Privacy Notice for Pennymac Office Visitors Who are California Residents

The California Consumer Privacy Act of 2018 (“CCPA”) provides California residents with privacy rights related to the personal information businesses collected about you and your household. The purpose of this privacy policy is to provide you with a description of our business practices regarding the collection, use, disclosure, and sale of your personal information and of your rights regarding your personal information.

In the preceding 12 months, PennyMac has collected the following categories of personal information about office visitors:

Length of Time We Intend to Retain Each Category (or the criteria used to determine the period of time)

Pennymac will retain each of the above categories of Personal Information for 5 years post the end of the business day. However, the retention period may vary based upon the following:

• As required by a law
• As required for legal purposes (statutes of limitations, litigation, regulatory investigations or audits)
• The time period required to fulfill necessary use and processing.

Categories of Sources From Which Personal Information is Collected

1. Directly from you, when you provide us with your personal information. For example, when you complete the screening questions on the iPad at one of our California PennyMac locations.

How We May Use Your Data

1. For security purposes, so that we have a record of who visited a PennyMac facility.

Categories Of Third Parties With Whom We May Disclose Your Personal Information

1. Suppliers who provide products or services to PennyMac.
2. Outside counsel, when needed.
3. Legal, regulatory, or other similar authorities and/or agencies, when required.

Why We Might Disclose Your Personal Information to Third Parties

1. To support business operations

In the preceding 12 months, PennyMac has disclosed to a Supplier the following categories of personal information (see examples of each category above):

1. Identifiers;
2. Categories of personal information described in the California Customer Records Act (Cal. Civ. Code section 1798.80(e));
3. Characteristics of protected classifications under California or federal law;
4. Sensory data; and
5. Inferences drawn from any personal information.

Sale or Sharing of Personal Information

Pennymac does not sell or share personal information. For the purposes of this policy, “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.

Pennymac has not sold or shared the personal information of consumers under 16 years of age.

Sensitive Personal Information

Pennymac does not collect sensitive personal information from California residents strictly visiting a Pennymac office.

Right to Know

You have the right to request that Pennymac disclose the personal information Pennymac has collected about you, including the categories of personal information, categories of sources from which the personal information was collected, the purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.

Right to Access

You have the right to request that Pennymac disclose the personal information Pennymac has collected about you, including the categories of personal information, categories of sources from which the personal information was collected, the purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.

Right to Request Deletion

You have the right to request the deletion of the personal information we collected about you. However, we may deny your request if there are any conflicts with our corporate record retention requirements, federal or state law, or if it falls under any other CCPA exception.

Right to Request Correction

You have the right to request that Pennymac correct inaccurate personal information Pennymac maintains about you.

Right to Opt-Out of the Sale of Personal Information

You have the right to opt-out of the sale of your personal information. PennyMac does NOT sell personal information.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

PennyMac does not discriminate against you for exercising your CCPA privacy rights.

Authorized Third Party

If you are an authorized third party (such as an attorney-in-fact) making a request on behalf of someone else, please contact us using one of the methods provided below.

How to Submit Your Request If You are a Resident of California

To submit a request to know, access, delete, or correct your information, click on “Submit a Request” or call us toll-free at (866) 601-3518.

Pennymac will verify your identity using the personal information you provide, which must include your name, address, and email address.

Contact Information:

If you have any questions or concerns about our privacy policies and practices, you may contact Pennymac using the information below.

A link to Pennymac’s consumer privacy policies may be found at pennymac.com/privacy

This privacy policy was last updated on March 25, 2024, and is subject to change.

Rev. 03/2024