The California Consumer Privacy Act (CCPA)

Your rights and choices under the CCPA

The California Consumer Privacy Act (CCPA) provides consumers (California residents) with specific rights regarding their personal information, subject to certain exceptions defined in the CCPA and other applicable laws and regulations. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right, subject to certain exceptions defined in the CCPA and other applicable laws and regulations, to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
  

Deletion Request Rights

You have the right, subject to certain exceptions defined in the CCPA and other applicable laws and regulations, to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

• Email: privacyoffice@statestreet.com
• Website: http://www.statestreet.com/contact-us.html
  
• Postal Address: State Street Bank & Trust Company One Congress Street, Boston, MA 02114-2016

Attn: Privacy Office

Once we receive a request from you, we will first verify your identity.

If you are a client and have an account with us, we will verify your identity by either allowing you to use our existing authentication practices or by asking you to provide your account number, address and utility bill and matching them with data points we have on file.

If you are not an accountholder, we will verify your identity by asking you to provide your email address, home address and utility bill and matching them with data points we have on file. We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm the personal information relates to you or whether you, as an agent, have the authority to make the request on behalf of another.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

Authorized Agent

Only you, or a person you have designated in writing as your authorized agent, or whom is registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

To designate an agent, please provide a written and signed document by both you and the agent that authorizes the agent to act on your behalf (including a power of attorney). We will still require you to provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information.