California Consumer Privacy Act
California Consumer Privacy Act Privacy Notice (pdf)
Effective January 1, 2023
California Bank of Commerce, N.A. (“CBC”, “we”, “us”) is committed to protecting the privacy of Personal Information of all our clients and employees and we thank you for your trust and confidence.
CCPA Summary: The California Consumer Privacy Act of 2018 (CCPA) gives consumers control over the personal information that businesses collect. In general, the law gives consumers the right to:
- Know about the personal information a business collects about them and how the information is used and shared.
- Delete personal information collected (under limited circumstances).
- Opt-out of the sale or sharing of the consumer’s personal information; and,
- Not be discriminated against for exercising consumer rights under the CCPA law.
Businesses that are subject to the CCPA have responsibilities, including responding in a timely manner to consumer requests to exercise their CCPA rights and providing consumers with certain privacy notices.
In November of 2020, Proposition 24 (The California Privacy Rights Act (CPRA)) was approved, which amended the CCPA and added new additional privacy protections that became effective on January 1, 2023. These additional rights included:
- The right to correct inaccurate personal information that a business has about the consumer; and
- The right to limit the use and disclosure of sensitive personal information collected about the consumer.
The CPRA amended the CCPA; it does not create a separate, new law or supersede the older law. It should be noted that this Privacy Policy does not apply to information that is subject to the Gramm-Leach Bliley Act (GLBA). Please refer to CBC’s Privacy Policy Notice for additional details.
Personal Information: Information that identifies, relates to, or could reasonably be linked directly or indirectly with a California resident is considered “Personal Information”. The specific Personal Information that CBC collects, uses, and discloses that is covered by the CCPA will vary based on your relationship or interaction with us.
Personal Information does not include:
- Publicly available information from government.
- De-identified or aggregated consumer information.
- Information excluded from the CCPA’s scope including:
-
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
- Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), and the GLBA.
We do not share or disclose your information except as allowed by law. We share (disclose) information only with those vendors or third parties providing servicing of your products and services and require that they not sell, share, or use your information for any other purpose.
Your Rights Under the CCPA: The CCPA provides you with specific rights regarding your personal information that includes.
- Right to Know: You may be entitled to request that we disclose to you Personal Information we have collected about you, the categories of sources from which we collected the information, the purposes of collecting the information, the categories of third parties with whom we have shared the information, and the categories of Personal Information that we have shared with third parties for a business purpose. Before providing such information, we must be able to verify your identity. You may make a Right to Know request up to twice a year.
- Right to Delete: You may request that we delete personal information collected from you and inform our service providers to do the same. However, there are exceptions that allow us to retain your Personal Information. For example, we will not delete Personal Information about you when the information is required to fulfill a legal obligation, is necessary to exercise or defend legal claims, or where we are required or permitted to retain the information by law. In addition, before deleting information, we must be able to verify your identity.
- Right to Opt-Out of Sale or Sharing: We do not sell or share Personal Information to third parties within the meaning of the CCPA, and therefore we do not offer this option. We may disclose Personal Information about you to our affiliates and service providers as permitted by law. As stated above in the Personal Information section, we do not share or disclose your information except as allowed by law.
- Right to Correct: You may request that we correct your Personal Information that you believe is incorrect. Subject to exceptions, we may choose not to change Personal Information if we believe that the information is more likely to be accurate than inaccurate. To make a correction request please refer to the “How to Make Requests” section below.
- Right to Limit, Sensitive Personal Information: The CCPA grants you the right to limit the use or disclosure of your Sensitive Personal Information (e.g. social security number, precise geolocation or ethnicity) to that which is necessary to perform the services reasonably expected by you to provide those services and to perform activities permitted by the CCPA. Since we do not use or disclose Sensitive Personal Information for any purposes other than necessary to provide relevant services or as permitted by the CCPA, no Right to Limit applies.
- Right to Non-Discrimination for Exercising Rights: The CCPA protects you from discrimination that could include denying goods or services, charge you a different price, or provide a different level or quality of goods or services just for exercising your rights under the law. Please refer to the “How to Make Requests” section below for details on how to exercise these rights.
Notice at Collection
Categories of Information
How We Use Personal Information
Identifiers:
Examples: A real name, postal address identification numbers such as Social Security number, driver’s license number, state identification card or passport number, or financial account credentials
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- Enable information security, detect security incidents and authenticate your identity.
- To engage in or maintain an employment relationship with you or for other employment related purposes.
- For payroll, tax and benefit purposes.
- To support our audit, legal, regulatory, and compliance obligations.
Personal Information:
Categories listed in the California Customer Records statute. Examples: A signature, telephone number, passport number, education, bank account number, credit card number, health insurance or health information.
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- Enable information security, detect security incidents, and authenticate your identity.
- To engage in or maintain an employment relationship with you or for other employment related purposes.
- For payroll, tax and benefit purposes.
- To support our audit, legal, regulatory, and compliance obligations.
Protected Classes Characteristics:
Examples: Age (40 years or older), race, citizenship, immigration status, marital status, sex, or veteran or military status.
- To fulfill or meet the purpose for which you provided the information.
- For Equal Employment Opportunity purposes.
- To support our audit, legal, regulatory, and compliance obligations.
Commercial Information:
Examples: Records of personal property, products, or services purchased, obtained, or considered
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- Enable information security, detect security incidents and authenticate your identity.
- To support our audit, legal, regulatory, and compliance obligations.
Biometric Information:
This topic may include fingerprints
- As a fraud protection tool to authenticate a person’s identity.
- To provide you with support and respond to your inquiries.
- Provide job related notifications, conduct research to assess job qualifications, background checks, and employment processing.
Internet or Other similar network activity:
Examples such as: Information regarding a consumer’s interaction with a CBC website or application, browsing history / search history, cookies, advertisements, or contents of personal messages, where the bank is not the intended recipient.
- To fulfill or meet the purpose for which you provided the information.
- To provide you support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- Enable information security, detect security incidents and authenticate your identity.
- To support our audit, legal, regulatory, and compliance obligations.
Geolocation Data:
Examples such as device or personal location.
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- Enable information security, detect security incidents, and authenticate your identity.
- To support our audit, legal, regulatory, and compliance obligations.
Sensory Data:
Examples such as audio, electronic, visual, thermal, olfactory, or similar information.
- To protect, detect, investigate, report, and prevent financial crime.
- Support our audit, legal, regulatory, and compliance obligations, and exercise and defend legal rights.
- Maintain and service your account, including processing transactions.
- Enable information security, detect security incidents, authenticate your identity, and perform due diligence.
Professional or Employment-Related Information:
Examples such as employment related records including work history and prior employer, information from background checks, and resumes.
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- Provide job related notifications, conduct research to assess job qualifications and employment processing.
- To support our audit, legal, regulatory, and compliance obligations.
Inferences:
Inferences drawn from other personal information such as profiles reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- To engage in or maintain an employment relationship with you or for other employment related purposes.
Sensitive Personal Information:
Examples include social security, driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation, health information, racial or ethnic origin, or union membership; contents of a consumer’s mail, email, and text messages unless the bank is the intended recipient of the communication.
- To fulfill or meet the purpose for which you provided the information.
- To provide you with support and respond to your inquiries.
- To process your requests, transactions and payments and prevent transactional fraud.
- Enable information security, detect security incidents and authenticate your identity.
- To engage in or maintain an employment relationship with you or for other employment-related purposes.
- For payroll, tax and benefit purposes.
- To support our audit, legal, regulatory, and compliance obligations.
The “Selling” and “Sharing” of Personal Information: CBC does not sell or share your Personal Information as those terms are defined within the CCPA.
- In the previous 12 months, we have not sold information about consumers.
- In the previous 12 months, we have disclosed personal information to service providers for a business purpose to assist in providing products and services to you, to comply with legal or regulatory requirements and for employment related purposes.
Retention of Personal Information: We retain your Personal Information, including your Sensitive Personal Information, for the period necessary to fulfill our requirements unless a longer retention period is required or permitted by law. In many situations, we must retain all, or a portion, of your Personal Information, to comply with our legal obligations, resolve disputes, enforce our agreements, to protect against deceptive or illegal activity, or for another one of our business purposes.
Children’s Privacy: Our web site is not intended for use by children under the age of 13. We do not knowingly solicit data online from, or market online to, children under the age of 13. If we knowingly obtain personally identifying information in error on a child under the age of 13, we will delete that information from our systems.
How to Make Requests: To submit requests, please contact us by any of the following options:
Email:
In your request, please include the following:
- Your first and last name as well as middle initial, if applicable
- Telephone number where you can be reached during normal business hours (Monday through Friday 8 am to 5 pm PT)
- The last four digits of your account number (if you have one). If you have multiple accounts, please include the last four digits of the additional accounts.
- An email address
- Your physical addres
Response Timing: We will respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.
Once a request has been submitted, we will verify that you are the consumer the request applies to. If we are unable to verify your identity, we may contact you and ask you to provide additional information
Changes to this Policy: CBC reserves the right to amend this Privacy Policy Notice at any time. If changes are made, we will post the new policy on our website and change the “Last Updated” date. If required by law, we will send you notice of the change(s).
