1. Overview
This State-Specific Privacy Rights Notice supplements our Privacy Notice with additional rights and disclosures that apply to residents of certain U.S. states with comprehensive consumer-privacy laws. If you are a resident of one of the states listed below, the rights described in your state's section apply to you in addition to the protections described in the main Privacy Notice.
This Notice is provided in accordance with the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), the Montana Consumer Data Privacy Act ("MCDPA"), the Iowa Consumer Data Protection Act ("ICDPA"), the Tennessee Information Protection Act ("TIPA"), and equivalent state laws in effect from time to time.
2. Important note: financial-privacy laws and state privacy laws
Most U.S. state consumer-privacy laws (including those listed above) exempt personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations, or by financial institutions subject to GLBA, from the scope of the state law. Personal information about you that PayServices Bank handles in connection with a financial product or service is therefore generally subject to GLBA and our Privacy Notice, not to state consumer-privacy laws.
This Notice describes the rights that apply to the limited subset of personal information about state residents that is not covered by GLBA — for example, personal information collected from a website visitor who is not (yet) a customer, or personal information used for marketing purposes that fall outside GLBA's scope.
3. California (CCPA/CPRA)
If you are a California resident, you have the following rights with respect to your personal information that is not exempt under GLBA:
- Right to know. You may request that we disclose to you the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for which the information is collected, and the categories of third parties with whom we share or disclose it.
- Right to delete. You may request that we delete personal information we have collected from you, subject to certain exceptions (including legal-retention obligations).
- Right to correct. You may request that we correct inaccurate personal information about you.
- Right to opt out of sale or sharing. We do not sell personal information for monetary value, and we do not share personal information for cross-context behavioral advertising. You may exercise the right to opt out at any time using the "Do Not Sell or Share My Personal Information" link.
- Right to limit use of sensitive personal information. You may direct us to limit our use of sensitive personal information to purposes specified in CCPA § 1798.121.
- Right to non-discrimination. We will not discriminate against you for exercising any of these rights.
Categories of personal information. In the past 12 months, we have collected the following CCPA categories of personal information for the purposes set out in our Privacy Notice: identifiers (e.g., name, email, account number); customer records (CCPA § 1798.80); commercial information (transactions); internet/network activity (server logs); geolocation; financial information; and inferences drawn from the above. We do not collect biometric, genetic, racial, religious, sexual, or trade-union information except where strictly necessary for KYC/identity-verification or AML/sanctions compliance.
How to exercise. Submit a request via info@payservices.com, or by mail to PayServices Bank, Attn: Privacy, 950 W Bannock Street, Suite 1100, Boise, Idaho 83702-6140. We respond within 45 days, with a 45-day extension permitted where necessary. We may need to verify your identity before processing your request.
Authorized agents. You may designate an authorized agent to make a request on your behalf, in accordance with CCPA § 1798.135 and 11 CCR § 7063. We will require proof of the agent's authority and may require you to confirm the request directly.
Metrics. CCPA requires us to publish annual metrics on requests received, granted, and denied if we meet certain thresholds. The current metrics are published at itam.world/state-privacy.
4. Virginia (VCDPA)
If you are a Virginia resident, you have the rights to confirm processing, access, correct, delete, and obtain a portable copy of your personal data, and to opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. Submit a request via info@payservices.com. We respond within 45 days. If we deny a request, you may appeal our decision by replying to our denial notice; we will respond to the appeal within 60 days.
5. Colorado (CPA)
If you are a Colorado resident, you have the rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects. Submit a request via info@payservices.com. We honor universal opt-out mechanisms (such as the Global Privacy Control browser signal) where required by Colorado regulation.
6. Connecticut (CTDPA)
If you are a Connecticut resident, you have the same categories of rights described above for Colorado. Submit a request via info@payservices.com. We honor universal opt-out signals as required.
7. Utah (UCPA)
If you are a Utah resident, you have the rights to access, delete, obtain a portable copy of your personal data, and opt out of targeted advertising and the sale of personal data. The UCPA does not provide a right to correct or a right to opt out of profiling. Submit a request via info@payservices.com.
8. Texas, Oregon, Montana, Iowa, Tennessee, and other states
If you are a resident of Texas, Oregon, Montana, Iowa, Tennessee, or any other U.S. state with a comprehensive consumer-privacy law in effect, you have rights similar to those described above, with variations in scope, thresholds, and procedure. Submit a request via info@payservices.com and identify your state; we will process the request under the applicable state law.
The list of state laws covered by this Notice is updated as new laws come into effect. The current list as of the date of this Notice includes the laws referenced in Section 1.
9. Sensitive personal information / sensitive data
Several state laws (CCPA/CPRA, VCDPA, CPA, CTDPA, OCPA, MCDPA, TIPA, and others) define a category of "sensitive personal information" or "sensitive data" that includes information such as government-issued identifier numbers, financial-account credentials, precise geolocation, racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sex life or sexual orientation, biometric data processed for the purpose of uniquely identifying a natural person, and genetic data. We process such information only as strictly necessary to comply with our legal obligations (including KYC, AML, sanctions, and beneficial-ownership rules), and only with appropriate safeguards. You may direct us to limit our use of sensitive personal information as described in your state's section above.
10. Contact us
For all state-privacy requests, complaints, or questions:
PayServices Bank — Privacy
950 W Bannock Street, Suite 1100
Boise, Idaho 83702-6140
United States
info@payservices.com