BECU California Consumer Privacy Notice

Last Updated: June 2, 2026

Boeing Employees' Credit Union (BECU or we) is committed to respecting and protecting the privacy of our members and others who trust us with their personal information. This California Consumer Privacy Notice (California Privacy Notice) applies to residents of California.

As a financial institution, most of the personal information we collect, use, and disclose is exempt from the CCPA, but other privacy laws may apply, such as the Gramm-Leach-Bliley Act (GLBA), Fair Credit Reporting Act, Health Insurance Portability and Accountability Act, and California Financial Information Privacy Act. This California Privacy Notice also does not apply to Publicly Available Information, Deidentified Data, and Aggregated Consumer Information (all of which are terms defined in the CCPA).

This California Privacy Notice serves as BECU's Notice at Collection, as required by the California Consumer Privacy Act (CCPA). If you are an employee, job applicant or independent contractor, please see the BECU Applicant Privacy Notice, or the BECU Employee Privacy Notice.

I. DEFINITIONS

In this California Privacy Notice, the following terms have the following meanings:

BECU Services means becu.org and other BECU online and offline services that link to or reference this California Privacy Notice, including, if you choose to use it, BECU's Beca AI virtual assistant (“Beca”).
Business Purpose means performing services requested by California Consumers, including managing and processing interactions and transactions with California Consumers; securing and debugging; advertising and marketing; quality assurance; research and development; and any other Business Purpose as defined in the CCPA.
California Consumers (or you) means BECU members and other individuals residing in California who are identified or identifiable by CCPA Personal Information.
CCPA Personal Information means personal information that is regulated by the CCPA (but not GLBA) and identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California Consumer or a California Consumer's household (as further defined in Cal Civ Code § 1798.140(v)).
Processing (and its variants) means any operation or set of operations performed on CCPA Personal Information, including collecting, combining, and storing CCPA Personal Information.
Third Party means any entity or natural person other than BECU and Vendors.
Vendor means a person or entity Processing CCPA Personal Information on behalf of BECU acting as a Service Provider or a Contractor (each as defined in the CCPA).

The terms “Sensitive Personal Information,” “Share,” and “Sold” (and their variants) and all other capitalized terms used but not defined in this California Privacy Notice have the meanings given to them in the CCPA.

II. WHEN DOES THIS CALIFORNIA PRIVACY NOTICE APPLY?

This California Privacy Notice covers the twelve (12) months prior to the “Last Updated” date above. This California Privacy Notice is reviewed and updated (if necessary) at least once per year. If this California Privacy Notice conflicts with the BECU Online Privacy Notice, this California Privacy Notice will govern as to CCPA Personal Information, unless expressly stated otherwise. If BECU's Processing materially changes between updates to this California Privacy Notice, BECU will provide a supplemental notice when or before the changes apply.

III. BECU'S ONLINE AND OFFLINE PRACTICES FOR CCPA PERSONAL INFORMATION

A. CATEGORIES OF CCPA PERSONAL INFORMATION COLLECTED

BECU may collect or receive (and may have collected or received during the 12-month period prior to the “Last Updated” date above) the categories of CCPA Personal Information listed below. These categories track the categories required by the CCPA, but not all categories are collected or received for every California Consumer. Some CCPA Personal Information included in one category may overlap with other categories.

Categories of CCPA Personal Information that BECU Collects	Examples of CCPA Personal Information that BECU Collects (by Category)
Personal Identifiers	Name, postal address, email address, phone number, date of birth, social security number, account name, government-issued identification numbers, and other information that directly identifies you.
Personal Records	Name, address, telephone number, signature, description, social security number, and information about financial purchases.
Characteristics of Protected Classifications	Age, gender, and marital status, but only when relevant for our Business Purposes.
Commercial Information	Account number, credit and debit card numbers, account balance, loan information, information about beneficiaries and joint account owners, transaction details, billing information or statements, and payment or transaction history.
Internet or other electronic network activity information	Browsing history, search history, computer type, operating system, network addresses, IP address, identifiers for computers and mobile devices, activity and audit logs, and other information regarding your interaction with our systems or other sites, applications, or content.
Geolocation data	The approximate location (from IP address) of the device or equipment used to access BECU Services.
Sensory data (audio, electronic, visual, thermal, olfactory, or similar information.)	Log-in activity, and applications accessed on the BECU Services and how they are used; activity from security systems in our facilities; and audio and video recordings.
Professional or employment-related information	Professional, educational, or employment-related information, such as business contact details, job title or position, company affiliation, and company address.
Inferences from personal information	Inferences drawn from CCPA Personal Information to create a profile about a California Consumer reflecting preferences or characteristics.
Sensitive Personal Information	Social security, driver's license, state identification card, or passport number. Account Log-In, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account (e.g., username and password to BECU account). Biometric Information used for the purpose of uniquely identifying a California Consumer, i.e., a voiceprint or faceprint used to verify your identity.

BECU has not knowingly collected or Processed the following categories of Sensitive Personal Information in the 12 months preceding the “Last Updated” date above:

Health Information.
Sex Life/Sexual Orientation.
Precise Geolocation, i.e., data that is derived from a device and that is used or intended to be used to locate an individual within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet.
Contents of email and other electronic communications unless BECU (including communications in Beca) is the intended recipient.
Genetic data used to uniquely identify an individual.
Neural data, which means any information that is generated by measuring the activity of an individual's central or peripheral nervous system, and that is not inferred from nonneural information.
Personal information of California residents who BECU has actual knowledge are less than 16 years of age.

Information that is Deidentified information, Publicly Available information, or Aggregate Consumer Information (each as defined in the CCPA) is not CCPA Personal Information and is outside the scope of this California Privacy Notice. We reserve the right to convert, or permit others to convert, your CCPA Personal Information into Deidentified information, Publicly Available information, and Aggregate Consumer Information. We will not attempt to reidentify data that we maintain as Deidentified information. We will contractually obligate any recipient of our Deidentified information to not associate Deidentified information with California Consumers or their devices or households.

B. CATEGORIES OF SOURCES FROM WHICH BECU COLLECTS CCPA PERSONAL INFORMATION

BECU collects CCPA Personal Information from you or about you as follows:

Directly from you (e.g., when you complete online forms on our websites, provide feedback to us, and complete membership or credit applications);
From your computer and mobile devices when you access and use BECU Services;
From our Vendors when they provide BECU and you with services on our behalf;
From public sources of data; and
From other businesses and individuals, such as providers of identity verification and fraud prevention services.

C. BUSINESS PURPOSES OR COMMERCIAL PURPOSES FOR WHICH BECU COLLECTS CCPA PERSONAL INFORMATION

Generally, BECU Processes CCPA Personal Information to provide our services and as otherwise related to the operation of our business. Subject to restrictions and obligations under the CCPA, our Vendors also may use your CCPA Personal Information for their Business Purposes and other approved purposes and may engage their own Vendors to help perform services for us.

Generally, we collect CCPA Personal Information for Business Purposes related to providing services and for the operation of our business. Specifically, the Business Purposes for which we collect CCPA Personal Information include:

To provide and perform our products and BECU Services
For internal research and development
To verify or maintain the quality or safety of our products and the BECU Services
To identify and correct errors
To ensure security and integrity of the BECU Services, including preventing fraud
For short-term transient use
For advertising and marketing

We also collect CCPA Personal Information for the following Commercial Purposes:

For online advertising
For co-marketing with our business partners
Improving BECU Services and developing new product offerings, including through use of machine learning, AI, and other automated tools to help us detect unusual or anomalous activity, monitor information transmitted to, through or from BECU Services, and for similar purposes, in each case when permitted by applicable law

We also collect CCPA Personal Information for the following other notified purposes permitted by the CCPA (Additional Business Purposes):

To comply with federal, state, or local laws or comply with a court order or subpoena to provide information and cooperate with law enforcement agencies concerning conduct or activity that BECU reasonably and in good faith believes may violate federal, state, or local law.
To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.
To exercise or defend legal claims.
To collect, sell, or share CCPA Personal Information if every aspect of that commercial conduct takes place wholly outside of California.
To Process CCPA Personal Information at your direction or through your action.
To use and disclose CCPA Personal Information as part of an acquisition, merger, bankruptcy, asset sale, or other transaction through which another party assumes control of all or part of our business.
For any other Business Purpose set forth in the CCPA from time to time.

We also collect CCPA Personal Information for other purposes that may arise from time to time as explained in a supplemental pre-collection notice.

D. SELLING/SHARING CCPA PERSONAL INFORMATION

In the 12 months preceding the “Last Updated” date above, BECU has Sold or Shared the following categories of CCPA Personal Information:

Categories of CCPA	Whether Sold/Shared	Categories of Recipients to which the CCPA Personal Information is Sold/Shared	Purpose for Sale/Sharing
Personal Identifiers	Share/Sold	Providers of Tracking Technology (defined in Section IV.A.4 below)	Cross-Contextual Behavioral Advertising
Personal Records	Shared/Sold	Providers of Tracking Technology (defined in Section IV.A.4 below)	Cross-Contextual Behavioral Advertising
Characteristics of Protected Classifications	Not Sold/Shared	N/A	N/A
Commercial Information	Not Sold/Shared	N/A	N/A
Internet or other electronic network activity information	Shared/Sold	Providers of Tracking Technology (defined in Section IV.A.4 below)	Cross-Contextual Behavioral Advertising
Geolocation data	Shared/Sold	Providers of Tracking Technology (defined in Section IV.A.4 below)	Cross-Contextual Behavioral Advertising
Sensory data (audio, electronic, visual, thermal, olfactory, or similar information.)	Not Sold/Shared	N/A	N/A
Professional or employment-related information	Not Sold/Shared	N/A	N/A
Inferences from personal information	Not Sold/Shared	N/A	N/A
Sensitive Personal Information	Sold/Shared	Business partners	Joint marketing and similar business ventures (such as new customer acquisition and market expansion)

BECU has no actual knowledge that it Sold or Shared CCPA Personal Information about any California resident under age 16. We will not knowingly Sell or Share the CCPA Personal Information of California residents under age 16, unless we receive affirmative (opt-in) authorization from either the California resident who is between age 13 and age 16 or the verifiable parent consent of a California resident who is less than age 13.

E. BECU'S DISCLOSURES OF CCPA PERSONAL INFORMATION

In the 12 months preceding the “Last Updated” date above, BECU has disclosed the categories of CCPA Personal Information to Vendors and other recipients for Business Purposes as set out in the following table.

CCPA Personal Information Category Disclosed	Vendors and Other Recipients	Business Purpose for Disclosure
Personal Identifiers Personal Records Characteristics of Protected Classifications Commercial Information Internet or other electronic network activity information Geolocation data Sensory Data (audio, electronic, visual, thermal, olfactory, or similar information) Professional or employment-related information Inferences from personal information Sensitive Personal Information	Vendors that provide data analytics, fraud detection, marketing, property and facility management security, technology, and similar administration and operational services Government agencies, including courts, law enforcement agencies, federal, state, or local authorities Other parties as permitted for Additional Business Purposes	For auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards. To help ensure security and integrity. For debugging to identify and repair errors that impair existing intended functionality. For short-term, transient use, including, but not limited to, non-personalized advertising. To perform services on behalf of BECU. For advertising and marketing services. For internal research for technological development. To verify or maintain the quality or safety of the BECU Services or another service or device controlled by BECU. To improve, upgrade, or enhance the BECU Services or another service or device controlled by BECU. For additional Business Purposes.

F. Retention of CCPA Personal Information

BECU will retain CCPA Personal Information [as described in this Notice] as long as necessary to achieve the purpose(s) for which it was collected, as permitted by the CCPA.

Because of the many purposes and use cases for CCPA Personal Information, we are unable to provide retention periods based on categories of CCPA Personal Information in a way that would be meaningful and transparent to you. Actual retention periods for CCPA Personal Information depend on how long we have a legitimate purpose for the retention — consistent with the collection purposes and applicable law.

G. Use of Beca

It is your choice to use Beca to help answer your financial questions, provide personalized insights, and suggest next steps based on information you share with us or consent to us collecting (such as your credit report information). These insights are intended to help you better understand your finances and explore options, but they are informational only and not a guarantee or financial advice, and you should verify details before taking action. BECU will not use Beca to make any decisions, including but not limited to lending decisions or creditworthiness.

H. No ADMT Use

BECU may use CCPA Personal Information to help us make decisions concerning you that could have a significant impact on you. BECU does not, however, use automated decision-making technology (ADMT) to do so. The term ADMT means technology that Processes CCPA Personal Information and uses computation to make a significant decision without human involvement, including human review and analysis of the output of the technology and the authority to change the decision.

For purposes of the CCPA, BECU does not make a significant decision about financial or lending services, housing opportunities, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services using ADMT without human involvement. If our practices with ADMT change, BECU will provide you with the required ADMT-related notices and rights.

IV. WHAT CONSUMER PRIVACY RIGHTS ARE AVAILABLE AND HOW CAN YOU EXERCISE THEM?

If you are a California Consumer, BECU provides you with the privacy rights described in this Section IV subject to our verification requirements, and only with respect to CCPA Personal Information.

A. PRIVACY RIGHTS

Subject to certain exceptions and limitations, which we will explain to you in response to your request if we are relying on an exception, you may have the following rights:

1. Right to Know / Access

You are entitled to access CCPA Personal Information up to twice per 12-month period.

a) Right to Know (Categories) of CCPA Personal Information

You have a right to submit a request for the following information: The categories of CCPA Personal Information that we collected from or about you.

The categories of sources from which your CCPA Personal Information was collected.
BECU's Business Purpose(s) or Commercial Purpose(s) for collecting, Selling and Sharing your CCPA Personal Information.
The categories of Third Parties to which BECU disclosed your CCPA Personal Information.

b) Right to Know (Specific Pieces) of CCPA Personal Information

You have a right to submit a request to (i) confirm the specific pieces of CCPA Personal Information we have collected about you and (ii) receive a copy of the CCPA Personal Information in a structured, commonly used, machine-readable and transportable format to the extent technically feasible.

2. Right to Delete

You have a right to request that BECU delete the CCPA Personal Information about you which BECU has collected from you, unless BECU has a basis for retaining it under the CCPA.

3. Right to Correct

You have the right to request that we correct inaccuracies that you find in the CCPA Personal Information about you maintained by us. You also can make certain changes to your online account (e.g., name and password) in the account settings section of the account. Changing your account settings may not, however, change your CCPA Personal Information that exists in other places.

4. Right to Opt-Out of Sale/Share

You have the right to request to opt-out of the Sale or Sharing of your CCPA Personal Information (Right to Opt-Out).

We use cookies and similar technology (Tracking Technology) to provide features of BECU Services. Third-party digital businesses which are not limited to acting as our Vendors may use Tracking Technology to collect CCPA Personal Information about you on BECU Services or otherwise Process CCPA Personal Information about you that we make available. This Processing by third-party digital businesses is a Sale/Share and subject to the Right to Opt-Out.

If you want to submit a request to exercise the Right to Opt-Out (Request to Opt-Out) for CCPA Personal information collected by Tracking Technology, you can update your preferences here. Otherwise, to submit a Request to Opt-Out, please use BECU's privacy request form.

The CCPA requires us to recognize certain types of signals, referred to as Opt-Out Preference Signals in the CCPA. Opt-Out Preference Signals are signals sent by a technology tool enabled by a California Consumer on a device or browser that communicates the California Consumer's Request to Opt-Out.

We currently look for and recognize the global privacy control (GPC) signal, a type of Opt-Out Preference Signal. To use the GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. We process GPC signals with respect to Selling and Sharing that may occur and apply it to the specific browser or device on which you enable the GPC, as well as any profile associated with that browser or device. We do not change your experience with any BECU product or service or change an extra fee if you use GPC or display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the GPC, except that we will display a message acknowledging the signal.

Certain web browsers also may provide a do-not-track (DNT) option. You may be able to ask your browser to inform websites that you do not wish your activities to be tracked, either with cookies or other persistent identifiers, commonly called “DNT signals.” Because there is not yet a common understanding of how to interpret web browser-based DNT signals other than cookies, our websites do not currently respond to DNT signals.

5. Right to Limit Use or Disclosure of Sensitive Personal Information

You have the right to request to limit certain uses or disclosures of your Sensitive Personal Information (Right to Limit), subject to certain exceptions and limitations, such as when use of your CCPA Personal Information is necessary to provide a service you requested or to prevent, detect, and investigate a security incident.

6. Right to Opt-Out of or Access ADMT (when applicable)

B. HOW TO EXERCISE PRIVACY RIGHTS

To submit a request to exercise your privacy rights, or to submit a request as an authorized agent, visit BECU's privacy request form, call us at 800-233-2328, or contact us here. Please check for and respond to any follow-up inquiries we make. Please be aware that we do not accept or process requests through other means.

C. HOW BECU VERIFIES A PRIVACY RIGHT REQUEST

As permitted or required by the CCPA, when you make a privacy right request, we may ask you to provide verifying information, such as your name, email, phone number, account and/or transaction information, as described below, so that we can reasonably verify you are the California Consumer about whom we collected CCPA Personal Information (Verifiable Consumer Request).

Only you, or someone legally authorized to act on your behalf (your authorized agent), may make a Verifiable Consumer Request related to your CCPA Personal Information or the information of your minor child.

BECU verifies each request as follows:

Right to Know (Categories): We verify your request to a reasonable degree of certainty, which may include matching at least two (2) data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you.
Right to Know (Specific Pieces): We verify your request to a reasonably high degree of certainty, which may include matching at least three (3) data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you together with a signed declaration under penalty of perjury that you are the California Consumer whose CCPA Personal Information is the subject of the request. If you fail to provide requested information, we will be unable to verify you sufficiently to honor your request, but we will then treat it as a Right to Know (Categories) request.
Right to Delete: We verify your request to a reasonable degree of certainty, which may include matching at least two (2) data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three (3) data points provided by you with data points maintained by us, depending on the sensitivity of the CCPA Personal Information and the risk of harm posed by unauthorized deletion.
Right to Correct: We verify your request to a reasonable degree of certainty, which may include matching at least two (2) data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three (3) data points provided by you with data points maintained by us, depending on the sensitivity of the CCPA Personal Information and the risk of harm posed by unauthorized correction.
Right to Opt-Out: We do not verify your Request to Opt-Out, but we may ask you for information necessary to complete the request.
Right to Limit: We do not verify your request to Request to Limit, but we may ask you for information necessary to complete the request

We will review the information that you provide and may request additional information to ensure that we are interacting with the correct individual (except for a Request to Opt-out and Request to Limit).

We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete, or Right to Correct request(s) unless you provide sufficient information for verification. If we are unable to verify you, we are unable to honor your request. We will use CCPA Personal Information provided for a Verifiable Consumer Request only to verify identity and authority to make the request and to track and document request responses unless you also gave it to us for another purpose, and will delete any new Personal Information collected for purposes of verification as soon as practical after processing your request.

D. AUTHORIZED AGENT REQUEST

You may use an agent to make a request to delete, request to correct, or a request to know. Before you can use an agent, BECU requires that you complete and submit an Authorized Agent Authorization Form [https://www.becu.org/forms/ccpa-agent] or provide a power of attorney to your agent pursuant to Probate Code sections 4121 to 4130 (POA).

We may require that you verify your identity or directly confirm that you authorized the agent to submit the request unless you provide a POA. Once verified by us or if your agent has a POA, your agent becomes an “Authorized Agent” and may exercise the rights to delete, correct, and know on your behalf, subject to the requirements of the CCPA.

You may use an agent to make to submit a Request to Opt-Out if you provide the agent written permission signed by you. BECU may deny a Request to Opt-Out from an agent if the agent does not provide the signed written permission. (The signed written permission requirement does not apply to requests made by an Opt-Out Preference Signal.)

E. BECU RESPONSES

BECU will make commercially reasonable efforts to identify CCPA Personal Information that we Process to respond to a privacy rights request. In some cases, particularly with voluminous requests, we may suggest that you receive a summary of your CCPA Personal Information and offer you the opportunity to elect whether you want to receive all of it. We reserve the right to direct you to where you may access CCPA Personal Information yourself. We typically do not charge a fee to fully respond to privacy rights requests, but we may charge a reasonable fee or refuse to act upon a privacy rights request if the request is excessive, repetitive, unfounded or overly burdensome (as permitted by the CCPA). If we determine that the request warrants a fee or that we may refuse it, we will notify you, explaining why we made that decision. We will provide a fee estimate and the opportunity to accept the fee before we charge you for responding to your request.

V. WHAT ELSE DO CALIFORNIA CONSUMERS NEED TO KNOW?

1. NON-DISCRIMINATION / NON-RETALIATION

BECU will not discriminate or retaliate against you in a manner prohibited by the CCPA for your exercise of your privacy rights. We may charge a different price or rate or offer a different level or quality of goods or services, to the extent that doing so is reasonably related to the value of the applicable CCPA Personal Information.

2. NOTICE OF FINANCIAL INCENTIVE PROGRAMS

BECU does not currently offer financial incentives that are subject to the CCPA. If we provide financial incentives for California Consumers in the future, we will provide notice and obtain consent as required by applicable law.

3. OUR RIGHTS AND THE RIGHTS OF OTHERS

BECU may collect, use, and disclose your CCPA Personal Information as required or permitted by applicable law, which may override your rights under CCPA. In addition, we are not required to honor privacy rights requests if doing so would infringe on BECU's or another party's rights or conflict with applicable law

4. CALIFORNIA SHINE THE LIGHT LAW

California residents have the right to prevent disclosures of “personal information,” as defined by California's “Shine the Light” law, with third parties for those third parties' own direct marketing purposes. BECU does not, however, disclose personal information within the scope of this law.

VI. HOW TO CONTACT BECU

If you have comments, questions, or concerns about our privacy practices or this California Privacy Notice, please contact us by visiting contact us here or reach out to us in the following ways:

By Postal Mail:

Privacy MS 1028-4
P.O. Box 97050
Seattle, Washington 98124

By Phone:

Business hours: Monday – Friday, 7 a.m. to 7 p.m. Pacific Time and Saturday, 9 a.m. to 1 p.m. Pacific Time
800.233.2328
Contact Us