Disclosures

We take your privacy seriously and work hard to help protect your personal information. The RiverBank Digital Privacy Policy (“Policy”) describes how RiverBank and our affiliates manage personal information about you when you interact with us using our digital services online through our websites, online banking, mobile applications and social media sites through your computer, smartphone, tablet, or other mobile devices.

This policy explains

• How we collect personal information when you visit, use, or interact with us online, and through our ads displayed through digital services.
• How we may use or share personal information collected to deliver products and services to you and for advertising purposes.

The term "RiverBank" or “Bank,” "we", "us" or "our" in this Policy refers to banking and its affiliate, RiverBank Holding Company, that link to or reference this Policy. “You”, “Your”, “User”, “Customer”, and other similar terms means, with respect to online Digital Services and an individual Account, each person who has an interest in or authority to transact business in such Account and, with respect to an entity Account, the person designated as the Company System Administrator (Administrator) on the Business Enrollment Form for such Account and any other person authorized by the Administrator to transact business with respect to such Account. “Account” or “Accounts” means your accounts at Bank.

By interacting with us through our digital services, websites, online banking, mobile applications, and social media sites, you agree to the terms and conditions of this Policy. RiverBank works with third party providers who are contractually obligated to comply with our policies to protect information. However, if you visit or access one of these third-party provider sites or mobile apps, please review the online privacy practices of that site or mobile app to understand the specifics of how your online personal information may be collected, used, and shared.

Updates to this Policy

This policy is subject to change. We update this policy periodically to comply with the most recent federal and local laws. Please review it whenever you have questions.

Online Privacy Practices

We value your privacy and work hard to help protect your personal information. We ask for your consent when required, otherwise by interacting with us online through our websites, online banking, mobile applications, and social media sites, you consent to the collection, use and sharing of your personal information subject to and consistent with applicable laws and other notices you may have received based on your relationship with us.

Linking to non-affiliated third-party sites

We may provide links to non-affiliated third-party sites, such as credit bureaus, service providers or merchants. If you follow links to sites not affiliated with, or controlled by RiverBank, you should review their privacy and security policies and other terms and conditions, as they may be different from those of our Sites and Mobile Apps. RiverBank does not guarantee and is not responsible for the privacy or security of these sites, including the accuracy, completeness or reliability of information shared on those sites.

How we help protect your personal information

To protect personal information from unauthorized access and use, we use security measures that comply with applicable federal and state laws. These measures may include device safeguards and secured files and buildings as well as oversight of our third-party providers to ensure personal information remains secure and confidential. In accordance with applicable laws, in the event of a data breach, we will provide timely notification.

We also recognize the importance of protecting privacy where children are involved. Our Sites and Mobile Apps are not marketed to individuals under the age of 13, and we request that these individuals do not provide personal information through our Sites and Mobile Apps. We do not knowingly collect personal information from children under the age of 13.

Maintaining accurate personal information

Keeping your personal information accurate and up to date is very important. If your personal information is incomplete, inaccurate, or not current, please contact us and we will be happy to update your information.

Personal information we collect online

We may collect personal information about you through your computer or mobile devices by the use of cookies and similar tracking technologies as well as personal information you provide when you visit or use our Sites and Mobile Apps.

Examples of when we may collect personal information are when you:

• Apply for or open a new account
• Apply for or open a new loan
• Apply for online banking services
• Apply for digital services

We may use third party providers to process personal information for business purposes on our behalf. Third party providers are contractually obligated to comply with our policies to protect information we share with them, or they collect on our behalf.

The personal information we collect is limited to what is required to provide our products or services and to support legal and risk requirements. For additional information, please review the How we use your personal information section of this Policy.

Types of personal information we collect online

The type of personal information we collect from and about you online will depend on how you interact with us and may include:

• Personal identifiers such as social security number, account number(s), driver's license number (or comparable) or other information that identifies you for ordinary business purposes Contact Information such as name, mailing address, email address, telephone, and mobile number(s)
• Account Application information such as credit and income information
• User Access Authorization such as online banking login ID, alias, password, secure access codes, security questions and answers
• Information from your computer and mobile devices when allowed by individual browsers and/or operating systems, such as:
  • Unique device identifiers such as IP addresses
  • Browser type, version, language, and display/screen settings
  • Information about how you use and interact with our Sites and Mobile Apps
  • Responses to marketing advertisements on sites and mobile apps where we advertise
  • Geolocation information with consent (for example, branch location finder)

How we use your personal information

Personal information collected from and about you online described in this Policy may be used for many purposes such as:

• Complying with and enforcing applicable legal requirements, industry standards, contractual obligations, and our policies
• Delivering products and services to you by verifying your identity.
  • For Example: when you access your account information online or via our mobile app; processing applications for products or services such as to apply for an account, apply for a credit card, digital service, financial product, or processing transactions.
• Performing analytics concerning your use of our online services, including your responses to our emails and the pages and marketing advertisements you view
• Marketing and Advertising on our Sites and Mobile Apps as well as affiliated and non-affiliated third-party sites and through off-line channels like email, mail, and phone
• Fraud Prevention and Detection, identify theft and other risks to you or RiverBank
• Providing notifications concerning security and opt-in alerts for which you have signed-up to receive, providing analysis to enhance our overall effectiveness as well as enhancing products and services

As required by laws and regulations and the necessary business purposes, we retain personal information for a period of time. As soon as legally permitted, RiverBank securely deletes personal information previously used.

How your personal information may be shared

We may share the personal information we collect from and about you online described in this Policy and subject to other legal restrictions/notices you may have received depending on your relationship with us with:

• Regulatory/Government Agencies as required by laws and regulations
• Third Party Providers who have contracts with RiverBank

Third party information and data sharing

Companies/third parties may offer aggregation websites and services that allow you to share your information and data with them to aggregate your account information from multiple sites or sources (including your accounts with RiverBank or with other financial institutions) into one primary platform. To do this, a company/third party may request that you authorize access to your RiverBank accounts by providing your RiverBank online banking login ID and password.

How we respond to Do Not Track Signals

We do not take action in response to a "do not track" configuration set in your web browser.

Things to know when authorizing information and data sharing via aggregation

• RiverBank is not responsible for the use or disclosure of any personal information accessed by any company/third party or person to whom you provide your RiverBank online banking login ID and password
• Use of your information by the company/third party is subject to the terms and conditions governed by your agreement with them, not by RiverBank
• The company/third party may request access, on your behalf, information about yourself, your RiverBank relationship, and your accounts at RiverBank
• You should use caution and ensure that the company/third party has established security policies and practices to protect the privacy and security of all personal information you provide or to which they are gaining access
• Should you choose to share your RiverBank online banking login ID, password, or other information about your accounts with other companies/third parties, RiverBank will consider that you have authorized any transaction or action initiated by using the access information you provide
• If you decide to revoke the authorization previously provided to a company/third party, RiverBank strongly recommends that you change your RiverBank online banking login ID and password to ensure that the company/third party no longer has access to your account information

Miscellaneous information and data sharing permissions that we may request

• Access to your Camera for access to CheckSnap via our mobile check deposit service
• Access to your Location for bank Branch location services
• Access to external storage for Secure Message Attachments or Statement downloads
• Access to Phone State that allows access to information about your device for identification purposes

Unlawful Internet Gambling Enforcement Act (UIGEA) of 2006

The UIGEA, signed into law in 2006, prohibits any person engaged in the business of betting or wagering (as defined in the Act) from knowingly accepting payments in connection with the participation of another person in unlawful internet gambling. The Department of Treasury and the Federal Reserve Board have issued a joint final rule, Regulation GG, to implement this Act.

As defined in Regulation GG, unlawful internet gambling means to "place, receive or otherwise knowingly transmit a bet or wager by any means which involves the use, at least in part, of the internet where such bet or wager is unlawful under any applicable Federal or State law in the State or Tribal lands in which the bet or wager is initiated, received or otherwise made".

As a customer of RiverBank, you agree that such transactions will not be conducted through your account, and that you will notify the Bank should your account be used for internet gambling of any kind. Please be advised that should the Bank discover your account is being used for such restricted transactions, we may terminate your access to certain payment systems and/or close your account.

Please see one of our Bankers if you would like additional information on UIGEA or Regulation GG.

This message is to inform you about amendments to Visa's operating rules regarding non-Visa debit transactions*. Visa has requested that we inform you annually of the following information:

Your RiverBank Visa-branded debit card is enabled for non-Visa debit transactions, which means your card may be used for debit transactions without a Personal Identification Number (PIN). These types of transactions are enabled on the STAR Network, a PIN-Debit Network**. This network is not a Visa network.

Through the STAR Network, it may be possible to process a non-VISA debit transaction with certain merchants without the use of a PIN. These types of transactions are usually conducted by telephone, through the Internet, or at kiosk locations.

STAR Network merchants are required to display the STAR logo. STAR Network merchants must also allow you to choose how your payment is directed. Thus, you could see the STAR logo and choose to direct your payment through the STAR Network. In addition, STAR Bill Payments are not authenticated with a PIN; instead, the merchant authenticates your identity using known information derived from an existing relationship with you. When you conduct a PIN-less non-Visa network, the cardholder provisions specific to Visa transactions (such as the Visa zero-liability program) do not apply.

RiverBank's Visa-branded debit card can also be used in the VISA Network. To initiate a payment, you must select a payment option that sends your transaction over the Visa network. Examples of the type of actions you may be required to make to initiate a Visa transaction on a Visa-branded debit card include signing a receipt, providing a card number over the phone or via the Internet, or swiping the card through a point-of-sale terminal.

*Non-Visa Debit Transaction-(effective July 1, 2008), an act between a Visa Check Card or Visa Debit Card Cardholder and a merchant that results in the generation of a transaction on a PIN-Debit Network.

**PIN-Debit Network-(effective July 1, 2008), a non-Visa debit network that typically authenticates transactions by use of a PIN that is not generally known as, marketed as, or enabled as a competitive general-purpose card program, or other prohibited payment program, either directly or through a joint acceptance agreement.