Privacy Policy for California Residents

Privacy Policy for California Residents

Last updated on January 1, 2020

This Privacy Policy for California Residents supplements the information contained in Zenith’s Privacy Statement and any other privacy notices previously provided to you.  This policy applies solely to natural persons who are residents in the State of California (“consumers” or “you”).  We adopt this policy to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this policy. Please note that if you are an employee or job applicant of Zenith, you may not have all of the rights described below (such as the right to request deletion and the right to request categories of personal information).  All Zenith employees should review Zenith’s Employee Handbook for further guidance on their CCPA rights. Where noted in this Policy, the CCPA temporarily exempts personal information reflecting a written or verbal business-to-business communication (“B2B personal information”) from some of its requirements.

Information We Collect

As insurance companies that write workers’ compensation insurance and commercial property and casualty insurance, we collect personal information about you when it is necessary to conduct the business of insurance.  Depending upon the nature of our relationship with you, the categories of personal information we collect may differ.

In general, we will have collected the following categories of personal information from consumers within the last twelve (12) months:

Category

Examples

A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.

Collected

YES

Business Purpose

  • Communicating with you
  • Underwriting your policy
  • Administering or investigating a claim
  • Making payments to you
  • Honoring our contractual obligations
  • Improving our products and services
  • Security Purposes
  • Complying with law
  • Credentialing of providers
  • Reviewing your employment application
  • Due diligence for contracting purposes

Examples

A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

Collected

YES

Business Purpose

  • Communicating with you
  • Underwriting your policy
  • Administering or investigating a claim
  • Making payments to you, taking payments from you
  • Honoring our contractual obligations
  • Improving our products and services
  • Security Purposes
  • Complying with law
  • Credentialing of providers
  • Reviewing your employment application
  • Due diligence for contracting purposes

Examples

Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Collected

YES

Business Purpose

  • Underwriting your policy
  • Administering or investigating a claim
  • Making payments to you, taking payments from you
  • Honoring our contractual obligations
  • Complying with law
  • Improving our products and services
  • Security Purposes
  • Credentialing of providers
  • Due diligence for contracting purposes
  • Due diligence for employment purposes

Examples

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Collected

YES

Business Purpose

  • Underwriting your policy
  • Administering or investigating a claim
  • Honoring our contractual obligations
  • Complying with law
  • Improving our products and services
  • Credentialing of providers
  • Due diligence for contracting purposes

Examples

Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Collected

YES

Business Purpose

  • Administering or investigating a claim
  • Making payments to you
  • Honoring our contractual obligations
  • Complying with law
  • Reviewing your employment application

Examples

Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.

Collected

YES

Business Purpose

  • Administering or investigating a claim
  • Improving our products and services
  • Underwriting your policy
  • Honoring our contractual obligations
  • Complying with law

Examples

Physical location or movements.

Collected

NO

Business Purpose

Examples

Audio, electronic, visual, thermal, olfactory or similar information.

Collected

YES

Business Purpose

  • Administering or investigating a claim
  • Complying with law
  • Communicating with you

Examples

Current or past job history or performance evaluations, income and salary details, credentialing information.

Collected

YES

Business Purpose

  • Underwriting your policy
  • Administering or investigating a claim
  • Complying with law
  • Credentialing
  • Due diligence for contracting purposes
  • Reviewing your employment application

Examples

Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Collected

YES

Business Purpose

  • Underwriting your policy
  • Administering or investigating a claim
  • Complying with law
  • Reviewing your employment application

Examples

Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Collected

YES

Business Purpose

  • Due diligence for employment purposes
  • Administering or investigating a claim

Personal information does not include:

  • Publicly available information from federal, state or local government records.
  • Deidentified or aggregated consumer information.
  • Information excluded from the CCPA’s scope such as personal information collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley Act and implementing regulations (“GLBA”), the California Financial Information Privacy Act (“CFIPA”), and the Driver’s Privacy Protection Act of 1994 (“DPPA”).

When information is subject to an exclusion, your rights under the CCPA are limited.

The examples below may help you understand what information may be collected depending upon your relationship with us.   Some items listed may be exempt from the scope of the CCPA because they are subject to protection under other privacy laws such as GLBA.  They are included here in the interest of full disclosure.  Generally, Zenith may collect the following information: 1) your name; 2) your physical and mailing address; 3) your email address; 4) your telephone number; 5) your signature; and 6) your Social Security number, federal employer identification number or other federal or state identification number.  Additionally, depending on the type of consumer you are, Zenith may collect additional information from you as follows:

When you or your business applies for workers’ compensation insurance or is a workers’ compensation insurance policyholder, we may collect the following additional information: 1) your date of birth; 2) your and your employees’ driver’s license numbers if hired to drive; 3) salaries and compensation paid by the business to you, other owners and your employees; 4) prior insurance policy numbers, loss runs and insurance experience and history; 5) information about your financial assets; 6) education, employment, and employment history and/or professional employment information to verify your eligibility or those of other owners for exclusion from coverage under the workers’ compensation law; 7) your marital status; and 8) your bank account number and details, credit card number and details, and other financial information to process premium payments and refunds.

When you apply for commercial auto, liability and/or property insurance or become a commercial insurance policyholder, we may collect the following additional information: 1) your and your employees’ driver’s license numbers if hired to drive; 2) your prior insurance policy numbers and loss runs; 3) your drivers’ names, addresses, age, gender, marital status and date of hire; 4) motor vehicle records for you and any other driver to be insured under your policy; 5) vehicle make, model and identification numbers for vehicles to be insured under your policy; 6) information about properties you or your family members own that are insured or to be insured under your policy; and 7) bank or mortgage loan numbers for financed properties or vehicles to be insured under your policy.

If you file a claim under a workers’ compensation insurance policy, we may collect the following additional information: 1) your Medicare identification number; 2) your medical records; 3) your employment records including wage information, citizenship status, or work visa number or information; 4) your bank account number and details, credit card number and details, and other financial information to process payments and refunds; 5) your driver’s license number; 6) your date of birth and date of death; 7) your gender; 8) your marital status; 9) your nonpublic educational records; 10) your financial information including information about assets you own; 11) your prior claim history; 12) your criminal activity (if applicable); 13) your biometric information; 14) your ability to benefit test, predispositions or other inferences from personal information; and 15) your recorded statement.

If you file a claim under a commercial auto, liability or property insurance policy, we may collect the following additional information: 1) your Medicare identification number; 2) your medical records; 3) your employment records including wage information; 4) your bank account details; 5) your driver’s license number; 6) your date of birth and date of death; 7) your gender; 8) your marital status; 9) your nonpublic educational records; 10) your vehicle make, model and identification number; 11) your past driving history; 12) your financial information including information about assets you own; 13) your prior claim history; 14) your criminal activity (if applicable); 15) your passport number (if needed); 16) your citizenship status; and 17) your recorded statement.

If you are a Zenith workers’ compensation medical provider or a Zenith vendor or a services provider, we may collect the following additional information: 1) your bank account number and details; 2) your debit or credit card  number and details; 3) your insurance policy numbers (WC, CGL, E&O); 4) your professional license number; 5) your professional employment information, employment records including wage information; 6) your nonpublic educational records; 7) your criminal activity (if applicable); 8) your Medicare identification number; 9) your driver’s license number; 10) your date of birth and date of death; 11) your gender; 12) information about assets you own; 13) your recorded statement; and 14) information required for credentialing.

If you are a witness to an accident or a loss involving a claim, we may collect the following additional information: 1) your driver’s license number (if needed); 2) your vehicle make, model and identification number (if needed); 3) your insurance policy number (if needed); and 4) your recorded statement.

If you are an employee or intern of Zenith or when you apply for employment or an internship with Zenith, we may collect the following additional information: 1) your driver’s license number and driving records (if needed); 2) your date of birth; 3) your gender; 4) your marital status; 5) your professional license number; 6) your professional employment information; 7) your nonpublic educational records; 8) your criminal activity (if applicable); 9) your medical information; 10) your passport number (if needed); 11) your citizenship status; 12) your photograph and/or fingerprints; 13) your financial information; and 14) your emotional intelligence factors.

Categories of Sources of Information

We obtain the categories of personal information listed above from the following categories of sources:

  • Directly from you or your agent. For example, we may collect personal information from forms you complete when applying for insurance or filing a claim.
  • Indirectly from you. For example, we may collect personal information by monitoring your usage of our Zenith Connect mobile application.
  • From others. For example, we may collect personal information about you from a medical provider.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

  • To fulfill or meet the reason you provided the information. For example, if you applied for Commercial Auto insurance, we will use the vehicle identification numbers you provided for your vehicles to ensure that coverage for such vehicles are added to your policy.  If you filed a claim under a Workers’ Compensation policy, we will use your medical records to evaluate your claim.
  • To review, investigate, process and pay claims.
  • To provide you with support and respond to your inquiries, including investigating and addressing your concerns and monitoring and improving our responses.
  • To create, maintain, customize, and secure your account with us, including detecting security incidents and debugging to identify and repair errors that impair existing functionality.
  • To process your requests, premium payments, transactions, and other payments to and from you, and prevent transactional fraud.
  • For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.
  • To respond to law enforcement requests, regulatory agency requests and as required or allowed by applicable laws, court order, rules or regulations.
  • As described to you when collecting your personal information or as otherwise set forth in the CCPA or as otherwise set forth in this Privacy Policy and any other CCPA Privacy Notice (for example, the business purposes set forth in the chart above).
  • To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Zenith’s assets in which personal information held by Zenith is among the assets transferred.
  • To conduct fraud investigations and report fraud pursuant to applicable laws, court order, rules or regulations.

The business purposes listed above may also apply to the categories of personal information identified in the chart.  Zenith will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing of Personal Information

Zenith may disclose your personal information to a service provider or a third party for a business purpose.  When we disclose personal information to a service provider for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We share your personal information for a business purpose with the following:

  • Service providers and third parties
  • Insurance advisory rate service organizations
  • Insurance industry standard setting organizations
  • Governmental authorities and regulatory entities
  • Insurance producers

In the preceding twelve (12) months, Zenith has disclosed the following categories of personal information for a business purpose:

  • Category A: Identifiers.
  • Category B: California Customer Records personal information categories.
  • Category C: Protected classification characteristics under California or federal law.
  • Category D: Commercial information.
  • Category E: Biometric information.
  • Category F: Internet or other similar network activity.
  • Category H: Sensory data.
  • Category I: Professional or employment-related information.
  • Category J: Non-public education information.
  • Category K: Inferences drawn from other personal information.

Zenith does not sell personal information and has not sold any personal information within the preceding twelve (12) months.

Your Rights and Choices

Effective January 1, 2020, the CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

These rights are not available to Zenith employees, job applicants or similar individuals.  These rights do not apply to B2B personal information of Zenith workers’ compensation medical providers, vendors or service providers.

Access to Specific Information and Data Portability Rights

You have the right to request that Zenith disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting that personal information and, if we were to begin selling personal information, our business or commercial purpose for selling that personal information.
  • The categories of third parties with whom we share that personal information.
  • The specific pieces of personal information we collected about you (also called a data portability request).
  • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
    • sales, identifying the personal information categories that each category of recipient purchased; and
    • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Deletion Request Rights

You have the right to request that Zenith delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies under applicable privacy laws and regulations.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
  • Detect security incidents, or protect against malicious, deceptive, fraudulent, or illegal activity, or respond to requests from governmental authorities prosecuting those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation or applicable laws, court order, rules or regulations.
  • Make other internal and lawful uses of the information that are compatible with the context in which you provided it.

Exercising Access, Data Portability and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
  • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Making a verifiable consumer request does not require you to create an account with us.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We try to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

Changes to Our Privacy Policy

Zenith reserves the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated policy on the Website and update the policy’s effective date.

Contact Information

If you have any questions or comments about this policy, the ways in which Zenith collects and uses your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone1-888-622-8012

Emailprivacyoffice@thezenith.com

If you have any questions or comments about our Privacy Statement, the practices of this site, or your dealings with this Website, you can contact:

ONLINE ACCOUNT LOG INX
For:
  • Policyholders
  • Workers' Compensation Agents
  • Zenith Solution Center®
Need To Sign Up?

For:
  • Agribusiness Agents
Need To Sign Up?