Privacy Policy

Additional document: Privacy Notice

Last updated: November 1, 2022

Your privacy is important to Citadel Servicing Corporation, that’s why we provide this comprehensive Online Privacy Policy to explain what and how we collect, share, use, and protect your personal information when you use and visit our websites, or use the online services offered by the Citadel Servicing Corporation family of companies (“Acra Lending”) that link to and reference this Policy (our collective, “online services”). We cater to a large variety of clients and the principals applied within this Online Privacy Policy may apply or not depending on the product or services you obtain from us, or your jurisdiction in which we are doing business with you. Below, you will find links to our GDPR, DPA, CCPA/CPRA, Privacy Act of Canada, and PIPL disclosures that may or may not apply to you, depending on your residency.

We take our responsibility to protect the privacy and confidentiality of any information you give us, including personal information, sensitive data, and confidential information very seriously. We maintain an entire IT security team that regularly updates our physical, electronic, and procedural safeguards that comply with the legal standards to secure information from unauthorized access, accidental or unlawful alteration and destruction, and any other unlawful or unauthorized forms of processing. We also have strict employee policies, procedures, and rules concerning the safe handling and use of your private and confidential information.

To give our customers the best products we can offer, we collect various types of information. We want you to know what we may collect and how we use it.

Types of information we collect and how we use it.

The types of personal information we collect from you when you visit or use our online services include your name, email address, mailing address, telephone number(s), account numbers, limited location information, username, and password. We may also collect payment card information, Social Security numbers, driver’s license numbers (or comparable numbers), and your gender, race, and nationality when you provide it directly to us while using our online services and where we believe it is reasonably required for ordinary business purposes. In some instances, we create personal information about you, such as records of your interactions with us, and details of your accounts.

We do not seek to collect or process sensitive personal information unless it is required or permitted by law; necessary for the detection or prevention of crime; necessary to establish, exercise or defend legal rights; or we have your prior explicit consent to do so.

In addition to the personal information described above, we also collect certain information about your use of our online services. For example, we may capture the IP address of the device you use to connect to the online service, the type of operating system and browser you use, and information about the site you came from, the parts of our online service you access, and the site you visit next. As explained in more detail in our Cookies Policy.

We and our third-party partners use cookies (as well as web beacons or other technologies) to collect and store this and other information about your visit to, or use of, our online services. We may later associate the usage and other information we collect online with personal information about you, as permitted or required by law.

We sometimes collect information about you from additional online and offline sources including social media (to the extent you choose to make your personal information public) and commercially available third-party sources, such as credit reporting agencies. We may combine this information with the personal and other information we have collected about you under this Online Privacy Policy.

Where we are required to establish a legal basis to process your personal information as described in this Online Privacy Policy, we will do so on the basis that we have obtained your prior express consent to the processing; we have a legitimate business interest in the processing that is not overridden by your interests, fundamental rights, or freedoms; and/or the processing is needed to comply with applicable law, to perform under your contract(s) with us, or to protect the vital interests of any individual.

We use and otherwise process the information we collect from you to help us deliver our online services; to administer, evaluate and improve our business (including developing new products and services, improving existing products and services, performing data analytics and other research tasks, communicating with you, and performing accounting, auditing and other internal functions); manage our risks; to market our services and products; and to comply with and enforce applicable laws and regulations, relevant industry standards, contractual obligations, and our policies. We also use data that we collect on an aggregate or anonymous basis (such that it does not identify any individuals or clients) for various business purposes and allow other third parties to do the same, where permissible under applicable laws and regulations.

By submitting data on our website, you are providing explicit consent to transmission of data collected on the website.

Our goal is to collect only what we need, keep it up-to-date, and remove it when we no longer need it.

We take reasonable steps to ensure that the personal information we process is limited to what we require in connection with the purposes set out in this Policy; accurate and, where necessary, kept up to date; and erased or rectified without delay if it is inaccurate. From time to time, we may ask you to confirm the accuracy of your personal information.

For some of our online services, you can review or update certain account information by logging in and accessing a user profile section. If you cannot change the incorrect information online, or you prefer to request changes offline, please contact your Acra Lending representative using the contact information listed on your account statements, records, or other account materials.

How We Use Your Personal Information

We carefully evaluate how we use data to make sure we are using your personal information to personalize our services and provide value for you. We may use or disclose the personal information we collect for one or more of the following business purposes:

To fulfill or meet the reason for which the information is provided. For example, if you provide us with Personal Information in order for us to provide a loan estimate, we will use that information to prepare loan estimates and submit it for an application.
To provide you with information, products or services that you request from us.
To provide you with email alerts and other notices concerning our products or services, or events or news, that may be of interest to you.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
To improve our Website and present its contents to you.
For testing, research, analysis and product development.
To detect security incidents and protect again malicious, deceptive, fraudulent, or illegal activity.
As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
To market our products and services to you.
For our affiliates to market their products and services to you.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you advance notice. In the event we would like to use your personal information in a way that is not described here, we will let you know in advance so you can decide if you are comfortable with that use.

Note that in those jurisdictions that require a legal basis in order to process your personal information, we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us at [email protected] if you need details about the specific legal ground(s) we are relying on to process your personal data where more than one ground has been specified by us.

We share personal information with affiliates and approved third parties when we believe it will improve the services and products we provide or for legal and/or routine business reasons.

We share personal information among our affiliates and business units when we believe it will enhance the services we can provide, but only in circumstances where such sharing conforms to law, any applicable confidentiality agreements, and our policies and practices. Additionally, we reserve the right to share your personal information in connection with a corporate change including a merger, acquisition or sale of all or any relevant portion of our business or assets. We also share personal information with our affiliates to allow them to market their products and services to you.

We disclose information we have about you as required or permitted by law. For example, we share information with regulatory authorities and law enforcement officials when we believe in good faith that such disclosure is necessary to comply with legal requirements.

We share information with third parties where appropriate to protect against fraud or to verify or enforce our terms of use, our other rights, and/or other applicable policies.

From time to time, we enter into agreements with other companies to provide services to us, or to make services and products available to you. If these companies receive your personal information, they are required by contract to safeguard it and only use it for those purposes we specify.

We do not sell your Personal Information.

International Users

Although our website is intended for United States users, we take privacy seriously for all and may sometimes contact you while you are in another Country. In those instances, our international policies are outlined below.

For customers located in the United Kingdom, please see our DPA disclosure.

For customers located in the European Union, please see our GDPR disclosure.

For customers located in Canada, please see our Privacy Act of Canada disclosure.

For customers located in the People’s Republic of China, please see our PIPL disclosure.

Protection of Your Personal Information

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on our secure servers behind firewalls.

The safety and security of your information also depends on you. We urge you to be careful about giving out information in public areas of the website and/or social media. The information you share in public areas may be viewed by any user of the website.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to or from our website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the website.

Your rights concerning the processing of your personal information.

Depending on how and where you interact with us, you may have a right to one or more of the following with respect to your personal information we process or control:

request access to, or copies of, your personal information, together with details about how we process such information;
request rectification of any inaccuracies;
request erasure or restriction of processing;
object to processing by us or on our behalf;
have personal information transferred to another party;
withdraw consent to processing; and
lodge complaints with a data protection authority regarding any processing by us or on our behalf.

To exercise one or more of these rights or to ask a question about them, please use the contact details provided below in the “Contact Information” section.

In addition to the rights you may have under applicable data protection laws, we may also give you choices regarding the sharing of personal information with affiliates and third parties based on your relationship(s) with us as a financial institution. Choices you have about the sharing of your personal information will be described in the privacy policies or notices you receive from us, such as those provided in connection with particular financial products or services you obtain from us.

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances in accordance with applicable law.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests during that same time period. In this case, we will notify you and keep you updated.

Data Retention

We will retain personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide our services; (ii) whether there is a legal obligation to which we are subject; and (iii) whether we need to retain the Personal Information for our legal purposes (statutes of limitations, litigation or regulatory investigations).

We will retain copies in a form that permits identification for as long as we deem necessary in connection with the purposes set out in this Policy, unless applicable law requires a longer retention period.

Social Security Numbers

Social Security numbers are treated as “confidential” and may only be accessed by and disclosed to our employees and others with a legitimate business need in accordance with applicable laws and regulations. Social Security numbers, whether in paper or electronic form, are subject to safeguards, and must be stored, transmitted, and disposed of in accordance with our internal policies created and maintained to protect confidential information from unlawful disclosure and to limit access. These restrictions apply to all Social Security numbers collected or retained by Acra Lending and related service providers and vendors.

Children Under the Age of 18

Our website is for financial services and therefore not intended for children under 18 years of age. We do not knowingly collect personal information from anyone under the age of 18 without parental consent. No one under age 18 may provide any personal information to or on the website. If you are under 18, do not attempt to register on the website or send any personal information about yourself to us, including your name, address, telephone number, or email address.

Third-party Websites

Links to websites that are owned and controlled by third parties may be provided on our website from time to time. This includes links contained in advertisements, including banner advertisements and sponsored links. These links which navigate off of our website are provided for your convenience only and are beyond our control. Third-party websites you may be linked to have their own separate terms of use, and although we seek to protect the integrity of our website, we are not responsible and cannot be held liable for the content and activities of external web destinations. Such links do not imply our endorsement or guarantee of the products, services, information, or recommendations provided by any third-party Website.

The third-party websites may have a privacy policy different from ours and may provide less security. The third-party websites may send their own cookies to users, collect data, or solicit personal information, and therefore, you are advised to check the terms of use and/or privacy policies on those websites prior to using them. If you follow links to these websites or services, any information you contribute will be governed by the terms of use or privacy policies for those third-party websites and may be visible to others. You should never share or post personal, financial, or sensitive information or any information you expect to be treated confidentially through those websites. Acra Lending expressly disclaims any and all liability, including but not limited to any loss or damage, with regard to your access to or use of such linked websites. Your visit, access, and/or use of third-party websites is entirely at your own discretion and risk.

Collection of your personal information for advertising purposes.

Acra Lending does not allow unaffiliated third parties to collect personal information about your online activities when you visit or use our online services. Nor do we use personal information collected across non-affiliated websites for the purpose of serving you advertising related to your browsing behavior. If we engage in this practice in the future, we will provide appropriate notice and choices so that you can opt-out of the practice.

We tell you when our privacy policies and practices change.

We may change this Online Privacy Policy from time to time. When we do, we will let you know by appropriate means such as by posting the revised text on this page with a new “Last Updated” date. All changes will become effective when posted unless indicated otherwise. We encourage you to regularly check this page to review any changes we might make.

Cookies

As explained in more detail in our Cookies Policy, we and our third-party partners use cookies (as well as web beacons or other technologies) to collect and store this and other information about your visit to, or use of, our online services. We may later associate the usage and other information we collect online with personal information about you, as permitted or required by law.

Contact Information

If you have any questions or comments about our privacy practices, including any disclosures for direct marketing purposes, please contact your regular Acra Lending representative or write to us at [email protected], or contact us:

By Phone: (949) 900-6630 or (888) 800-7661

By Postal Address:

Citadel Servicing Corporation
3 Ada Parkway, Suite 200A
Irvine, CA 92618, USA

Shine the Light

Under the Shine the Light law, California customers may request information about whether a business has disclosed personal data (as defined in that law) to any third parties for their direct marketing purposes. We don’t do that without your permission.

Do Not Track

Do Not Track signals are a web browser setting or mechanism used to indicate that you do not want your online activity tracked. Because there is no universal standard of how to apply that setting, we currently do not honor them.

Your California Privacy Rights

If you are a California resident, please review our California Consumer Privacy Notice available at www.citadelserivicing.com/CCPA.

If you have any questions about this Online Privacy Notice, including any requests to exercise your legal rights, please contact us at [email protected].

Acra Lending is a dba name of Citadel Servicing Corporation.