Effective: September 25, 2024
(Last Reviewed: 09/25/2024)
This California Consumer Privacy Act Notice at Collection ("Notice") is provided by the Wells Fargo companies described below. These companies are referred to in this Notice as "we" or "us."
This Notice explains how we collect, use, retain, and disclose personal information about California residents. The Notice also explains certain rights that California residents have under the California Consumer Privacy Act (the “CCPA”).
The CCPA only applies to information about residents of California. If you are a resident of a U.S. state other than California, you may submit a request and we may process it, as described in this Notice, even though the CCPA does not require us to do so. In accepting, processing, and responding to requests by individuals who are not California residents, we will apply all the same limitations and exceptions under the CCPA to those requests as apply to requests made by California residents. We reserve the right to change or stop the practice of accepting requests from U.S. residents of states other than California, except as otherwise required by law.
Under the CCPA, "personal information" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. This information is referred to in this Notice as "Personal Data."
Categories of Personal Data that We Collect
We collect Personal Data in a variety of contexts. For example, we collect Personal Data to provide financial products and services, for our human resources, and for vendor management purposes.
The Personal Data that we collect about a specific California resident will depend on, for example, our relationship or interaction with that individual.
During the past 12 months, we have collected the following categories of Personal Data.
- Personal Identifiers — Personal unique identifiers, such as full name and federal or state issued identification numbers, including Social Security number, driver’s license number, and passport number
- Personal Information — Personal information, including contact details (e.g., telephone number and address), financial information (e.g., account number and balance), payment card details (e.g., credit and debit card numbers), and medical and health insurance information
- Characteristics of Protected Classes — Characteristics of protected classes or groups under state or federal law, such as sex, disability, citizenship, primary language, immigration status, and marital status
- Purchase Information — Purchase information, such as products and services obtained and transaction histories
- Biometric Information — Biometric information, such as fingerprints and voiceprints
- Internet or Online Information — Internet or online information (e.g., browsing history), including information about interaction with our websites, applications, or advertisements
- Geolocation Data — Geolocation data, such as device location
- Audio and Visual Information — Audio, electronic, visual, thermal, olfactory, or similar information, such as call and video recordings
- Employment Information — Professional or employment-related information, such as work history, information from background checks, resumes, and personnel files, personal qualifications, training, and work preference, payroll and benefit information, leave and absence information, and performance and disciplinary information
- Education Information — Education information subject to the federal Family Educational Rights and Privacy Act, such as student records and confirmation of graduation; and
- Inferences — Inferences based on information about an individual to create a summary about, for example, an individual’s preferences and characteristics; and
- Sensitive Personal Information —
- Social Security number, driver’s license, state identification card, or passport number;
- Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
- Precise geolocation;
- Racial or ethnic origin, religious or philosophical beliefs, citizenship, immigration status, or union membership;
- The contents of mail, email, and text messages unless we are the intended recipient of the communication;
- Biometric information processed to uniquely identify an individual; and
- Health information, sexual orientation.
Sources of Personal Data
The sources from which we collect Personal Data depend on, among other things, our relationship or interaction with a specific California resident. The information below lists the categories of sources from which we collect Personal Data in different contexts.
- From California residents directly, or other individuals acting on their behalf, through, for example, physical (e.g., paper application), audible (e.g., phone), and electronic (e.g., website, social media) sources.
- Public records or widely available sources, including information from the media, and information that is made available by federal, state, and local government entities.
- Outside companies or organizations that provide data to support activities such as fraud prevention, underwriting, and marketing. Examples may include internet service providers, social networks, data brokers, advertising networks, and data analytics providers
- Outside companies or organizations from whom we collect Personal Data to support human resource and workforce management activities. Examples may include service providers and social networks.
- Outside companies or organizations from whom we collect Personal Data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples include companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.
Why We Collect Personal Data and How We Use It
The purposes for which we collect, use, and disclose Personal Data depend on, among other things, our relationship or interaction with a specific California resident. The table below lists the purposes for which we collect, use, and disclose Personal Data in different contexts.
Purposes for Collection, Use and Disclosure
| Examples
|
Provide and manage products and services
| - Establish and process transactions for our products and services, including checking accounts, credit cards, loans, investment accounts, commercial financing, and payment services
- Support the ongoing management and maintenance of our products and services, including to provide account statements, online banking access, customer service, payments and collections, and account notifications
- Obtain support for fulfilling the above purposes from our third-party service providers, professional services and business partners, and financial institutions
|
Support our everyday operations, including to meet risk, legal, and compliance requirements
| - Perform accounting, monitoring, and reporting
- Enable information security and anti-fraud operations, as well as credit, underwriting and due diligence
- Support audit and investigations and legal requests and demands, as well as exercise and defend legal claims
- Enable the use of service providers for business purposes
- Comply with laws, regulations, policies, procedures, and contractual obligations
- Obtain support for fulfilling the above purposes from our third-party service providers, professional services and business partners, and financial institutions
- Operate and manage IT and communications systems and facilities, and allocate company assets
|
Manage, improve, and develop our business
| - Market, personalize, develop, and improve our products and services
- This includes “sharing” Personal Data for purposes of delivering tailored advertising on third party websites, applications or services (also known as cross-context behavioral advertising)
- Conduct research and analysis, including for product and services innovation
- Support customer relationship management
- Evaluate and engage in mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets
- Obtain support for fulfilling the above purposes from our service providers and from our professional services, business, and marketing partners
|
Support employment, infrastructure, and human resource management
| - Provide benefits to employees and dependents, including healthcare and retirement plans
- Manage pay and compensation activities
- Manage attendance, time keeping, leaves of absence, and vacation
- Manage and operate our facilities and infrastructure, including conducting risk and security control and monitoring activities
- Recruit new employees, process employment applications, and onboard new employees
- Perform identity verification, accounting, budgeting, audit, and other internal functions, such as internal investigations, disciplinary matters, and handling grievances and terminations
- Operate and manage IT and communications systems and facilities, allocate company assets and human resources, and undertake strategic planning and project management
- Conduct research, analytics, and data analysis, such as to assist in succession planning and to ensure business continuity
- Obtain support for fulfilling the above purposes from our third-party service providers, professional services and business partners
|
| Sensitive Personal Information as permitted by law | - Perform services for our business, provide goods or services as requested by individuals
- Detect and investigate security incidents
- Short term transient use such as displaying first party, non-personalized advertising
- Process and fulfil orders, maintain and service accounts, provide customer service, verify customer information, process payments, and provide financing
- Activities relating to quality and safety control or product improvement
- To support employment, infrastructure, and human resource management
- Countering wrongful or unlawful actions
- Other collection and processing, as permitted by law, without inferring characteristics about an individual
|
Categories of Third Parties and Our Disclosure and Sharing of Personal Data
The categories of third parties to whom we disclose or share Personal Data about a specific individual depend on, among other things, our relationship or interaction with a specific California resident. Such third parties include:
- Outside companies or organizations, including service providers, to whom we disclose Personal Data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples may include internet service providers, social networks, operating systems and platforms, advertising networks, and data analytics providers; companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.
- Companies or individuals that represent California residents such as an accountant, financial advisor, or person holding power of attorney on behalf of a California resident
- Government agencies, including to support regulatory and legal requirements
- Outside companies or organizations, including service providers, to whom we provide Personal Data to support human resource activities and workforce management. Examples may include recruiting, training, data analytics, and employee benefits providers
- Outside companies or organizations, in connection with routine or required reporting, including consumer reporting agencies and other parties
- Third-party marketing and advertising technology providers, advertising partners, and social media platforms, in connection with our cross-context behavioral advertising activities
Wells Fargo did not sell or share personal data within the 12 months prior to the date of this notice. The table below shows, for each Personal Data category we have collected, the categories of third parties to whom we disclosed Personal Data for our business purposes during the preceding 12 months and the categories of third parties with whom we may share Personal Data for purposes of cross-contextual behavioral advertising as of the effective date of this Notice. The table below contains briefer descriptions of the categories of Personal Data and third parties. The full descriptions of the categories of Personal Data and third parties are available above.
| Personal Data Type | Third Party Category to Whom We Disclosed Personal Data for Business Purposes | Third Party Category with Whom We May Share Personal Data for Cross-Context Behavioral Advertising |
| Personal Identifiers | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| - Third-party marketing and advertising technology providers
- Third-party advertising partners including social media platforms
- Data analytics providers
|
| Personal Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| - Third-party marketing and advertising technology providers
- Third-party advertising partners including social media platforms
|
| Characteristics of Protected Classes | | |
| Purchase Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| - Third-party marketing and advertising technology providers
- Third-party advertising partners including social media platforms
- Data analytics providers
|
| Biometric Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Outside organizations in connection with human resource activities and workforce management
| |
| Internet or Online Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| - Third-party marketing and advertising technology providers
- Third-party advertising partners including social media platforms
- Data analytics providers
|
| Geolocation Data | | - Third-party marketing and advertising technology providers
- Third-party advertising partners including social media platforms
|
| Audio and Visual Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
| |
| Employment Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| |
| Education Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| |
| Inferences | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| - Third-party marketing and advertising technology providers
- Third-party advertising partners including social media platforms
- Data analytics providers
|
| Sensitive Personal Information | - Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development
- Representatives of California residents
- Government agencies
- Outside organizations in connection with human resource activities and workforce management
- Outside companies in connection with routine or required reporting
| |
Data Retention
We will keep Personal Data, including Sensitive Personal Information, no longer than reasonably necessary to fulfil the purposes described in this Notice. Under records and information management policy, we are required to destroy records containing Personal Data, including Sensitive Personal Information, according to specific periods in our retention schedule. However, we may need to hold such records beyond these retention periods as set forth in our record retention policy, due to regulatory requirements or in response to a regulatory audit, investigation, or other legal matter.
Requests Under the CCPA
The CCPA defines a “sale” as the disclosure of Personal Data for monetary or other valuable consideration. Wells Fargo does not sell and has not, within the last 12 months, sold Personal Data, including Sensitive Personal Information. Furthermore, we have no actual knowledge that we sell or share (for purposes of cross-context behavioral advertising) Personal Data, including Sensitive Personal Information, of minors under 16 years of age.
If you are a California resident, you have the right to request that we:
- Disclose to you the following information ("Request to Know"):
- The categories of Personal Data we collected about you and the categories of sources from which we collected the Personal Data;
- The business or commercial purpose for collecting or sharing Personal Data about you;
- The categories of third parties to whom we disclosed Personal Data about you, and the categories of Personal Data disclosed;
- The categories of Personal Data about you that we shared and the categories of third parties with whom we shared such Personal Data; and
- The specific pieces of Personal Data we collected about you.
- Delete Personal Data we collected from you ("Request to Delete").
- Correct inaccurate personal information that we maintain about you ("Request to Correct").
- Opt you out of "sharing", for purposes of cross-context behavioral advertising, ("Request to Opt-Out of Sharing").
In addition, you have the right to be free from discrimination by a business for exercising your CCPA privacy rights, including the right as an employee, applicant, or independent contractor not to be retaliated against for exercising your CCPA privacy rights.
View Wells Fargo's CCPA record-keeping details in the annual disclosure.
How to Make Requests
If you are a California resident, you can make a Request to Know, Delete, or Correct by:
- Contacting us at 1-844-774-9229; or
- Submitting your request at www.wellsfargo.com/privacycenter/.
Wells Fargo Online® customers and Wells Fargo employees: you can make a request by using your existing Wells Fargo log-in credentials.
For all other individuals, we will ask you to provide the following information to identify yourself:
- Name, contact information, Social Security or individual taxpayer identification number, and date of birth; and
- A copy of a government-issued photo ID. We accept your driver’s license, state ID, or matricula card.
When you make a Request to Know, Delete, or Correct, we will attempt to verify that you are who you say you are. For example, we will attempt to match information that you provide in making your Request with other sources of similar information to reasonably verify identity.
To make a Request to Opt-Out of Sharing, click here . We also process opt-out preference signals, such as the Global Privacy Control, as required by the CCPA. These signals set the opt out of sharing preferences for the specific browser or device you are using. For information about how to use the Global Privacy Control, please visit https://globalprivacycontrol.org/ .
Responding to Requests
Privacy and data protection laws, other than the CCPA, apply to much of the Personal Data that we handle. When these other laws apply, Personal Data may be exempt from, or outside the scope of, a request to Know, Delete, or Correct. For example, information subject to certain federal privacy laws, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability, is exempt from CCPA Requests. As a result, we may decline all or part of your Request to the extent that it relates to exempt Personal Data. This means that we may not provide, delete, correct, or opt-out some, or all, of this Personal Data when you make a CCPA Request.
As examples, our processing of, or response to, a CCPA Request may not include some or all of the following Personal Data:
- Consumer Accounts. Personal Data related to consumer accounts used for personal, family, or household purposes and applications for such accounts. We have other privacy notices providing certain information on use and sharing of this data, for example, the Wells Fargo U.S. Consumer Privacy Notice, available at www.wellsfargo.com/privacy-security.
The types of Personal Data described above are examples. We have not listed all types of Personal Data that may not be included when we respond to or process CCPA Requests.
In addition to the above examples, we may not include Personal Data when we respond to or process CCPA Requests when the CCPA recognizes another exception. For example, we will not provide the Personal Data about another individual when doing so would adversely affect the data privacy rights of that individual. As another example, we will not delete Personal Data when it is necessary to maintain that Personal Data to comply with a legal obligation.
We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Data subject to the request.
Authorized Agents
If you are a California resident, you may authorize an agent to make a request on your behalf. A California resident's authorized agent may make a request on behalf of the California resident by using the submission methods listed above under “How To Make Requests.” As part of our verification process, we may request that you provide, as applicable:
- For an individual ("requestor") making a request on behalf of a California resident:
- The requestor's name; contact information; Social Security or individual taxpayer identification number; date of birth; and driver’s license, state ID, or matricula card.
- The name; contact information; Social Security or individual taxpayer identification number; date of birth; and driver’s license, state ID, or matricula card of the California resident on whose behalf the request is being made.
- A document to confirm that the requestor is authorized to make the request. We may accept, as applicable, a signed permission by the California resident on whose behalf the request is made, a copy of a power of attorney, legal guardianship or conservatorship order, or a birth certificate of a minor if the requestor is the custodial parent.
- For a company or organization ("legal entity requestor") making a request on behalf of a California resident:
- Proof that the California resident has authorized the legal entity requestor to make the request. We may accept as applicable, a signed permission by the California resident on whose behalf the request is made, copy of power of attorney, or legal guardianship or conservatorship order.
- The name; contact information; Social Security or individual taxpayer identification number; date of birth; and driver’s license, state ID, or matricula card of the California resident on whose behalf the request is being made. From the individual who is acting on behalf of the legal entity requestor, proof that the individual is authorized by the legal entity requestor to make the request. We accept a letter on the legal entity requestor's letterhead, signed by an officer of the organization. We provide a template to use via the URL provided above for making requests.
Deidentified Information
Where we maintain or use deidentified information, we will continue to maintain and use the deidentified information in a deidentified fashion and will not attempt to re-identify the information.
Changes to this Notice
We may change or update this Notice periodically. When we do, we will post the revised Notice on this webpage indicating when the Notice was "Last Updated."
Wells Fargo Companies Providing this Notice
This Notice is provided by Wells Fargo and Company and its subsidiaries that either: (1) act as a business within the meaning of the CCPA, or (2) are controlled by Wells Fargo and Company and use the Wells Fargo name. As an example, companies providing this Notice include Wells Fargo Bank, N.A.
Contact Us
If you have any questions or concerns about Wells Fargo’s privacy policies and practices, please contact us at PrivacyCenter@wellsfargo.com. Please do not use this email address to send sensitive information or account-specific questions; instead call 1-800-TO-WELLS (1-800-869-3557) with any account-specific questions.
Sign On 