Privacy Policy & Consumer Privacy Notice

1. Our Federal Privacy Notice (GLBA)

As a financial institution, we are required by the Gramm-Leach-Bliley Act to explain how we collect, share, and protect your nonpublic personal information (NPI). Federal law gives consumers the right to limit some but not all sharing. The types of personal information we collect and share depend on the product or service you have with us and can include:

• Social Security number and government-issued identification
• Income, employment history, and assets
• Credit history, credit scores, and payment history
• Account balances and transaction history
• Property information and loan details

We do not sell your nonpublic personal information. We share it only as permitted by law: to process your loan with lenders and settlement service providers, for our everyday business purposes, to comply with legal requirements, and with your consent.

2. Information We Collect

We collect information you provide directly to us, information collected automatically, and information from third parties:

• Identity data: name, date of birth, Social Security number, government ID numbers, marital status
• Contact data: mailing address, email address, phone number
• Financial data: income, employment, assets, liabilities, credit reports and scores, bank statements, tax returns
• Property data: subject property address, value, occupancy, and transaction details
• Usage data: IP address, browser type, device identifiers, pages visited, and interactions with our website (collected via cookies and similar technologies)
• Third-party data: information from credit reporting agencies, verification services, title/escrow companies, and real estate professionals involved in your transaction

3. How We Use Your Information

• Originate, process, underwrite, and broker your mortgage loan application
• Obtain credit reports and verify identity, income, employment, and assets (with your authorization, as required by the Fair Credit Reporting Act)
• Communicate with you about your application, rates, and our services
• Comply with federal and state legal and regulatory obligations, including TRID, RESPA, HMDA reporting, ECOA, BSA/AML, and state licensing laws
• Detect and prevent fraud, identity theft, and unauthorized activity
• Maintain records as required by law (loan records are generally retained for a minimum of 3–5 years, or longer where required)
• Improve our website and services

4. How We Share Your Information

We share personal information only as necessary and as permitted by law with:

• Wholesale lenders and investors to whom your loan application is submitted
• Credit reporting agencies and verification vendors
• Title, escrow, appraisal, insurance, and other settlement service providers involved in your transaction
• Federal and state regulators, and government agencies as required by law (e.g., HMDA reporting to the CFPB)
• Service providers who support our operations under confidentiality obligations
• Parties you authorize, such as your real estate agent

We do not sell personal information, and we do not share personal information with nonaffiliated third parties for their own marketing purposes.

5. California Residents — CCPA/CPRA Notice

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, provides you specific rights regarding personal information not already covered by the GLBA exemption (most information collected in connection with a loan application is exempt under Cal. Civ. Code § 1798.145(e)). For non-exempt personal information (such as website usage data), you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Delete — request deletion of your personal information, subject to legal retention requirements
• Correct — request correction of inaccurate personal information
• Opt-Out — opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as defined by the CCPA)
• Limit — limit the use of sensitive personal information
• Non-Discrimination — not receive discriminatory treatment for exercising your privacy rights

To exercise these rights, contact us at team@cdlmtg.com or (916) 624-0767. We will verify your identity before responding and will respond within 45 days as required by law. You may designate an authorized agent to make a request on your behalf.

6. Texas Residents — TDPSA Notice

If you are a Texas resident, the Texas Data Privacy and Security Act provides rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling. Data collected subject to the GLBA is exempt from the TDPSA. We do not engage in the sale of personal data or targeted advertising. To exercise applicable rights, contact us using the information in Section 12. If we decline your request, you may appeal by replying to our decision, and we will respond to your appeal within 60 days.

7. Other State Privacy Rights (Georgia, Tennessee, Oklahoma, Idaho)

Residents of Tennessee are protected under the Tennessee Information Protection Act (effective July 1, 2025), which provides rights similar to those described above for non-GLBA data. Residents of Georgia, Oklahoma, and Idaho are protected by their states' data breach notification and financial privacy laws. Regardless of your state of residence, we apply the GLBA safeguards described in this policy to all customer nonpublic personal information, and we will honor verified requests to access or correct your information where required by applicable law.

8. Data Security (GLBA Safeguards Rule)

We maintain a written information security program in accordance with the FTC Safeguards Rule (16 CFR Part 314), including administrative, technical, and physical safeguards: encryption of sensitive data at rest and in transit, multi-factor authentication for system access, role-based access controls, secure document handling, employee security awareness, and vendor oversight. Social Security numbers and payment information are encrypted and displayed only in masked form. In the event of a data breach affecting your personal information, we will notify you and applicable state regulators as required by the breach notification laws of your state.

9. Fair Credit Reporting Act (FCRA)

We obtain consumer credit reports only with your written authorization and for permissible purposes under the FCRA. You have the right to know if information in your credit file was used against you, to dispute inaccurate information with the credit bureaus, and to obtain a free annual credit report at annualcreditreport.com. If adverse action is taken based on your credit report, you will receive the required notice identifying the credit reporting agency used.

10. Cookies, Analytics, and Communications

Our website uses cookies and similar technologies for essential functionality and analytics. You can control cookies through your browser settings. If you provide your phone number, you consent to receive calls and text messages related to your inquiry or application; consent to marketing texts is never a condition of obtaining a loan, and you may opt out at any time by replying STOP (Telephone Consumer Protection Act). Email communications include an unsubscribe option where required by the CAN-SPAM Act.

11. Children's Privacy & Changes to This Policy

Our services are not directed to individuals under 18, and we do not knowingly collect information from children. We may update this Privacy Policy from time to time; material changes will be reflected by an updated "Last Updated" date, and, where required by law, we will provide additional notice. Continued use of our services after changes constitutes acceptance of the revised policy.

12. Contact Us

To exercise your privacy rights, or with questions about this policy or our data practices, contact:

• CDL Mortgage Services Inc. — Privacy Officer
• 📞 (916) 624-0767
• 📧 team@cdlmtg.com
• NMLS #132263 · DRE #01118984 — verify at nmlsconsumeraccess.org