PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

1.INFORMATION PSECU COLLECTS

PSECU collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). Section 1.2 provides information about certain types of data that are not considered personal information. Specifically, PSECU has collected the following categories of personal information listed in Section 1.1 from our consumers within the last twelve (12) months.

1.1PSECU collects personal information in the following categories; however, not all examples listed in the table are collected from every member or individual.

*PSECU may not collect every item listed in category examples.

1.2Exceptions.

This Notice does not apply to you if you are not a California resident.

CCPA also excludes personal information covered by specific privacy laws. For example, nonpublic personal information provided by a consumer to a financial institution in order to obtain a financial product or service, that results from a consumer transaction, or that is otherwise obtained in connection with providing a financial product or service is covered under the Gramm-Leach Bliley Act (GLBA) Privacy Notice and is excluded from this notice.

• Publicly available information
• De-identified or aggregated information
• Information collected as part of a job application or employment information

1.3PSECU collects information in the categories listed above from the following categories of sources:

2.PSECU’S USE OF PERSONAL INFORMATION

PSECU uses personal information we collect about you for the following business purposes:

• To fulfill or meet the reason for which the information was provided. For example, if you, your agent, or another entity with whom we do business shares your name and contact information to request a financial product or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your request.
• To provide, support, personalize, and develop our websites, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests, purchases, transactions, and payments and prevent fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To market and sell PSECU’s products and services.
• To personalize your website experience and to deliver content, product, and service offerings relevant to your interests, including targeted offers and ads through our websites, third-party sites, and via email or text message (with your consent, where required by law).
• To help maintain the safety, security, and integrity of our business websites, products and services, databases, and other technology assets.
• For testing, research, analysis, and product development, including to develop and improve our websites, products, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

PSECU does not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice to you.

3.PSECU’S USE OF PERSONAL INFORMATION

PSECU does not “sell” member or consumers’ personal information as defined under the CCPA. For this reason, PSECU does not offer an opt-out for selling information.

4.PSECU’S USE OF PERSONAL INFORMATION

4.1PSECU only shares personal information with vendors (third parties) and service providers who are under contract to provide specific services. These contracts define the purpose and use of the data and restrict the vendor from selling any data provided by PSECU. PSECU shares information with these categories of third parties:

• Service providers
• Advertising networks
• Government or regulatory authorities (as required by law ((federal, state, and local)) or regulation)
• Social networks

4.2In the past twelve (12) months, PSECU has disclosed or shared the following categories of personal information to third parties for business purposes:

4.3In the past twelve (12) months, PSECU has not sold any personal information.

5.CALIFORNIA RESIDENTS’ RIGHTS AND CHOICES

5.2Access to Specific Information and a Copy of Personal Information

California residents have the right to request that PSECU disclose information to you about the collection and use of your personal information over the past 12 months and to request a copy of the specific pieces of personal information PSECU has collected about you in the prior 12 months (collectively, referred to as your “access” right). Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you
• Our business or commercial purpose for collecting or selling (if applicable) that personal information
• The categories of third parties with whom we have shared or share that personal information
• The categories of personal information we disclosed or shared with a third party for a business purpose
• The specific pieces of personal information we collected about you (also called a data portability request)
• The categories of third parties to whom the California resident's personal information has been sold and the specific categories of personal information sold to each category of third party (if applicable)

5.3Deletion Request Rights

California residents have the right to request that PSECU delete any of your personal information we collected from you and retained, subject to certain exceptions. Once your verifiable consumer request is received and confirmed, PSECU will delete (and where applicable, direct our service providers to delete) your personal information from our records, unless an exception applies.

PSECU may deny your deletion request if an exception applies, such as a regulatory obligation, or if it’s required for servicing the account.

5.4Do-Not-Sell Rights

California residents have the right to opt out of the sale of their personal information. PSECU does not sell personal information about our members or other consumers.

5.5Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request (as described more fully below) to us by either:

• Using the CCPA Request Form
• Calling us at 800.237.7328 and using the reference "CCPA request”

Only you, or a person registered with the California Secretary of State whom you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

However, we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

5.6Response Timing and Format

PSECU endeavors to respond to a verifiable consumer request for access to personal information within 45 days of receiving it. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

PSECU will deliver our written response by mail or electronically, at your option.

The response we provide will also explain the reasons we cannot comply with a request, if applicable.

5.7Non-Discrimination

California consumers have the right to exercise their access, deletion, and other rights without discrimination, and to receive transparent disclosures about any incentives a business offers them with regard to the collection, use, and disclosure of their personal information.

Discrimination may exist where a business takes or suggests that it will take the following actions in response to a consumer exercising rights under the CCPA, unless doing so is reasonably related to the value provided to the consumer by the consumer’s data:

• Deny access to, or use of, goods or services
• Charge different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties
• Provide a different level or quality of goods or services

6.CHANGES TO THIS PRIVACY NOTICE

PSECU reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will notify you through a notice on our website’s homepage.

7.CONTACT INFORMATION

If you have any questions or comments about this Notice, our Internet Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us by:

• Email: privacyofficer@psecu.com
• Phone: 800.237.7328. Use the reference "CCPA request."

Updated/Current as of December 3, 2020

©PSECU Form #5919 1220