CCPA/CPRA Privacy Policy

Privacy Policy for California Residents

Last Updated: July 14, 2026

This Privacy Policy for California Residents (“California Privacy Policy”) supplements the information contained in Lendmark’s Terms of Use (opens in new tab) and Online Privacy Policy (opens in new tab) and discusses our collection and use of “personal information”, as defined under the CCPA(as defined below). This California Privacy Policy applies solely to all visitors, users, and others who reside in the State of California that use or interact with our personal lending and other financial services, website, customer account portal, mobile application, physical branches, and other applications (“consumers” or “you”).

Lendmark Financial Services, LLC, its subsidiaries and affiliates (“We”, “us”, “our” or “Lendmark”) adopts this California Privacy Policy to comply with applicable California data privacy and protection laws and regulations, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), and any implementing regulations adopted by the California Privacy Protection Agency (collectively referred to as the “CCPA”). Capitalized terms not defined herein shall have the same meaning as the CCPA when used in this California Privacy Policy. “Personal Information” in both capitalized or lower case form shall have the same meaning as “personal information” ascribed to it under the CCPA.

Please note that Lendmark is a financial institution subject to the Gramm-Leach-Bliley Act (“GLBA”). The CCPA excludes certain personal information from its scope including, without limitation, personal information collected, processed, sold, or disclosed subject to the GLBA. Therefore, for example, if you have submitted an application for a loan with Lendmark or are a customer of Lendmark, any information you provided in that application and in connection with your Lendmark account is subject to the GLBA and exempt from the CCPA. For additional information regarding our collection, use, and disclosure of personal information subject to the GLBA, and information relating to your choices with respect to this information, please see our GLBA Privacy Notice (opens in new tab)

Accessibility

A Spanish version of this California Privacy Policy is available at: https://www.lendmarkfinancial.com/es/disclosures/cpra (opens in new tab)

I. Notice at Collection

Data Categories Collected by Us

This Notice at Collection describes the categories of personal information we collect, the purposes for which we use the information, whether we sell or share the information, and our retention criteria.

We currently collect the following categories of personal information listed in the chart below:

Retention Period: We retain and use these categories of personal information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, to comply with our business requirements and legal obligations, to provide our Services, and other purposes to the extent provided in this California Privacy Policy. Specific retention periods vary based on the type of information, the sensitivity of the information, the purpose for which it was collected, or relationship to you, and the applicable legal, regulatory, contractual, accounting, and operational requirements. We will take reasonable steps to delete the personal information when (1) we have a legal obligation to do so; (2) we no longer have a purpose or obligation for retaining the information; or (3) if you ask us to delete the information unless there is an applicable exception to deleting the information under the CCPA or another applicable law. We are required to maintain records of Consumer requests submitted under the CCPA, which may include these categories of personal information, and how we responded to such requests for at least twenty-four (24) months. Such information related to Consumer requests is retained only for recordkeeping purposes.

Business or Commercial Purposes: We use the categories of personal information listed above to provide our products and services to you, to operate, manage, and maintain our business, and to accomplish the following business and commercial purposes, including the following:

• To fulfill or meet the reason for which the information is provided;

• To provide you with information, products or services that you request from us directly or indirectly;

• To provide you with email alerts, SMS or text messages, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you;

• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections;

• To provide customer service, maintain and service accounts, verify customer information, process payments, provide financing, provide analytic services, or provide similar services on behalf of the business;

• To improve our website and present its contents to you;

• To manage your preferences and provide a more personalized experience;

• To establish and maintain your user account with us;

• To authenticate you and verify your identity, including by using photographs, photo-identification, or third-party identity-verification services where applicable;

• For short-term, transient use including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the consumer’s personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business

• To detect fraud and prevent loss, or as necessary or appropriate to protect the rights, property, or safety of us, our users and customers, or others;

• To audit related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;

• To debug to identify and repair errors that impair existing intended functionality;

• To allow you to contact us and facilitate your communication with us;

• To respond to your feedback, requests, questions, or inquiries;

• To provide offers to eligible users or customers;

• To provide advertising and marketing services, measure ad-driven activity, manage marketing and advertising platforms, and conduct cross-context behavioral advertising, subject to applicable notice, opt-out, and opt-out preference signal requirements under the CCPA.

• As described to you when collecting your personal information or as otherwise set forth in the CCPA; and

• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

Other Processing Activities: As permitted by applicable law, we may use all of the personal information that we collect in order to:

• Comply with federal, state, or local laws;

• Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities;

• Cooperate with law enforcement agencies concerning conduct or activity that we, a service provider, or a third party reasonably and in good faith believe may violate federal, state, or local law;

• Cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury;

• Exercise or defend legal claims; and

• Collect, use, retain, sell, or disclose consumer information that is deidentified or aggregated.

Additional Data Collection and Uses: We will not collect categories of personal information other than those discussed above, use your personal information for any other purposes that are not disclosed or that are incompatible with the disclosed purposes, or retain personal information for longer than is reasonably necessary to achieve the purposes for which it was collected, without providing you notice as may be required under the CCPA.

Exclusions from Personal information: Personal information does not include:

• Publicly available information or lawfully obtained, truthful information that is a matter of public concern;

• Personal information that is deidentified;

• Personal information that is aggregated;

• Information excluded from the scope of the CCPA including, but not limited to:

  • Personal information collected, processed, sold, or disclosed subject to the GLBA or the California Financial Information Privacy Act;

  • Personal information bearing on an activity involving the collection, maintenance, disclosure, sale, communication, or use of such information by an agency, furnisher, or user subject to regulation under the Fair Credit Reporting Act (FCRA); or

  • Personal information collected, processed, sold, or disclosed pursuant to the California Financial Information Privacy Act and implementing regulations or the Driver’s Privacy Protection Act of 1994.

II. Data Practices During Last 12 Months

Personal Information Collected: As described in this California Privacy Policy, we have collected the categories of personal information listed below during the preceding 12 months:

• Identifiers

• Categories of personal information described in Cal. Civ. Code § 1798.80(e)

• Characteristics of protected classifications under California or federal law

• Commercial information

• Biometric information

• Internet or other similar network activity

• Geolocation data

• Sensory data

• Professional or employment-related information

• Non-public education information

• Sensitive Personal Information

Categories of Sources: We have collected the categories of personal information identified in this California Privacy Policy from the following categories of sources:

• Directly from you. For example, from forms you complete, applications you submit, or products or services you obtain from us.

• Indirectly from you. For example, from lead generation companies or cookies.

• Service Providers and Contractors. For example, credit reporting agencies or credit and verification providers.

• Government entities. For example, from government records.

Business and Commercial Purpose for Collecting: We have collected the categories of personal information identified for the purposes listed in the “Business or Commercial Purposes” section above.

Categories of Personal information Disclosed for a Business Purpose: We have disclosed the following categories of personal information to service providers or contractors for a business purpose, or upon your consent to third parties during the preceding 12 months:

• Identifiers

• Personal information described in Cal. Civ. Code § 1798.80(e)

• Characteristics of protected classifications under California or federal law

• Commercial information

• Biometric information

• Internet or other similar network activity

• Geolocation data

• Sensory data

• Professional or employment-related information

• Non-public education information

• Sensitive Personal Information

Business and Commercial Purpose for Disclosing: We have disclosed the categories of personal information identified for the purposes listed in the “Business or Commercial Purposes” section above.

Prior to disclosing any personal information to a service provider or contractor for a business purpose, we enter into a written contract which describes, without limitation, the specific business purposes which the personal information can be used by the service provider or contractor to perform the services specified in the contract, requires the service provider or contractor to both keep any personal information confidential, prohibits the service provider or contractor receiving the personal information from retaining, disclosing, or using the personal information outside the direct business relationship, prohibits the service provider or contractor from selling or sharing any personal information, provides us the right to take reasonable and appropriate steps to ensure that they use personal information in accordance with contractual terms, among other regulatory requirements.

The categories of personal information identified above were disclosed to the following categories of third-party recipients: (1) corporate parents, subsidiaries, and affiliates; (2) advisors (accountants, attorneys); (3) investors; (4) service providers or contractors (data analytics, data storage, mailing, marketing and advertising, payment processing, website and platform administration, technical support, security monitoring; and operating systems and platforms); (5) government agencies, law enforcement, and (6) third parties to which you have authorized us to disclose your Personal Information in connection with services, products or online platforms that we made available for your use or access. With respect to these third parties, please review the Cookies section of our Online Privacy Policy located here (opens in new tab).

Categories of Personal Information Sold or Shared to Third Parties: We do not sell personal information to third parties. In the preceding 12 months, we have shared Identifiers, Internet or other similar network activity, and Geolocation data with advertising, analytics, and marketing partners for advertising, analytics, measurement, attribution, and cross-context behavioral advertising purposes. We do not knowingly sell or share the personal information of Consumers under 16 years of age.

Opt-out. You may opt out of the sharing of your personal information by using the “Do Not Sell or Share My Personal Information” link where provided, or by using an opt-out preference signal such as Global Privacy Control, and we will honor such requests consistent with applicable law.

No Financial Incentive: We do not offer financial incentives or any price or service difference in exchange for the retention or sale of your personal information.

III. California Consumer Rights

Consumer Rights

The CCPA provides consumers with certain rights regarding their personal information. These rights do not apply in all instances and are subject to certain exceptions as a matter of law. By way of example, these rights do not apply where we collect or sell a consumer’s personal information if: (1) we collected that information while the consumer was outside of California, (2) no part of a sale of the consumer’s personal information occurred in California, and (3) no personal information collected while the consumer was in California is sold. You may submit these requests to us as described below, and we honor these rights where they apply.

Right to Know: As described below, you have the right to request that we disclose personal information that we have collected, sold, or shared about you. This includes a request for the following:

• The categories of personal information we have collected about you;

• The categories of sources from which the personal information is collected;

• The categories of personal information that we have sold, shared, or disclosed for a business purpose about you;

• The categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose;

• The specific pieces of personal information we have collected about you;

• The business or commercial purpose(s) for which the personal information was collected, disclosed, sold, or shared.

Right to Delete: You have the right to request that we delete any personal information that we have collected, sold, or shared about you. However, we are not required to honor a deletion request if an exemption applies under the law.

Right to Opt-Out of Sale/Sharing: You have the right to direct a business that sells or shares personal information about you to third parties to stop doing so. We do not sell any personal information as defined by the CCPA. We share Identifiers and Internet or other similar network activity with Google and other advertising, analytics, and marketing partners for advertising, analytics, measurement, attribution, and cross-context behavioral advertising purposes. You may opt out of such sharing by using the “Do Not Sell or Share My Personal Information” link where provided or by using an opt-out preference signal such as Global Privacy Control, and we will honor such requests consistent with applicable law.

Right to Non-Discrimination: We will not discriminate against you, in terms of price or services that we offer, if you submit one of the rights requests listed above.

Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you. Our goal is to keep your personal information accurate, current, and complete.

Right to Limit: In limited circumstances, a Consumer has the right to limit the use and disclosure of Sensitive Personal Information to uses that are necessary to perform our services or as otherwise permitted by law. We only use or disclose Sensitive Personal Information for purposes permitted by the CCPA, and not for purposes for which the right to limit applies, such as targeted advertising or inferring characteristics about you. Therefore, we include this disclosure for informational purposes only.

These rights do not apply to personal information collected or disclosed under certain exemptions under the CCPA. This includes, but is not limited to, personal information collected, processed, sold, or disclosed subject to the GLBA, the California Financial Information Privacy Act, the Fair Credit Reporting Act, or other applicable exemptions. Therefore, rights such as the Right to Know and Right to Delete do not apply to personal information collected, processed, sold, or disclosed pursuant to these exemptions.

IV. How to Exercise your Consumer Rights

Submission Instructions: You may submit a consumer request under the CCPA by: (1) calling toll-free 1-866-413-8340 or (3) submitting a CCPA Request Form through our website (www.lendmarkfinancial.com/contact (opens in new tab)).

Response Process: Upon receiving a request to know, request to delete, or request to correct, we will confirm receipt of the request within ten (10) business days and provide information about how we will process your request. The information provided will describe our verification process and when you should expect a response from us. In general, we will respond to the request within forty-five (45) calendar days from the day we receive it; but, if necessary, we may take up to an additional forty-five (45) calendar days to respond to your request. If an extension is needed, we will notify you of the extension and explain the reasons that responding to your request will take more than forty-five (45) calendar days.

Once verification is complete, we will associate the information provided by you in the verifiable consumer request to any personal information previously collected by us about you. We will promptly take steps to disclose and deliver, free of charge to you, the information requested. We will provide an individualized response to requests regarding categories of personal information as required by applicable law, but, we may refer you to our general practices outlined in this California Privacy Policy when our response would be the same for all consumers and all the information that is otherwise required to be in a response is presented here.

Delivery: Except as otherwise provided by applicable law, the information will be provided in writing or through our website. We will respond by mail. If we do not take action on your request, we will, without delay and, at the latest, within the time period permitted for our response, inform you of the reasons that we did not take action and any rights you may have to appeal the decision.

Verification Procedures: Where verification is required by the CCPA, we are required to verify the identity of individuals who submit a request to know, request to delete, or request to correct. In accordance with our internal policies and in compliance with the CCPA, we will take steps to verify your identity before granting you access to such Personal Information or acting on your request to exercise your rights, as outlined below:

To determine whether the individual making the request is the consumer about whom we collected information, we will verify your identity by matching the identifying information provided by you in the request to the personal information that we already maintain about you. As part of this process, you will be asked to provide your full name, address, and phone number. We will inform you if we cannot verify your identity.

a. If we cannot verify the identity of the person making the request for specific pieces of information, we are prohibited from disclosing any specific pieces of personal information to the requestor. However, if denied in whole or in part for this reason, we will evaluate the request as if it is seeking the disclosure of categories of personal information about the consumer.

b. If there is no reasonable method by which we can verify the identity of the requestor to the degree of certainty required, we will state this in our response and explain why we have no reasonable method by which we can verify the identity of the requestor.

If we cannot verify your identity based on the information already maintained, we may request additional information from you. We will try to limit the information collected, and we will only use this information to verify your identity and for security or fraud-prevention purposes. Except as required by law, we will delete any new personal information collected for the purposes of verification as soon as practical after processing the request.

Authorized Agents: You may designate an authorized agent to make requests on your behalf by sending us written authorization in writing at Privacy Policy Manager, 2118 Usher Street, Covington, GA 30014. If you use an authorized agent to submit a consumer request we may require you to: (1) provide the authorized agent with written permission to do so; and (2) verify your identity directly with us. However, we will not require these actions if you have provided the authorized agent with power of attorney pursuant to the California Probate Code. We may deny a request from the agent that does not submit proof that they have been authorized by the consumer to act on their behalf.

Excessive Requests: If requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, we may either (1) charge a reasonable fee, or (2) refuse to act on the request and notify the consumer of the reason for refusing the request. If we charge a fee, the amount will be based upon the administrative costs of providing the information or communication or taking the action requested.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights including, but not limited to, by:

a. Denying you goods or services.

b. Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

c. Providing you a different level or quality of goods or services.

d. Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

California Shine the Light

Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us once a calendar year information about the information we shared, if any, with other businesses for direct marketing uses. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing, if any, will be included in our response. As part of the California Online Privacy Protection Act, users of our website, applications, or services may request to review or update their information by contacting us using the information provided in the “Contact Information” section below.

Changes and Updates to This California Privacy Policy

We reserve the right to amend, add to, change, update, or modify this California Privacy Policy at our discretion and at any time to reflect changes to how we treat your information or changes in law. When we make changes to this California Privacy Policy, we will post the updated California Privacy Policy on this page with a new “Last Updated” date. If we make material changes to how we treat personal information, we may notify you by email to the email address specified in your account and/or through a notice on the website home page. Any such changes, updates, or modifications shall be effective immediately upon posting unless otherwise stated. Your continued use of our website, applications, or services after the “Last Updated” date will constitute your acceptance of and agreement to such changes and to our collection and sharing of your information according to the terms of the then-current policy.

Contact Information

If you have any questions or comments about this California Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to lodge a complaint with us, you may contact us using the information below and we will do our best to assist you. Please note, if your communication is sensitive, you may wish to contact us by postal mail or telephone:

In Writing: Compliance Manager, 2118 Usher Street, Covington, GA 30014

By Telephone: 1-866-413-8340