Policy Approval Date: 01/18/2024
Policy Effective Date: 01/18/2024
Next Review Date: 01/18/2024
This Policy applies when: (i) Savvy LLC (“Savvy”) originates and funds loans of any type; and (ii) Savvy and NCP (“Third-Party Lender”) enter a lending program where Third-Party Lender funds loans of any type. In either case, Savvy markets to and solicits consumers interested in obtaining loans of any type. Such loans are originated and funded in accordance with either: (i) Savvy’s credit criteria; or (ii) the Third-Party Lender’s credit criteria, depending on whether Savvy is acting as a lender or a service agent for the Third-Party Lender.
Savvy’s CEO has approved this Privacy Policy (this “Policy”) to provide management, employees, personnel, officers and directors (“Savvy Personnel”) with guidance with respect to their responsibilities regarding compliance with requirements related to customer privacy, security of customer information, and information sharing as it relates to the conduct of Savvy’ business.
As financial services professionals entrusted with sensitive financial information, Savvy respects the privacy of customers and is committed to treating customer information responsibly and is dedicated to protecting confidential information. Savvy has established standards and procedures to safeguard that personal information. It is the policy of Savvy that we do not disclose nonpublic personal information about our customers to nonaffiliated third parties, except as permitted by law, or to affiliated parties, except as permitted by law.
Part 332 of the Federal Deposit Insurance Corporation’s regulations, Privacy of Consumer Financial Information, 12 CFR 332, and Part 1016 of the Consumer Financial Protection Bureau’s regulations, Privacy of Consumer Financial Information, 12 CFR 1016 (collectively the “Privacy Rule”) govern the treatment of nonpublic personal information about consumers by the Third-Party Lender and Savvy itself. These regulations implement Section V of the Gramm Leach Bliley Act. Both Savvy and the Third-Party Lender are financial institutions as defined in the Privacy Rule. State privacy requirements (e.g., California and Vermont) prohibit Savvy from sharing nonpublic personal information about a consumer unless the consumer affirmatively opts-in to such sharing. These state requirements differ from the requirements found in the Privacy Rule and Gramm Leach Bliley Act.
The Privacy Rule regulates how and with whom nonpublic personal information may be shared. The Privacy Rule requires each party to provide notice to customers about its privacy policies and practices and whether it shares that information with nonaffiliated third parties. Savvy will ensure compliance with this Privacy Policy, in cooperation with both its and, if applicable, the Third-Party Lender’s Chief Compliance Officer.
Nonpublic personal information consists of information that is collected in connection with providing a financial product or service. Specifically, it means personally identifiable financial information, which includes:
Nonpublic personal information does not include information that is available from public sources, such as telephone directories or government records. It also does not include information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.
The Privacy Rule regulates how and with whom nonpublic personal information may be shared. The Privacy Rule requires each party to provide notice to customers about its privacy policies and practices and whether it shares that information with nonaffiliated third parties. Savvy will ensure compliance with this Privacy Policy, in cooperation with both its and, if applicable, the Third-Party Lender’s Chief Compliance Officer.
The Privacy Rule allows Savvy to share information with its affiliates, to the extent that there is a need for its affiliate to have that information; the affiliate may disclose and use that information only to the extent that Savvy may disclose and use that information. Note: There are important differences in opt-out requirements in the Fair Credit Reporting Act (“FCRA”). FCRA-related opt-out requirements are described in the Fair Credit Reporting Act Policy. Also, as noted above, state privacy requirements (e.g., California and Vermont) prohibit Savvy from sharing nonpublic personal information about a consumer unless the consumer affirmatively opts-in to such sharing.
Savvy may share information with other parties, without meeting the “opt-out” requirements if:
In addition to the information sharing permitted without opt-out described above, Savvy may share other nonpublic personal information about its customers to nonaffiliated third parties or with affiliated parties subject to the opt-out requirements in the Privacy Rule and the FCRA. Savvy includes a disclosure in its Privacy Notice of these information sharing practices and an opt-out notice that provides a reasonable means to opt-out (i.e., an 800 number the consumer can call to opt-out). Savvy does not share any such information until thirty (30) days after the Privacy Notice including the opt-out notice is provided.
If a consumer directs Savvy not to share this information, the consumer’s name is added to a database maintained by Savvy, as servicer. Savvy Personnel are trained to consult the list for consumer opt-out directions prior to such information sharing with non-affiliates and affiliates.
Both Savvy and the Third-Party Lender are required to provide a copy of its Privacy Notice when it enters into a customer relationship with a consumer. Once a consumer becomes a customer at account opening, a copy of the Privacy Notice is provided. Both Savvy and the Third-Party Lender also must post a copy of the Privacy Notice along with the account terms online where a consumer can view the Privacy Notice.
Not less than annually thereafter, both Savvy and the Third-Party Lender are each required to provide a Privacy Notice to applicable customers as long as there is a continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. For purposes of this section, the 12-month consecutive period will be defined as a calendar year. The annual notice is provided to the customer via e-mail or paper copy once in each calendar year following the calendar year in which the initial notice was provided. For example, if a customer opens an account on any day of year one, an annual notice must be provided to that customer no later than December 31 of year two. Alternatively, posting of the annual notice will be done online as permitted by law in lieu of mailing or email notices.
Both Savvy and the Third-Party Lender must limit the use and collection of customer information to that which is necessary to conduct their respective businesses. All Savvy Personnel are responsible for maintaining the confidentiality of customer information. Savvy Personnel’s access to personally identifiable customer information will be limited to those with a business reason to know such information.
Appendix B Part 364 of the Federal Deposit Insurance Corporation’s regulations, Safeguards Rule, 12 CFR 364, and Part 314 of the Federal Trade Commission’s regulations, Safeguards Rule, 16 CFR 314 (collectively the “Safeguards Rule”) govern the requirements for safeguarding nonpublic personal information about consumers by both Savvy and the Third-Party Lender. These regulations implement Section V of the Gramm Leach Bliley Act.
Both Savvy and the Third-Party Lender must safeguard personal and financial information according to standards and procedures contained in its Data Security and Access Policy. All of its operational and data processing systems are stored in a secure environment. The secure environment will protect account information from being accessed by third parties.
Providing proper notice to consumers and customers in the event of a security breach is detailed in the Data Security and Access Policy.
Savvy’s CEO will approve all Privacy Notices provided to customers. Savvy’s CEO is responsible for developing, implementing and administering the Privacy Program and will report on an as-needed basis. Both Savvy and the Third-Party Lender must review this Policy at least annually to ensure it remains responsive, efficient, and effective. Additionally, Savvy’s CEO, through his/her monitoring of operational activities, will note any ongoing issues or trends and efforts shall be made to optimize and improve upon all aspects of the Policy. Savvy as servicer, will be responsible for ensuring a safe and properly secured physical environment with appropriate preventative measures to prevent unauthorized access to customer information. As needed and as applicable, Savvy must report issues related to this policy to its CEO and, if applicable, the Third-Party Lender. Savvy’s CEO will provide recommendations to Savvy on Compliance with the Privacy Program.
New Savvy Personnel will receive Privacy Program training as it relates to their job responsibilities. All affected Savvy Personnel will receive Privacy Program training annually or as necessary when changes are made to this Policy and its procedures. Savvy Personnel questions related to compliance with this Policy should be directed to Savvy’s CEO. Evidence of training will be retained and made available upon request.
Savvy’s CEO will be responsible for maintaining a record of the form of Privacy Notice used by Savvy. Savvy, as servicer, will be responsible for ensuring that Savvy servicer(s) maintain customer records that include issuance of the Privacy Notice to each customer initially and on an annual basis, any reports to the company, and a record of employee training. Refer to the Records Retention policy for more information on the manner and time period of retention. Savvy, as servicer, is responsible for monitoring the Information Systems Program and the documents and records related to the Information Security Program. Refer to the policy and the Records Retention Policy for more information. Savvy, as servicer, will coordinate maintenance of the database of all customers who exercise their right to opt-out of those information sharing practices with non-affiliates and affiliates as described in the Privacy Notice as a permanent record, in accordance with the requirements of the Privacy Rule and the FCRA.
By proceeding with an application, you, the Applicant, hereby authorize Savvy Loans to obtain your credit report and related information about you from one or more consumer reporting agencies, such as TransUnion, Equifax, or Experian. This authorization is intended to apply to your initial application and any future updates, renewals, or extensions of credit we may provide.
Your credit report will be used for the purpose of evaluating your creditworthiness, which includes, but is not limited to, verifying your identity, assessing your ability to repay the loan you are applying for, and determining the terms and interest rates that best suit your financial situation.
Savvy Loans respects your privacy. The information obtained will only be used in accordance with our Privacy Policy and applicable federal and state laws, including the Fair Credit Reporting Act. We do not sell or rent personal information to third parties.
Under the Fair Credit Reporting Act, you have the right to know the information contained in your credit report and to dispute any inaccuracies. You also have the right to obtain a free copy of your credit report from the reporting agency once every twelve months or if you have been denied credit based on information in your report.
