California Consumer Privacy Act (CCPA) Notice

Last updated: April 1, 2024

The words “we”, “us” and “our” mean Royal Business Bank, and the words “you” and “your” mean you, the consumer who resides in the California State. We adopt this notice to comply with the California Privacy Rights Act (CPRA) that amended to California Consumer Privacy Act (CCPA).

This Notice explains what personal information we collect and how we use of the personal information about California residents. The Notice also explains certain rights that California residents have under the CCPA. This Notice explains how California residents can exercise their rights under the CCPA to request that we: (1) provide certain personal information that we have collected about them during the past 12 months, along with related information described below, or (2) delete certain personal information that we have collected from them.

Collection of Personal Information

During the past 12 months, we have collected the following categories of your personal information. We have also provided each category of sources from which we collected the personal information, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share the personal information.

Categories Personal Information that we may collect

Identifiers: Real name, alias, postal address, unique personal identifier, online identifier, Internet
Protocol address, email address, account name, social security number, driver’s license number,
passport number, signature, physical characteristics or description, address, telephone number,
insurance policy number, education, employment, employment history, bank account number, credit
card number, debit card number, or any other financial information, medical information, or health
insurance information or other similar identifiers
Employment Information: Federal & state tax filing, emergency contact, beneficiary, dependent,
spouse, immigration status, legal issue, health information, work history, salary
Biometric information: Imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice
recordings, from which an identifier template can be extracted (faceprint, a minutiae template, voiceprint),
and keystroke patterns, gait patterns, and sleep, health, or exercise data that contain identifying
information
Image and Video: Picture, moving visual images with or without audio
Commercial information: Records of personal property, products or services purchased, obtained, or
considered, or other purchasing or consuming histories or tendencies
California State or Federal Law characteristics of protected classifications: Race, color, religion,
national origin, sex, gender identity, gender expression, sexual orientation, marital status, medical
condition, military or veteran status, national origin, ancestry, disability, genetic information, request for
family care leave, request for leave for an employee’s own serious health condition, request for pregnancy
disability leave, retaliation for reporting patient abuse in tax-supported institutions, age (over 40)
Internet or other electronic network activity information:
o Browsing history, search history, and information regarding a consumer or individual’s
interaction with an Internet Web site, application, or advertisement
o When you visit a website, your device and browser may automatically disclose certain
information (such as device type, browser application, browser settings, IP address and other
technical communications information)
Rev 4/1/2024 2 RM-200-19
Professional or employment-related information and references: Current or past job history or
performance evaluation, school or degrees earned

Sensitive Personal Information

The following categories of Sensitive Personal Information comprised of Personal Information that may reveal:

Social Security, driver’s license, state identification card, or passport number;
Account log-in, financial account, debit card, or credit card number in combination with any
required security or access code, password, or credentials allowing access to an account;
Precise geolocation;
Racial or ethnic origin, sex, religious or philosophical beliefs, or union membership;
Citizenship or Immigration Status;
The contents of mail, email, and text messages unless the business is the intended recipient
of the communication; and
The processing of biometric information for the purpose of uniquely identifying a person.

Categories of sources from which we collect

From deposit and/or credit applicants and bank customers, third party service vendors, public
information.
From Credit Reporting Agencies with your authorization
From contract or agreement
From the specific application or software when you accessing our online or mobile banking application,
our website
From the security camera or similar devices when you visit our branches, facilities and ATMs
Employment Information: From resume, job applicants, employees and former employers

Our business or commercial purpose for collecting

To provide and manage products and services. Establish and process transactions including checking
accounts, loans, online banking access, customer services and everyday operations
To qualify you for an account or credit with us
To perform the service for our daily business.
To qualify you for the appointed position
To validate your identity when accessing or visiting our sites, applications, branches, facilities, and ATMs
in connection with our products, service, and daily business
To validate your identity when accessing our sites and applications
Employment Information: Process employment applications. Provides benefits to employees and
dependents, including health care plan and retirement plans

Categories of third parties with whom we share

Shared with our service providers to service your account
Government agencies including to support regulatory and legal requirements
Share with vendors that assist us in protecting your accounts and personal information from fraud,
Identify Theft and providing security and safety for our customers and employees
Employment Information: Share with service provider for employee payroll, health care and
retirement plan

Personal information does not include

Publicly available information from government records
De-identified or aggregated consumer information
Information excluded from the CCPA’s scope, like:
o Health or medical information covered by the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or
clinical trial data;
Personal information is covered by certain sector-specific privacy laws, including the Fair Credit
Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information
Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994

RBB Privacy Notice and RBB Online Privacy Notice: you can access to our privacy notice and online privacy policy notice by this link RBB Privacy Policies & Notices or go to our website at
www.royalbusinessbankusa.com/privacy.

Sale or Share of Personal Information

We do not sell personal information for monetary or other valuable consideration OR share any personal
information for cross-context behavioral advertising about customers, consumers including minor under 16 years
of age. During the past 12 months, Royal Business Bank has disclosed the categories of personal information
listed above for its business purposes.

Retention of Personal Information

The length of time that we intend to retain each category of Personal Information will depend on a number of
criteria, including (i) the length of time we are required to retain Personal Information in order to comply with
applicable legal and regulatory requirements, (ii) the length of time we may need to retain Personal Information
in order to accomplish the business or commercial purpose(s) for which such Personal Information is collected,
used or disclosed (as indicated in this Notice), and (iii) whether you choose to exercise your right, subject to
certain exceptions, to request deletion of your Personal Information.

Your Rights under the CCPA

You have the following rights under the CCPA regarding your personal information.

Right to know
a. The categories and/or specific pieces of personal information we have collected
b. The categories of sources from which the personal information was collected
c. The purposes of collecting the personal information
d. The categories of third parties with we share the personal information
e. The categories of information that we sell or disclose to third parties
Right to delete personal information data we collected
Right to correct inaccurate personal information we collected
Right to limit uses of personal information we collected
Right not to be discriminated against for exercising any of these rights

Right to Opt-Out of the Sale or Share of Personal Information

You do not need to request the right to opt-out of the sale or share of your personal information because we do
not sell or share your personal information to third parties as defined under CCPA. We do need to collect certain
personal information in order to provide banking services to you. If you do not want to provide that necessary
personal information, we will not be able to provide you with our banking services.

Authorized Agent

When you use an authorized agent to submit a request to know or a request to delete, request to correct, or a
request to know, we may require the authorized agent to provide proof that you gave the agent signed
permission to submit the request. We may also require you to verify your identity directly with us or directly
confirm with us that you gave the authorized agent permission to submit the request.

How to Exercise Your Rights

You may submit a request by:

Contact us at: (888) 616-8188 Monday through Friday from 9:00 AM to 5:00 PM PST;
Complete the “Personal Information Request Form” mail to Royal Business Bank, Attention: Risk
Management Department, 1055 Wilshire Blvd., Ste 1200, Los Angeles, CA 90017 or drop it off at any of
our California branch; or
Submit the online form “Personal Information Request Form” at our website under Privacy
Policies & Notices

We are required by law to verify your identity before releasing any of your information to you.
Privacy and personal information protection laws, other than the CCPA, apply to the personal information that
we collect, use, and disclose. When these laws apply, personal information may be exempt from, or outside the
scope of requests. As a result, in some instances, we may decline all or part of a request related to your personal
information. This means that we may not provide some or all this personal information when you make a
request. Also, we may not delete some or all this personal information when you make a deletion request.

You can access this link to find our CCPA Notice at our website: RBB CCPA Notice

Question
If you have any questions, you may write to us at Royal Business Bank, Attention: Risk Management
Department, 1055 Wilshire Blvd., Suite 1200, Los Angeles, CA 90017 or call toll free (888) 616-8188.
Mail to Royal Business Bank, Attention: Risk Management Department, 1055 Wilshire Blvd., Ste 1200, Los
Angeles, CA 90017

Change to This Notice
We may change or update this Notice from time to time. When we do, we will post the revised Notice with the
last updated date.