American Family Insurance California Privacy Notice
Effective Date: January 3, 2023
This California Privacy Notice supplements the American Family Insurance General Privacy Notice and applies solely to individuals who reside in California (“consumers”). We have adopted this policy to comply with the California Privacy Rights Act (“CPRA”), previously known as the California Consumer Privacy Act of 2018 ("2018").
Information We Collect
CPRA defines personal information as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Personal information does not include de-identified or aggregate consumer information. We will implement technical safeguards to prohibit re-identification of de-identified information about you.
We have collected some or all the below categories of personal information from consumers within the last twelve (12) months.
Please note that the examples are not an exhaustive list and personal information collected may fall into multiple categories. Categories and specific pieces of information collected will vary depending on the nature of your relationship with us.
|Credit history, bank account numbers, investment or brokerage account numbers, information regarding estate or tax planning, debts, trusts, credit or debit card numbers|
|Profiles reflecting a person’s preferences, such as interests, hobbies, characteristic tendencies, behaviors, attitudes or aptitudes, including inferences drawn from personal information|
We reserve the right to create or allow others to create aggregate consumer information data sets by ensuring that individual consumer identities have been removed and are not linked or reasonably linkable to any consumer or household, including via a device. The CPRA does not require that we re-identify such information in response to a consumer request.
We collect personal information about consumers from the following sources:
- Insurance applications and related forms
- Transactions with us, our affiliates or others
- Consumer reporting agencies
- Transactions with non-affiliated third parties
- From a text or SMS message that you send to us in order to obtain more information about a product or service
How We Retain Your Personal Information
We retain personal information for the periods required by applicable laws and/or as specified in our records retention policies and procedures and our Privacy Notice. The period chosen takes account of applicable legal requirements to retain data and specific business use cases. We maintain records management and retention policies and procedures so that, where required, personal information is disposed of after a reasonable time in consideration of the following retention criteria:
- We retain your personal information for as long as needed to carry out the business purposes set forth in this Privacy Notice, or to support our business functions and operations.
- We retain your personal information as long as we have an ongoing relationship with you or for as long as needed to provide products or services to you.
- We retain your personal information for as long as needed to comply with our legal and contractual obligations or as necessary to defend our rights.
How We Use Personal Information
We may use or disclose the personal information we collect for one or more of the following business or commercial purposes:
- Insurance policy sales and administration
- Marketing and advertising
- Claims and investigations
- Research and analytics
- Fulfilling legal and regulatory obligations
How We Share Personal Information
We do not sell the personal information we obtain.
Your personal information may be disclosed to our affiliates or an external third party for a business purpose. When we disclose personal information to an external third party for a business purpose, we enter a contract with the recipient that describes the purpose for sharing the information and requires the recipient to protect that information. Our affiliates are only permitted to use personal information we disclose to them for authorized business purposes and they are required to protect the information in accordance with approved data security plans.
We may share your personal information with the following categories of third parties including:
- Other insurance institutions, financial institutions or insurance support organizations;
- Authorized agents or brokers;
- Service providers;
- Marketing and advertising partners;*
- Law enforcement, regulators and other parties for legal reasons; and
- Our affiliates.
We may have disclosed personal information to a third party for a business purpose in the last twelve (12) months.
* Personal Information collected through the short code/SMS program will not be shared, sold or leased to unaffiliated or affiliated third parties for their own marketing purposes.
Your Rights and How to Exercise Them
The CPRA grants consumers (California residents) rights regarding the personal information that a business has collected about the consumer in the twelve (12) months prior to the consumer’s request.
Access Request Rights
You have the right to request that we disclose certain information to you about our collection and use of your personal information. Once we receive your request and confirm your identity (see Exercising Your Rights), we will disclose to you:
- The categories of personal information we collected about you;
- The categories of sources from which the personal information was collected;
- The business or commercial purpose for collecting or disclosing personal information;
- The categories of third parties with whom we share personal information; and
- The specific pieces of personal information we collected about you.
Deletion Request Rights
Subject to certain exceptions, you have the right to request that we delete any of the personal information that we collected from you and have retained. Unless an exception applies, once we receive your request and confirm your identity (see Exercising Your Rights), we will delete your personal information from our records and direct our service providers to delete your personal information from their records.
We may deny your deletion request if we did not collect the information directly from you or we or our service providers need the information:
- To complete a transaction or service that you requested;
- For security purposes;
- To identify and repair system errors;
- For internal business purposes; or
- To comply with a laws or legal obligation.
Correction Request Rights
You have the right to request we correct inaccurate personal information. Once we receive your request and confirm your identity (see Exercising Your Rights), we will ensure your information is corrected and accurate.
Opt Out of Sharing Rights
You have the right to opt-out of sharing for cross context behavioral advertising. Once we receive your request and confirm you identify (see Exercising Your Rights), we will opt you out of this advertising practice.
Exercising Your Rights
To exercise your rights, please submit a request to us by either:
- Completing the request form found HERE; or
- Calling us toll-free at (844) 904-1030.
Only you, or an authorized agent appointed to act on your behalf, may make a request related to your personal information. You may also make a request on behalf of your minor child. If you are submitting a request on behalf of someone else, you will need to provide proof that you have been authorized by the consumer to make the request for them. To do so, please complete the form found HERE and email or mail it back to the contact information indicated below (see Contact Information).
You may only make an access request twice within a 12-month period.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. In order to verify your identity, we need information that allows us to reasonably verify that you are the person about whom we collected personal information. Information we request may include:
- First, middle, and last name
- Date of birth
- Phone number
- Last four digits if your social security number
- Policy or claim number
We will match these data points with information we have about you to confirm your identity. We will only use the personal information provided to us in a request in order to verify the requestor's identity or authority to make the
We will confirm that we received your request within ten (10) days of receiving the request. We will respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to an additional 45 days) to respond to your request, we will inform you of the reason and the extension period in writing by mail or electronically based on your stated preference.
If you choose to exercise your CPRA rights, we will not discriminate against you by:
- Denying you goods or services;
- Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
- Providing you a different level or quality of goods or services; or
- Suggesting that you may receive a different price or rate for goods or services or a different level or quality of service.
Changes to Our Privacy Notice
We reserve the right at our discretion to amend this privacy notice at any time. When we make changes to this privacy notice, we will post the updated notice on our website (amfam.com) and update the notice's effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.
If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at:
Phone: (844) 904-1030
American Family Insurance
Attn: Corporate Compliance
6000 American Parkway
Madison, WI, 53783