Consumer Privacy Policy for Specific State Residents
The California Consumer Privacy Act (“CCPA”), Oregon Consumer Privacy Act (“OCPA”), and Minnesota Consumer Data Privacy Act (“MCDPA”) (collectively, “state law”), grants their state residents certain privacy rights, in addition to the information contained in PennyMac Loan Services, LLC (“Pennymac”)’s online “Privacy Policy” for Pennymac and its affiliates. Pennymac affiliates include companies with a Pennymac or Townsgate name (collectively, “Pennymac,” “we,” “us,” “our”). We adopt this privacy policy to comply with the CCPA, OCPA, and MCDPA, and it applies solely to persons who reside in those states (“consumer” or “you”).
You are provided with privacy rights related to the personal information businesses process about you and your household. The purpose of this privacy policy is to provide you with a description of our business practices regarding the collection, use, sale, sharing, and retention of your personal information, and of your rights regarding your personal information.
Generally, you have the right to know what personal information Pennymac collects, uses, sells, shares, and retains about you, the right to request the deletion of your personal information, the right to correct inaccuracies in your personal data, the right to opt-out of Pennymac processing your personal information for certain purposes, and the right to a list of specific third parties to which Pennymac may have disclosed your personal information. However, these rights only extend to certain information covered by state law, and because state law does not cover all consumer information in all scenarios, only certain information is subject to the above referenced rights.
Exceptions:
State law contains certain exceptions. For example, privacy rights established under state law (including the right to know and right to delete) do not apply to personal information collected or disclosed pursuant to the Gramm-Leach-Bliley Act (“GLBA”) and the Fair Credit Reporting Act (“FCRA”).
INFORMATION WE MAY COLLECT, USE, OR DISCLOSE
| Category | Examples | Collected Within the Previous 12 Months |
|---|---|---|
| Identifiers | A real name, alias, mailing address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number or state identification card number, date of birth, passport number, or other similar identifiers. | Yes |
| Any categories of personal information described in the California Customer Records Act (Cal. Civ. Code section 1798.80(e)) | A name, signature, social security number, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, criminal history, credit history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. | Yes |
| Characteristics of protected classifications | Race, color, age (40 and older), national origin, ancestry, citizenship, mental or physical disability, sex/gender (includes pregnancy, childbirth, and related medical conditions), sexual orientation, gender identity and gender expression, military or veteran status, marital status, medical condition, political affiliations or activities, primary language, immigration status, or protected medical leaves. | Yes |
| Commercial Information | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Yes |
| Biometric information | Physiological, biological or behavioral characteristics that can be used to establish individual identity, such as a fingerprint or voiceprint. | No |
| Internet or other electronic network activity | Browsing history, search history, and information regarding interaction with an Internet Web site, application, or advertisement. | Yes |
| Geolocation data | Physical location or movements. | No |
| Sensory data | Audio, electronic, visual, or similar information, such as call and video recordings. | Yes |
| Professional or employment-related information | Current or past employment history. | Yes |
| Non-public education information, per the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99) | Education records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution, such as transcripts, graduation information, degree, licenses, or certifications. | Yes |
| Inferences drawn from any personal information | A profile reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes. | Yes |
| Sensitive Personal Information | Personal information that reveals a consumer’s social security, driver’s license, state identification card, or passport number. A consumer’s account log-in, financial account, debit card, or credit card in combination with any required security or access code, password, or credentials allowing access to an account. A consumer’s precise geolocation, racial or ethnic origin, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, religious or philosophical beliefs, or union membership. The contents of a consumer’s mail, email, or text messages unless the business is the intended recipient of the communication. A consumer’s genetic data. The processing of biometric information for the purpose of uniquely identifying a consumer. | Yes |
Categories of Sources From Which Personal Information is Collected
- Information you provided directly to us
- Information collected through our websites
- Information provided by third parties, such as lead providers, service providers, credit reporting agencies, or government entities
- Information collected using web technologies
Purpose For Collecting Personal Information
- Originating your loan
- Servicing your loan
- Marketing
- Analytics
- Business purposes
Why We Might Use or Disclose Your Personal Information
- Activities related to the origination of your loan
- Activities related to the servicing of your loan
- Marketing
- Analytics
- Business purposes
Why We Might Use or Disclose Your Sensitive Personal Information to Third Parties
- Pennymac only uses or discloses sensitive personal information for the following purposes:
- Originate or service your loan
- Detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information
- Resist malicious, deceptive, fraudulent, or illegal actions directed at Pennymac to prosecute those responsible for those actions
- Ensure the physical safety of natural persons
Who We May Disclose Your Personal Information To and What We Might Disclose (Examples of each Category are included in the table above)
| Third Parties | ||||
|---|---|---|---|---|
| Category | Suppliers, Service Providers, or Professional Service Firms | Affiliates | Regulators, Legal Authorities, or Other Similar Authorities and/or Agencies | Investors, Banks, or Insurers |
| Identifiers | ||||
| Personal Information Categories | ||||
| Protected Classification Characteristics | ||||
| Commercial Information | ||||
| Biometric Information | N/A | N/A | N/A | N/A |
| Internet or other electronic network activity | N/A | |||
| Geolocation data | N/A | N/A | N/A | N/A |
| Sensory data | N/A | |||
| Professional or employment-related information | ||||
| Non-public education information | ||||
| Inferences drawn from any personal information | N/A | N/A | N/A | N/A |
| Sensitive Personal Information | ||||
Regulators, legal authorities, or other similar authorities and/or agencies may process your personal information to oversee Pennymac’s compliance with legal and regulatory requirements.
Sale or Sharing of Information
Pennymac does not sell personal information; however, Pennymac shares personal information, such as identifiers and internet or other electronic network activity with Suppliers or Service Providers for marketing purposes.
Pennymac does not have actual knowledge that it has sold, shared, or processed the personal information of consumers under 18 years of age.
YOUR PRIVACY RIGHTS
Right to Know
You have the right to request that Pennymac disclose the personal information Pennymac has collected or processed about you, including the categories of personal information, categories of sources from which the personal information was collected, the purpose for collecting, selling, or sharing personal information, a list of third parties to whom we disclose personal information, and the categories of third parties to whom we disclose personal information.
Right to Access
You have the right to request that Pennymac disclose the specific pieces of personal information Pennymac has collected about you.
Right to Request Deletion
You have the right to request the deletion of the personal information we collected about you.
Pennymac may deny your request if there are any conflicts with our corporate record retention requirements, federal or state law, or if it falls under any other state law exception.
Right to Request Correction
You have the right to request that Pennymac correct inaccurate personal information Pennymac maintains about you.
Right to Opt Out
You have the right to opt-out of the sale or sharing of your personal information, and the right to opt-out from Pennymac processing your personal information for the purposes of targeted advertising, or profiling you in furtherance of decisions that produce legal effects or effects of similar significance. Pennymac does not sell personal information. To opt-out of this type of processing, see the Notice of Right to Opt-out below.
Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
Pennymac does not discriminate against you for exercising your state law privacy rights.
Authorized Third Party
If you are an authorized third party (such as an attorney-in-fact) making a request on behalf of someone else, please contact us using one of the methods provided below. You may be asked to provide proof that you are authorized to submit the request.
How to Submit Your Request
To submit a request, click on “Submit a Request” or call us toll-free at (866) 601-3518.
Pennymac will verify your identity using the personal information you provide, which must include your name, address, and email address.
How to Appeal Pennymac’s Denial of Your Previous Request
To submit an appeal of Pennymac’s denial of your previous request, click on “Submit a Request” or call us toll-free at (866) 601-3518.
Notice of Right to Opt Out
You have the right to opt-out of the sale or sharing of your personal information, and the right to opt-out from Pennymac processing your personal information for the purposes of targeted advertising, or profiling you in furtherance of decisions that produce legal effects or effects of similar significance. Pennymac does not sell personal information.
We use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. These cookies collect information for analytics and to personalize your experience with targeted ads. If you opt out, we will not be able to offer you personalized ads and will not hand over your personal information to any third parties.
Marketing cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device.
If you do not allow these cookies, you will experience less targeted advertising.
You may opt out by clicking on the Manage Cookie Preferences button below, and selecting your preferences.
If you ever want to make changes to your opt-out preferences in the future, you can click on “Do Not Sell or Share My Personal Information” as found on PENNYMAC.COM. It will return you to this location where you may then click on the Manage Cookie Preferences button.
You may submit a request to opt out of the offline sale or sharing of your personal information, and the right to opt-out from Pennymac processing your personal information for the purposes of targeted advertising, or profiling by clicking on “Submit a Request” or by calling us toll-free at (866) 601-3518.
How Opt-Out Preference Signals are Processed
You may also submit a request to opt-out of the sharing of your online information through an opt-out preference signal. Pennymac automatically processes opt-out preference signals based on your browser.
RETENTION CRITERIA
The length of time we intend to retain your personal information depends on (I) applicable legal and regulatory requirements (ii) whether we need to retain the information for a business purpose(s) and/or (iii) whether you exercised your right, subject to certain exceptions, to request deletion of your information.
HOW TO CONTACT PENNYMAC
If you have any questions or concerns about our privacy policies and practices, you may contact Pennymac using the information below.
PennyMac Loan Services, LLCAttention: Corporate Privacy
PO Box 788
Moorpark, CA 93020-9903
Phone: (866) 601-3518
Email: PennyMacPrivacyOffice@pennymac.com
A link to Pennymac’s consumer privacy policies may be found at pennymac.com/privacy
This privacy policy was last updated on July 30, 2025, and is subject to change.
Rev. 07/2025