CollegeData Privacy Center

Last Updated: March 10, 2023

COLLEGEDATA CALIFORNIA PRIVACY POLICY

This CollegeData California Privacy Policy (“Privacy Policy”) explains how 1st Financial Bank USA (“Bank”, “we”, “us” or “our”) collects, uses and discloses Personal Information (defined below) about natural persons who are California residents and users of our online college adviser service, CollegeData (“California CollegeData users”, “you” or “your”), as required by the California Consumer Privacy Act of 2018 and amended by the California Privacy Rights Act of 2022 (together, “CCPA”). 

  1. Personal Information

For purposes of this Privacy Policy, “Personal Information” is information that identifies, relates to, or could reasonably be linked with a particular California resident or household.

  1. Our Collection of Personal Information

The following table details which categories of Personal Information we collect and process, including within the 12 months preceding the date this Privacy Policy was last updated.

Categories of Personal Information Examples
Identifiers Real name, alias, postal address, unique personal identifier, online identifier, IP address and email address
Personal information categories in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) Name, contact information, and education information
Education information Name of high school attending or attended, year of high school graduation, expected year of college graduation, grades, transcripts, standardized test scores, and other similar education information

We do not collect or process sensitive Personal Information, as defined under the CCPA.

We do not disclose the above categories of Personal Information to any third parties for our operational business purposes. We may, however, disclose the above categories of Personal Information to a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business assets, or stock (including in connection with any bankruptcy or similar proceedings).

We do not “sell” Personal Information, and we do not “share” or otherwise process Personal Information for purposes of cross-context behavioral advertising, as defined under the CCPA. We have not engaged in such activities in the 12 months preceding the date that this Privacy Policy was last updated. Without limiting the foregoing, we do not sell or share Personal Information of minors under 16 years of age.

  1. Purposes for the Collection, Use and Disclosure of Personal Information

We may collect, use or disclose the categories of Personal Information set forth in the table above for one or more of the following business purposes:

  • To operate, manage and maintain the CollegeData website and other online services and applications;

  • To personalize, develop, market and provide our products and services;

  • To accomplish our business purposes and objectives;

  • To conduct research and data analysis;

  • To facilitate and implement any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings);

  • To comply with law, legal process and internal policies; and

  • To maintain records.

  1. Retention Period

We retain Personal Information for as long as needed or permitted in light of the purpose(s) for which it was collected. The criteria used to determine our retention periods include: 

  • The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you keep using our services) and the length of time thereafter during which we may have a legitimate need to reference your Personal Information to address issues that may arise;

  • Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or

  • Whether retention is advisable in light of our legal position (such as, in regard to applicable statutes of limitations, litigation or regulatory investigations).

  1. Sources of Personal Information

We collected the categories of Personal Information set forth in the table above from the following types of sources:

  • Directly from you, such as from paper or electronic forms and applications you complete.

  1. Individual Rights

The CCPA gives you specific rights regarding your Personal Information. These rights are described below.

Access to Personal Information. You may request that we disclose to you the following information covering the 12 months preceding your request:

  • The categories of Personal Information we have collected about you;

  • The categories of sources from which we collected Personal Information about you; 

  • The business or commercial purposes for collecting Personal Information about you;

  • The categories of Personal Information about you that we disclosed to third parties for a business purpose and the categories of third parties to whom we disclosed such Personal Information; and

  • A copy of your Personal Information including the specific pieces of Personal Information we have collected about you, including a copy of the Personal Information you provided to us in a portable format.

Delete Personal Information. You may request that we delete any Personal Information that we collected from you, subject to certain exceptions.

Correct Inaccurate Personal Information. You may request that we correct inaccurate Personal Information that we collect or maintain about you.

We will not unlawfully retaliate against you for making a request under the CCPA. In some instances, we may decline to honor your request where the law or right you are invoking does not apply or where an exception applies. We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request.

  1. How to Make a Request

You may make a privacy request by calling us at 1-800-733-1732 or sending us a message through CollegeData’s website at www.collegedata.com/contact-us.

We cannot respond to a privacy request unless we are able to verify that the requestor is the California CollegeData user about whom we have collected Personal Information (“verifiable consumer request”). To enable us to determine whether a request is a verifiable consumer request, we may need to request additional Personal Information from you, such as your name, email address and date of birth, in order to verify your identity and protect against fraudulent requests.

Only you or an agent that you have authorized to act on your behalf may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. Before acting on a request from an authorized agent, we may require that you verify your identity and provide your written permission authorizing the agent to make a request on your behalf. We may decline to honor a request from an authorized agent who does not submit proof that you authorized him, her or it to act on your behalf.

We will not respond to an access request more than twice in a 12-month period.

  1. De-identified Information

Where we maintain or use de-identified data, we will continue to maintain and use the de-identified data only in a de-identified fashion and will not attempt to re-identify the data.

      9. Contact Us for More Information

For questions or concerns about our privacy policies or practices, the ways in which we collect and use your Personal Information, your rights and choices regarding the collection and use of your Personal Information, and to exercise your rights under the CCPA, you may call us at 1-800-733-1732 or send us a message through CollegeData’s website at www.collegedata.com/contact-us.

      10. Changes to Privacy Policy

We may, at any time and from time to time in our sole discretion, amend this Privacy Policy. When we do, we will post the revised Privacy Policy on this page with a new “Last Updated” date.