9.ADDITIONAL PRIVACY INFORMATION FOR OREGON RESIDENTS
Pursuant to the Oregon Consumer Privacy Act (“OCPA”), Oregon residents have specific rights regarding their personal information, which are detailed below. This Oregon-specific privacy section applies to Oregon residents and incorporates by reference Mariner’s general Privacy Statement and provides a comprehensive description of our online and offline practices regarding the collection, use, and disclosure of Oregon residents’ personal information.
Note that the rights set forth under OCPA do not apply to:
Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, and implementing regulations; and
An activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living if done strictly in accordance with the provisions of the Fair Credit Reporting Act.
Categories of Personal Data and Sensitive Data Collected
We currently collect and, in the 12 months prior to the Last Updated date of this Privacy Statement, have collected the following categories of Personal Data about Oregon residents:
Sensitive Data – Sensitive data is collected from consumers and loan applicants. Examples: Information that reveals social security number, driver’s license, state identification card, passport number, account log-in, financial account, debit card, geolocation and biometric information (e.g., for log-in purposes)
Identifiers – Examples: Your real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. Note: Some personal information included in this category may overlap with other categories.
Protected classification characteristics under State or federal law – Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, sex (including gender, gender identity, veteran or military status).
Customer Records with Personal Data – Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Note: Some personal information included in this category may overlap with other categories.
Commercial information – Examples: Information including, but not limited to, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Internet or other similar network activity – Examples: Information including, but not limited to, browsing history, search history, information regarding a consumer’s interaction with a website, loan application, and/or advertisement.
Professional or employment-related information – Examples: Current or past job history and/or performance evaluations.
Inferences drawn from other personal data – Examples: Information that can be used to create a profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
We have collected the above categories of personal data and sensitive data from the following sources:
Directly from our customers and/or their agents.
Indirectly from our customers or their agents. For example, through information we collect in the course of providing services to our customers.
Directly and indirectly from activity on the Site, as described in Section 2 herein. For example, from submissions through the online loan application, Customer Account Center, website usage details collected automatically, and/or Mariner app usage.
From third parties that interact with us in connection with the services we perform. Examples include, but are not limited to, personal information from credit reporting agencies, lead generator partners, as applicable, and cookie information service providers.
We currently collect and have collected the above personal data and sensitive data for the following business or commercial purposes:
For auditing purposes related to our customer relationships, including, but not limited to, verifying the quality of ad impressions and auditing our compliance with applicable law;
For detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
For debugging activities to identify and repair errors that impair Site functionality;
For short-term use, provided that the personal or sensitive data is not disclosed to another third party and is not used to build a profile about a consumer;
For performing services for Mariner or on behalf of a service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of Mariner or a service provider;
For internal research for technological development;
For use in activities to verify or maintain the quality or safety of the services, and to improve, upgrade, or enhance such services; and
For commercial purposes, such as inducing another person to buy, services or enabling or effecting, directly or indirectly, a commercial transaction.
Disclosure, Targeted Advertising, Sale of Personal data, and Profiling
We may use personal and/or sensitive data for targeted advertising, as defined in the OCPA.
In the 12 months preceding the Last Updated Date of this Privacy Statement, we disclosed for a business purpose the categories of personal and sensitive data identified above to the following categories of third parties:
Our lead generator partners;
Our service providers, including, but not limited to, credit reporting agencies, mail service providers, and complaint management service providers; and
Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services offered and/or provided to you, including but not limited to insurance companies, and ancillary product administrators.
Mariner does not offer any financial incentives for the collection, sale, sharing, or deletion of personal information.
In the preceding twelve (12) months, we have not sold personal or sensitive data.
We do not knowingly sell or collect the personal information of minors under 16 years of age.
Length of Time Personal Information is Retained
We will not retain your personal information or sensitive personal information for longer than is reasonably necessary for the disclosed collection or use purpose. Our retention of personal information also is subject to state and federal legal requirements.
Right to Access to Specific Information
Oregon residents have the right to request that we disclose certain information about our collection and use of personal and sensitive data. Once we receive and verify, to the extent applicable, your request, we will disclose to you:
The categories of personal and sensitive data we collected about you.
The categories of sources for the personal and sensitive data we collected about you.
Our business purpose for collecting or selling that personal or sensitive data.
The categories of third parties with whom we share that personal or sensitive data.
The specific pieces of personal or sensitive data we collected about you.
Right to Correct Inaccurate Personal Information
You have the right to request that we correct any inaccurate personal or sensitive data, taking into account the nature of the personal or sensitive data and the purposes of the processing of the personal or sensitive data. Upon receiving a request to correct inaccurate personal or sensitive data, we will use commercially reasonable efforts to correct the inaccurate personal or sensitive data as directed by you.
Right to Delete Personal or Sensitive Data
You have the right to request that we delete any of your personal or sensitive data that we collected from you and retained, subject to certain exceptions. Once we receive your request, we will delete your personal or sensitive data from our records, unless an exception applies. We will also ensure that all deletion requests are passed along to applicable third parties, contractors, and services providers, unless an exception applies.
Please note, however, that we may deny your deletion request if retaining the data is necessary for us or our service providers to:
Complete the transaction for which we collected the personal or sensitive data, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer and/or employee expectations based on your relationship with us.
Comply with a legal obligation.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Right to Opt-Out of Targeted Advertising, Sale of Personal Data, and Profiling
You have the right, at any time, to opt out of targeted advertising, sale of personal data, and profiling. Mariner does not currently sell personal or sensitive data covered by this Privacy Statement. However, you may exercise your right to opt out of sales in the event that Mariner subsequently decides to sell such data. If Mariner elects in the future to sell personal or sensitive data and if we at any time receive direction from you not to sell such data, we will not sell your personal or sensitive data information, unless you subsequently provide express authorization for such sales.
Exercising Your Rights:
To exercise your access, correction, deletion, and limitation of use and disclosure rights described above, please submit a verifiable request to us by either:
Calling us at 844-338-2080. Available Monday through Friday, 8:30 am EST to 5:00 pm EST, excluding observed holidays.
Filling out an online request at any time by clicking HERE
To exercise your right to opt-out of targeted advertising, sale of personal data, and profiling, please call us at 844-338-2080 or click the following link: Do Not Sell or Share my Personal Information and/or Limit the Use of My Sensitive Personal Information or manage your privacy preferences via the Your Privacy Choices link.
If you are submitting a request on behalf of an Oregon resident, please submit the request through one of the designated methods discussed above. Please attach a written authorization signed by the Oregon resident authorizing you to make the request on their behalf or other approved documentation.
We will respond to a verifiable request for access or data portability up to two times within a 12-month period. The verifiable request must:
Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal and/or sensitive data or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal and/or sensitive data if we cannot verify your identity or authority to make the request and confirm the personal information and/or sensitive data relates to you. Making a verifiable request does not require you to create an account with us. We will only use personal and/or sensitive data provided in a request to verify the requestor’s identity or authority to make the request.
Response Timing and Format
We endeavor to respond to a verifiable request within forty-five (45) calendar days of its receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We may deny your request if we are unable to verify your identity or have reason to believe that the request is fraudulent. We may also deny your request if the personal information is subject to an exemption under the Fair Credit Reporting Act or the Gramm-Leach-Bliley Act. For data access requests, we will select a format technically feasible to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
If your Request is denied, we will notify you and provide you with instructions on how to appeal the decision. Thereafter, you will have 10 days to appeal the first decision. If you appeal, we will issue you a final response within 45 days after receiving your appeal. If your appeal is denied, you will receive an explanation and additional information on how to contact the Oregon Attorney General’s office to submit a complaint.
For data access requests, we will select a format technically feasible to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable request unless it is manifestly unfounded or excessive, for example, because of a repetitive nature. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Non-Discrimination
We will not discriminate against you for exercising any of your OCPA rights.
Website Accessibility
We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you wish to access this Privacy Policy in an alternative format, please contact us as described above. Please also see our Website Accessibility Statement available here.
