California Privacy Rights
Your rights under the CCPA and CPRA, what we hold, what we never sell, and a form that actually submits a request.
This notice is given under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”), Cal. Civ. Code §§1798.100 et seq. It supplements our Privacy Policy and describes the rights of California residents specifically — and how to actually use them, on this page, in about a minute.
1. Does this apply to you?
If you are a natural person who resides in California, yes — including if you are temporarily outside the state. Genesis Home Loans is a “business” and you are a “consumer” within the meaning of the CCPA.
Personal information collected in the course of a mortgage transaction is also subject to the Gramm-Leach-Bliley Act, and information from a consumer report is subject to the Fair Credit Reporting Act. Where the CCPA exempts that information, we still apply the standards below to it voluntarily, because drawing a line through your file and telling you which half you have rights over is not a service.
2. Categories of personal information we collect
In the twelve months before the effective date of this notice, we collected the following categories. This mirrors §2 of our Privacy Policy exactly.
| CCPA category | Collected | Examples in a mortgage file |
|---|---|---|
| A — Identifiers | Yes | Name, address, email, phone, mobile number, IP address |
| B — Customer records (§1798.80) | Yes | Signature, employment, income, bank and account numbers |
| C — Protected classifications | Yes | Age, race, ethnicity, sex, marital status — only where HMDA or a lender requires the record. Never used in a decision. |
| D — Commercial information | Yes | Loan programmes considered; calculator inputs |
| E — Biometric information | No | — |
| F — Internet or network activity | Yes | Pages viewed, referring URL, ad click |
| G — Geolocation | Approximate only | City or county inferred from IP or typed by you. No precise geolocation. |
| H — Audio, electronic, visual | Limited | Voicemail; a call recorded only with your knowledge |
| I — Professional / employment | Yes | Employer, title, income, self-employment |
| J — Education (FERPA) | No | — |
| K — Inferences | Limited | Which loan programmes likely fit. No advertising profiles. |
| L — Sensitive personal information | Yes — see §3 | SSN or ITIN, government ID, financial account numbers |
3. Sensitive personal information
We collect three kinds of sensitive personal information, and only three: your Social Security number or ITIN, your government-issued identification, and your financial account numbers. A lender cannot underwrite a mortgage without them.
The CCPA gives you the right to direct a business to limit its use of sensitive personal information to what is necessary to perform the service you asked for.
We already do only that. We do not use or disclose sensitive personal information to infer characteristics about you. We do not use it for advertising, profiling, or any secondary purpose. We do not sell or share it. Under §1798.121, a business that uses sensitive personal information solely for the permitted purposes is not required to offer a “Limit” link — and we do not offer one, because there is genuinely nothing behind it.
If you want that confirmed in writing for your own records, ask. We will send it the same day.
4. Categories of sources
- You — directly, through forms, calls, texts, email and documents.
- Your devices — automatically, through ordinary web technologies.
- Consumer reporting agencies — once you authorise a credit pull.
- Third parties you direct us to — employers, banks, accountants, agents, appraisers, title and escrow.
- Advertising platforms — aggregate click data only.
- Public records — county recorder and property data.
5. Business and commercial purposes
We use personal information for the business purposes enumerated at Cal. Civ. Code §1798.140(e): performing the service you requested (arranging a mortgage); security and fraud prevention; debugging; internal research; quality assurance; and complying with law. We use it for no commercial purpose beyond offering you our own services.
6. What we disclosed for a business purpose in the last 12 months
| Category disclosed | To whom | Why |
|---|---|---|
| A, B, C, D, I, L | Wholesale lenders and investors | To underwrite the loan you asked us to arrange — after you told us to submit |
| A, L | Consumer reporting agencies | To pull a credit report you authorised |
| A, B, I | Verification services | Employment, income, asset and identity verification |
| A, D | Appraisers, title, escrow, notaries | To close the transaction |
| A, B, D, F, I | Service providers and contractors | To operate the business — all bound by written contracts limiting use to our instructions |
| Any | Regulators, law enforcement, our lawyers | Where required by law or to establish or defend a claim |
7. Sale and sharing
In the twelve months before the effective date of this notice, Genesis Home Loans sold no personal information and shared no personal information for cross-context behavioural advertising — including no personal information of consumers we know to be under 16 years of age.
We do not sell to lead aggregators, lead buyers, affiliate networks, or data brokers. We never sell or share your mobile number or your SMS consent, to anyone, for any consideration.
You still have the right to opt out, and we still give you the mechanism. See Do Not Sell or Share My Personal Information, which also reads your Global Privacy Control signal live.
8. Retention
We keep each category only as long as necessary for the purpose we collected it, or as long as the law requires — whichever is longer. The schedule in §10 of our Privacy Policy sets out every period: 4 years minimum for a funded file (California DRE), 25 months for a declined application (Regulation B), at least 5 years for SMS consent records (TCPA), 24 months for an enquiry that went nowhere. Then we delete.
9. Your rights
- Right to know
- What we collected, the sources, the purposes, the categories of recipients, and the specific pieces of personal information we hold about you — for the 12-month period, or beyond it if you ask and it is not impossible for us to produce.
- Right to delete
- Delete the personal information we collected from you, subject to the exceptions in §1798.105(d) — chiefly, information we are legally required to retain, such as a funded loan file.
- Right to correct
- Correct inaccurate personal information we hold about you.
- Right to opt out of sale or sharing
- Direct us not to sell or share your personal information. We do not do either, but the mechanism is on our Do Not Sell or Share page, and we honour Global Privacy Control automatically.
- Right to limit use of sensitive personal information
- See §3. We already limit it to the permitted purposes.
- Right to data portability
- Receive the information you gave us in a readily usable, machine-readable format.
- Right to non-discrimination
- We will not deny you a service, charge you a different price, give you a lower quality of service, or treat you differently because you exercised any of these rights. See §14.
- Right to no dark patterns
- Our consent flows use plain language, symmetrical choices, and no pre-checked boxes designed to trick you. Opting out is exactly as easy as opting in — by design, and because §1798.185(a)(20) requires it.
You may make a request to know or delete twice in a 12-month period, free of charge.
10. Make a request — right here
The CCPA requires us to give you at least two designated methods. Here are four. The form below is the interactive webform required by 11 CCR §7020.
We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 with notice to you (Cal. Civ. Code §1798.130). Submitting this form logs your request with a reference number so you and we both have a record of exactly what you asked for and when.
Or use any of these:
- Email — deanda.adriana@gmail.com with “CCPA Request” in the subject line
- Phone — (408) 569-9288. A person answers. She is the broker.
- Mail — 1313 N Milpitas Blvd, Ste 235, Milpitas, CA 95035
- In person — walk into the office during business hours
11. How we verify you
We have to be sure it is you before we hand over or delete a mortgage file. We verify to a reasonable degree of certainty for a request to know categories, and to a reasonably high degree of certainty for a request to know specific pieces, to delete, or to correct — as 11 CCR §§7060–7062 require.
- We will ask you to match two to three data points we already hold — for example the property address on your file and the month you applied.
- We will never ask you for your Social Security number, a password, or a security-question answer in order to verify a privacy request. If someone claiming to be us asks for that, it is not us.
- We use the information you give us to verify only for that purpose, and we delete it afterwards.
- If we cannot verify you, we will tell you why, and we will treat a request to delete as a request to opt out instead — so you still get something.
12. Authorised agents
You may use an authorised agent. We will ask for written permission signed by you, and we will still verify your identity directly unless the agent holds a valid power of attorney under Cal. Prob. Code §§4000–4465, in which case we will not.
13. Global Privacy Control
We honour the Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as a valid opt-out of any sale or sharing, applied automatically, with no account and no form. You can see whether we are receiving your signal, live, on our Do Not Sell or Share page. It reads the actual header your browser sent us.
14. We will not retaliate
Exercising a privacy right will not get you a worse rate, a slower file, a lower level of service, or a denial. It will not be recorded anywhere that touches your loan. We offer no financial incentive for your data and we run no loyalty programme, so there is no “different price” for you to be offered in the first place.
15. Minors
We do not knowingly collect personal information from consumers under 16, and we do not sell or share the personal information of consumers under 16 under any circumstances — with or without opt-in. A California resident under 18 may request removal of content they posted (Cal. Bus. & Prof. Code §22581); this site hosts no user-posted content.
16. Shine the Light
Cal. Civ. Code §1798.83 lets California residents ask a business, once a year and free of charge, for a list of the personal information it disclosed to third parties for those parties’ own direct marketing during the preceding calendar year. Our answer is: we disclosed none. We do not share personal information for third-party direct marketing. Ask us in writing and we will confirm it in writing.
17. Request metrics
Businesses that handle the personal information of 10 million or more Californians must publish annual request metrics under 11 CCR §7102. Genesis Home Loans is far below that threshold and is not required to. We publish this anyway, because a privacy notice that never reports on itself is a brochure.
| Metric | Period ending July 13, 2026 |
|---|---|
| Requests to know received | See annual disclosure — published each January |
| Requests to delete received | See annual disclosure |
| Requests to correct received | See annual disclosure |
| Requests to opt out received | See annual disclosure |
| Median days to respond | We target under 14; the statutory limit is 45 |
18. Contact and escalation
- Email — deanda.adriana@gmail.com · Phone — (408) 569-9288
- Mail — 1313 N Milpitas Blvd, Ste 235, Milpitas, CA 95035
- If you are unhappy with our answer, you may complain to the California Privacy Protection Agency at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy. We will not obstruct you.
This notice is available in an alternative format on request, at no charge, for anyone who needs one — as §1798.130(a)(6) requires. Call and ask.