Online Privacy Policy for California Residents

This Online Privacy Policy for California Residents supplements the information contained in SoFi’s Online Privacy Policy and applies solely to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”). This Online Privacy Policy for California Residents is being provided by Social Finance, Inc. and its wholly owned affiliates (collectively, “SoFi”, “we”, or “us”).

Applicability

This Online Privacy Policy for California Residents explains how SoFi collects, uses, and discloses personal information relating to California residents covered by the CCPA. Under the CCPA, “Personal Information” is any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household. Personal information does not include:

• Publicly available information form government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA’s scope, like:
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach Bliley Act (“GLBA”) or California Financial Information Privacy Act (“FIPA”), and the Driver’s Privacy Protection Act of 1994

For more information about how we collect, disclose, and secure information not covered by the CCPA please review SoFi’s Online Privacy Policy and SoFi’s GLBA Privacy Notice.

Categories Of Information We Collect, Sell, Or Disclose For A Business Purpose

In the previous twelve (12) months we have collected the following categories of personal information from consumers. This list also shows the categories of information we have sold in the previous twelve (12) months and the categories of information we have disclosed for a business purpose in the previous twelve (12) months.

Sources of Personal Information

We obtain the personal information listed above from the following categories of sources:

• Directly from you or your authorized agents. For example, from forms you complete or from communications you have with SoFi.
• Indirectly from you. For example, from your actions on our website (www.sofi.com) or our mobile application.
• SoFi Wealth, LLC
• Affiliates within the SoFi family of companies
• Service Providers, consumer data resellers, and other third parties
• Public record sources

The Business Purposes For Which We Collect Or Sell Your Personal Information

We may collect or disclose personal information for the following business purposes:

• Performing financial services, such as reviewing your applications, processing transactions, fulfilling orders, verifying customer information, processing payments, product development analytics, and providing advertising or marketing services
• To communicate with you by telephone calls, push notifications, text message, and email
• Fraud prevention, detecting security incidents, protecting against illegal activity
• As required to comply with applicable laws and regulations, including responding to law enforcement requests

The Categories Of Third Parties With Whom We Share Your Personal Information

Below is a list of third parties to whom we may disclose your personal information:

• Affiliates within the SoFi family of companies
• Service providers and vendors who provide services such as data analytics, servicing of loans, payment processing, order fulfillment, customer service, auditing, marketing services, and IT services
• Third party security providers to help us prevent and detect fraud, security or technical issues, or illegal activity
• Marketing partners

Your Rights And Choices Under The CCPA

Your Right To Know:

Under the CCPA you can request free of charge the following information covering the 12 months preceding your request:

• The categories of personal information we have collected about you
• The categories of sources from which the personal information was collected
• The business purpose for collecting or selling personal information
• The categories of third parties with whom we shared personal information
• The specific pieces of personal information we have collected about you

• If we sold your personal information, or disclosed it for a business purpose, two separate lists:

  • The categories of personal information that were disclosed for a business purpose; and
  • The categories of information that we sold to third parties (SoFi does not sell information of California residents)

  • Your Right To Request Deletion

    You have the right to request we delete the personal information we collected from you, unless the CCPA recognizes an exception.

    How To Exercise Your Rights We will need to verify your identity before processing most requests, which may require you to provide additional information. In some instances, we may not be able to honor your request, such as when an exception applies or when we cannot verify your identity.

    You may submit a request by using our self-service Personal Information Request Form and our Deletion Request Form, or by calling us at 1-855-456-SOFI (7634).

    All requests for Your Right To Know will be honored within forty-five (45) days of receipt, unless we are unable to process your request in such a time, in which case we will provide you an explanation for the delay

    The Right To Non-Discrimination

    You will not be discriminated against in any way for exercising your rights under the CCPA, including but not limited to:

    • Denying you goods or services
    • Charging you different prices or rates
    • Providing you with a lesser quality of goods or services
    • Suggesting any of the foregoing

    Changes And Modifications

    SoFi may change or update this Online Privacy Policy for California Residents at any time. Your continued use of our website following the posting of changes constitutes your continued acceptance of such changes.