AFS/IBEX

Afs Ibex logo
Insurance Premium Financing Excellence since 1986


California Privacy Statement


This California Privacy Statement is for California Residents only. This policy describes the personal information that MetaBank®, National Association, and its divisions, including, without limitation, AFS/IBEX (“we,” “our,” or “us”) collects in the course of its business, explains how this information is collected, used, shared, and disclosed, describes rights provided by the California Consumer Privacy Act of 2018 (CCPA) to California Residents (“consumers” or “you”) regarding their personal information, and explains how consumers can exercise those rights.


What is Personal Information?


We may collect, use, or share your personal information. We do not and will not sell personal information. Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“personal information”). “Personal information” does not include: (1) publicly available information, such as information that is lawfully made available from federal, state, or local records, and (2) de-identified or aggregate consumer information.


With a limited exception, and as noted in other sections of this privacy policy, certain provisions of the CCPA do not apply to:


  • Certain personal information covered by or collected under industry-specific privacy laws including, but not limited to, the Health Insurance Portability and Accountability Act of 1996, the California Confidentiality of Medical Information Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the California Financial Information Privacy Act, and the Driver's Privacy Protection Act of 1994.

  • Personal information that we collect about you when you are acting as our job applicant, employee, owner, director, officer, medical staff member, or contractor to the extent that we collect and use your personal information solely within the context of that role. This also includes your emergency contact information and personal information that is necessary for us to retain to administer benefits for you. However, you will still receive a notice at the time of collection, which outlines the categories of personal information we collect and the purposes for which we collect the categories of personal information.

  • Personal information we receive from you reflecting a communication or transaction between us and another business when you are acting as an employee, owner, director, officer, or contractor of such company, partnership, sole proprietorship, nonprofit, or government agency and you are seeking a product or service from us for the company, partnership, sole proprietorship, nonprofit, or government agency (Business Consumer). We have outlined the limited rights afforded to Business Consumers below.


Your Rights under the CCPA


As described in more detail below, the CCPA provides you with certain rights regarding the collection, use, retention, and disclosure of your personal information.


The Right to Know About Personal Information Collected, Used, or Disclosed


You have the right to request that we provide you with certain information about the personal information we collect, use, or disclose about you as well as the categories and specific pieces of information that we have collected about you in the 12 months before your submission of a verifiable consumer request. Specifically, you have the right to request the following information:


  • The categories of personal information we have collected about you.

  • The categories of sources from which we have collected personal information about you.

  • Our business or commercial purpose for collecting your personal information.

  • Our business or commercial purpose for disclosing the category of personal information about you.

  • The specific pieces of personal information we have about you.

  • If we disclosed your personal information for a business or commercial purpose:

    • The categories of personal information that we disclosed about you for a business or commercial purpose; and

    • The categories of third parties to whom your personal information was disclosed for a business or commercial purpose, and which category of personal information was disclosed to that category of third party.


A household may request to know aggregate household personal information by submitting a verifiable consumer request. Also, if all consumers in a household jointly request access to specific pieces of information for the household, and we can individually verify all the members of the household, then we will comply with the request.


However, there is certain information that we will not disclose to you. This information includes but is not limited to your Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answer. Also, we will not provide you with specific pieces of personal information if the disclosure creates a substantial, articulable, and unreasonable risk to the security of that personal information, your account with us, or the security of our systems or networks.


This right does not apply to Business Consumers.


Personal Information We Collect, Use, or Share


The CCPA requires us to disclose certain information regarding our collection, use, and sharing of personal information. The following table outlines the categories of personal information that we have collected about consumers in the last 12 months. For each category, if applicable, we have identified the categories of sources from which that information was collected, the business or commercial purpose(s) for which the information was collected, and the categories of third parties with whom we share personal information.


Categories of Personal Information

Have We Collected This Personal Information in the Last 12 Months?

The Categories of Sources From Which the Personal Information is Collected

The Business or Commercial Purpose(s) for Which the Information is Collected, Used, and/or Shared

The Categories of Third Parties With Whom we Share Personal Information

Identifiers. This may include a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.

Yes

Web visitor inquiries, Cloud based third party loan management system (PBS).

To provide premium financing for commercial clients.

N/A

Personal information described in the California Customer Records Statute (Cal. Civ. Code § 1798.80(e)). This may include a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

Yes

Web visitor inquiries, Cloud based third party loan management system (PBS).

To provide premium financing for commercial clients.

N/A

Characteristics of Protected Classification under California or Federal Law. This may include age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth, and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

No

N/A

N/A

N/A

Commercial information. This may include records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

No

N/A

N/A

N/A

Biometric information. This may include genetic, physiological, biological, or behavioral characteristics that can be used, singly or in combination with each other or with other identifying data, to establish your identity, including deoxyribonucleic acid (DNA), fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

No

N/A

N/A

N/A

Internet or other similar network activity. This may include browsing history, search history, or information on a consumer's interaction with a website, application, or advertisement.

No

N/A

N/A

N/A

Geolocation data. This may include physical location or movements.

No

N/A

N/A

N/A

Sensory data. This may include audio, electronic, visual, thermal, olfactory, or similar information.

No

N/A

N/A

N/A

Professional or employment-related information. This may include current or past job history or performance evaluations.

No

N/A

N/A

N/A

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)). This may include education records directly related to a student maintained by an educational institution or party acting on its behalf, such as report cards, transcripts, class lists, student schedules, student identification codes, student financial information, and student disciplinary records.

No

N/A

N/A

N/A

Inferences drawn from other personal information. This may include information, data, assumptions, or conclusions derived from facts, evidence, or another source of information or data reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

No

N/A

N/A

N/A




Disclosing Your Personal Information for a Business or Commercial Purpose


In the preceding twelve (12) months, we have not disclosed personal information for a business purpose.


Selling Your Personal Information for a Business or Commercial Purpose


We have not sold consumer personal information to third parties for a business or commercial purpose in the preceding 12 months. We do not and will not sell your personal information. In addition, we do not sell the personal information of minors under 16 years of age.



Submitting a Verifiable Request to Know About Personal Information Collected or Disclosed


To exercise your Right to Know, please submit a verifiable consumer request to us by either:

  • Calling us at 833-898-0023

  • Emailing us at privacy@metabank.com

To submit a verifiable consumer request, you will be asked to:

  • Provide us with your account number and name, or other identifying information, for us to verify with information in our system.


Only you (or an authorized agent) may make a verifiable consumer request for your personal information. [You may also make a verifiable consumer request on behalf of your minor child.]


Please note that we are only required to respond to your request for access to your personal information twice within a 12-month period.



How We Verify Your Request to Know About Personal Information Collected, Used, or Disclosed


  • Password-Protected Accounts:If you have a password-protected account with us, we may verify your identity through our existing authentication practices for your account. We will also require you to re-authenticate yourself before we disclose your personal information. If we suspect fraudulent or malicious activity on or from your account, we will not comply with your request until we perform further verification to determine whether your request is authentic and you are the person about whom we have collected the personal information.

  • Non-Account Holders:If you do not hold a password-protected account with us, we will verify you as follows:

    • If you submit a request to know the categories of personal information,you will need to provide us with your account number and name, or other identifying information, which we will match with information in our system to verify your identity.

    • If you submit a request to know specific pieces of personal information,you will need to provide us with your account number, name, and date of birth, or other identifying information, which we will match with information in our system to verify your identity. You will also be required to submit a signed declaration under penalty of perjury stating that the requestor is the consumer whose personal information is the subject of the request.


We will generally avoid requesting additional information from you to verify you. However, if we cannot verify your identity based on the information we currently maintain, we may request additional information from you, which will only be used to verify your identity and for security or fraud-prevention purposes. We will delete any new personal information we collect to verify your identity as soon as practical after processing your request unless otherwise required by the CCPA.


Generally, if we are unable to verify your identity, we will inform you of this inability and explain why we were unable to do so.



Our Response to Your Request to Know About Personal Information Collected or Disclosed


Once we receive your verifiable consumer request, our goal is to respond to your request within 45 days of receiving the request, beginning on the day we receive the request. However, in the event that we need more time (up to 90 days) to respond to your request, we will provide you with notice and an explanation of the reasons that we will take more than 45 days to respond. Any disclosures we provide will cover the 12-month period preceding the verifiable consumer request’s receipt. If we are unable to comply with a given request, we will provide you with a response explaining why we have not taken action on your request and identifying any rights you may have to appeal the decision.


We will not charge you to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.



The Right to Request Deletion of Personal Information


You have the right to request that we delete any personal information that we have collected from you and maintained about you. Once we receive and confirm your verifiable consumer request, if we determine that we must comply with a deletion request and delete your personal information from our records, we will also direct any service providers we work with to also delete your personal information from their records.


A household may request the deletion of aggregate household personal information by submitting a verifiable consumer request. If all consumers in a household jointly request deletion of household personal information, and we can individually verify all the members of the household, then we will comply with the request.


Please note that we may deny your deletion request for a number of different reasons, which are identified in the CCPA. 


This right does not apply to Business Consumers.



Submitting a Verifiable Request to Delete Personal Information


To exercise your Right to Request Deletion, please submit a verifiable consumer request to us by either:

  • Calling us at 833-898-0023

  • Emailing us at privacy@metabank.com


To submit a verifiable consumer request, you will be asked to:


  • Provide us with your account number and name, or other identifying information, for us to verify with information in our system.


Only you (or an authorized agent) may make a verifiable consumer request for your personal information. [You may also make a verifiable consumer request on behalf of your minor child.]



How We Verify Your Request to Delete Personal Information


  • Password-Protected Accounts: If you have a password-protected account with us, we may verify your identity through our existing authentication practices for your account. We will also require you to re-authenticate yourself before we delete your personal information. If we suspect fraudulent or malicious activity on or from your account, we will not comply with your request until we perform further verification to determine whether your request is authentic and you are the person about whom we have collected the personal information.

  • Non-Account Holders: If you do not hold a password-protected account with us, we will request you to provide us with your account number, name, and date of birth, or other identifying information, which we will match with information in our system to verify your identity. You will also be required to submit a signed declaration under penalty of perjury stating that the requestor is the consumer whose personal information is the subject of the request.


We will generally avoid requesting additional information from you to verify you. However, if we cannot verify your identity based on the information we currently maintain, we may request additional information from you, which will only be used to verify your identity and for security or fraud-prevention purposes. We will delete any new personal information we collect to verify your identity as soon as practical after processing your request unless otherwise required by the CCPA.


If we are unable to verify your identity, we will inform you that your identity cannot be verified and provide you with specific directions on how you may verify your identity.



Our Response to Your Request to Delete Personal Information


Once we receive your verifiable consumer request, our goal is to respond to your request within 45 days of receiving the request, beginning on the day we receive the request. However, in the event that we need more time (up to 90 days) to respond to your request, we will provide you with notice and an explanation of the reasons that we will take an additional 45 days to respond.


We will not charge you to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.



Authorized Agent for Requests


You may designate an authorized agent to make a request on your behalf. If you would like to use an authorized agent, which is an individual or business registered with the Secretary of State that you have authorized to act on your behalf, to submit a request to opt-out, you must provide the authorized agent with written permission to do so and verify your own identity directly with us. We may deny a request from an agent that does not submit proof that they are authorized to act on your behalf.


Non-Discrimination


We will not discriminate against you for exercising any of your CCPA rights. For example, unless otherwise permitted by the CCPA, we will not:

  • Deny you goods or services.

  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

  • Provide you with a different level or quality of goods or services.

  • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.


Changes to Our California Privacy Statement


We are required by law to update this California Privacy Statement at least once each year. This California Privacy Statement was last updated on April 1, 2020.


Contact Information


If you have any questions regarding our privacy policies, our California Privacy Statement, the ways in which we collect, use, and disclose your personal information, or how to exercise your rights under the CCPA, please do not hesitate to contact us at:


Phone: 833-898-0023
Email: privacy@metabank.com