M-F 9:30a-6:30p
    Mesa Group Consulting
    Join
    Legal Document

    California Privacy Rights

    MESA & CO CONSULTING LLC, doing business as Mesa Group Consulting

    Effective Date: [TBD — date of publication]
    Last Updated: [TBD — date of publication]

    This California Privacy Rights notice supplements our Privacy Policy and applies exclusively to California residents. This policy describes how Mesa Group Consulting collects, uses, discloses, and protects the personal information of California consumers as required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

    Table of Contents

    1
    INFORMATION WE COLLECT

    In the past 12 months, Mesa Group Consulting has collected the following categories of personal information from California consumers:

    Categories of Personal Information Collected

    CategoryExamplesCollected?
    A. IdentifiersName, alias, postal address, email address, phone number, Social Security number, driver's license number, passport number, online identifiers, IP address, account name, unique device identifiersYES
    B. Personal Information (Cal. Civ. Code § 1798.80(e))Name, signature, SSN, physical characteristics, address, telephone number, driver's license, passport, education, employment, employment history, bank account number, credit card number, financial informationYES
    C. Protected Classification CharacteristicsAge (40+), race, color, ancestry, national origin, citizenship, religion, marital status, medical condition, physical or mental disability, sex, veteran or military status, genetic informationNO
    D. Commercial InformationRecords of services purchased or considered, purchasing or consuming histories or tendenciesYES
    E. Biometric InformationPhysiological, biological, or behavioral characteristics (fingerprints, faceprints, voiceprints, iris/retina scans, keystroke patterns, gait)NO
    F. Internet or Network ActivityBrowsing history, search history, information on interaction with website or application, cookies, pixels, device informationYES
    G. Geolocation DataPhysical location (derived from IP address)YES
    H. Sensory DataAudio, electronic, visual, thermal, olfactory, or similar information (e.g., call recordings)YES
    I. Professional or Employment InformationCurrent or past job history, performance evaluations, employer information, incomeYES
    J. Non-Public Education InformationEducation records maintained by an educational institution or party acting on its behalfNO
    K. InferencesProfile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitudesYES
    L. Sensitive Personal InformationSSN, driver's license, state ID, passport; account login + password/credentials; precise geolocation; racial/ethnic origin; religious/philosophical beliefs; union membership; genetic data; biometric data; health data; sex life/sexual orientation data; contents of mail/email/texts (not directed to Mesa Group)YES (Limited)

    Note on Sensitive Personal Information

    We only collect SSN, driver's license, account login credentials, and precise geolocation from Category L. We do not collect racial/ethnic origin, religious beliefs, union membership, genetic data, biometric data, health data, sex life/sexual orientation data, or contents of mail/email/texts not directed to us.

    Sources of Personal Information

    We collect personal information from the following sources:

    • •Directly from you (forms, enrollment, communications)
    • •Credit bureaus (Experian, Equifax, TransUnion)
    • •Service partners (SmartCredit, Novae, SuperMoney, etc.)
    • •Public databases and commercially available data sources
    • •Social media platforms and advertising networks
    • •Cookies and tracking technologies on our website

    2
    HOW WE USE PERSONAL INFORMATION

    Mesa Group Consulting uses personal information for the following business and commercial purposes:

    Business Purposes

    • Providing Services: Credit repair, business funding facilitation, credit monitoring, DIY training, financial consulting, life insurance referrals
    • Processing Transactions: Enrollment, billing, payment processing, invoicing
    • Customer Support: Responding to inquiries, providing technical support, managing client accounts
    • Communication: Service updates, progress reports, appointment reminders, transactional notifications
    • Legal Compliance: CROA, FCRA, GLBA, TCPA, CAN-SPAM, TSR, CCPA/CPRA, and other applicable laws
    • Security and Fraud Prevention: Protecting against unauthorized access, fraud, illegal activity
    • Internal Operations: Quality assurance, training, audits, business planning
    • Recordkeeping: Maintaining records as required by law (5-year minimum under TSR; up to 7 years for legal/tax purposes)

    Commercial Purposes

    • Marketing and Advertising: Email marketing, SMS marketing, promotional offers, retargeting ads, social media advertising
    • Analytics and Optimization: Website analytics, user behavior analysis, A/B testing, campaign performance tracking
    • Lead Generation: Capturing potential clients, nurturing leads, conversion optimization

    3
    HOW WE SHARE PERSONAL INFORMATION

    Categories of Third Parties We Share With

    In the past 12 months, Mesa Group Consulting has disclosed personal information to the following categories of third parties for business purposes:

    Service Partners:

    • • SmartCredit (credit monitoring)
    • • Novae (business funding and debt relief for business and personal)
    • • SuperMoney (financial product comparisons — personal loans, auto refinancing, student loans, debt consolidation, credit cards)
    • • Ava Finance, CreditStrong, Self (credit building platforms)
    • • RentReporters, Rental Kharma, BoomPay, Experian Boost (credit building and rent reporting)
    • • PolicyGenius (life insurance comparison platform)
    • • Various life insurance carriers (for life insurance applications and quotes)
    • • Trust & Will (estate planning document platform)
    • • Various lenders (through SuperMoney and other lending networks)

    Credit Bureaus and Creditors:

    • • Experian, Equifax, TransUnion
    • • Creditors, collection agencies, data furnishers

    Payment Processors:

    • • Credit card processors, ACH processors, payment gateways

    Technology and Service Providers:

    • • GoHighLevel (CRM, email/SMS marketing, client portal, call recording storage)
    • • Skool (educational content platform, community access)
    • • Google Analytics (website analytics)
    • • Facebook/Meta (advertising and retargeting)
    • • Web hosting providers
    • • Cloud storage providers (including for call recording storage and transcription)
    • • Email service providers

    Legal and Regulatory Entities:

    • • Law enforcement agencies
    • • Government agencies and regulators
    • • Courts and legal counsel

    Business Transfer Recipients:

    • • Potential acquirers, merger partners, or successor organizations (in the event of business transfer)

    Personal Information Disclosed for Business Purposes

    CategoryDisclosed to Third Parties?
    A. IdentifiersYES
    B. Personal Information (Cal. Civ. Code § 1798.80(e))YES
    D. Commercial InformationYES
    F. Internet or Network ActivityYES
    G. Geolocation DataYES
    H. Sensory Data (Call recordings)YES — to technology providers for storage and transcription
    I. Professional or Employment InformationYES
    K. InferencesYES
    L. Sensitive Personal InformationYES (Limited)

    Note: SSN and driver's license are disclosed only to authorized partners (credit bureaus, identity verification services, payment processors) as needed to provide requested services. Call recordings are stored and processed through secure technology providers (such as GoHighLevel and cloud storage providers) for quality assurance, transcription, training, and compliance purposes.

    4
    YOUR CALIFORNIA PRIVACY RIGHTS

    As a California resident, you have the following rights under the CCPA and CPRA:

    4.1 Right to Know

    You have the right to request that we disclose:

    • • Categories of personal information we have collected about you
    • • Categories of sources from which we collected personal information
    • • Business or commercial purpose for collecting or selling personal information
    • • Categories of third parties with whom we share personal information
    • • Specific pieces of personal information we have collected about you

    Time Period: We will provide information for the 12 months preceding your request.

    4.2 Right to Delete

    You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal retention requirements, fraud prevention, contractual obligations, legal compliance).

    Note: We may retain information as required by CROA (Credit Repair Organizations Act), FCRA (Fair Credit Reporting Act), GLBA (Gramm-Leach-Bliley Act), TSR (Telemarketing Sales Rule), tax laws (IRS requirements), and other applicable regulations. If you exercise your right to delete information necessary to provide our services, we may not be able to continue providing those services.

    4.3 Right to Correct

    You have the right to request correction of inaccurate personal information we maintain about you.

    4.4 Right to Opt-Out of Sale or Sharing

    You have the right to opt out of the sale or sharing of your personal information.

    Important: Mesa Group Consulting does not sell your personal information to third parties. We do not engage in data brokering or selling consumer data for monetary compensation.

    4.5 Right to Limit Use of Sensitive Personal Information

    You have the right to limit the use and disclosure of your sensitive personal information to only what is necessary to provide services you requested or as permitted by law.

    Sensitive Personal Information We Collect:

    • Social Security Number (required for credit services)
    • Driver's license or state ID (for identity verification)
    • Account login credentials (for client portal access)
    • Precise geolocation (from IP address)

    How We Use It:

    • • SSN: Obtaining credit reports, identity verification, credit bureau disputes
    • • Driver's License: Identity verification and compliance with KYC (Know Your Customer) requirements
    • • Login Credentials: Secure client portal access
    • • Geolocation: Website analytics and fraud prevention

    We only use sensitive personal information for purposes necessary to provide our services and comply with legal obligations. We do not use sensitive personal information for purposes beyond those permitted by law without your consent.

    4.6 Right to Non-Discrimination

    You have the right to not receive discriminatory treatment for exercising your CCPA/CPRA rights. See for details.

    5
    DO NOT SELL OR SHARE MY PERSONAL INFORMATION

    Mesa Group Consulting does not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

    What Does "Sell" or "Share" Mean Under CCPA/CPRA?

    • •"Selling" means disclosing or making available personal information to a third party in exchange for monetary or other valuable consideration.
    • •"Sharing" means disclosing personal information to a third party for cross-context behavioral advertising purposes, whether or not for monetary consideration.

    Our Position

    • We do NOT sell your personal information to data brokers, advertisers, or third-party marketers
    • We do NOT exchange your personal information for monetary compensation
    • We may share information with service partners to provide services you requested, but this is NOT considered a "sale" under CCPA/CPRA

    Third-Party Cookies and Tracking

    Like many websites, we use third-party cookies and tracking technologies (Google Analytics, Facebook Pixel, etc.) for analytics and advertising. While this may technically constitute "sharing" under CCPA/CPRA, we do not receive monetary compensation for this activity.

    If you want to limit third-party tracking:

    • Use the cookie consent banner on our website to opt out of non-essential cookies
    • Adjust your browser cookie settings
    • Opt out of interest-based advertising: https://optout.aboutads.info
    • Use browser privacy tools or ad blockers
    • See our Cookie Policy for more details

    You may also visit our Do Not Sell or Share My Personal Information page on our website to submit a formal opt-out request.

    6
    FINANCIAL INCENTIVES

    Mesa Group Consulting does not currently offer any financial incentive programs (discounts, rewards, promotions) in exchange for collecting, retaining, or selling personal information.

    If we offer such programs in the future, we will provide a separate notice describing the material terms, including how to opt-in, how to opt-out, and an explanation of how the program is reasonably related to the value of your personal information.

    7
    EXERCISING YOUR CCPA/CPRA RIGHTS

    To exercise your CCPA/CPRA rights, you may submit a verifiable consumer request through any of the following methods:

    Contact Methods

    • Email:

      compliance@mesagroupconsulting.com

      Subject Line: "CCPA/CPRA Privacy Rights Request"

    • Mail:

      MESA GROUP CONSULTING

      Attn: Compliance Department — CCPA/CPRA Privacy Rights Request

      5001 California Ave, Suite 219

      Bakersfield, CA 93309

    What to Include in Your Request

    • Your full name
    • Email address associated with your account (if applicable)
    • Phone number
    • Mailing address
    • Specific right you are exercising (Right to Know, Right to Delete, Right to Correct, Right to Limit, Right to Opt-Out)
    • Description of your request
    • Proof of California residency (if not already on file)

    8
    VERIFICATION PROCESS

    To protect your privacy and security, we must verify your identity before processing CCPA/CPRA requests.

    Verification Steps

    For Right to Know (Categories):

    We will match at least two data points you provide with information we have on file (e.g., name, email, phone number).

    For Right to Know (Specific Pieces) or Right to Delete:

    We will match at least three data points you provide with information we have on file. We may request additional documentation (e.g., copy of driver's license, utility bill) to verify identity.

    For Right to Correct:

    We will verify your identity using the same process as Right to Know (Specific Pieces). We may request supporting documentation for requested corrections.

    Response Timeframe

    • We will acknowledge receipt of your request within 10 business days
    • We will respond to your request within 45 days
    • If we need additional time (up to 90 days total), we will notify you and explain the reason for the extension

    9
    AUTHORIZED AGENTS

    You may designate an authorized agent to submit privacy requests on your behalf.

    To authorize an agent, the agent must provide:

    • Written authorization signed by you (notarized authorization is preferred and may be required for certain requests)
    • A copy of the agent's government-issued identification
    • Power of attorney pursuant to California Probate Code sections 4000-4465 (where applicable)
    • Sufficient information about you to allow us to verify your identity

    Submission methods:

    • Email: compliance@mesagroupconsulting.com (with required documents attached)
    • Mail: Mesa Group Consulting, Attn: Compliance Department — Authorized Agent Request, 5001 California Ave, Suite 219, Bakersfield, CA 93309

    We may contact you directly to verify the agent's authority before processing the request. We reserve the right to deny requests where we cannot reasonably verify the agent's authority or your identity.

    Note: Even if you use an authorized agent, we may contact you directly to confirm the request and verify your identity.

    10
    NON-DISCRIMINATION

    Mesa Group Consulting will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not:

    • • Deny you goods or services
    • • Charge you different prices or rates for goods or services (including discounts or other benefits)
    • • Provide you a different level or quality of goods or services
    • • Suggest that you may receive a different price, rate, level, or quality of goods or services

    Exception:

    We may offer financial incentives permitted by CCPA/CPRA that can result in different prices, rates, or quality levels. Such programs are voluntary and you may opt out at any time. See for details.

    11
    GLBA PRE-EMPTION NOTICE

    Mesa Group Consulting is a financial services provider subject to the Gramm-Leach-Bliley Act (GLBA). The GLBA includes definitions for "nonpublic personal information" and "personally identifiable financial information" that may pre-empt CCPA/CPRA definitions for matters involving services provided by Mesa Group Consulting, our service providers, or our agents. Where GLBA applies, its provisions and obligations govern.

    This means certain information collected, used, or disclosed in the course of providing financial services may be exempt from CCPA/CPRA rights (such as deletion or opt-out) when GLBA, FCRA, or other applicable financial services laws govern that information.

    12
    SHINE THE LIGHT LAW

    Under California Civil Code Section 1798.83 ("Shine the Light" law), California residents may request information about our disclosure of personal information to third parties for direct marketing purposes.

    Our Response:

    Mesa Group Consulting does not share personal information with third parties for their direct marketing purposes. Therefore, we are not required to provide a list of third parties or categories of personal information shared.

    If you have questions, contact us at compliance@mesagroupconsulting.com.

    13
    CONTACT INFORMATION

    For questions about this California Privacy Rights notice or to exercise your CCPA/CPRA rights, contact us:

    MESA GROUP CONSULTING

    Mailing Address

    5001 California Ave, Suite 219

    Bakersfield, CA 93309

    Privacy / Compliance Email

    compliance@mesagroupconsulting.com

    Compliance Department

    For all California privacy-related questions, requests, or complaints:

    The Compliance Department serves as our point of contact for all California privacy matters.

    Hours of Operation

    • • Monday – Friday: 9:30 AM – 6:30 PM Pacific Time
    • • Saturday: 10:30 AM – 2:30 PM Pacific Time
    • • Sunday: Closed

    CALIFORNIA RESIDENT NOTICE

    If you are a California resident, you may report complaints to the California Attorney General's Office:

    California Attorney General's Office

    Consumer Law Section

    1300 I Street

    Sacramento, CA 95814

    Phone: (916) 445-9555

    Website: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

    CHANGES TO THIS CALIFORNIA PRIVACY RIGHTS NOTICE

    Mesa Group Consulting reserves the right to update this California Privacy Rights notice at any time. When we make changes, we will:

    • Update the "Last Updated" date
    • Post the revised notice on our website
    • Notify you via email (if you have provided an email address)

    Your continued use of our services after changes become effective constitutes acceptance of the revised notice.

    ACKNOWLEDGMENT

    By using our website or services as a California resident, you acknowledge that you have read and understood this California Privacy Rights notice and your rights under the CCPA/CPRA.

    © 2026 Mesa Group Consulting. All Rights Reserved.