Privacy Policy for Pennymac Employees & Contractors
How to Submit Your Request If You are a Resident of California
To submit a request to know, access, delete, or correct your information, click on “ Submit a Request ” or call us toll-free at (866) 601-3518 .
Pennymac provides employees and contractors (“consumer” or “you”) with a privacy policy related to the personal information Pennymac collects about you and your household. The purpose of this privacy policy is to provide you with a description of our business practices regarding the collection, use, sale, sharing, and retention of your personal information and of your rights regarding your personal information.
Pennymac provides this policy to California-resident employees and contractors pursuant to the California Consumer Privacy Act of 2018 (“CCPA”) and makes it available through Pennymac’s designated employee and contractor privacy channels. However, with the exception of the additional rights granted to California employees and contractors (explained below), the information in this policy is applicable to all Pennymac employees and contractors.
In the preceding 12 months, Pennymac may have collected the following categories of personal information about you.
| Category | Examples | Collected Within the Previous 12 Months | Retention Period |
|---|---|---|---|
| Identifiers | A real name, alias, mailing address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number or state identification card number, date of birth, passport number, or other similar identifiers. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Any categories of personal information described in the California Customer Records Act (Cal. Civ. Code section 1798.80(e)) | A name, signature, social security number, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, criminal history, credit history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Characteristics of protected classifications under state or federal law | Race, color, age (40 and older), national origin, ancestry, citizenship, mental or physical disability, sex/gender (includes pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity and gender expression, military or veteran status, marital status, medical condition, political affiliations or activities, primary language, immigration status, protected medical leaves | Yes | Duration of employment/contract + 7 years, or as required by law |
| Commercial Information | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Biometric information | Physiological, biological or behavioral characteristics that can be used to establish individual identity, such as a fingerprint. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Physiological, biological or behavioral characteristics that can be used to establish individual identity, such as a facial geometry / facial recognition templates collected for building security and facility entry processes. This may include facial geometry processed through Pennymac’s facial-recognition facility-access system for enrolled individuals. | Yes | Enrolled Users: Retained until you opt out. Non-Enrolled Users: Scans are processed in real time and immediately discarded; no records or logs are created or kept. | |
| Internet or other electronic network activity | Browsing history, search history, and information regarding interaction with an Internet Web site, application, or advertisement. | Yes | Permanently |
| Geolocation data | Physical location or movements. | No | N/A |
| Sensory data | Audio, electronic, visual, or similar information, such as a picture or still images/video captured by facility entry cameras. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Professional or employment-related information | Current or past employment history, or performance evaluations. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Non-public education information, per the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99) | Education records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution, such as transcripts, graduation information, degree, licenses or certifications. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Inferences drawn from any personal information | A profile reflecting the employee’s or contractor’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes, or a profile used to authorize clearance to work in a Pennymac office. | Yes | Duration of employment/contract + 7 years, or as required by law |
| Sensitive Personal Information | Personal information that reveals a consumer’s social security, driver’s license, state identification card, or passport number. A consumer’s racial or ethnic origin, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, religious or philosophical beliefs. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. The processing of biometric information (such facial geometry or templates) for the purpose of uniquely identifying a consumer. Personal information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation. | Yes | Duration of employment/contract + 7 years, or as required by law |
Categories of Sources From Which Personal Information is Collected
- Information you provided directly to us
- Information collected through our websites
- Information provided by entities, such as service providers, credit reporting agencies, or government entities
- Information collected through the use of Pennymac IT systems and devices (including laptops, internal networks, email, and collaboration platforms), through server and system logs, productivity/monitoring software, and internal application cookies, which record Internet or other electronic network activity.
- Information collected through physical facility security systems, including facial recognition entry kiosks and badge readers at Pennymac locations.
Purpose For Collecting Personal Information
- Acknowledge Receipt of Documents and Policies
- Administrative Functions
- Applicant Identification
- Application Process
- Benefits (including administration of benefits involving dependents and beneficiaries)
- Business Resource Groups
- Career Progression/Internal Transfers
- Company Correspondence and/or Gifts
- Determine Website Used to Identify the Open Pennymac Position
- Emergency Response and Contact Information
- Employee Relations
- Employment Authorization
- Equal Employment Opportunity Commission Requirements
- Equity Awards
- Expense Reimbursement
- External Due Diligence Reviews of Pennymac Operations
- Facility access control and automated identity verification via facial recognition systems
- Family and Medical Leave Act Requirements
- Fulfillment of Philanthropy Requests
- Fulfillment of Specific Role Based Responsibilities
- Hiring and Background Screening
- Leave of Absence
- Mentorship Program
- Monitor Call Recordings for Training and Quality
- Obtaining E-Signatures
- Payroll
- PennyPantry Access
- Performance Reviews
- Pre-Employment Assessment
- Regulatory Compliance, such as Access Persons and Know Your Customer Requirements
- Rehire Eligibility
- Security and Building Access, including biometric facial verification
- Special Accommodations
- State Licensing Requirements
- System Access
- Tax Purposes
- Training & Education
- Wellness Program
- Work Equipment Distribution
- Workplace Engagement
- Workplace Monitoring
Why We Might Disclose Your Personal Information to Entities (as further described below)
- To support business operations
- Fulfillment of employment benefits you have selected (401K, medical, etc.)
- To support security infrastructure, including vendor facility access control systems and biometric processing software
Sale or Sharing of Personal Information
Pennymac does not sell or share personal information. For the purposes of this policy, “share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
Pennymac has no knowledge that we sold or shared the personal information of consumers under 16 years of age.
While we do not sell or share your information, we do disclose your information for the business purposes described below to the categories of entities outlined below.
In the Preceding 12 Months, Pennymac May Have Disclosed the Following Categories of Personal Information About You to the Entities Below (Examples of each Category are included above)
| Entities | ||||
|---|---|---|---|---|
| Category | Service Providers or Professional Service Firms | Affiliates | Regulators, Legal Authorities, or Other Similar Authorities and/or Agencies | Borrowers, Customers, or Authorized Third Parties (ATP) |
| Identifiers | ||||
| Personal Information Categories (CAL. CIV. CODE § 1798.80(e)) | ||||
| Protected Classification Characteristics | N/A | |||
| Commercial Information | N/A | |||
| Biometric Information | N/A | |||
| Biometric Information (Facial Recognition) | N/A | N/A | ||
| Internet or other electronic network activity | N/A | |||
| Geolocation data | N/A | N/A | N/A | N/A |
| Sensory data | N/A | |||
| Professional or employment-related information | N/A | |||
| Non-public education information | N/A | |||
| Inferences drawn from any personal information | N/A | |||
| Sensitive Personal Information | N/A | |||
Sensitive Personal Information
Pennymac uses and discloses sensitive personal information only as reasonably necessary and proportionate for the purposes permitted by the CCPA and its implementing regulations. Therefore, Pennymac does not currently provide a separate Right to Limit the Use or Disclosure of Sensitive Personal Information. If Pennymac’s practices change in a manner that requires this right, Pennymac will provide the required notice and request method.
Facial-Recognition Facility Access
Pennymac offers eligible personnel facial-recognition access to designated facilities. Personnel who withdraw may continue to use a valid access badge. To enroll a person, Pennymac uses an existing badge photo or takes a new photo; if a new photo is taken, it replaces the old photo in Pennymac’s badge-photo system. That badge-system photo remains subject to Pennymac’s ordinary badge-photo retention practices. Copies on the camera and upload computer are deleted after upload.
Pennymac makes the enrollment photo available to its security vendor, Verkada. Verkada uses and retains its own copy to create a facial-authentication credential and retains both the photo copy and credential while needed to provide this access option. If enrollment is withdrawn, Pennymac disables facial-recognition access and Verkada removes its photo copy and credential from the access system. Verkada also deletes both when employment or the program ends, subject to applicable law. These actions do not delete Pennymac’s separate badge-system photo.
The badge reader and facial scanner are on the same device. An unenrolled person may be briefly scanned while using a badge, and the scan may return “no match.” Neither Pennymac nor Verkada retains the incidental facial scan, a biometric template, or a log of that scan. Ordinary security video recording and badge-access records continue. Pennymac and Verkada use facial-access information for facility access, identity verification, and physical security—not to make employment decisions or to train, improve, develop, or test facial-recognition or other technology.
Additional Rights Granted to California Employees and Contractors
Under the CCPA, you, as a California resident, have the following rights:
Right to Know/Access
As a California resident, you have the right to request that Pennymac disclose what specific/categorical personal data we collected about you, the sources and purposes for that collection, and a list of the categories and specific entities your data was sold, shared, or disclosed to.
Pennymac does not sell or share your personal information.
Right to Delete
As a California resident, you have the right to request that Pennymac delete any personal information about you that it collected.
Pennymac may deny your request if there are any conflicts with our corporate record retention requirements, federal or state law, or if it falls under any other CCPA exception.
Right to Correct
As a California resident, you have the right to request that Pennymac correct inaccurate personal information Pennymac maintains about you.
Right to Opt-Out
As a California resident, you have the right to direct a business not to sell or share your personal information. Pennymac does not sell or share the personal information of employees or contractors. If Pennymac’s practices change, Pennymac will provide any notice and opt-out method required by applicable law.
Right Not to Be Retaliated Against for Exercising Your CCPA Rights
Pennymac does not discriminate against you for exercising your CCPA privacy rights.
Automated Decision-making Technology
If Pennymac uses automated decision-making technology in a manner covered by applicable CCPA regulations, Pennymac will provide required notices and honor applicable rights relating to that technology.
These rights only extend to information covered by the CCPA, and because the CCPA does not cover all consumer information in all scenarios, only certain information is subject to the above referenced rights.
Authorized Third Party
If you are an authorized third party (such as an attorney-in-fact) making a request on behalf of someone else, please contact us using one of the methods provided below.
How to Submit Your Request If You are a Resident of California
To submit a request to know, access, delete, or correct your information, click on “ Submit a Request ” or call us toll-free at (866) 601-3518 .
Pennymac will verify your identity using the personal information you provide, which must include your name, address, and email address.
Contact Information:
If you have any questions or concerns about our privacy policies and information practices, you may contact Pennymac using the information below.
PennyMac Loan Services, LLCAttention: Corporate Privacy
PO Box 788
Moorpark, CA 93020-9903
P: (866) 601-3518
This privacy policy was last updated on October 15, 2026.
Pennymac may update this policy from time to time. If we make material changes, we will provide notice as required by applicable law and update the “Last Updated” date above.
Rev. 10/2026