Privacy Notice for California and Virginia Residents

Effective Date: January 1, 2020
Last Updated: December 15, 2022

This Notice at Collection and Privacy Policy for California and Virginia Residents of Home Point Financial Corporation ("we") supplements the information contained in Home Point Financial Corporation’s Privacy Notice and applies solely to those who reside in the State of California and Virginia ("consumers" or "you"). This Notice is provided pursuant applicable state law and regulation, and any terms defined in those requirements have the same definitions when used in this Notice.

Collection of Personal Information

We collect information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The purpose of this Notice at Collection is to provide you with timely notice, at or before the point of collection, about the categories of personal information to be collected from you and the purposes for which the personal information will be used.

We collect	Categories of Personal Information
	A. Identifiers: For example, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
	B. Personal Information Categories from State Law For example, a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
	C. Characteristics of State or Federal Protected Classifications:For example, race, religion, national origin), age (40 and over), gender, sexual orientation, medical condition, ancestry, pregnancy (includes childbirth, breastfeeding and/or related medical conditions), familial status, disability, veteran status, or genetic information.
	D. Commercial Information: For example, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
	E. Biometric Information: For example, physiological, biological or behavioral characteristics, including an individual’s deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
	F. Internet or Other Similar Network Activity: For example, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
	G. Geolocation Data: For example, information that can be used to determine a device’s physical location
	H. Sensory or Surveillance Data: For example, audio, electronic, visual, thermal, olfactory, or similar information that can be linked or associated with a particular consumer or household
	I. Professional or Employment-Related Information: For example, employment applications, compensation, evaluations, performance reviews, personnel files and current and past job history.
	J. Education Information (defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99)): Education records directly related to a student maintained by an education institution or party acting on its behalf, for example, non-public information that can be used to distinguish or trace an individual’s identity in relation to an educational institution either directly or indirectly through linkages with other information.
	K. Profile Data: For example, inferences drawn from personal information to create an automated profile to analyze or make predictions about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitudes, performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Personal Information may also include “Sensitive Personal Information” defined as social security or tax identification number, driver’s license number, or passport number, account credentials, precise geolocation, racial or ethnic origin, religious beliefs, biometric data, personal information concerning a consumer’s health or sex life or sexual orientation, as well as contents of a consumer’s mail, email, and text messages. Homepoint only collects Sensitive Personal Information necessary for its interactions with you to conduct our business, such as loan-related information or employment-related information.

*Please note that personal information does not include:

Publicly available information from government records.
Deidentified or aggregated consumer information.
Information excluded from the state requirements, such as:
- Certain personal information covered by or collected under certain sector-specific privacy laws including, but not limited to, the Fair Credit Reporting Act (FCRA), the federal Gramm-Leach-Bliley Act (GLBA) and its implementing regulations, the Driver's Privacy Protection Act of 1994.

Use of Personal Information for Business or Commercial Purposes

We may use the personal information we collect for one or more of the following business or commercial purposes:

To fulfill or meet the reason for which the information is provided.
For our internal operational purposes.
For auditing relating to consumer transactions including ad impressions and compliance with regulations.
Fraud and security detection
Debugging to identify and repair errors.
Short-term data use for the current interaction that is not used to build a profile.
Servicing transactions and accounts (e.g., customer service, maintaining and servicing accounts, customer verification, payment processing) and providing services on behalf of business or service provider (e.g., financing, advertising or marketing, analytics).
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
Undertaking internal research for technological development and demonstration.
To share the personal information with service providers to carry out other business purposes.

We will not collect additional categories of personal information without providing you a new Notice at Collection disclosing those categories. We will not use your personal information for a purpose materially different from those disclosed in this Notice at Collection unless we directly notify you and obtain explicit consent to use it for the new purpose.

Privacy Policy

The purpose of this privacy policy is to provide you with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale or sharing of personal information and of your rights regarding your personal information.

State Law provides consumers with specific rights regarding their personal information. This section describes your State Law rights and explains how to exercise those rights.

Your Right to Know About Personal Information Collected, Disclosed, or Sold

You have the right to request that we disclose what personal information we collect, use, disclose, and sell. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories of personal information we have disclosed for a business or commercial purpose, and categories of third parties to whom the information was disclosed.

Category	In the preceding 12 months this category was:		Categories of third parties to whom the information was disclosed
Category	Collected	Disclosed
A. Identifiers			Advertising networks Data analytics providers Government entities Operating systems and platforms Social networks Cloud storage providers Payment processors E-mail distribution service providers Cybersecurity service providers Logistics and planning tool providers Customer relationship management tool providers
B. State Law Personal Information Categories			Advertising networks Data analytics providers Government entities Operating systems and platforms Social networks Cloud storage providers Payment processors E-mail distribution service providers Cybersecurity service providers Logistics and planning tool providers Customer relationship management tool providers
C. Characteristics of State or Federal Protected Classifications			Advertising networks Data analytics providers Government entities Operating systems and platforms Social networks Cloud storage providers Payment processors E-mail distribution service providers Cybersecurity service providers Logistics and planning tool providers Customer relationship management tool providers
D. Commercial Information			Advertising networks Data analytics providers Government entities Operating systems and platforms Social networks Cloud storage providers Customer relationship management tool providers
E. Biometric Information			Data analytics providers Government entities Cloud storage providers Customer relationship management tool providers
F. Internet or Other Similar Network Activity			Government entities Data analytics providers Operating systems and platforms Cloud storage providers
G. Geolocation Data			Advertising networks Data analytics providers Social networks
H. Sensory or Surveillance Data			Government entities Operating systems and platforms Cloud storage providers
I. Professional or Employment-Related Information			Government entities Operating systems and platforms Cloud storage providers
J. Education Information
K. Profile Data

We collected this personal information from the following categories of sources:

Directly from consumers
Our website and using web technologies
Broker and correspondent partners
Consumer credit reporting agencies
Government entities

We have not sold consumers’ personal information in the past 12 months. We do not sell personal information and do not have actual knowledge that we sell the personal information of minors under 16 years of age.

Your Right to Request Deletion of Your Personal Information

You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions – including personal information collected subject to the GLBA. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Comply with State or Federal law.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
Comply with a legal obligation.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Your Right to Request Correction of Your Inaccurate Personal Information

You have the right to request correction of your personal information that you believe is inaccurate.

Right to Opt-Out of the Sale or Sharing of Personal Information

You have the right to opt-out of the sale or sharing of your personal information including sensitive personal information; however, as noted above, we do not sell or share personal information, including sensitive personal information. You may still exercise this right by using the link provided below.

Our Retention of Personal Information

We follow applicable law governing the retention of your personal information. We retain your personal information for as long as we need to fulfil our business purposes, as set forth in this policy. Factors that influence the length of time that we retain your personal information include, but are not limited to: information needed to provide employment, products, services, and/or experiences to you; information needed to manage your account, ensure secure payment, and contact you; and, finally, information needed to serve any other business purpose as allowed or required by applicable law.

Right to Non-Discrimination

You have a right not to be discriminated against for exercising your privacy rights under State Law. Unless permitted by State Law, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Submitting a Verified Consumer Request

You have the right to submit verified consumer requests to know and requests to delete. The request to know can be for any or all of the following:

Specific pieces of personal information that we have collected about you;
Categories of personal information we have collected about you;
Categories of sources from which the personal information was collected;
Categories of personal information that we sold or disclosed for a business purpose about you;
Categories of third parties to whom the personal information was sold or disclosed for a business purpose; and
The business or commercial purpose for collecting or selling personal information.

The response to a request for any of the categories above will cover the 12 months preceding your request. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Submitting a Verified Consumer Request

You may exercise your right to request Deletion, Correction of Your Inaccurate Personal Information or Your Right to Opt-Out of the Sale or Sharing of Personal Information as provided below:

You may submit a request by:

Visitinghttps://my-info.homepointfinancial.com/ccpa

If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will either treat it as if it had been submitted in accordance with our designated methods or provide you with information on how to submit the request or remedy any deficiencies.

Your request will be verified by matching the information you provide to information that we have collected.

Once we receive your verifiable consumer request, we will confirm receipt of the request which will describe our verification process. In general, we will respond to your request within 45 calendar days if we are able to verify your identity. However, if necessary, we may take up to an additional 45 calendar days to respond to your request and will provide you with notice and an explanation of the reason for any such extension. Requests for deletion will require a separate confirmation that you want your information deleted.

If requests from you are manifestly unfounded or excessive in particular because of their repetitive character, we may either charge a reasonable fee or refuse to act on the request, notifying you of our reason for refusing to act. If we determine that the request warrants a fee, we will notify you of the reason for that determination and provide you with a cost estimate before completing your request.

Please note that, in responding to your request, we are not permitted to disclose or provide you with your Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics. However, we will inform you with sufficient particularity that we have collected the type of information without disclosing the actual data.

Requests to Know or Delete for Child Under the Age of 13

We do not knowingly collect information of minors under the age of 13.

Using an Authorized Agent to Submit a Request

Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in your state that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to State Law. If a power of attorney that meets those provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request.

If you are an authorized agent making a request, you need to either:

e-mail a copy of a power of attorney provided to you by the consumer pursuant to applicable State Law; or
e-mail proof of signed permission along with a copy of your ID and have the consumer directly confirm with us that they provided you permission to submit the request by sending an e-mail.

Requests to Access or Delete Household Information

We will not comply with a request to know specific pieces of personal information or a request to delete household personal information unless all consumers of the household jointly request access to specific pieces of information or deletion, we can individual verify all members of the household and we can verify that each member making the request is currently a member of the household. If a member of a household is a minor under 13, we must obtain verifiable parental consent before complying with a request to access specific pieces of information for the household or deletion of household personal information.

Other State Privacy Rights

We do not respond to web browser “do not track” signals or other mechanisms. Other parties may collect personally identifiable information about your activities over time and across different web sites when a consumer uses our web site or service.

Changes to Our Privacy Notice

Home Point Financial Corporation reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s “Last Updated” date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes

Contact Information

If you have any questions or comments about this notice, the ways in which Home Point Financial Corporation collects and uses your information described herein or in Home Point Financial Corporation’s Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under state Law, please do not hesitate to contact us at:

Website: https://my-info.homepointfinancial.com/ccpa