CCPA Notice of Collection

This California Consumer Privacy Act (“CCPA”) Privacy Policy explains how we collect, share, use, and protect your personal information. This Privacy Policy applies to residents of California to the extent that the California Consumer Privacy Act (“CCPA”) is applicable.  As used in this Privacy Policy, “personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  

However, for purposes of the CCPA, personal Information does not include: (i) publicly available information; (ii) deidentified or aggregated consumer information; or (iii) personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FRCA”) and the Gramm-Leach-Bliley Act (“GLBA”).  Accordingly, this Privacy Policy does not apply to such information.

The specific personal information that we collect, use, and disclose relating to a California resident in different contexts covered by the CCPA will vary based on our relationship or interaction with that individual. For example, this CCPA Disclosure does not apply with respect to information that we collect about California residents who apply for or obtain our financial products and services for personal, family, or household purposes (i.e., information subject to the GLBA). For more information about how we collect, disclose, and secure information relating to these customers, please refer to our U.S. Consumer Privacy Notice. We may use the information described below for any of the purposes described in this Privacy Policy or for our business, security, or operational purposes compatible with the context in which the personal information was collected, unless limitations are listed in this Privacy Policy or described elsewhere at the time of collection of the information.
 

I. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

In the preceding 12-months, we have collected the following categories of personal information (please note that some categories overlap):
 

A. Identifiers

A real name or alias; postal address; signature; home phone number or  mobile phone number; bank account number, credit card number, debit card number, or other financial information; physical characteristics or description; email address; account name; Social Security number; driver's license number or state identification card number; passport number; or other similar identifiers.  

B. Personal information categories described in Cal. Civ. Code § 1798.80(e)

Signature; state identification card number; physical characteristics or description; insurance policy number; education; employment or employment history; bank account number, credit card number, debt card number, or any other financial information; or medical information or health insurance information.

C. Protected classification characteristics under state or federal law

Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

D. Commercial information

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

E. Biometric information

Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

F. Internet or other similar network activity

Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

G. Geolocation data

Physical location or movements.  For example, city, state, country, and ZIP code associated with your IP address or derived through Wi-Fi triangulation; and, with your permission in accordance with your mobile device settings, and precise geolocation information from GPS-based functionality on your mobile devices.

H. Sensory data

Audio, electronic, visual, or similar information.

I. Professional or employment-related information.

Current or past job history, performance evaluations, disciplinary records, workplace injury records, disability accommodations, and complaint records; Emergency contact information, such as the name, phone number, address and email address of another person in the context of having an emergency contact on file; Personal information necessary for us to collect and retain to administer benefits for you and another personal relating to you (e.g., your spouse, domestic partner, and dependents), such as their name, Social Security Number, date of birth, telephone number, email, and address.

J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

Educational records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

K. Inferences drawn from other personal information.

Profile reflecting a person’s preference, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

L. Sensitive Personal Information.

A consumer’s social security, driver’s license, state identification card, or passport number; A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; A consumer’s precise geolocation; A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication; A consumer’s genetic data; A consumer’s neural data; The processing of biometric information for the purpose of uniquely identifying a consumer; Personal information collected and analyzed concerning a consumer’s health; and Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation; Personal information of consumers that the business has actual knowledge are less than 16 years of age.

II. CATEGORIES OF SOURCES FROM WHICH PERSONAL INFORMATION IS COLLECTED

  • We obtain the categories of personal information listed above from the following categories of sources:
    Directly from consumers or their agents. For example, from forms you complete, when you perform transactions, and when you purchase products or services.

  • Indirectly from consumers or their agents. For example, when you use your debit or credit cards, when you make deposits or withdrawals to/from your accounts, or when you pay your bills.

  • Directly and indirectly from activity on our website or our mobile applications. For example, from submissions through our website, application portals, or website usage collected automatically.

  • From third-parties, such as credit reporting agencies, government agencies, law enforcement agencies, and service providers.

III. BUSINESS OR COMMERCIAL PURPOSE FOR COLLECTING PERSONAL INFORMATION

We may collect, use and disclose your personal information for one or more of the following business or commercial purposes:

  • To fulfill or meet the reason for which the information is provided.  For example, you apply for a loan, and we use the information in your loan application to give you the loan.

  • To provide you with information, products or services that you request from us.

  • To evaluate your candidacy for employment or for an independent contractor engagement, and to administer employment-related benefits for you, your spouse or domestic partner, and your dependents.

  • To provide you with email alerts, event registrations or other notices concerning our products or services, or events or news, that may be of interest to you.

  • To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.

  • To improve our website and present its contents to you.

  • For testing, research, analysis to improve our products and services and for developing new ones.

  • To protect the rights, property or safety of us, our employees, our members or others.

  • To detect security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

  • To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

  • As described to you when collecting your personal information.

  • To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, in which personal information held by us is among the assets transferred. 

  • As otherwise permitted by law.

We do not use or disclose your sensitive personal information for any purpose other than, as reasonably necessary and proportionate, for the following purposes:

  • To perform the services or provide the goods reasonably expected by an average consumer who requests those goods and services. 

  • To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.

  • To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.

  • To ensure the physical safety of natural persons.

  • For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with the business, provided that the personal information is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside of your current interaction with us.

  • For our service providers or contractors to perform services on our behalf, such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf; provided, however, that the use of your sensitive personal information is reasonably necessary and proportionate for this purpose.

  • To verify or maintain the quality or safety of a service or device that is owned, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured for, or controlled by us; provided, however, that the use of your sensitive personal information is reasonably necessary and proportionate for this purpose.

  • To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about you Identifiers

IV. HOW WE SHARE AND DISCLOSE PERSONAL INFORMATION

In addition to the specific situations discussed elsewhere in this Privacy Policy, we may disclose your personal information in the following situations:

  • Service Providers.  We may share your information with service providers.  Among other things, service providers may help us to administer our website, conduct surveys, provide technical support, process payments, assist in the fulfillment of services, and help us market our own products and services.

  • Joint Marketing Partners.  We may share your information with other companies to offer you co-branded financial products and services. 

  • Advertising Networks.  We may share your information with advertising networks such as Google and Meta to help deliver our advertisements to you as you are browsing online.

  • Compliance with Laws and Other Lawful Uses.  We may disclose information to law enforcement agencies and other government entities or private parties in litigation in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws.  We may also share your information with this parties to establish or exercise our rights, to defend against a claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies.  We may also disclose your personal information with our acquisition or merger partners in the event of an acquisition or merger.  Furthermore, we may disclose your personal information as permitted by applicable law.  All of the categories of personal information we collect from you may be disclosed for this purpose.

  • Your Consent.  All the categories of personal information we collect from you may be disclosed to third parties with your consent or direction.

In addition to the information above, California law requires that organizations disclose whether the specific categories of personal information defined in the CCPA have been disclosed to third parties for a “business purpose,” or “sold” or transferred for “valuable consideration, or “shared” for purposes of cross-context behavioral advertising.  We do not have actual knowledge of selling or sharing personal information of minors under 16 years of age for cross-context behavioral advertising.

The table below indicates which of these specified categories we may collect and transfer in a variety of contexts.

V. YOUR RIGHTS AND CHOICES

This section describes your rights and choices regarding how we collect, share, use, and protect your personal information, how to exercise those rights, and limits and exceptions to your rights and choices.

  1. Exceptions

    The rights and choices in this section do not apply:

  • If you are not a California resident.

  • If we collected personal information covered by certain financial sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA). Such laws govern how we collect, share, use and protect your personal information instead of the CCPA.

  • To aggregate consumer information.

  • To deidentified personal information.

  • To publicly available information.

  1. Right to Know

    If the above exceptions do not apply, and you have not made this request more than twice in a 12-month period, you have the right to request that we disclose certain information to you about our collection and use of your personal information.  Once we receive and confirm your request and verify that the request is coming from you or someone authorized to make the request on your behalf, we will disclose to you or your representative:

  • The categories of personal information we collected about you.

  • The categories of sources for the personal information we collected about you.

  • Our business or commercial purpose for collecting, sharing or selling that personal information.

  • The categories of third parties to whom we disclosed, shared or sold your personal information.   

  • The specific pieces of personal information we collected about you in a form that you can take with you (also called a “data portability request”).

To exercise the Right to Know, a consumer or a consumer’s authorized agent may submit a verifiable consumer request to us by either:

  1. Right to Delete

You have the right to request that we delete any of your personal information that we collect from you and retained, subject to certain exceptions. Once we receive and verify your request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.  We may deny your deletion request if retaining the information is necessary for us or our service providers to:

  1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

  2. Help to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for those purposes.

  3. Debug to identify and repair errors that impair existing intended functionality. 

  4. Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.

  5. Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.

  6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you previously provided informed consent.

  7. To enable solely internal uses that are reasonably aligned with your expectation based on your relationship with the us and compatible with the context in which you provided the information.

  8. Comply with a legal obligation.

To exercise the Right to Delete, a consumer or a consumer’s authorized agent may submit a verifiable consumer request to us by either:

  1. Right to Correct

You have the right to request changes to any of your personally identifiable information that we have collected through our website and online services. 

To exercise this Right to Correct, a consumer or a consumer’s authorized agent may submit a verifiable consumer request to us by either:

  1. General Description Regarding Identity Verification Requirements

We cannot respond to a Request to Know, Delete, Correct or Access ADMT without first verifying the identity of the requestor.  Making a verifiable consumer request does not require you to create an account with us. However, we may consider requests made through a password protected account with us sufficiently verified when the request relates to personal information associated with that specific account. 

If we receive a request through and authorized agent of the consumer, we will require: 

  1. Submission of a written document signed by the consumer with the consumer’s permission for the authorized agent to submit a verifiable request on their behalf and require the authorized agent to verify their own identity to us; or

  2. The consumer to directly verify with us that they have authorized the agent to submit the request. 

  3. We will not require either of the above if the authorized agent provides a copy of a power of attorney pursuant to California Probate Code sections 4121 to 4130 and we are able to verify authorized agent’s identity.

We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.  We will ask you to complete the CCPA Request Form which will ask you for information that will help us verify your identity.  The verification process includes matching the information you provide us with the information we have in our records.  The stringency of the verification process depends on the sensitivity of the request, whether or not the consumer is a current customer with a password-protected account, the need to prevent unauthorized access and disclosure of personal information and other factors.  Within 10-days of your submission of your CCPA request, we will notify you of any additional information we might need to verify your identity. 

  1. Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of its receipt.  If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.  For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.  We do not charge a fee to process or respond to your verifiable consumer request.

VI. CHANGES TO OUR PRIVACY POLICY

We reserve the right to amend this Privacy Policy at our discretion and at any time.  When we make changes to this Privacy Policy, we will notify you by email or through a notice on our website homepage.

VII. CONTACT INFORMATION

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights, or to request changes to any of your personally identifiable information that we have collected, please do not hesitate to contact us at:

Phone:             800-300-9728

Website:          https://www.wpccu.org  

Email:              compliance@wpcu.org 

Mail:                Attn: Compliance Department, 1053 W Sunset Blvd , Los Angeles, CA 90012-2134

Revised 1/28/2026

Apply Online