California Consumer Privacy Act Disclosure

CALIFORNIA NOTICE AT COLLECTION

ADDITIONAL NOTICE TO CALIFORNIA RESIDENTS – This supplements our Privacy Policy.

The state of California enacted the California Consumer Privacy Act of 2018 (“CCPA”), which was amended by ballot measure in 2020 (the California Privacy Rights Act 2020 (the “CPRA”)) and effective January 1, 2023, to further Californians’ right to privacy by giving CA residents an effective way to know of and control their Personal Information collected by companies doing business in CA.

Please note that many organizations following the law will refer to the updated law as the CPRA after January 1, 2023. However, the California Privacy Protection Agency (the “Agency”), which is the regulatory body charged with enforcing the CCPA and CPRA, has indicated it will continue to call the law the CCPA. Where we use “CCPA” in the requirements we are following the Agency’s approach and are referring to the law as updated by the CPRA.

North American Risk Services, Inc. (“NARS,” “we,” “our,” or “us”) is a third-party insurance claims administrator committed to keeping your Personal Information secure and provides this Disclosure to explain how we collect, protect, use, and disclose Personal Information relating to California residents. NARS recognizes that privacy is an important and protected right. It applies to all products, services and websites offered by NARS and its subsidiaries or affiliated companies. This Disclosure supplements our general Privacy Policy located on our web page.

This Disclosure does not apply to any third-party websites, services, applications, or portals linked to NARS’ sites. Those websites and services are governed by the privacy policies that appear on those sites and applications. We will not collect or use Personal Information for purposes other than those described in our Privacy Policy or this Disclosure, or in any supplementary privacy notices.

Service Provider

NARS acts generally as a service provider under the CCPA. This means that we collect and use Personal Information on behalf of another company, such as an insurance company or managing general agency, to provide claims management services to third party insurers and insureds. Where your Personal Information is processed by NARS acting as a service provider, this Disclosure will explain our privacy practices, and you should submit any request to exercise CCPA rights directly to us. Please note that in some instances, if you make a request to exercise CCPA rights to NARS where it acts as a service provider under the CCPA, we may be required to disclose your request to the relevant company.

In addition, the CCPA and its requirements do not apply to personal information processed in order to service a claim, which is governed by the California Insurance Code. Instead, the CCPA applies to any personal information a company collects outside of an insurance transaction, including employee and applicant information.

What is Personal Information and Sensitive Personal Information

The CCPA generally defines “Personal Information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household and can include the Personal Information listed in the section below entitled Categories of Personal Information Collected.

The definition of Personal Information under the CCPA also includes Sensitive Personal Information, which means: (l) Personal Information that reveals (A) a consumer’s social security, driver’s license, state identification card, or passport number; (B) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) a consumer’s precise geolocation; (D) a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) the contents of a consumer’s mail, email and text messages, unless we are the intended recipient of the communication; (F) a consumer’s genetic data; (G) a consumer’s neural data, which means information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information; and (2) the processing of biometric information for the purpose of uniquely identifying a consumer; (3) Personal Information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation; and (4) Personal Information of consumers that the business has actual knowledge are less than 16 years of age.

Personal Information Not Covered by the CCPA and this Disclosure

There are a number of exemptions from the application of the CCPA. The CCPA does not apply to the collection, maintenance, disclosure, or use of publicly available information lawfully made available or information subject to other federal laws. Accordingly, the following are categories of Personal Information that are not subject to the CCPA, and therefore are not covered by this Disclosure Notice. The obligations imposed by the CCPA do not apply to:

Health or medical information that is collected and that is subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the California Confidentiality of Medical Information Act or the Health Information Technology for Economic and Clinical Health Act.
Information collected in connection with the issuance of insurance or financial products or services to you that are to be used primarily for your personal, family, or household purposes and that is subject to the Gramm-Leach-Bliley Act (“GLBA”) or the California Financial Information Privacy Act. For example, where an insurer provides you with a personal insurance policy or handles a claim from you as an individual.
Information collected that is subject to the Fair Credit Reporting Act.
Information collected as a motor vehicle record that is subject to the Driver’s Privacy Protection Act of 1994.
Publicly available information or lawfully made available through the internet or from local, state or federal government records, and information we have a reasonable basis to believe is lawfully made available to the general public by you or by widely distributed media, or by a person to whom you have disclosed the information and not restricted it to a specific audience.
Deidentified or aggregated information.
Information received or provided in compliance with federal, state, or local laws, law enforcement, a court order or subpoena, a civil, criminal, or regulatory inquiry, investigation, or summons as provided by law.
Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or by the consumer.
Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

Rights Regarding Your Personal Information

The CCPA provides a California consumer with specific rights regarding Personal Information, subject to certain exceptions and requirements. A California consumer can make the following requests:

1. Right to Know and Access What Personal Information is Being Collected. You have the right to know and request (up to twice per year and subject to certain exemptions and carveouts):

The categories of Personal Information we collected about you;
The categories of sources from which Personal Information is collected;
The business purpose for collecting or disclosing, that Personal Information;
The categories of third parties with whom we disclose that Personal Information; and
The specific Personal Information we have collected.

2. Right to Delete Personal Information. Subject to certain conditions and exceptions, you have the right to request deletion of your Personal Information that we have collected about you. However, we are not required to delete Personal Information where a CCPA exception exists. For example, we do not have to delete Personal Information that is needed as follows: • To provide our services;

To complete the transaction for which we collected the Personal Information and take actions reasonably anticipated within the context of our ongoing business relationship with you;
To detect errors or bugs in our websites/servers or detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity;
To engage in statistical research in the public interest;
To comply with a legal obligation; or
To make other lawful use of that information as permitted by law.

3. Right to Correct Inaccurate Personal Information. Subject to certain restrictions, you have the right to request that we correct inaccuracies in your Personal Information.

4. Right to Know What Personal Information is “sold” or “shared,” or disclosed for a business purpose, and to whom. Note, however, that we do not “sell” or “share” Personal Information as defined by the CCPA. You also have a right to see by category the Personal Information we have disclosed and the categories of persons to whom your Personal Information was disclosed for business purposes.

5. Right to Opt-Out. You have the right to opt-out of “sales” and “sharing” of your Personal Information, as those terms are defined under the CCPA. However, we do not “sell” or “share” Personal Information.

6. Right to Limit Use and Disclosure of Sensitive Personal Information. The CCPA says a consumer shall have the right, at any time, to direct a business that collects Sensitive Personal Information about the consumer to limit its use of the consumer’s Sensitive Personal Information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services. However, we do not engage in uses or disclosures of sensitive Personal Information for purposes other than those allowed under section 7027, subsection (m) of the CCPA Regulations, which are outlined in the section entitled Use of Personal Information Collected below, that would trigger the right to limit use of sensitive Personal Information under the CCPA. We also do not collect or process sensitive Personal Information for purposes of inferring characteristics about you.

7. Right to No Retaliation or Discrimination. You have the right to be free from discrimination and retaliation because you exercise any of the rights under the CCPA. We will not discriminate or retaliate against you or for exercising any of the rights described in this section.

Categories of Personal Information Collected

The specific Personal Information we collect will depend on our specific relationship or interaction with that individual. We collect Personal Information in a variety of situations, including Personal Information on individuals who may be pursuing an insurance claim for benefits or damages, applying for, or maintaining employment, or from persons who provide vendor services.

The following identifies the categories and types of Personal Information we may collect about you (and may have collected in the prior 12 months). Some Personal Information included in each category may overlap with other categories:

Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, job title, date of birth, policy number, salary information, address, Social Security number, passport number, e-mail address, tax identification number, drivers’ license number or similar identifier, Internet Protocol address, and account name.
Personal information, as defined in the California Customer Records law, such as name, signature, physical characteristics or description, education, employment, employment history, financial and health information, bank account number, credit card number, debit card number, contact information, Social Security number, passport number, address, telephone number, driver’s license number, state identification number, insurance policy number, medical information, customer or claimant records containing Personal Information, as well as information provided by an insurance company, broker/agent or reinsurer for underwriting purposes and information included in a list of claims.
Characteristics of Protected Classifications under California or federal law, such as age, race, ancestry, national origin, citizenship, marital status, medical condition, physical or mental disability, sex (including gender, pregnancy, or childbirth and related conditions), sexual orientation, and veteran or military status.
Commercial Information, such as transaction and account information, and records of personal property, or services and products provided/purchased, information from consumer reporting agencies, other insurers, medical providers, and insurance support organizations, such as motor vehicle records, claims loss history, employment history, professional licenses and affiliations, date and cause of injury, disability, death, and credit report information.
Biometric Information such as individual genetic, physiological, and biological or behavioral characteristics.
Internet or other electronic network activity information. This may include browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement.
Geolocation data such as physical location or movements, which we do not capture.
Audio, electronic, visual, thermal, olfactory, or similar information, such as phone call recordings, as well as email and text messages and their contents and other communications when interacting with our customer service or claims representatives.
Professional or Employment-Related Information, such as occupation, job title, employer, employment status, salary information, employment history, performance evaluations, qualifications, licensing, disciplinary record and some contents of mail, e-mail and text messages on company devices, applications or communication platforms.
Education information, defined as information that is not publicly available personally identifiable information as defined In the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, and 34 C.F.R. Part 99). This might include grades, transcripts, class lists, student schedules, student identification codes, student financial information or student disciplinary records. We do not collect this information.
Inferences drawn from any of the information listed above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. We do not collect this information.
Sensitive Personal Information, such as Social Security number, driver’s license number, medical condition, and physical or mental disability, as well as other information as defined earlier under “What is Personal Information.”

Use of Personal Information Collected

The specific business or commercial purposes for which we use and or disclose Personal Information depends on our relationship or interaction with a specific CA resident but is generally used for employment purposes or to provide claims services as a third-party claims administrator on behalf of another company, such as an insurance company or managing general agency. We process this information to perform our contractual obligations to you or our clients, for our legitimate business purposes, to comply with legal obligations and exercise any legal rights we may have consistent with the following purposes:

To run our day-to-day claims business operations processing, adjusting, and administering claims under an insurance policy, including subrogation and salvage operations, litigation management, risk management, and auditing; to communicate with you and others about managing your claim, to evaluate and process your claim, to conduct customer surveys, and to manage disputes and legal actions.
To evaluate and improve claims processes, procedures, quality, security, and training, including analytics models that might apply to claims services and loss control.
To better understand how you access and use our sites and the products and services available (both on an aggregated and individualized basis) to better communicate with you.
To investigate, enforce, and apply this Disclosure, the Privacy Policy, and our Terms of Use, and to otherwise protect our own rights and interests.
To detect, prevent, investigate, or otherwise address suspected fraud, security incidents, potential threats to the data or safety of any person, to protect against inadvertent data loss, malicious, deceptive, fraudulent, or illegal activity, and to debug or identify and repair errors, to prevent violations of this Disclosure, or Privacy Policy or our Terms of Use, or as evidence in litigation, security or technical issues.
To manage our business operations, to consider and implement mergers, acquisitions, reorganizations, refinancing, and other business transactions, and for the administration of our general business, accounting, recordkeeping, and other legal functions.
To comply with internal policies and procedures, verify and maintain the quality or safety of services, quality assurance, data analytics, auditing, accounting, and billing, IT systems, data, and website hosting, and to resolve complaints. To the extent that we use or maintain de-identified data, we take reasonable measures to ensure that de-identified data cannot be associated with a natural person.
To pay insurance claims, pay third-party service providers and other payees, and to make other business-related payments.
To send you text messages related to your claim, appointment reminders, or other service-related communications if you have opted in.
To cooperate with applicable federal, state, and local agencies, regulators, courts, laws, and law enforcement including due diligence regarding money laundering, trade sanctions screening, and credit, as well as responding to government requests for information, including the Centers for Medicare and Medicaid Services.
To recruit and evaluate candidates in the employment process.

We also may use automated processes and aggregate any of the Personal Information we collect for any of these purposes or for analyzing statistics and trends.

We may host online forums or other interactive programs that enable you to share information about our services or other issues of interest. Please be aware that any communications with any such program is open for review by other public users. By submitting to any such program, you acknowledge and agree that you have no expectation of privacy or confidentiality in the content you submit, including any Personal Information.

We do not collect, use, or disclose Personal Information beyond the purposes authorized by the CCPA, and only use and disclose it as reasonably necessary and proportionate: (i) to perform our services requested by you; (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents; (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct; (iv) to verify or maintain the quality and safety of our services; (v) for compliance with our legal obligations; (vi) to our service providers who perform services on our behalf; and (vii) for purposes other than inferring characteristics about you.

We establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of Personal Information appropriate to the volume and nature of the personal data at issue.

Categories of Sources from Which Personal Information is Collected

The categories of sources of from which NARS collects Personal Information includes the following:

From you, either directly or indirectly or through your authorized representative, in the course of providing our services, and automatically through your use of our website.
From our clients, insurance companies, brokers, and agents, claims professionals, independent claims adjusters, customers, employers, and website visitors. As permitted by applicable law, we may combine the information we collect from publicly available or third-party sources.
Background checks and other screening tools, including credit agencies, financial institutions, sanctions screening, insurance fraud detection and prevention databases, statistical reporting agencies, claims inquiry, and consumer reporting agencies.
Vendors, service providers, medical and health service providers, contractors, medical equipment companies, structured settlement companies.
Publicly accessible sources, including social media and governmental records.
Governmental authorities, including state, local and federal law enforcement, courts, agencies, and regulators.
Other third parties.

Disclosure of Personal Information to a Service Provider or Contractor and Other Recipients

The specific Personal Information we disclose will depend on our specific relationship or interaction with that individual. The categories of Personal Information we have disclosed for a business purpose in the preceding twelve (12) months include Identifiers, Personal Information, Characteristics of Protected Classifications, Commercial Information, Audio, Electronic, Visual, or similar information, Professional or Employment-Related Information, and Sensitive Personal Information.

The categories of third parties, service providers and contractors and other recipients to whom we disclose Personal Information for business purposes consistent with the CCPA include:

Business partners, including affiliated companies, subsidiary companies, managing general agencies, insurance agents, brokers, claims representatives, customer service representatives, and IT representatives, as well as the insurance company clients, auditors, lawyers, tax professionals, claims professionals, reinsurers, actuaries, underwriters, and related professional entities.
External vendors and third-party service providers, your employer, independent claims adjusters, repair shops, claims related vendors, appraisers, mediators, contractors, roofing companies, accountants, medical professionals, experts, engineers, actuaries, health professionals, health service providers, auditors, debt collection agencies, background and credit reporting agencies, lawyers and other outside professional advisors, consumer reporting agencies, financial institutions, credit bureaus and industry reporting agencies, and other companies or individuals associated with our business operations.
Governmental authorities, including state, local and federal law enforcement, public agencies, regulators, courts, public authorities in compliance with the law, subpoena, judicial proceedings, federal national security reporting, court order, or other legal process.
Fraud detection and prevention vendors and authorities to investigate, detect, and prevent potentially fraudulent or suspicious activities, including disclosure to state/federal and local investigators, state agencies, law enforcement, attorneys, other insurance companies and their investigators, companies engaged for the detection and prevention of spam and malware mitigation, and other related purposes.
Other third parties as required by law.

NARS discloses Personal Information with other companies or individuals in the following limited circumstances:

We have express authorization,
As authorized by law;
NARS restricts access of Personal Information to NARS employees, vendors, medical and health vendors, healthcare providers who provide independent medical examinations, insurance carriers, legal counsel, your employer, medical equipment companies, claims adjusters, companies that structure settlements/annuities and determine lifespans and state and other government agencies, the Centers for Medicare and Medicaid Services, contractors and agents who need to know such information in order to operate, develop or improve services. These individuals are bound by confidentiality obligations and may be subject to discipline, including termination, if they fail to meet these obligations. We have a good faith belief that use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce applicable Terms of Service, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against imminent harm to the rights, property or safety of NARS, its users or the public as required or permitted by law.
We may disclose aggregated or de-identified non-personal information, which does not identify an individual user.

PLEASE NOTE THAT WE DO NOT SELL A CONSUMER’S PERSONAL INFORMATION TO A THIRD PARTY FOR MONETARY OR OTHER VALUABLE CONSIDERATION AND DO NOT SELL THE PERSONAL INFORMATION OF CONSUMERS UNDER 16 YEARS OF AGE.

IN ADDITION, WE DO NOT SHARE BY MEANS OF RENTING, DISCLOSING, DISSEMINATING, TRANSFERRING OR MAKING AVAILABLE A CONSUMER’S PERSONAL INFORMATION TO A THIRD PARTY FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING, WHETHER OR NOT FOR MONETARY OR OTHER VALUABLE CONSIDERATION. WE DO NOT SELL THE PERSONAL INFORMATION OF CONSUMERS UNDER 16 YEARS OF AGE. WE DO NOT ENGAGE IN TELEMARKETING OR TARGETED ADVERTISING.

How to Make Requests to Exercise Consumer Rights

If you are a California resident, you may make a request to exercise the rights above by contacting us at:

(800) 315-609;
privacy@narisk.com; or
Completing our Data Subject Request – Click here.

Or write to us at:

North American Risk Services, Inc.
Attention: Privacy Inquiries
P.O. Box 166002
Altamonte Springs, FL 32716-6002

Note that under the CCPA, we are not obligated to provide the information required in this Disclosure to you more than twice in a 12-month period.

In some instances, we may maintain personal information for longer than 12 months. You have the right to submit a request to know what personal information was collected prior to the 12-month period preceding our receipt of your request. On any request, please indicate the date range for which you are making the request to know.

Please note however, as a service provider or contractor we shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumer’s authorized agent to the extent that we have collected Personal Information about you in our role as a service provider or contractor. Instead, a service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business’s response to a verifiable consumer request.

Verification Of Consumer Requests

Under the CCPA, the request can be made by a California consumer, by a consumer on behalf of the consumer’s minor child, or by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumer’s behalf, or by a person who has a power of attorney or is acting as a conservator for the consumer, and that we can verify, using commercially reasonable methods, to be the consumer about whom we have collected Personal Information. We have no obligations to act if we cannot verify that the consumer making the request is the consumer about whom we have collected Personal Information or is a person authorized by the consumer to act on such consumer’s behalf.

In order to respond to your request, we will first verify your identity using the Personal Information you recently provided to us. The information we need in order to verify your identity may differ depending on the request made and our relationship with you and might include your name, mailing address or email address you use to interact with us, your phone number, your date of birth, your policy number, or other information. We will attempt to verify your request by matching the information provided by you with the information we have in our records. In some cases, we may also conduct checks, including with third party identity verification services, to verify your identity before taking any action with your Personal Information. For privacy reasons, we reserve the right to request additional information to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and will explain the reason for the denial.

Authorized Agent

You may designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that you directly verify your identity and the authority of your authorized agent.

A business operating as an authorized agent must provide both of the following:

(1) Certificate of good standing with its state of organization; and

(2) A written authorization document, signed by the California resident, containing the California resident’s name, address, telephone number, and valid email address, and expressly authorizing the business to act on behalf of the California resident.

Individuals who are operating as an authorized agent must provide a written authorization document, signed by the California resident, containing the California resident’s name, address, telephone number, and valid email address, with express authorization of the individual to act on behalf of the California resident.

We reserve the right to reject (1) authorized agents who have not fulfilled the above requirements, or (2) automated CCPA requests where we have reason to believe the security of the requestor’s Personal Information may be at risk.

We shall use any Personal Information collected from you or your agent in connection with our verification of your request solely for the purposes of verification, and shall not further disclose the Personal Information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.

Right to Appeal

You have the right to appeal any determination we make as a business entity, not as a service provider, by contacting us at the address below. If you disagree with a decision, you must file a concise statement (i) setting forth what you think is the correct, relevant, or fair information and (ii) explaining the reasons why you disagree with the decision regarding the Personal Information. You will be notified in writing of any action taken or not taken in response to the appeal, including a written explanation of the reason for the decisions within the time period allowed by state law.

Retention of Personal Information

We retain the Personal Information we collect only as reasonably necessary for the purposes described in this Disclosure Notice. We will retain certain Personal Information for as long as it is necessary to comply with our tax, accounting and recordkeeping obligations, for fraud investigative purposes, for purposes of any relevant statute of limitations, to administer certain policies and coverage, and for research and development purposes, as well as an additional period of time as necessary to protect, defend or establish our rights, defend against potential claims, and to comply with our legal obligations. From time to time, we may also deidentify your Personal Information, retain it and use it for a business purpose in compliance with CCPA.

Contact Us

If you have any questions or comments about this section of the Privacy Policy, the ways in which we collect and use your Personal Information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

North American Risk Services, Inc.
Attention: Privacy Inquiries
P.O. Box 166002
Altamonte Springs, FL 32716-6002

Changes to our Disclosure

We regularly review this Notice and may change it from time to time. We encourage you to review it periodically. The date of the last change will be indicated by the date listed at the bottom of the Notice. Any future changes will be reflected with an updated version of this Notice which will be available on our Sites.

Last Updated: 2026