1. Introduction
Heritage Community Bank ("we," "our," or "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our banking services, or interact with us in any capacity.
We operate in accordance with applicable federal and state privacy laws, including the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA) where applicable, and other relevant regulations governing financial institutions.
By using our services, you consent to the practices described in this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.
2. Information We Collect
2.1 Personal Data
We collect personal information that you provide directly to us, including:
- Identification Information: Full name, date of birth, Social Security number, driver's license number, passport number, and other government-issued identification.
- Contact Information: Mailing address, email address, telephone numbers, and preferred method of contact.
- Employment Information: Employer name, job title, work address, income, and employment history.
- Account Information: Account numbers, usernames, passwords, security questions, and account preferences.
2.2 Financial Data
We collect financial information necessary to provide banking services, including:
- Transaction Data: Deposit and withdrawal records, purchase history, payment records, and wire transfer details.
- Account Balances: Checking, savings, and investment account balances.
- Credit Information: Credit reports, credit scores, loan applications, debt obligations, and payment history.
- Tax Information: Tax identification numbers and relevant tax documents for reporting purposes.
2.3 Usage Data
When you use our website or digital services, we automatically collect:
- Device Information: Device type, operating system, browser type, and unique device identifiers.
- Log Data: IP address, access times, pages viewed, referring URLs, and navigation patterns.
- Location Data: General geographic location based on IP address or, with your consent, precise location from your device.
- Session Data: Login duration, features used, and error logs.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Account Management: To open, maintain, and service your accounts; process transactions; and provide customer support.
- Loan Processing: To evaluate loan applications, underwrite credit decisions, and service existing loans.
- Security and Fraud Prevention: To verify your identity, detect and prevent fraud, and protect against unauthorized access.
- Regulatory Compliance: To comply with federal and state laws, including anti-money laundering (AML) and Know Your Customer (KYC) requirements.
- Communication: To send account alerts, statements, and regulatory notices; and to respond to your inquiries.
- Product Improvement: To analyze usage patterns, improve our services, and develop new products and features.
- Marketing: With your consent, to inform you about products, services, and promotions that may interest you.
4. Data Security
We implement robust security measures to protect your personal and financial information:
- Encryption: All data transmitted between your device and our systems is encrypted using TLS 1.3 and 256-bit AES encryption.
- Multi-Factor Authentication: We require multi-factor authentication for online and mobile banking access.
- Firewalls and Intrusion Detection: Our systems are protected by enterprise-grade firewalls and continuous monitoring for suspicious activity.
- Regular Security Assessments: We conduct regular penetration testing, vulnerability scans, and third-party security audits.
- Physical Security: Our facilities employ access controls, surveillance, and environmental protections.
Despite our efforts, no method of transmission or storage is completely secure. If you suspect unauthorized access to your account, please contact us immediately.
5. Your Rights
Depending on your location, you may have the following rights regarding your personal information:
5.1 Right to Access
You have the right to request a copy of the personal information we hold about you. To submit an access request, contact our Privacy Officer using the information provided below.
5.2 Right to Correction
You may request correction of inaccurate or incomplete personal information. We will investigate and, if necessary, update your records.
5.3 Right to Deletion
You may request deletion of your personal information, subject to certain legal and regulatory retention requirements.
5.4 Right to Opt-Out
You may opt out of marketing communications at any time. You may also limit certain sharing of your information for marketing purposes.
6. How to Request Data Deletion
To request deletion of your personal information, follow these steps:
Step 1: Submit a Written Request
Send a written request to our Privacy Officer including:
- Your full name and current contact information
- The account number(s) or service(s) associated with your request
- A clear statement requesting deletion of your personal data
- A copy of valid government-issued identification
Step 2: Verification
We will verify your identity before processing your request. This may include additional security questions or documentation.
Step 3: Processing
Upon verification, we will process your request within 30 days. We will delete your personal information except where retention is required by:
- Federal or state banking regulations
- Tax reporting requirements
- Anti-money laundering laws
- Ongoing legal matters or disputes
- Legitimate business purposes
Step 4: Confirmation
We will notify you in writing when your request has been completed or if additional information is needed.
7. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:
We will respond to your inquiry within 30 days. If we need more time, we will notify you of the delay and the expected response date.