FIRST CITIZENS BANK MOBILE BANKING APPLICATION PRIVACY POLICY

Personal Information is generally information that can be used to directly identify an individual (e.g., passport number, government identity number, driver’s license number) or information that may be used to indirectly identify an individual (e.g., date of birth, address, employment information, health information).

Types of Personal Information that May be Collected. The types of Personal Information we collect depends on the Services you request or use, and our obligations under applicable legal or regulatory obligations.
The Personal Information we process (collect, use, store, and share) may include:

Contact information

• Full name
• Telephone number
• Email address
• Physical legal/mailing address
• Identity, Employment, Education, and Political Information
• Gender
• Nationality
• Country of residence
• Valid passport information
• National identification card information
• Driver’s license information
• Birth certificate information
• Signature exemplar
• Marital status
• Spouse or partner’s information
• Mother’s maiden name
• Home ownership
• Number of dependents
• Employment history
• Educational background
• Political affiliation

Financial information

• Financial account information (e.g. institution, account numbers)
• Transaction history
• Credit ratings
• Credit report
• Annual income
• Assets and liabilities
• Investment objectives
• Collateral/Security provided

Technological information

• IP address
• Device characteristics
• Geo-location
• URLs of Group websites to which you arrive or leave
• Your browser type, operating system, internet service provider
• Mobile device provider
• Internet Service Provider
• Other necessary technical and security information

Sensitive Personal Information. We will not collect Sensitive Personal Information unless you provide consent, and it is permitted under applicable law.

Sensitive Personal Information which is a subset of Personal Information includes:

• Racial or ethnic origin
• Political opinions
• Socio-economic status
• Criminal record or record of proceedings for an offence committed or alleged to have been committed
• Financial record or position
• Membership in a trade union
• Biometric data
• Physical or mental health
• Sexual orientation or sexual life

Directly from you. We may directly collect your Personal Information when you access our Services or communicate with us in-person or online.
Your actions will also determine whether you have provided consent, which includes, but is not limited to your:

• Voluntary provision of Personal Information to us through any of our channels;
• Express consent or acknowledgement, including those contained within a written, verbal or electronic application process;
• Consent solicited by us for a specified purpose;
• Receipt of this Notice (either via hard copy or digitally);
• Consent given through your authorized representative (e.g., legal guardian, agent or holder of a power of attorney).

Third-Party Service Providers.

We may also collect your Personal Information through our Third-Party Service Providers (e.g., credit bureaus, reporting agencies, and advertising agencies) whose services are generally covered by a service agreement with us.

We may collect your Personal Information in the following situations including when you:

• Apply or register for our Services
• Conduct transactions in-person, online, or at an Automated Teller Machine (ATM)
• Engage with us in-person, on the phone, or digitally through emails, social media or other touchpoints
• Complete online or hardcopy forms
• Register for our events
• Schedule an appointment with us
• Complete surveys, enter a competition, or promotion
• Access our websites, browse online applications, or utilize our online services (see, “Use of Cookies and Similar Technologies” below)
• Subscribe to our newsletters/publications
• Request marketing materials
• Apply for employment

The Group uses your Personal Information only when we have a lawful basis to do so. Depending on your interaction with us, we may rely on your consent to process (e.g., use, collect, store, share) your Personal Information, or when it is necessary:

• To fulfill a contract with you
• To comply with a legal obligation
• To protect your vital interests
• To comply with the law
• For our or others’ legitimate interests, except where such interests are outweighed by your fundamental rights and freedoms or legitimate interests

We may use and share your Personal Information for legitimate business purposes. We may share your Personal Information with our subsidiaries and affiliates, and third parties:

• To confirm a customer’s identity
• To perform our responsibilities under our contract with you
  To provide existing Services and explore new Services
  To provide updates on administrative changes to our terms, conditions, notices, and policies, and to respond to your customer service needs
• To send marketing and promotional communications (e.g., special offers, new products, online services)
• To request and receive your feedback on our Services, and events hosted by the Group and/or in collaboration with third parties
• To assist in investigating, processing and adjudicating complaints made internal or externally
• To assist with the identification and mitigation of fraudulent activities, anti-money laundering and terrorism financing
• To promote the safety and security of our systems, our physical locations, and to protect the rights and property of the Group and others
• To monitor and analyze trends, usage, and activities relating to our Services
• To meet our legal, regulatory, and compliance requirements
• To manage and assess our risks
• To facilitate the enforcement of debts or any obligation owed to us by you
• To respond to court orders, search warrants or other lawful demands or requests, or to comply with the rules of a court
• Any other legitimate business purposes to aid in evaluating and improving our services
  

Recipients of Your Personal Information. Your Personal Information may be shared with:

• Business units, subsidiaries and affiliates within the Group
• Third-Party Service Providers
• Successors in title (through merger, acquisition)
• Professional advisors (e.g., lawyers, auditors, consultants)
• Law enforcement agencies
• Other entities or any person entitled to demand or request the disclosure of your Personal Information in accordance with the law

Cross-Border Data Transfers

We may share your Personal Information with other countries within the Group, and with third-party service providers located outside of your country. The Group will apply appropriate safeguards to protect your Personal Information.

Safeguards

We will ensure that appropriate safeguards are in place to protect your Personal Information from unauthorized access and any service providers shall be restricted from utilizing your Personal Information for their own purposes.

Save for the purposes outlined above, we will keep your Personal Information confidential to the extent that such information is not:

• Information which at the time of disclosure is published or otherwise generally available to the public
• Information, which is published or becomes generally available to the public, other than through any act or omission by the Group
• Information in our possession which is not otherwise confidential
• Information rightfully acquired from a third party who did not, to the best of the Group’s knowledge and belief, obtain it under pledge of confidentiality to you or another.

Automated Decision Making

The Group may use automated decision-making (i.e., using automated means to make decisions) in limited circumstances.

Closed-Circuit Television (CCTV)

As permitted by law, we monitor our offices, branches and ATMs using CCTV cameras. These cameras cover outer areas of our premises, as well as, entry points, exit points and specific areas inside our buildings such as waiting areas, lobbies and spaces with monetary, mission critical or sensitive assets with a high risk of theft.

Cameras are positioned to monitor access to and ensure security of our premises, employees, visitors and customers. Video footage from CCTV cameras is retained to investigate unauthorized physical access to our premises; theft of assets of the Group or persons on our premises; customer transaction queries; and safety of persons on our premises.

Your Personal Information may be stored on premises and/or by third-party cloud service providers in any country where we operate or in which we engage service providers. Third-Party Service Providers are contractually obligated to comply with applicable policies, laws, and regulations in protecting your information.

Your Personal Information belongs to you. The following privacy rights, subject to applicable law, apply to all customers of the Group.

Right to Access

You have the right to request access to your Personal Information held by the Group. In some instances, we may charge a reasonable fee based on administrative costs in fulfilling your request.

Right to Correction

Your Personal Information should always be accurate and up to date. The Group encourages you to inform us of any changes or alterations to your Personal Information during the tenure of our relationship by contacting us or providing updates when requested by us.
If you have subscribed to any of our online services, some of your Personal Information may be updated by logging into your account and making or requesting any necessary changes. In all instances, your changes may require that you provide us with additional supporting documentation.

Right to Withdraw Your Consent (Opt-Out)

You may opt-out of receiving marketing-related emails from us by following the “unsubscribe” instructions at the bottom of each email. You may not opt-out of receiving administrative messages about your account(s).

Cookies are small files placed on your device when you visit a website or use mobile applications. The Group and/or Third-Party Service Providers may use cookies and similar technologies to help us store your preferences and settings, assist in security measures and to understand the performance of our websites, online services, and mobile applications.

We will only retain your Personal Information for as long as reasonably necessary to fulfil the purposes identified for collection, and to meet our legal obligations. We will collect, store and process your Personal Information during the tenure of your relationship with the Group and for the purposes outlined in this Notice. Upon termination of our relationship with you, your Personal Information will be retained for a period prescribed by applicable laws and regulations, and thereafter it is destroyed.

We have implemented procedural, physical and online security measures and systems that align with industry standards to protect any Personal Information we collect, store and process.

You should only access our website and provide your Personal Information over a secure connection.
While the Group utilizes all reasonable efforts to protect your Personal Information, it is your personal responsibility to act prudently to secure such information.

We advise you that the Group will not send emails, texts, or messages via social media that require you to log-on, verify your identity, and/or disclose your Personal Information, or provide sensitive banking data using those channels. Please contact us (see “Contact Us” tab below) if you are suspicious of any such communications or refer to our guidelines for protecting your personal information.

Third Party Service Provider Websites

Our websites may contain links to products and services of our authorized Third-Party Service Providers. This Notice applies solely to the Group’s websites, or such websites operated and controlled by us, and we will not be responsible for any unauthorized access to your Personal Information disclosed on such websites.

If you utilize any third- party link, please ensure that you read the policies and conditions governing the use of such websites.

You have a right to file a complaint with the data protection authority in your country if you allege a violation of that country’s data protection law.

This Notice may be updated from time to time by the Group (“Revised Notice”). All parties affected by this Notice must abide by the updated terms and conditions of the Revised Notice. The Revised Notice will be made available on our website and may be accessed at our physical locations (on an ‘as needed’ basis).

If you have any privacy related questions, you may contact us via email at:

Email: data.privacy@firstcitizenstt.com

For your protection, we may only process requests associated with the email address you used to send your request. We may need to verify your claimed identity before processing your request. In order to properly respond to your request, we may also need additional information and/or clarification of your request.