California Privacy Policy

We collect most of this personal information directly from our clients whom we provide services to, as well as directly from you, such as through telephone conversations, written correspondence through the mail, email or fax, by viewing your public social media/network pages or posts, or other information available publicly online. However, we may also collect information:

• From public record sources (e.g., property records or court records);
• From our service providers (e.g., letter vendor, skip tracing vendors, payment processing vendors, call analytics vendor, and/or electronic signature service provider);
• Information from our affiliates;
• Directly from a third party (e.g., third parties contacted during skip tracing activities pursuant to 16 U.S.C. §1692b, such as your friends, neighbors, relatives, and/or employer);
• From a third party with your consent (e.g., your authorized representative and/or attorney); and/or
• From activity on our website.

We may use or disclose your personal information for one or more of the following business purposes:

• To fulfill or meet the reason you provided the information. For example, if you supplied information as part of a loan application, we may use that information to collect on the loan, or if you share your personal information to make a payment, we will use that information to process your payment.
• Performing our services, including debt collection, maintaining or servicing accounts, providing customer service, processing or fulfilling transactions, verifying information, processing payments, providing analytic services, or providing similar services on behalf of our business clients.
• To provide you with information or services that you request from us.
• Auditing related to a current interaction with the consumer and concurrent transactions.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Debugging to identify and repair errors that impair existing intended functionality.
• Short-term, transient use, provided the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction.
• Undertaking internal research for technological development and demonstration.
• Operating, understanding, optimizing, developing, or improving our sites, applications, products, services and operations, including by using analytics tools.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned or controlled by the business.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As necessary or appropriate to protect the rights, property or safety of us, our clients, consumers, or others.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We routinely share personal information with:

• Our affiliates, when deemed appropriate, including companies within Performant Financial Corporation’s group of subsidiaries;
• Service providers we use to help deliver our services, such as letter vendors, website hosting, information technology and related infrastructure, email delivery, and auditing;
• Other third parties we use to help us run our business, such as banking services, communications infrastructure, insurers, storage providers, legal professionals, tax professionals, and auditors;
• Third parties approved by you, including third-party payment providers;
• Credit reporting agencies; and
• Government agencies as required by laws and regulations.

You have the right under the CCPA, and certain other privacy and data protection laws, as applicable, to exercise free of charge:

1. Disclosure of Personal Information We Collect About You

   You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

   • The categories of personal information we have collected about you.
   • The categories of sources from which the personal information is collected.
   • Our business or commercial purpose for collecting or selling personal information.
   • The categories of third parties with whom we share personal information, if any.
   • The specific pieces of personal information we have collected about you.
    

   Please note that we are not required to:

   • Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained;
   • Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information; or
   • Provide the personal information to you more than twice in a 12-month period.
   • Honor your request in some instances, such as when we cannot verify your identity or if we cannot verify that you have the authority to make a request on behalf of another individual. We will advise you in our response if we are not able to honor your request. We will not provide Social Security numbers, driver’s license numbers or government issued identification numbers, financial account numbers, health care or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.
    
2. Disclosure of Personal Information Sold or Used for a Business Purpose

   In connection with any personal information we may sell or disclose to a third party for a business purpose, you have the right to know:

   • The categories of personal information about you that we sold and the categories of third parties to whom the personal information was sold; and
   • The categories of personal information that we disclosed about you for a business purpose.
    
3. Deletion Request Rights

   You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

   We may deny your deletion request if retaining the information is necessary for us or our service providers to:

   • Complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us.
   • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
   • Debug to identify and repair errors that impair existing intended functionality.
   • Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
   • Comply with the California Electronic Communications Privacy Act.
   • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent.
   • Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
   • Comply with an existing legal obligation.
   • Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.
    
4. Protection Against Discrimination

   You have the right to not be discriminated against by us because you exercised any of your rights under the CCPA. This means we cannot, among other things:

   • Deny goods or services to you;
   • Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
   • Provide a different level or quality of goods or services to you; or
   • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
    

To exercise any rights described herein, please submit a verifiable consumer request to us by either:

• Submitting a request through our online inquiry form
• Write to us:
  Attention: Compliance Department – CA Privacy Rights
  Performant Financial Corp.
  333 North Canyons Parkway, Suite 100
  Livermore, CA 94551
  USA
 

Please note that you may only make a data access or data portability disclosure request twice within a 12-month period.

If you choose to contact us, you will need to provide us with:

• Enough information to identify you (i.e., your full name, postal address, and account or matter reference number);
• Proof of your identity:
  • If you have an account with us, provide the last four numbers of your Social Security number and date of birth
  • If you do not have an account with us, provide your phone number and a copy a government issued identification card showing your address
• Describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it.

We are not obligated to make a data access disclosure if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person’s behalf.

Any personal information we collect from you to verify your identity in connection with you request will be used solely for the purposes of verification.

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

• Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained;
• Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information; or
• Provide the personal information to you more than twice in a 12-month period.
• Honor your request in some instances, such as when we cannot verify your identity or if we cannot verify that you have the authority to make a request on behalf of another individual. We will advise you in our response if we are not able to honor your request. We will not provide social security numbers, driver’s license numbers or government issued identification numbers, financial account numbers, health care or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated policy on our website (with a new “Last Updated” date) and/or notify you by other means consistent with applicable law.