CCPA Privacy Policy

Effective Date/Last Updated: January 1, 2020

This privacy policy for California Residents supplements, and incorporates by reference, the information contained in our GLBA Privacy Policy and Terms of Use. This policy applies solely to all visitors, users and others who reside in the State of California ("consumers" or "you"). We (subsidiaries of Enova International, Inc., operating under the CashNetsUSA brand) adopt this policy to comply with the California Consumer Privacy Act of 2018 and its regulations ("CCPA"), and any terms defined in the CCPA have the same meaning when used in this policy unless otherwise defined.

The CCPA provides consumers with specific rights regarding their personal information. The information below describes your CCPA rights and explains how to exercise those rights.

I. Right to Know – Personal Information We Collect and the Purposes for Which This Information Is Used

 a. Right to Know

Under the CCPA, you have the right to request that we disclose certain information to you about our collection, use and disclosure of your or your household’s personal information over the past 12 months. Once we receive your request and verify your identity, and to the extent the personal information that we have on you is not otherwise exempt under the CCPA, we will disclose to you:

  • The categories of personal information we collected about you;
  • The categories of sources for the personal information we collected about you;
  • Our business or commercial purpose for collecting or disclosing that category of personal information;
  • The specific pieces of personal information we collected about you; and
  • If we disclosed your personal information for a business purpose:
    • The categories of personal information that we disclosed about you for a business purpose; and
    • The categories of service providers to whom your personal information was disclosed for a business purpose and which category of personal information was disclosed to those service providers.

 b. Our Collection, Use and Sharing Practices

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("personal information"). Personal information does not include: (1) publicly available information, such as information that is lawfully made available from federal, state or local records, and (2) de-identified or aggregate consumer information (e.g., information that cannot be linked to you or your household).

In particular, we collected the following categories of personal information from consumers within the last twelve (12) months:

Collapse All Expand All

Category 1 - Identifiers

Category Identifiers (e.g., name, Internet Protocol address, email address, or other similar identifiers)

Source of Information Consumer, credit reporting agencies, third-party data providers, marketing partners, and advertising partners

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; counting ad impressions; auditing; detecting security incidents; debugging and repairing functionality; short-term transient use; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Payment processing vendors, third-party data providers, advertising partners, marketing partners, web analytics providers, data processing providers, IT services providers, security/anti-fraud providers, credit reporting agencies, professional services providers, and customer support providers

Category 2 - Personal information categories listed in the California Customer Records statute

Category Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) (e.g., name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, employment, employment history, bank account number, debit card number, or any other financial information)

Source of Information Consumer, credit reporting agencies, and third-party data providers

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; auditing; detecting security incidents; debugging and repairing functionality; short-term transient use; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Payment processing vendors, third-party data providers, marketing partners, data processing providers, IT services providers, security/anti-fraud providers, credit reporting agencies, professional services providers, and customer support providers

Category 3 - Protected classification characteristics under California or federal law

Category Protected classification characteristics under California or federal law (e.g., age, gender, national origin, citizenship, marital status, disability, or military status)

Source of Information Consumer, credit reporting agencies, and third-party data providers

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; auditing; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Advertising partners, marketing partners, data processing providers, IT services providers, security/anti-fraud providers, credit reporting agencies, professional services providers, and customer support providers

Category 4 - Commercial information

Category Commercial information (e.g., records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)

Source of Information Consumer, credit reporting agencies, and third-party data providers

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; detecting security incidents; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Advertising partners, marketing partners, web analytics providers, data processing providers, IT services providers, security/anti-fraud providers, credit reporting agencies, and professional services providers

Category 5 - Biometric information

Category Biometric information (e.g., keystroke or other behavioral or biological characteristics)

Source of Information Consumer

Purpose of Collection Business — debugging and repairing functionality; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Web analytics providers

Category 6 - Internet or other similar network activity

Category Internet or other similar network activity (e.g., browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement)

Source of Information Consumer, web browsers, marketing partners, and advertising partners

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; counting ad impressions; detecting security incidents; debugging and repairing functionality; short-term transient use; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Advertising partners, marketing partners, web analytics providers, and security/anti-fraud providers

Category 7 - Geolocation data

Category Geolocation data (e.g., physical location or movements)

Source of Information Consumer, web browsers, marketing partners, and advertising partners

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; counting ad impressions; auditing; detecting security incidents; debugging and repairing functionality; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Advertising partners, marketing partners, web analytics providers, and security/anti-fraud providers

Category 8 - Sensory data

Category Sensory data (e.g., audio, electronic, visual, or similar information)

Source of Information Consumer

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications and servicing credit products; auditing; detecting security incidents; debugging and repairing functionality; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Data processing providers, IT services providers, security/anti-fraud providers, professional services providers, and customer support providers

Category 9 - Professional or employment-related information

Category Professional or employment-related information (e.g., current and/or prior employment information)

Source of Information Consumer, credit reporting agencies, and third-party data providers

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; auditing; detecting security incidents; debugging and repairing functionality; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Credit reporting agencies, data processing providers, IT services providers, security/anti-fraud providers, professional services providers, and customer support providers

Category 10 - Inferences drawn from other personal information

Category Inferences drawn from other personal information (e.g., profile reflecting a person’s preferences, characteristics, trends, behavior, and abilities)

Source of Information Third-party data providers, credit reporting agencies, marketing partners, and advertising partners

Purpose of Collection Business — for performing services or offering products on our behalf or our partners’ behalves, such as processing credit applications, servicing credit products, and/or marketing; auditing; detecting security incidents; undertaking internal research for technological development; and undertaking activities to verify or maintain the quality or safety of our products and services

Categories of Service Providers (with whom information is shared) Web analytics providers, data processing providers, and security/anti-fraud providers

Note that the personal information that we collect may not be subject to your rights under the CCPA because it is personal information covered by or collected under industry-specific privacy laws, including, but not limited to:

  • the Health Insurance Portability and Accountability Act of 1996;
  • the California Confidentiality of Medical Information Act;
  • the Fair Credit Reporting Act ("FCRA");
  • the Gramm-Leach-Bliley Act ("GLBA");
  • the California Financial Information Privacy Act; and
  • the Driver's Privacy Protection Act of 1994.

II. Right to Delete Your Personal Information

Under the CCPA, you have the right to request that we delete any of your personal information that we collected and retained from you or your household, subject to certain exceptions. Once we receive your request and verify your identity, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if (i) the information that you are requesting be deleted is exempt from the CCPA or (ii) retaining such information is necessary for us or our service provider(s) to:

  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
  • Debug products to identify and repair errors that impair existing intended functionality;
  • Exercise free speech, ensure the right of another consumer to exercise that consumer’s free speech rights, or exercise another right provided for by law;
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
  • Comply with a legal obligation; or
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

III. Right to Opt Out of the Sale of Your Personal Information to Third-Parties

Under the CCPA, if you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time. However, we have not sold personal information that is covered under the CCPA to third-parties for a business or commercial purpose in the preceding 12 months, nor do we currently sell or intend to sell personal information covered by the CCPA in the future. In addition, we do not collect, and therefore, do not sell the personal information of minors under 18 years of age.

For information about how we share personal information that is subject to the GLBA and FCRA, please see our GLBA Privacy Policy and Terms of Use.

IV. Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless otherwise permitted by the CCPA, we will not:

  • Deny you goods or services;
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
  • Provide you a different level or quality of goods or services; or
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

V. Exercising Your Right to Know or Delete Your Information

You may exercise your right to know or right to delete by (i) submitting the webform located at cashnetsusa.net or (ii) contacting us via email at ccpa@cashnetsusa.net. Only you, or a person you authorize to act on your behalf, may exercise your rights under the CCPA. Please note that we are only required to respond to your request for access to your personal information twice within a 12-month period.

We cannot process your request or provide you with personal information if we cannot verify your identity or authority to make the request on your behalf and confirm that the personal information relates to you. To verify your request, we will match the personal information you submit with the information we have about you. If we cannot conclude your information matches what we have, you may be directed to contact us with further instructions to assist us in responding to your request. In order to verify your request, you must submit:

  • Your first and last name;
  • Your Social Security number;
  • Your date of birth; and
  • Your email or mailing address (depending on delivery preference).

To designate an authorized agent to submit a request on your behalf, you must call our Customer Service team at 888.801.9075 and provide us with your name and date of birth or last four numbers of your Social Security number in order for us to verify your identity. Next, you must give the first and last name or the name of the organization that will act as your agent, and verbally confirm your authorization. Once your authorization is given, the authorized agent will be able to submit a request by calling our Customer Service team at 888.801.9075.

We will only use personal information provided in a request to verify the requestor’s identity or authority to make the request. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing within the initial 45-day period.

We will deliver our written response to you via the delivery method you specify to us when you submit your request.

Any disclosures we provide will only cover the 12-month period preceding the receipt of the verifiable request. We will select a format in which to provide your personal information to you that is readily useable and should allow you to transmit the information to a third-party without hindrance.

Note that, under no circumstances, will we provide you or your authorized agent with your Social Security number, driver’s license number or other government-issued identification number, financial account number, account password, or security questions and answers, or with any other specific pieces of personal information if the disclosure creates an unreasonable risk to the security of your personal information. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

VI. Reasonable Accommodation

Individuals with disabilities who require an accommodation to access this policy or to make a request under the CCPA should contact us via email at privacy_accommodations@cashnetsusa.net, by telephone at 888.801.9075, or by mail at 175 W. Jackson Blvd., Suite 1000, Chicago, IL 60604. Please note that we may need advance notice to provide certain accommodations.

VII. Changes to This Privacy Policy

We reserve the right to amend this privacy policy at our discretion at any time. When we make changes to this privacy policy, we will post the updated policy on the website and update the policy’s effective date. Your continued use of our website following the posting of changes to this privacy policy constitutes your acceptance of such changes.

VIII. Contact Information

If you have any questions or comments about this policy, the ways in which we collect and use your information as described above, your choices and rights regarding such use, please do not hesitate to contact us via email at support@cashnetsusa.net or by telephone at 888.801.9075.