Privacy Policy

Last Revised: July 2023

Overview

This privacy policy (“Privacy Policy”) describes how Bread Financial Holdings, Inc. family of companies, including Comenity Bank, Comenity Capital Bank, and Lon Operations LLC (d/b/a Bread ) (collectively referred to as “Bread Financial”, “we”, “us”, or “our”), collects, uses, discloses, processes, and retains Personal Information collected from you—or that you provide to us—in connection with your use of our “online services.” Online services includes our websites, such as www.breadfinancial.com, www.savings.breadfinancial.com, and www.payments.breadfinancial.com, Social Media Pages (as defined below), mobile apps, and from the Services (as defined below) we offer to our customers. By accessing our online Services, you signify your understanding of the terms set out in this Privacy Policy.

If you are visiting us from a location outside of the United States, please keep in mind that we are U.S.-based. This Policy governs the information collected by or on behalf of our websites irrespective of where you are located when you access, browse, or interact with it. If you are a California resident, please see the “Privacy Notice for California Residents” section below, which supplements this Privacy Policy. 

Our online services and Services are not intended for use by minors under 16, and we do not knowingly collect, use, or maintain Personal Information from users under 16. If you are under the age of 16, please do not use our online services or Services.

We may modify this Privacy Policy from time to time. If we make changes to this Privacy Policy, we will update the last revised date, post the updated version on our website(s) and take any other steps necessary to comply with applicable law. Please check the date at the top of this Privacy Policy to see when it was last updated.

Definitions:

• "Personal Information": Information that identifies you directly or can reasonably identify you using other information. Such Personal Information may include your name, Social Security number, date of birth, email address, postal address, or telephone number. Personal Information does not include information that is aggregated or anonymized in accordance with applicable law. 
  
• "Services": Refers to any account that you may have with us, including loans, credit cards, deposit accounts and any related service that we provide.
• "Merchant": The branded merchant partner for whom your Bread Financial credit card is issued as well as any merchant who accepts your Bread Financial credit card. Merchant also includes those businesses with whom we partner to offer you a point-of-sale installment loan or split-pay loan.
• "Cookies": Small pieces of data – usually text files – placed on your device (e.g., computer, tablet, phone, or similar device) when you use that device to visit our online Services. 

Personal Information We Collect

The following details the categories of Personal Information we collect and have collected over the past 12 months. Throughout this Privacy Policy, we will refer back to the categories listed in this chart.

Information You Directly Provide Us: When you visit our online services or use our Services, we will collect information that you directly provide us. This information may include: 

• Your first and last name
• Email address 
• Phone number 
• Date of birth 
• Identification numbers, such as a Social Security number or other taxpayer identification number
• Your home street address 
• Photographs, government identification, or other official identifying information, such as a driver’s license
• Financial account numbers, such as for a debit or credit card 
• Employment history 

You may provide information in writing, through our online services (e.g., online forms), using other customer service tools, or over the phone with our customer service representatives. As noted on our calls, all calls are recorded and retained in order to provide the best assistance to you, improve our level of customer experience and service, and to meet any legal and regulatory requirements.

Information We Collect Automatically or Generate About You: We also collect information automatically when you visit our websites. This information may include:

• Your device’s IP address
  
• Device type
• Device hardware model 
• Unique device identifier
• GPS location data
• Other Information about your interactions with our Services on any Merchant website or our websites
• Information collected by Cookies and other similar technologies 

Information from Third Parties: We also collect information about you from third parties such as credit information (e.g., credit reports). 

To help us further identify you to protect against fraud and identity theft, and for other purposes (including to improve our product or Services, or for us, or third parties, to market to you), our technology may gather further information about you, which information may include the following:

Cookies: Like many online services, we use Cookies or other anonymous identifiers to collect information about you. We may also gather and store “clickstream information,” including information regarding your use of our site directly, or through service providers, including Cookies, web beacons, page tags, pixels or similar tools (collectively, “Cookies”) and information about your device, the type of browser you are using, your internet service provider, your page views, pathways to and from the site, referral URL, data from third party analytics or marketing companies regarding the interaction with any web-based advertising, and your operating system. 

We use Cookies for a variety of different reasons. Certain Cookies are essential to our online services, including to provide you with features or Services that you have requested. We also use Cookies to record your choices and settings regarding the Services, collect analytical and performance data, and for the purposes of retargeting and advertising, in order to identify your interests and providing advertising that we believe is relevant to you. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s).

Your Choices Regarding Cookies: You can decide whether or not to accept Cookies through your internet browser’s settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allowing you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit a website and some of our websites’ functionalities may not work. To explore what Cookie settings are available to you, look in the “preferences” or “options” section of your browser’s menu. 

Additionally, behavioral advertisements will feature an AdChoices Icon (also known as the “Advertising Option Icon”), that when clicked, provides more information about how the advertisement was delivered to you and also provides the ability to opt-out from future Online Behavioral Advertisements by the third parties listed. To opt-out of Online Behavioral Advertising (OBA) from all Digital Advertising Alliance (DAA)-participating companies, please visit http://www.aboutads.info/choices/. Please note that if you opt-out of OBA, you may still receive online advertising from us on third party websites. Opting out from third party advertising companies means that the advertisements you receive will not be based on your preferences or behavior. Further, opting out does not prevent other parties from tracking your online activity for other uses as described in this Privacy Policy.

Site Analytics:

We may use various analytics services, including Google Analytics, a web analytics service provided by Google, Inc., on our websites. These analytics services use Cookies or other tracking technologies to help us analyze how users interact with and use the websites, compile reports on activity, identify and address technical issues, and provide other services related to activity and usage. These technologies may collect information such as your IP address, time of visit, whether you are a return visitor and any referring website. 

Our online services do not use analytics services to gather information that personally identifies you. The information generated by analytics services will be transmitted to and stored by the individual analytics service provider and will be subject to the providers’ privacy policies. You can control the information provided to Google and opt out of certain ads provided by Google by using the methods set forth in http://www.google.com/policies/privacy/partners/ or use the Google Analytics opt out browser add-on at http://tools.google.com/dlpage/gaoptout?hl=en.

From time to time, we may create and manage social media pages that include, but are not limited to, a Twitter or Instagram account or a Facebook page (“Social Media Pages”). With your consent, Personal Information like your name, profile picture, gender, networks, user ID, list of friends, birthday, likes, education history, work history, current city, hometown, interests, relationship status, and any other information you have shared on a social media site may be collected by us. This Privacy Policy does not cover the privacy practices of the social media websites on which we may have Social Media Pages. Please review their privacy policies and terms of service if you have any questions about their privacy practices. 

How We Use The Personal Information We Collect

Information we receive in connection with our online services or the Services we provide may be used for the following purposes:

• Process your transactions
• Expand, enhance, or verify the accuracy of our records 
• Market our products or our Merchant partners’ products to you
• Contact you by mail, telephone, text message or email, in connection with your account or to deliver updates to our Services (for example, we may use email to send you information about products or services and new offers that we think may interest you – you may be able to opt out of some of these communications)
• Develop new products and services or improve them and your experience with them
• Support internal business operations, including assessing and managing risk and meeting legal and regulatory requirements
• Provide technical support for using our online services
• Monitor and analyze trends and usage
• Comply with contractual obligations, relevant industry standards and our policies
• Verify your identity, prevent or detect fraud or other unauthorized or illegal activity
• Operate, evaluate and improve our business (including developing new products and services, performing data analytics, and performing accounting, auditing and other internal functions)
• Respond to your requests
• Resolve disputes
• Respond to law enforcement requests and as required by applicable law, court order, or governmental regulations
• Perform any other business purpose stated when collecting your Personal Information or as otherwise set forth in applicable data privacy laws, such as the Gramm-Leach-Bliley Act. 

Providing Your Personal Information To Others

We may disclose your Personal Information to third parties in the ways described in this Privacy Policy: 

Merchants: By using our Services, you authorize us to disclose Personal Information to Merchants, for managing and servicing your account, Merchants’ marketing purposes, including certain information that is a part of or related to your application for your account, including, but not limited to, your name, email address and whether or not you were pre-qualified for our loan products, as permitted by law. You may limit this sharing at any time. See “Your Choices” below. 

Service Providers:  We disclose information (such as name, account information, demographic information) to our service providers in connection with our everyday business operations, including those that engage in assisting us in underwriting, sending communications on our or our Merchants’ behalf, document storage, fraud prevention, collections, maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of a service provider.

Marketing and Analytics Companies: We disclose information (such as name, account information, demographic information, and transaction information) to marketing and analytics companies for the purposes of marketing our or our Merchants’ products and services to you, as well as the purposes set forth below: 

• Auditing related to a current interaction and concurrent transactions, including, but not limited to, ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
• Debugging to identify and repair errors that impair existing intended functionality
• Short-term, transient use of Personal Information that is not used by another party to build a consumer profile or otherwise alter your consumer experience outside the current interaction
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that we own, manufacture, was manufactured for us, or that we control
• With the Merchant for their marketing purposes and with other non-affiliated third parties (for example, marketing companies) for purposes of marketing our or our Merchant’s products and services to you
• With regulators or auditors, in connection with an audit, routine inquiry, or to fulfill our contractual or legal obligations
• With third parties who may purchase your loan agreement (or an interest in the loan or agreement), or the rights to service such loan account
• With non-affiliated third parties, including regulatory bodies, law enforcement officials, governmental agencies, and courts, in response to a judicial proceeding, court order, or legal process or for the purposes of preventing fraud or criminal activity, or as required by law or to protect our legal rights
• With our Affiliates who have a need to know such information for everyday business purposes
• With any third party in response to a legal or regulatory inquiry.

In the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of any or all of our assets, some of the Personal Information that we hold may be among the assets transferred to a buyer or other successor. We may transfer to another business or non-affiliated entity or its affiliates, advisors or service providers some or all information about you in connection with, or during negotiations of, any joint marketing relationship, merger, acquisition, sale of assets or any business unit, change in ownership control or financing transaction. If we do, we may not be able to limit how such other party may use or further transfer your information.

We may disclose information in other ways if you give us consent or direct us to do so.

Your Choices 

When it comes to how your Personal Information is collected, stored, used, and disclosed, you have rights and choices. You can control how Personal Information is collected or disclosed, as well as how we communicate with you. Here are some of the ways you can customize your choices.

Choose How We Collect Personal Information

You may choose to limit the Personal Information you provide when our online services or Services request it. In order to receive our Services, some Personal Information is required. This Privacy Policy is intended to describe to you how your Personal Information is collected, used, and disclosed so you can make the choices that are right for you. 

Choose How We Communicate With You

You have choices about how we communicate with you and how it is delivered. Some messages are considered necessary for you to manage your accounts with us (e.g., servicing your account) and some are considered optional (e.g., marketing emails). 

Some browsers have a ‘Do Not Track’ feature that signals to online services that you do not want your online activities tracked. We recognize browser do not track signals. In order for us to recognize such a signal you will have to enable it in your browser according to your browser’s instructions.

Protecting Personal Information

Your privacy is important to us. We have implemented and maintain reasonable physical, technical, electronic, and administrative security measures to safeguard the Personal Information that we collect through our websites, your interactions with us, or through our Services. 

Accuracy of Your Personal Information

We strive to maintain accurate Personal Information about you. If you are a Bread Financial cardholder or borrower and believe that our records contain inaccurate or incomplete information about you, please contact the Customer Care phone number listed on your billing statement or on the back of your credit card. Customers with a registered online account may review their Personal Information by logging in to our secure account management service. 

Privacy Notice for California Residents 

This Privacy Notice for California Residents (“Notice”) applies to California consumers and households (“you” and “your”) whose Personal Information we collect through our online services and the services we offer, and describes your rights and choices with respect to the processing of Personal Information under the California Privacy Rights Act (“CPRA”) which amends the California Consumer Privacy Act (“CCPA”).  This Notice does not apply to Bread Financial employees or job applicants except to the extent you may utilize our Services.  For California residents, this Notice controls to the extent it conflicts with any provision in the main body of the Privacy Policy.  Capitalized terms not defined in this Notice are defined in our Privacy Policy.

The specific Personal Information that we collect, use, and disclose relating to a California resident covered by the CPRA will vary based on our relationship or interaction with that individual. Most of the information that we collect is collected in connection with your application for, and use of our Services.  As such, it was collected in accordance with the terms of the federal Gramm Leach Bliley Act and is exempt from the provisions of the CCPA and CPRA.  For your privacy rights related to that information please see our Financial Privacy Policy further described above or found at https://www.breadfinancial.com/en/privacy.html.

How We Collect, Use, Share, and Sell Information

Below is a summary describing the Personal Information we collected from you in the past 12 months, as classified under the CPRA, the reason we collect your Personal Information, and how we disclose, share, and sell your information.  Please see our Privacy Policy for further detail about how we collect, process, and disclose Personal Information about you. 

Categories of Information Collected: As described further in our Privacy Policy, when you visit our online services, interact with us, or use our services, we may collect your Personal Information for business or commercial purposes.  In the past 12 months we may have collected the following categories of Personal Information directly from you when you communicated with us, indirectly when you visited our online services, through the use of Cookies and other technologies, as well as from third parties, such as Merchants: 

• Identifiers, including first and last name, email address, IP address, device identifier, government identification number (such as Social Security number), date of birth, phone number, financial account numbers 
• Commercial information, such as information related to your purchasing or consuming tendencies, including financial transactions, and employment 
• Internet or other electronic network activity information, such as device type, device hardware model, and information about your interactions with our Services on any Merchant website or our online services, or information collected from Cookies and other similar technologies 
• Geolocation information. 

Uses of Information: As described further in our Policy, in the past 12 months we may have used the information we receive in connection with our online services or the Services we provide for the following purposes: 

• Process your transactions
• Expand, enhance, or verify the accuracy of our records 
• Market our products or our Merchant partners’ products to you
• Contact you by mail, telephone, text message or email, in connection with your account or to deliver updates to our Services (for example, we may use email to send you information about products or services and new offers that we think may interest you – you may be able to opt out of some of these communications);
• Develop new products and services or improve them and your experience with them
• Support internal business operations, including assessing and managing risk and meeting legal and regulatory requirements
• Provide technical support for using our online services
• Monitor and analyze trends and usage
• Comply with contractual obligations, relevant industry standards and our policies
• Verify your identity, prevent or detect fraud or other unauthorized or illegal activity
• Operate, evaluate and improve our business (including developing new products and services, performing data analytics, and performing accounting, auditing and other internal functions)
• Respond to your requests
• Resolve disputes
• Respond to law enforcement requests and as required by applicable law, court order, or governmental regulations
• Perform any other business purpose stated when collecting your Personal Information or as otherwise set forth in applicable data privacy laws, such as the Gramm-Leach-Bliley Act. 

Disclosure of Information: As described further in our Policy, in the past 12 months we may have disclosed each of the data categories described above to the following third parties: 

• Merchants: By using our Services, you authorize us to share Personal Information with Merchants, for managing and servicing your account and for Merchants’ marketing purposes, including certain information that is a part of or related to your application for your account, including, but not limited to, your name, email address and whether or not you were pre-qualified for our loan products, as permitted by law. You may limit this sharing at any time. See “Your CPRA Privacy Rights and Exercising Your CPRA Rights” below.  
• Service Providers: We share information (such as name, account information, demographic information) with our service providers in connection with our everyday business operations, including those that engage in assisting us in underwriting, sending communications on our or our Merchants’ behalf, document storage, fraud prevention, collections, maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of a service provider;
• Marketing and Analytics Companies: We share information (such as name, account information, demographic information, and transaction information) with marketing and analytics companies for the purposes of marketing our or our Merchants’ products and services to you. 

Selling or Sharing of Information: In the last 12 months, we have “sold” or “shared” (as defined by the CPRA) identifiers and internet or other electronic network activity information to third party partners for advertising and marketing Bread Financial services to consumers. We did not sell or share personal information of minors under 16 years of age. 

How Long We Retain Your Personal Information

We retain your Personal Information as long as it is deemed necessary for providing our Services and in accordance with applicable laws and regulations, which is approximately seven years from the end of our relationship (e.g., seven years after the account is closed and balance is paid in full). Your Personal Information will be destroyed in accordance with applicable requirements at the end of the applicable retention period.   

Your CPRA Privacy Rights

The CPRA provides California residents with certain rights regarding their Personal Information.  These rights are not absolute and certain exceptions apply under the CPRA. To exercise any of the rights described below, see the “Exercising Your CPRA Rights” section. 

Right to Know: You have the right to know the categories and specific pieces of personal information we have collected about you in the previous 12 months. 

The categories of Personal Information include:

• The categories of sources from which the Personal Information was collected.
  
• Our business or commercial purpose for collecting or selling Personal Information. 
• The categories of third parties with whom the business shares Personal Information. 
• Specific pieces of Personal Information we have collected about you. 

As more fully explained above, the data that we collect in the categories listed above is collected from you and data resellers for the marketing or servicing of a financial product. We may use any of the categories of information listed above for other business or operational purposes compatible with the context in which the Personal Information was collected. We disclose the above data to the Merchant listed on your card or who received the proceeds of your loan, services providers, vendors, advertising partners and data analytics providers. 

Right to Deletion: You have the right to request that we delete any Personal Information we have collected about you. 

Right to Opt-Out of the Sale and Sharing of Information: You have the right to opt-out of the sale and sharing of Personal Information we have collected about you. 

Right to Non-Discrimination: You have the right to not receive discriminatory treatment for exercising any of your CPRA Rights.  The Company will not treat you differently for exercising any of the rights above. 

Right to Correct: You have the right to request that we correct inaccurate Personal Information maintained about you.

Exercising Your CPRA Rights

How to Submit a Request: If you are a California resident or an authorized agent and wish to make a request, you can make a request by visiting https://calprivacy.comenity.com or dialing 1-877-655-5391 (TDD/TTY: 1-800-695-1788). In order to verify your identity we will require you to provide: your first name, last name, address, phone number, date of birth and email address. Once you have provided your data you will be asked a series of questions to confirm your identity. 

If you are an authorized agent, such as Power of Attorney, and submitting a request, please send a letter to Comenity at PO Box 182567, Columbus, OH 43218 with the request type(s) (request to know, delete, do not sell or share, and/or correct my data).  Please include proof that the data subject gave you signed permission to make the request.

Under the CPRA, you may exercise these rights yourself or you may also designate an authorized agent to make these requests on your behalf.  For the Company to process the request, you must provide the authorized agent signed written permission.  The Company reserves the request to require the agent to verify their own identity and to confirm directly with you that you have provided the authorized agent permission to submit the request. 

How to Opt-Out of the Sale and Sharing of My Information: If you are a California resident and wish to opt-out of the sale and sharing of your personal information, please click here: Do Not Sell or Share My Personal Information.

How to Contact Us

To submit questions about this Notice, or to contact us for more information, please call 1-877-655-5391 (TDD/TTY: 1-800-695-1788). To exercise your rights under the CPRA, please only do so following the designated methods above. 

CPRA Statistics

CPRA Requests Handled July 1, 2022 through June 30, 2023

Request to Know: 1,517 Requests Received, 887 Requests Verified, 887 Verified Requests Answered, 630 Verified Requests Denied

Request to Delete: 342 Requests Received, 207 Requests Verified, 207 Verified Requests Answered, 135 Verified Requests Denied

Request to Opt Out*: 4,143 Requests Received, N/A Requests Verified, 4,143 Verified Requests Answered, 0 Verified Requests Denied

Request to Correct: 250 Requests Received, 126 Requests Verified, 126 Verified Requests Answered, 124 Verified Requests Denied

*Requests are passed to our service providers.

During this period, our median time within which we sent responses was 3.6 days.