FDIC-Insured - Backed by the full faith and credit of the U.S. Government

Skip to Content
Personal
Business

California Consumer Privacy Act Privacy Policy and Notice at Collection

Applicability

This California Consumer Privacy Act ("CCPA") Privacy Policy and Notice at Collection ("Notice") applies only to California residents ("consumer(s)," "you," "your," "their," or "them"). It explains the online and offline information practices of FirstBank, our Holding Company, and our Affiliate(s) ("we," "our," or "us"), along with outlining consumers' rights regarding their Personal Information and the instructions necessary for them to exercise those rights. For purposes of this Notice, our efirstbank.com, es.efirstbank.com, efirstbankblog.com, and similar websites will be referred to as "our websites." Additionally, the information within provides timely notice about the categories of Personal Information to be collected from you during online and offline interactions with us, the purposes for which the Personal Information is collected or used, and whether that Personal Information is sold or shared. This, therefore, serves as our Notice at Collection. Please note that the CCPA, and this Notice, do not apply to information covered by the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or certain other laws.

For more information, please visit:

Categories of Personal Information

We collect Personal Information in a variety of contexts. The specific Personal Information that we collect relating to consumers will vary based on our relationship or interaction with them. In the past 12 months, we have collected, and do collect, for our disclosed purposes, each of the following categories of Personal Information.

Personal Information:

  • Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, Social Security Number, driver's license number, passport number, or other similar identifiers
  • Characteristics of protected classifications under California or federal law, such as sex and marital status
  • Commercial Information, such as records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
  • Biometric information, such as fingerprint and voiceprint
  • Internet or Online Activity Information, such as browsing history, search history, and information regarding consumers' interaction with FirstBank's websites, applications or advertisements
  • Geolocation Data, such as device location and Internet Protocol (IP) location
  • Audio, Electronic, Visual, or Thermal (or similar) Information, such as call and video recordings
  • Professional or Employment-related Information, such as work history and prior employer, information from background checks, resumés, and personnel files
  • Education information, such as details of your education and qualifications
  • Inferences drawn from any of the Personal Information listed above to create consumers' profiles reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
  • Sensitive Personal Information:
    • Social Security, driver's license, state identification card, or passport number
    • Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, or credentials allowing access to an account
    • Precise geolocation
    • Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs
    • Biometric information processed for identification

Categories of Sources of Personal Information

The categories of sources pertaining to the Categories of Personal Information described in this Notice include the following:

  • You or Your Representative(s) through physical (for example, paper application), audible (for example, by phone), and electronic/online (for example, our websites and online application/intake systems) sources.
  • Service Providers, Consumer Data Resellers, Credit Reporting Agencies and other similar persons or entities who provide it to us, including your current or prior employer(s), and/or current or prior education provider(s).
  • Public Records or Widely Available Sources like information from the media and other records and information that are made available by federal, state, and local government entities.
  • FirstBank, our Holding Company, or our Affiliate(s).
  • Website/Mobile App Activity/Social Media Activity, as use of any features or resources available on or through an app or website may automatically trigger disclosure, from your device and browser, certain information may constitute Personal Information.

Business Purposes for the Collection, Disclosure, and Use of Personal Information

We collect, use, and disclose for our business and commercial purposes Personal Information to operate, manage, and maintain our business and to provide our products and services, including the following:

  • Communicating with you through any means, including email, phone, text message, social media, post or in-person
  • Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services (except for cross-context behavioral advertising, a type of targeted advertising), providing analytic services, facilitating event management and execution, managing our real estate portfolio, or for similar reasons
  • Helping to ensure security and integrity to the extent the use of Personal Information is reasonably necessary and proportionate for these purposes
  • Short-term, transient use, including but not limited to, non-personalized advertising shown as part of a current interaction with us, where the information is not used to build a profile or otherwise alter consumers' experience outside the current interaction with us
  • Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with specifications and other standards
  • Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance that service
  • Debugging to identify and repair errors that impair existing intended functionality
  • Undertaking internal research for technological development and demonstration
  • Complying with laws and regulations and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes, or opinions)
  • Supporting employment, human resource management, and related reasons to provide benefits, manage compensation activities, process employment applications, and to fulfil similar purposes, internally or in partnership with professional services providers and business partners

Sale or Sharing of Personal Information

For purposes of this Notice:

  • "Sale," "Sold," or "Sell(s)" means the disclosure of Personal Information to a third-party for monetary or other valuable consideration.
  • "Share" or "Shared" means the disclosure of Personal Information to a third-party for cross-context behavioral advertising.

In August 2022, the California Attorney General's office interpreted the term "Sale" under the CCPA as follows: "SALE USING ONLINE TRACKING TECHNOLOGY means SALE where the business discloses or makes available consumers' personal information to third-parties through the use of online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies, in exchange for monetary or other valuable consideration, including, but not limited to: (1) personal information or other information such as analytics; or (2) free or discounted services." Under this interpretation, FirstBank has determined that our third-parties used for advertising and analytics purposes, in which these third-parties obtain analytics data from the users of our websites would constitute a "Sale." Sale activities deliver advertising and marketing using Personal Information we collected or that you provided to assist in determination of bank ads or offers that might appeal to you, to display them to you, and to monitor your responses.

If you opt-in on our websites, FirstBank may sell/share your Personal Information gathered from use of our websites to third-party advertising and marketing vendors for cross-context behavioral advertising (also referred to as Online Behavior Advertising or OBA) through use of technologies such as Targeting Cookies. We do not otherwise sell your Personal Information.

The categories of Personal Information that we have sold/shared in the 12 months preceding the date of this Notice for cross-context behavioral advertising through use of technologies such as Targeting Cookies on our websites include the following:

  • Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, or other similar identifiers
  • Internet or Online Activity Information, such as browsing history, search history, and information regarding consumers' interaction with an Internet website application or advertisement
  • Geolocation Data, such as device location and Internet Protocol (IP) location
  • Inferences drawn from any of the Personal Information listed above to create consumers' profiles reflecting their preferences, characteristics, psychological trends, predispositions, behavior, and attitudes, intelligence, abilities, and aptitudes

Consumers Under 16 Years

We do not have knowledge of selling the personal information of consumers under 16 years of age.

Categories of Third-Parties To Whom Personal Information Was Disclosed

With respect to the Categories of Personal Information described in this Notice, the categories of persons or entities to whom we disclosed that Personal Information include the following:

  • Service Providers and Contractors who provide services such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure, customer service, email delivery, auditing, marketing, marketing research activities, credit financing, event management, employee support and administration, and real estate management
  • Other Service Providers and Contractors who enable customers to conduct transactions online and via mobile devices, support mortgage and fulfillment services, vehicle loan processes and aggregators (at the direction of consumers)
  • Other persons or entities to whom we transfer Personal Information as an asset that is part of a merger, acquisition, or other transaction in which such other person or entity assumes control of all or part of the business
  • Government Agencies as required by laws and regulations
  • Other persons or entities with which you may use or direct us to intentionally interact or to which you may use or direct us to intentionally disclose your Personal Information

Statement Regarding Other Purpose(s)

We do not use or disclose Sensitive Personal Information for purposes other than to perform services or provide goods reasonably expected; prevent, detect, and investigate security incidents; resist or respond to malicious, deceptive, fraudulent, or illegal actions directed at us; ensure physical safety of individuals; use short-term, such as for non-personalized advertising; perform services on our behalf; verify, maintain, improve, upgrade, or enhance the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us; or collect or process Sensitive Personal Information where the collection or processing is not for the purpose of inferring characteristics about consumers. Given our limited use and disclosure of Sensitive Personal Information, we do not offer the right to limit its use or disclosure.

How Long We Retain Personal Information

The length of time that we intend to retain each category of Personal Information will depend on a number of criteria, including the length of time we are required to retain Personal Information in order to comply with applicable legal and regulatory requirements; the length of time we may need to retain Personal Information in order to accomplish the business purposes for which such Personal Information is collected, used, or disclosed (as indicated in this Notice); and whether you choose to exercise your right, subject to certain exceptions, to request deletion of your Personal Information.

Explanation Of Rights Regarding Personal Information

You may have one or more of the following rights. Please see the sections following the descriptions of your rights to learn how to exercise the rights described.

  1. KNOW - Right to request information, from the 12-month period preceding receipt of your request, about:
    • the categories of your Personal Information that we collected
    • the categories of sources from which your Personal Information was collected
    • the purpose for collecting, selling, or sharing your Personal Information
    • the categories of third-parties to whom we disclosed your Personal Information
    • the specific pieces of Personal Information we collected about you
  2. DELETE - Right to request deletion of Personal Information that we collected from you
  3. CORRECT - Right to request we correct inaccurate Personal Information that we maintain about you
  4. OPT-OUT of the Sale/Sharing of Personal Information, which directs us to stop selling or sharing your Personal Information
  5. BE FREE FROM UNLAWFUL DISCRIMINATION for exercising your rights under the CCPA requests

How To Exercise Your Rights To Know, Delete, or Correct Personal Information & What To Expect

You may submit a request to know, delete, or correct your Personal Information by doing any one of the following:

  1. Complete this CCPA Request Form
  2. Call: 800-964-3444
  3. Email: dataprivacy@efirstbank.com
  4. Mail:
    Data Privacy
    FirstBank
    PO Box 150097
    Lakewood, CO 80215

When you submit a request as described, we will acknowledge receipt of your request and advise you how long we expect it will take to respond if we are able to verify your identity. Requests for specific pieces of Personal Information will require additional information to verify your identity.

In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or if we cannot verify that you have the authority to make a request on behalf of another individual. Third Parties are unable to accept a request from us on your behalf. Additionally, we will not honor your request where an exception applies, such as where the disclosure of Personal Information would adversely affect the rights and freedoms of another California resident or where the Personal Information that we maintain about you is not subject to the CCPA's access or deletion rights.

We will advise you in our response if we are not able to honor your request. We will not provide Social Security, driver's license, or government-issued identification numbers, financial account numbers, unique biometric data, health care or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

We will work to process all verified requests within 45 days pursuant to the CCPA. If we need an extension for up to an additional 45 days in order to process your request, we will provide you with an explanation for the delay.

CCPA Request Form

  • Required field.

How To Exercise Your Right To Opt-Out Of The Sale/Sharing Of Personal Information & What To Expect

We do our best to automatically opt-out consumers visiting our websites, however, you may exercise your right to opt-out of your Personal Information being sold or shared for cross-context behavioral advertising through use of technologies, such as Targeting Cookies, on our websites by doing any one of the following:

  1. Managing your cookies preferences when the banner is presented to you when visiting our websites. You may also access the option to manage your cookies preferences by clicking the "Cookie Settings" link displayed in our website's footer. Clicking on the "Do Not Sell or Share My Personal Information" link displayed in our website's footer will lead you to this Notice.
  2. Setting the Global Privacy Control on your browser accordingly, as we honor opt-out requests submitted via this method.

You may use Option 1 within this section at any time to update or manage your cookies preferences to opt-in or opt-out. Unless you authorize us to do so by opting-in, we will not sell or share your Personal Information collected through use of the websites listed.

Authorized Agents

You may authorize an agent ("Authorized Agent") to make a request on your behalf. Authorized Agents may make requests on consumers' behalf by using the methods described in the How To Exercise Your Right(s) sections within this Notice. For Authorized Agents who are individuals, we may require proof of authorization and verification of identity directly from the person for whom the request is made. For Authorized Agents that are companies or organizations, we may require proof of authorization from the individual, such as a Power of Attorney and verification of identity directly from the person for whom the request is made.

Questions or Concerns

You may contact us with questions or concerns about this Notice and our practices by doing any one of the following:

  1. Call us toll-free at 800-964-3444
  2. Email us at dataprivacy@efirstbank.com

Changes to This Privacy Policy Notice

We may change or update this Notice from time to time. When we do, we will post the revised Notice on this page with a new "Last Updated" date. The Notice was last updated 10/11/2024.

Return to Top