Know your rights under the California Consumer Privacy Act.

If you are a California resident, you have the following rights under the CCPA:

1. The right to know what personal information we have collected about you, including:
   • a. The categories of personal information we have collected;
   • b. The categories of sources from which the personal information is collected;
   • c. The business or commercial purpose(s) for collecting, selling, or sharing your personal information; and
   • d. The specific pieces of personal information that we have collected about you;
2. The right to delete personal information that we have collected from you, subject to some exceptions;
3. The right to correct inaccurate personal information that we maintain about you;
4. If we sell or share your personal information with third parties, the right to opt-out of the sale or sharing of your personal information by the Credit Union;
5. If we use or disclose your sensitive personal information other than for reasons set forth in Section 7027(m) of the Regulations implementing the CCPA, you have the right to limit our use or disclosure of your sensitive personal information; and
6. The right not to receive discriminatory treatment by the Credit Union for the exercise of privacy rights conferred by the CCPA, including an employee’s, applicant’s or independent contractor’s right not to be retaliated against for the exercise of their CCPA rights.

However, as a financial institution, the CCPA is not applicable if the information we collect, share, or sell is subject to the federal Gramm-Leach-Bliley Act and its implementing regulations and/or the California Financial Information Privacy Act. Generally speaking, this means that we are not required to comply with the CCPA if the information we collected is information that:

1. You provided to us to obtain a product or service from the Credit Union;
2. We collected about you resulting from any transaction involving a product or service between you and the Credit Union; or
3. The Credit Union otherwise obtained about you in connection with providing a product or service to you.

Nevertheless, the Credit Union takes the privacy and security of your personal information seriously and, even though the CCPA may not be applicable to us in most cases, we will honor your rights described in this CCPA Privacy Policy except in the event of a conflict with applicable state or federal law, another exception to the CCPA applies, or complying with your request would be impossible or require disproportionate effort.

The Categories of Personal Information That We Have Collected About California Consumers in the Preceding 12 Months

The Categories of Sources From Which We Collect Personal Information About California Consumers

We obtain the categories of personal information listed in the Table above from the following categories of sources:

Directly from you. For example, from forms you complete, when you perform transactions, or when you purchase products or services.

Indirectly from you. For example, from observing your actions on our Website, when you use your debit or credit card, when you make deposits or withdrawals to/from your accounts, or when you pay your bills.

From third parties. We also receive information from third parties, such as credit reporting agencies, government agencies, law enforcement authorities, or service providers.

The Specific Business or Commercial Purposes for Which We Collect Personal Information About California Consumers

To fulfill or meet the reason the consumer provided the information. For example, if you share your name and contact information with us to request a rate quote, to ask a question about our products or services, or to process a transaction, we will use that personal information to respond to your request or question and to process your transactions, accordingly. We may also save your information to facilitate new transactions in the future. We also use your information for customer service and collections purposes and for ongoing account maintenance purposes, such as providing account statements, providing access to online banking, and providing account notifications.

• To offer products and/or services that we believe may be of interest.
• To provide, support, personalize, and develop our website, products, and services.
• To create, maintain, customize, and secure accounts with us.
• To process requests, purchases, transactions, and payments, and to prevent transactional fraud.
• To provide support and to respond to inquiries, including to investigate and address concerns and monitor and improve our responses.
• To help maintain the safety, security, and integrity of our Website, our products and services, our databases and other technology assets, and the Credit Union.
• To prevent fraud by monitoring activity to detect, investigate, and prevent potentially fraudulent transactions and other illegal activities, as well as to protect the rights and property of the Credit Union and our members.
• For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described when we collect personal information or as otherwise set forth in the CCPA.
• For our business purposes, such as to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a liquidation or similar proceeding, in which personal information held by us about our members and Website users/consumers is among the assets transferred.
• To support our operations and to comply with applicable legal or regulatory requirements.
• To communicate with consumers via any means (including email, telephone, text message, or in person) about products, services, and events offered by the Credit Union and others, as well as to provide news and information we think will be of interest.
• To respond to consumers’ comments, questions, and customer service requests, as well as to send members support notices, updates, security alerts, and administrative messages (such as changes to our terms, conditions, and policies).
• To monitor and analyze trends, usage, and activities in connection with our products and services.
• To audit the quality and efficacy of our work for compliance, controls, and other risk management.
• To improve our products and services by identifying issues with existing products and services, enhancing existing products and services, and creating new products and services.
• To personalize website experiences and to deliver content and product and service offerings relevant to consumer’s interests, including targeted offers and ads through our website, third-party sites, and via email or text message (with consent, where required by law).
• We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

The Categories of Personal Information, if Any, That We Have Sold or Shared to Third Parties in the Preceding 12 Months

Please note that the CCPA defines “selling” and “sharing" personal information differently than you might expect. Under the CCPA, (1) “selling” and “sharing” personal information means selling or sharing personal information to a “third party” and (2) the term “third party” does not include our service providers or contractors when we have a written contract in place with such service providers or contractors that meets certain requirements set forth in the CCPA. This means that our service providers and contractors are not considered “third parties” for CCPA purposes.

With the above in mind, we have not sold or shared consumers’ personal information with third parties (other than our service providers or contractors) in the previous 12 months.

The Categories of Personal Information, if Any, That We Have Disclosed for a Business Purpose to Third Parties in the Preceding 12 Months

We have not disclosed consumer’s personal information to third parties (other than our service providers or contractors) for a business purpose in the preceding 12 months.

Additional Required Disclosures We Are Required to Make to You

Under the CCPA

We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age. The Credit Union does not use or disclose sensitive personal information for purposes other than specified in Section 7027(m) of the CCPA Regulations.

An Explanation of How You Can Exercise Your Rights and What to Expect from the Process

How to Submit a Request:

You can exercise your rights under the CCPA by:

Emailing us at: [email protected]; or
Calling us at 800.944.2200; or

Writing to us at:
First City Credit Union
P.O. Box 93727
Pasadena, CA 91109-3727
Attention: Compliance

For All Requests, You Must Provide the Following Information:

To submit a request to know the information we have collected about you, to request that we delete information we have about you, or to request that we correct information we have that you believe is inaccurate, you must provide the following information to us:

• Your full name
• Any alias or other name you may have used with us;
• Your address;
• How you have interacted with us (i.e., as a member or if you are not a member, explain how you interacted with us);
• Any other information you feel will help us identify any records we have collected about you.

Please also see the sections below for additional information.

Requests to Delete:

In addition to the general information, you must provide in connection with your request (see “For All Requests, You Must Provide the Following Information” above), to request that information be deleted, you must identify the information you would like us to delete.

If we cannot verify your identity, we may deny the request to delete. We will inform you that your identity cannot be verified.

As set forth in the CCPA regulations, we will comply with a verified request to delete your personal information by:

1. Permanently and completely erasing the personal information on from our existing systems with the exception of archived or back-up systems, deidentifying the personal information, or aggregating your information;
2. Notifying our service providers or contractors to delete your personal information from their records which they collected pursuant to their written contract with us, or if enabled to do so by the service provider or contractor, we will delete the personal information that the service provider or contractor collected pursuant to their written contract with us; and
3. Notifying all third parties to whom we have sold or shared the personal information (if applicable) to delete your personal information unless this proves impossible or involves disproportionate effort.

If we, a service provider, or a contractor stores any personal information on archived or backup systems, we/it may delay compliance with your request to delete, with respect to data stored on the archived or backup system, until the archived or backup system relating to that data is restored to an active system or is next accessed or used for a sale, disclosure, or commercial purpose.

In responding to a request to delete, we will inform you whether or not we have complied with your request. We will maintain a record of the request as required by regulation. We, our service providers, contractors, or third parties may retain a record of the request for the purpose of ensuring that your personal information remains deleted.

In cases where we deny your request to delete in whole or in part, we will do all of the following:

1. Provide you with a detailed explanation of the basis for the denial, including any conflict with federal or state law, or exception to the CCPA, or factual basis for contending that compliance would be impossible or involve disproportionate effort, unless prohibited from doing so by law;
2. Delete your personal information that is not subject to the exception;
3. Not use your personal information retained for any other purpose than provided for by that exception; and
4. Instruct our service providers and contractors to delete your personal information that is not subject to the exception and to not use your personal information retained for any purpose other than the purpose provided for by that exception.

In responding to a request to delete, we may present you with the choice to delete select portions of your personal information as long as a single option to delete all personal information is also offered and more prominently presented than the other choices. If we provide California consumers the ability to delete select categories of personal information (e.g., purchase history, browsing history, voice recordings) in other contexts, however, we must inform you of your ability to do so and direct you how you can do so.

Requests to Correct:

In addition to the general information, you must provide in connection with your request (see “For All Requests, You Must Provide the Following Information” above), to request that information be corrected, you must identify the information you would like us to correct.

If we cannot verify your identity, we may deny the request to correct. We will inform you that your identity cannot be verified.

In determining the accuracy of the personal information that is the subject of your request to correct, we will consider the totality of the circumstances relating to the contested personal information. We may deny your request to correct if we determine that the contested personal information is more likely than not accurate based on the totality of the circumstances. Considering the totality of the circumstances includes, but is not limited to, considering:

1. The nature of the personal information (e.g., whether it is objective, subjective, unstructured, sensitive, etc.);
2. How we obtained the contested information; and
3. Documentation relating to the accuracy of the information whether provided by you, available to us, or obtained via another source.

If we are not the source of the personal information and we have no documentation to support of the accuracy of the information, your assertion of inaccuracy may be sufficient to establish that the personal information is inaccurate.

If we comply with your request to correct, we will correct the personal information at issue on our existing systems and implement measures to ensure that the information remains corrected. We will also instruct our service providers and contractors that maintain the personal information at issue pursuant to their written contract with us to make the necessary corrections in their respective systems. Service providers and contractors must comply with our instructions to correct the personal information or enable us to make the corrections and must also ensure that the information remains corrected.

If we, a service provider, or a contractor store any personal information that is the subject of your request to correct on archived or backup systems, we/it may delay compliance with your request to correct, with respect to data stored on the archived or backup system, until the archived or backup system relating to that data is restored to an active system or is next accessed or used.

We will accept, review, and consider any documentation that you provide in connection with your request to correct whether provided voluntarily or as required by us. You should make a good-faith effort to provide us with all necessary information available at the time of your request.

We may require you to provide documentation if necessary to rebut our own documentation that the personal information is accurate. In determining the necessity of the documentation requested, we will consider the following:

1. The nature of the personal information at issue (e.g., whether it is objective, subjective, unstructured, sensitive, etc.).
2. The nature of the documentation upon which we consider the personal information to be accurate (e.g., whether the documentation is from a trusted source, whether the documentation is verifiable, etc.)
3. The purpose for which we collect, maintain, or use the personal information. For example, if the personal information is essential to the functioning of the Credit Union, we may require more documentation.
4. The impact on you. For example, if the personal information has a negative impact on you, we may require less documentation.

Any documentation provided by you in connection with your request to correct shall only be used and/or maintained by us for the purpose of correcting your personal information and to comply with the record-keeping obligations under the CCPA regulations.

We will implement and maintain reasonable security procedures and practices in maintaining any documentation relating to your request to correct.

We may delete the contested personal information as an alternative to correcting the information if the deletion of the personal information does not negatively impact you, or if you consent to the deletion. For example, if deleting instead of correcting inaccurate personal information would make it harder for you to obtain a job, housing, credit, education, or other type of opportunity, we will process the request to correct or obtain your consent to delete the information.

In responding to a request to correct, we will inform you whether or not we have complied with your request. If we deny your request to correct in whole or in part, we will do the following:

1. Explain the basis for the denial, including any conflict with federal or state law, exception to the CCPA, inadequacy in the required documentation, or contention that compliance proves impossible or involves disproportionate effort.
2. If we claim that complying with your request to correct would be impossible or would involve disproportionate effort, we will provide you with a detailed explanation that includes enough facts to give you a meaningful understanding as to why we cannot comply with the request. We will not simply state that it is impossible or would require disproportionate effort.
3. If we deny your request to correct personal information collected and analyzed concerning your health, you may provide a written statement to us to be made part of your record per Civil Code section 1798.185, subdivision (a)(8)(D). The written statement is limited to 250 words per alleged inaccurate piece of personal information and you must request that the statement be made part of your record. Upon receipt of such a statement, we will include it with your record and make it available to any person with whom we disclose, share, or sell the personal information that is the subject of the request to correct.

If the personal information at issue can be deleted pursuant to a request to delete, you can make a request to delete the personal information. See “How to Submit a Request,” “For All Requests, You Must Provide the Following Information”,” and “Requests to Delete” above.

We may deny your request to correct if we have denied your request to correct the same alleged inaccuracy within the past six months of receiving the request. However, we must treat the request to correct as new if you provide new or additional documentation to prove that the information at issue is inaccurate.

We may deny a request to correct if we have a good-faith, reasonable, and documented belief that a request to correct is fraudulent or abusive. We will inform you that we will not comply with the request and will provide an explanation why we believe the request is fraudulent or abusive.

Where we are not the source of the information that you contend is inaccurate, in addition to processing your request, we may, but we are not required to, provide you with the name of the source from which we received the alleged inaccurate information.

Upon request, we will disclose all the specific pieces of personal information that we maintain and have collected about you to allow you to confirm that we have corrected the inaccurate information that was the subject of your request to correct. This disclosure will not be considered a response to a request to know that is counted towards the limitation of two requests within a 12-month period as set forth in Civil Code section 1798.130, subdivision (b). With regard to a correction to your Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics, we will not disclose this information, but we may provide a way to confirm that the personal information we maintain is the same as what you have provided.

The Following is a General Description of the Process We Use to Verify Your Identity When Submitting a Request to Know, a Request to Delete, or a Request to Correct:

By law and regulation, we are required to positively verify your identity prior to responding to your requests.

You will need to provide a valid identification card (i.e., a state-issued driver’s license, ID card, or US or other government-issued passport) plus the address portion of a utility bill, bank, investment, or credit card statement (number redacted) that contains the name and address that matches your ID and information request.

If making a request by phone, we may require you to answer specific questions based on information we have or can obtain about you or we may ask you to otherwise verify your identity.

If you are requesting to know specific pieces of information, a higher degree of verification may be required. We will also require, pursuant to CCPA regulations, that you submit a signed declaration under penalty of perjury that you are the consumer to whom the information relates.

If we are unable to positively identify the person making the request is the consumer to whom the information relates, we may ask for additional verification or we may deny the request.

If you use an authorized agent to submit a request to know information under CCPA, you must verify your own identity with us and provide the agent written permission to submit the request on your behalf unless the agent holds a valid Power of Attorney or Conservatorship of the Person or the Estate for you. An agent’s failure to provide proof of authorization will result in a denial of the request.

Your Rights to Opt-Out and to Limit Use or Sharing of your Sensitive Personal Information

The CCPA gives you the right to tell us not to sell or share your personal information with third parties by opting-out of such information sales or sharing. However, the CCPA also states that we are not required to provide you with the right to opt-out if we only sell or share your personal information with our service providers or contractors pursuant to a written contract that meets specific requirements, such as the requirement that we only sell or share your personal information to the extent that is reasonably necessary for the service provider or contractor to carry-out the contracted for business purpose and provided that the service provider or contractor agrees only to use your personal information for that purpose. You do not have the right to opt-out because we do not sell or share your personal information outside of an exception that allows us to do so.

In addition, the CCPA gives you the right to limit our use or sharing of your sensitive personal information. However, the CCPA also states that we are not required to provide you with the right to limit our use or sharing of your sensitive personal information so long as we only share it for the specific purposes set forth in Section 7027(m) of the regulations implementing the California Privacy Rights Act. We are not required to provide you with the right to limit our use or disclosure of your sensitive personal information because we only use or disclose such sensitive personal information for the following purpose(s):

1. To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. For example, a consumer’s precise geolocation may be used by a mobile application that is providing the consumer with directions on how to get to specific location. A consumer’s precise geolocation may not, however, be used by a gaming application where the average consumer would not expect the application to need this piece of sensitive personal information.
2. To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose. For example, a business may disclose a consumer’s log-in information to a data security company that it has hired to investigate and remediate a data breach that involved that consumer’s account.
3. To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose. For example, a business may use information about a consumer’s ethnicity and/or the contents of email and text messages to investigate claims of racial discrimination or hate speech.
4. To ensure the physical safety of natural persons, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose. For example, a business may disclose a consumer’s geolocation information to law enforcement to investigate an alleged kidnapping.
5. For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business. For example, a business that sells religious books can use information about its customers’ interest in its religious content to serve contextual advertising for other kinds of religious merchandise within its store or on its website, so long as the business does not use sensitive personal information to create a profile about an individual consumer or disclose personal information that reveals consumers’ religious beliefs to third parties.
6. To perform services on behalf of the business, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose. For example, a business may use information for maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
7. To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by the business, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose. For example, a car rental business may use a consumer’s driver’s license for the purpose of testing that its internal text recognition software accurately captures license information used in car rental transactions.
8. For purposes that do not infer characteristics about the consumer. For example, a business that includes a search box on their website by which consumers can search for articles related to their health condition may use the information provided by the consumer for the purpose of providing the search feature without inferring characteristics about the consumer.

Questions or Concerns?

If you have questions or concerns about this Privacy Policy, you may contact us by:

Email: [email protected]

Phone: (800) 944 - 2200

Mail:
First City Credit Union
P.O. Box 93727
Pasadena, CA 91109-3727
Attention: Compliance

Online Mobile Banking Privacy Policy

Effective Date: October 1, 2025

First City Credit Union (“the Credit Union”, “we”, “our”, “us”) respects your right to privacy and understands the importance of maintaining the security of your personal information. This Online Privacy Policy (“Policy”) relates to the information we collect online through our website https://www.firstcitycu.org/,Online Banking, and Mobile Banking apps for both Apple® and Android™ platforms.

Information We Collect About You

When you visit our website, you may be asked to provide personal information (“Personal Information”), including but not limited to:
- First and last name
- Home or physical address
- Email address
- Telephone number
- Tax identification number
- Any other identifier that permits physical or online contact with you

We may also collect and store information about your visit, such as:
- IP address
- Browser and operating system type
- Date and time of access
- Referring website
- Pages visited and information requested

Accessing your account via Online Banking may allow us to personalize your experience by storing relevant information such as your name, branch of record, and site preferences via cookies.

How This Information Is Collected

We collect personal and session information when you:
- Visit our websites
- Access Online or Mobile Banking
- Interact with our content on social media or via email
- Schedule appointments
- View online videos
- Apply for accounts or services
- Enter contests or sweepstakes
- Contact us with inquiries

How This Information Is Used

We use your personal information, as permitted by law, to:
- Personalize your experience
- Verify your identity
- Prevent fraud and ensure account security
- Process transactions
- Communicate with you
- Manage preferences
- Provide advertisements about our products and services
- Perform analytics
- Administer and improve our digital platforms
- Comply with legal and contractual obligations

We retain personal information only as long as required by law or necessary for business purposes.

Cookies and “Do Not Track” Mechanisms

We use necessary browser cookies to analyze usage patterns, enhance security, and personalize your experience. We do not use cookies to track or sell information. You may set your browser to notify you when cookies are set, block them, or enable “Do Not Track” signals. Blocking cookies may affect functionality of Online Banking and other services.

Third-Party Sharing

We disclose personal information only as permitted by law, such as:
- To service providers acting on our behalf
- To credit reporting agencies
- In response to legal processes
- To prevent fraud or as part of audits

We do not sell personal information or track your activities across third-party websites.

Protecting Your Information

We maintain physical, electronic, and procedural safeguards that comply with federal standards to protect your personal information.

Children’s Online Privacy Protection Act (COPPA) Disclosure

Our website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that such information has been collected, we will delete it promptly.

We may provide contest information for youth members, but children under 13 will not be permitted to submit personal information. We may collect non-personal data (e.g., domain names, visit times, page views) to improve our site, but this does not include identifiable information.

For more information about COPPA, visit the Federal Trade Commission’s website: https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions

Third-Party Website Links

Our website may contain links to third-party websites. These sites have their own privacy and security policies. Please review them before providing any personal information.

Policy Updates

This Policy may be updated periodically. Changes will be posted with a revised effective date. Continued use of our site after changes means you accept the updated Policy.

Reviewing and Updating Your Information

You may review and update your personal information by logging into Online or Mobile Banking or contacting us directly at:
- Phone: 800-944-2200
- Address: First City Credit Union, P.O. Box 93727 Pasadena CA 91109-3727
- Email: [email protected]
- In person: Visit any branch location

Reg P GLBA Privacy Policy