Notice to California Residents

This California Privacy Notice (“Notice”) supplements the Keen Bank Privacy Policy for individuals who reside in the State of California (“you”).

Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), we are required to provide California Residents with information about the personal information we collect, use, share and disclose when you use our website, mobile application and our online products and services. In addition, the CCPA provides California Residents with the right to make certain requests to us with respect to our data collection and sharing practices. Any terms defined in the CCPA have the same meaning when used in this Notice.

Keen Bank may change this Notice at any time. The most recent version of this Notice, as indicated by the date at the top of this Notice, will take effect when posted unless otherwise indicated. We will provide you with additional notice if we make material changes to this Notice.

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”). Personal Information does not include information that is publicly available information from government records, deidentified or aggregated consumer information and information that is specifically excluded from the scope of CCPA, such as personal information covered by the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA) and the Driver’s Privacy Protection Act of 1994. Accordingly, the specific Personal Information covered by the CCPA will vary based on our relationship or interaction with you.

Keen Bank does not sell Personal Information in exchange for payment. However, the CCPA defines the term “sale” in a way that includes transfers of information relating to advertising cookies. We use Google Analytics to monitor and analyze the use of our website. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our website. This data is shared with other Google services (for example, to contextualize and personalize the ads of its own advertising network). You can opt out of making your activity on our website available to Google Analytics by installing the Google Analytics opt-out browser add-on. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page.Your Rights

Right to Know and Access Personal Information Collected, Disclosed or Sold

If you are a California resident, you have the right, subject to certain exceptions under the CCPA and other applicable laws and regulations, to request that we disclose what Personal Information we have collected about you. You also have the right to receive your Personal Information in a structured and commonly used format so that it can be transferred to another entity (also known as “data portability”). This includes the right to request any or all of the following:

• Specific pieces of Personal Information that we have collected about you;
• Categories of Personal Information that we have collected about you;
• Categories of sources from which the Personal Information was collected;
• Categories of Personal Information that we sold (if applicable) or disclosed for a business purpose about you;
• Categories of third parties to whom the Personal Information was sold (if applicable) or disclosed for a business purpose, and the categories of Personal Information disclosed; and
• The business or commercial purpose for collecting or, if applicable, selling Personal Information about you.

Right to Request Deletion of Personal Information

If you are a California resident, you have the right, subject to certain exceptions under the CCPA and other applicable laws and regulations, to request that we delete the Personal Information about you that we have collected. Under the CCPA, we are not required to comply with a request to delete if it is necessary for us to maintain the Personal Information in order to, for example, complete a transaction, detect security incidents, comply with a legal obligation, or otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right to Correct Personal Information

In certain circumstances, you have the right to request that we correct any inaccurate Personal Information held by us.

Rights Regarding Sensitive Personal Information Processing

The CCPA provides rights to limit how your Sensitive Personal Information is disclosed or shared with third parties, as defined in the CCPA. We only collect and use Sensitive Personal Information for certain limited purposes, such as providing services and products, maintaining and servicing accounts, detecting and investigating security incidents and verifying customer information. Because we only use Sensitive Personal Information for legally permissible limited purposes, there is no right to limit our use for these purposes.

Right to Non-Discrimination

You have the right to be free from discrimination for exercising any of your rights under the CCPA as described in this CCPA Notice at Collection and Privacy Policy. This means you cannot be denied goods or services, charged different prices or rates, provided with a different level or quality of goods or services or retaliated against in any other way for exercising your privacy rights.

Right to Opt-Out of Sale of Personal Information

If you are a California resident, you have the right to direct us to stop selling your Personal Information.

The CCPA defines “sell” to mean selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing or by electronic or other means, a California resident’s Personal Information to another business or a third party for monetary or other valuable consideration.

You may submit a request to opt out of the sale of your Personal Information by calling us at 507.835.2740 or emailing us at privacy@keen.bank.

How to Submit a Request to Know, Access or Delete

You may submit a request to know, access or delete by calling us at 507.835.2740 or emailing us at privacy@keen.bank.

Our Process for Verifying a Request to Know or Delete

If we determine that your request is subject to an exemption or exception, we will notify you of our determination. If we determine that your request is not subject to an exemption or exception, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request. We will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty,” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized disclosure or deletion, as applicable.

For requests to access categories of Personal Information and for requests to delete Personal Information that is not sensitive and does not pose a risk of harm by unauthorized deletion, we will verify your identity to a “reasonable degree of certainty” by verifying at least two data points that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

For requests to access specific pieces of Personal Information or for requests to delete Personal Information that is sensitive and poses a risk of harm by unauthorized deletion, we will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

We will generally respond to your request(s) within 45 days, unless, for reasons beyond our control, a longer response time is necessary, in which case, you will be advised accordingly. Please note that we may retain certain information about such requests as required by law or as necessary for our legitimate business purposes.

Authorized Agents

A California resident may designate an authorized agent to make a request on behalf of the California resident by contacting us at the toll-free number or email address listed above. If you designate an authorized agent to make an access, correction, or deletion request on your behalf, we may require you to provide the authorized agent with written permission to do so and require you to verify your own identity directly with us (as described above).

An authorized agent submitting a request on behalf of a California resident must submit the request through one of the designated methods discussed above. After submitting the request, we will require additional information to verify the authority to act on behalf of the California resident.

Categories of Personal Information Collected or Disclosed

We have collected or may have disclosed the following categories of personal information about consumers for a business or commercial purpose in the preceding 12 months:

 

Sources of Personal Information

We obtain the categories of personal information listed above from the following sources:

• Directly from you
• Businesses with which we have interacted, such as on behalf of a business we provide products and services to, or otherwise in the
  business-to-business context
• Individuals authorized to act on your behalf
• Our affiliates
• Service providers
• Government agencies and other publicly available sources
• Operating systems and platforms Data analytics providers
• Credit bureaus

Use of Personal Information

We may use or disclose the personal information we collect for the following business purposes:

• To respond to inquiries and fulfill your requests
• To notify you about important information regarding products and services that you applied for or in which you are enrolled
• To verify your identity
• To prevent fraud and enhance the security of your account or our online services
• To manage your preferences
• To perform analytics of your use of our online services (e.g., the web pages and advertisements you have viewed)
• To deliver advertisements
• To internally evaluate and improve our business operations
• To comply with legal requirements, relevant contractual obligations and our internal policies
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution or other sale of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation or similar proceeding, in which personal information is held by us among the assets transferred.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

Categories of Personal Information Sold

We have not sold personal information in the preceding 12 months.

Questions or Concerns about the Privacy Notice for California Residents

If you have any questions or comments about this Notice, the ways we collect and use your personal information, your choices and rights regarding such use or you wish to exercise your rights under California law, you may call us at 507.835.2740 or email us at privacy@keen.bank.