Customer Privacy and Data Protection Policy

Purpose

The purpose of this policy is to ensure that First Citizens Financial Bank (hereinafter referred to as "the Bank") handles all customer information with the utmost confidentiality and in compliance with applicable data protection laws and regulations. This policy outlines the Bank’s commitment to safeguarding personal data and maintaining customer trust.

Scope

This policy applies to all employees, contractors, and third-party service providers of the Bank who have access to customer data. It covers all forms of personal data, including electronic and paper records.

Data Collection and Use

The Bank will collect personal data only for legitimate business purposes, such as providing banking services, managing customer relationships, and complying with legal requirements. Personal data will be collected with the customer’s knowledge and consent, ensuring transparency regarding the purpose and use of the data.

Data Protection Principles

The Bank adheres to the following data protection principles:

Lawfulness, Fairness, and Transparency: Personal data will be processed lawfully, fairly, and in a transparent manner.
Purpose Limitation: Data will be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
Data Minimization: Only data necessary for the intended purpose will be collected and processed.
Accuracy: Personal data will be kept accurate and up-to-date. Inaccurate data will be corrected or deleted promptly.
Storage Limitation: Data will be retained only for as long as necessary to fulfill the purposes for which it was collected.
Integrity and Confidentiality: Appropriate security measures will be implemented to protect personal data against unauthorized access, alteration, or destruction.

Customer Rights

Customers have the following rights regarding their personal data:

Right to Access: Customers can request access to their personal data held by the Bank.
Right to Rectification: Customers can request correction of inaccurate or incomplete data.
Right to Erasure: Customers can request deletion of their personal data under certain conditions.
Right to Restrict Processing: Customers can request the restriction of data processing under specific circumstances.
Right to Data Portability: Customers can request a copy of their data in a structured, commonly used, and machine-readable format.
Right to Object: Customers can object to the processing of their personal data for direct marketing purposes.

Data Security Measures

The Bank will implement appropriate technical and organizational measures to ensure the security of personal data, including encryption, access controls, and regular security assessments.
Employees and contractors will receive regular training on data protection and privacy policies.

Third-Party Data Sharing

The Bank will not share personal data with third parties without the customer’s consent, except where required by law or necessary to provide banking services.
Third-party service providers who process personal data on behalf of the Bank must comply with data protection standards and enter into data processing agreements.

Data Breach Response

In the event of a data breach, the Bank will promptly assess the risk to customer data and take appropriate measures to mitigate the impact.
Customers will be notified of any data breaches that pose a high risk to their rights and freedoms.

Compliance and Monitoring

The Bank will regularly review and update this policy to ensure compliance with applicable laws and regulations.
The Bank will conduct periodic audits and assessments to monitor compliance with data protection policies and procedures.

Bank Policy