Last updated on January 1, 2023

This Privacy Policy for California Residents supplements the information contained in Zenith’s Privacy Statement (https://www.thezenith.com/zenith/privacy-statement) and any other privacy notices previously provided to you.  This policy applies solely to natural persons who are residents in the State of California (“consumers” or “you”).  We adopt this policy to comply with the California Consumer Privacy Act of 2018, as amended by The California Privacy Rights Act of 2020 (collectively the “Act”) and in accordance with any implementing regulations.  Any terms defined in the Act have the same meaning when used in this policy.  When we use the terms “Zenith”, “we”, “us”, or “our” in this Privacy Policy, we are referring to Zenith Insurance Company and its subsidiaries.

Information We Collect

As insurance companies that write workers’ compensation insurance, commercial property and casualty insurance, and crop insurance, we collect personal information about you when it is necessary to conduct the business of insurance or to comply with federal regulations under the Crop Insurance Act. As an employer, we also collect personal information from Zenith job applicants and employees.  Depending upon the nature of our relationship with you, the categories of personal information we collect may differ.

In general, we will have collected the following categories of personal information from consumers within the past twelve months:

Category	Examples	Collected	Business Purpose
A.   Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES	Administering or investigating a claim Communicating with you Complying with law Credentialing of providers Due diligence for contracting purposes Due diligence for employment purposes Honoring our contractual obligations Improving our products and services Processing payments to or from you Security purposes Underwriting your policy
B.   Personal information categories described in the California Customer Records Statute (Cal. Civ. Code § 1798.80(e))	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.	YES	Administering or investigating a claim Communicating with you Complying with law Credentialing of providers Due diligence for contracting purposes Due diligence for employment purposes Honoring our contractual obligations Improving our products and services Processing payments to or from you Purposes Underwriting your policy
C.   Characteristics of protected classifications under California or federal law	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES	Administering or investigating a claim Complying with law Credentialing of providers Due diligence for contracting purposes Due diligence for employment purposes Honoring our contractual obligations Improving our products and services Processing payments to or from you Security Purposes Underwriting your policy
D.   Commercial Information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES	Administering or investigating a claim Complying with law Credentialing of providers Due diligence for contracting purposes Due diligence for employment purposes Honoring our contractual obligations Improving our products and services Underwriting your policy
E.   Biometric information	Physiological, behavioral, and biological characteristics, including information pertaining to an individual’s DNA that is used or is intended to be used singly or in combination with each other or with other identifying data to establish individual identity.	YES	Security Purposes
F.    Internet or other electronic network activity information	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES	Administering or investigating a claim Complying with law Honoring our contractual obligations Due diligence for employment purposes Improving our products and services Underwriting your policy
G.   Geolocation data	Geolocation data of an internet-connected device	YES	Administering or investigating a claim Due diligence for employment purposes Security Purposes
H.   Sensory data	Audio, electronic, visual, thermal, olfactory or similar information.	YES	Administering or investigating a claim Communicating with you Complying with law Due diligence for employment purposes Security Purposes
I.     Professional or employment-related information	Current or past job history or performance evaluations, income and salary details, credentialing information.	YES	Administering or investigating a claim Complying with law Credentialing Due diligence for contracting purposes Due diligence for employment purposes Reviewing your employment application Underwriting your policy
J.    Education information that is not publicly available and that is personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g)	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	YES	Administering or investigating a claim Complying with law Due diligence for employment purposes Underwriting your policy
K. Inference from other personal information	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES	Administering or investigating a claim Due diligence for employment purposes
L. Sensitive Personal Information	(1) Personal information that is not publicly available and that reveals: (A) a consumer’s social security, driver’s license, state identification card, or passport number; (B) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) a consumer’s precise geolocation; (D) a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) the contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication; (F) a consumer’s genetic data,(2) (A) the processing of biometric information for the purpose of uniquely identifying a consumer; (B) personal information collected and analyzed concerning a consumer’s health; (C) personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. Sensitive personal information that is “publicly available” pursuant to paragraph 2 of subdivision (v) of Section 1798.140 shall not be considered sensitive personal information or personal information.	YES	Administering or investigating a claim Communicating with you Complying with law Credentialing of providers Due diligence for contracting purposes Due diligence for employment purposes Honoring our contractual obligations Improving our products and services Processing payments to or from you Security Purposes Underwriting your policy

Personal information does not include:

• Publicly available information from federal, state or local government records.
• Deidentified or aggregated consumer information.
• Information to the extent it is subject to the Fair Credit Reporting Act.
• Information excluded from the Act’s scope such as personal information collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley Act and implementing regulations (“GLBA”), the California Financial Information Privacy Act (“CFIPA”), and the Driver’s Privacy Protection Act of 1994 (“DPPA”).

When information is subject to an exclusion, your rights under the Act are limited.

Retention Period

All information collected is retained for the length of time required by our record retention policies or as required by law, whichever is longer.

The examples below may help you understand what information may be collected depending upon your relationship with us.  Some items listed may be exempt from the scope of the Act because they are subject to protection under other privacy laws such as GLBA.  They are included here in the interest of full disclosure.  Generally, Zenith may collect the following information: 1) your name; 2) your physical and mailing address; 3) your email address; 4) your telephone number; 5) your signature; and 6) your Social Security number, federal employer identification number or other federal or state identification number.  Additionally, depending on the type of consumer you are, Zenith may collect additional information from you as follows:

When you apply for workers’ compensation insurance or become a workers’ compensation insurance policyholder, we may collect the following additional information: 1) your date of birth; 2) your and your employees’ driver’s license numbers if hired to drive; 3) salaries and compensation paid by the business to you, other owners and your employees; 4) prior insurance policy numbers, loss runs and insurance experience and history; 5) information about your financial assets; 6) education, employment, and employment history and/or professional employment information to verify your eligibility or those of other owners for exclusion from coverage under the workers’ compensation law; 7) your marital status; and 8) your bank account number and details, credit card number and details, and other financial information to process premium payments and refunds.

When you apply for commercial auto, liability and/or property insurance or become a commercial insurance policyholder, we may collect the following additional information: 1) your and your employees’ driver’s license numbers if hired to drive; 2) your prior insurance policy numbers and loss runs; 3) your drivers’ names, addresses, age, gender, marital status and date of hire; 4) motor vehicle records for you and any other driver to be insured under your policy; 5) vehicle make, model and identification numbers for vehicles to be insured under your policy; 6) information about properties you or your family members own that are insured or to be insured under your policy; and 7) bank or mortgage loan numbers for financed properties or vehicles to be insured under your policy.

When you apply for or become a crop insurance policyholder or file a claim under a crop insurance policy with Zenith, we may collect the following additional information: 1) information about crops that you own or in which you have a substantial beneficial Interest that are insured or to be insured under your policy; 2) your date of birth and your date of death; 3) your criminal activity (if applicable); 4) your citizenship status; and 5) your recorded statement.

If you file a claim under a workers’ compensation insurance policy, we may collect the following additional information: 1) your Medicare identification number; 2) your medical records; 3) your employment records including wage information, citizenship status, or work visa number or information; 4) your bank account number and details, credit card number and details, and other financial information to process payments and refunds; 5) your driver’s license number; 6) your date of birth and date of death; 7) your gender; 8) your marital status; 9) your nonpublic educational records; 10) your financial information including information about assets you own; 11) your prior claim history; 12) your criminal activity (if applicable); 13) your ability to benefit test, predispositions or other inferences from personal information; 14) your geolocation data and 15) your recorded statement.

If you file a claim under a commercial auto, liability or property insurance policy, we may collect the following additional information: 1) your Medicare identification number; 2) your medical records; 3) your employment records including wage information; 4) your bank account details; 5) your driver’s license number; 6) your date of birth and date of death; 7) your gender; 8) your marital status; 9) your nonpublic educational records; 10) your vehicle make, model and identification number; 11) your past driving history; 12) your financial information including information about assets you own; 13) your prior claim history; 14) your criminal activity (if applicable); 15) your passport number (if needed); 16) your citizenship status; and 17) your recorded statement.

If you are a Zenith agent, workers’ compensation medical provider, Zenith vendor or a service provider, we may collect the following additional information: 1) your bank account number and details; 2) your debit or credit card  number and details; 3) your insurance policy numbers (WC, CGL, E&O); 4) your professional license number; 5) your professional employment information, employment records including wage information; 6) your nonpublic educational records; 7) your criminal activity (if applicable); 8) your Medicare identification number; 9) your driver’s license number; 10) your date of birth and date of death; 11) your gender; 12) information about assets you own; 13) your recorded statement; and 14) information required for credentialing.

If you are a witness to an accident or a loss involving a claim, we may collect the following additional information: 1) your driver’s license number (if needed); 2) your vehicle make, model and identification number (if needed); 3) your insurance policy number (if needed); and 4) your recorded statement.

If you are an employee or intern of Zenith or when you apply for employment or an internship with Zenith, we may collect the following additional information: 1) your driver’s license number and driving records (if needed); 2) your date of birth; 3) your gender; 4) your marital status; 5) your professional license number; 6) your professional employment information; 7) your nonpublic educational records; 8) your criminal activity (if applicable); 9) your medical information; 10) your passport number (if needed); 11) your citizenship status; 12) your photograph and/or fingerprints; 13) your financial information; 14) your  biometric information; 15) your geolocation data; and 16) your emotional intelligence factors.

Categories of Sources of Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you or your agent. For example, we may collect personal information from forms you complete when applying for insurance or filing a claim.
• Indirectly from you.
• From others. For example, we may collect personal information about you from a medical provider.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the reason you provided the information. For example, if you applied for Commercial Auto insurance, we will use the vehicle identification numbers you provided for your vehicles to ensure that coverage for such vehicles are added to your policy.  If you filed a claim under a Workers’ Compensation policy, we will use your medical records to evaluate your claim.
• To review, investigate, process and pay claims.
• To provide you with support and respond to your inquiries, including investigating and addressing your concerns and monitoring and improving our responses.
• To create, maintain, customize, and secure your account with us, including detecting security incidents and debugging to identify and repair errors that impair existing functionality.
• To process your requests, premium payments, transactions, and other payments to and from you, and prevent transactional fraud.
• For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.
• To review your employment application and comply with our regulatory obligations as an employer.
• To respond to law enforcement requests, regulatory agency requests and as required or allowed by applicable laws, court order, rules or regulations.
• As described to you when collecting your personal information or as otherwise set forth in the Act or as otherwise set forth in this Privacy Policy and any other Privacy Notice (for example, the business purposes set forth in the chart above).
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Zenith’s assets in which personal information held by Zenith is among the assets transferred.
• To conduct fraud investigations and report fraud pursuant to applicable laws, court order, rules or regulations.

The business purposes listed above may also apply to the categories of personal information identified in the chart.  Zenith will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Selling or Sharing of Personal Information

We do not sell or share, as these terms are defined in the Act, consumers’ personal information, including sensitive personal information.

Sensitive Personal Information

We do not use or disclose consumers’ sensitive personal information for any purposes other than those which are permitted under the Act.   We do not control the collection of personal information by third parties.

Information We Disclose

Zenith may disclose your personal information to a service provider, a contractor, or a third party for a business purpose.  When we disclose personal information to a service provider for a business purpose, we enter a contract that describes the purpose and require the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We may disclose your personal information for a business purpose with the following:

• Service providers, contractors and third parties
• Insurance advisory rate service organizations
• Insurance industry standard setting organizations
• Governmental authorities and regulatory entities
• Insurance producers

In the preceding twelve (12) months, Zenith has disclosed the following categories of personal information for a business purpose:

Category A: Identifiers.

Category B: California Customer Records personal information categories.

Category C: Protected classification characteristics under California or federal law.

Category D: Commercial information.

Category E: Biometric information.

Category F: Internet or other similar network activity.

Category G: Geolocation data

Category H: Sensory data.

Category I: Professional or employment-related information.

Category J: Non-public education information.

Category K: Inferences drawn from other personal information.

Category L: Sensitive Personal Information

Your Rights and Choices

Request to Know

You have the right to request that Zenith disclose certain information to you about our collection and use of your personal information over the past 12 months or if permitted, a longer period of time. Once we receive and confirm your verifiable consumer request, we will disclose to you (as applicable to your request):

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information and, if we were to begin selling personal information, our business or commercial purpose for selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  • sales, identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Request to Delete

You have the right to request that Zenith delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies under applicable privacy laws and regulations.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, or protect against malicious, deceptive, fraudulent, or illegal activity, or respond to requests from governmental authorities prosecuting those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation or applicable laws, court order, rules or regulations.

Request to Correct

You have the right to request that Zenith correct your inaccurate personal information, including sensitive personal information.  Once we receive and verify your request, we will use no more than commercially reasonable efforts to implement your request.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by either:

• Calling us at: 1-888-622-8012
• Sending an email to: privacyoffice@thezenith.com, or
• Submitting a Web Form

Only you, or a person that you authorize to act on your behalf (“authorized agent”), may make a verifiable consumer request related to your personal information. If we receive a request from an authorized agent, we may request from you further verification to ensure the request was valid and intentional, your signed written permission authorizing the agent to act on your behalf and your signed permission to release, correct and/or delete your personal information before fulfilling the request. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for the right to know twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Making a verifiable consumer request does not require you to create an account with us.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We try to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt or a longer period, if permitted by law. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

 

Non-Discrimination

We will not discriminate against you for exercising any of your rights under the Act.

 

Changes to Our Privacy Policy

Zenith reserves the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated policy on the Website and update the policy’s effective date.

 

Contact Information

If you have any questions or comments about this policy, the ways in which Zenith collects and uses your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone:                       1-888-622-8012

Email:                        privacyoffice@thezenith.com

Postal Address:      Zenith Insurance Company, 21255 Califa Street Woodland Hills, CA 91367