in connection with financial products and services subject to those laws.

Personal Data We Process

We may process various categories of personal data concerning Oregon Consumers. These categories may include those described in the Policy as well as the following:

Identifiers. This may include a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, telephone numbers, or other similar identifiers.

Commercial information. This may include records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Internet or other similar network activity. This may include browsing history, search history, or information on a consumer’s interaction with a website, application, or advertisement.

Geolocation data. This may include physical location or movements.

Audio, electronic, visual, thermal, olfactory, or similar information. This may include audio, electronic, visual, thermal, olfactory, or similar information.

Inferences drawn from other personal data. This may include information, data, assumptions, or conclusions derived from facts, evidence, or another source of information or data reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

Business Purposes for Processing Personal Data

We may process personal data for various business purposes. These purposes may include those described in the Policy as well as the following:

Security And Fraud Detection. We use personal data for our security and fraud detection services including: detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity.

Debugging. We use personal data to engage in debugging to identify and repair errors that impair existing intended functionality.

Improvement Of Products And Services. We use personal data to verify, maintain, and improve our products and services.

Internal Research. We use personal data for our internal research related to technological development and demonstration.

Advertising And Marketing Services. Generally speaking, we collect, use, and/or disclose personal data for the following business purposes:

Marketing To You.  For example, this may include determining what products and services you may be interested in; marketing products and services to you; providing mortgage product information; screening for mortgage product eligibility and qualification; and audio and electronic information, such as call recordings for marketing.

Enhancing Your Experience With Us On Our Website.  For example, this may include identifying website visits, ad interaction, and search history; recommending mortgage products based on preferences; delivering jurisdiction-specific website content; tailoring your experience on our website; and drawing inferences from personal data to tailor your experience on our website and identify the products you might be interested in.

Marketing Enhancement. For example, this may include conducting data analytics; reporting lead conversions; optimizing online searching; and identifying consumer mortgage product interest.

Legal Obligations. We use personal data to comply with legal and compliance obligations.

Audits. We use personal data to audit current interactions with you and related transactions (e.g., counting and verifying ad impressions, auditing compliance).

Commercial And Economic Interests. We use personal data to advance our commercial or economic interest, including but not limited to onboarding, maintaining, and offboarding investors, brokers, and vendors and supporting broker and vendor customer service, marketing, and other business purposes.

Merger, Acquisition, And/Or Bankruptcy. We may use your personal data as part of a merger, acquisition, bankruptcy, or other transaction where a third party assumes control of us.

Third Parties to Whom We May Disclose Your Personal Data For a Business or Commercial Purpose

We may disclose your personal data to the following categories of third parties:

Web And Data Analytics Providers. This category may include third-party tracking technology, cookie, and pixel operators on our website, which collect and use personal data to analyze the use, performance, and effectiveness of our services, communications, and marketing.

Digital Marketing Providers. This category may include third parties that facilitate the delivery of our online advertisements, promotions and offers.

Financial And Payment Technology Providers. This category may include third parties that provide solutions for projecting mortgage loans and communicating with non-customer/non-applicant leads and prospects.

Categories of Personal Data We Disclose to Third Parties and Third Parties’ Business or Commercial Purposes for Processing Personal Data

Your Privacy Choices

Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

Right to Confirm and Access

You may have the right to request us to confirm whether we process or have processed your personal data and to disclose (and direct our processors to disclose):

• The categories of personal data we process or have processed about you;
• A copy of the personal data we processed or are processing about you; and
• The list of third parties to whom we have disclosed any personal data.

Right to Delete

You may have the right to request us to delete any of your personal data we collect and retain (and direct our processors and third parties to do the same).

Right to Correct

You may have the right to request us to correct inaccurate personal data that we maintain about you (and direct our processors and third parties to do the same). Alternatively, we may delete the inaccurate personal data if doing so does not negatively impact you, or if you consent.

Opt-Out Rights

You may have the right to request we opt you out of selling your personal data (and direct our third parties to do the same).

You may submit a request by clicking here and completing our Oregon Consumer Rights Request form, by contacting us at the following toll-free number: 844-413-6884, or by enabling an opt-out preference signal in your device or browser.

An opt-out preference signal is a setting or extension in a browser or device that a web user sets to prevent the selling of personal data on sites the browser or device visits. You can use an opt-out signal by downloading a browser or browser extension and enabling the signal feature. To learn more, click here. We will process your signal as a request to opt data associated with your device, browser, and/or consumer profile out of selling.

We will consider only those requests submitted using these three options.

Exceptions

We may deny your request if retaining the personal data is reasonably necessary for us (or our processors) to:

• Complete the transaction for which we collected the personal data, provide a good or service that you requested, take actions reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• Help ensure security and integrity of our systems;
• Preventing, detecting, protecting against, or responding to, and investigating, reporting or prosecuting persons responsible for, security incidents, malicious, deceptive, fraudulent, or illegal activity;
• Debug systems to identify and repair errors that impair existing or intended functionality;
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deleting the personal data may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Comply with a legal obligation; and
• Make other internal and lawful uses of the personal data that are compatible with the purposes for which we collected and processed it and are and disclosed in this Notice.

Other legal limitations and exceptions may also apply.

Exercising Your Rights

How to Submit a Request to Exercise Your Rights

To exercise any of the rights described above, you may submit a request either by clicking here  and completing the linked Oregon Consumer Rights Request form or by contacting us at the following toll-free number: 1-844-413-6884. Except requests to opt-out of selling, we will consider only those requests submitted using these two options. For a request to opt-out of selling of personal data on sites the browser or device visits, we will also recognize an opt-out preference signal enabled on your device or browser as described above in “Opt-Out Rights.”

Exercising Your Rights to Confirm and Access, Delete, Correct, and Opt-Out

Only you or your authorized agent may make an authenticated consumer request to confirm and access, delete, correct, or opt-out your personal data. If you use an authorized agent to submit an authenticated consumer request on your behalf, you will be required to provide additional information as described below.

In order to authenticate your identity to process your request, we will request your full name, street address, city, zip code, phone number, and email address. For us to treat your request as an authenticated consumer request, you must:

• Provide sufficient information, commensurate to the type or sensitivity of the information you are requesting, that allows us to reasonably authenticate that you are the person about whom we collected personal data or an authorized representative; and
• Describe your request in sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal data if we are unable to: (a) authenticate your identity or authority to make the request, (b) confirm the personal data we have in our systems relates to you, or (c) locate your data in our systems. If the information you provided us does not match our records, in certain circumstances we may request additional information from you. If the information you provided us does match our records, your request is authenticated (an “authenticated consumer request”).

In certain circumstances, an authorized agent may submit a rights request for you. An authorized agent is a natural person or business entity you have given permission to submit a request on your behalf. An authorized agent must submit a request using one of three designated methods described above. We must be able to authenticate the authorized agent has the authority to act on your behalf. In order to authenticate the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney; or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement by you authorizing the authorized agent to submit an authenticated consumer request on your behalf.   Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to authenticate your identity in connection with the request.

Response Timing and Format

We endeavor to respond to an authenticated consumer request to confirm and access, to delete, correct, or opt-out within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your authenticated consumer request unless you have already made a request within the preceding twelve (12) months. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your OCPA rights.

Changes to Our Privacy Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated Notice on the website and update the Notice’s effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.

The effective date of the rights for Oregon residents described in this Notice is July 1, 2024. Changes to the Notice will not affect our use of previously provided personal data.

Contact Information

If you have any questions about this Notice, the ways in which we may collect and use your personal data described in this Notice, and your choices and rights regarding such use, please feel free to contact us as follows:

• Sending an e-mail request to: mmcompliance@mutualmortgage.com
• Sending a letter via US Mail to:

3131 Camino Del Rio N., Suite 1100. Mutual of Omaha Mortgage, Inc San Diego, CA 92108

Appealing our decision about your rights

If we have denied your request to exercise your rights under the OCPA, you may appeal our denial. Please submit your appeal request by:

Sending an e-mail request to privacy.office@mutualofomaha.com