CALIFORNIA CONSUMER PRIVACY ACT NOTICE

Printer friendly version of CCPA Notice

APPLICABILITY

Your privacy is important to us. This California Consumer Privacy Act Notice (this "CCPA Notice") supplements the information contained in our www.wafdbank.com/privacy-center#privacy-policy and Consumer Privacy Policy. It also explains how Washington Federal Bank ("we", "us", or "WaFd Bank") collects, uses, and discloses the personal information of California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"). This CCPA Notice is provided pursuant to the CCPA.

BACKGROUND

Under the CCPA, "Personal Information" is information that identifies, relates to, or could reasonably be linked directly or indirectly with a particular California resident and includes certain categories of Personal Information discussed below that constitute "Sensitive Personal Information". The specific Personal Information that we collect, use, and disclose relating to a California resident covered by the CCPA will vary based on our relationship or interaction with that individual.

It is important to note that Personal Information does not include: (i) publicly available information from government records; (ii) deidentified or aggregated consumer information; or (iii) information excluded from the CCPA's scope, including personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (the "FCRA"), the Gramm-Leach-Bliley Act (the "GLBA") or California Financial Information Privacy Act (the "FIPA"), and the Driver's Privacy Protection Act of 1994. For example, information that we collect about California residents who apply for or obtain our financial products and services for personal, family, or household purposes fall under the scope of the GLBA, rather than the CCPA. For more information about how we collect, disclose, and secure information relating to these consumers, please refer to our www.wafdbank.com/privacy-center#privacy-policy.

Keeping Personal Information secure is one of our most important priorities. Consistent with our obligations under applicable laws and regulations, we maintain physical, technical, electronic, procedural, and organizational safeguards and security measures that are designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access, whether it is processed by us or elsewhere.

PERSONAL INFORMATION WE COLLECT

Personal Information: In the past 12 months, we have collected the following categories of Personal Information:

Sensitive Personal Information: Personal Information that reveals any of the information listed in the categories in the table below constitutes "Sensitive Personal Information". In the past 12 months, we have collected the following categories of Sensitive Personal Information:

PERSONAL INFORMATION SOURCES

The categories of sources from whom we collected the Personal Information and Sensitive Personal Information listed above include the following:

• Directly from you or an authorized agent or family member, through direct interactions and forms
• Service Providers and other third parties (e.g., credit bureaus or mortgage brokers)
• Directly and indirectly from activity on our Website, Mobile App, or Social Networks
• Through passive collection of information about your interactions, including page clicks, time spent, or other automatically collected meta-data Internet cookies
• Government Agencies and other publicly available sources

USE OF PERSONAL INFORMATION

We may use or disclose the Personal Information we collect for one or more of the following business purposes:

• To provide you with information, products, loans, or services that you request from us, including maintaining or servicing accounts, providing customer service, processing transactions, verifying customer identity, processing payments, or providing similar services
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
• To maintain, improve, upgrade, or enhance our products and services
• To carry out our obligations and enforce our rights arising from any contracts entered between you and us, including billing and collections
• Complying with laws and regulations and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes, or opinions)

SHARING PERSONAL INFORMATION

We may share your Personal Information and Sensitive Personal Information by disclosing it to a third party for a business purpose. In the preceding twelve (12) months, we have disclosed Personal Information and Sensitive Personal Information for a business purpose to the categories of third parties indicated in the charts below. We do not sell Personal Information or Sensitive Personal Information. In the preceding twelve (12) months, we have not sold the following categories of Personal Information or Sensitive Personal Information to the categories of third parties indicated in the charts below.

Personal Information:

Sensitive Personal Information:

YOUR RIGHTS UNDER THE CCPA

The CCPA provides California residents with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

Right to Know: You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive your request and confirm your identity (see Exercising Your Rights to Know, Delete, and Correct), we will disclose to you:

• The specific pieces of Personal Information we collected about you (also called a data portability request)
• The categories of Personal Information we collected about you
• The categories of sources for the Personal Information we collected about you
• The Personal Information categories sold or shared, if any, and the categories of third parties purchasing or receiving that Personal Information
• The Personal Information categories disclosed for a business purpose, if any, and the categories of persons receiving the Personal Information
• Our business or commercial purpose for collecting, selling, or sharing that Personal Information

Right to Delete: You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive your request and confirm your identity (see Exercising Your Rights to Know, Delete, and Correct), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which the Personal Information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform a contract you have entered into with us.
• Help ensure security and integrity to the extent the use of your Personal Information is reasonably necessary and proportionate for those purposes.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.

Right to Correct: You have the right to request that we correct any inaccuracies in your Personal Information we hold about you, considering both the Personal Information's nature and processing purposes. Upon receiving your request (see Exercising Your Rights to Know, Delete, and Correct), we will use commercially reasonable efforts to:

• Correct the Personal Information on our existing systems or alternatively, delete the contested Personal Information if the deletion does not negatively impact you or if you consent to such deletion.

Right to Opt-Out: You have the right to prevent the sale and sharing of your Personal Information to third parties at any time by requesting that we stop doing so (see Exercising Your Rights to Opt-Out).

Right to Limit Sensitive Personal Information: You have the right to limit how we use and disclose your Sensitive Personal Information by requesting that we restrict our use and disclosure of such Sensitive Personal Information to the "Permitted Sensitive Personal Information Purposes", which allow us to collect, use, and disclose Sensitive Personal Information for the following purposes, even after you exercise your limitation rights:

• To perform services or provide goods that an average consumer requesting those goods or services would reasonably expect.
• To prevent, detect, and investigate security incidents compromising Personal Information.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at our business and to prosecute those responsible for those actions.
• To ensure individuals' physical safety.

• For short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us, so long as we do not:

  • disclose your Sensitive Personal Information to another third party; or
  • use it to build a profile about you or otherwise alter your experience outside your current interaction with us.
• To perform services for the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing, storage, or providing similar services for the business.

• For products, services, or devices that we own, manufacture (directly or indirectly), or control, to:

  • verify or maintain the quality or safety of the product, service, or device; or
  • improve, upgrade, or enhance the service or device.
• For purposes that do not infer characteristics about you.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.

EXERCISING YOUR RIGHTS

Right to Know, Delete, and Correct: To exercise your rights to know, delete, or correct described above, please submit a request by either:

• 800-324-9375
• Completing a form online at: www.wafdbank.com/privacy-center#ccpa-request

Right to Opt-Out: To exercise your right to opt-out, please submit a request by either:

• 800-324-9375
• www.wafdbank.com/privacy-center#ccpa-request

Right to Limit Sensitive Personal Information: To exercise your right to limit Sensitive Personal Information, please submit a request by either:

• 800-324-9375
• www.wafdbank.com/privacy-center#ccpa-request

Submission and Response

Once you have submitted a request, we will acknowledge receipt of your request and advise you how long we expect it will take to respond if we are able to verify your identity. Also, we may ask you to describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. Only you or a person that you authorize to act on your behalf, may make a Verifiable Consumer Request, as defined in the CCPA, related to your Personal Information. You may also make a Verifiable Consumer Request on behalf of your minor child.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Additionally, we will not honor your request where an exception applies, such as where the disclosure of Personal Information would adversely affect the rights and freedoms of another consumer or where the Personal Information that we maintain about you is not subject to the CCPA's access or deletion rights. We will advise you in our response if we are not able to honor your request. We will not provide social security numbers, driver's license numbers or government issued identification numbers, financial account numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

Making a Verifiable Consumer Request does not require you to create an account with us. We will only use Personal Information provided in a Verifiable Consumer Request to verify the requestor's identity or authority to make the request.

We commit to respond to a Verifiable Consumer Request within 45 days of its receipt. If we require more time (up to a total of ninety (90) days), we will inform you of the reason and extension period in writing.

Authorized Agent

You may authorize an agent to exercise your rights on your behalf. When a request is submitted by an authorized agent, WaFd Bank will require the requestor to: (i) provide the authorized agent's written permission to do so; and (ii) will require the requestor to verify their own identity directly with WaFd Bank. If WaFd Bank is unable to verify the identity of the requestor or does not receive proof from the authorized agent that the requestor authorized the agent to act on the requestor's behalf, the request will be denied.

CHANGES TO THIS CCPA NOTICE

WaFd Bank may make periodic changes to this CCPA Notice. When these changes occur, we will post the new CCPA Notice on our website and change the "Last Updated" date. When appropriate, we may notify you through other means.

CONTACT FOR MORE INFORMATION

If you have any questions about this policy, please contact us at:

E-mail: privacy@wafd.com
Address: 425 Pike Street, Seattle, WA 98101
Toll Free Number: 800-324-9375

Last Updated: November, 2023

California Consumer Privacy Act (CCPA) Request

California Consumer Privacy Act Notice at Collection

Printer friendly version of Protecting Your Privacy

Washington Federal Bank ("we", "us", or "WaFd Bank") is collecting your personal information and sensitive personal information to support its business operations, including for the business purposes listed in the chart below.

We do not sell personal information, including any sensitive personal information. To view our full Privacy Policy, visit www.wafdbank.com/privacy-center#privacy-policy. You may also review and download our California Consumer Privacy Act Notice, which applies to California residents, by visiting www.wafdbank.com/privacy-center#ccpa-notice.

We may collect the personal information and sensitive personal information categories listed in the tables below. The tables also list, for each category, our expected retention period, use purposes, and whether we sell the information or share it with third parties for cross-context behavioral advertising.

As to all information collected as disclosed in this notice, WaFd does not retain Personal Information or Sensitive Personal Information for each disclosed purpose for which the Personal Information was collected for longer than is reasonably necessary for that purpose or as required by law.

Sensitive personal information is a subtype of personal information consisting of specific information categories. We may collect or use information that falls within the sensitive personal information categories listed in the table below to infer characteristics about a person.

If you have any questions about this Notice or need to access it in an alternative format due to having a disability, please contact us at privacy@wafd.com or 800-324-9375.

Last Updated: November, 2023

Cookie Policy

Printer friendly version of Cookie Policy

Cookies, Web Beacons, and Other Tracking Technologies

The technologies we use for the automatic data collection described above may include:

Cookies

A cookie is a small file placed on your computer's hard drive. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, online banking at WaFd requires cookies to be accepted by the browser. The cookies allow us to track how users navigate through our Website. It also allows us to collect unique information about the user's device, such as an IP address. The device information stored within a cookie is used throughout the online banking user authentication process. In addition, the information within the cookie is used by back-end fraud prevention systems. WaFd does not collect or store personal information within cookies.

The Website does not currently respond to "Do Not Track" ("DNT") browser signals. WaFd will continue to monitor the progress of the DNT technology as it develops into an industry standard.

Why Do We Use Cookies?

We use cookies for several reasons. Cookies help us to provide you with a good experience when you browse our Website and also allow us to improve our site. Through cookies, we can:

• Understand your browsing behavior to develop and improve our products and services in response to your needs or wants.
• Personalize our Website to you by remembering your preferences and settings.
• Improve the security of our Website by supporting security features and aiding in the detection of fraudulent or illegal activities.
• Measure and analyze traffic and browsing patterns to understand how our services are being used and how we can improve them.

Types of Cookies We Use

• Essential cookies: These are cookies that are required for the operation of our Website. They include, for example, cookies that enable you to log into secure areas of our Website.
• Analytical/performance cookies: They allow us to recognize and count the number of visitors and to see how visitors move around our Website when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users find what they are looking for easily.
• Functionality cookies: These are used to recognize you when you return to our Website. This enables us to personalize our content for you and remember your preferences.
• Targeting cookies: These cookies record your visit to our Website, the pages you have visited, and the links you have followed. We will use this information to make our Website, and the advertising displayed more relevant to your interests.

Web Beacons

Pages of our Website and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Other Tracking Technologies

Some content or applications, including advertisements, on the Website are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Website. The information they collect may be associated with your personal information, or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, contact the responsible provider directly for information about how to opt out of receiving targeted advertising from many providers.

Your Consent

By using our Website, you consent to our use of cookies in accordance with this Cookie Policy. If you do not agree to our use of cookies, please ensure you set your browser settings accordingly, or do not use our Website.

Changes to This Policy

We may update this policy from time to time. Any changes we may make to our Cookie Policy in the future will be posted on this page.