privacy policy

Information We Collect

In the course of our business, it is necessary to collect nonpublic personal information about you. However, we do not collect any information unless it is required to serve you and to conduct our business. We collect information from sources such as:

• You;
• Your interaction with us, including your use of our website through the use of Google Analytics features such as Audience Demographic Reports, Audience Interest Reports, and Remarketing;   
• Consumer reporting agencies and other third parties authorized by you to give us;
• information (e.g., consumer reports, claims reports, medical reports and motor vehicle reports); and
• Your transactions with us, our affiliates, and insurers or broker-dealers that we represent.

We do not sell, trade or rent your information to third parties. We do not knowingly collect personal information from people under the age of 13.

This Privacy Policy describes our practices for protecting your personal information. For California residents, this Privacy Policy also describes rights and disclosures under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).

Use and Disclosure of Customer Information

We do not disclose any nonpublic personal information about you to anyone outside our organization, except to effect a transaction authorized by you or as required by law. We may use and disclose such personal information to our affiliate companies:

• To communicate with you, including for marketing and advertising purposes;
• To identify other products and services that may be beneficial to you;
• To complete financial transactions authorized by you;
• To service, process or administer business operations such as accounting, underwriting and claims; and
• For other legitimate purposes relating to our business operations. 

We disclose personal information to the following categories of recipients for business purposes:

• Service providers and contractors (e.g., IT hosting, analytics, security, customer support, payment processing, claims administration, mailing, professional services);
• Affiliated entities;
• Government entities and regulators where required by law; and
• Other third parties at your direction / with your authorization. 

Sharing of Information with Service Providers

From time to time, we may retain third parties to perform various support services for us and may enter into relationships with other parties with whom we will jointly market various products and services.

We may disclose limited amounts of your information to these parties so they can perform their services or engage in joint marketing activities with us, but we do not disclose any more information than is necessary.

Where required, we contractually require service providers and contractors to process personal information only for specified business purposes and to protect it.  

Marketing and Advertising

Our website uses cookies, pixels, and similar tracking technologies to help us understand how visitors use our website, measure the effectiveness of our marketing, support advertising and retargeting efforts, and improve the overall user experience. These technologies may collect information such as your IP address, device information, browser type, pages visited, and interactions with our website. We do not store nonpublic personal information such as names, Social Security numbers, or financial account information directly in cookies.

We use Google Analytics 4 (GA4) and similar tools to analyze website traffic, understand user behavior, and support advertising and remarketing activities. Information collected through these tools may be used to show you relevant advertisements on third‑party websites. We do not sell personal information.

You may customize your advertising preferences or opt out of certain personalized advertising by visiting:

• https://adssettings.google.com
• https://tools.google.com/dlpage/gaoptout

Our email communications may include marketing content, advertisements, or solicitations. You may opt out of receiving marketing emails from us at any time by using the unsubscribe link included in our emails.    

Medical Information

If we receive your or your patient's health information, we do not share such information with third parties or affiliates except as required to service the subject of your policy, account, claim or contract; for legitimate insurance functions; as allowed by applicable laws governing the privacy of health records; or with your or your patient's authorization.

California residents: Certain health and medical information may be exempt from the CCPA/CPRA where governed by other laws; however, where we process personal information subject to the CCPA/CPRA, the rights described below may apply.

Confidentiality and Security of Your Information

We go to great lengths to maintain the privacy and security of your personal information. We maintain physical, electronic, technical, and procedural safeguards to protect all the information we collect. We are careful to ensure that our employees follow strict policies and procedures to protect the confidentiality of your personal information, and our computer systems are configured in a way that prevents inappropriate or unauthorized access by third parties. Our employees are allowed access to your personal information only to the extent that they need to know that information to provide products or services to you or for other legitimate business purposes.

California Residents – “Sale” and “Sharing” of Personal Information

Under California law, “selling” and “sharing” personal information are distinct concepts. “Sharing” may include the disclosure of personal information for cross‑context behavioral advertising.

We do not sell personal information as defined under California law. However, we may share certain personal information with advertising and analytics partners (such as Google) for cross‑context behavioral advertising and measurement purposes.

California residents may opt out of the sharing of their personal information for these purposes by clicking the “Do Not Sell or Share My Personal Information” link available on our website:
here ( https://www.magmutual.com/contact/data-privacy)      

Your California Privacy Rights

California Consumer Privacy Act (CCPA) Notice - Effective January 1, 2020

This Notice supplements the information contained in our Privacy Policy and applies to any California resident about whom we collect, use, and disclose "personal information:' "Personal information" is information that identifies, relates to, or could reasonably be linked to a particular California resident or household.

This Notice reflects the CCPA as amended by the CPRA, which became operative January 1, 2023, and provides additional rights including the right to correct and the right to limit use and disclosure of sensitive personal information.

This CCPA Notice does not apply to personal information that we collect, use, and disclose in our normal course of business on behalf of our customers or that we collect from job applicants, contractors, or employees.

"Personal information" does not include the following:

• Publicly available information from government records; 
• De-identified or aggregated consumer information;
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), or the California Confidentiality of Medical Information Act.

Information We Collect

We collected the following categories of personal information in the last 12 months.

• Identifiers (names, contact information, email address, postal address, Social Security number, Internet Protocol address);
• Personal information categories listed in the California Customer Records statute
• (Cal. Civ. Code § 1798.80(e)) (name, contact information, payment card data, medical information, insurance information, and financial information);
• Characteristics of protected classifications under California or federal law, such as gender, age, medical conditions, physical or mental disability, genetic information;
• Commercial information, such as transaction information and purchase history; Biometric information;
• Internet or network activity information, such as browsing history and interactions with our website;
• Geolocation data, such as device location;
• Audio, electronic, visual, and similar information, such as call and video recordings;
• Professional or employment-related information;
• Education information subject to the federal Family Educational Rights and Privacy Act, such as student records; and
• Inferences drawn from other personal information.

We have not sold any personal information in the last 12 months.

We have not shared personal information for cross-context behavioral advertising in the last 12 months.

Sensitive Personal Information (SPI) - Some personal information we collect may be considered “sensitive personal information” under California law (e.g., Social Security number, driver’s license/state ID, account log-in with password, precise geolocation, certain health information, biometric information).   

What We Do with Your Information

We may collect, use, or disclose personal information from you for the following purposes:

• Internal analytics to improve and develop our services;
• Audit, compliance, policy, procedures, or regulation;
• Billing, payment, and fulfillment;
• Customer claims and fraud investigation and prevention;
• General business administration;
• Marketing products and services;
• Financial reporting and accounting; and
• Exercise and defend against legal claims.  

Data Retention

We retain each category of personal information for as long as reasonably necessary and proportionate to achieve the purposes described in this Privacy Policy, including to: (i) provide services and administer policies/claims; (ii) comply with legal, tax, accounting, and regulatory requirements; (iii) maintain business records; and (iv) exercise or defend legal claims. Where feasible, we specify retention periods in our internal retention schedule. If we cannot specify a period, we use criteria including: the nature of the relationship with you, the sensitivity of the data, legal obligations, and limitation periods.

In addition to personal information, we may use or disclose patient information that has been de-identified as permitted by law. To the extent we share such de-identified patient information, we do so pursuant to one of the de-identification methodologies described in Section 164.514(b)(1) or (b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method and the HIPAA safe harbor method, respectively.  

Sources of Collected Information

We may collect, use, or disclose personal information from the following categories of sources:

• You;
• Affiliated entities and insurers or broker-dealers that we represent;
• Third-party service providers;
• Government or public authorities upon request and as required by law; and
• Consumer reporting agencies and other third parties authorized by you to give us information (e.g., consumer reports, claims reports, medical reports, and motor vehicle reports).

Your Rights Under the CCPA (as amended by the CPRA)

Right to Know/Disclose

You have the right to request, twice within a 12-month period, that we disclose the following information to you about our collection, use, and disclosure of your information in the last 12 months:

• Categories of personal information we collected about you;
• Categories of sources from which we collected personal information about you;
• The specific pieces of personal information we collected about you; 
• The business purpose for collecting personal information about you;
• The categories of personal information about you that we otherwise shared or disclosed; and
• The categories of third parties with whom we shared, or to whom we disclosed, personal information about you.

Right to Delete

You have the right to request the deletion of personal information that we collected from you and maintained.

In some cases, the CCPA may allow us to refuse to act on certain requests to delete personal information. When this is the case, we will provide you with an explanation as to why.

Right to Correct (CPRA)

You have the right to request that we correct inaccurate personal information that we maintain about you, subject to certain exceptions.

Right to Opt-Out of Sale or Sharing (CPRA)

You have the right to direct us not to sell or share your personal information. If we sell or share, we will provide a “Do Not Sell or Share My Personal Information” link on our website and process requests through that link and other available submission methods described below.

Right to Limit Use and Disclosure of Sensitive Personal Information (CPRA)

You have the right to limit the use and disclosure of sensitive personal information to certain purposes permitted by law. If we use or disclose sensitive personal information beyond those purposes, we will provide a “Limit the Use of My Sensitive Personal Information” link on our website.

Right to Non-Discrimination

You have the right not to be discriminated against for exercising any of your CCPA rights. Except as permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price rate for goods or services or a different level or quality of goods or services.

Submitting Requests (Know/Delete/Correct/Opt-Out/Limit)

To make a request for the disclosures or deletion described above, contact us via email at [email protected] or toll-free at 1-800-282-4882.

You may also submit requests to correct, to opt out of sale/sharing, and to limit the use/disclosure of sensitive personal information through the same channels, and where applicable via the following website links:

• Do Not Sell or Share My Personal Information: www.magmutual.com/contact/data-privacy
• Limit the Use of My Sensitive Personal Information: www.magmutual.com/contact/data-privacy

We must be able to reasonably verify your identity and authority to exercise these rights before fulfilling a request. So that we can verify your identity when you make a request, you will need to sign in to your MagMutual Account or provide certain personal information via email or over the phone when making the request. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

We will respond to your request free of charge within 30 calendar days. If we require more time (up to 90 days), we will notify you in writing of the reason and extension period.

Accuracy of Information

It is important to us to keep your information current and accurate. You may request access to, correction of, or deletion of personal information, subject to verification and applicable exceptions, by emailing us at [email protected] or calling toll-free at 1-800-282-4882. We will investigate your concerns and correct any inaccuracies within 30 calendar days. We may need additional time as permitted by law and will notify you if an extension applies.

Changes to our Policy

We will provide you with notice of any material or significant changes to the Privacy Policy before implementing the changes. If you have any questions about how we handle privacy and confidentiality issues, please contact us at [email protected] or toll-free at 1-800-282-4882.

Last Updated: June 26, 2026