California Consumer Privacy Act – Notice at Collection

Introduction

Under the California Consumer Privacy Act of 2018 (CCPA) and as amended by the California Privacy Rights Act (CPRA), River City Bank (the “Bank”) is required to inform California residents who are employees, job applicants, contractors, or any other consumer not exempted from the CCPA about the categories of personal information the Bank collects about you, the purposes for which the collected information will be used, and whether that information is sold or shared as defined by the CCPA. This notice provides a summary of how we collect, use, and share your personal information.

View our California Consumer Privacy Act Policy.

Categories of Personal Information We Collect

We collect the following categories of Personal Information relating to California residents covered by this Notice:

Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers;
Personal Information Categories listed in Civ. Code § 1798.80, such as name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, date of birth, insurance policy number, education, employment, employment history, bank account number, credit or debit card number, or any other financial information;
Protected Classification Characteristics under California or federal law, such as age, race, ethnicity, gender, veteran or military status, and marital status;
Commercial information, such as records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
Biometric information, such as fingerprints;
Internet or other electronic network activity information, such as browsing history, search history, and information regarding a California resident's interaction with an internet website application, or advertisement;
Geolocation data, such as general device location and IP for city and country location;
Sensory information, such as audio, electronic, visual, or similar information such as call recordings;
Professional or employment-related information, such as work history and prior employer;
Non-public education information directly related to a student and as provided by the student;
Inferences drawn from any of the Personal Information listed above to create a profile about a California resident reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. For example, if an individual clicks on a link to learn more about a HELOC, the Bank may infer that they are a homeowner and/or that they are looking for lending options;
The following categories of Sensitive Personal Information:

- Personal Information that may reveal:

A California resident's Social Security number, driver's license, state identification card, or passport number;
A California resident's account log-in, financial account, debit or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
A California resident's racial or ethnic origin, citizenship or immigration status;
The contents of a California resident's mail, email, and text messages unless the business is the intended recipient of the communication.

- The processing of biometric information for the purpose of uniquely identifying a California resident.

Use of Personal Information

We collect, use, and disclose Personal Information for our business purposes, including Sensitive Personal Information, to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business or commercial purposes, including the following:

Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, facilitating event management and execution, managing our real estate portfolio, or providing similar services;
Helping to ensure security and integrity to the extent the use of Personal Information is reasonably necessary and proportionate for these purposes;
Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a current interaction with us, where the information is not disclosed to a third party and is not used to build a profile or otherwise alter the California resident's experience outside the current interaction with us;
Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance that service;
Debugging to identify and repair errors that impair existing intended functionality;
Undertaking internal research for technological development and demonstration;
Complying with laws and regulations along with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes or opinions).

Use of Sensitive Personal Information

We only use or disclose Sensitive Personal Information for the following purposes consistent with CCPA Regulations:

To perform the services or provide the goods reasonably expected by an average California resident who requests those goods or services. For example, the Bank is required to ask for demographic data from an applicant as part of a mortgage loan application.
To detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted Personal Information, provided that the use of a California resident's Personal Information is reasonably necessary and proportionate for this purpose. For example, we may disclose a California resident's account information to a data security company that is hired to investigate and remediate a data incident that involved that individual's account
To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions, provided that the use of a California resident's Personal Information is reasonably necessary and proportionate for this purpose. For example, we may use information about a California resident's ethnicity and/or the contents of email messages to investigate claims of racial discrimination.
To ensure the physical safety of natural persons, provided that the use of a California resident's Personal Information is reasonably necessary and proportionate for this purpose. For example, we may disclose a California resident's account information to law enforcement, when required by law, to investigate financial elder abuse.
For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a California resident's current interaction with us.
To perform services such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying a California resident's information, processing payments, providing financing, analytic services, or storage.
To verify or maintain the quality or safety of a service or device that is owned, manufactured by, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us.

The Bank will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice, where required by law. Personal information is retained by us as determined by relevant law and internal record retention policies.

Selling or Sharing Personal Information

The Bank does not share (for cross-context behavioral advertising) nor sell any category of personal information.

Revised 9/1/2025