Privacy Policy For California Residents
Last Updated: June 15, 2026
This Privacy Policy and Notice at Collection applies to personal information of California residents to the extent the information is subject to the California Consumer Privacy Act (CCPA). This notice does not apply to personal information collected pursuant to (i) the federal Gramm-Leach-Bliley Act and its implementing regulations or the California Financial Information Privacy Act; or (ii) certain medical and health information covered by HIPAA.
Personal Information We Collect, Use, Disclose, Share, or Sell
Categories of Personal Information We Collect, Categories of Sources of Personal Information, Business or Commercial Purposes for Which Personal Information Will Be Used, and Third Parties with Whom Personal Information is Sold, Shared, or Disclosed.
We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). Within the last twelve (12) months, may have collected the following categories of personal information from the sources identified below for the business and commercial purposes indicated, and disclosed, shared, or sold (as indicated) such categories of personal information with the specified categories of third parties.
| Category of Personal Information Collected | Category of Third Parties Personal Information is Sold or Shared for Advertising Purposes |
|---|---|
| Identifiers A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, or other similar identifiers. | Only online identifiers shared with: – Advertising networks – Data analytics providers – Social networks |
| Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Personal Information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. Note: Some personal information included in this category may overlap with other categories. | N/A |
| Protected classification characteristics under California or federal law Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). | N/A |
| Commercial information Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Online browsing and purchase history shared with: – Advertising networks – Data analytics providers – Social networks |
| Biometric information Physiological, biological, or behavioral, characteristics (including DNA) that can be used to establish individual identity, or imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template such as a faceprint, a minutiae template, or a voiceprint, can be extracted and keystroke patterns or rhythms, gait patterns, or rhythms, and sleep, health or exercise data that contain identifying information. We do not collect this category of personal information. | N/A |
| Internet or other electronic network activity Browsing history, search history, information on a consumer’s interaction with an internet website, application, or advertisement. | – Advertising networks – Data analytics providers – Social network |
| Geolocation data Physical location or movements. | N/A |
| Sensory data Audio, electronic, visual, thermal, olfactory, or similar information. | N/A |
| Professional or employment-related information Current or past job history or performance evaluations. | N/A |
| Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g, 34 C.F.R. Part 99) Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. | N/A |
| Inferences drawn from other personal information to create a profile about a consumer Profile reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | – Advertising networks – Data analytics providers – Social network |
| Sensitive Personal Information Social Security Number, driver’s license, state identification card, or passport number; Account log-in financial account, debit card, or credit card number in combination with any required security access code, password, or credentials allowing access to the account; Precise geolocation; Racial or ethnic origin, religious or philosophical beliefs, or union membership; Contents of mail, email or text messages unless Company is intended recipient of the communication; or Genetic Information. | N/A |
Baldwin has disclosed each of the categories described above to a service provider or contractor in the preceding 12 months.
Personal Information is retained based on internal retention policies. Information is segregated by legal retention requirements and maintained in accordance with various local, state, federal, and other legal requirements. Personal information will not be retained beyond the reasonably foreseen need to retain the information for legal or business purposes.
Categories of Sources of Personal Information
Baldwin has collected personal information from the following sources: from you and from others including insurance companies that we work with; third party claims handlers who are involved in a claim or assist us in investigating or processing claims, including witnesses and external claims data collectors and verifiers; our business partners with whom we work to provide insurance products, public sources, such as public databases (where permitted by law); from our affiliates; from data brokers; insurance brokers or other intermediaries; third party evidence providers; healthcare service providers; financial institutions; and individuals that you may be associated with (e.g. joint account holders, company employees or directors, family members, etc.
Purposes of Processing Your Personal Information
Baldwin collects, discloses, and otherwise processes your personal information, both directly and through service providers, contractors, and third parties, your personal information for the following purposes: to provide our services and fulfill our contractual obligations to you and other third parties; to review, process and assist with claims; to conduct data analysis, which helps us assess risks, price our products appropriately and improve our services; to help us prevent and detect fraud, money laundering, terrorism and other crimes; to help develop new, and improve existing, services; to operate and expand our business activities; to carry out background checks, where lawful; to perform human resources and administrative activities in connection with our services; to exercise, defend and protect our legal rights or the rights of third parties; to comply with legal obligations and to cooperate with regulatory bodies to which we are subject; for research and development of new insurance products; to audit our business; and for marketing purposes.
We do not sell or share (for the purposes of cross-context behavioral advertising) the personal information of minors under 16 years of age.
We share personal information we collect about you for purposes of cross-context behavioral advertising.
We disclose personal information to third parties who perform marketing and data analytics services for us, such as Google, or Linked-In. These disclosures, even when they do not include the exchange of monetary compensation, under the CCPA may constitute a “sale,” which is defined under the CCPA to mean any disclosure to a third party in exchange for anything of value. Under this definition of the concept of a “sale” we may sell consumers’ personal information.
We may disclose personal information collected via online website tracking technologies as described in our online privacy policy: https://baldwin.com/privacy-policy/. You have the ability to restrict this sharing through your browser preferences, which may include universal opt-out preferences such as the GPC (Global Privacy Control — Take Control Of Your Privacy) . Please review our website privacy policy for more information.
We do not use or disclose sensitive personal information for purposes other than the following:
- To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
- To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information,
- To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.
- To ensure the physical safety of natural persons.
- For short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with the business, provided that the personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.
- To perform services on behalf of the business.
- To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by the business.
- To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.
Your Privacy Rights
Right to Notice
You have the right to receive notice at or before the point of collection about our collection and retention practices. Please review our notice at collection linked https://baldwin.com/privacy-policy/ccpa-privacy-policy-at-collection for more information.
Submitting Consumer Requests
You may submit a consumer request to us by email at LegalCompliance@baldwin.com or via phone at (888) 971-9520. You may make up to two disclosure requests in any 12 month period.
Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.
Making a verifiable consumer request does not require you to create an account with us.
When you submit a verifiable consumer request, we will take steps to verify your request by email or telephone call. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.
Right to Know and Access Your Information
You have the right to request that we disclose to you certain descriptions and categories of the personal information we collect, use, disclose, share, or sell about you. For example, you may request the following:
- The categories of personal information we have collected about you.
- The categories of sources from which the personal information is collected.
- The business or commercial purpose for collecting, selling, or sharing personal information.
- The categories of third parties to whom we disclose the personal information.
- The specific pieces of personal information we have collected about you.
You may make up to two disclosure requests in any 12 month period.
Right to Request Deletion
You have the right to request that we delete your personal information. See above for additional details about how to submit a consumer request.
You should be aware, however, that California law allows us to retain your personal information under certain conditions, even if you have asked us to delete it, such as when retaining your personal information is necessary for us to complete a transaction with you or provide you with a good or service you have requested. We will notify you of any denial of your deletion request and the reason for such denial.
Right to Request Correction
You have the right to request that we correct your personal information. See above for additional details about how to submit a consumer request.
Right to Opt-Out of the Sharing or Sale of Personal Information
We may share personal information we collect about you with third parties for purposes of cross-context behavioral advertising. We may sell personal information we collect about you, as the term “Sale” is defined by the CCPA. You may opt out of the sale or sharing (for purposes of cross-context behavioral advertising) of your personal information by signaling an opt-out preference through the GPC (Global Privacy Control — Take Control Of Your Privacy), or by making an opt-out request.
To submit a request under the Right to Opt-Out, please provide the information necessary to identify the consumer to whom the request should be applied and reasonable identifying information that you are authorized to make the request and submit an email requesting your “Right to Opt-Out” email at LegalCompliance@baldwin.com or via phone at (888) 971-9520.
Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sharing or sale at any time by contacting us.
Authorized agents will be required to provide proof of their authorization to submit opt-out requests and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent in limited circumstances.
Right to Non-Retaliation for Exercise of Consumer Privacy Rights
We will not retaliate against you because you have chosen to exercise any of your privacy rights provided by the CCPA.
If you have questions about this policy, please contact us at:
Your journey begins here
When you decide to partner with us, you choose to protect your business and open the door to new ventures and opportunities.