California Notice of Collection | Pacific Western Bank

Most of the information we collect about you is financial information or information collected in the context of our relationship as your financial institution. As such, this information generally is not subject to state consumer privacy laws. However, in certain circumstances, we may collect information that is outside the context of our financial relationship. In particular, if you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), and to the extent that we collect personal information subject to the CCPA, that information and our practices are described below.

A few things to note when reading the below:

The categories we use to describe personal information are those enumerated in the CCPA. Certain personal information may fall into multiple categories. Categories listed in the CCPA and not discussed here are either not collected or financial or other information not within scope of the CCPA.

We are required to list the categories of third parties to whom we (1) “sell” personal information; or (2) “share” personal information with for cross-context behavioral advertising. The CCPA defines a “sale” as the disclosure of personal information for monetary or other valuable consideration. We do not sell and have not, within at least the last 12 months, sold personal information. Note, we are not required to list disclosures that are infrequent or that are not considered “sales” or “sharing” under the law. We are also required to list the categories of entities to whom we disclose information to conduct activities on our behalf. Service providers are restricted from using personal information for any purpose that is not related to our engagement or otherwise permitted under the law. Please see Section 3 above for more information about how we disclose your information.

5.1 CUSTOMER BANKING ACTIVITY
Category	Required Information
Identifiers	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers Source: Directly from you or our business customer (e.g., if you personally guarantee a business loan); service providers Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2, above Categories of Parties to Whom PI is “Sold” or “Shared”: Online identifiers and IP address may be shared with third-party marketing partners Categories of Parties to Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; marketing partners; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, medical information Source: Directly from you or our business customer (e.g., if you personally guarantee a business loan); service providers Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
Protected classification characteristics under California or federal law	Age (40 years or older), national origin, marital status, gender, veteran or military status Source: Directly from you or our business customer (e.g., if you personally guarantee a business loan); service providers Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
Commercial Information	Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies Source: Directly from you or our business customer (e.g., if you personally guarantee a business loan); service providers; business partners Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties to Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
Professional or employment-related information; Education information	Institutions attended and degrees obtained; Current and prior job history Source: Directly from you or our business customer (e.g., if you personally guarantee a business loan) Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties to Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
Sensory Data	Audio (call recordings), electronic, visual (CCTV), or similar information Source: Directly from you Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties to Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
Sensitive personal information	Information reflecting social security, driver’s license, state identification card, or passport number; account log-in/number in combination with any required security code or password; precise geolocation; racial or ethnic origin Source: Directly from you or our business customer (e.g., if you personally guarantee a business loan); service providers Purpose of collection and use: All purposes listed in Sections 2.1 and 2.2 above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as payment processors, merchants, or other financial institutions; other third parties with your consent or as necessary to provide our financial products and services to customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.2, above
5.2. JOB APPLICANT INFORMATION
Category	Required Information
Identifiers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Name, email address, phone number, and contact address, username, password Source: Directly from you; service providers; business partners such as recruiters Purpose of collection and use: All purposes listed in Sections 2.1 and 2.3 above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; marketing partners; business partners such as recruiters; other third parties with your consent; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.3, above
Protected classification characteristics under California or federal law	Age (40 years or older), national origin, marital status, gender, veteran or military status Source: Directly from you; service providers; business partners such as recruiters Purpose of collection and use: All purposes listed in Sections 2.1 and 2.3 above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as recruiters; other third parties with your consent; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.3, above
Professional or employment-related information; Education information	Institutions attended, degrees obtained, and courses taken; Current and prior job history Source: Directly from you; service providers; business partners such as recruiters Purpose of collection and use: All purposes listed in Sections 2.1 and 2.3 above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as recruiters; other third parties with your consent; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.3, above
Inferences drawn from other information	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes Source: We do not actively create profiles of the preferences or interests of our job applications; however, certain of this information may be collected incidentally during the process of evaluating your application for employment Purpose of collection and use: All purposes listed in Sections 2.1 and 2.3 above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as recruiters; other third parties with your consent; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.3, above
Sensitive personal information	Information reflecting social security, driver’s license, state identification card, or passport number; account log-in/number in combination with any required security code or password; racial or ethnic origin, religious or philosophical beliefs, or union membership Source: Directly from you; service providers; business partners such as recruiters Purpose of collection and use: All purposes listed in Sections 2.1 and 2.3, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties With Whom PI is Disclosed: Service providers; business partners such as recruiters; other third parties with your consent; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.3, above
5.3. BUSINESS CONTACT INFORMATION
Category	Required Information
Identifiers	Name, email address, phone number, and business contact address Source: Directly from you or from the business entity you represent Purpose of collection and use: All purposes listed in Sections 2.1 and 2.4, above Categories of Parties to Whom PI is “Sold” or “Shared”: None Categories of Parties to Whom PI is Disclosed: Service providers; business partners, such as your employer; other third parties with your consent or as necessary to provide our products and services to our customers; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.4, above
5.4. ONLINE USER ACTIVITY
Category	Required Information
Internet or other similar network activity	Device ID, browsing history, search history, and information regarding your interaction with an internet website, application, or advertisement Source: Automatically generated when you use the Services. Purpose of collection and use: All purposes listed in Section 2.5, above Categories of Parties to Whom PI is “Sold” or “Shared”: Marketing partners Categories of Parties With Whom PI is Disclosed: Service providers; marketing partners; business partners; other third parties with your consent or as necessary to provide our products and services; government entities and others with whom we share information for legal or necessary purposes; and other entities listed in Sections 3.1 and 3.5, above

5.5. Sensitive Personal Information. While some of the categories of information that we collect may be considered “sensitive personal information,” the Company uses and discloses sensitive personal information for those purposes that are authorized by law. For example, we may process your sensitive personal information in order to perform the services or provide the products you request from us, or to verify customer information. California law does not afford you rights to limit the use or disclosure of your sensitive personal information for these purposes.
5.6. Retention. The length of time we retain personal information will depend on a number of criteria, including (i) the length of time we are required to retain personal information in order to comply with applicable legal and regulatory requirements, (ii) the length of time we may need to retain personal information in order to accomplish the business or commercial purpose(s) for which such personal information is collected, used or disclosed (as indicated in this Online Privacy Policy), and (iii) whether you choose to exercise your right (subject to certain exceptions) to request deletion of your personal information.

For additional information about your rights as a California resident, see Section 6.3.

6. YOUR CHOICES ABOUT YOUR INFORMATION

6.1. Customer Banking Activities
- 6.1.1. We treat information collected from or about individuals in connection with any Customer Banking Activities in accordance with applicable federal and state privacy laws including the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA). We therefore use and share any information that we collect from or about consumers of our financial products or services consistent with the disclosures in our Consumer Privacy Notice, posted here.
- 6.1.2. Accessing and Correcting Customer Banking Activity Information. Keeping your customer account information up-to-date is very important. You may review or update certain account information and transactions by logging in to the Services or by contacting us. You can also adjust certain profile and privacy settings as follows:
- 6.1.2.1. Account profile: Your online account profile may provide different options for the type of personal information you can provide as well as the types and methods of communication that you prefer. You may view or update your profile and privacy settings by logging in to your online banking account. You may also review or update account information by visiting one of our branches.
- 6.1.2.2. Emails: In all promotional emails, you will be given the opportunity to opt-out of receiving such messages in the future by clicking on the link at the bottom of the email that says “unsubscribe.” It may take up to ten (10) business days for us to process your opt-out request. Please note that even after opting out of promotional emails, we may still send you customer service announcements, administrative notices and Services-related communications (e.g., account notices, transaction confirmations, and security notices).
- 6.1.2.3. Text messages: In the event you are enrolled in any service that provides text messages to you, you can opt-out of receiving text messages from that service by replying “STOP” to any text message received. You will continue to receive text messages from product lines or services from which you have not opted out.
- 6.1.2.4. Mobile devices: As with cookies, mobile devices may allow a user to block certain information requests (e.g., location information), but doing so may diminish your experience with our Services. Mobile device or mobile operating system providers typically provide instructions on how to adjust such privacy features.

6.2. Online User Activity. Online User Activity information collected by third parties about your visit to, or use of, our Services could potentially be used by those parties for their own purposes, some of whom may be able to associate such information with you based on other information they have collected independently (not from us). When you opt-out as provided below, we will endeavor to block such information collection activities by third parties.
- 6.2.1. Rejecting Cookies. Most web browsers allow a user to reject cookies, but doing so may diminish your experience with our Services.
- 6.2.2. Opting Out of Tracking Cookies. We provide all customers and other website visitors with the option of turning off the tracking cookies used on our website by visiting the homepage and clicking on the “Do Not Sell or Share My Personal Information” link. (The California Consumer Privacy Act refers to this as a “Do Not Sell” request.)
- 6.2.3. Global Privacy Control. Our website supports Global Privacy Control (GPC), which is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When we detect a GPC signal from a browser, we treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws.
- 6.2.4. Do Not Track. We do not respond to Do Not Track (DNT) signals and handle all user information as permitted by law consistent with our Terms of Use and this Online Privacy Policy.

6.3. Additional Notices for Residents of California
- 6.3.1. Shine the Light – Your California Privacy Rights. California residents have the right to request information from us regarding other companies to whom we have disclosed certain categories of information during the preceding year for the other companies' direct marketing purposes. If you are a California resident and would like to make such a request, please email us at privacy@pacwest.com.
- 6.3.2. Notice of Financial Incentive. We do not provide a financial incentive or a price or service difference to customers in exchange for the retention or sale of their personal information. We may send promotions or offers to customers or other individuals who subscribe to marketing communications, and unless a customer has opted out of such communications, the customer will continue to receive such notices irrespective of whether any information privacy request described here has been submitted. We do not offer financial incentives to deter customers from making such requests.
- 6.3.3. CCPA Rights. If you are a California resident, you may have the following rights with respect to your personal information within scope of the CCPA:
- 6.3.3.1. Right to Access. You have the right to request access to personal information collected about you and information regarding the sources of that personal information, the purposes for which we collect it, and the categories of third parties and service providers with whom we share it with.
- 6.3.3.2. Right to Correct. You have the right to correct inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.
- 6.3.3.3. Right to Delete. You have the right to request in certain circumstances that we delete personal information that we have collected directly from you.
- 6.3.3.4. Exercising Your Right to Access, Right to Correct, or Right to Delete. You may submit a request for access to your personal information, to correct your personal information, or to delete your personal information, by completing the form or emailing us at privacy@pacwest.com.
  
  To protect your personal information, you must verify your identity before we can act on your request. Thus, we ask you to provide personal identifiers we can match against information we may have collected from you previously, and to confirm your request using the contact information provided in the request. If we need additional information, we will let you know.
  
  We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you may anticipate. For example, we may decline to honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. In other instances, we may decline to honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer or where the personal information that we maintain about you is not subject to the CCPA. If we do, we will explain that to you in our response.
- 6.3.3.5. Authorized Agents. You may authorize another individual or a business registered with the California Secretary of State, called an authorized agent, to make requests on your behalf through these means.
- 6.3.3.6. Right to Opt-Out and Exercising Your Right to Opt-Out. You have the right to opt-out of “sale” and “sharing” (as those terms are defined in the CCPA) of your personal information with certain of third parties. In the past 12 months, we have not disclosed personal information relating to California residents in any manner that we consider a sale within the meaning of the CCPA. We provide all customers and other website visitors with the option of opting out of the sharing of personal information for cross-context behavioral advertising purposes by turning off the tracking cookies used on our website. You can turn off cookies by visiting the homepage and clicking on the “Do Not Sell or Share My Personal Information” link. You can also enable Global Privacy Control (GPC) in your browser.
- 6.3.3.7. Right to Non-Discrimination. You have the right to be free from discrimination if you exercise your CCPA rights.

7. LINKING TO THIRD-PARTY WEBSITES AND SERVICES

7.1. Our Services may contain links to other websites, services or social media platforms that are owned or operated by other companies (“Third-Party Websites”). Third-Party Websites are not subject to our Privacy Policy. We are not responsible for the practices employed by any Third-Party Websites or services linked to or from our Services, including the information or content contained within them. Your browsing and interaction on any Third-Party Websites or service, including those that have a link on our Services, are subject to that third party’s own rules and policies, not ours. By accessing Third-Party Websites you agree that we are not responsible and do not have control over any third parties that you authorize to access your personal information, which includes your sharing of account credentials with any third party, or linking your activity to any social media platforms or data aggregators.

8. INTERNATIONAL CONSIDERATIONS

8.1. We operate in the United States. While our primary data centers are in the United States, we may transfer personal information or other information outside of the United States. In addition, we may employ other companies and individuals to perform functions on our behalf. If we disclose personal information to a third party, we will seek assurances that any information we may provide to them is safeguarded adequately and in accordance with this Online Privacy Policy. By providing your personal information, you consent to any transfer and processing in accordance with this Online Privacy Policy.
8.2. There may be very limited circumstances under which we process the personal information of European Union or European Economic Area residents (“Data Subjects”) that is deemed “Personal Data” subject to foreign data protection and privacy laws such as the General Data Protection Regulation 2016/679 (“GDPR”). In such circumstances, you (the Data Subject) may have the right to request (a) access to your Personal Data we hold about you; (b) request we correct an inaccurate Personal Data we hold about you; (c) request we delete any Personal Data we hold about you; (d) restrict the processing of Personal Data we hold about you; (e) object to the processing of Personal Data we hold about you; and/or (f) receive any Personal Data we hold about you in a structured and commonly used machine-readable format or have such Personal Data transmitted to another company. If you would like to exercise any of your rights, please complete the form here, or contact us by email at privacy@pacwest.com or by mail to Attn: Operations, Pacific Western Bank, 3011 Townsgate Rd., Ste. 200, Westlake Village, CA 91361.

9. HOW TO CONTACT US

9.1. Please direct questions or concerns about this Online Privacy Policy or our Services to us at privacy@pacwest.com or by mail to Attn: Operations, Pacific Western Bank, 3011 Townsgate Rd., Ste. 200, Westlake Village, CA 91361.

10. EFFECTIVE DATE

10.1. This Online Privacy Policy was last revised and is effective as of 1.11.23.