AMERICAN FAMILY INSURANCE CALIFORNIA PRIVACY NOTICE

Effective Date: January 1, 2020

Last Modified On: October 26, 2020          

This California Privacy Notice supplements the American Family Insurance General Privacy Notice and applies solely to individuals who reside in California (“consumers”). We have adopted this policy to comply with the California Consumer Privacy Act of 2018 (“CCPA”).

Information We Collect

CCPA defines personal information as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Personal information does not include de-identified or aggregate consumer information. We will implement technical safeguards to prohibit re-identification of de-identified information about you.

We have collected some or all the below categories of personal information from consumers within the last twelve (12) months.

Please note that the examples are not an exhaustive list and personal information collected may fall into multiple categories. Categories and specific pieces of information collected will vary depending on the nature of your relationship with us.

We reserve the right to create or allow others to create aggregate consumer information data sets by ensuring that individual consumer identities have been removed and are not linked or reasonably linkable to any consumer or household, including via a device. The CCPA does not require that we re-identify such information in response to a consumer request.

We collect personal information about consumers from the following sources:

• Insurance applications and related forms
• Transactions with us, our affiliates or others
• Consumer reporting agencies
• Transactions with non-affiliated third parties

How We Use Personal Information

We may use or disclose the personal information we collect for one or more of the following business or commercial purposes:

• Insurance policy sales and administration
• Marketing and advertising
• Claims and investigations
• Research and analytics
• Fulfilling legal and regulatory obligations

How We Share Personal Information

We do not sell the personal information we obtain.

Your personal information may be disclosed to our affiliates or an external third party for a business purpose. When we disclose personal information to an external third party for a business purpose, we enter a contract with the recipient that describes the purpose for sharing the information and requires the recipient to protect that information. Our affiliates are only permitted to use personal information we disclose to them for authorized business purposes and they are required to protect the information in accordance with approved data security plans.

We may share your personal information with the following categories of third parties including:

• Other insurance institutions, financial institutions or insurance support organizations;
• Authorized agents or brokers;
• Service providers;
• Marketing and advertising partners;
• Law enforcement, regulators and other parties for legal reasons; and
• Our affiliates.

We may have disclosed personal information to a third party for a business purpose in the last twelve (12) months.

Your Rights and How to Exercise Them

The CCPA grants consumers (California residents) access and deletion rights about the personal information that a business has collected about the consumer in the twelve (12) months prior to the consumer’s request.

Access Request Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information. Once we receive your request and confirm your identity (see Exercising Access and Deletion Rights), we will disclose to you:

• The categories of personal information we collected about you;
• The categories of sources from which the personal information was collected;
• The business or commercial purpose for collecting or disclosing personal information;
• The categories of third parties with whom we share personal information; and
• The specific pieces of personal information we collected about you.

Deletion Request Rights

Subject to certain exceptions, you have the right to request that we delete any of the personal information that we collected from you and have retained. Unless an exception applies, once we receive your request and confirm your identity (see Exercising Access and Deletion Rights), we will delete your personal information from our records and direct our service providers to delete your personal information from their records.

We may deny your deletion request if we did not collect the information directly from you or we or our service providers need the information:

• To complete a transaction or service that you requested;
• For security purposes;
• To identify and repair system errors;
• For internal business purposes; or
• To comply with a laws or legal obligation.

Exercising Access and Deletion Rights

To exercise your access and deletion rights, please submit a request to us by either:

• Completing the request form found HERE; or
• Calling us toll-free at (844) 904-1030.

Only you, or an authorized agent appointed to act on your behalf, may make an access or deletion request related to your personal information. You may also make a request on behalf of your minor child. If you are submitting a request on behalf of someone else, you will need to provide proof that you have been authorized by the consumer to make the request for them. To do so, please complete the form found HERE and email or mail it back to the contact information indicated below (see Contact Information).

You may only make an access request twice within a 12-month period.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. In order to verify your identity, we need information that allows us to reasonably verify that you are the person about whom we collected personal information. Information we request may include:

• First, middle, and last name
• Date of birth
• Phone number
• Address
• Last four digits if your social security number
• Policy or claim number

We will only use the personal information provided to us in an access or deletion request in order to verify the requestor's identity or authority to make the request.

Response Timing

We will confirm that we received your request within ten (10) days of receiving the request. We will respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to an additional 45 days) to respond to your request, we will inform you of the reason and the extension period in writing by mail or electronically based on your stated preference.

Non-Discrimination

If you choose to exercise your CCPA rights, we will not discriminate against you by:

• Denying you goods or services;
• Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Providing you a different level or quality of goods or services; or
• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of service.

Changes to Our Privacy Notice

We reserve the right at our discretion to amend this privacy notice at any time. When we make changes to this privacy notice, we will post the updated notice on our website (amfam.com) and update the notice's effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at:

Phone: (844) 904-1030

Email: CA-Privacy@amfam.com

Postal Address:

Attn: Corporate Compliance
6000 American Parkway
Madison, WI, 53783