Consumer Privacy Act Notice and Policy

CrossCountry Mortgage will only retain personal information for the length of time needed to fulfill the purpose for which it was collected.

Collection Sources 

CrossCountry obtains the categories of personal information listed above from the following categories of sources:

• Directly from consumers or their agents. For example, from a consumer’s real estate agent prior to the consumer initiating a mortgage loan application.
• Directly and indirectly from activity on our website. For example, a consumer’s IP address, kind of web browser and computer used, and locality including the state or country from which the consumer accessed the site.
• From advertising networks, operating systems and platforms, data analytic providers, internet service providers, and other technology providers.

• From affiliates, consumer data resellers, social networks, marketing providers and other third parties that interact with us in connection with the services we perform. For example, from an entity that collects consumer personal information and then sells that information to CrossCountry as a lead.
• Public record sources including Federal, state or local government.

Use of Personal Information 

CrossCountry may collect or disclose consumer personal information for one or more of the following business purposes or commercial:

• To fulfill or meet the reason for which the consumer provides the information, such as maintaining or servicing accounts, providing customer service, processing, and fulfilling orders and transactions. For example, if a consumer provides information to a loan officer or insurance agent, CrossCountry will use that information to assist in the preparation and submission of a loan application or insurance quote, respectively.
• To provide consumers with information including loan and insurance products and pricing.
• For marketing and analytic purposes and to provide consumers with email alerts or other notices concerning our products, services, events, contests, promotions, or news that may be of interest. .
• To carry out our obligations and enforce our rights arising from any contracts entered between consumers and CrossCountry, including for billing and collections.
• To improve the CrossCountry website and better present content to consumers. For example, auditing related to a current interaction and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and to personalize the advertisements you see on third-party platforms and websites.
• For testing, research, analysis and product development. .
• As necessary or appropriate to protect the rights, property or safety of CrossCountry and our consumers or others. For example, detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

• To establish or defend legal claims and allegations.

• To seek advice from attorneys, auditors and other professional advisors.

• As described to consumers in any notice provided at or before the time of collection of personal information, or as otherwise set forth in the CCPA.

• To evaluate or conduct a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by CrossCountry is among the assets transferred, or personal information held by CrossCountry is used to assess assets or personal information held by another.

Note: CrossCountry will limit its collection of personal data to only the personal data that is adequate, relevant, and reasonably necessary to serve the purposes stated above.

Sensitive Personal Information 

CrossCountry does not collect, use, or disclose sensitive personal information other than:

• To provide the products and services requested by you;

• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information;

• To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions;

• To ensure the physical safety of natural persons;  and
• To perform services on behalf of CrossCountry.

CrossCountry does not collect or process sensitive personal information for the purpose of inferring characteristics about consumers.

Sale and Sharing of Personal Information

CrossCountry has sold the following categories of personal information and shared the following categories of personal information for the purposes of cross-context behavioral advertising to third parties in the previous twelve (12) months:

CrossCountry may sell or share consumer personal information to third parties for one or more of the following business or commercial purposes:

• For analytic purposes and to market our products and services to consumers.

Consumers can read more about their rights regarding the sale or sharing of their personal information here

Sale or Sharing of Personal Information of Minors 

CrossCountry does not knowingly collect, use, disclose, sell, or share the personal information of a person less than 16 years of age.

Targeted Advertising

CrossCountry may use consumer personal information we collect to better market our services to you based on your interests. You can read more about your rights regarding the use of your personal information for the purposes of targeted advertising here

Profiling

CrossCountry may use automated decision-making technology (“ADMT”) to process a consumer’s personal information for the purpose of assisting with decisions that have legal or significant effects, like decisions about whether to provide or deny financial services (“profiling”). You can read more about your rights regarding the profiling of your personal information here

Consumer Rights and Choices

Certain consumer privacy acts provide consumers with specific rights regarding their personal information. This section describes consumers’ rights and explains how to exercise those rights.

Right to Know/Confirm Processing of Categories of Personal Information

Consumers have the right to confirm whether CrossCountry has processed their personal information, and the categories of personal information CrossCountry has processed, including what personal information that CrossCountry has sold, shared, or otherwise disclosed to others and the purpose for the sale, sharing, or disclosure of that personal information.

Upon receipt and confirmation of an authenticated consumer request, CrossCountry will confirm whether CrossCountry has processed a consumer’s information and will provide the categories of information above, unless an exception applies.

To exercise your right to know/confirm the processing of categories of your personal information by CrossCountry, see the How to Exercise Rights section of this policy.

Right to Access/Obtain Personal Information

Consumers have the right to access and obtain a copy of the specific pieces of their personal information that CrossCountry has retained.

Upon receipt and confirmation of an authenticated consumer request, CrossCountry will provide the requested information, unless an exception applies.

To exercise your right to access/obtain a copy of specific pieces of your personal information retained by CrossCountry, see the How to Exercise Rights section of this policy.

Note:  Under no circumstances will CrossCountry disclose a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, health insurance or medical identification number, an account password, or security questions and answers. CrossCountry will, however, inform the consumer that it has collected the type of personal information, if applicable.

Right to Delete Personal Information

Consumers may request the deletion of personal information collected and retained by CrossCountry. Upon receipt and confirmation of an authenticated consumer request, CrossCountry will delete (and/or direct CrossCountry service providers to delete) consumer personal information from applicable records, unless an exception applies.

To exercise your right to delete your personal information, see the How to Exercise Rights section of this policy.

Right to Correct Personal Information

Consumers may request the correction of inaccurate personal information collected and retained by CrossCountry. Upon receipt and confirmation of an authenticated consumer request and supporting documentation (if necessary), CrossCountry will correct (and/or direct CrossCountry service providers to correct) the inaccurate consumer personal information in all applicable records, unless an exception applies.

To exercise your right to correct your personal information, see the How to Exercise Rights section of this policy.

Right to Request a List of the Third parties to Which We Have Disclosed Personal Information

Consumers may request a list of specific third parties, other than natural persons, to which CrossCountry has disclosed personal information.

Upon receipt and confirmation of an authenticated consumer request, CrossCountry will provide the requested information, unless an exception applies.

To exercise your right to obtain a list of third parties to which CrossCountry has disclosed your personal information see the How to Exercise Rights section of this policy.

Consumers have the right to opt-out of the sale or sharing of their personal information collected by CrossCountry. Upon receipt of a consumer request CrossCountry will stop selling or sharing the consumer’s non-exempt personal information to third parties as soon as feasibly possible, but no later than 15 business days from the date the CrossCountry receives the request.

To exercise your right to opt out of the sale or sharing of your information, see the How to Exercise Rights section of this policy.

Consumers have the right to opt-out of the use of their personal information for the purposes of targeted advertising. Upon receipt of a consumer request CrossCountry will stop the processing personal information for the Purpose of targeted advertising as soon as feasibly possible, but no later than 15 business days from the date the CrossCountry receives the request.

To exercise your right to opt out of targeted advertising, see the How to Exercise Rights section of this policy.

Consumers may opt out of the use of CrossCountry’s use of ADMT to process their personal information for the purpose of assisting with decisions that have legal or significant effects, like decisions about whether to provide or deny financial services. Upon receipt of a request to opt out of the processing of a consumer’s personal information for this purpose, CrossCountry will comply with the request as soon as feasibly possible, but no later than 15 business days from the date CrossCountry receives the request, unless an exception applies.

To exercise your right to opt out the profiling of your personal information, see the How to Exercise Rights section of this policy.

Note: CrossCountry may deny a request to opt out of the profiling of a consumer’s personal information if the use of ADMT is necessary to provide a service that is specifically requested by the consumer.

Non-Discrimination Rights

CrossCountry will not discriminate against consumers, including employees, job applicants, or independent contractors, for exercising any consumer rights. Except to the extent permitted by law, CrossCountry will not:

• Deny you goods or services;

• Charge different prices or rates for goods or services based upon provision of personal information, including through granting discounts or other benefits, or imposing penalties;

• Provide different levels or quality of goods or services; or,

• Suggest that a consumer may receive a different price or rate for goods or services or a different level or quality of goods or services.

You may exercise the Privacy Act rights described above by submitting a request to CrossCountry by either:

• Calling us at 844-940-2272

• Completing the online webform –Consumer Privacy Act Request

• For requests to opt-out of the sale and or sharing of personal information – in addition to the methods listed above, you may click on the “Do Not Sell or Share My Personal Information” button found in the banner at the bottom of this webpage.

For requests submitted using the Consumer Privacy Act Request form, you must describe the request with enough detail so that CrossCountry may properly understand, evaluate, and respond to the request.

Opt-Out Preference Signals

An opt-out preference signal is a feature that allows a consumer to automatically notify websites they visit that the consumer doesn’t want their personal data sold, shared, or processed for targeted advertising or profiling. This is typically done through browser settings or browser extensions.

Depending on which opt-out preference signal you use, our ability to process the signal may be limited to the specific browser or electronic device that you use.

Authorized agents

An authorized person may submit a Privacy Act request on behalf of a consumer using the telephone number or online webform shown above. An authorized agent will be required to provide their contact information, the verification information of the consumer on whose behalf they are making the CCPA request, any documentary evidence as part of a correction request, and to submit evidence of authorization to act on behalf of the consumer in the form of either:

• A document signed by the signed by the consumer giving the authorized agent permission to act on behalf of the consumer (CrossCountry may also contact the consumer directly to verify their identity and that authorization has been given)

• A valid power of attorney

CrossCountry Consumer Requests

Authenticating Consumer Requests

CrossCountry will respond only to requests that are authenticated consumer requests.  To authenticate a request, CrossCountry will seek to verify a consumer’s identity upon receipt of any request and validate that an authorized agent has the authority to act on behalf of the consumer, if applicable. CrossCountry will request information from the requestor that enables identification, such as the consumer’s email address, current address, or date of birth. CrossCountry also may use a third-party verification provider to verify a consumer’s identity.

Other than for a request to opt-out the processing of personal information (opt out of sale, sharing, profiling, or targeted advertising), CrossCountry will not comply with a Privacy Act request or provide a consumer with personal information if it cannot verify the identity of the consumer, the authority of an authorized agent to make the request on behalf of a consumer (if applicable), and/or confirm the requested personal information relates to the consumer.  Making a request does not require the creation of an account with CrossCountry.  CrossCountry will only use personal information provided in a request to verify the requestor’s identity or authority to make the request.

Correction request: As part of a request to correct inaccurate information that CrossCountry maintains about a consumer, the consumer submitting the request may be asked to provide any documentation that rebuts the accuracy of the contested information maintained by CrossCountry. A consumer’s request to correct may be denied if CrossCountry determines that the contested information maintained by CrossCountry is more likely than not accurate based on the totality of relevant circumstances.

Response Timing and Format

CrossCountry will respond to each authenticated consumer request within 45 days of its receipt.  If CrossCountry requires more time, it will inform the requestor of the reason and extension period in writing.  If the requestor has a pre-existing account with CrossCountry, CrossCountry may deliver its written response by means of that account.  If the requestor does not have a pre-existing account, CrossCountry may deliver its written response either by mail or electronically.  For any request to be provided with information related to the processing of a consumer’s personal information, CrossCountry will select a format to provide the information that is readily useable and allows the consumer to transmit the information from one entity to another entity without hindrance.

CrossCountry does not charge a fee to process or respond to a verifiable consumer request unless the request is excessive, repetitive, or manifestly unfounded.  If CrossCountry determines a request warrants a fee, CrossCountry will inform the consumer of the decision and provide a cost estimate before completing the request.

CrossCountry will inform the consumer whether it has complied with their request. If CrossCountry denies a consumer request, it will inform the consumer and explain the basis for the denial, including whether the denial is due to an exception permissible under Privacy Act laws.

Right to Appeal Denial of Consumer Request

If CrossCountry denies a consumer request, it will notify the consumer in writing and explain the basis for the denial. The consumer may appeal the denial by responding to the notification of denial with additional information for consideration within 14 calendar days of the date of notification. CrossCountry will approve or deny the appeal within 45 days after the date on which CrossCountry receives the appeal and will notify the consumer in writing of CrossCountry’s decision and the reasons for the decision. If CrossCountry denies the appeal, the notice will provide or specify information that enables the consumer to contact any applicable agency to submit a complaint, if the consumer chooses to do so.

Changes to This Disclosure

CrossCountry reserves the right to amend this Privacy Policy at its discretion and at any time. When CrossCountry makes changes to this Privacy Policy, it will post a link to the updated Privacy Policy to its website homepage.

How to Contact Us

For questions or comments about this Privacy Policy, our Privacy Statement, the ways in CrossCountry collects and uses consumer personal information, consumer choices and rights regarding such use, or exercising rights under California law, please contact CrossCountry at:

Phone: 844-940-2272
US Mail:
CrossCountry Mortgage, LLC
Attn: Privacy Team
2160 Superior Avenue
Cleveland, OH 44114

Or please contact CrossCountry by sending an email to: Privacy@ccm.com

This policy was last updated June 10, 2025.