California Privacy Policy

This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS supplements the information contained in the Privacy Statement of Highlands Residential Mortgage, Ltd (“Highlands Mortgage, HRM,” “we,” “us,” or “our”) and applies solely to those individuals who reside in the State of California (“consumers” or “you”). We are issuing this Notice in compliance with the California Consumer Privacy Act of 2018 (“CCPA”) and other applicable California privacy laws. Any terms used in this Notice that are not defined in the Notice itself have the same definition as used in the CCPA.

Definition of Personal Information

We collect certain “personal information” from consumers. The CCPA defines personal information as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device. Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated information.
• Information excluded from the CCPA’s scope, like:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • personal information covered by certain other privacy laws, like the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) and California Financial Information Privacy Act (FIPA).

What Personal Information We Collect

We have collected the following categories of personal information from consumers within the last twelve (12) months:

Categories of Sources

We obtain the categories of personal information listed above:

• from the companies from which we buy or consider buying loans (our “customers”) or their agents, from our loan servicing agents and from our service providers in connection with the purchase and securitization of loans and the resecuritization and sale of such securities.
• from credit bureaus and other vendors who provide credit and other background information on individuals for credit and due diligence purposes.
  from activity on our websites or mobile application (for example, from submissions to our mobile application or through our website portals, or from automatically collected website or mobile application usage details).
• from borrowers and loan applicants.
• from third-parties from whom we obtain products or services.

How We Use Personal Information

We may use or disclose personal information we collect for one or more of the following business purposes:

• To fulfill the request or satisfy the reason for which the information is provided. For example, if you provide your personal or financial information through our mobile application, we organize, store and retain that information, making the information available to the loan officer so the he or she can determine your readiness to purchase a home and get your finances and credit profile ready for success in the mortgage application process.
• In connection with activities related to securitizing mortgages and selling the securities (our secondary market-related activities). For example, we use personal information to evaluate loans that we are considering guaranteeing and to monitor the performance of loans that we own or guarantee. As another example, we use this information to evaluate the value of properties collateralizing these loans and to predict default.
• If you send us an email or message and provide your name or other personal information, we may use this information to research your question, to send an answer to your question and to deliver the requested information or service to you. We also may use this information to provide you with information in which we believe you will be interested; however, at any time, you may request that we stop doing this by contacting us in the manner described in the “How to Contact Us” section of this Notice.
• To provide our customers with email alerts, event registrations and other notices concerning our products or services, events, news, or other items that may be of interest.
  With regard to website visitor information, to measure the number of visitors to different pages on the website, conduct statistical modeling and evaluate, modify and enhance our websites, our services and our business. We also use this information to monitor network traffic and to identify unauthorized access or unusual activity on the website.
• The mobile application will also capture information about your mobile device and your usage of the application, including location, session duration and similar data. We use this to help refine the application.
• In connection with employment applications to, or employment with, Highlands Residential Mortgage, Ltd, and in connection with our employment processes more generally (such as assessing an individual’s suitability for a position, determining compensation and eligibility to work, arranging or reimbursing travel and other expenses, career planning and development, compliance with policies and procedures, administering benefits, maintaining emergency contacts and granting access to internal systems).
• To carry out our obligations and enforce our rights arising from any loan documents or other contracts we have entered into, including for collections.
• To evaluate or conduct a restructuring, reorganization, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• In connection with the security and access control systems for our offices, buildings and other facilities, if you work for or with Highlands Residential Mortgage, Ltd.
• As necessary or appropriate to protect the rights, property or safety of us, our customers or others.
• As required by applicable laws, regulations and court orders, and requests from Congress, our regulators, or our conservator.
• To respond to law enforcement requests.
• For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, or other misconduct.
• To establish or defend legal claims and allegations.
• To seek advice from lawyers, auditors and other professional advisers.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We do not do the following things with your personal information:

• We do not sell personal information to third parties for advertising or marketing products and services to you, or to third parties whose purpose in acquiring the information is to sell your personal information to others for advertising or marketing purposes.
• We will not collect additional categories of personal information or use the personal information we collect for materially different, unrelated, or incompatible purposes without first providing you notice in the manner specified in the “Changes to this Notice” section of this Notice.

How We Share Personal Information

We may disclose your personal information to third parties for business-related purposes.  Before we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient not to use or disclose the information except for purposes specified in the contract (typically to perform services for us).

In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

• Category A: Identifiers.
• Category B: California Customer Records personal information categories.
• Category C: Protected classification characteristics under California or federal law.
• Category D: None
• Category I: Professional or employment-related information.
• Category J: None (per the Family Educational Rights and Privacy Act (20 U.S.C.1232g, 34 C.F.R. Part 99)).

Third Parties to Whom We Disclose Personal Information

We disclose your personal information to the following categories of third parties:

• Service providers.
• Third parties to whom you or your agents authorize us to disclose your personal information in connection with activities we perform or services we provide to you or in connection with your loan.
• Third parties who assist us with this or our other websites, or our applications. This may include information you provide as part of voluntary surveys about application or website-related issues taken after visiting this site.
• Third parties as part of our secondary market-related activities and other aspects of our business, including to loan servicers, consumer reporting agencies, workout companies, attorneys, and technology providers who enable us or third parties to perform business, professional, and technical support functions for us or you. For example, we may disclose personal information to third parties to administer or protect our interest in a loan.

We also may disclose personal information to our regulators, our conservator, and as otherwise required by applicable laws, regulations and court orders.

In the twelve (12) months preceding the date of this Notice, we have not sold any personal information other than as specified in this Notice.

Your Rights and Choices under the CCPA

The CCPA provides California residents with specific rights regarding their personal information. This section describes consumers’ CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Before we disclose information to you, we will ask you for information to verify your identity.  Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or sharing that personal information.
• The categories of third parties with whom we share that personal information.
  • If we disclosed your personal information for a business purpose, the business purpose and the categories of personal information that each category of recipient received.

Additionally, if you have requested it and have provided sufficient identifying information to enable us to do so, we will disclose the specific pieces of your personal information that we collected about you.

Please note that we may not disclose the information you have requested if we are unable to verify your identity.  In addition, we may not disclose certain information that is covered by one or more of the exemptions from the CCPA, as outlined earlier in this Notice.

Deletion Request Rights

You have the right to request that we delete personal information that we collected and retained. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.  If we deny your deletion request, we will inform you and explain the basis for our denial.

How to Exercise Your Access, Data Portability, and Deletion Rights

To exercise your rights described above, please submit a request to us by either:

• Calling us at 866-912-7511 or
• Submitting a request via the form at the bottom of this page.

You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it.  You may only make a request for access or data portability twice within any 12-month period.

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. You may also make a request on behalf of your minor child.

As noted earlier in this Notice, we respond only to requests that are verifiable consumer requests.  Therefore, when you submit a request to us, we will seek to verify your identity by asking you to provide us with information that enables us to identify you, such as your email address or the last four digits of your social security number.  We also may use a third-party verification provider to verify your identity.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Making a request does not require you to create an account with us.  We will only use personal information provided in a request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to each verifiable consumer request within 45 days of its receipt.  If we require more time, we will inform you of the reason and extension period in writing.  If you already have an account with us, we will deliver our written response to that account.  If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.  Any disclosures we provide will only cover the 12-month period preceding our receipt of your verifiable consumer request.  For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.  If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Except to the extent permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Changes to This Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will notify you by posting the updated Notice on our website homepage.  Please be sure to check back periodically for any updates.

How to Contact Us

If you have any questions or comments about this Notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

• Phone: 866-912-7511
• US Mail:
  • Highlands Residential Mortgage, Ltd.
  • 950 W. Bethany Drive, Suite 800
  • Allen, Texas 75013
• Or please contact us by submitting a request via the form below. Version Dated:  September 15, 2021