The California Consumer Privacy Act (“CCPA”) Policy
Your Rights Under The California Consumer Privacy Act of 2018
Effective January 1, 2020, California residents have certain rights under the California Consumer Privacy Act of 2018 (Cal. Civ. Code §1798.100 et seq.). A description of these rights is listed below. These rights only apply to you if you are a resident of the State of California.
- Request to Know: You have the right to request that we disclose to you any or all of the following:
- The categories of personal information that we have collected about you;
- The categories of sources from which we have collected personal information about you;
- The specific pieces of personal information that we have collected about you;
- The categories of your personal information that we sold, if any;
- The categories of your personal information that we disclosed about you for a business or commercial purpose in the last twelve (12) months;
- The categories of companies to whom we have disclosed personal information for a business purpose, if any; and/or
- Our business or commercial purpose(s) for collecting or selling your personal information.
- Request to Delete: You have the right to request that we delete any personal information about you, and that we instruct any vendors, service providers, or third parties of ours to do so, except if it is necessary for us or one of our vendors, service providers, or third parties to maintain your information in order to do any of the following:
- Complete the transaction for which the information was collected (including performing contracts between us), or provide a good or service requested by you or reasonably anticipated within the context of our ongoing business relationship with you;
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
- Debug our data to identify and repair errors that impair existing intended functionality of boh.com;
- Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
- Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code;
- Engage in ethical research in the public interest, the achievement of which would likely be rendered impossible or seriously impaired, provided you give informed consent;
- Enable solely internal uses that are reasonably aligned with our ongoing business relationship with you or otherwise compatible with the context in which you provided the information;
- Comply with a legal obligation; and/or
- Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.
- You have the right to request that we deliver to you, free of charge to you, the personal information collected about or from you as set forth in paragraph (1), above (Request to Know). The information may be delivered by mail or electronically, and if provided electronically, the information will be in a portable and, to the extent technically feasible, in a readily-useable format.
- Under the CCPA, you have the right to opt-out of the sale of personal information that we collect about you. However, we do not sell your personal information, and we do not share it with nonaffiliates for marketing purposes.
- You have the right not to be discriminated against by us if you exercise any of your rights under the CCPA, including those described in this notice. Specifically, if you exercise any of your rights under the CCPA, we will not (i) deny goods or services to you; (ii) charge you different prices or rates for goods or services (including through the use of discounts or other benefits or imposing penalties); (iii) provide you with a different level or quality of goods or services; or (iv) suggest that you will receive different prices or rates for goods or services, or a different level or quality of goods or services. As permitted by California Civil Code section 1798.125(b)(1), we may offer you financial incentives, including payments to you as compensation, for the collection of personal information or the sale of personal information.
Personal Information Under The CCPA
For purposes of the CCPA, the term “personal information” does not include:
- Publicly available information;
- De-identified or aggregated information; and
- Information covered by certain sector-specific privacy laws, such as the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or the California Financial Information Privacy Act (CFIPA).
Personal Information We Have Collected
In the last twelve (12) months, we have collected the following categories of personal information about California consumers:
- Identifiers such as name, alias, address, unique identifier, online identifier, internet protocol (IP) address, email address, account number, Social Security Number, driver’s license number, passport number, or other similar identifiers;
- Personal information such as name, signature, Social Security Number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, or medical information. Some personal information included in this category may overlap with other categories;
- Protected classification characteristics under California or federal law such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, or veteran or military status;
- Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
- Biometric information, such as genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, or gait;
- Information regarding online activities, including online identifiers, internet protocol (IP) addresses, email addresses, browsing history, search history and other information related to interactions with our website, application, or advertisements;
- Geolocation data;
- Sensory data such as audio, electronic, or visual information;
- Professional or employment-related information;
- Non-public education information (per the Family Education Rights and Privacy Act) such as education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records; and
- Inferences, including any derivation or assumptions made from any of the information identified in the above categories to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
In the last twelve (12) months, we have collected personal information about California consumers from the following categories of sources:
- From consumers when they initiate a transaction for a product or service from us, communicate with us, interact with our website, visit our physical locations or make payments to us;
- From companies that share common ownership, management or control with us;
- From service providers, such as vendors that improve our services and detect fraud; and
- From credit bureaus, such as Experian.
Disclosure and Use of Personal Information
In the last twelve (12) months, we have disclosed personal information about California consumers to the following categories of companies for a business or commercial purpose:
- Companies that share common ownership, management or control with us;
- Credit bureaus; and
- Companies with whom we do business in order to provide products or services to consumers.
In the last twelve (12) months, we have collected personal information for each of the following business or commercial purposes. Using the categories of collected personal information identified in the preceding Section 1 (A – K), we identify the business or commercial purpose for sharing each category as follows:
- Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards (Identifiers, Personal Information, Commercial Information, Geolocation Data, Inferences);
- Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity (Identifiers, Personal Information, Commercial Information, Biometric Information, Geolocation Data, Sensory Data);
- Debugging to identify and repair errors that impair existing intended functionality (Identifiers, Personal Information, Commercial Information, Biometric Information, Geolocation Data);
- Short-term, transient use, provided the personal information that is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction (Personal Information, Protected Classification Characteristics, Commercial Information, Geolocation Data);
- Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on our behalf (Identifiers, Personal Information, Protected Classification Characteristics, Commercial Information, Geolocation Data, Inferences);
- Undertaking internal research for technological development and demonstration (Identifiers, Personal Information, Protected Classification Characteristics, Commercial Information, Biometric Information, Geolocation Data, Sensory Data, Professional Information, Non-Public Education Information, Inferences);
- Undertaking activities to verify or maintain the quality or safety of a service or device that is owed, manufactured, manufactured for, or controlled by, us, and to improve, upgrade or enhance the service or devise that is owned, manufactured, manufactured for, or controlled by us (Identifiers, Personal Information, Protected Classification Characteristics, Commercial Information, Biometric Information, Geolocation Data, Sensory Data);
- Inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information or services (Identifiers, Personal Information, Protected Classification Characteristics, Commercial Information, Biometric Information, Geolocation Data, Sensory Data, Inferences); and
- Enabling or effecting, directly or indirectly, a commercial transaction (Identifiers, Personal Information, Protected Classification Characteristics, Commercial Information, Biometric Information, Geolocation Data, Sensory Data, Professional Information, Non-Public Education Information, Inferences).
Personal Information We Have Sold
We do not sell your personal information. We do not sell the personal information of minors under 16 years of age.
Access To And Control Over The Use Of Your Personal Information
Submitting a Request to Know or Request to Delete on Your Behalf or on Behalf of Your Minor Child
You may make a Request to Know or a Request to Delete on your behalf or on behalf of your minor child by either:
- Calling us toll free at 1-888-643-3888; or
- Clicking the “Submit a Request” link and filling in the information requested.
Your Request to Know or Request to Delete must provide sufficient information that allows us to reasonably verify that the consumer that is the subject of the request is the person about whom we collected personal information. Given the sensitivity of your personal information that we collect and retain, we will need to verify your identity with at least 3 separate pieces of information.
Pursuant to California Civil Code section 1798.130(b), we are not required to respond to a Request to Know from the same consumer more than twice in a twelve (12) month period.
A person authorized by you to act on your behalf, or an entity registered with the California Secretary of State and authorized by you to act on your behalf, may make a Request to Know or Request to Delete on your behalf. Before we can respond to a verifiable consumer request submitted by an authorized agent, we need to confirm that person or entity’s authority to act on behalf of a consumer and verify the identity of the authorized agent.
Your authorized agent may submit a Request to Know or Request to Delete on your behalf by contacting us at PrivacyCCPARequests@boh.com or 1-888-643-3888. Your authorized agent will need to provide the following information:
- A copy of one or more of the following to verify the agent’s authorization to make a request on your behalf:
- California Secretary of State authorization;
- Written permission from the California resident; and/or
- Power of attorney.
- Documentation of your agent’s identity:
- Valid government-issued identification (not expired); AND
- A utility bill, bank statement, or similar documentation to verify your name and address.
- Your agent will also be required to verify your identity.
We cannot respond to your agent’s request or provide your agent with personal information if we cannot verify your agent’s identity or authority to make the request and confirm that you are the person about whom we collected personal information.
Use of Information in a Consumer Request
We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.
We will acknowledge receipt of the request within 10 business days of its receipt. We will further respond to the request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any response to a Request to Know will only cover the preceding 12 months. If applicable, the response will also explain the reasons we cannot comply with a Request to Know or Request to Delete. For Requests to Know specific pieces of information (as opposed to categories), we will provide the responsive information in a portable and, to the extent technically feasible, readily useable format that allows you to transmit the information to another entity without hindrance.
We do not charge a fee to process or respond to Requests to Know or Requests to Delete unless a request is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
How to Contact Us for More Information
If you have any questions or concerns regarding this CCPA Policy or practices, please contact us.
Last updated August 12, 2021
You're about to exit BOH.com
Links to other sites are provided as a service to you by Bank of Hawaii. These other sites are neither owned nor maintained by Bank of Hawaii. Bank of Hawaii shall not be responsible for the content and/or accuracy of any information contained in these other sites or for the personal or credit card information you provide to these sites.