Privacy Notice for Pennymac Employees & Contractors
How to Submit Your Request If You are a Resident of California
To submit a request to know, access, delete, or correct your information, click on “ Submit a Request ” or call us toll-free at (866) 601-3518 .
Pennymac provides this notice to California-resident employees and contractors (“consumer” or “you”) at or before the collection of personal information, pursuant to the California Consumer Privacy Act (“CCPA”) to explain the personal information Pennymac may collect about you and the purpose for which the categories of personal information may be used. While the CCPA only applies to California residents, the information in this notice is applicable to all Pennymac employees and contractors.
For additional information about Pennymac’s privacy practices and your rights under the CCPA, please review the Pennymac Employee and Contractor Privacy Policy at https://www.pennymac.com/privacy-policy-california-employees-contractors.
The chart below outlines categories of personal information Pennymac may collect about you, your household, your dependents, or your beneficiaries, specific examples for each category, and the purpose for which that information may be used.
| Category | Examples | Collected Within Previous 12 Months | Retention Period |
|---|---|---|---|
| Identifiers | A real name, alias, mailing address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number or state identification card number, date of birth, passport number, or other similar identifiers. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Any categories of personal information described in the California Customer Records Act (Cal. Civ. Code section 1798.80(e)) | A name, signature, social security number, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, criminal history, credit history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Characteristics of protected classifications under state or federal law. | Race, color, age (40 and older), national origin, ancestry, citizenship, mental or physical disability, sex/gender (includes pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity and gender expression, military or veteran status, marital status, medical condition, political affiliations or activities, primary language, immigration status, protected medical leaves. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Commercial Information | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Biometric information | Physiological, biological or behavioral characteristics that can be used to establish individual identity, such as a fingerprint. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Physiological, biological or behavioral characteristics that can be used to establish individual identity, such as facial geometry / facial recognition templates collected for building security and facility entry processes. This may include facial geometry processed through Pennymac’s facial-recognition facility-access system for enrolled individuals. | Yes | Enrolled Users: Retained until you opt out. Non-Enrolled Users: Scans are processed in real time and immediately discarded; no records or logs are created or kept. | |
| Internet or other electronic network activity | Browsing history, search history, and information regarding interaction with an Internet Web site, application, or advertisement. | Yes | Permanently |
| Geolocation data | Physical location or movements. | No | N/A |
| Sensory data | Audio, electronic, visual, or similar information, such as a picture. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Professional or employment-related information | Current or past employment history, or performance evaluations. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Non-public education information, per the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99) | Education records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution, such as transcripts, graduation information, degree, licenses or certifications. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Inferences drawn from any personal information | A profile reflecting the employee’s or contractor’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes, or a profile used to authorize clearance to work in a Pennymac office. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Sensitive Personal Information | Personal information that reveals a consumer’s social security, driver’s license, state identification card, or passport number. A consumer’s racial or ethnic origin, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, religious or philosophical beliefs. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. The processing of biometric information for the purpose of uniquely identifying a consumer. Personal information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation. | Yes | Duration of employment/contract + 7 years, or as required by law |
Biometric Information and Facial Recognition Access
Pennymac may collect fingerprints where required for a disclosed work-related purpose. Employees enrolled in facial-recognition building access may have an existing badge photo used, or a new photo taken, to create a facial-authentication credential. Verkada, Pennymac’s security vendor, uses and retains a copy of the photo and retains the credential to provide facial-recognition building access. Verkada deletes both its photo copy and the credential when the employee withdraws from enrollment, employment ends, or the program ends, subject to applicable law. A photo in Pennymac’s separate badge-photo system remains subject to Pennymac’s ordinary badge-photo retention practices.
An unenrolled person, including someone who has opted out, may be briefly scanned when using the combined badge and facial reader. Neither Pennymac nor Verkada retains the incidental facial scan, a biometric template, or a log of that scan. Ordinary security video and badge-access records are unaffected. Neither Pennymac nor Verkada uses facial-access information to train, improve, develop, or test facial-recognition or other technology.
Categories of Sources From Which Personal Information is Collected
- Information you provided directly to us
- Information collected through our websites
- Information provided by entities, such as service providers, credit reporting agencies, or government entities
- Information collected through the use of Pennymac IT systems and devices (including laptops, internal networks, email, and collaboration platforms), through server and system logs, productivity/monitoring software, and internal application cookies, which record Internet or other electronic network activity.
- Information collected through physical facility security systems, including facial recognition entry kiosks and badge readers at Pennymac locations.
Purpose For Collecting and Using Personal Information
- Acknowledge Receipt of Documents and Policies
- Administrative Functions
- Applicant Identification
- Application Process
- Benefits (including administration of benefits involving dependents and beneficiaries)
- Business Resource Groups
- Career Progression/Internal Transfers
- Company Correspondence and/or Gifts
- Determine Website Used to Identify the Open Pennymac Position
- Workplace Engagement
- Emergency Response and Contact Information
- Employee Relations
- Employment Authorization
- Equal Employment Opportunity Commission Requirements
- Equity Awards
- Expense Reimbursement
- External Due Diligence Reviews of Pennymac Operations
- Family and Medical Leave Act Requirements
- Fulfillment of Philanthropy Requests
- Fulfillment of Specific Role Based Responsibilities
- Hiring and Background Screening
- Leave of Absence
- Mentorship Program
- Monitor Call Recordings for Training and Quality
- Obtaining E-Signatures
- Payroll
- PennyPantry Access
- Performance Reviews
- Pre-Employment Assessment
- Regulatory Compliance, such as Access Persons and Know Your Customer Requirements
- Rehire Eligibility
- Security and Building Access
- Special Accommodations
- State Licensing Requirements
- System Access
- Tax Purposes
- Training & Education
- Wellness Program
- Work Equipment Distribution
- Workplace Monitoring
Sale or Sharing of Personal Information
Pennymac does not sell or share personal information. For the purposes of this notice, “share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
To submit a request to know, access, delete, or correct your information, click on “ Submit a Request ” or call us toll-free at (866) 601-3518 .
Questions? Contact Employee Relations at employeerelations@pnmac.com.
This privacy notice was last updated on October 15, 2026 and is subject to change.
Rev. 10/2026