Privacy Notice for Pennymac Office Visitors Who are California Residents

How to Submit Your Request If You are a Resident of California

To submit a request to know, access, delete, or correct your information, click on “Submit a Request” or call us toll-free at (866) 601-3518.

The California Consumer Privacy Act of 2018 (“CCPA”) provides California residents with privacy rights related to the personal information businesses collected about you and your household. The purpose of this privacy policy is to provide you with a description of our business practices regarding the collection, use, disclosure, and sale of your personal information and of your rights regarding your personal information.

IMPORTANT NOTE: Your personal information has not yet been collected. If you opt to continue with the check-in process, you acknowledge and consent to the collection of your personal information as described in this policy.

In the preceding 12 months, Pennymac may have collected the following categories of personal information about office visitors:

Categories of Sources From Which Personal Information is Collected

• Directly from you, when you provide us with your personal information. For example, when you complete the screening questions on the iPad at one of our California Pennymac locations.

Purpose For Collecting or Processing Personal Information

• Security purposes, so that we have a record of who visited a Pennymac facility.

Why We Might Disclose Your Personal Information to Entities

• Pennymac facility safety and monitoring

Sale or Sharing of Personal Information

Pennymac does not sell or share personal information. For the purposes of this policy, “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.

Pennymac has no knowledge that we sold or shared the personal information of consumers under 16 years of age.

Categories Of Entities With Whom We May Disclose Your Personal Information

• Suppliers who provide products or services to Pennymac.
• Outside counsel, when needed.
• Legal, regulatory, or other similar authorities and/or agencies, when required.

In the preceding 12 months, Pennymac may have disclosed to a Service Provider the following categories of personal information (see examples of each category above):

• Identifiers;
• Categories of personal information described in the California Customer Records Act (Cal. Civ. Code section 1798.80(e));
• Sensory data; and
• Inferences drawn from any personal information.

Sensitive Personal Information

Pennymac does not collect sensitive personal information from California residents strictly visiting a Pennymac office.

Right to Know/Access

As a California resident, you have the right to request that Pennymac disclose what specific/categorical of personal data we collected about you, the sources and purposes for that collection, and a list of the categories and specific entities your data was sold, shared, or disclosed to.

Right to Delete

As a California resident, you have the right to request the deletion of the personal information/data we collected about you. However, we may deny your request if there are any conflicts with our corporate record retention requirements, federal or state law, or if it falls under any other CCPA exception.

Right to Correct

As a California resident, you have the right to request that Pennymac correct inaccurate personal information/data Pennymac collected about you.

Right to Opt-Out of the Sale of Personal Information

As a California resident, you have the right to opt-out of the sharing or selling of your personal information. Pennymac does NOT sell or share personal information.

Right to Opt-Out of the Processing of Personal Information for Targeted Advertising or Profiling

As a California resident, you have the right to opt-out of the processing of your personal information for targeted advertising or profiling. Pennymac does NOT sell or share your personal information.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

Pennymac does not discriminate against you for exercising your CCPA privacy rights.

Right to Opt-In to the Sale or Sharing of Personal Information

As a California resident, you have the right to opt-in to the sale or sharing of your personal information. Pennymac does NOT sell or share your personal information.

Authorized Third Party

If you are an authorized third party (such as an attorney-in-fact) making a request on behalf of someone else, please contact us using one of the methods provided below.

Length of Time We Intend to Retain Each Category (or the criteria used to determine the period of time)

Pennymac will retain each of the above categories of Personal Information for up to 5 years from date of collection. However, the retention period may vary based upon the following:

• As required by a law
• As required for legal purposes (statutes of limitations, litigation, regulatory investigations or audits)
• The time period required to fulfill necessary use and processing.

How to Submit Your Request If You are a Resident of California

To submit a request to know, access, delete, or correct your information, access “PENNYMAC.COM/PRIVACY” or call us toll-free at (866) 601-3518.

Pennymac will verify your identity using the personal information you provide, which must include your name, address, and email address.

Contact Information:

If you have any questions or concerns about our privacy policies and practices, you may contact Pennymac using the information below.

A link to Pennymac’s consumer privacy policies may be found at pennymac.com/privacy

This privacy policy was last updated on December 31, 2025, and is subject to change.

Rev. 12/2025