Updated 12/10/2024
SouthState Bank, N.A. and its subsidiaries (collectively, the “Company,” “SouthState,” “we,” “us,” or “our”) are committed to protecting the privacy and security of the information we collect and to being transparent about the purposes for which we use your information.
This California Privacy Notice (“California Privacy Notice”) is provided by SouthState pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act of 2020 (“CPRA”), and its implementing laws (collectively referred to as the “California Privacy Laws”) and supplements the information contained in SouthState’s Privacy Statement.
This California Privacy Notice applies solely to information about California residents (“Consumers” or “you”) and to “Personal Information” as defined in the CCPA. The California Privacy Laws require us to make certain additional disclosures and provide California Consumers with the ability to request additional information about their Personal Information. This section explains these rights and describes how California Consumers may submit a request to exercise those rights.
Please note that the term Personal Information under the California Privacy Laws does not apply to Personal Information collected, processed, sold, or disclosed pursuant to:
- Gramm-Leach-Bliley Act (Public Law 106-102), the federal privacy regulation. Generally, this will apply to any Personal Information obtained in connection with SouthState’s financial products or services that are used primarily for personal, family, or household purposes.
- Medical information governed by the Confidentiality of Medical Information Act or protected health information as governed by the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
- Personal information covered by other sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA). Generally, this will apply to Personal Information related to credit history or credit worthiness.
- Publicly available information or lawfully obtained, truthful information that is a matter of public concern.
- Consumer information that is deidentified or aggregated.
Personal Information We Collect and Disclose
Information collected may be used to provide you with products and services that we offer, to provide ongoing management and maintenance of the products and services you have with us, or in order to meet regulatory, federal or state law requirements. In addition, we may use information collected on our website or other online platforms to market products and services to you. It is necessary for us to share certain customer information with our service providers in order to provide our products and services to you. Please see our Consumer Privacy Notice for specific details.
The table below shows each category of Personal Information we may have collected and disclosed for our business purposes (further described below) and the categories of potential other parties to whom the Personal Information was disclosed within the last twelve (12) months, depending on your relationship with us, and as permitted or required by law:
| Category of Personal Information Collected |
Examples | Categories of Other Parties to Whom We Disclose Personal Information |
|
|---|---|---|---|
|
Personal Identifiers and Contact Information |
Real Name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
| Certain sensitive types of Personal Information | Social Security number, driver’s license number or state identification card number, passport number, bank account number, credit card number, debit card number, or any other financial information, credentials allowing access to an account, age, race, color, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, pregnancy or childbirth or related conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information), precise geolocation. | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations |
|
| Commercial Information | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations |
|
| Biometric information | Physiological, behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints you provide to us, and voice recordings when you contact us by telephone or keystrokes. | Service Providers Government agencies as required by laws and regulations. |
|
| Sensory Data | Audio, electronic, visual, thermal, or similar information, such as phone call and video recordings; ATM and in-branch video monitoring. | Service Providers Government agencies as required by laws and regulations. |
|
| Geolocation Data | Information associated with the location of an electronic device. | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
| Protected Class Information under California or federal law | Characteristics such as age, sex or gender, race, religion/creed, color, national origin, citizenship, disability, immigration status, military/veteran status, medical conditions, marital status, and request for leave | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
| Education information | Education information subject to the federal Family Educational Rights and Privacy Act, such as student records and directory information | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
| Internet or other electronic network activity information | All activity on the Company’s information and communication systems, such as IP address, internet browsing history, search history, email communications, stored documents, usernames and passwords; information regarding interactions with a website, application, or advertisement, including phone calls, call logs, voice mails, text messages, chat logs, app use, mobile browsing and search history; and other similar information. | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
| Professional or employment information | Current or past job history | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
| Inferences drawn from other Personal Information | Information identified to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, and attitudes. | Service Providers Affiliates in accordance with applicable law Other Third Parties, in connection with products or services we provide, in accordance with applicable law Government agencies as required by laws and regulations. |
|
Sources of Personal Information
We obtain Personal Information directly from you, such as when you apply for or obtain one of our products or services, or if you apply for a job with us, and from affiliates, third-party service providers, business partners, consumer reporting agencies, publicly available databases, social media, operating systems and platforms, internet service providers, ad networks, data analytics providers, and joint marketing partners when they share the information with us.
Sale of Personal Information
In the preceding twelve (12) months, we have not sold personal information.
Disclosures of Personal Information for a Business Purpose
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
- Personal Identifiers
- Device/IP Data
- Web Analytics
- Geolocation Data
Use of Personal Information
We may use or disclose the Personal Information we collect for any of the following business or commercial purposes, including to:
- To fulfill or meet the reason you provided the information, including completing transactions and providing account services.
- To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
- To provide you with support and to respond to your inquiries, including to investigate and address your complaints and monitor and improve our responses.
- To help to ensure security and integrity to the extent the use of the personal information is reasonably necessary and proportionate.
- To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity.
- To debug to identify and repair errors that impair existing intended functionality.
- To perform services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the Company.
- To personalize, advertise, and market our products and services.
- To conduct employment-related activities, including the performance of background checks, manage employee benefit programs, conduct workforce assessments, process payroll, and conduct research, analytics, and data analysis, to assist in succession planning, and process and evaluate job applications and recruit employees.
- To evaluate or conduct a merger, sale, reorganization, assets, joint venture, partnership, transfer, or other disposition of all or any portion of our business.
- Comply with federal, state, or local laws or comply with a court order or subpoena to provide information.
- Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.
- Exercise or defend legal claims in connection with litigation.
- To comply with regulatory retention requirements.
- For other purposes as expressly authorized by the implementing regulations of the California Privacy Laws.
Retention of Personal Information
We retain Personal Information for as long as needed to fulfill the purpose(s) for which it was collected, unless a longer retention period is required by law to comply with our business requirements and legal obligations, to provide our services, resolve disputes, enforce our agreements, and other purposes to the extent provided in this California Privacy Notice. We take reasonable steps to delete personal information when (1) we have a legal obligation to do so; (2) we no longer have a purpose or obligation for retaining the information; or (3) if you ask us to delete the information unless there is an applicable exception to deleting the information under the California Privacy Laws.
We are required to maintain records of consumer requests submitted under the California Privacy Laws, which may include personal information, and how we responded to such requests for at least twenty-four (24) months. Such information related to consumer requests is retained only for recordkeeping purposes.
Special Considerations for Minors
In the preceding twelve (12) months, we have not knowingly sold or shared (as such term as defined in the California Privacy Laws) Personal Information about California consumers under 16 years of age. We do not knowingly collect or retain Personal Information from individuals under 13 years of age.
Your Rights under the California Privacy Laws
The California Privacy Laws provide consumers with specific rights regarding their personal information. This section describes your rights and explains how to exercise those rights. You may submit requests to us as described below and we honor those rights where they apply.
Right to Know About Personal Information Collected and/or Disclosed: You have the right to request that the Company disclose personal information that it has collected, sold, or shared about you. This includes a request for any or all of the following:
- The categories of personal information we have collected about you.
- The categories of sources from which the personal information is collected.
- The categories of personal information that we have sold or disclosed for a business purpose about you.
- The categories of third parties to whom the personal information was sold or disclosed for a business purpose.
- The specific pieces of personal information we collected about you.
- The business or commercial purpose for collecting, selling, or sharing personal information.
Right to Request Deletion of Personal Information: You have the right to request that the Company delete any personal information that we have collected, sold, or shared about you.
Right to Limit Use and Disclosure of Personal Information: In certain circumstances, you have the right to limit the use and disclosure of sensitive personal information. Our use of your sensitive personal information is solely for business purposes and not for those purposes for which a consumer may exercise a right to limit the use or disclosure under the California Privacy Laws. Therefore, we include this disclosure of information for information purposes only.
Right to Opt Out of Sale or Sharing of Personal Information: You have the right to direct a business that sells or shares personal information about you to third parties to stop doing so. The Company does not sell or share any personal information as defined by the California Privacy Laws. Therefore, we include this disclosure of information for informational purposes only.
Right to Request Correction of Inaccurate Personal Information: You have the right to request that we correct inaccurate personal information that we maintain about you. Our goal is to keep your personal information accurate, current, and complete. These rights do not apply to personal information collected or disclosed under certain exemptions under the California Privacy laws. This includes, but is not limited to, personal information collected, processed, sold, or disclosed subject to the GLBA. Therefore, rights such as the Right to Know and Right to Delete do not apply to personal information collected, processed, sold, or disclosed pursuant to these exemptions.
Right to Non-Discrimination: We will not unlawfully discriminate against you for exercising your rights under the California Privacy Laws.
To Exercise Your Rights Under This Privacy Notice
- Submit your request here: https://www.southstatebank.com/privacyrequest
- Call us at (800) 277-2175
Upon receipt of a request a consumer will receive a confirmation of receipt within 10 calendar days. A full response will be provided within 45 calendar days unless we notify you that an extension to provide the information is necessary. We may take up to an additional 45 calendar days from the initial request. Please remember that sensitive customer data collected under the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994 will not be included in the information provided to you. This includes information collected from you when you make a request to open an account with us.
We may deny your request if:
- We cannot verify your identity.
- The request is not covered under the California Privacy Laws.
We may deny your request for deletion of information we have collected, if:
- The personal information we collected is needed to complete your requested transaction.
- The personal information we have is required to be maintained as part of a regulatory or legal requirement.
- The personal information we have is required to service your account with us
- We are only required to respond to Requests to Know twice in a 12-month period.
- A response to a Request to Know may be limited to the 12-month period preceding receipt of the request if it would be impossible, involve disproportionate effort, or the request is for data for a specific time period.
- We are prohibited from disclosing certain specific pieces of personal information in response to a Request to Know including, but not limited to, Social Security numbers, driver’s license numbers, and financial account numbers.
Under Submitting a Request Through Your Authorized Agent
You may designate an authorized agent to make a Request to Know, Request to Delete, or Request to Correct on your behalf. If you use an authorized agent to submit a request, we require the authorized agent to provide proof that the consumer gave the authorized agent signed, written permission to submit the request. We may also require you to verify your identity directly with us and you to directly confirm with us that you provided the authorized agent permission to submit the request. We will inform you if we cannot verify your identity.
- If we cannot verify the identity of the person making a Request to Know, we are prohibited from disclosing any specific pieces of personal information to the requestor. However, if denied in whole or in part for this reason, we will evaluate the request as if it is seeking the disclosure of categories of personal information about the consumer. If we still cannot verify the request, and the request is denied in whole or in part, we will provide a copy of, or direct you to, our privacy policy.
- If we cannot verify the identity of the person making a Request to Delete or Request to Correct, we may deny the request and inform the person making the request that their identity cannot be verified.
Other Websites
Please be aware that we are not responsible for the privacy practices of other websites that are linked to our site. We encourage our visitors to be aware when they leave our site and to read the privacy statements or policies of each website that they visit.
Changes to this Privacy Notice
The policies and disclosures contained in this Privacy Policy may change over time, so please check this notice periodically for changes. If you have additional questions about SouthState Bank data collection practices after reading this notice, please contact us at [email protected].
How to Contact Us
If you have any questions or comments about this California Privacy Notice, the ways in which SouthState collects and uses your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at (800) 277-2175 or at https://www.southstatebank.com/privacyrequest.
