California Consumer Privacy Act Disclosure

Last updated May 6, 2024

Applicability

This privacy disclosure (“Notice”) explains how First Interstate Bank (individually and collectively “First Interstate,” “us,” “our,” or “we”) collect, use, and disclose personal information relating to California residents (also referred to as “you” or “consumer” in this Notice) covered by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA) (collectively “CCPA”), and its implementing regulations. This supplements our Online Privacy Policy.

Right to Know

California residents have the right to be informed of the categories and specific pieces of personal information collected about them, including sensitive personal information, collected, used, and disclosed, the categories of sources from which that information is collected, whether that information is sold or shared, the categories of third parties to whom that information has been disclosed, the business or commercial purposes for collecting and using each category of personal information, and the intended retention period for each category of personal information.

The below chart reflects the categories of personal information we have collected from California residents during the past twelve months, the categories of sources from which the information was collected, the business or commercial purpose for which the information was collected, the categories of third parties to whom we disclosed that information, and our anticipated retention period for each category of information.

Categories of Personal Information (as set forth in Cal. Civ. Code § 1798.140)	Sources of Collection	Business or Commercial Purpose for Collection	Categories of Third Parties Receiving Personal Information	Retention Period
1. Identifiers This may include: Name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers.	Directly from you; indirectly from you as you navigate or use our website, applications, or services; internet service providers; vendors that assist us in providing our services and running our internal business operations; data analytics providers; advertising networks; operating system suppliers; public databases; social media platforms; data append services; and other data providers. For job applicants: Recruiters and recruitment platforms; background check providers.	Fulfill or meet the reason you provided the information; provide you with our website, applications, products, and services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; to satisfy our legal obligations; market to you. For Job Applicants: Assess and process your application; satisfy legal obligations.	Technology service providers; data analytics providers; customer relationship management providers; marketing and advertisement providers and networks; social networks; operational support providers. For Job Applicants: Background check providers; human resource providers; technology providers and technology support services.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
2. California Customer Records Information This may include (per Cal. Civ. Code § 1798.80(e)): name, signature, social security number, physical characteristics or description, address, telephone number, government issued ID numbers, education, employment history, credit or debit card number, or other financial information, or medical or health insurance information.	Directly from you, including via interest forms, applications, and account profiles, dashboards, settings, or other information. For Job Applicants: Recruiters and recruitment platforms; background check providers.	Fulfill or meet the reason you provided the information; provide you with our website, applications, products, and services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; to satisfy our legal obligations; market to you. For Job Applicants: Assess and process your application.	Technology service providers; customer relationship management providers; operational support providers. For Job Applicants: Background check providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
3. Characteristics of protected classifications under CA or Federal Law This may include: age, veteran status, accommodations information, gender identity and expression, sexual orientation, and religion.	Directly from you. For Job Applicants: Recruiters and recruitment platforms; background check providers.	Meet our legal obligations.	For Job Applicants: Background check providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
4. Commercial Information This may include: records of personal property; products or services purchased, obtained, or considered; other purchasing or consuming histories or tendencies.	Directly from you; indirectly from you as your navigate our website, applications, or services; vendors that assist us in providing our services and running our internal business operations; data analytics providers; advertising networks; operating system suppliers; and other data providers.	Maintain transaction records; provide you with our products or services; provide you with advertising or marketing services.	Technology service providers; data analytics providers; customer relationship management providers; marketing and advertisement providers and networks; social networks; operational support providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
5. Biometric Information	Directly from you.	Fulfill or meet the reason you provided the information; provide you with our services; protect and secure our environment.	Technology service providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
6. Internet or other electronic network activity information This may include: browsing history, search history, information regarding your interaction with our websites, application, or advertisement.	Indirectly from you as you navigate or use our website, applications, or services; advertising networks; social media platforms; internet service providers; data analytics providers.	Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; verify, maintain, improve, upgrade, or enhance a service, website, applications or device that is owned or controlled by us; identify and repair errors; provide you with advertising or marketing services; perform analytics; satisfy legal obligations.	Advertising networks; technology service providers; data analytics providers; social media platforms.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
7. Geolocation Data This may be derived from your IP address, for example.	Indirectly from you; devices you use to access our website, applications, or services; advertising networks; data analytics providers.	Protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product, service, website or application; identify and repair errors; satisfy legal obligations.	Advertising networks; technology service providers; data analytics providers; social media platforms.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
8. Sensory Data This may include: audio recordings, electronic, visual, or similar information.	Directly from you.	Protect and secure our environment and physical facilities.	Not applicable.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
9. Professional or Employment Information This may include: employment application information (work history, academic, and professional qualifications).	Directly from you. For job applicants: Recruiters and recruitment platforms; background check providers.	Fulfill or meet the reason you provided the information and to provide certain services. For job applicants: Assess and process your application.	Job Applicants: Background check providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
10. Educational Information This may include: education records, degrees and vocational certificates obtained, report cards, and transcripts.	Directly from you. For job applicants: Recruiters and recruitment platforms; background check providers.	Fulfill or meet the reason you provided the information and to provide certain services. For job applicants: Assess and process your application.	Job Applicants: Background check providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
11. Inferences This may include: creating a profile or summary of an individual's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Indirectly from you; devices you use to access our website, applications, products, or services; advertising networks; social media platforms; data analytics providers.	Provide you with advertising or marketing services; perform analytics; maintain, improve, upgrade, or enhance our website, applications, products or services.	Advertising networks; technology service providers; data analytics providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.

Sensitive Personal Information Categories (per Cal. Civ. Code § 1798.140)	Sources of Collection	Business or Commercial Purpose for Collection	Categories of Third Parties Receiving Personal Information	Retention Period
Government Identifiers, such as social security number, driver’s license number, state identification card, or passport number.	Directly from you. For job applicants: Recruiters and recruitment platforms; background check providers.	Fulfill or meet the reason you provided the information; provide you with our website, applications, products, and services; protect and secure our environment. For job applicants: Assess and process your application.	Job Applicants: Background check providers	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
Citizenship or Immigration Information	Directly from you. For job applicants: Recruiters and recruitment platforms; background check providers.	· Fulfill or meet the reason you provided the information; provide you with our services.	Job Applicants: Background check providers	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
Account access credentials (usernames, account numbers, or card numbers combined with required access code, security code or password to access an account).	Directly from you.	· Fulfill or meet the reason you provided the information; provide you with our website, applications, products, and services; protect and secure our environment. For job applicants: Process your application.	Not applicable.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
Precise geolocation (location within a geographical area of a circle with a radius of 1850 feet or less).	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Racial or ethnic origin	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Religious or philosophical beliefs	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Union membership	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Genetic Data	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Mail, email, or text messages where the content is not directed to us.	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Unique identifying biometric information	Directly from you.	Fulfill or meet the reason you provided the information; provide you with our services; protect and secure our environment.	Technology service providers.	The length of your business relationship with us plus any legally required additional retention period for this category of personal information following conclusion of your business relationship with us or for the length of time necessary to fulfill our business purposes, whichever is longer.
Personal information collected and analyzed concerning health.	We do not collect.	Not applicable.	Not applicable.	Not applicable.
Personal information collected and analyzed concerning sex life, or sexual orientation.	We do not collect.	Not applicable.	Not applicable.	Not applicable.

In addition, each of the above referenced personal information categories may be shared with government agencies or other third parties as required by law or compelled by legal process; to assignees as part of a merger or asset sale; to respond to an emergency or otherwise protect the rights, property or security of our customers, third parties, or First Interstate; exercise or defend the legal rights of First Interstate and its employees, affiliates, customers, contractors, and agents; or to other parties at the request of the California resident (or to the California resident directly).

Right to Access

You have the right to request the categories and specific pieces of personal information we have collected about you.

Right to Limit Use and Disclosure of Sensitive Personal Information

We do not collect or process sensitive personal information for the purpose of inferring characteristics about consumers. We also do not disclose sensitive personal information for purposes other than those specified in section 7027(m) of the CCPA regulations promulgated by the California Privacy Protection Agency. Therefore, we do not offer consumers the option to limit the use of their sensitive personal information.

Right to Opt Out of Sharing for Cross-Context Behavioral Advertising

In the past twelve months we have used data about your activities on our Sites and Mobile Apps to serve you tailored ads. In the past twelve months, we have provided the following categories of personal information to advertising networks, data analytics providers, and social media networks for this purpose:

Personal identifiers (such as unique personal identifier, online identifier, internet protocol address, device information and identifiers, unique advertising identifiers and cookies); Commercial information; Internet and other electronic network activity information; Geolocation information; and Inference data.

If you would like to opt out of this sharing, you may exercise your right by contacting us as set forth in the “How to Exercise Your Rights” section below.

Right to Opt Out of Sale

While we do not sell personal information in exchange for monetary consideration, we do share personal information for other benefits that could be deemed a “sale,” under the CCPA. In the past twelve months, we have provided the following categories of information to advertising networks, data analytics providers, and social media networks in ways that could be considered a “sale” under California law:

We disclosed these categories of information to these third parties to market and advertise our products and services; perform analytics; and to maintain, improve, upgrade, or enhance our products or services. We have no actual knowledge of selling the personal information or sensitive personal information of minors under 16 years of age.

You have the right to opt out of the “sale” of your personal or sensitive personal information. If you would like to opt out of such disclosures, you may contact us as set forth in the “How to Exercise Your Rights” section below.

Right to Correct

You have the right to request that we correct any incorrect personal information that we collect or retain about you.

Right to Delete

You have the right to request deletion of the personal information we have collected from you.

Right of Non-Retaliation and Non-Discrimination

You have the right to exercise the privacy rights conferred to you under the CCPA without receiving retaliatory or discriminatory treatment. We do not discriminate against California residents who exercise their privacy rights.

How to Exercise Your Rights

If you, or your authorized representative, would like to exercise any of your rights as described in this Notice, please send an email to Privacy@fib.com or call us toll-free at 855-342-3400. When you contact us, identify the privacy right you would like to exercise and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. Requesters will need to provide us with personal information in order to verify their identity and residency, including name, email, and state of residence. We will compare the information you provide with our internal records.

Verifying Requests

To help protect your privacy and maintain security, we will take steps to verify your identity before fulfilling your request. We will only use the personal information collected during this verification process to verify your identity by comparing the data against our internal records.

If you submit a request on behalf of another person, we will also require proof of authorization and verification of identity directly from the person for whom you are submitting a request.

Changes to This Privacy Notice

Please review this Notice periodically, as we may change it from time to time. When we make changes to this Notice, we will revise the “Last Updated” date at the top of this document.

Print Disclosure