California Consumer Privacy Policy

WHAT PERSONAL INFORMATION IS COVERED?

Personal information means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked with a particular consumer or household. Examples include social security numbers, account information, transaction histories, credit information, and biometric data.

WHAT PERSONAL INFORMATION IS NOT COVERED?

Financial institutions, such as Bank of the West, a trade name used by BMO Harris Bank N.A., and BancWest Investment Services, Inc., a subsidiary of BMO Harris Bank N.A., (collectively “the Bank,” “we,” “us,” “our”), are subject to certain laws and regulations that govern how we may collect, use, and disclose personal information, including the federal Gramm-Leach-Bliley Act (“GLBA”). The CCPA does not apply to personal information collected, processed, sold, or disclosed pursuant to the GLBA. The personal information of California residents we collect, process, or disclose pursuant to this Policy does not include (i) publicly available information, (ii) de-identified or aggregate consumer information, (iii) information excluded from the CCPA’s scope, such as GLBA personal information, and (iv) personal information collected for a single, one-time transaction in the ordinary course of business, and not retained.

The categories of personal information we collect depend on the product or service you have with us, and your use of our websites and services. Over the past 12 months and on an ongoing basis, the information we have collected and may collect includes:

• Directly from you. For example, when you use our products or services (through in-person interactions at a branch, electronically, or over the phone). Please refer to our CCPA Disclosure for more information.
• From third parties. From time to time, we receive personal information from third parties, like our business partners, vendors, and other entities, who are authorized to disclose certain personal information to us.
• Our websites and mobile apps. We collect certain personal information when customers visit our banking website(s) or use our banking mobile application(s). Please refer to our Online Privacy Notice for further information.

If you are an applicant for our services or our customer, we may use your personal information to:

• verify your identity;
• provide and manage products and services you have requested;
• understand your financial services requirements;
• report to consumer credit bureaus and business reporting companies;
• protect against fraud and manage risk;
• determine suitability of products and services for you;
• better manage your relationship with us;
• determine your eligibility for certain of our products and services, or products or services of others;
• comply with legal or regulatory requirements, or as otherwise permitted by law;
• communicate with you regarding products and services that may be of interest;
• understand our customers and develop and tailor our products and services; and/or
• respond to any questions you may have.

If you are a job applicant, we may use your personal information to:

• determine your eligibility for the role you are applying for;
• identify, and communicate to you, other potential opportunities at the Bank that may be a good match for your qualifications;
• comply with legal or regulatory requirements, or as otherwise permitted by law;
• and/or respond to any questions you may have.

If you are visiting our website please refer to our Online Privacy Notice to learn more about the uses of your information.

We will only use or disclose your personal information for the purpose(s) it was collected and as otherwise identified in this Policy. We do not sell your personal information to any other business or third parties for monetary or other valuable consideration. We may disclose your personal information within the Bank for legal and regulatory purposes, to manage credit risk and other business risks, to perform analytics, to ensure we have correct and up to date information about you (such as your current address or date of birth), and to better manage your relationship with us.

During the past 12 months, we have disclosed, for a business purpose, personal information to the following categories of third parties:

Personal Data Type	Third Party Category to Whom We Disclosed Personal Data
Personal Identifiers	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations; consumer credit bureaus and business reporting companies; third parties who are selling you goods or services where you have requested that we finance the purchase; third parties, such as other creditors, when you have specifically authorized us to disclose your information; third parties in order to comply with a court order or other legal process; or third parties in order to protect our assets (for example, collection of overdue accounts).
Commercial Information	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations; consumer credit bureaus and business reporting companies; third parties who are selling you goods or services where you have requested that we finance the purchase; third parties, such as other creditors, when you have specifically authorized us to disclose your information; third parties in order to comply with a court order or other legal process; or third parties in order to protect our assets (for example, collection of overdue accounts).
Professional or Employment Related Information provided when applying for the Bank's services or as the Bank's customer	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations; consumer credit bureaus and business reporting companies; third parties who are selling you goods or services where you have requested that we finance the purchase; third parties, such as other creditors, when you have specifically authorized us to disclose your information; third parties in order to comply with a court order or other legal process; or third parties in order to protect our assets (for example, collection of overdue accounts).
Characteristics of Protected Classifications	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations; consumer credit bureaus and business reporting companies; third parties who are selling you goods or services where you have requested that we finance the purchase; third parties, such as other creditors, when you have specifically authorized us to disclose your information; third parties in order to comply with a court order or other legal process; or third parties in order to protect our assets (for example, collection of overdue accounts).
Internet/Electronic Network Activity	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations; consumer credit bureaus and business reporting companies; third parties who are selling you goods or services where you have requested that we finance the purchase; third parties, such as other creditors, when you have specifically authorized us to disclose your information; third parties in order to comply with a court order or other legal process; or third parties in order to protect our assets (for example, collection of overdue accounts).
Biometric Information	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations.
Audio, Visual and Similar Information	service providers who assist us in managing and servicing your account(s); legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations; consumer credit bureaus and business reporting companies; third parties who are selling you goods or services where you have requested that we finance the purchase; third parties, such as other creditors, when you have specifically authorized us to disclose your information; third parties in order to comply with a court order or other legal process; or third parties in order to protect our assets (for example, collection of overdue accounts).

If you are a California resident, you have certain rights with respect to your personal information, as described below. We reserve the right to verify your identity in connection with any request related to exercising these rights to help ensure that we provide the information we maintain to the individuals to whom it pertains, and allow only those individuals or their authorized representatives to exercise these rights. Please note that your exercise of these rights is subject to certain exemptions that include, but are not limited to, safeguarding the public interest (e.g., prevention or detection of crime) and our interests (e.g., maintenance of legal privilege).

As a California resident, you have the following rights:

• Right to Know: You may submit a request that we disclose to you the categories of personal information we collect, the sources from which we collect that personal information, the business or commercial purpose for collecting personal information, categories of third parties with which we disclose personal information, and the specific pieces of personal information we have collected about you, or to access information related to an automated decision. You also have the right to know criteria used to determine the period of time for which we intend to retain each category of personal information, including sensitive personal information.
• Right to Delete Data: You may submit a request that we delete or remove certain personal information that we may have collected about you, as long as we are not otherwise obligated or permitted to retain or use that information for a lawful purpose. If we reject your request, we will notify you of the reason(s) for the rejection.
• Right to Correct: You have the right to request that we correct inaccurate personal information we may have about you.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for the exercise of your privacy rights.
• Rights Related to the Sale and Sharing of your Personal Information: You have the right to be notified at or before the point of collection what categories of sensitive personal information the Bank collects about you and the purposes for which it is collected or used, and whether your personal information is “sold” or “shared” as those terms are defined in the CCPA and to opt out of such sale or sharing; we do not sell your personal information or share your sensitive personal information as defined under the CCPA. To learn about opting out of online behavioral advertising at BMO Harris Bank N.A., visit https://www.bmo.com/main/about-bmo/privacy-security/our-privacy-code/digital-privacy-policy.

Section 6, below, sets out the process for you to submit a request with respect to your rights under this Policy, and explains the process we will use to verify your request.

To submit a CCPA request online, you must be:

Verification and Time for Completion: Please note that identities of individuals submitting requests under this Policy must first be verified to protect you and the Bank from fraud and identity theft. We verify consumer request(s) by comparing information you provide with information we maintain or possess on file. As part of this process, you may be asked to provide certain identifying information, which we will use for the purpose of verifying your identity, only. Please note that for certain requests, we reserve the right to ask you to provide us with a signed declaration under penalty of perjury affirming that you are the consumer whose personal information is the subject of the request. All requests typically will be fulfilled within forty‐five (45) days of submission. If we need an extension for up to an additional 45 days in order to process your request, we will provide you with an explanation for the delay.

Designating an Agent: If you wish to designate an authorized agent to submit a CCPA request on your behalf, you must provide a written and signed declaration (i) explaining that you intend to designate an authorized agent to assert your rights under CCPA, (ii) identifying by name and address the intended authorized agent, (iii) stating the specific right(s) you intend to have the agent assert on your behalf, and (iv) stating that you consent to the designated agent receiving personal information about you, the requestor. Alternatively, you may also provide legal documents demonstrating that you have designated another individual with power of attorney. Designated agents wishing to make a request will be required to provide the written and signed declaration or other supporting documents prior to the Bank processing a CCPA request.

Our site and our services are not directed at individuals under the age of sixteen (16), and we do not knowingly solicit, collect or use personal information from children under 16. Minors under 16 are prohibited by this Policy from providing personal information through our Site.

We retain personal information (including sensitive personal information) for as long as needed or permitted with respect to the purpose(s) for which it was obtained and consistent with applicable law. To determine the appropriate retention period, we consider different criteria, including the sensitivity of the personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, the need for maintaining your personal information to provide you with products and services, and all applicable legal and regulatory requirements.