Your Consumer Rights

Firefighters First Credit Union is committed to protecting consumers’ privacy. The California Consumer Privacy Act (CCPA) creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by businesses. Firefighters First Credit Union is not responsible for data entry errors.

Consumer Privacy Policy

Last Updated and Effective: 12/13/2022

Your privacy is important to us. This Consumer Privacy Policy (“Privacy Policy”) explains how we collect, share, use, and protect your personal information through your online and offline interactions with us. This Privacy Policy includes references and links to our other privacy policies which serve different purposes under various laws and regulations that apply to us. Please read this notice carefully to understand how we handle user privacy.

I. CATEGORIES OF PERSONAL OF INFORMATION WE COLLECT

In the preceding 12-months, we have collected the following categories of personal information (please note that some categories overlap):

Category Examples
A. Identifiers A real name or alias; postal address; signature; home phone number or mobile phone number; member number, credit card number, debit card number, or other financial information; physical characteristics or description; email address; account name; Social Security number; date of birth, driver's license number or state identification card number; passport number; or other similar identifiers.
B. Protected classification characteristics under state or federal law Age, race, ancestry, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status.
C. Commercial information Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
D. Biometric information Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information.
E. Internet or other similar network activity Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.
F. Geolocation data Physical location or movements. For example, city, state, country, and ZIP code associated with your IP address or derived through Wi-Fi triangulation; and, with your permission in accordance with your mobile device settings, and precise geolocation information from GPS-based functionality on your mobile devices.
G. Sensory data Audio, electronic, visual, or similar information.
H. Professional or employment-related information. Current or past job history, and salary.
I. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)). Educational records directly related to a class roster or student identification card, college or university, major (course of study), and graduation date.
J. Inferences drawn from other personal information. Profile reflecting a person’s preference, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

II. CATEGORIES OF SOURCES OF INFORMATION WE COLLECT

We obtain the categories of personal information listed above from one or more of the following categories of sources:

a. From You or Your Authorized Agent

We may collect information directly from you or your authorized agent. For example, when you provide us your name and Social Security number to open an account and become a member. We also collect information indirectly from you or your authorized agent. For example, through information we collect from our members in the course of providing services to them.

b. From Our Website and Applications That You Access on Your Mobile Device

We collect certain information from your activity on our website, www.firefightersfirstcu.org, and your use of Firefighters First CU applications, such as the Firefighters First CU Mobile Banking app on your mobile device. We may collect your IP address, device and advertising identifiers, browser type, operating system, the date and time of your visit, information about the links you click and pages you view on our website, and other standard server log information. Geolocation information can be monitored on a continuous basis in the background only while the feature(s) are being used or not at all, depending on the end user's selection. The end user can change their location permissions at any time in their device settings. This information may be collected when you use certain services that are dependent on your mobile device's location ( such as the location of an ATM or in store transactions).

i. The Role of Cookies and Other Online Tracking Technologies

We, or our service providers, and other companies we work with may deploy and use cookies, web beacons, local shared objects and other tracking technologies for various purposes, such as fraud prevention. Some of these tracking tools may detect characteristics or settings of the specific device you use to access our online services.

“Cookies” are small amounts of data a website can send to a visitor’s web browser. They are often stored on the device you are using to help track your areas of interest. Cookies may also enable us or our service providers and other companies we work with to relate your use of our online services over time to customize your experience. Most web browsers allow you to adjust your browser settings to decline or delete cookies, but doing so may degrade your experience with our online services.

Clear GIFs, pixel tags or web beacons—which are typically one-pixel, transparent images located on a webpage or in an email or other message—or similar technologies may be used on our sites and in some of our digital communications (such as email or other marketing messages). They may also be used when you are served advertisements, or you otherwise interact with advertisements outside of our online services. These are principally used to help recognize users, assess traffic patterns and measure site or campaign engagement.

Local Shared Objects, sometimes referred to as “flash cookies” may be stored on your hard drive using a media player or other software installed on your device. Local Shared Objects are similar to cookies in terms of their operation but may not be managed in your browser in the same way. For more information on managing Local Shared Objects, click here.

“First party” cookies are stored by the domain (website) you are vising directly. They allow the website’s owner to collect analytics data, remember language settings, and perform useful functions that help provide a good experience. “Third-party” cookies are created by domains other than the one you are visiting directly, hence the name third-party. They may be used for cross-site tracking, retargeting and ad-serving. We also believe that cookies fall into the following general categories:

ii. Online Advertising & Online Behavioral Advertising

You will see advertisements when you use many of our online services. These advertisements may be for our own products or services (including pre-screened offers of credit) or for products and services offered by third parties. Which advertisements you see is often determined using the information we or our affiliates, service providers and other companies that we work with have about you, including information about your relationships with us (e.g., types of accounts held, transactional information, location of banking activity). To that end, where permitted by applicable law, we may share with others the information we collect from and about you.

Online behavioral advertising (also known as “OBA” or “interest-based advertising”) refers to the practice of collecting information from a computer or device regarding a visitor’s web-browsing activities across non-affiliated websites over time in order to deliver advertisements that may be of interest to that visitor based on their browsing history.

We do not engage in OBA.

c. Third-party service providers in connection with our services or our business purposes

We collect information from third-party service providers that interact with us in connection with the services we perform or for our operational purposes. For example, a credit report we obtain from a credit bureau to evaluate a loan application. Another example is a third-party service provider that provides us information to help us detect security incidents and fraudulent activity.

d. Information we collect from third-parties for a commercial purpose

We collect information from third-parties for our commercial purposes. We partner with a limited number of third-party analytics and advertising firms. These third parties may use cookies or code processed by your browser to collect public information about your visits to our and other websites in order to provide customized experiences, advertisements or services. These parties may also collect information directly from you by contacting you telephonically, via email or through other communication channels. We do not disclose any information about you to such third-parties except as permitted by applicable laws and regulations, and we require such third-parties to follow applicable laws and regulations when they collect information from you to transfer such information to us.

e. Google Analytics

We use Google Analytics to understand how visitors engage with our website. For information on how Google uses the data it collects and how to control the information sent to Google please visit: Google's Privacy Terms

III. HOW WE USE YOUR PERSONAL INFORMATION

We may use or disclose personal information we collect for one or more of the following operational or other notified purpose (“business purpose”):

We also use your personal information to advance our commercial or economic interests (“commercial purpose”), such as advertising our membership, products and services, or enabling or effecting, directly or indirectly, a commercial transaction.

IV. SHARING PERSONAL INFORMATION

We disclose your personal information to a third party for a business purpose or commercial purpose. When we disclose personal information for a business or commercial purpose, we enter a contract that describes the purpose and requires the recipient to keep that personal information confidential and not to use it for any purpose except performing the contract.

In the preceding 12-months, we have disclosed the following categories of personal information for a business purpose and, for each category, the following categories of third-parties with whom such personal information was shared:

We disclose your personal information for a business or commercial purpose to the following categories of third-parties:

  1. Our third-party service providers;
  2. Our affiliated websites and businesses in an effort to bring you improved service across our family of products and services, when permissible under relevant laws and regulations
  3. Other companies to bring you co-branded services, products or programs;
  4. Third parties that help us advertise products, services or membership with us to you;
  5. Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you;
  6. Third parties or affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of our financial institution or affiliated business; and
  7. Other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.

V. SELLING PERSONAL INFORMATION

We do not sell your personal information for monetary consideration. However, there may be instances where we disclose or share your information with a third party for other valuable consideration. When we refer to “sell,” “selling,” “sale” or “sold” in this Privacy Policy, we are referring to disclosure or sharing of personal information for valuable consideration other than money.

In the preceding 12-months, we have not sold any personal information and, going forward, we will not sell your information. If this changes, we will notify you in accordance with applicable law.

VI. YOUR RIGHTS AND CHOICES

If you are a California resident, this section describes your rights and choices regarding how we collect, share, use, and protect your personal information, how to exercise those rights, and limits and exceptions to your rights and choices under the CCPA.

a. Exceptions

In the following instances, the rights and choices in this Section VI do not apply to you:

b. Access to Specific Information and Data Portability Rights

If the above exceptions do not apply, and you have not made this request more than twice in a 12-month period, you have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months from the date we receive your request. Once we receive and confirm your request and verify that the request is coming from you or someone authorized to make the request on your behalf, we will disclose to you or your representative:

c. Deletion Request Rights

You have the right to request that we delete any of your personal information that we collect from you and retained, subject to certain exceptions. Once we receive and verify your request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service providers to:

  1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
  2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
  3. Debug to identify and repair errors that impair existing intended functionality.
  4. Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
  5. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you previously provided informed consent.
  6. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  7. Comply with a legal obligation.
  8. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

d. Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

After we receive your request, we will send you instructions on how to verify your identity. If you are submitting a request that applies to an entire household, we will need to verify the identity of each consumer in the household to whom the request applies. Depending on the type of information you are requesting, you may also be required to provide a signed declaration under penalty of perjury confirming that you are the consumer whose information you are requesting. If the request is submitted on your behalf by an agent, we will verify the identity of the agent and the authority of the agent to make the request on your behalf.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

An authorized agent is any person or legal entity registered with the California Secretary of State that you have authorized to act on your behalf. If we receive a request through your authorized agent, we may require:

  1. Submission of a written document signed by you with your permission for the authorized agent to submit a verifiable request on your behalf and require the authorized agent to verify its own identity to us; or
  2. You to directly verify with us that you have provided the authorized agent to submit the request.
  3. We will not require either of the above if your authorized agent provides a copy of a power of attorney pursuant to California Probate Code sections 4000 to 4465 and we are able to verify authorized agent’s identity.

We will deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf and cannot verify their own identity to us.

f. Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. All responses will be mailed via U.S. Mail or be emailed to the verified addresses, depending upon your communication preferences.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request.

g. Right of Non-Discrimination

We will not discriminate against you for exercising any of your rights in this Privacy Policy and under applicable laws. Unless permitted by law, we will not:

h. Request to Correct

You may have the right to request correction to CCPA Personal Information that we retain about you. We generally rely on you to update and correct your CCPA Personal Information. Note that we may keep historical information in our backup files as permitted by law.

i. Objection to Certain Processing of Sensitive Information

In some cases, you may object to our use or disclosure of the sensitive CCPA Personal Information we collect. For more information about the types of Sensitive Data that we collect, see the How We Share and Disclose CCPA Personal Information section above.

VII. DO NOT TRACK (“DNT”) SIGNALS

We do not employ tracking signals on our website and, therefore, we are not able to recognize DNT signals. If tracking mechanisms are utilized for future releases of our website, we will update this Privacy Policy to disclose how we respond to DNT signals.

VIII. CHANGES TO OUR PRIVACY POLICY

We reserve the right to amend this Privacy Policy at our discretion and at any time. When we make changes to this Privacy Policy, we will notify you by email or through a notice on our website homepage.

IX. CHILDREN’S ONLINE INFORMATION PRIVACY

Our website is not intended for children under the age of 13. We do not knowingly collect, maintain, or use personally identifiable information from our website about children under the age of 13 without parental consent. For more information about the Children’s Online Privacy Protection Act (COPPA), visit the Federal Trade Commission website: www.ftc.gov.

X. LINKING TO THIRD-PARTY WEBSITES

We may provide links to websites that are owned or operated by other companies ("third-party websites"). When you use a link online to visit a third-party website, you will be subject to that website’s privacy and security practices, which may differ from ours. You should familiarize yourself with the privacy policy, terms of use and security practices of the linked third-party website before providing any information on that website. We are not responsible for the third-party website’s use, collection, sale or sharing of your personal information.

XI. SECURITY

We use reasonable physical, electronic, and procedural safeguards that comply with federal standards to protect and limit access to personal information. This includes device safeguards and secured files and buildings.

Please note that information you send to us electronically may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential information (such as your Social Security number) to us.

XII. CONTACT INFORMATION

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights, or to request changes to any of your personally identifiable information that we have collected, please do not hesitate to contact us at:

Phone: 800-231-1626
Website: www.Firefightersfirstcu.org
Mail: Firefighters First Credit Union, Attn: Operations,
1520 West Colorado Blvd
Pasadena, California 91105