Central Bank of Bahrain U.S. Privacy Notice

We use the personal information we collect for purposes described in this privacy notice or as otherwise disclosed to you. For example, we use personal information for the following purposes:

• Provide the Services;
• Process and fulfill transactions;
• Establish and manage CBB accounts;
• Personalize your experience on our Services;
• Remember you and the information you share with the Services including on forms and applications;
• Facilitate payroll or other direct deposits (including tax refunds) to your CBB account;
• Facilitate transfers or API connections between external bank accounts and CBB accounts;
• Verify your identity, including to facilitate a name change request;
• Respond to inquiries, provide member support and resolve disputes;
• Send you communications, including emails, text messages, and App push notifications, that you request or that we are permitted to send;
• Determine your eligibility for, and administer your participation in, certain features of the Services, including, but not limited to, surveys, contests, sweepstakes, promotions and rewards;
• Facilitate and manage referrals from business partners and third-parties;
• Identify recipients and facilitate transfers for PayAnyone;
• Advertise and market our products and Services, and to send you information about third-party products and Services;
• Provide you targeted offers and notify you of third-party locations where you may use our products and Services;
• Provide member support and quality assurance, and conduct customer service training;
• Collect fees and other amounts owed in connection with your CBB account;
• Operate, evaluate and improve our business (including researching and developing new products and Services; enhancing, improving, debugging and analyzing our products and Services; managing our communications; establishing and managing our business relationships; and performing accounting, auditing and other internal functions);
• Maintain and enhance the safety and security of our products and services and prevent misuse;
• Protect against, identify and prevent fraud and other criminal activity, claims and other liabilities;
• Exercise our rights and remedies and defend against legal claims; and
• Comply with and enforce applicable legal requirements, relevant industry standards and CBB policies;
• Develop, maintain, and improve our services by using machine learning, AI, and risk modeling;
• To provide our services using privacy preserving de-identified data. CBB will not attempt to re-identify de-identified data provided to us if that was not the intended purpose for the data or without providing proper notice to you.

We may use analytics on our Services. For example, we use Google Analytics to better understand how you interact with our Site. We also use Google Maps to better understand how our Services are used and to provide you with a map of nearby ATMs. The information we obtain through our Services may be disclosed to or collected directly by these third parties. To learn more about Google Analytics and Google Maps, please visit https://www.google.com/policies/privacy/partners/.

On our Services, we may obtain information about your online activities to provide you with advertising about products and Services that may be tailored to your interests.

You may see our ads on other websites because we use third-party ad services. Through these ad services, we can target our messaging to users considering demographic data, users' inferred interests and browsing context. These services track your online activities over time and across multiple websites and apps by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other similar technologies. The ad services use this information to show you ads that may be tailored to your individual interests. The information ad services may collect includes data about your visits to websites that serve CBB advertisements, such as the pages or ads you view and the actions you take on the websites or apps. This data collection takes place both on our Services and on third-party websites and apps that participate in these ad services. This process also helps us track the effectiveness of our marketing efforts.

To learn how to opt out of interest-based advertising, see our "Your Choices" section in this Notice.

If you are a California resident and apply for a job with us, please see our CBB Applicant Privacy Notice.

1. Notice of Collection

We may collect (and may have collected during the 12-month period prior to the effective date of this Notice) the following categories of personal information about you:

• Identifiers such as a real name, postal address, unique personal identifiers (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver's license number, passport number, and other similar identifiers;
• Additional Data Subject to Cal. Civ. Code § 1798.80. Signature, physical characteristics or description, state identification card number, education, bank account number, credit card number, debit card number, and other financial information;
• Protected Classifications. Characteristics of protected classifications under California or federal law, such as race, color, national origin, age, sex, gender, marital status, citizenship status, and military and veteran status;
• Commercial Information. Commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consumer histories or tendencies;
• Online Activity. Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements;
• Geolocation Data. We use your IP address to determine your general location (such as city, state, or zip code);
• Sensory Information. Audio, electronic, visual, and similar information;
• Employment Information. Professional or employment-related information;
• Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes;
• Sensitive Personal Information
  • Government ID. Government identification such as social security numbers, driver's license, state identification card, or passport number;
  • Account access information. Information such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
  • Precise geolocation data. Data derived from a device and that is used or intended to be used to locate you within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet;
  • Sensitive demographic data. Racial or ethnic origin, religious or philosophical beliefs, or union membership;
  • Biometric information. For the purpose of uniquely identifying an individual.

2. Notice of Use of Personal Information

We may use (and may have used during the 12-month period prior to the effective date of this Notice) your personal information for the purposes described in our CBB Privacy Notice and for the following business purposes specified in the CCPA:

• Performing Services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services;
• Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
• Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
• Debugging to identify and repair errors that impair existing intended functionality;
• Undertaking internal research for technological development and demonstration;
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

3. Sources of Personal Information

During the 12-month period prior to the effective date of this Notice, we may have obtained personal information about you from the following categories of sources:

• Directly from you, such as when you sign up for an account or contact member services, or participate in sweepstakes, promotions, or research or survey activities;
• Our Bank Partners;
• Your devices, when you use our Site or App;
• Your family or friends, such as when they provide us with your contact information by choosing to share their phone contacts with CBB;
• Payment processors;
• External banks (i.e., banks other than our Bank Partners) if you link a non-CBB bank account;
• Credit reporting agencies;
• Our affiliates and subsidiaries;
• Vendors who provide services on our behalf;
• Our joint marketing partners;
• Our business partners (such as referring websites);
• Online advertising services and advertising networks;
• Data analytics providers;
• Government entities;
• Operating systems and platforms;
• Social networks;
• Data brokers;
• Data aggregators, such as Plaid.

4. Categories of third parties with whom personal information was shared

During the 12-month period prior to the effective date of this Notice, we may have shared your personal information with certain categories of third parties, as described below. When we share personal information with our Bank Partners, we do so as their service provider. The privacy practices of our Bank Partners are subject to their privacy notices (see The CBB Partner Bank, N.A. Consumer Privacy Notice and the Stride Consumer Privacy Notice), which we strongly suggest you review. CBB is not responsible for our Bank Partners' information practices or privacy notices. We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

In addition to the categories of third parties identified above, during the 12-month period prior to the effective date of this Notice, we may have shared personal information about you with the following additional categories of third parties: government entities; other persons to whom we have a legal obligation to disclose personal information (including, for example, in response to a duly issued subpoena or search warrant); and other persons to whom you authorize CBB to disclose your personal information.

5. California Privacy Rights

If you are a California resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, twice in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information, which is also provided in this Notice.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of the Selling or Sharing of your Personal Information. You have the right to opt out of the selling or sharing of your data. The CCPA requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Shine the Light Request. You have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties.
• Joint Marketing with other Financial Institutions. You have the right to opt-out of joint marketing with other financial institutions.
• Appeal. You have the right to appeal our decision to refuse to act on a CCPA data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request (except for a request to opt-out of sales or sharing).
• Retention. We retain personal information for as long as necessary to provide the Services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes.
• Notice of Financial Incentives. CBB may offer rewards or prizes for participation in certain activities that may be considered a "financial incentive" under California law.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

If you are a Colorado resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Selling and Targeted Advertising. You have the right to opt out of targeted advertising and the sale of your personal information. Colorado law requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Appeal. You have the right to appeal our decision to refuse to act on data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

If you are a Connecticut resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Selling and Targeted Advertising. You have the right to opt out of targeted advertising and the sale of your personal information. Connecticut law requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Appeal. You have the right to appeal our decision to refuse to act on data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

If you are a Montana resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Selling and Targeted Advertising. You have the right to opt out of targeted advertising and the sale of your personal information. Montana law requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Appeal. You have the right to appeal our decision to refuse to act on data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

If you are a Oregon resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Selling and Targeted Advertising. You have the right to opt out of targeted advertising and the sale of your personal information. Oregon law requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Appeal. You have the right to appeal our decision to refuse to act on data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

If you are a North Dakota resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Joint Marketing with other Financial Institutions. You have the right to opt-out of joint marketing with other financial institutions. If you would like to opt out of joint marketing with other financial institutions by submitting a request through the CBB Privacy Hub.

If you are a Texas resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Selling and Targeted Advertising. You have the right to opt out of targeted advertising and the sale of your personal information. Texas law requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Appeal. You have the right to appeal our decision to refuse to act on data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

If you are a Utah resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you.
• Obtaining a portable copy of your personal information. To obtain a copy of your personal information that you previously provided to us in a portable format, please submit an "Access" request as described above.
• Deletion. You have a right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Targeted Advertising. You have a right to opt-out of targeted advertising and the sale of personal information. We do not "sell" data as it is defined under Utah law.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.
• Third Party Sharing. To access the categories of third parties with whom personal information was shared, please consult the table under "California Consumers" as our data sharing is the same regardless of the state of our members.

If you are a Vermont resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Joint Marketing with other Financial Institutions: You have the right to opt-out of joint marketing with other financial institutions. If you would like to opt out of joint marketing with other financial institutions by submitting a request through the CBB Privacy Hub.

If you are a Virginia resident, you have rights regarding your personal information. Those rights and other state-specific information is described below:

• Access. You have a right to request that we disclose to you, once in a 12-month period, the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.
• Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a number of exceptions.
• Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions.
• Opt-Out of Selling and Targeted Advertising. You have the right to opt out of targeted advertising and the sale of your personal information. Virginia law requires us to describe the categories of personal information we sell or share to third parties and how to opt-out of future sales.
• Obtaining a portable copy of your personal information. You have the right to obtain a portable copy of your personal information.
• Appeal. You have the right to appeal our decision to refuse to act on data privacy request within a reasonable period after you receive our decision.
• Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
• Authentication/Verification. To help protect your privacy and maintain security, we will take steps to authenticate your identity before granting you access to your personal information.
• Declining Requests. Except for the automated controls described in this Notice, if you send us a request to exercise your rights or the choices in this section, to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.