EFC Bank Online Privacy Notice

Last updated 20 December 2023

Elite Financial Corporation Group (EFC Bank) operations rely on trust and your privacy is just as important to us as your finances. We conduct regular assessment reviews of our policies and operate in accordance with rigorous privacy standards to ensure that personal information we collect, use and/or share is protected. This Online Privacy Notice (“policy”) describes how EFC Bank manages personal information about you when you interact with us online through our websites, mobile applications, event registration sites and social sites through your computer, smartphone, tablet or other mobile devices.

What this policy covers

This EFC Bank policy covers how we collect personal information when you visit, use, or interact with EFC Bank websites, mobile applications and other online services including our ads displayed through online services operated by us or non-affiliated third parties. It describes how we may use and share personal information collected to deliver products and services to you and for advertising or event management purposes as well as explains your privacy options and rights. Our online services are intended for and limited to EFC Bank clients. The term “EFC Bank” or “we”, “us” or “our” in this Notice refers to EFC Bank and its banking and non-banking affiliates or subsidiaries in all countries we would have established a subsidiary prior to updating this policy.

By using our Sites, mobile applications, and other online services, you agree to the terms and conditions of this Notice. If you visit or use one of our online services in your country or any country, your information may be processed in the country you accessed the site from and transferred to EFC Bank Corporate HQ. If you do not fit in with the audience, stop and do not use our services.

What this policy does not cover

This Privacy Policy does not apply to the websites, mobile applications, or other online services of the third parties and their affiliates. It also does not apply to non-EFC Bank companies, such as our co-branded partners, auto dealerships and auto-finance companies, or any third-party websites that we connect to online. EFC Bank works with third-party providers who are contractually obligated to comply with our policies to protect information. However, if you visit or access one of these third-party provider sites or mobile apps, please review the online privacy practices of that site or mobile app to understand the specifics of how your online personal information may be collected, used and/or shared.

Updates to this Notice

This Notice is subject to change. We update this Notice periodically to comply with the most recent federal and local laws. Please review it whenever you have questions. If we make changes to this Notice, we will revise the Last updated date on this page.

Our Online Privacy Practices

Transparency about your personal information is very important to us, which is why we ask for your consent when required, otherwise by using our Site and Mobile Apps, you consent to the collection, use and sharing of your personal information subject to and consistent with applicable laws, regulations and other notices you may have received based on your relationship with us.

Linking to other sites

We may provide links to non-affiliated third-party sites, such as credit bureaus, service providers or merchants. If you follow links to sites not affiliated with, or controlled by EFC Bank, you should review their privacy and security policies as well as other terms and conditions, as they may be different from those of our Sites and Mobile Apps. EFC Bank does not guarantee and is not responsible for the privacy or security of these sites, including the accuracy, completeness or reliability of their information.

Protecting your personal information

Protecting your personal information is as important to us as protecting your finances. In order to protect personal information from unauthorized access and use, we use security measures that comply with applicable federal, national and state laws. These measures may include device safeguards, secured files and buildings as well as oversight of our third-party providers to ensure personal information remains confidential and secure. In the event of a data breach, we provide timely notification, in accordance with applicable laws and regulations.

We also acknowledge the importance of protecting privacy where children are involved. Our Sites and Mobile applications are not marketed to individuals under the age of 12, and we request that these individuals do not provide personal information through our Sites and Mobile Apps. We do not knowingly collect personal information from children under 12.

Accuracy of personal information

Keeping your personal information accurate and up to date is very important. If your personal information is incomplete, inaccurate or not current, please make the change directly from your account, update your KYC (confirm your credentials), use the Contact Us option on our Sites and Mobile Apps, or call or write to us at the telephone numbers or appropriate address for changes listed on your account statements, records, online or other account materials. You can also speak to a customer representative at a financial center, your Financial Advisor or any account representative.

How does EFC Bank collect personal information online?

·        Directly from you

EFC Bank and third parties on our behalf may collect personal information about you directly from you through your computer or mobile devices by the use of cookies and similar tracking technologies (see our Cookie Policy for details) as well as personal information you provide when you visit or use our Sites to apply or register for our products and services, use our online banking services or mobile apps, communicate with us, respond to surveys, provide feedback, or our enter contests or promotions. Third-party providers are contractually obligated to comply with our policies to protect information we share with them, or they collect on our behalf.

·        Automatically when you use our Online Services

EFC Bank and third parties on our behalf may automatically collect Device Data, Online/Mobile Activity Data, and other information when you interact with us online.

The personal information we collect is limited to what is required for us to provide our products or services and to support legal and risk requirements. For additional information, please review the How do we use your personal information section of this Notice.

What information does EFC Bank collect online?

The type of personal information we collect from and about you online will depend on how you interact with us and may include:

• Contact or identity data, such as your name, mailing address, email address, phone number, date of birth, government-issued identifier (e.g., National Identity Number, tax ID number, driver’s license, or other government issued ID), citizenship, country of residence, city of residence, business contact and professional information, username and password, profile picture, and other information that directly identifies you.
• Account data, such as account number, credit/debit card number, account history, account balances, loan details, vehicle or property information, information about beneficiaries and joint account holders, business-related information (e.g., business name, address, revenue, and industry type), information you provide when using our travel, entertainment, or dining services (e.g., dietary, seating, or other preferences), and other information related to your EFC Bank accounts, applications, or prequalification inquiries.
• Transaction data, such as credit/debit card purchases, payment or transaction history, transaction details when you transfer money to or from your EFC Bank accounts, third-party billing information or statements, payment card details, and information about flights, hotels, events, and other expenses paid for using your EFC Bank debit or credit card or by transfer.
• Credit report information, such as your credit score, credit history, and other information that we receive from credit reporting agencies when you use our credibility features or mobile app.
• Demographic data, such as gender, marital status, age, household size/composition, education information, income, occupation, veteran or military status, and employment status.

• Device data, such as your device type, web browser type and version, operating system type and version, display/screen settings, language preferences, device contacts (e.g., to facilitate mobile transfer payments or wire transfers), photos (e.g., to deposit checks), internet protocol address, mobile network information, general location (e.g., city, state, or country), precise location (e.g., latitude/longitude to find a nearby EFC Bank branch or ATM), cookie IDs, device IDs, mobile advertising IDs (e.g., Apple’s IDFA or Google’s Advertising ID), and likely connections among different browsers and devices that you use (collectively, “Device Data”).
• Online/mobile activity data, such as login data, search history, information about how you use and interact with our Online Services or advertising (including content viewed, links clicked, and features used), when and how often you use our Online Services, the webpage from which you clicked a link to come to our Online Services (e.g., the referrer URL), and crash reports (collectively, “Online/Mobile Activity Data”).
• Marketing data, such as your marketing preferences, information about products or services we think you might like, and inferences based on your interactions with us or our partners (e.g., Online/Mobile Activity Data used for targeted advertising).
• Communications data, such as your communication preferences and details or the content of your communications with us (e.g., chat messages).
• Survey and research data, such as your responses to questionnaires, surveys, requests for feedback, and research activities.

• Employment application data, such as professional, employment-related, and education history collected through the Online Services about job applicants, employees, associates, contractors, or other members of the EFC Bank workforce who inquire about or apply for a job at EFC Bank using our Online Services
• Other people’s information, such as information related to other people that you disclose to us or to our service providers when you visit or use the Online Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

How do we use your personal information?

Personal information collected from and about you online described in this Notice may be used for many purposes such as:

• Providing our products and services, such as enabling you to apply for and obtain EFC Bank products or services, evaluating your application for eligibility for a EFC Bank product or service, servicing and managing your accounts, providing customer service or support, communicating with you, and providing online tools and features.
• Processing transactions and payments, such as transferring funds between accounts, processing payments or transactions, fulfilling orders, and conducting settlement, billing, processing, clearing, or reconciliation activities, and helping you make a purchase, book flights, hotels, events, and other online services.
• Protecting against security risks, such as monitoring network activity logs, detecting security incidents, conducting data security investigations, and otherwise protecting against malicious, deceptive, fraudulent, or illegal activity.
• Verifying your identity, such as conducting identity verification when you apply for our products or services, authenticating your login credentials, verifying your location to allow access to your accounts, and storing security questions for subsequent verification online or over the phone.
• Detecting and preventing fraud, such as determining fraud risk and identifying fraudulent transactions.
• Conducting analytics and research, such as examining which parts of our website you visit or which aspects of our mobile apps you find most useful, evaluating user interface and experiences, testing features or functionality, performing debugging and error repair, and analyzing the use of our Online Services.
• Advertising and marketing, such as sending you offers for special products and services via mail, email, or text message, displaying online advertising, targeting our offers or promotions, conducting market research, and evaluating or improving the effectiveness of our marketing efforts.
• Improving our products and services, such as personalizing and optimizing your website and mobile experiences, recognizing you across different browsers and devices you use, improving existing products and services, and developing new products and services.
• Carrying out legal and business purposes, such as complying with applicable laws, responding to civil, criminal, or regulatory lawsuits, subpoenas, or investigations, exercising our rights or defending against legal claims (including for collections and recoveries on past-due accounts), resolving complaints and disputes, performing compliance activities, analyzing credit risk, conducting credit reporting activities, regulatory reporting, performing institutional risk control, conducting human resources activities, and otherwise operating, managing, and maintaining our business.
• Creating aggregated and de-identified information, such as using or modifying the information described in this Privacy Policy in a manner that does not allow us to reasonably identify you. Collected personal information may be aggregated and/or de-identified (we remove any details that identify you personally). We may share this aggregated and/or de-identified information with third-party providers to help deliver products, services, and content that are better tailored to the users of our online services and for our own business purposes where permissible under applicable laws and regulations.

We retain personal information for a period of time as required by laws and regulations and the necessary business purpose. We securely delete personal information as soon as legally permitted.

Individual health and/or sensitive information

To the extent that we receive, maintain, or process an individual’s health information, EFC Bank may use and disclose that information as authorized by and in accordance with applicable federal and/or state law. At the time of event registration participants may provide information that requires special accommodation. This information will be used only to the extent necessary to facilitate any special accommodation for event participation.

How do we share this information?

We may share the personal information we collect from and about you online described in this Notice (and subject to other legal restrictions and notices you may have received depending on your relationship with us) with:

• Affiliates. We may share information with companies in the EFC Bank family.
• Business partners. We may share information with companies that we have partnered with to offer or enhance products and services for EFC Bank customers or prospective customers. For example, we may share information with co-branded debit and credit card partners, joint marketing partners, bill pay partners, or retail partners that allow you to redeem credit card rewards.
• Marketing partners. We may allow companies to collect information through our Online Services in order to provide marketing services to us, including to target advertising to you based on personal information collected across different websites, mobile apps, and devices over time. Learn more about how we use online tracking technology to conduct personalization, analytics, and targeted advertising, and how you can opt out below at the online tracking technology section.
• Service providers. We use other companies to provide services on our behalf and to help us run our business, including credit cards partners. We may share information with these service providers, or they may collect information on our behalf, for various business purposes. For example, we use service providers for hosting and securing our information systems, servicing customer accounts, detecting and preventing fraud, assisting with human resources activities, communicating with our customers, and analyzing and improving our Online Services.
• Other third parties with your consent or as necessary to provide our products and services. We share information with your consent or at your direction, such as when you ask us to share information with a money management app to track your finances or to share financing details with an auto dealer when shopping for a car or a motorcycle. We also may share information with third parties to provide products and services that you request, such as with merchants that are authorizing EFC Bank debit and credit card transactions, with travel, entertainment, or restaurant providers when you transfer funds or send money to friends and family via mobile transfer or bank to bank transfer, and with third-party payment processors (such as PayPal, Rogapay or Stripe) when you make payments online or add funds to your accounts from those payments gateways.
• Credit bureaus. We share information with credit reporting agencies, to report on or learn about your financial history and for other lawful purposes.
• Government entities and others with whom we share information for legal or necessary purposes. We may share information with government entities and others for legal and necessary purposes, such as:
  • To respond to requests from our regulators or to respond to a warrant, subpoena, governmental audit or investigation, law enforcement request, legal order, or other legal process.
  • In connection with a proposed or actual sale, merger, transfer, acquisition, bankruptcy, or other disposition of some or all of our assets, in which case we may share information with relevant third parties.
  • For other legal purposes, such as to enforce our terms and conditions, exercise or defend legal claims, comply with applicable laws, or if we determine that disclosure is necessary or appropriate to protect the life, safety, or property of our customers, ourselves, or others.

How to limit sharing

You have choices regarding the sharing of some personal information. Where appropriate, we will limit sharing of your personal information based on your privacy choices. You can register your choices online.

Online tracking technology used by EFC Bank

We and third-party providers acting on our behalf use a variety of online tools and technologies to collect information when you visit or use our online services, including Device Data and Mobile/Online Activity Data. We may use these tools to collect information for debugging, fraud prevention, session management, and other necessary purposes. We also use these to conduct personalization, analytics, and targeted advertising on or through the Online Services. We may associate this tracking data with your EFC Bank account (if you have one).

These tools include:

• Server logs. Server logs automatically record information and details about your online interactions with us. Server logs may record information about your visit to our website on a particular time and day.
• Cookies. Cookies are small text files that a website’s server stores in your web browser. Cookies allow companies to recognize your device and store information about your account and preferences. We may use cookies to store information about pages visited on our sites, language preferences, your relationship with us, or other information that we have associated with you or your device. You may be able to manage cookies on your device.
• Pixel tags. A pixel tag (also known as a web beacon, clear GIF, pixel, or tag) is an image or a small string of code that may be placed in a website, advertisement, or email. It allows companies to set or read cookies or transfer information to their servers when you load a webpage or interact with online content. We or our service providers may use pixel tags to determine whether you have interacted with a specific part of our website, viewed a particular advertisement, or opened a specific email.
• SDKs and mobile advertising IDs. Our mobile applications may include third-party software development kits (“SDKs”) that allow us and our service providers to collect information about your mobile app activity. In addition, some mobile devices come with a resettable advertising ID (such as Apple’s IDFA and Google’s Advertising ID) that, like cookies and pixel tags, allow us and our service providers to identify your mobile device over time for advertising purposes.
• Third-party plugins. Our Online Services may include plugins from other companies, including social media companies (e.g., the Rogachat “Like” button). These plugins may collect information, such as information about the pages you visit, and share it with the company that created the plugin even if you do not click on the plugin. These third-party plugins are governed by the privacy policies and terms of the companies that created them.

Online Behavioral Advertising

Personal information collected from and about you online, as described in this Notice, is used and shared to deliver advertising and marketing, including prescreened offers of credit, which may be of interest to you. We present tailored ads to you on our Sites and Mobile applications through ads that appear as you sign on or off of your online accounts. In off-line channels such as financial centers, call centers, and through direct marketing (for example email, mail, phone). On third-party sites and mobile applications not affiliated with EFC Bank.

·        How we tailor ads to you: Advertising on our sites, mobile applications, and off-line channels such as financial centers, call centers, and through direct marketing (for example email, mail, phone): We may use personal information about your activities on our Sites and Mobile Apps, such as pages visited and key words entered, to help determine which of our ads or offers may be of interest to you. We may use personal information about your relationship with us (such as types of accounts, transactional information, or the location in which you bank) to help determine which advertisements or offers to present to you.

·        Advertising on non-affiliated third-party sites and mobile apps: EFC Bank contracts with advertising companies to advertise our products and services on sites and mobile applications not affiliated with us. We may use personal information we have collected or that you have provided to assist our non-affiliated third-party sites and mobile applications to select bank ads or offers that may appeal to you, display them to you and monitor your responses. Non-affiliated thirdparty sites and mobile applications are not subject to EFC Bank Privacy Notices.

How you can opt out of Online Behavioral Advertising

You have choices about how EFC Bank advertises to you based on your online behavior.

Additional Information Third-party data sharing

Some companies may offer aggregation websites and services that allow you to share your data with them in order to consolidate your account information from different sources (such as your accounts with us or with other financial institutions) so that you can view it in one location or perform actions related to your accounts using their services. To do this, a third party may request you to authorize access to your EFC Bank accounts by providing your EFC Bank user ID and password or by providing your information-sharing consent directly to EFC Bank.

• The third party may access, on your behalf, information about you, your EFC Bank relationship, and your

accounts at EFC Bank.

• You should use caution and ensure that the third party has appropriate policies and practices to protect the privacy and security of any personal information you provide or to which they are gaining access.

• Use of your information by the third party is governed by your agreement with them, not by EFC Bank. We recommend reviewing the third parties’ policies before sharing your personal information to understand how they will use and store your account information. For example, look for whether they sell any of your personal information, and if your information will be transferred, processed, or stored outside of your country.

• We are not responsible for the use or disclosure of any personal information accessed by any company or person to whom you provide your site user ID and password.

• If you share your EFC Bank user ID, password or other information about your accounts with others, we will

consider that you have authorized any transaction or action initiated by using the access information you provide.

• If you decide to revoke the authority you have given to a third party, we strongly recommend that you change your EFC Bank password to ensure that the third party cannot continue to access your account.

• You may revoke your consent for certain third parties through the Security Center within EFC Bank Online Banking.

Social media

EFC Bank engages with customers on social media platforms such as Rogachat, Facebook®, Twitter®, YouTube® and LinkedIn®.

• Any content you post on official EFC Bank managed social media pages, such as pictures, information, opinions or any personal information that you make available to other participants on these social platforms, is subject to the Terms of Use and Privacy Policies of those respective platforms.

• When interacting with official EFC Bank social media pages, EFC Bank’s privacy notices, Social Media User

Terms and Community Guidelines may apply.

• Please review the privacy policy for the specific social media service you are using to better understand your rights and obligations with regard to such content. We may allow social share buttons on our sites that enable users to easily share information on social media platforms. The non-affiliated third parties that own these widgets may have access to information about your browsing on pages of our Sites and Mobile applications where these widgets are placed.