This California Consumer Privacy Act Notice ("Notice") explains how Allspring Global Investments (and all its direct and indirect subsidiaries) (“Allspring”) collects, uses, and discloses personal information about California resident. The Notice also explains certain rights that California residents have under the California Consumer Privacy Act ("CCPA"). For example, this Notice explains how California residents can exercise their rights under the CCPA to request that we: (1) provide certain personal information that we have collected about them during the past 12 months, along with related information described below, or (2) delete certain personal information that we have collected from them. The CCPA only applies to information about residents of California.
Under the CCPA, "personal information" is information that identifies, relates to, or could reasonably be linked with a particular California resident or household. This information is referred to in this Notice as "Personal Data."
Categories of personal data that we collect
We collect Personal Data in a variety of contexts. For example, we collect Personal Data to provide individual and commercial financial products and services, and for our employment and human resource purposes. The Personal Data that we collect about a specific California resident will depend on, for example, our relationship or interaction with that individual.
During the past 12 months, we have collected the following categories of Personal Data:
- Personal Identifiers - Personal unique identifiers, such as full name and federal or state issued identification numbers including Social Security number, driver's license number, and passport number
- Personal Information - Personal information, including contact details such as telephone number and address, financial information such as account number and balance, payment card details including credit and debit card numbers, as well as medical and health insurance information
- Characteristics of Protected Classes - Characteristics of protected classes or groups under state or federal law, such as sex or marital status
- Purchase Information - Purchase information, such as products and services obtained and transaction histories
- Biometric Information - Biometric information, such as fingerprints and voiceprints
- Internet or Online Information - Internet or online information such as browsing history, and information regarding interaction with our websites, applications, or advertisements
- Geolocation Data - Geolocation data, such as device location
- Audio and Visual Information - Audio, electronic, visual, thermal, olfactory, or similar information, such as call and video recordings
- Employment Information - Professional or employment-related information, such as work history and prior employer
- Education Information - Education information, such as school and related information; and
- Inferences - Inferences based on information about an individual to create a summary about, for example, an individual's preferences and characteristics
Why we collect personal data and how we use it
The purposes for which we collect and use Personal Data depend on, among other things, our relationship or interaction with a specific California resident. The purposes for which we collect and use Personal Data include:
- Establish and process transactions for our products and services including investment accounts
- Support the ongoing management and maintenance of our products and services including to provide account statements, customer service, and account notifications
- Perform accounting, monitoring, and reporting
- Enable information security and anti-fraud operations, as well as credit, underwriting, and due diligence
- Support audit and investigations, legal requests and demands, as well as exercise and defend legal claims
- Enable the use of service providers for business purposes
- Comply with policies, procedures, and contractual obligations
- Market, personalize, develop, as well as improve our products and services
- Conduct research and analysis, including to drive product and services innovation
- Support customer relationship management
- Evaluate and engage in mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets
- Process employment applications
Sources of personal data
The sources from which we collect Personal Data depend on, among other things, our relationship or interaction with a specific California resident. The information below lists the categories of sources from which we collect Personal Data in different contexts.
- From California residents directly, or other individuals acting on their behalf, through physical (e.g., paper application), audible (e.g., phone), or electronic (e.g., website, social media) sources.
- Public records or widely available sources, including information from the media, and other records and information that are made available by federal, state, or local government entities.
- Outside companies or organizations that provide data to support activities such as fraud prevention, underwriting, and marketing. Examples may include internet service providers, social networks, operating systems and platforms, data brokers, advertising networks, and data analytics providers
- Outside companies or organizations from whom we collect Personal Data to support human resource and workforce management activities. Examples may include operating systems and platforms, and social networks.
- Outside companies or organizations from whom we collect Personal Data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples include companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.
Categories of third parties and our disclosure of personal data
The categories of third parties to whom we disclose Personal Data about a specific individual depend on, among other things, our relationship or interaction with a specific California resident. During the past 12 months, we have disclosed for our business purposes the eleven categories of Personal Data listed above to the following categories of third parties:
- Outside companies or organizations, including service providers subject to appropriate confidentiality and use restrictions, to whom we disclose Personal Data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development.
- Companies or individuals that represent California residents such as an accountant, financial advisor, or person holding power of attorney on behalf of a California resident
- Government agencies including to support regulatory and legal requirements
- Outside companies or organizations, including service providers subject to appropriate confidentiality and use restrictions, to whom we provide Personal Data to support human resource activities and workforce management. Examples may include operating systems and platforms and data analytics providers
- Outside companies or organizations, in connection with routine or required reporting, including consumer reporting agencies and other parties
Requests Under the CCPA
If you are a California resident, you have the right to request that we:
- Disclose to you the following information covering the 12-month period prior to your request ("Access Request"):
- The categories of Personal Data we collected about you and the categories of sources from which we collected the Personal Data
- The business or commercial purpose for collecting Personal Data about you
- The categories of third parties to whom we disclosed Personal Data about you, and the categories of Personal Data disclosed
- The specific pieces of Personal Data we collected about you
- Delete Personal Data we collected from you ("Deletion Request").
Responding to Requests
Privacy and data protection laws, other than the CCPA, apply to much of the Personal Data that we collect, use, and disclose. When these laws apply, Personal Data may be exempt from, or outside the scope of, Access Requests and Deletion Requests. For example, information subject to certain federal privacy laws, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability, is exempt from CCPA Requests. As a result, in some instances, we may decline all or part of an Access Request or Deletion Request related to Personal Data exempt from CCPA Requests. This means that we may not provide some or all this Personal Data when you make an Access Request. Also, we may not delete some or all of this Personal Data when you make a Deletion Request.
As examples, our processing of or response to an Access Request or Deletion Request may not include some or all of the following Personal Data:
- Consumer Accounts - Personal Data connected with consumer accounts used for personal, family, or household purposes-. We have other privacy notices providing certain information on use and sharing of this data
- Employment - Personal Data about an individual who is a current or former employee or job applicant, and we use that Personal Data within the context of that individual's role as a current or former employee or job applicant
- Business-to-Business Relationship - Certain Personal Data we collect while providing a product or service to another business, or while receiving a product or service from another business
The types of Personal Data described above are examples. We have not listed all types of Personal Data that may not be included when we respond to or process Access Requests or Deletion Requests. In addition to the above examples, we may not include Personal Data when we respond to or process Access Requests or Deletion Requests when the CCPA recognizes another exception. For example, we will not provide the Personal Data about another individual where doing so would adversely affect the data privacy rights of that individual. As another example, we will not delete Personal Data when it is necessary to maintain that Personal Data to comply with a legal obligation.
How to Make Requests
If you are a California resident, you can make an Access Request or a Deletion Request by submitting your request to AllspringPrivacy@allspring-global.com.
Notice updates and effective date
This Notice may be modified as a result of amendments to the law or regulations or due to other reasons. Any updates to this Notice will become effective when we post the updates on the Allspring website.