Allspring California Consumer Privacy Act Notice

Updated as of February 2024

FOR RESIDENTS OR DATA SUBJECTS IN CALIFORNIA ONLY

Notice statement

This privacy notice provides you with necessary information about the personal information we collect, how this information may be used by Allspring Global Investments (Allspring), your privacy rights, and Allspring’s obligations in accordance with the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA).

Scope

This privacy notice applies solely to natural persons residing in California (consumers) and does not apply to individuals living elsewhere, businesses, or other corporate entities.

Definitions

“Allspring,” “we,” “us,” “our”:
Allspring Global Investments is the trade name for the asset management firms of Allspring Global Investments Holdings, LLC, a holding company indirectly owned by certain portfolio companies of GTCR LLC and Reverence Capital Partners, L.P. These firms include but are not limited to Allspring Global Investments, LLC; Allspring Funds Management, LLC; Allspring Funds Distributor, LLC; Allspring Global Investments (UK) Ltd.; Allspring Global Investments Luxembourg S.A. (including those acting on behalf of the branches of Allspring Global Investments Luxembourg S.A.); Allspring Global Investments (Singapore) Pte. Ltd.; Allspring Global Investments (Hong Kong) Limited; Allspring Global Investments (Japan) Limited; and Galliard Capital Management, LLC (collectively, Allspring). Certain products managed by Allspring entities are distributed by Allspring Funds Distributor, LLC (a broker-dealer and Member FINRA/SIPC).

“Consumer,” “you,” “your”: As defined by the CCPA and CPRA, a consumer is a natural person who is a California resident, living in California for other than a temporary or transitory purpose, or an individual domiciled in California.

“Personal data” has the meaning given to it or any similar term (e.g., “personal data,” “nonpublic personal data,” “personally identifiable information) in applicable data protection legislation and, for the avoidance of doubt, means any information that directly or indirectly identifies or otherwise relates to a living individual, which is in the possession or under the control of Allspring (or its representatives or service providers) and includes the personal data mentioned below.

“Sensitive personal data” or sensitive personal information (SPI) is a subset of persona data that requires greater security protections and standards of care in handling. SPI, also known as special categories of information, is defined as information that if lost, compromised, or disclosed could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

“Process” or “processing” means any operation that is carried out in respect of personal data, including but not limited to collecting, storing, using, disclosing, transferring, or deleting personal data.

The types of personal data we collect

We collect personal data as necessary to enable us to carry out your instructions, to manage and operate our business, to perform the services we have been engaged to provide, and to comply with our legal and regulatory obligations. In connection with the provision of those services, or as your potential employer, Allspring will collect personal data about you, including:

Your name
Your date of birth
Your job title, position held, length of employment, and company name
Your mailing address
Your contact details (such as telephone number and email address)
Your nationality and citizenship
Your employment and educational background and other relevant applicant information
Other personal data contained in correspondence and documents that you provide to us
Information we obtain from our IT and communication monitoring
Electronic data resulting from your online activity and the pages you visit on our website, including your internet protocol (IP) address, the type of device and browser you are using, information about your device operating system and information collected through cookies, tags and other technologies.

Please note that if you do not provide certain personal information to Allspring when requested, we may not be able to provide you with some or all of our services and products.

You confirm that you are authorized to provide to us the personal data that we collect on your behalf. Where the personal data relates to your directors, shareholders, beneficial owners, employees, agents, associates, or family members, it is not reasonably practicable for us to provide to them the information set out in this notice. Accordingly, where appropriate, you are responsible for providing this information to any such person.

Sensitive personal information we collect

We may also collect or process SPI as necessary to enable us to carry out your instructions, to manage and operate our business, and to comply with our legal and regulatory obligations. You may also supply us with, or we may receive, the following SPI:

Financial information or other information obtained as a result of your investment in any of our funds, such as banking details, financial relationships and transactions, salary and other income, and sources of wealth and assets
Information related to your financial activities, your social insurance or social security number or other tax identification number, and details of tax residency
Personal data provided by you in the context of us carrying out background checks and anti-money laundering, regulatory, tax, and know-your-client (KYC) background checks, such as identification documents, passport number, driver's license number, or state/national government-issued identification, details of credit, criminal records and sanctions
Diversity or demographic information, including race or ethnicity; gender or gender identity; marital status; religious or philosophical beliefs; political affiliation, opinion, or association; veteran or disability status; or sexual orientation
Biometric information for identification, including fingerprints and voiceprints
Geolocation data, including your device location

Allspring collects SPI on the basis of one or more of the following:

You have given explicit consent to the collection for one or more specified purposes
Where the collection of SPI is manifestly made public by you
Where the collection is necessary for the establishment, exercise, or defense of legal claims

Where the collection is necessary for reasons of substantial public interest, in accordance with applicable law, Allspring may collect SPI for the purposes of the prevention or detection of an unlawful act or for preventing fraud.

Sources of personal data

Allspring collects most personal data directly from you or other individuals acting on your behalf. However, we may also collect personal data from the following sources:

Publicly accessible sources, including the media and information made available by federal, state, or local government entities
Directly from a third party for background checks or KYC due diligence providers
Third parties from whom we collect personal data to support human resource and workforce management activities
Third parties from whom we collect personal data as part of providing products and services and executing transactions, including other financial institutions and parties involved with mergers, acquisitions, and other transactions, including the transfer of all or part of a business or a set of assets
Through the use of cookies and other tracking technologies in accordance with the scope of our Cookies Notice, which can be found here.

How we use your personal data

Your personal data may be collected, stored, disclosed, and processed by Allspring to:

Provide you with marketing communications and inform you about news, information, and events relating to our business and services, including new product launches and product updates
Assess your application for Allspring’s products and services, where applicable
Understand your needs and interests and respond to your inquiries
Provide the services requested by you and comply with our contractual obligations under our agreements and carry out related business functions, including performing data and transaction processing, conducting credit checks, and managing our relationship with you
Analyze and improve our services
Manage and administer our business
Provide you with the products and services for which you subscribe
Comply with and in order to assess compliance with applicable laws, rules, and regulations (including KYC obligations based on applicable anti-money laundering and anti-terrorism requirements; economic and trade sanctions; suspicious activity reporting; foreign exchange and international trade; tax reporting pursuant to applicable laws, regulations, ordinances, and obligations anywhere in the world); good practices; and internal policies and procedures
Confirm and verify your identity and conduct due diligence, background, and related checks (this may involve the use of credit reference agencies and/or other third parties acting as our agents to conduct these verifications and related reviews, including screens against publicly available government and/or law enforcement agency sanctions lists)
Confirm a person’s authority as a representative or agent for you with which Allspring has entered or intends to enter into various arrangements, including but not limited to deposit contracts, loan contracts, contracts for foreign exchange transactions, contracts for derivative transactions, and letters of credit; we collect and use work contact details, position description, and authentication data
Detect, investigate, and prevent fraud and other crimes or malpractice
Obtain legal advice or establish, exercise, or defend legal rights
Administer and maintain databases storing personal data
Conduct recordkeeping
Communicate with and assess job applicants during the recruitment process, verify job applicants’ employment history and education, confirm work authorizations, make decisions about financial packages on offers, monitor equal opportunities, and comply with employment law legal and regulatory obligations
For purposes otherwise set out in this notice or as notified to you at the specific time of collection
Operating our website including providing content to you and interacting with you (in accordance with the scope of our Cookies Notice linked below).

Disclosure of your personal data to third parties

Allspring does not sell personal data to third parties or target advertising to individuals based on their personal data collected. The categories of third parties with whom we share your personal data depend on, among other things, our relationship or interaction with you. Allspring discloses personal data as follows, in each case only to the extent necessary and on a need-to-know basis:

Affiliates. Allspring may disclose personal data to our affiliates on a worldwide basis, and such affiliates may use the data for the purposes described above.
Beneficiaries, counterparties, and other parties related to a transaction. Allspring may disclose personal data to beneficiaries, counterparties, or other parties related to a transaction on a worldwide basis to provide the services requested by our customers and to comply with legal obligations and
Service providers. Allspring may disclose personal data to information technology (IT) providers or other service providers around the world that act under our instructions regarding the processing of such data (data processors). Data processors will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard the personal data and to process personal data only as instructed. Allspring may also disclose personal data to independent external third parties, such as accountants, administrators, auditors, custodians, depositories, third-party managers, paying agents, professional advisors, IT and communications providers, employment background check providers, or any entity around the world we reasonably consider necessary for the purposes outlined above. Such service providers will be subject to any necessary contractual obligations regarding the protection and processing of such personal
Legal requirements. Subject to applicable law, Allspring may disclose personal data if required or permitted by applicable laws or regulations, including laws and regulations of the United States and other countries, or in the good faith belief that such action is necessary to: (a) comply with a legal obligation or in response to a request from law enforcement or other public authorities wherever Allspring may do business; (b) protect and defend the rights or property of Allspring; (c) act in urgent circumstances to protect the personal safety of individuals, customers, and contractors/employees of Allspring or others; or (d) protect against any legal liability. In addition, Allspring may share your personal data with U.S. regulators and with other self-regulatory bodies to which we are subject, wherever Allspring may do business.
Business transfers, combinations, and related activities. As we develop our business, Allspring might sell, buy, restructure, or reorganize businesses or assets. In the event of any actual or proposed sale, merger, reorganization, restructuring, dissolution, or any similar event involving our business or assets, personal data may be shared with the relevant entity or may be part of the transferred Additionally, if Allspring makes you an offer of employment, it may also share your personal information with your previous employers to obtain references.

Our third-party service providers are subject to security and confidentiality obligations and are only permitted to process information for a specified, legitimate business purpose and in accordance with our instructions.

How we store and safeguard your personal data

Allspring shall use a reasonable standard of care to store and protect your personal data. Allspring safely stores personal data in its databases located in the U.S. and the U.K. Some of our third-party service providers may include cloud-based service providers that may store and process personal data in the cloud. Allspring has implemented appropriate physical, technical, organizational, and security measures to prevent your personal data from being accidentally lost, misused, or accessed in an unauthorized way; altered; or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. Personal data is protected with safeguards according to the sensitivity of the information contained therein.

Additionally, we have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Retention of personal data

Allspring will retain your personal data for a period of up to seven (7) years from the date of termination of our relationship with you and will not retain your personal data for longer than is reasonably necessary to fulfill the purposes outlined in this notice or for such period as may be required under relevant laws, regulations, and policies, including those related to record retention periods.

Your rights

Right to access: You have the right to access personal information that we may collect or retain about you. If requested, we shall provide you with a copy of your personal information that we collect as permitted by the CCPA/CPRA. You also have the right to receive your personal information in a structured and commonly used format so that it can be transferred to another entity (data portability).
Right to know: You have the right to request that we disclose the following about your personal information, as defined by the CCPA/CPRA, including the specific personal data we may collect; the categories of personal data we may collect, the categories of sources from which we may collect your personal data, the business purpose(s) for collecting or sharing your personal data, the categories of personal data we may disclose for business purposes, and the categories of third parties with whom we may share your personal data.
Right to opt-out of the sale of personal information to third parties: Allspring does not sell personal information within the meaning of the CCPA/CPRA.
Right to limit use and disclosure of sensitive personal data: You have the right to limit how your SPI is disclosed or shared with third parties, as defined in the CCPA/CPRA.
Right to deletion: In certain circumstances, you have the right to request the erasure of your personal data. Upon verifying the validity of a deletion request, we will delete your personal data from our records and instruct any service providers or third parties to delete your information, when applicable.
Right to correct: In certain circumstances, you have the right to request correction of any inaccurate personal data Allspring holds about you. Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your personal data as directed, taking into account the nature of the personal data and the purposes of maintaining your personal data.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

Exercising your rights

If you are a California resident, you can exercise any of your rights as described in this notice and under applicable privacy laws by using the contact information provided below. We will not discriminate against you for exercising such rights. Except as described in this notice or provided for under applicable privacy laws, there is no charge to exercise your legal rights.

However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested or refuse to act on the request and notify you of the reason for refusing the request.

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

Verifying consumer requests

If you exercise any of the above rights, we may need to request specific information from you to help us confirm your identity and that you are entitled to make such a request. This is to ensure that personal data is not disclosed to any person who has no right to receive it. We will require your name, email, phone number, and address and will attempt to match our records based on that information. Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm their identity.

Changes to our privacy notice

This notice is under regular review and Allspring reserves the right to update this privacy notice at any time. Please review it periodically. This notice was last updated in February 2024.

How to contact us

If you have any questions or concerns about this notice or you would like to exercise one of your data protection rights, please contact Allspring’s Privacy Officer at: PrivacyOfficer@Allspringglobal.com.

Terms of Use