California privacy notice (CCPA).

CREST INSURANCE GROUP CCPA PRIVACY NOTICE. Effective January 1, 2023. Last updated April 4, 2023.

This notice supplements the information in Crest Insurance Group's Privacy Policy, and applies solely to California residents. Terms defined in the CCPA and CPRA carry the same meaning here.

Collection and Sharing of Personal Information. Crest may collect personal information that identifies, relates to, or could reasonably be linked with you or your household, from you and from persons other than the individual(s) proposed for coverage. This does not include publicly available government records, deidentified or aggregated information, or information protected by other statutes such as the Gramm-Leach-Bliley Act or California's Insurance Information and Privacy Protection Act.

In the twelve months before this notice, we may have collected and disclosed, for business purposes, the following categories of personal information: identifiers such as name, address, identifiers, IP address, email, Social Security number, driver's licence or passport number, and date of birth — retained up to five years, disclosed to insurance companies and third-party agents or brokers, vendors, and our affiliates. Personal information under the California Customer Records statute — name, signature, Social Security number, physical description, address, phone number, licence or ID numbers, insurance policy number, education, employment history, financial account numbers, medical or health insurance information — retained up to five years, disclosed to insurance companies, agents, brokers and vendors. Protected classification characteristics under California or federal law (age 40+, race, colour, ancestry, national origin, citizenship, religion, marital status, medical condition, disability, sex, gender identity, pregnancy, sexual orientation, veteran or military status, genetic information) — retained up to five years, collected but not further disclosed. Commercial information, such as records of property or services purchased or considered — retained up to five years, disclosed to insurance companies, agents, brokers and vendors. Biometric information — not applicable, not collected. Internet or network activity, such as browsing and search history and site interaction — retained up to three years, disclosed to vendors supporting the Site's operation and performance. Geolocation data — not applicable, not collected. Sensory data — retained up to five years, disclosed to insurance companies, agents, brokers and vendors. Professional or employment-related information (not applicable to Crest's own employees or contractors) — retained up to five years, disclosed to insurance companies, agents, brokers and vendors. Non-public education information under FERPA — retained up to five years, disclosed to insurance companies, agents, brokers and vendors. Inferences drawn from other personal information — not applicable, not collected.

Sensitive Personal Information (SPI) is a subtype of the categories above with the meaning given in CPRA Section 1798.140(ae), excluding publicly available information. We may collect SPI that falls within the categories above, but do not treat it as sensitive because we do not use it to infer characteristics about a person.

We may receive these categories directly from you — when you request a quote, complete an application or other form, transact insurance business with us or our affiliates, provide claims information, or interact with us on social media — as well as indirectly through your use of this Site, such as device type, IP address, pages visited and time spent on them, used to enhance and improve the Site and our services.

Data Retention. Various federal and state laws require Crest to keep certain company records for specific periods. These schedules are general guidelines and may be superseded by applicable law. Data reasonably likely to be relevant to actual or potential litigation may be placed under a litigation hold and preserved regardless of any standing retention or destruction schedule until Crest determines it is no longer needed.

Use of Personal Information. Crest may use the personal information described above to: fulfil the reason you provided it; underwrite, sell, solicit and negotiate insurance products; provide support and respond to inquiries; contact you about your account, payments, renewals or endorsements; provide a requested quote or connect you with a third-party vendor's goods or services; determine eligibility and process applications; tell you about products and services we offer; communicate, create, service, secure and bill accounts; obtain and update insurance or credit information with third parties; monitor and administer accounts; process transactions and prevent fraud; fulfil contractual and legal obligations; and provide, support, personalise, improve and secure this Site and our services. We do not sell personal information to any third party, and have not done so in the preceding twelve months. We may use or disclose deidentified information exempt from the CPRA for legitimate business purposes.

Your Rights and Choices. California residents have the following rights, subject to certain exceptions.

Right to Know and Data Portability. You may request that we disclose, for the preceding twelve months: the categories of personal information we collected about you; the categories of sources; our business or commercial purpose for collecting it; the categories of third parties we shared it with; and, where applicable, the specific pieces of personal information collected. We will respond once we've received and verified your request.

Right to Request Deletion. You may request that we delete personal information we collected from you, subject to exceptions where retention is necessary to: complete the transaction you requested or fulfil a contract with you; detect security incidents or fraud and prosecute those responsible; debug the Site; exercise free speech or another legal right; comply with the California Electronic Communications Privacy Act; conduct public-interest research where deletion would seriously impair it and you consented in advance; make internal uses reasonably aligned with your relationship with us; or comply with a legal obligation. Information not covered by an exception will be deleted or deidentified, and we will direct our service providers to do the same.

Right to Correct. You may request that we correct inaccurate personal information we hold about you; once we've verified your identity or authority to request this, we will use commercially reasonable efforts to correct it.

Personal Information Sales Opt-Out and Opt-In Rights. California residents aged 16 or older have the right to direct a business not to sell or share their personal information. Because Crest does not sell personal information for monetary or other valuable consideration, no opt-out mechanism is provided for this activity.

Right to Limit Use of Sensitive Personal Information. You may request that we limit the use of your SPI to what is necessary to provide the goods or services you requested. We will honour a valid, verified request to do so.

Exercising Your Rights. To exercise any of the rights above, call 1-888-881-5765 or email info@crestins.com. Only you, or someone legally authorised to act on your behalf, may make a request; an authorised agent must provide signed permission and independently verify their own identity. A parent or guardian may request on behalf of a minor child by signing and returning a consent form. Requests to know may be made up to twice in a twelve-month period, and must include enough information for us to verify your identity and to understand and evaluate the request. We cannot respond if we cannot verify your identity or authority, or confirm the information relates to you. You do not need an account with us to submit a request.

Response Timing and Format. We will confirm receipt of a request within ten business days, and aim to respond substantively within forty-five days; if more time is needed we will explain why in writing. Disclosures cover only the twelve months preceding the request. We do not charge a fee to process a request unless it is excessive, repetitive or manifestly unfounded, in which case we will explain why and provide a cost estimate first.

Non-Discrimination. We will not deny you goods or services, charge different prices or rates, or provide a different level or quality of goods or services because you exercised a CCPA right, except as the CCPA itself permits.

Minors. We do not knowingly collect personal information online from children under 13. If we learn that we have, we will delete it as quickly as possible. We do not sell the personal information of minors under 16 and would not do so without appropriate affirmative authorisation.

Changes to This Notice. We may amend this notice at any time; changes are posted on this Site with an updated effective date and take effect immediately unless stated otherwise.

Contact Us. Questions about this notice, or requests to exercise your rights under California law, can be directed to 1-888-881-5765 or info@crestins.com.