Prince Parker & Associates
Policy and Procedure California CCPA

CALIFORNIA CONSUMER PRIVACY ACT (“CCPA”) POLICY

*ONLY APPLICABLE TO CALIFORNIA CONSUMERS

Table of Contents
Article I. PURPOSE
Article II. SCOPE
Article III. CCPA STATUTORY TEXT AND DEFINITIONS
Article IV. TYPES OF PERSONAL INFORMATION WAYPOINT RECEIVES, COLLECTS, AND USES
Article V. PROCEDURES TO COMPLY WITH NOTICE REQUIREMENTS
Article VI METHODS AVAILABLE FOR CALIFORNIA CONSUMERS TO SUBMIT REQUESTS
Article VII. PROCEDURES TO RESPOND TO CALIFORNIA CONSUMER REQUESTS
Article VIII. WAYPOINT’S ROLE AS A “SERVICE PROVIDER” TO ITS CLIENTS
Article IX. RECORD RETENTION
Article X. RAMIFICATIONS

Article I. PURPOSE

California Consumer Privacy Act of 2018 (“CCPA”)

The CCPA was enacted to enhance privacy rights and provide additional consumer protection for California residents.

Prince Parker & Associates implements this policy to enable Prince Parker & Associates employees and management to collect debts from California consumers in compliance with the CCPA. This policy will be reviewed and updated as necessary.

Article II. SCOPE

This policy includes in scope: All Waypoint management and employees with respect to California consumers.

Article III. CCPA STATUTORY TEXT AND DEFINITIONS

Section III.01 CCPA Statutory Text

TITLE 1.81.5. California Consumer Privacy Act of 2018 can be found here:

http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.5.&part=4.&chapter=&article

Section III.02 CALIFORNIA ATTORNEY GENERAL CCPA REGULATIONS

On August 14, 2020, the Office of Administrative Law (OAL) approved the Department of Justice’s regulations regarding the CCPA. These CCPA Regulations are referenced by the Attorney General’s office and can be found here:

https://oag.ca.gov/privacy/ccpa/regs

Section III.03 DEFINITIONS

This Policy references various CCPA-defined terms. Full definitions are located in CCPA Section 1798.140 and can be found here:

http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.

“Consumer(s)” referenced in this Policy specifically refers to only California consumers.

Article IV. TYPES OF PERSONAL INFORMATION WAYPOINT RECEIVES, COLLECTS, AND USES

As required by the CCPA, Prince Parker & Associates management team conducted a comprehensive review of the types of Personal Information Prince Parker & Associates receives, collects and/or uses in the course of collecting debts from California consumers. Prince Parker & Associates identified the following:

Prince Parker & Associates management will actively review and update this list as needed.

Article V. PROCEDURES TO COMPLY WITH NOTICE REQUIREMENTS

• 5.01 Notice of Privacy Policy

Prince Parker & Associates shall provide a privacy policy in accordance with the CCPA, including Section 999.308

• 5.02 Notice at or before Point of Collection

Prince Parker & Associates shall provide consumers with timely notice, at or before the point of collection, about the categories of Personal Information it will collect from them and the purposes for which the Personal Information will be used.

• 5.03 Notice of Right to Opt-Out of Sale of Personal Information

Section V.01 Notice of Privacy Policy

Prince Parker & Associates privacy policy shall provide consumers with a comprehensive description of Prince Parker & Associates online and offline practices regarding the collection, use, and disclosure of Personal Information and of the rights of consumers regarding their personal information.

(a) Prince Parker & Associates privacy policy shall be designed and presented in a way that is easy to read and understandable to consumers. The policy shall:

1. Use plain, straightforward language and avoid technical or legal jargon.

2. Use a format that makes the policy readable.

3. Be reasonably accessible to consumers with disabilities.

4. Be available in a format that allows a consumer to print it out as a document.

(b) Prince Parker & Associates privacy policy shall be posted online through a conspicuous link using the word “privacy” on its website homepage.

(c) Prince Parker & Associates privacy policy shall include the following information:

1. Right to Know About Personal Information Collected, Disclosed, or Sold.

a. Explanation that a consumer has the right to request that Prince Parker & Associates disclose what Personal Information it collects, uses, discloses, and sells.

b. Instructions for submitting a verifiable consumer request to know and links to an online request form.

c. General description of the process Prince Parker & Associates will use to verify the consumer request, including any information the consumer must provide.

d. Identification of the categories of Personal Information Prince Parker & Associates has collected about consumers in the preceding 12 months. The categories shall be described in a manner that provides consumers a meaningful understanding of the information being collected.

e. Identification of the categories of sources from which the Personal Information is collected.

f. Identification of the business or commercial purpose for collecting or selling personal information. The purpose shall be described in a manner that provides consumers a meaningful understanding of why the information is collected or sold.

g. A statement that Prince Parker & Associates does not sell Personal Information

2. Right to Request Deletion of Personal Information.

a. Explanation that the consumer has a right to request the deletion of certain Personal Information collected by Prince Parker & Associates, subject to exclusions for Personal Information required to fulfill its business purpose of debt collection.

b. Instructions for submitting a verifiable consumer request to delete and links to an online request form.

c. General description of the process Prince Parker & Associates will use to verify the consumer’s request to delete, including any information the consumer must provide.

3. Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights.

a. Explanation that the consumer has a right not to receive discriminatory treatment by Prince Parker & Associates for the exercise of the privacy rights conferred by the CCPA.

4. Authorized Agent.

a. Instructions on how an authorized agent can make a request under the CCPA on the consumer’s behalf.

5. Contact for More Information.

a. A contact for questions or concerns about Prince Parker & Associates privacy policies and practices using a method reflecting the manner in which Prince Parker & Associates primarily interacts with the consumer.

6. Date the privacy policy was last updated

Section V.02 Notice At or Before Point of Collection

Prince Parker & Associates shall provide consumers with timely notice, at or before the point of collection, about the categories of Personal Information it will collect from them and the purposes for which the Personal Information will be used.

1. The notice shall:

a. Use plain, straightforward language and avoid technical or legal jargon.

b. Use a format that draws the consumer’s attention to the notice and makes the notice readable, including on smaller screens, if applicable.

c. Be reasonably accessible to consumers with disabilities.

2. The “notice at collection” shall be made at the time Prince Parker & Associates sends its initial notice to the consumer.

3. Prince Parker & Associates shall not collect categories of Personal Information other than those disclosed in the notice at (or before) collection.

4. The “notice at collection” shall include the following:

a. A list of the categories of Personal Information to be collected. Each category of Personal Information shall be written in a manner that provides consumers a meaningful understanding of the information being collected.

b. The business or commercial purpose(s) for which the categories of Personal Information will be used.

c. Instructions on how Prince Parker & Associates privacy policy can be found online.

5. A sample initial notice disclosure can be found below:

“CALIFORNIA RESIDENTS: Pursuant to the California Consumer Privacy Act of 2018 (CCPA), California residents are entitled to certain notices and disclosures regarding the collection and use of their personal information. Prince Parker & Associates CCPA Policy can be found at www.——.com. Our Policy outlines what personal information we collect, use, and disclose. It also explains your right to know, right to delete, and how to submit a verifiable consumer request. Please note, Prince Parker & Associates does not sell any personal information.”

Section V.03 Notice of Right to Opt-Out of Sale of Personal Information

Prince Parker & Associates does not sell any Personal Information.

As required by the CCPA, Prince Parker & Associates shall disclose the following in its Privacy Policy: “Prince Parker & Associates does not sell Personal Information.”

If Prince Parker & Associates begins, at any time, to sell any Personal Information, it shall immediately notify all applicable consumers.

ARTICLE VI. METHODS AVAILABLE FOR CALIFORNIA CONSUMERS TO SUBMIT REQUESTS

Prince Parker & Associates shall designate at least two methods for consumers to submit their request. Prince Parker & Associates current methods are:

1. Email Address

a. Consumers may send their requests to collections@waypoint.com. A member from Prince Parker & Associates management team is responsible for monitoring this email address and notating each request received.

2. Mail form

a. Download and fill out a copy of the form: link to document

b. Mail to Prince Parker & Associates, 1065 W Levoy Dr., Suite 100, Taylorsville, UT 84123

ARTICLE VII. PROCEDURES TO RESPOND TO CONSUMER REQUESTS

IN GENERAL

(1) Cost: Prince Parker & Associates shall not charge a consumer or their agent for responding to requests.

(2) Confirmation of Request, Timing, and Verification: Prince Parker & Associates shall respond to consumer requests within 45 calendar days of receipt of the request. Prince Parker & Associates may extend that deadline by another 45 days (90 days total) if Prince Parker & Associates notifies the consumer.

a. Upon receiving a request to know or a request to delete, Prince Parker & Associates shall confirm receipt of the request within 10 business days and provide information about how Prince Parker & Associates will process the request. The information provided shall describe in general Prince Parker & Associates verification process and when the consumer should expect a response, except in instances where Prince Parker & Associates has already granted or denied the request. The confirmation may be given in the same manner in which the request was received. For example, if the request is made over the phone, the confirmation may be given orally during the phone call.

b. Prince Parker & Associates shall respond to requests to know and requests to delete within 45 calendar days. The 45-day period will begin on the day Prince Parker & Associates receives the request, regardless of time required to verify the request. If Prince Parker & Associates cannot verify the consumer within the 45-day time period, Prince Parker & Associates may deny the request. If necessary, Prince Parker & Associates may take up to an additional 45 calendar days to respond to the consumer’s request, for a maximum total of 90 calendar days from the day the request is received, provided that Prince Parker & Associates provides the consumer with notice and an explanation of the reason Prince Parker & Associates will take more than 45 days to respond to the request

.

RESPONDING TO REQUESTS TO KNOW

(1) For requests that seek the disclosure of specific pieces of information about the consumer, if Prince Parker & Associates cannot verify the identity of the person making the request pursuant to the CCPA’s Regulations, Prince Parker & Associates shall not disclose any specific pieces of Personal Information to the requestor and shall inform the requestor that it cannot verify their identity. If the request is denied in whole or in part, Prince Parker & Associates shall also evaluate the consumer’s request as if it is seeking the disclosure of categories of Personal Information about the consumer as explained in (2) below.

(2) For requests that seek the disclosure of categories of Personal Information about the consumer, if Prince Parker & Associates cannot verify the identity of the person making the request pursuant to the CCPA’s Regulations, Prince Parker & Associates may deny the request to disclose the categories and other information requested and shall inform the requestor that it cannot verify their identity. If the request is denied in whole or in part, Prince Parker & Associates shall provide or direct the consumer to its general business practices regarding the collection, maintenance, and sale of Personal Information set forth in its privacy policy.

(3) In responding to a request to know, Prince Parker & Associates is not required to search for Personal Information if all of the following conditions are met:

a. Prince Parker & Associates does not maintain the Personal Information in a searchable or reasonably accessible format;

b. Prince Parker & Associates maintains the Personal Information solely for legal or compliance purposes;

c. Prince Parker & Associates does not sell the Personal Information and does not use it for any commercial purpose; and

d. Prince Parker & Associates describes to the consumer the categories of records that may contain Personal Information that it did not search because it meets the conditions stated above.

(4) Prince Parker & Associates shall not disclose in response to a request to know a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics. Prince Parker & Associates shall, however, inform the consumer with sufficient particularity that it has collected the type of information. For example, a business shall respond that it collects “unique biometric data including a fingerprint scan” without disclosing the actual fingerprint scan data.

(5) If Prince Parker & Associates denies a consumer’s verified request to know specific pieces of personal information, in whole or in part, because of a conflict with federal or state law, or an exception to the CCPA, Prince Parker & Associates shall inform the requestor and explain the basis for the denial, unless prohibited from doing so by law. If the request is denied only in part, Prince Parker & Associates shall disclose the other information sought by the consumer.

(6) Prince Parker & Associates shall use reasonable security measures when transmitting Personal Information to the consumer.

(7) If Prince Parker & Associates maintains a password-protected account with the consumer, it may comply with a request to know by using a secure self-service portal for consumers to access, view, and receive a portable copy of their Personal Information if the portal fully discloses the Personal Information that the consumer is entitled to under the CCPA and the California AG’s CCPA Regulations, uses reasonable data security controls, and complies with the verification requirements set forth the CCPA Regulations.

(8) Unless otherwise specified by Prince Parker & Associates to cover a longer period of time, the 12- month period covered by a consumer’s verifiable request to know referenced in Civil Code section 1798.130, subdivision (a)(2), shall run from the date Prince Parker & Associates receives the request, regardless of the time required to verify the request.

(9) In responding to a consumer’s verified request to know categories of Personal Information, categories of sources, and/or categories of third parties, Prince Parker & Associates shall provide an individualized response to the consumer as required by the CCPA. It shall not refer the consumer to Prince Parker & Associates general practices outlined in its privacy policy unless its response would be the same for all consumers and the privacy policy discloses all the information that is otherwise required to be in a response to a request to know such categories.

(10) In responding to a verified request to know categories of Personal Information, Prince Parker & Associates shall provide:

a. The categories of Personal Information Prince Parker & Associates has collected about the consumer in the preceding 12 months;

b. The categories of sources from which the Personal Information was collected;

c. The business or commercial purpose for which it collected or sold the personal information;

d. The categories of third parties with whom Prince Parker & Associates shares personal information; and

e. The categories of Personal Information that Prince Parker & Associates disclosed for a business purpose in the preceding 12 months, and for each category identified, the categories of third parties to whom it disclosed that particular category of personal information.

(11) Prince Parker & Associates shall identify the categories of personal information, categories of sources of personal information, and categories of third parties to whom Prince Parker & Associates disclosed personal information, in a manner that provides consumers a meaningful understanding of the categories listed.

RESPONDING TO REQUESTS TO DELETE

(1) For requests to delete, if Prince Parker & Associates cannot verify the identity of the requestor pursuant to the CCPA Regulations, Prince Parker & Associates may deny the request to delete. Prince Parker & Associates shall inform the requestor that their identity cannot be verified.

(2) Prince Parker & Associates shall comply with a consumer’s request to delete their Personal Information by:

a. Permanently and completely erasing the Personal Information on its existing systems with the exception of archived or back-up systems;

b. De-identifying the personal information; or

c. Aggregating the consumer information.

(3) If Prince Parker & Associates stores any Personal Information on archived or backup systems, it may delay compliance with the consumer’s request to delete, with respect to data stored on the archived or backup system, until the archived or backup system relating to that data is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose.

(4) In responding to a request to delete, Prince Parker & Associates shall inform the consumer whether or not it has complied with the consumer’s request. *Note requests to delete will often be denied due to Prince Parker & Associates business purpose of collecting debts.

(5) If Prince Parker & Associates complies with the consumer’s request, Prince Parker & Associates shall inform the consumer that it will maintain a record of the request as required by section 999.317, subsection (b). Prince Parker & Associates may retain a record of the request for the purpose of ensuring that the consumer’s Personal Information remains deleted from Prince Parker & Associates records.

(6) In cases where Prince Parker & Associates denies a consumer’s request to delete, Prince Parker & Associates shall do all of the following:

a. Inform the consumer that it will not comply with the consumer’s request and describe the basis for the denial, including any conflict with federal or state law, or exception to the CCPA, unless prohibited from doing so by law;

b. Delete the consumer’s Personal Information that is not subject to the exception; and

c. Not use the consumer’s Personal Information retained for any other purpose than provided for by that exception.

(8) In responding to a request to delete, Prince Parker & Associates may present the consumer with the choice to delete select portions of their Personal Information only if a global option to delete all Personal Information is also offered and more prominently presented than the other choices.

PRINCE PARKER & ASSOCIATES MAY DENY CERTAIN CONSUMER REQUESTS

Prince Parker & Associates may deny a consumer’s request for the following reasons:

1. Prince Parker & Associates cannot verify the consumer’s request.

2. The request is manifestly unfounded or excessive, or Prince Parker & Associates has already provided Personal Information to the consumer more than twice in a 12-month period.

3. Prince Parker & Associates will not disclose certain sensitive information, such as a consumer’s social security number, financial account number, or account passwords, but Prince Parker & Associates will provide a response that states the general category of information collected.

4. Disclosure would restrict Prince Parker & Associates ability to comply with legal obligations, exercise legal claims or rights, or defend legal claims.

5. If the Personal Information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA.

6. If the Personal Information is needed to enable Prince Parker & Associates to complete its business purpose (to collect debts).

7. Additional reasons listed in Civil Code section 1798.145.

Article VIII. PRINCE PARKER & ASSOCIATES ROLE AS A “SERVICE PROVIDER” TO ITS CREDITOR CLIENTS

In the event Prince Parker & Associates meets the definition of a “Service Provider” under the CCPA regarding the services it provides to its creditor clients, it will comply with the following obligations:

(a) In its role as a Service Provider, Prince Parker & Associates shall not retain, use, or disclose Personal Information obtained in the course of providing services except:

(1) To process or maintain Personal Information on behalf of the business that provided the Personal Information or directed Prince Parker & Associates to collect the personal information, and in compliance with the written contract for services required by the CCPA;

(2) To retain and employ another Service Provider as a subcontractor, where the subcontractor meets the requirements for a service provider under the CCPA and these regulations;

(3) For internal use by Prince Parker & Associates to build or improve the quality of its services, provided that the use does not include building or modifying household or consumer profiles to use in providing services to another business, or correcting or augmenting data acquired from another source;

(4) To detect data security incidents or protect against fraudulent or illegal activity; or

(5) For the purposes enumerated in Civil Code section 1798.145, subdivisions (a)(1) through (a)(4).

(b) In its role as a Service Provider, if Prince Parker & Associates receives a request to know or a request to delete from a consumer, Prince Parker & Associates shall either act on behalf of its creditor client in responding to the request or inform the consumer that the request cannot be acted upon because the request was sent to Prince Parker & Associates in its role as a service provider for its creditor client(s).

Article IX. RECORD RETENTION

(a) All Prince Parker & Associates employees responsible for handling consumer inquiries about Prince Parker & Associates privacy practices or Prince Parker & Associates compliance with the CCPA shall be informed of all of the requirements in the CCPA and the CCPA Regulations and how to direct consumers to exercise their rights under the CCPA and CCPA Regulations.

(b) Prince Parker & Associates shall maintain records of consumer requests made pursuant to the CCPA and how it responded to the requests for at least 24 months. Prince Parker & Associates shall implement and maintain reasonable security procedures and practices in maintaining these records.

(c) The records may be maintained in a ticket or log format provided that the ticket or log includes the date of request, nature of request, manner in which the request was made, the date of Prince Parker & Associates response, the nature of the response, and the basis for the denial of the request if the request is denied in whole or in part.

(d) Prince Parker & Associates maintenance of the information required by this Record Retention section, where that information is not used for any other purpose, does not taken alone violate the CCPA or CCPA Regulations.

(e) Information maintained for record-keeping purposes shall not be used for any other purpose except as reasonably necessary for Prince Parker & Associates to review and modify its processes for compliance with the CCPA and CCPA Regulations. Information maintained for recordkeeping purposes shall not be shared with any third party except as necessary to comply with a legal obligation.

(f) Other than as required by subsection (b), Prince Parker & Associates is not required to retain Personal Information solely for the purpose of fulfilling a consumer request made under the CCPA.

Article X. RAMIFICATIONS

Non-compliance with this Policy will be considered a major non-conformity.