California Consumer Privacy Act | CCPA Disclosure

Effective Date: August 23, 2023

This California Consumer Privacy Act Disclosure (“CCPA Disclosure”) explains how SMBC MANUBANK collects, uses, and discloses personal information subject to the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”). It also describes the privacy rights of California residents under the CCPA and how they may exercise those rights.

This CCPA Disclosure applies solely to California residents and supplements all other applicable SMBC MANUBANK privacy policies and notices.

What Information is Covered by the CCPA?

Under the CCPA, “Personal Information” is defined as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.

The CCPA does not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this CCPA Disclosure does not apply to information that we collect about individuals that is subject to our U.S. Consumer Privacy Notice.

What Categories of Personal Information Does SMBC MANUBANK Collect?

Most of the information we have collected has been collected in the context of providing financial products and services, and therefore, is not subject to the CCPA. We also may collect Personal Information related to California residents in other contexts, including relative to our marketing activities, website traffic, or mobile applications.

In the past 12 months, we have collected the following categories of Personal Information, as defined in the CCPA, related to California residents. The examples provided in each category below are provided solely for illustrative purposes.

CCPA Category Examples

Identifiers: Name, address, email address, Social Security number, online identifiers, internet protocol address, or other similar identifiers

Personal information as defined in the California Customer Records Act, Cal. Civ. Code § 1798.80: Contact and financial information

Protected classifications under California or federal law: Age, marital status, sex, and veteran or military status

Commercial information: Information about past transactions or purchases

Biometric information: Voiceprints and behavioral characteristics derived from interactions with our websites or mobile apps

Internet or similar network activity information: Browsing history, search history, information about a consumer’s interaction with a website, application, or advertisement

Geolocation data: Device location

Audio, electronic, visual, or similar information: Call and video recordings

Inferences drawn from other personal information: Certain inferences concerning an individual’s preferences and characteristics

What Categories of Sensitive Personal Information (SPI) Does SMBC MANUBANK Collect?

SMBC MANUBANK may collect the following categories of SPI related to customers, employees, and/or job applicants (examples are provided solely for illustrative purposes):

Government ID — Social Security, driver’s license, state identification card, or passport number

Finances — account log‐in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account

Geolocation — precise geolocation

Race, religion and union membership — racial or ethnic origin, religious or philosophical beliefs, or union membership

Communications — contents of certain private communications

Biometrics — biometric information processed for the purpose of uniquely identifying a consumer

Health — personal information collected and analyzed concerning a consumer’s health

How Long Does SMBC MANUBANK Retain These Categories of Personal Information and Sensitive Personal Information?

As a regulated financial institution, SMBC MANUBANK is required to retain records of the above categories of Personal Information and Sensitive Personal Information to meet numerous legal, compliance, and auditability requirements. All Personal Information and Sensitive Personal Information is continuously assessed against and retained in a manner to maintain compliance with these requirements.

How Does SMBC MANUBANK Collect These Categories of Personal Information and Sensitive Personal Information?

SMBC MANUBANK may collect Personal Information and Sensitive Personal Information from the following categories of sources:

Directly from consumers
Service providers
Publicly available sources and registries
SMBC MANUBANK affiliates
Business partners
Third parties authorized to share information with us
Government entities

Why Does SMBC MANUBANK Collect These Categories of Personal Information and Sensitive Personal Information?

SMBC MANUBANK uses Personal Information and Sensitive Personal Information for the following purposes:

Providing products and services to consumers
Identifying and preventing fraud
Verifying your identity
Conducting data analysis and research
Improving products and services
Marketing and advertising
Maintaining internal systems and infrastructure
Ensuring compliance with all other applicable laws and regulations
Responding to civil, criminal, or regulatory requests
For any other use disclosed at, or before the point of collecting the Personal Information

SMBC MANUBANK may also use Personal Information for any one of the following specific “business purposes” described in the CCPA:

Auditing related to a current interaction with the consumer
Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity
Identifying and debugging errors that impair functionality
Permissible short-term transient use

Who Does SMBC MANUBANK Disclose Personal Information and Sensitive Personal Information To?

SMBC MANUBANK may disclose Personal Information and Sensitive Personal Information to the following parties:

Our parent company - Sumitomo Mitsui Banking Corporation ("SMBC")
Other SMBC affiliates
Business partners
Service providers
Third parties with whom you authorize or direct us to share your information
Government entities and others with whom we share information for legal or necessary purposes

In the past 12 months, we have not shared Personal Information relating to California residents in any manner that we consider a "Sale” or “Share” as defined by the CCPA.

Rights Under the CCPA

If you are a California resident, you may request that we disclose to you the following information covering the 12 months preceding your request:

The categories of non-exempt Personal Information that we have collected about you and the categories of sources from which we collected such personal information
The business or commercial purposes for collecting any non-exempt Personal Information
The categories of non-exempt Personal Information about you that we have disclosed to third parties for a business purpose, and the categories of third parties to whom we have disclosed such Personal Information
The specific pieces of non-exempt Personal Information we have collected about you

California residents also have the right to submit a request for deletion of non-exempt Personal Information, request to limit certain use of their SPI, and opt-out of automated decision making under certain circumstances. Although these rights apply only to non-exempt Personal Information or SPI and there may be legal, compliance, or business reasons that SMBC MANUBANK will need to retain and use the information.

How to Make Requests

If you are a California resident and would like to exercise your right as stated above, please submit your request by:

Our privacy portal: Submit a data subject access request
Emailing: [email protected]

To protect your information, we can only honor access or deletion requests upon receipt of a verifiable consumer request. Accordingly, we may require additional information to authenticate your identity before processing your request.