State Data Privacy Rights Notice

Your Privacy Rights

Some states provide individuals with additional rights as it relates to their personal information that a business collects about them. For example, California residents may be eligible to exercise consumer privacy rights under the California Consumer Privacy Act or “CCPA” (Cal Civ. Code §1798.100 et seq.). This notice is provided pursuant to the CCPA, and, if eligible, you may exercise the following rights.

Personal Information Collected

Categories of Personal Information

We may have collected the following categories of personal information within the last twelve (12) months:

Behavioral (e.g., purchase history, leisure activities and interests, shopping preferences, inferences)
Contact and Biographical (e.g., first name, last name, maiden name, mailing address, phone number, email address, date of birth)
Demographic (e.g., household information)
Employment (e.g., occupation, job title)
Financial (e.g., account number, transaction history, credit history, credit score)
Government-Issued (e.g., social security number, driver’s license number, passport number)
Location (e.g., geolocation)
Medical and Health (e.g., health insurance account number, medical payment information)
Payment Card (e.g., credit/debit card number, expiration date, card verification number)
Protected Classifications (e.g., racial or ethnic origin, legal status)
Unique Persistent Identifiers (e.g., IP address, cookies, login credentials, biometric information)
User Activity (e.g., information regarding interaction with Huntington websites, call logs, content of emails and text messages with Huntington colleagues)

Sources of Personal Information

We may obtain personal information from the following sources:

Directly from the Individual
Consumer Reporting Agencies
Directly obtained, generated, created
Government Entities
Employer of Individual
Data Resellers
Affiliates

Purposes for Collecting Personal Information

We may obtain personal information for the following business and commercial purposes:

To provide, maintain, and/or service an account
To improve and develop our services and products
For marketing purposes
For data analytics or internal research purposes
For debt collection purposes
To comply with legal and regulatory requirements and guidance
For fraud prevention or account security purposes
To manage customer concerns and complaints

Disclosure of Personal Information

No Sale or Sharing for Cross-Context Behavioral Advertising Purposes

Huntington has not sold any personal information to third parties in the preceding 12 months, including the personal information of minors under 16 years of age. Huntington Bank does not share personal information with third parties for cross-context behavioral advertising purposes.

Categories of Personal Information Disclosed

We may disclose the following personal information to third parties:

Behavioral (e.g., purchase history, leisure activities and interests, shopping preferences, inferences)
Contact and Biographical (e.g., first name, last name, maiden name, mailing address, phone number, email address, date of birth)
Demographic (e.g., household information)
Employment (e.g., occupation, job title)
Financial (e.g., account number, transaction history, credit history, credit score)
Government-Issued (e.g., social security number, driver’s license number, passport number)
Location (e.g., geolocation)
Medical and Health (e.g., health insurance account number, medical payment information)
Payment Card (e.g., credit/debit card number, expiration date, card verification number)
Protected Classifications (e.g., racial or ethnic origin, legal status)
Unique Persistent Identifiers (e.g., IP address, cookies, login credentials, biometric information)
User Activity (e.g., information regarding interaction with Huntington websites, call logs, content of emails and text messages with Huntington colleagues)

Third Parties to Whom Personal Information May Be Disclosed

We may disclose any of the above personal information to the following third parties:

Service Providers
Affiliates
Your authorized representative or other designated recipient
Consumer Reporting Agencies
Government Entities
Operating Systems and Platforms
Non-Affiliated Financial Services Companies

Purposes for Disclosure of Personal Information

We may disclose personal information to the above third parties for the following purposes:

For our everyday business purposes—such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus
For our marketing purposes—to offer our products and services to you
For joint marketing with other financial companies
For our affiliates' everyday business purposes—information about your transactions and experience
For our affiliates’ everyday business purposes—information about your creditworthiness
For our affiliates to market to you

Sensitive Personal Information Collected

Categories of Sensitive Personal Information

Huntington may collect the following categories of sensitive personal information:

Sensitive identification numbers (e.g., social security number, driver’s license number, passport number)
Access or log-in credentials (e.g., account log-in or financial account number in connection with password, security code, or access code)
Precise geolocation
Racial or ethnic origin
Religious or philosophical beliefs
Biometric data
Health information

Use of Sensitive Personal Information

Huntington may use sensitive personal information for the following purposes:

To perform services on behalf of Huntington and Huntington’s customers
To ensure the security and integrity of Huntington systems and accounts
For short-term, transient use, including non-personalized advertising
To undertake activities to verify or maintain quality or safety of service or enhance service

Your Rights Related to Your Personal Information

If you are eligible, you may have the following rights related to the personal information that Huntington has collected.

Know Information: The right to know what personal information that Huntington has collected, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information the business has collected about the consumer.
Delete: The right to delete personal information that Huntington has collected, subject to certain exceptions.
Correct: The right to correct inaccurate personal information that Huntington maintains.
Non-Discrimination: The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by an applicable privacy law.

Huntington does not engage in any activities related to the following rights:

Opt Out of Sale or Sharing: The right to opt out of the sale or sharing of their personal information by the business.
Limit Use or Disclosure of Sensitive Personal Information: The right to limit the use or disclosure of sensitive personal information by the business.

How to Exercise a Privacy Right and What to Expect

Methods

Huntington provides two methods for submitting a rights request:

Option 1: Submit an online request
Option 2: Call our designated “Personal Information Rights Request” line at (866) 644-9790, daily 6:00 a.m. to midnight ET.

Verification

To verify your request, we will ask you to provide information (for example: name, date of birth, address, email address, phone number, and last 4 of your Social Security Number). We will use the identifying information you provided to attempt to verify your identity. If necessary, we may also use a third-party provider to assist in verification.

Opt-Out Preference Signal

As previously stated, Huntington does not engage in any activity related to the right to opt out of the sale or sharing of personal information. As a result, Huntington does not process an opt-out preference signal.

Authorized Agent

You will be asked to submit a notarized affidavit authorizing your delegate to act on your behalf. If you do not submit the notarized affidavit within 10 business days, your case may be closed.

What to Expect

In the event you submit a rights request, you can expect the following:

We will determine whether your request can be fulfilled, which may include, verifying your identity, determining whether you have reached your request limit (no more than two for the preceding 12 months), determining whether you reside in a state that provides these rights, and determining whether you are ineligible under any other exception.
We may take up to 45 days to fulfill your request.
We may also extend the time to fulfill your request by another 45 days (for a total of 90 days); however, we will notify you when we make this extension.
We will provide you with your response via your chosen communication method (mail or email).

Please note, as discussed above, your submission does not guarantee that we will fulfill your request.

Contact

For questions or concerns about the Huntington’s privacy policies and practices, please contact us at privacy@huntington.com.

Exceptions

Applicable state law may provide exceptions that impact your rights under this notice. For example, the CCPA provides an exception to compliance with some of the rights under this Notice if the personal information is regulated under the federal Gramm-Leach-Bliley Act.

Date This Notice Was Last Updated

January 1, 2023