For California Residents Only 

The California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (collectively "CPRA") provides consumers residing in California ("California Consumers", "you", or "your") with specific rights regarding their personal information. This Notice supplements the Mutual of Omaha Online Privacy Policy ("Policy") and applies solely to California Consumers.

This Notice also explains your rights regarding your personal information and how you can exercise those rights. This Notice describes the practices of Mutual of Omaha Insurance Company and its subsidiaries and affiliates ("Mutual", "we", "us" or "our") that link to the Policy regarding the collection, use, disclosure, sale, sharing, and retention of personal information we will collect from you and have collected from California Consumers in the past 12 months.

At Mutual, we strive to help consumers achieve their financial goals by providing an array of insurance and financial products. In doing so, we collect, use, and disclose personal information of a variety of California Consumers. We do not collect, sell, share, or disclose the personal information of any covered California Consumers under the age of 16. In this Notice, personal information has the meaning described below and excludes certain information subject to other laws.

Personal information is defined for purposes of this Notice and the CPRA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you as an individual or your household. Personal information includes, for example, information collected directly from you if you use certain services available on our sites or personal information that you voluntarily provide, such as information you provide in response to a questionnaire or survey, if you apply for a job on our Careers sites, or to do business with us.

We may also collect or receive personal information about you through or from our business partners; service providers; marketing partners; and other third parties that perform services for us or for you, or to market our products and services to you. Please see the "Consumers Whose Personal Information We Collect, Use, and Disclose" section of this Notice to learn more about how we may collect your personal information.

Sensitive personal information is defined for purposes of this Notice and the CPRA as a subset of personal information that reveals certain financial, health, geolocation, racial, ethnic, biometric, and sexual orientation information about a California Consumer. If a business collects this type of information but uses or discloses it to provide you goods and services you requested or for certain business purposes described in the CPRA, this information is considered personal information, not sensitive personal information.

Under the CPRA and the unique consumer rights described below, personal information does not include:

• Publicly available information, such as information from government records, information we reasonably believe you made available to the general public, or unrestricted information you have disclosed or made available;
• De-identified or aggregated consumer information we maintain in deidentified form and do not attempt to reidentify except as required or permitted by law;
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act ("FRCA"), the Gramm-Leach-Bliley Act ("GLBA") or California Financial Information Privacy Act ("FIPA"), and the Driver's Privacy Protection Act of 1994.

We separately provide notices required under other state and federal laws, such as GLBA and HIPAA in connection with products and services subject to those laws. Those notices can be found by clicking here.

We may collect, use, and/or disclose, and in the preceding 12 months we have collected, used, and/or disclosed, the following types of personal information and sensitive personal information:

Identifiers

This may include real name, alias, postal address, unique personal identifier, cookies and pseudonymous identification number, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, tax identification number, user identification number, or other similar identifiers.

Personal information described in the California Customer Records Statute (Cal. Civ. Code § 1798.80(e))

This may include name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number and information, credit card number, debit card number, income, tax, ACH, or any other financial information, health history, tests, and other medical information, policy and other health insurance information, health expense preferences, or date of birth.

Characteristics of protected classifications under California or Federal Law

This may include age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth, and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Commercial information

This may include records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Biometric information

This may include genetic, physiological, biological, or behavioral characteristics that can be used, singly or in combination with each other or with other identifying data, to establish your identity, including deoxyribonucleic acid (DNA), fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Internet or other similar network activity

This may include browsing history, search history, or information on a consumer's interaction with a website, application, or advertisement.

Geolocation data

This may include physical location or movements.

Audio, electronic, or similar information

This may include audio, electronic, or similar information, such as call recordings and the content of advisor emails where Mutual is not the intended recipient.

Professional or employment-related information

This may include current or past job history or performance evaluations, such as licenses, certifications, producer numbers, and prior work history.

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99))

This may include education records directly related to a student maintained by an educational institution or party acting on its behalf, such as report cards, transcripts, class lists, student schedules, student identification codes, student financial information, and student disciplinary records.

Inferences drawn from other personal information

This may include information, data, assumptions, or conclusions derived from facts, evidence, or another source of information or data reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes, such as your advisor profile or products or website experiences you might be interested in.

Sensitive personal information

Precise geolocation

We may collect, use, and/or disclose, and in the preceding 12 months we have collected, used, and/or disclosed, personal information for the following business purposes:

A purpose you direct. You direct us to collect, use, and/or disclose your personal information.

Marketing to you. For example, this may include determining what products and services you may be interested in; marketing products and services to you; providing insurance product quote information; and screening for insurance product eligibility and suitability.

Enhancing your experience with us on our website. For example, this may include identifying website visits, ad interaction, and search history; recommending insurance products based on preferences; delivering jurisdiction-specific website content; tailoring your experience on our website; and drawing inferences from your personal information to tailor your experience on our website and identify the products you might be interested in.

Marketing enhancement. For example, this may include conducting data analytics; reporting lead conversions; optimizing online searching, and identifying consumer product interest.

Recruit and hire for employment. For example, this may include recruiting, identifying, evaluating, and communicating with you as a prospective recruit or applicant; conducting and monitoring recruiting efforts; conducting background checks; making hiring decision; supporting diversity and inclusion initiatives; pre-employment testing; determining benefit eligibility; and monitoring and managing your access to facilities and systems.

Manage our business relationship with you. For example, this may include communicating with you and others; conducting background checks; conducting appointment, licensing, due diligence, contracting, and other onboarding activities; paying and reporting commissions; administering contracts; processing and administering your workers' compensation and other insurance claims; and determining benefit eligibility.

Support your business operations. For example, this may include providing product marketing and sales support; administering and processing product applications and policies; collecting financial information such as income, bank account number, and encrypted credit card number; providing customer service support; and supporting other business processes concerning or affected by our business relationship with you.

Vendor management. For example, this may include administering requests for information/proposals (RFI/RFP); conducting due diligence; monitoring contract compliance and performance; communicating about projects, systems, problems, and other matters relevant to the vendor relationship; and issuing payments and tax statements to you.

Legal and regulatory compliance. For example, this may include complying with applicable laws, regulations, and oversight obligations; for quality assurance; for internal and external audits and investigations; engaging with law enforcement and other governmental bodies; for litigation; for compliance with Mutual policies and procedures, contracts, and oversight obligations; and enforcing contractual obligations and exercising contractual rights.

Merger, Acquisition, and/or Bankruptcy. For example, this may include as part of a merger, acquisition, bankruptcy, or other transaction where a third party assumes control of us.

Our internal purposes. For example, this may include conducting, managing, maintaining, and improving our products and services; business operations and processes; security and privacy practices, which may include, but not be limited to detecting, investigating, and resolving potential vulnerabilities, data security, or privacy incidents; quality assurance; business continuity; systems, networks, applications, and databases, which may include, but not be limited to preventing, finding, and resolving software, hardware, or application bugs and issues.

We may collect your personal information from and/or disclose your information to, and in the preceding 12 months we have collected from or disclosed your personal information to, one or more of the following parties:

You

Data providers. This may include relationship management providers; data/lead aggregators; web, call tracking, marketing, and other data analytics providers, market researchers, credit reporting agencies, consumer insight platform organizations, and similar vendors.

Digital marketing providers. This may include social media and other online advertising/marketing providers, brand managers, marketing brokers, digital advertising publishers, and similar vendors.

Marketing providers. This may include our call centers, multi-channel marketers, advertising publishers, marketing print and distribution providers, and similar vendors.

Advisors. This may include our sales agents, brokers, producers, marketers, and other similar business partners.

Human resources vendors. This may include background check companies, recruitment agencies, insurance and other benefits providers, travel companies, and similar vendors.

Employees, job applicants, and/or independent contractors

Mutual service providers. This may include customer policy vendors, wealth management vendors, and other companies who are assisting us in fulfilling our contracts and carrying out our business.

Technology providers This may include communication compliance providers, security vendors, electronic document management vendors, and similar entities.

Government entities. This may include regulatory agencies, law enforcement entities, and similar parties.

We collect personal information from various types of California Consumers, including persons who may receive information about products or services (“Leads/Prospects”); prospective recruits or job applicants; agents, producers, brokers, marketers, and other similar business partners; and representatives of other businesses we work with. The type of personal information we may collect, the sources of that personal information, our purposes for collecting, using, and disclosing that personal information, and other factors vary depending on the type of California Consumer you are.

Why we collect your personal information

We may collect and/or use your personal information for various business purposes, such as for a purpose you direct; marketing to you; enhancing your experience with us on our website; marketing enhancement; for our own internal purposes; and for legal and regulatory compliance. We may also collect or use personal information for one or more business purposes described in the Policy.

What personal information we collect

To accomplish these business purposes, and depending on the nature of our specific relationship with you, we may collect identifiers; personal information described in the California Customer Records Statute; characteristics of protected classifications under California or federal law; commercial information; internet or other similar network activity; geolocation data; inferences drawn from other personal information; audio, electronic, or similar information; and professional or employment-related information.

Sensitive personal information – what we collect and why

We may collect and/or use your sensitive personal information to market products and services to you. To accomplish this purpose, we may collect precise geolocation.

How we collect your personal information

We may collect this personal information from you if you use certain services available on our sites or voluntarily provide it to us; data providers; marketing providers; digital marketing providers; and other service providers, contractors and/or third parties.

Personal information we sell

Mutual does not sell your personal information for money – no one can buy the personal information we or those acting on our behalf collect from and about you and we do not act as a data broker. However, we may use and disclose your personal information and sensitive personal information to determine what products and services you may be interested in and market those to you, report lead conversions, and assess marketing effectiveness. Even though they involve no exchange of money, these disclosures may constitute selling for purposes of the CPRA. We may make these disclosures of certain personal information and sensitive personal information as permitted by law to digital marketing companies, analytics platform providers, and marketing brokers. Personal information and sensitive personal information we provide these third parties may include name, email address, IP address, online identifiers, physical address, and precise geolocation.

Personal information we share

For purposes of the CPRA, we may share certain personal information and sensitive personal information as permitted by law to third parties for purposes of targeted marketing. Personal information we may share includes name, email address, IP address, online identifiers, physical address, and precise geolocation. We share this information with digital marketing companies, analytics platform providers, marketing brokers, and digital advertising publishers.

Click here to learn about and exercise your right to opt-out of selling and sharing of your personal information.

Personal information we disclose for a business purpose

• We disclose certain personal information for various business purposes, such as marketing to you; enhancing your experience with us on our website; marketing enhancement; for our own internal purposes; and for legal and regulatory compliance. We may also disclose personal information we collect for one or more business purposes described in the Policy.
• Personal information we disclose for these business purposes includes identifiers; personal information described in the California Customer Records Statute; characteristics of protected classifications under California or federal law; commercial Information; internet or other similar network activity; geolocation data; professional or employment-related information; non-public education information; and Inferences drawn from other personal information
• We disclose this information to advisors, data providers, marketing providers, and other service providers, contractors and/or third parties. Should we undergo a merger, acquisition, or bankruptcy, we may disclose all personal information we collect about you to the involved entities.

Why we collect your personal information

We may collect and/or use your personal information to recruit, hire, and manage employment, or for a purpose you direct. We may also collect personal information in the event of a merger, acquisition, or bankruptcy or for one or more business purposes described in the Policy.

What personal information we collect

To accomplish these business purposes, we may collect identifiers; personal information described in the California Customer Records Statute; characteristics of protected classifications under California or federal law; and non-public education information.

How we collect your personal information

This information is collected from you, human resources vendors, and other service providers, contractors and/or third parties.

What personal information we disclose

• We may disclose the personal information described above to service providers, contractors, or third parties who provide services to accomplish the business purposes identified above. Should we undergo a merger, acquisition, or bankruptcy, we may disclose all personal information we collect about you to the involved entities.
• We do not sell personal information of job applicants, and we do not share job applicant personal information for the purposes of targeted marketing.

Why we collect your personal information

We may collect and/or use your personal information for various business purposes, such as for a purpose you direct; to manage our business relationship with you; support your business operations; for our internal purposes; and for legal and regulatory compliance. We may also collect or use personal information in the event of a merger, acquisition, or bankruptcy or for one or more business purposes described in the Policy.

What personal information we collect

To accomplish these business purposes, and depending on the nature of our specific relationship with you, we may collect identifiers; personal information described in the California Customer Records Statute; characteristics of protected classification under California or federal law; commercial information; professional or employment-related information; non-public education information; geolocation data; biometric information; internet or other similar network activity; audio, electronic, or similar information; and inferences drawn from other personal information.

How we collect your personal information

We may collect this personal information from you, our employees and/or contractors, other agents/producers/brokers/marketers/registered representatives, Managing General Agents, Brokerage General Agencies, advisors, marketing providers, human resource vendors, technology providers, data providers, and other service providers, contractors and/or third parties.

What personal information we disclose

• We disclose certain personal information for various business purposes, such as for a purpose you direct; to manage our business relationship with you; to support your business operations; and for legal and regulatory compliance. We may also disclose personal information we collect in the event of a merger, acquisition, or bankruptcy or for one or more business purposes described in the Policy.
• Personal information we disclose for these business purposes includes identifiers; personal information described in the California Customer Records Statute; commercial information; professional or employment-related information; non-public education information; geolocation data; and biometric information. Should we undergo a merger, acquisition, or bankruptcy, we may disclose all personal information we collect about you to the involved entities.
• We disclose this information to advisors; your service providers, contractors, or third parties; government entities; service providers; technology providers; human resources vendors; data providers; employees and independent contractors; and other contractors and/or third parties.
• We do not sell your personal information, and we do not share your personal information for the purpose of targeted marketing.

Why we collect your personal information

We may collect and/or use your personal information for various business purposes, such as for a purpose you direct; for vendor management; to manage our business relationship with you or your company; to support your or your company's business operations; for our internal purposes; and for legal and regulatory compliance. We may also collect or use personal information in the event of a merger, acquisition, or bankruptcy or for one or more business purposes described in the Policy.

What personal information we collect

To accomplish these business purposes and depending on the nature of our specific relationship with you, we may collect identifiers; personal information described in the California Customer Records Statute; professional or employment-related information; commercial information; characteristics of protected classifications under California or federal law; and audio, electronic, or similar information.

How we collect your personal information

We may collect this personal information from you; other representatives of the company you work for, or your company’s business partners; data providers; government entities; and other service providers, contractors and/or third parties.

What personal information we disclose

• We may disclose certain personal information for business purposes, such as for a purpose you direct, to support your business operations, and for legal and regulatory compliance. We may also disclose personal information we collect in the event of a merger, acquisition, or bankruptcy or for one or more business purposes described in the Policy.
• Personal information we disclose for these business purposes includes identifiers and personal information described in the California Customer Records Statute. Should we undergo a merger, acquisition, or bankruptcy, we may disclose all personal information we collect about you to the involved entities.
• We disclose this information to government entities; technology providers; data providers; and other service providers, contractors and/or third parties.
• We do not sell your personal information, and we do not share personal information for the purpose of targeted marketing.

We will retain your personal information and sensitive personal information that we collect and maintain subject to this Notice as long as is reasonably necessary to fulfill the purposes for which it was collected. In doing so, we will consider the type of products and services requested by or provided to you, the nature and length of our relationship with you or the business entity you are associated with, and mandatory retention periods under applicable law. We will also retain your information, including after your relationship with us ends, as long as necessary to enforce or comply with our legal or contractual rights and obligations, to resolve disputes and defend claims, and to reserve our legal rights.

Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

You may have the right to request that we disclose certain information to you about our collection and use of your personal information (and direct our service providers and contractors to do the same), including:

• The categories of personal information collected;
• The categories of sources of the personal information collected;
• Our purposes for collecting, sharing, or selling your personal information;
• The categories of personal information disclosed for a business purpose, if any, and the categories of persons to whom the personal information was disclosed;
• The specific pieces of personal information we collected about you;
• The categories of personal information we shared for targeted marketing purposes, if any, and the categories of third parties to whom the personal information was disclosed for that purpose; and
• The categories of personal information we sold, if any, and the categories of third parties to whom the personal information was sold.

You may have the right to request that we delete any of your personal information collected from you and retained by us (and direct our service providers, contractors, and third parties to do the same).

We may deny your deletion request if retaining the personal information is reasonably necessary for us (or our service provider(s), contractor(s), or third parties) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• Help ensure security and integrity of your personal information;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
• Debug products to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deleting the personal information may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Comply with a legal obligation; and
• Make other internal and lawful uses of the personal information that are compatible with the context in which you provided it.

Other legal limitations and exceptions may also apply.

You may have the right to request we correct inaccurate personal information that we maintain about you (and direct our service providers and contractors to do the same). Alternatively, we may delete the inaccurate personal information if doing so does not negatively impact you, or if you consent.

You may have the right to request we opt you out of selling and sharing your personal information (and direct our third parties and their business partners to do the same).

You may submit a request by clicking here and completing our California Consumer Rights Request form, by contacting us at the following toll-free number: 1-844-413-6884, or by enabling an opt-out preference signal in your device or browser.

An opt-out preference signal is a setting or extension in a browser or device that a web user sets to prevent the selling or sharing of personal information on sites the browser or device visits. You can use an opt-out signal by downloading a browser or browser extension and enabling the signal feature. To learn more, click here. We will process your signal as a request to opt information associated with your device, browser, and/or consumer profile out of selling and sharing with third parties.

We will consider only those requests submitted using these three options.

We disclose sensitive personal information for purposes other than those specified in section 7027(m) of the California Consumer Privacy Act Regulations. Consequently, you may have the right to request we limit our use or disclosure of your sensitive personal information to the following purposes (and direct our service providers, contractors, and third parties, and their business partners to do the same):

• To provide you with the services or goods you requested;
• To ensure security and integrity of your information;
• To prevent, detect, and investigate security incidents that affect your information;
• To avoid illegal actions against us and prosecute responsible parties;
• To ensure the physical safety of persons;
• To advertise to you during your visit to the websites linking to this Policy and other short-term uses, where your information is not disclosed to a third party or used to affect your web experience or build a consumer profile;
• To collect or process sensitive personal information for purposes other than inferring characteristics about you;
• To maintain/service accounts, provide customer service, process payments, provide analytics, complete transactions, and perform other services on behalf of Mutual; or
• To verify and maintain the quality or safety of, or to improve, a Mutual product or service.

Once we receive and process your request, we will stop using and disclosing your personal information for purposes other than those listed above (and direct our service providers, contractors, and third parties, and their business partners to do the same).

How to Submit A Request to Exercise Your Rights

To exercise any of the rights described above, you may submit a request either by clicking here and completing the linked California Consumer Rights Request form or by contacting us at the following toll-free number: 1-844-413-6884. Except requests to opt-out of selling and sharing, we will consider only those requests submitted using these two options. For a request to opt-out of selling and sharing, we will also recognize an opt-out preference signal enabled on your device or browser as described above in "Opt-Out Rights."

Exercising Your Rights to Know, Delete, and Correct

Only you or your authorized agent may make a verifiable consumer request to know, delete, or correct your personal information. If you use an authorized agent to submit a verified consumer request on your behalf, we will require you to provide additional information as described below. You may make a verifiable consumer request on behalf of your minor child.

• For verifiable consumer requests to know: Our response will cover the preceding 12 months, unless you request longer (with certain limitations). You may make a verifiable consumer request to know only twice within a 12-month period.

In order to verify your identity to process your request, we will request your full name, street address, city, zip code, phone number, and email address. For us to treat your request as a verifiable consumer request, you must:

• Provide sufficient information, commensurate to the type or sensitivity of the information you are requesting, that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we are unable to: (a) verify your identity or authority to make the request, (b) confirm the personal information we have in our systems relates to you, or (c) locate your information in our systems. If the information you provided us does not match our records, in certain circumstances we may request additional information from you.

In certain circumstances, an authorized agent may submit a rights request for you. An authorized agent is a natural person or business entity you have given permission to submit a request on your behalf. An authorized agent must submit a request using one of two designated methods described above. We must be able to verify the authorized agent has the authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney; or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement by you authorizing the authorized agent to submit a verifiable consumer request on your behalf. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

We endeavor to respond to a verifiable consumer request to know, to delete, or to correct within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We will not discriminate against you for exercising any of your rights under the CPRA.

The metrics below reflect, by type of request, the total number of CA consumer requests received, completed, and denied during the 2023 calendar year. The total requests received was 115. The total requests completed and denied may vary due to carryover at year-end.

• Request to Know - 19
• Complied: 9
• Denied*: 10
• Request to Delete - 32
• Complied: 18
• Denied*: 14
• Request to Opt-Out of Selling & Sharing - 45
• Complied: 32
• Denied*: 13
• Request to Limit - 19
• Complied: 0
• Denied*: 20
• Average Number of Days to Respond
• Request to Know: 34
• Request to Delete: 34
• Right to Correct: N/A
• Request to Opt-Out of Selling & Sharing: 9
• Request to Limit Use of Sensitive Data: N/A
  

*This includes, but is not limited to, requests that were denied because we were unable to verify the identity of the requestor.

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated Notice on the website and update the Notice's effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.

The effective date of the rights for California residents described in this Notice is January 1, 2023. Changes to the Policy will not affect our use of previously provided personal information.

If you have any questions about this Notice, the ways in which we may collect and use your personal information described in this Notice, and your choices and rights regarding such use, please feel free to contact us by:

• Sending an e-mail request to privacy.office@mutualofomaha.com
• Sending a letter via US Mail to: