CCPA/CPRA Privacy Notice

Last Updated: December 12, 2023

1. APPLICABILITY OF CCPA PRIVACY NOTICE

This Privacy Notice (“Notice”) applies solely to California residents and supplements Cy Creek Bank’s Online Privacy Notice. We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act of 2020 (“CPRA”).

Under the CCPA, ‘Personal Information’ is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly with a particular California resident or household.

The CCPA, however, does not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act (“GLBA”), the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this CCPA Notice does not apply to information that we collect about Individuals located in Canada. who seek, apply for, or obtain our financial products and services for personal, family, or household purposes, which is subject to our U.S. Consumer Privacy Notice (available on our Cy Creek Bank Privacy Center page).

2. CATEGORIES OF PERSONAL INFORMATION WE COLLECT AND DISCLOSE

Most of the information we collect is in the context of providing financial products or services and is therefore not subject to the CCPA. We do collect Personal Information relating to California residents in other contexts, including for employment and recruiting purposes, marketing activities and interaction with our website that may include Sensitive Personal Information as defined under the CPRA.

In the past 12 months, we may have collected and disclosed to third parties for our business purposes the following categories of Personal Information about you in several ways when you use our services, as described below:

• Identifiers: name, email, and address (e.g., Social Security Number);
• Personal Information, as defined in the California safeguards law: contact and financial information;
• Characteristics of protected classifications under California or federal law: sex and marital status;
• Commercial Information: products or services purchased and account information;
• Internet or other similar network activity: browser type, pages viewed, and links clicked;
• Biometric Information:video footage and voiceprints;
• Geolocation Data: device location;
• Professional or employment-related information: occupation, job title, employment email or prior employer;
• Sensory Data: audio recordings of customer care calls, electronic, visual or similar information; and
• Inferences are drawn from any of the Personal Information listed above to create a profile about, for example, an Individual’s preference and characteristics.

3. SOURCES OF PERSONAL INFORMATION

The categories of sources from whom we collect Personal Information are:

• Directly from a California Resident: We collect information when you register on our site or fill out a profile. We also collect information when you create an account with Anchorage  Digital (including the identity verification process), subscribe to our promotional campaigns, or respond to a survey. We also collect information when you apply for a job with Cy Creek Bank, service as a Board Member or Officer, or work for Cy Creek Bank as an employee or independent contractor.
• From Third Parties: We may collect information through referrals from other Cy Creek Bank users, from an Individual’s employer, or from our service providers (e.g., those that validate identity) or perform Anti-Money Laundering (“AML”) or Know-Your-Customer (“KYC”) services).
• From Individuals Passively: We use third party tools to collect information from Individuals from our website, online targeted marketing materials and mobile application.
• Publicly Available Information: We collect information about you via publicly available resources listed in our Online Privacy Notice.
• Combining Information: We combine information received from third parties with information already stored. Cy Creek Bank may also combine information from an Individual’s profile with information submitted from surveys.

4. HOW WE USE PERSONAL INFORMATION

Most of the information we use is for the provision of financial products or services and is therefore not subject to the CCPA. We may use Personal Information of California residents for one or more of the following business purposes as described below.

• Auditing related to counting ad impressions;
• Ensuring security and integrity of our use of your Personal Information;
• Debugging to repair errors to ensure our products’ functionality;
• Marketing, particularly short-term use of Personal Information for personalized and non-personalized advertising and online targeting advertising;
• Business services, including servicing accounts, customer service, processing transactions, etc.;
• Internal research for technological development;
• Maintaining the quality and security of Anchorage services.
• Investigations: detecting, investigating and preventing breaches of policy, and criminal offenses, in accordance with applicable law; and
• Providing employee benefit and accommodation management, regulatory reporting and requirements, job reviews and salary management, and recruiting efforts, including setting up interviews, extending offers, communicating feedback, and determining fits for job openings.

For additional information on how we use Personal Information see our Online Privacy Notice (available on our Cy Creek Bank Privacy Center page).

5. SALE OF PERSONAL INFORMATION

As a California resident, you have the right to direct a business that sells your Personal Information to third parties not to sell your Personal Information. This right is referred to as “the right to opt-out of sale of Personal Information.”

We do provide a cookie banner and consent management that incorporates a browser setting that notifies our website of your privacy preferences known as Global Privacy Control, (“GPC”) on our website for you to exercise the right to opt out.

6. CATEGORIES OF THIRD PARTIES DISCLOSURE

We may disclose Personal Information to the following third parties for a business purpose.

‍Third Party Responsibilities – Any third parties that we share your Personal Information with are limited by law and by contract in their ability to use your Personal Information. Cy Creek Bank requires third-party service providers acting on our behalf or with whom we share your information to provide appropriate security measures in accordance with industry standards and in compliance with this Policy, their privacy and security obligations, and any other appropriate confidentiality and security measures. However, we are not responsible for the privacy and data security practices of third parties outside of Personal Information we receive from or transfer to them.

7. PRIVACY CHOICES AND RIGHTS

The CCPA/CPRA provides California residents with specific rights regarding their Personal Information. If you are a California resident, you may have the following rights.

• Request we disclose to you free of charge the following information covering the 12 months preceding your request:
• ~the categories of Personal Information about you that we collected;
• ~the categories of sources from which the Personal Information was collected;
• ~the business or commercial purpose for collecting Personal Information about you;
• ~the categories of third parties with whom we share that Personal Information; and
• ~the specific pieces of Personal Information we collected about you.
• Request that we delete, limit or correct any of your Personal Information we collected from you, unless a CCPA exception is applicable
• Be free from unlawful discrimination for exercising your rights under the CCPA

We will acknowledge receipt of your request and advise you how long we expect it will take to respond if we are able to verify your identity. Requests for specific pieces of Personal Information will require additional information to verify your identity.

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. If you are an authorized agent, please send us proof that the consumer gave you written permission to submit the request and we will verify your identity as provided above. We may also require the consumer to verify their own identity with us and/or directly confirm with us that they have given you permission to submit the request.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. We will only use Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

We will work to process all verified requests within 45 days pursuant to the CCPA. If we need an extension for up to an additional 45 days in order to process your request, we will provide you with an explanation for the delay.

If you are a California resident, you may submit a request by:

• Emailing us at privacy@go2cycreek.com.

8. CHANGES TO THIS NOTICE

We may change or update this CCPA Notice in the future. When we do, we will post the revised CCPA Notice on our website. This CCPA Notice was last updated and became effective on the date posted at the top of this page.

9. CONTACT US

If you have questions about this Notice, or if you wish to exercise any of your rights in relation to your Personal Information, please contact us. You can call us at (415) 610-0179 or write to us at privacy@go2cycreek.com.