California Privacy Notice (Insurance Producers)

 
Effective February 12, 2024

This California Privacy Notice (the “Privacy Notice”) applies to insurance producers who reside in California (collectively, “Consumers” or “you”).  Clear Spring Life and Annuity Company (d/b/a Clear Spring Life and Annuity Insurance Company in California) (the “Company,” “us” or “we”) is providing this Privacy Notice to describe the Personal Information we collect, where we collect it from, how we use it in connection with your relationship with the Company or any of its affiliates and subsidiaries, who we share it with, how long we keep your Personal Information, and what rights you have over your Personal Information under the California Consumer Privacy Act of 2018, as amended  (“CCPA”) and the California Privacy Rights Act (“CPRA”).  
 
Categories of Personal Information We Collect
 
We collect the following categories of personal information (“Personal Information”) and have done so in the preceding 12 months.
 

Categories of Information	Data Collected
Identifiers	Name, work address, home address, telephone numbers, fax numbers, email address, internet protocol (“IP”) address, unique agent ID number, taxpayer ID, and Social Security number
Personal Information Described in California Civil Code 1798.80 (e)	Home address, personal contact details, degrees, certifications or licenses, bank account and routing number, Social Security number, home address, telephone numbers, and fax numbers
Protected Classifications Information	Protected classification characteristics described in California Civil Code 198.8(e), including age and sex/gender
Internet and Network Activity Information	Internet or network activity information, such as browsing history, online behavior, access logs and interactions with Company or Company affiliates’ systems and websites, and URLs in the form of login portals which may collect information from cookies disclosing IP address
Professional or Employment-Related Information	Compensation, commissions, one-time payments, professional memberships and affiliations, state license appointment documents, certifications for product training, national producer number, broker-dealer FINRA affiliation, errors and omissions insurance coverage information, regulatory agency disciplinary actions, and complaints, investigations, proceedings by Departments of Insurance
Personal Information Not Within One of the Defined Categories in California Civil Code 1798.140 (o)	Account logins, required security codes, passwords, or credentials that would allow access to any accounts; login and/or passcodes to Company or Company affiliates’ networks; and agent communications, including contents of email and mails between you and us
Sensitive Personal Information	Social Security number, driver’s license number, passport number, account login, geolocation, contents of mail, email, and text messages

 
We collect Sensitive Personal Information as defined under the CCPA and CPRA, but we only use Sensitive Personal Information for purposes authorized by the CCPA and CPRA.

How do we collect your information?

We obtain Personal Information about Consumers from the following categories of sources and have done so in the past 12 months:

Information you provide to us directly, including information provided in your agent application, product training certificates, licenses, and emails and calls you send or make to us;

Information we collect or receive from third parties, including our contractholders who may be your clients, claim administrators and investigators, government or administrative agencies or Departments of Insurance;

Automated technologies on Company websites;

Publicly available sources; and/or

Our affiliates.
 
 
How do we use your Personal Information and who do we disclose it to?

The Company uses the following categories of Personal Information for the following purposes and discloses this information to certain categories of third parties and has done so in the past 12 months.

Our service providers are required under written contract to implement appropriate security measures to protect your Personal Information consistent with our policies and all data security obligations applicable to us.  We do not permit our service providers to process Personal Information for their own purposes; they only process your Personal Information to the limited extent required to provide their services to us and only for the purpose that we disclosed your Personal Information to them.
 

Business Purpose for Use of the Personal Information We Collect from You	Categories of Personal Information Collected from You	Disclosed to These Categories of Third Parties
Appointment-related purposes: evaluating qualifications; facilitating communications; executing agent agreements; managing licenses, permits or certificates	Identifiers; Professional or Employment Information; Protected Classifications Information; Sensitive Personal Information	Affiliates; service providers
Compensation-related purposes:  administering and providing agent compensation, including commission payments	Identifiers; Personal Information Described in California Civil Code 1798.80 (e); Professional or Employment Information; Sensitive Personal Information	Affiliates; service providers; public entities including tax and other regulatory agencies; advisors including law firms, accountants, auditors, and tax advisors
Business-related purposes: performing services, including maintaining and servicing accounts; providing customer service; processing transactions; verifying Consumer information	Identifiers; Personal Information Described in California Civil Code 1798.80 (e); Professional or Employment Information; Internet and Network Activity Information; Sensitive Personal Information; Personal Information Not Within One of the Defined Categories in California Civil Code 1798.140 (o)	Affiliates; service providers; public entities including tax and other regulatory agencies; advisors including law firms, accountants, auditors, and tax advisors
Internal compliance-related purposes: ensuring compliance with applicable Company policies and procedures, including to protect the Company’s and its affiliates’ rights, property or safety; performing internal investigations; to maintain records as required by law and internal policies; to perform identity verification	Identifiers; Personal Information Described in California Civil Code 1798.80 (e); Professional or Employment Information; Internet and Network Activity Information; Sensitive Personal Information; Personal Information Not Within One of the Defined Categories in California Civil Code 1798.140 (o)	Affiliates; service providers; public entities including tax and other regulatory agencies; advisors including law firms, accountants, auditors, and tax advisors
IT-related purposes: Conducting debugging to identify and repair errors that impair existing intended functionality; conducting risk and security controls and monitoring; monitoring compliance with IT policies; ensuring security of electronic systems, network, website, and managed devices	Identifiers; Personal Information Described in California Civil Code 1798.80 (e); Professional or Employment Information; Internet and Network Activity Information; Personal Information Not Within One of the Defined Categories in California Civil Code 1798.140 (o)	Affiliates; service providers; public entities including tax and other regulatory agencies; advisors including law firms, accountants, auditors, and tax advisors
Communications-related purposes: communicating with you; for emergency services	Identifiers; Internet and Network Activity Information; Personal Information Not Within One of the Defined Categories in California Civil Code 1798.140 (o)	Personal Information not within one of the Defined Categories in California Civil Code 1798.140 (o)
Legal and regulatory purposes: Responding to law enforcement requests; disclosures required in  court proceedings, court orders, or pursuant to subpoenas and civil discovery requests, other legal process or as required by law; exercising and defending legal claims; exercising and defending our legal rights and positions; protecting confidential and trade secret information; complying with applicable laws and regulatory requirements and administration of those requirements; detecting and preventing fraud	Identifiers; Personal Information Described in California Civil Code 1798.80 (e); Professional or Employment Information; Internet and Network Activity Information; Sensitive Personal Information; Personal Information Not Within One of the Defined Categories in California Civil Code 1798.140 (o)	Affiliates; service providers; public entities including tax and other regulatory agencies; advisors including law firms, accountants, auditors, and tax advisors
Finance and audit-related purposes: performing accounting, audit, and other internal functions, including internal investigations, corporate financial responsibilities for tax and accounting purposes, internal and external audits; performing cost and budgeting analysis and control	Identifiers; Internet and Network Activity Information; Personal Information Described in California Civil Code 1798.80 (e); Professional or Employment Information; Personal Information not within one of the Defined Categories in California Civil Code 1798.140 (o)	Affiliates; service providers; public entities including tax and other regulatory agencies; advisors including law firms, accountants, auditors, and tax advisors

 
Do we sell or share your Personal Information?

We do not sell or share your Personal Information.  Furthermore, we do not sell or share the Personal Information of any Consumers under 16 years of age.

How long do we keep your Personal Information?

We retain Personal Information no longer than necessary to fulfill the purposes described in this Privacy Notice, and to comply with applicable laws and regulations.  We consider the following factors when determining how long to retain Personal Information: why we collected the Personal Information; the nature of the Personal Information; the sensitivity of the Personal Information; our legal obligations related to the Personal Information; and the risks associated with retaining the Personal Information.
 
What are your rights?

Consumers have certain privacy rights with respect to some of the Personal Information we may have collected.  You may exercise these rights free of charge except as otherwise allowed under applicable law. We may limit our response to you if an exception applies, as permitted by applicable law. These rights include:

Right to Know, Access, and to Receive a Copy

You have the right to request the categories of Personal Information we have collected about you and to request that we disclose certain information to you about our collection and use of your Personal Information over the preceding twelve months. Once we receive your request and verify your identity, we will disclose to you:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information collected.
• Our business or commercial purpose for collecting the Personal Information.
• The categories of third parties with whom we share Personal Information.
• The specific pieces of Personal Information we have collected about you (also called a data portability request), subject to certain exceptions.

We will not disclose your Social Security number, drivers’ license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics, but we will inform you if we have collected that type of information.

• If your Personal Information was disclosed for a business purpose, a list identifying the Personal Information categories that each category of third party received.

If we cannot verify the identity of the person making the request, we will not disclose any specific pieces of Personal Information to the requestor and shall inform the requestor we cannot verify their identity.

We are not required to search for your Personal Information if all of the following conditions are met:

1. We do not maintain the Personal Information in a searchable or reasonably accessible format.
2. We maintain the Personal Information solely for legal or compliance purposes.
3. We do not sell the Personal Information and do not use it for any commercial purpose.
4. We describe to you the categories of records that may contain Personal Information that we did not search because it meets the conditions stated above.

If we deny your verified request to know specific pieces of Personal Information, in whole or in part, we will inform you and explain the basis for the denial, unless prevented from doing so by law. If the request is denied in part, we will disclose the other information sought by you.

If you have a password protected account with us, we may comply with your request to know by using a secure self-service portal for you to access, view, and receive a portable copy of your Personal Information that discloses the Personal Information you are entitled to.
 
Right to Delete

You have the right to request that we delete any Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable request, we will delete (and direct our service providers to delete) your Personal Information from our records.
We may deny your deletion request if the information is necessary to:

1. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

If your Personal Information is de-identified, we are not obligated to provide or delete this information in response to your request or to re-identify individual data to verify a request to delete.

We are required to inform you whether we have complied with your request to delete, and we will maintain a record of the request as required by law. If we deny your request to delete in whole or in part, we will provide you a detailed explanation of why we denied your request.

If we cannot verify your identity, we may deny the request to delete. If we deny the request to delete, we will inform you that your identity cannot be verified.
 
Right to Correct

You may ask us to correct inaccurate Personal Information about you. In determining the accuracy of the Personal Information that is the subject of your request to correct, we are required to consider the totality of the circumstances relating to the contested Personal Information.

We may deny your request to correct certain Personal Information if we determine that the contested Personal Information is more likely than not accurate based on the totality of the circumstances.

1. Considering the totality of the circumstances includes, but is not limited to, considering:
   1. The nature of the Personal Information (e.g., whether it is objective, subjective, unstructured, sensitive, etc.).
   2. How we obtained the contested Personal Information.
   3. Documentation relating to the accuracy of the information whether provided by you, us, or another source. We will accept, review, and consider any documentation you provide in connection with your correction request. You should make a good-faith effort to provide us with all necessary information available to you at the time of your request.  Any documentation provided by you in connection with your request to correct shall only be used and/or maintained by us for the purpose of correcting your Personal Information and to comply with the CCPA’s record-keeping obligations.
2. If we are not the source of the Personal Information and have no documentation in support of the accuracy of the information, then your assertion of inaccuracy may be sufficient to establish that the Personal Information at issue is inaccurate.

If we comply with your request to correct, we will correct the Personal Information at issue on our existing systems. We will also instruct all service providers and contractors that maintain the Personal Information at issue pursuant to their written contract with us to make the necessary corrections in their respective systems. If we, our service provider, or our contractor stores any Personal Information that is the subject of the request to correct on archived or backup systems, we may delay complying with your request to correct, with respect to data stored on the archived or backup system, until the archived or backup system relating to that data is restored to an active system or is next accessed or used.

Alternately, we may delete the contested Personal Information if deleting it does not negatively impact you or you consent to deletion.
We will inform you whether we have complied with your request.  If we deny your request to correct, either in in whole or in part, we will:

1. Explain the basis for the denial, including any conflict with federal or state law, exception to the CCPA, inadequacy in the required documentation, or contention that compliance proves impossible or involves disproportionate effort.
2. If complying with your request to correct would be impossible or would involve disproportionate effort, we will provide you a detailed explanation as to why we cannot comply with the request.
3. If we deny your request to correct Personal Information collected and analyzed concerning your health, you may provide a written statement to us to be made part of your record. The written statement is limited to 250 words per alleged inaccurate piece of Personal Information and you must request that the statement be made part of your record. Upon receipt of such a statement, we will include it with your record.
4. If the Personal Information at issue can be deleted pursuant to a request to delete, we will inform you that you can make a request to delete the Personal Information and provide instructions on how you can make a request to delete.

 
How do we verify your identity for requests to know, delete and correct?

If you have a password protected account with us, we will verify your identity through our existing authentication practices for your account.
If you do not have a password protected account with us, we will match the identifying information you provide with the Personal Information we already maintain about you, if we do so, or use a third-party identity verification service.

For requests to know the specific pieces of Personal Information, we must verify the request to a reasonably high degree of certainty. This may mean matching at least three pieces of Personal Information provided by you with the Personal Information we maintain, if any, along with a declaration signed under penalty of perjury stating that you are the consumer whose Personal Information is the subject of the request.

For requests to delete or request to correct, we are required to verify the requestor’s identity with a reasonably high degree of certainty depending on the sensitivity of the Personal Information and risk of harm posed to you by unauthorized deletion or correction.

If we cannot verify your identity using the Personal Information we already maintain, if any, we may request additional information from you which will only be used to verify your identity, for security, or for fraud prevention.

If we cannot verify your identity in connection with a request, we will inform you that we cannot verify your identity.  If we cannot verify your identity in connection with making a request to know specific pieces of Personal Information, we must deny the request.
 
Use of Your Sensitive Personal Information
 
We do not use Sensitive Personal Information for purposes beyond those authorized by the CCPA and CPRA.

EXERCISING YOUR RIGHTS

Insurance Producers who live in California have certain rights with respect to the collection and use of their Personal Information. You may access these data rights by calling (800) 767-7749, by emailing us at [email protected] or by clicking here and submitting details regarding your request.
 
Authorized Agent

You may designate an authorized agent to make a request on your behalf. You can make a designation by providing the agent with written permission to act on your behalf. An authorized agent can make a request to know, delete, or correct on your behalf by contacting us at our contact information above.  We may require your agent to provide proof that you granted authority to submit a request.   

Responding to Your Request

We will confirm receipt of your request within 10 business days. If you do not receive confirmation within that timeframe, please contact [email protected]. We endeavor to respond to a verifiable request within forty-five days of receiving it. If we require more time, we will inform you of the reason for the extension in writing.  Any disclosures we provide will only cover the twelve-month period preceding the receipt of your request. If we cannot comply with a request, we will provide the reasons we cannot comply.

Changes to Our Privacy Notice

This Privacy Notice was last updated February 12, 2024. We reserve the right to amend this Privacy Notice at our discretion and at any time. If we make material changes to this Privacy Notice, we will notify you by posting an updated Privacy Notice on our website and listing the effective date of such updates.
 
Contact Information

If you have any questions or comments about this Privacy Notice, the methods used to collect your Personal Information and your choices and rights regarding our use, or if you wish to exercise your rights under California law, please contact us at [email protected].