CALIFORNIA CONSUMER PRIVACY ACT DISCLOSURE
(CCPA DISCLOSURE)

Effective Date: August 1, 2023

At SchoolsFirst Federal Credit Union ("SchoolsFirst FCU," "Credit Union," "we," "our," "us"), your privacy is important to us. This California Consumer Privacy Act Disclosure ("Privacy Disclosure") explains how we, including our wholly-owned affiliates, SchoolsFirst Insurance Services, LLC and SchoolsFirst Plan Administration, LLC ("CUSOs"), collect, disclose, use and retain your personal information through your online and offline interactions with us.

For California residents, this Privacy Disclosure is adopted under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"). The purpose of the CCPA is to give California consumers the rights to have more control over the use of the personal information that businesses collect about them.

What is personal information under CCPA?

Personal information is information that identifies, relates to, or could reasonably be linked with a particular consumer or household. For example, it could include a consumer's name, email address, records of transaction activity, internet browsing history, geolocation data or fingerprints.

The CCPA, however, does not apply to all personal information collected by us, such as information subject to the Gramm-Leach-Bliley Act ("GLBA"). As a result, THIS DISCLOSURE DOES NOT APPLY TO NONPUBLIC PERSONAL INFORMATION THAT WE COLLECT FROM OUR MEMBERS, CUSO AND PAYROLL CARD CLIENTS, IN CONNECTION WITH PROVIDING FINANCIAL PRODUCTS OR SERVICES FOR PERSONAL PURPOSES.

Categories of Personal Information We Collect

Identifiers — A real name or alias; home or postal address; signature; home or mobile phone number; bank account number, credit card number, debit card number, employee ID number or other financial information; physical characteristics or description; email address; account name; Social Security number; driver's license number or state identification card number; passport number; or other similar identifiers.
Characteristics of a Protected Class — Age, race, color, citizenship or disability status.
Commercial Information — Records of personal property, products or services purchased.
Biometric Information — Identifying information, such as fingerprints or data collected for timekeeping or security purposes.
Internet or Other Similar Network Activity — Browsing history, search history, information about a consumer's interaction with a website.
Geolocation Data — Information used to identify your physical location in relation to a branch or ATM.
Sensory Data Audio — Electronic, visual, thermal, olfactory or similar information.
Employment and Professional Information — Job title, job email address, business affiliation, work history, performance evaluations, education, skills and other employment-related details.
Inferences Drawn From Other Personal Information — Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes.
Sensitive Personal Information — Information that reveals your Social Security and driver's license numbers; account log-in information, account number in combination with required access code or password; credentials allowing access to an account; or a consumer's precise geolocation. We do not use or disclose your sensitive personal information for any purpose other than what is permitted by law.

Categories of Sources of Personal Information We Collect

From You or Your Authorized Agent — We may collect information directly from you or your authorized agent (i.e., a person that has been legally granted the rights to act on your behalf). For example, when you provide us your name and Social Security number to open an account and become a Member, CUSO client or payroll cardholder.
From Our Website and Applications That You Access On Your Device — We collect certain information from your activity on our website (schoolsfirstfcu.org) and mobile application.
From Our Service Providers — We collect information from third-party service providers in connection with the services we perform for our operational purposes.

How We Use Your Personal Information

To provide you with information, products or services that you request from us.
Advertising our products and services to you.
To provide you with email alerts, event registrations, or other notices concerning our products or services, events or news that may be of interest to you.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
For testing, research and analysis to improve our products and services and for developing new ones.
To protect the rights, property or safety of us, our employees, Members, CUSO clients, payroll cardholders or others.
To conduct employment-related activities, including payroll, benefits administration and performance evaluations.
To facilitate business-to-business transactions and communications.
To detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, and prosecute those responsible for that activity.
To respond to law enforcement requests and as required by applicable law, court order or governmental regulations.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, in which personal information held by us is among the assets transferred.
As described to you, when collecting your personal information.

Categories of Third Parties to Whom We Disclose Information

Our third-party service providers;
Our affiliates for their everyday business purposes — information about your transaction experiences;
Other companies to bring you co-branded services, products or programs; and
Other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third-parties.

Selling and Sharing Personal Information

We do not sell your information.
We do not share your personal information for cross-context behavioral advertising.
We do not offer an opt-out from the sale or sharing of personal information because we do not engage in the sale or sharing of your personal information for cross-context behavioral advertising.

Retention of Personal Information

We will retain your personal information only for as long as necessary to achieve the disclosed business purposes. We will determine the specific retention period depending on applicable legal requirements and the sensitivity of the information.

Rights and Choices for California Residents

California residents have certain rights under the California Consumer Privacy Act regarding their applicable personal information, including:

The right to request the specific pieces of personal information we collected about you; the categories of personal information we collected; the categories of sources used to collect the personal information; the business or commercial purposes for collecting your personal information; and the categories of third parties with whom we share your personal information as they pertain to our activities.
The right to request deletion of your personal information that we collected;
The right to request correction of your personal information that we collected;
The right to have someone you authorize make a request on your behalf; and
The right not to be discriminated against for exercising any of these rights.

Submitting a Request to Know, Delete or Correct

To submit a request to know, delete or correct your personal information we have collected about you, you or your authorized agent may submit a verifiable consumer request to us by either method below:

An online request — Click on the following link CCPA Request, and follow the instructions.
A request by phone — Call us at (888) 862-8328.

To process your request(s), we are required to verify your identity and, if applicable, the identity and authority of your authorized agent. We are also required to confirm your request and may do so by reaching out to you using the contact information you provided on your request.

If we receive a request through an authorized agent, we will require written proof or other legal documents with permission for the authorized agent to act on your behalf.

We will work to process all verified requests within 45 days pursuant to the CCPA. If we need an extension for up to an additional 45 days to process your request, we will provide you with an explanation for the delay. We will notify you of the results of your request. If applicable, our response will also explain why we cannot comply with a request.

Submitting a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity and authority to make the request.
We do not charge a fee to process or respond to your verifiable consumer request.

Changes to this Disclosure

This Privacy Disclosure is subject to change at any time. Please review it periodically. We will revise the "Effective Date" stated at the top of this disclosure at the time any material changes are made. Any changes will become effective when posted unless indicated otherwise.

Contact Us

If you have any questions regarding this Privacy Disclosure call us at (800) 462‐8328 or write to us at:

SchoolsFirst FCU
P.O. Box 11547
Santa Ana, CA 92711‐1547

CALIFORNIA CONSUMER PRIVACY ACT DISCLOSURE (CCPA DISCLOSURE)