California Consumer Privacy Act Notice

If you are a California resident, the California Consumer Privacy Act of 2018 (“CCPA”) permits you to obtain certain disclosures about information you have shared with The Bank of Orrick or one of its affiliates (“Bank”, “we”, “our”, “us”) in connection with your use of the bank’s products and/or services. CCPA also provides you with certain rights with respect to this information. This section outlines those CCPA required disclosures and details those rights that apply to “personal information” subject to the CCPA. Personal information does not include information that is publicly available (as defined by the CCPA), deidentified, or aggregated. This California Resident Privacy Notice (“CCPA Notice”) applies solely to all customers, users, and others who reside in the State of California (“California Resident” or “you”). We adopt this notice to comply with the CCPA and any terms defined in the CCPA have the same meaning when used in this CCPA Notice.

1. INFORMATION WE COLLECT

In the past 12 months, we may have collected the following categories of personal information about California Residents who are applicants for website visitors, users, and California Residents that apply for, access, or have an account for one or more products or services provided by or through the Bank:

We collect the information listed above from the following categories of sources: (i) information provided by you directly, (ii) information we collected when you use Bank products or services, or (iii) information received from third parties, including our strategic lending partners.
Personal information does not include:

(a) Publicly available information from government records.
(b) Deidentified or aggregated consumer information.
(c) Information excluded from the CCPA’s scope including but not limited to, personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FRCA”), the Gramm-Leach-Bliley Act (“GLBA”) or California Financial Information Privacy Act (“FIPA”), and the Driver’s Privacy Protection Act of 1994.

2. USE OF PERSONAL INFORMATION

We may use or disclose the personal information we collect from you for a number of purposes compatible for which it was collected or authorized by you, including for, but not limited to, the following purposes:
(a) To fulfill or meet the reason you provided the information;
(b) Providing, supporting, promoting, and improving Bank products and/or services;
(c) Communicating with you;
(d) Marketing and advertising;
(e) To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
(f) As described to you when collecting your personal information or as otherwise set forth in the CCPA; and
(g) For other purposes for which we provide notice to you at the time of collection or for which we obtain your consent.
The Bank will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

3. SHARING PERSONAL INFORMATION

The Bank may disclose your personal information to a third party for a business purpose, including, but not limited to, sharing with service providers to assist us in providing the products and/or services, and to our business partners, including our Strategic Lending Partners. When we disclose your personal information to a third party for a business purpose, such disclosure is subject to a contract that describes the business purpose and requires such party to keep the information confidential and not use it for any purpose other than performing the contract. We further require the party to certify that it understands and agrees to comply with such restrictions.

The Bank may also disclose your personal information: (i) to affiliates and subsidiaries; (ii) as required by law; (ii) in connection with corporate changes; (vi) in anonymized or aggregate form; or (vii) with your consent.

In the past 12 months, we have disclosed the following categories of personal information, in accordance with the Information Sharing section contained in this CCPA Notice, for a business purpose: (i) identifiers; (ii) categories of information described in the California Customer Records Statute; (iii) protected classification characteristics under California or federal law; (iv) commercial or transaction information; (v) internet or other electronic network activity information; (vi) sensory data, and (vii) professional or employment-related information.

4. SELLING PERSONAL INFORMATION

The Bank may sell, or have sold in the past 12 months, the following personal information to a third party: (i) identifiers; (ii) categories of information described in the California Customer Records Statute; (iii) commercial or transaction information; (v) internet or other electronic network activity information; (vi) sensory data, and (vii) professional or employment-related information.

5. DO NOT SELL MY PERSONAL INFORMATION

California Residents have the right to direct the Bank not to sell your Personal Information and you may exercise this right at any time. Once you opt-out, we will not sell your Personal Information unless you give us authorization to do so. We will not ask you to reauthorize such sales until 12 months have passed since complying with request to opt-out.

6. VERIFICATION PROCESS

Once we receive a request to know or to delete, we must verify your identity before we can respond. You will be required to provide all or some of the following information for verification purposes:

• Your first and last name
• Your email address
• Your telephone number
• Your account number (if applicable)

If you submit either a request to know specific pieces of Personal Information collected, or a request to delete sensitive, irreplaceable, or otherwise valuable Personal Information, you (or your authorized agent, if applicable) will be required to provide a signed declaration affirming your identity (or your authorized agent’s identity, if applicable).

7. AUTHORIZED AGENTS

An authorized agent is either a natural person or a business entity registered with the California Secretary of State that a California Resident has authorized to act on his or her behalf. You may use an authorized agent to submit a request to know, to delete or to opt-out. Your agent will need to provide: either (1) a power of attorney; or (2) your written permission to allow the authorized agent to submit the request on your behalf and verification of your identity.

8. RESPONSE TIMING AND FORMAT

(a) Acknowledgement of receipt of request

We will confirm receipt of a request from you within ten (10) days. This confirmation will provide information about how we will process the request, including a description of our verification process and an approximation of when we will send you a substantive response.

(b) Substantive Response

We will respond to a verifiable request from you within forty-five (45) days. If we cannot respond in that time, we will notify you in writing that we need an additional forty-five (45) days and explain the reason for the needed additional time. If you have an account with us, we will respond to that account. If you do not have an account with us, we will deliver the written response by mail or email, at your option. Any disclosures we provide will cover only the 12-month period preceding our receipt of your verifiable request. If we cannot comply with your request, we will explain why. If you have requested to know specific Personal Information we collected, we will provide that information to you via mail or electronically.

We do not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why and provide you with a cost estimate before completing the request.

(c) Acting upon opt-out requests

We will act upon an opt-out as soon as commercially reasonable, but no later than fifteen (15) days from the date we receive the request.

9. YOUR RIGHTS REGARDING PERSONAL INFORMATION

If you are a California Resident, subject to applicable law, you have the following rights under California law with respect to your personal information:

(a) Right to Know

You have the right to request that we disclose certain information we have collected, used and disclosed in the past 12 months. You have the right to know: (i) the categories and specific pieces of personal information we have collected about you;(ii) categories of sources from which your personal information was collected; (iii) the purposes for collecting your personal information; (iv) the categories of third parties with whom we have shared personal information; and (v) if your information is sold, lists of the categories of personal information sold and disclosed for a business purpose.

(b) Right to Delete

You have the right to request that we delete any personal information we have collected from you. We will also direct any service providers with whom we have shared your personal information to delete such information from their records. CCPA provides certain exceptions to the Right to Delete. If any of these exceptions apply, we will not be able to comply and will be forced to deny your request to delete, for example when the personal information is necessary to complete a transaction for which we collected it or to comply with a legal obligation. You will be asked to clearly submit your request to delete and to separately confirm your choice.

(c) Right to Opt-out of Sales

You have the right to opt-out of the sale of your personal information. See Section 6 of this CCPA Notice for further information.

(d) Right to Non-Discrimination

You have the right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.
The above rights are subject to various exclusions and exceptions under applicable laws. The above rights are also subject to our being able to reasonably verify your identity and authority to make these requests. In addition, we may require a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request. If we have collected information on your minor child, you may exercise the above rights on behalf of your minor child.

10. HOW TO EXERCISE YOUR RIGHTS

If you are a California resident, you may submit a request by:

(a) Emailing: info@bankoforrick.com

(b) Calling: 816.770.3311

11. QUESTIONS OR CONCERNS

You may contact us with questions or concerns about this Notice and our practices by:

(a) Writing us at:

The Bank of Orrick
PO Box 199
Orrick, MO 64077

(b) Emailing: info@bankoforrick.com

Last Updated: February 2024