UBANLC BANK (N.A.) (“we,” “us”) respects your privacy. This Notice describes how we collect, use, share and protect personal information of website visitors, applicants and accountholders, in accordance with the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act as amended (CCPA/CPRA), and other applicable U.S. law.
This Notice applies to consumer and business customers. If state law grants you additional rights, we honor them as described below.
1. Information we collect
We collect information you provide directly: identity information (name, date of birth, government ID numbers including Tax ID/EIN/FEIN, and ID documents), contact information (email, phone, postal address), financial information (account numbers, balances, transaction history, source of funds, income), and business information (registration data, directors, beneficial ownership). We also collect information automatically: device identifiers, IP address, browser type, operating system, pages viewed and login/audit records, and information from third parties such as identity-verification providers and credit bureaus, as permitted by law.
2. How we use your information
We use personal information to open and administer accounts; to verify identity and comply with anti-money-laundering, OFAC sanctions, KYC/KYB and Bank Secrecy Act obligations; to process transactions and provide the Services; to detect and prevent fraud and security incidents; to communicate with you, including service and security notices; to improve our products; and to comply with legal, regulatory and audit requirements.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We also do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA and GLBA.
3. How we share information
We share personal information only: (a) with service providers and processors who perform services for us under contracts restricting their use; (a2) with affiliates for everyday business purposes, as permitted by law; (b) with card networks, payment rails and counterparties as necessary to complete your transactions; (c) with fraud-prevention and identity-verification partners; (d) with regulators, law enforcement and courts as required by law, subpoena or legal process; and (e) with your consent or at your direction.
We may share aggregated or de-identified data that cannot reasonably identify you.
4. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary to operate the platform (authentication, security, session integrity) and, where permitted, analytics cookies to understand aggregate usage. You may control cookies through your browser settings; disabling strictly necessary cookies may prevent the Services from functioning.
5. Your rights and choices
Subject to applicable law, you may: request to know the categories and specific pieces of personal information we collect; request deletion or correction; request disclosure of sharing; and opt out of any sale or sharing (we do not sell). You will not be discriminated against for exercising your rights. To exercise rights, contact Customer Care through the Help Center; we will verify your identity before acting.
GLBA accountholders may limit certain sharing of account information with our non-affiliated third-party marketers by contacting us. Federal and state law already restricts some sharing; see our U.S. Customer Privacy Notice summary provided with your account opening materials.
6. Data retention
We retain personal information for as long as necessary to provide the Services and as required by law. Under the Bank Secrecy Act and related regulations, certain records must be retained for at least five years, and account records for the periods specified by regulation; transaction and audit records may be retained longer for compliance, litigation and audit purposes.
7. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls, audit logging and independent security reviews. Identity documents are stored in encrypted private storage accessible only to you and authorized compliance personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Children’s privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.
9. Changes and contact
We may update this Notice from time to time; the effective date above will reflect the current version, and material changes will be communicated as required by law. Questions or requests may be directed to Customer Care or in writing to the Compliance Department at our published headquarters address.
