California Consumer Privacy Act

Requests Under the California Consumer Privacy Act (CCPA)

Effective January 1, 2020, California residents have the right to:

1) make a “request to know:”

a) the specific pieces of personal information we have collected about them,

b) categories of personal information we have collected,

c) categories of sources from which the personal information was collected,

d) categories of personal information we disclosed for a business purpose,

e) purpose for collecting the information, and

f) categories of third parties with whom we shared personal information.

2) request that we deliver to them their personal information free of charge.

3) make a “request to delete” from our records their personal information that we have collected, subject to legal limitations.

4) non-discrimination. We do not discriminate against consumers who exercise their rights under the CCPA or other laws.

How to Make a Request under the CCPA

1) To make a request under the CCPA, a California consumer may:

a) email compliance@canopymortgage.comcreate new email,

b) call toll free 877-426-5600 and ask to speak with the Compliance Team,

c) submit a request via our website

2) For your protection, you must verify your identity before we take further action.

a) To verify your identity, we will attempt to use information you have already provided. But we may also need additional information.

b) California law allows you to designate an authorized agent to make a request on your behalf. To do this, you must provide a valid power

of attorney accompanied by both the requester’s and authorized agent’s valid government issued identification.

3) California residents may “opt out” of the sale of their personal information as previously disclosed in the Privacy Policy Disclosure.

Within 45 days of a verifiable consumer request, we will provide the information requested for the 12-month period preceding receipt of your verified consumer request at no cost to you, or deleting the information and notifying any service provider to delete it, subject to legal limitations. If we have

a valid reason to retain personal information or we are otherwise unable to comply with the request, we will notify you. By law, certain information collected may be ineligible for deletion. Additionally, personal information collected under the federal Gramm-Leach-Bliley Act may be exempt from the provisions of the CCPA.