Important Privacy Information

Financial Privacy Notice Here (PDF) | Notice of Your Financial Privacy Rights

Digital Privacy and Cookies Policy

Introduction and Scope of Policy
This policy applies to your interaction with Bank of the Sierra on any online or mobile site or application that we own and control, unless a different online and/or mobile or other privacy policy is posted relating to a particular site, application, product, or service, or is made available to you and by its terms supplants this policy. This policy informs you about information we may collect, retain, and/or use about you as allowed by law. Other privacy policies may also apply in addition to the terms of this Policy. To the extent permitted by applicable law, by using a site or by interacting with a Bank of the Sierra advertisement or page or account on a third-party site, you consent to this Policy, including your consent to our use and disclosure of information about you in the manner described in this policy.

Additional Privacy Policies and Notices
Additional privacy-related policies and notices that may apply to you are posted on the Disclosures | Bank of the Sierra page, or provided to you at the point of collection or at the time of obtaining a product or service. This Digital Privacy and Cookies Policy supplements the following disclosures or notices:

• Financial Privacy Notice: Applies to U.S. customers and consumers as described in the notice.
• California Privacy Notice: Applies to residents of California as described in the notice.
• Online Banking, Mobile Banking and Commercial Banking Privacy Notices and Digital Banking Terms of Use: Applies to users of our online banking services as described in the notices.

You may have certain rights to limit, opt out, correct, and delete certain information we collect about you by managing your cookie and browser settings as described in this notice. For additional information about your privacy rights, please review the California Privacy Notice and Financial Privacy Notice linked above.

Where we have another type of presence on a site owned by a third party, such as a page or handle on a social media site, that third party’s privacy policy and terms of use will apply to the third party’s collection, use, and disclosure of data (rather than this policy), unless specifically stated otherwise.

Types of Data We Collect and How We Collect It
We may collect the following anonymous and personal information about you in a variety of ways online, including automatically when you access our website on a computer or mobile device:

• Personal and sensitive personal information such as your name, address, phone number, email address, photos, biometric information, social security number, date of birth, driver’s license or other ID and the information associated with it, and your occupation and employer.
• Financial information such as account numbers, login information, transactions, passwords and passcodes or other credentials allowing access to an account, and debit card numbers.
• Technical data, such as your IP address, device identifiers, browser types, geolocation information, tracking information, camera, contact lists, device histories, data logs, and information about your device operating system.
• Behavioral data, such as page views, clicks, login history, keystroke and mouse movement patterns, and application settings.

You may interact with us in a variety of ways online, including through a mobile device. We may offer sites or applications that permit browsing and do not require registration. We may also offer the ability to enroll, register, or access your accounts online. Information that we may collect about you through online interaction includes information that you input. We may also collect information automatically through cookies, tags, pixel tags, web beacons, SDKs, and clear GIFs, and may permit our third-party service providers to use these technologies.

Purpose and Use of Data We Collect
We may collect the information described above to provide you a service or product that you request from us, communicate with you, improve our site, meet legal and regulatory compliance requirements, and for risk control, information security, and anti-fraud purposes. We may also use data we collect to market to you or personalize your online experience with us subject to the privacy preferences you have on file with Bank of the Sierra. We may use cookies, sometimes in conjunction with service providers, in online advertising either on our own site or on third party sites to help determine which of our advertisements are most likely to appeal to you. We may also use cookies for purposes such as maintaining continuity during an online session, collecting data about the use of our site, monitoring online promotions, and anti-fraud and information security.

Sharing Data
We may share information about you with service providers with whom we work, such as data processors, for everyday business purposes. This includes providing you with products and services you request from us, providing you with information about a service or product, or to effect, administer, and enforce transactions. We may also share information to perform fraud screenings, to prevent actual or potential fraud and unauthorized transactions, to verify your identity, or to respond to legal or regulatory requirements and requests.

We may also share information with service providers that help us market our products and services to you. We do not authorize these third parties to use or disclose the information except as necessary to perform services on our behalf or comply with legal and regulatory requirements.

We do not share your personal information with ad networks, mobile carriers, data resellers, analytics providers (except those that collect data independently as described above), operating systems, other apps, or social media platforms.

Cookie Usage
Cookies are small text files that your browser stores on your computer or mobile device when you visit a site. When you return to a site you have visited before, your browser gives this data back to the site to help it remember your preferences and personalize your experience; enhance site performance and security; and enable interest-based advertising. When you visit our site, we, or our service providers, may use cookies or other similar technologies to collect information on our site.

The following types of cookies may be used on any of our online or mobile banking sites or applications:

• Necessary Cookies: These are required for our site to function or to enable the functionality requested by you. These cookies cannot be blocked by preference settings or signals.
• Functional Cookies: These cookies enable an enhanced or personalized experience. They may be set by us or by third-party providers whose services we have available on our site. This may include things like playing videos on our site or downloading PDF forms or seeing content personalized to you. If these cookies are blocked, some services may not function.
• Performance and Analytical Cookies: These cookies allow us to monitor the performance of our website, such as how many people visit our site and how they got there, so we can measure and improve your experience on our site. If these are blocked, we have less information available to us to continue to improve our site.
• Marketing and Advertising Cookies: These cookies may be set by us or through our advertising partners. This information is used to understand your use of our site so we may show you more relevant online content and advertising. If you block or turn them off, you may still see online advertisements, but they will not be tailored to you based on your browsing history.

Other parties that may collect information about your web browsing behavior when you use our site are limited to service providers who may only use any information collected to provide services and marketing for us and not to provide services or advertising for any other party. We do not authorize these third parties to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements. Note, however, that we also provide certain links on our sites that allow you to interact with third parties who offer additional features, such as allowing web surfers to share information on another platform, such as a social media platform. At other times, information from a third party may be embedded on our site, such as a map. These features often function through third-party cookies used by third-party sites, such as social media platforms. As a result, if you use any of these features, these third parties may be able to access information about your web browsing on the pages of our site where links to these features are in place. These links are offered as a courtesy and a convenience. Bank of the Sierra assumes no responsibility for the content, safety, security, or privacy of any such site or any transactions with respect thereto. If you have questions or concerns about any other site’s policy regarding these matters, you should contact that site or its sponsor.

Managing Cookies
Managing cookies is domain and browser specific. For example, you may manage your use of certain types of cookies on the bankofthesierra.com domain or by using an opt-out preference signal. Our website recognizes Global Privacy Control (GPC) and will honor your preferences accordingly. Your preference applies to this domain and the browser you are currently using. It does not apply to different browsers or other Bank of the Sierra managed domains. If you visit this domain using a different browser or delete your browser cookies, you will need to exercise your preference again. If you visit other Bank of the Sierra managed domains or subdomains you will need to exercise your preference again.

For mobile devices, you can turn off personal ads on iOS devices or opt out of ads personalization on Android devices. You may be able to instruct your browser to stop accepting cookies or to prompt you before accepting cookies from the sites you visit. Google provides some additional privacy options relating to Google analytics, described at policies.google.com/technologies/partner-sites.

Retention Period
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to meet legal, regulatory, and operational requirements. The retention period for each category of personal information is determined based on:

• The nature and sensitivity of the information (e.g., account numbers, transaction history, Social Security numbers)
• Applicable federal and state financial regulations (e.g., Bank Secrecy Act, Gramm-Leach-Bliley Act)
• Statutory retention periods (e.g., IRS, FDIC, and SEC requirements)
• The purpose for which the data was collected (e.g., fraud prevention, account servicing, compliance)
• Internal policies and risk management practices

If deletion is requested and no legal or regulatory exception applies, we will securely delete or de-identify the personal information in accordance with applicable law.

Contact Information
For questions about our Digital Privacy and Cookies Policy or to provide us with updates or corrections to information about you, please contact Customer Service at 1-888-454-BANK. You can also contact us at the mailing address or through the Quick Message Center from the Contact Us link in the App or at BankoftheSierra.com.

Children’s Privacy
We do not knowingly collect information from or about individuals under 18 years of age. Please do not submit such information to us, and as a parent or legal guardian, please do not allow your children to submit personal information without your permission. Also, our sites are not directed to children under 13, and we do not knowingly collect personal information about them.

Policy Updates and Effective Date
We may amend this policy at any time by posting a revised version on our website. The revised version will be effective immediately. Thus, you are advised to review this page periodically for any changes. We will notify you of any changes by posting the new policy on this page.

Bank of the Sierra California Privacy Notice

Information for California Residents
We collect Personal Information from California residents and comply with the California Consumer Privacy Act and related laws and regulations (“California privacy laws”). In addition to our general Privacy Notice available at BankoftheSierra.com/Privacy, this California Privacy Notice applies to California residents (“users,” “you,” or “your”).

For the purposes of this California Privacy Notice, “Personal Information” means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Information:

• Publicly available information;
• Deidentified or aggregated data; or
• Information otherwise excluded from the scope of California privacy laws.

This Privacy Notice provides the following information to California residents:

• Categories of Personal Information we collect;
• Purposes for which we use Personal Information;
• Categories of Personal Information we disclose to third parties;
• Categories of third parties to which we disclose Personal Information; and
• Consumer rights under California privacy laws and how to exercise those rights, specifically including:
• The rights to access, correct, or delete their Personal Information;
• The right to limit the use of their Sensitive Personal Information in certain circumstances; and
• The rights to opt out of targeted advertising, sales of Personal Information, or profiling.

Categories of Non-Sensitive Personal Information

The information below outlines the non-sensitive categories of Personal Information Bank of the Sierra collects about California residents and whether and how they are disclosed to third parties.

We collect Non-Sensitive Personal Information from the following sources:

• Directly from our California residents or their authorized agents
• From our processors

---

Category of Personal Information: Identifiers
Examples
Identifiers may contain the following: name, address, contact information, email, date of birth, Social Security number, telephone numbers, driver’s license, state ID or passport or similar identifier (used to identify you or as required by law), signature.

Purpose(s) for Collection
Providing and maintaining our products and services, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Identifiers to our processors to provide banking services elected by you the consumer, as well as to detect and prevent fraud and to protect against security risks.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Category of Personal Information: Personal Characteristics
Examples
Personal Characteristics may contain the following: race, gender, disability, and marital status.

Purpose(s) for Collection
Providing and maintaining our products and services, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Personal Characteristics to our processors to provide banking services elected by you the consumer, as well as to detect and prevent fraud and to protect against security risks.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Category of Personal Information: Commercial Information
Examples
Commercial Information may contain the following: consumer history, records of personal property.

Purpose(s) for Collection
Providing and maintaining our products and services, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Commercial Information to our processors to provide banking services elected by you the consumer.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Category of Personal Information: Internet/Electronic Activity
Examples
Internet/Electronic Activity may contain the following: browsing history, device information, search history, application use.

Purpose(s) for Collection
Providing and maintaining our products and services, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Internet/Electronic Activity to our processors to provide banking services elected by you the consumer, as well as to detect and prevent fraud and to protect against security risks.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Category of Personal Information: Imprecise Geolocational Information
Examples
Imprecise Geolocational Information may contain the following: device physical location or movements that is less precise than 1/3 mile.

Purpose(s) for Collection
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and Third parties as required by law and similar disclosures. We disclose Imprecise Geolocational Information to our processors to provide banking services elected by you the consumer, as well as to detect and prevent fraud and to protect against security risks.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Category of Personal Information: Sensory Information
Examples
Sensory Information may contain the following: audio, electronic, video and similar information, such as call and video recordings.

Purpose(s) for Collection
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Sensory Information to our processors and/or state, federal or local law enforcement agencies to detect and prevent fraud, as well as to protect against security risks.

Retention Period
30 days for security camera footage and 8 months for recorded calls obtained through the Bank’s Customer Service Center.

---

Category of Personal Information: Professional Information
Examples
Professional Information may contain the following: occupation and employer.

Purpose(s) for Collection
Providing and maintaining our products and services, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Professional Information to our processors to provide banking services elected by you the consumer, as well as to detect and prevent fraud and to protect against security risks.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Categories of Sensitive Personal Information

The information below outlines the categories of Sensitive Personal Information Bank of the Sierra collects about California residents and whether they are disclosed to third parties.

We collect Sensitive Personal Information from the following sources:

• Directly from our users
• From our business partners (“business partners” are companies that we have a pre-existing commercial relationship with)

---

Category of Sensitive Personal Information: Government ID Data
Examples
Government ID Data may contain the following: Social Security number, passport number, driver’s license number, state identification card or similar government ID.

Purpose(s) for Collection
Providing and maintaining our products and services, verifying your identity, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Government ID Data to our processors to provide banking services elected by you the consumer, as well as to detect and prevent fraud and to protect against security risks.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud

---

Category of Sensitive Personal Information: Sensitive Category Data
Examples
Sensitive Category Data may contain the following: age, race, gender, marital status, citizenship status.

Purpose(s) for Collection
Providing and maintaining our products and services, verifying your identity, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Sensitive Category Data to our processors to provide banking services elected by you the consumer.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Category of Sensitive Personal Information: Financial Data
Examples
Financial Data may contain the following: individual’s account login, financial account number, or debit card number in combination with any required security or access code, password or credentials allowing access to an account.

Purpose(s) for Collection
Providing and maintaining our products and services, verifying your identity, detecting and preventing fraud, protecting against security risks.

Targeted Advertising
We do not engage in targeted advertising or disclose this information for targeted advertising purposes.

Sale
This information is not sold to third parties.

Other Disclosures
This information may be disclosed to processors, government entities, and third parties as required by law and similar disclosures. We disclose Financial Data to our processors to provide banking services elected by you the consumer.

Retention Period
We retain this data until the customer closes their account, after which it is retained only to the extent required by applicable law or for purposes of preventing fraud.

---

Use of Personal Information
We use Personal Information for the purposes described in our general Privacy Notice (see BankoftheSierra.com/Privacy). Personal Information may also be used or disclosed as otherwise permitted or required by applicable law.

Disclosing Personal Information
We disclose Personal Information to the following categories of third parties:

• Processors (also referred to as “Service Providers” or “Contractors” in California law): We use processors to securely handle Personal Information on our behalf for our business purposes and only on our instructions. California privacy laws and our contracts with these companies prevent them from using your Personal Information for their own purposes.

See the information above for more details about how different categories of Personal Information are disclosed.

We do not sell Personal Information to anyone. We do not share Personal Information for advertising purposes.

Exercising Your Personal Information Rights
California residents have the following rights under California privacy laws:

• The right to know the Personal Information we have collected about them, including the categories of sources from which we collected the Personal Information, the purpose(s) for collecting, selling, or sharing your Personal Information, and the categories of third parties to whom we have disclosed your Personal Information;
• The rights to correct or delete Personal Information;
• The right to limit the use of Sensitive Personal Information in certain circumstances;
• The rights to opt out of targeted advertising, sales of Personal Information, or profiling; and
• The right not to receive discriminatory treatment for exercising their privacy rights.

If you are a California resident, you can submit a request to exercise your personal data rights under California privacy laws by visiting our online portal at https://www.requesteasy.com/6385-8896 or by contacting us at 1-888-454-BANK.

To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will verify your identity by sending you an email asking you to provide certain pieces of information in order to properly identify you. We may ask you for additional information as part of this process, including the date and amount of your last deposit with us, as well as a telephone number that is on record with the Bank. If you do not complete the verification process, we may be unable to process your request. Any information you provide to authenticate your identity will only be used to process your rights request and not for any other purpose. Please be aware that we do not accept or process rights requests submitted through other means.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a California resident that are manifestly unfounded, excessive, or repetitive.

Notice of Right to Limit the Use of Sensitive Personal Information
You have the right to limit some uses of Sensitive Personal Information. You may direct companies not to use Sensitive Personal Information except as necessary to provide goods or services you have requested or other exempt purposes.

However, we only use Sensitive Personal Information for purposes that are exempt from this right, such as to provide you with goods or services you have requested, to detect and prevent security incidents, or to verify the quality of our goods and services. The full list of these exempt purposes is specified in California Code of Regulations, Title 11, Section 7027(m).

Children’s Data
We do not knowingly collect or use the Personal Information of children under 16. If you believe that we have collected the Personal Information of a child under 16, please contact us at CCPAInquiries@BankoftheSierra.com.

Authorized Agent Requests
California privacy law allows you to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above in the section titled Exercising Your Personal Information Rights. We may require verification of your authorized agent’s authority in addition to the information we require for verification of your identity.

Contact Us
If you have any questions or concerns regarding this California Privacy Notice, contact us at CCPAInquiries@BankoftheSierra.com.

Last updated: June 23, 2023