Privacy statement for California residents

Effective Date: 12/12/2019

Last updated: 10/29/2026

This PRIVACY STATEMENT FOR CALIFORNIA RESIDENTS supplements the information contained in the OneAmerica Financial Privacy Statement for OneAmerica Financial Partners, Inc. and our affiliated companies (collectively, “we,” “us,” or “our”) and applies solely to visitors, users, and others who reside in the State of California (“consumers,” “you” or “your”). We adopt this Statement to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws. Any terms defined in the CCPA have the same meaning as defined in the CCPA when used in this Statement.

Information We Collect.

In the preceding 12 months, we have collected the following categories of personal information about consumers, depending on their relationship with us:

“Personal information” does not include publicly available information, deidentified or aggregated consumer information, or information otherwise excluded from the CCPA’s scope, including but not limited to the following:

• Certain health or medical information.
• Information collected pursuant to the Gramm-Leach-Bliley Act.
• Personal information subject to the California Insurance Code and its regulations, such as information collected in connection with an insurance transaction.

If you are a California job applicant, employee, or contractor of OneAmerica, please see our Employee Privacy Notice for California Residents.

Use and Disclosure of Personal Information.

We may use or disclose the above categories of personal information for one or more of the following business purposes. In the preceding 12 months, we have disclosed each of the above categories to our service providers and contractors for these business purposes:

• To perform services for our customers, including maintaining or servicing accounts, processing transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on our own behalf or that of a service provider.
• To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity.
• To debug systems to identify and repair errors.
• To perform internal research for technological development and demonstration.
• To conduct audits related to interactions with customers and transactions.
• To undertake activities to verify or maintain the quality or safety of a service or device.

We may also disclose personal information to our affiliated companies; to government agencies, regulators, courts, and law enforcement when required or permitted by law; and to others at your direction.

Sale or Sharing of Information.

We have not sold or shared consumers’ personal information in the preceding 12 months, and we do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. Because we do not sell or share personal information, opt-out preference signals (such as Global Privacy Control) do not change how we handle your information.

Sensitive Personal Information.

We use and disclose sensitive personal information only for purposes permitted by California law, such as providing the products and services you request, verifying your identity, preventing fraud, and protecting the security of our systems. We do not use or disclose it for other purposes, so we do not offer a right to limit its use.

Retention.

We keep personal information only as long as reasonably necessary for the purposes described in this Statement, or longer if required by law. How long depends on the type of record, our legal, regulatory, and contractual obligations, and any applicable legal hold, consistent with our records retention schedule.

Sources of Personal Information.

We may collect your personal information from the following sources:

• From third parties, such as distribution or marketing partners.
• From your employer.
• From you directly, such as when you use our website or fill out forms.

Data Access Request and Data Portability Rights.

You have the right to request that we disclose certain information about the personal information we have collected about you in the 12 months before your request. You may also ask us to include personal information we collected on or after January 1, 2022, which we will provide unless doing so is impossible or would involve disproportionate effort. Upon receipt of a verifiable information access request (“Data Access Request”) from you, we will disclose the following to you if disclosure is not exempted under California privacy laws.

• The categories of personal information we have collected about you.
• The categories of sources from which the personal information was collected.
• Our business or commercial purpose for collecting your personal information.
• The categories of personal information that we disclosed about you for a business purpose.
• The categories of third parties to whom we disclose personal information.
• The specific pieces of personal information we have collected about you.

For information on how to make a Data Access Request, see "Submitting a Privacy Request" below.

After we receive a verifiable Data Access Request from you, we will promptly take steps to disclose and deliver, free of charge to you, the personal information required, subject to certain exceptions as specified in the CCPA. The information may be delivered by mail or electronically, and if provided electronically, the information will be in a portable and, to the extent technically feasible, in a readily useable format that allows you to transmit this information to another entity without hindrance. You may submit up to two Data Access Requests per 12-month period.

We will confirm receipt of your request (including a Deletion or Correction Request) within 10 business days and respond within 45 calendar days after we receive it. If we need more time, we will notify you within that period, explain why, and respond within 90 calendar days after receipt.

Deletion Request Rights.

You have the right to request that we delete any personal information about you that we have collected from you, subject to certain exceptions. We may deny your request to delete your personal information if it is necessary for us to maintain your personal information in order to:

• Complete the transaction for which the personal information was collected, provide a good or service requested by you or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform duties pursuant to a contract with you.
• Help to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for those purposes.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
• To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with our business and compatible with the context in which you provided the information.
• Comply with a legal obligation.

For information on how to make a Deletion Request, see "Submitting a Privacy Request" below.

Correction Request Rights.

You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the information and the purposes for which we process it. For information on how to make a Correction Request, see "Submitting a Privacy Request" below.

Anti-Discrimination Rights.

You have the right not to be discriminated or retaliated against for exercising any of your rights under the CCPA, including if you are a job applicant, employee, or independent contractor.

Submitting a Privacy Request.

You can submit a Data Access, Deletion, or Correction Request by calling us at 1-800-249-6269 (toll-free) and requesting a paper copy of the request form. To verify your identity, we will match information you provide with information we already maintain about you, and we may ask for additional information if needed. Any personal information we collect from you in connection with our verification of your request will be used solely for the purposes of verification. You may submit a request on your own behalf or on behalf of your minor child. Another person or business entity may submit a request on your behalf if they are authorized by you to do so. If you are submitting a request on behalf of another person, you must submit proof that you are authorized to do so. Documents which may be accepted as proof of authorization include a signed power of attorney, proof of guardianship, or signed and notarized letter of authorization from the consumer on whose behalf the request is being made.

Accessibility.

Information on how a consumer with a disability may access this Statement in an alternative format may be obtained by sending an email to department.corporatecompliance@oneamerica.com.

Changes to Our Privacy Notice.

We reserve the right to amend this privacy statement at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the statement’s effective date.

Contact Information.

If you have any questions or comments about this notice, the ways in which we collect and use your information, your rights regarding such use, or wish to exercise your rights under California law, please write to us at the address below.

Privacy Officer
OneAmerica Financial Partners, Inc.
One American Square, P.O. Box 368
Indianapolis, IN 46206-0368

Privacy Officer

OneAmerica Financial Partners, Inc.
One American Square, P.O. Box 368
Indianapolis, IN 46206-0368