California Consumer Privacy Act Notice and Notice at Collection

(Last Updated: 03/26/2026)

As a financial institution, we safeguard customer financial information in accordance with the Gramm-Leach-Bliley Act (“GLBA”). We provide separate GLBA-required privacy notices to our customers. This California Consumer Privacy Act Notice at Collection ("Notice") is provided by Northwest Bank (also referred to as “Northwest”, “we”, or “us” in this Notice).

Your privacy is important to us.  This Notice describes how we collect, use, retain, and disclose personal information about California residents covered by the California Consumer Privacy Act of 2018, as amended and its implementing regulations (“CCPA”). This Notice serves as our notice at collection and our privacy policy pursuant to the CCPA.

Under the CCPA, "Personal Information" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household and includes certain categories of Personal Information that are considered “Sensitive Personal Information.” The CCPA does not apply to certain information, such as information subject to the GLBA.

The specific Personal Information we collect, use, retain, and disclose relating to a California resident covered by the CCPA will vary based on the product, service, or interaction with that individual.

• Personal Identifiers – such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
• Personal Information – including contact details (e.g., telephone number and address), financial information (e.g., account number and balance), payment card details (e.g., credit and debit card numbers), and medical and health insurance information.
• Characteristics of Protected Classes – such as sex, marital status, disability, and citizenship.
• Commercial Information – including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Biometric Information.
• Internet or other electronic activity information – such as browsing history, search history, and information regarding a California resident's interaction with an internet website application or advertisement.
• Geolocation data – such as device location.
• Audio and visual information – such as call and video recordings.
• Professional or employment-related information – such as work history, occupation, job title, and prior employer.
• Education Information – such as information directly related to a student and maintained by an educational agency or its third party.
• Inferences Information – such as information drawn from any of the Personal Information listed above to create a profile about a California resident reflecting their preferences, characteristics, predispositions, behavior, and attitudes.
• Employment Information – such as work history, information from background checks, resumes, and personal qualifications.
• Sensitive Personal Information – Personal Information that reveals the following about a California resident:
  • Sensitive identification numbers such as social security number, driver’s license, state identification card, or passport number
  • Access or login credentials such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
  • Precise geolocation
  • Racial or ethnic origin
  • Religious or philosophical beliefs
  • Biometric data
  • Health information

The sources from which we collect Personal Information depend on our interaction or relationship with a specific California resident.  We may obtain Personal Information from the following sources:

• Directly from the California resident 
• Consumer Reporting Agencies
• Government entities
• Employer of the California resident
• Outside companies from whom we collect Personal Information as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development.
• Outside companies that provide data to support activities such as fraud prevention, underwriting, and marketing.
• Direct interactions with the residents through our website, mobile app, or other third party digital applications.

We collect, use, retain, and disclose a California resident’s Personal Information for the following business and commercial purposes:

• Provide, maintain, and/or service an account.
• Provide and develop our services and products
• Marketing purposes 
• Data analytics or internal research purposes
• Debt collection purposes
• Compliance with legal and regulatory requirements
• Fraud prevention or security purposes
• Support job applicants and human resource management
• Manage customer concerns and complaints

Northwest has not sold any Personal Information to third parties in the preceding 12 months. Northwest does not share Personal Information with third parties for cross-context behavioral advertising purposes.

We may disclose the following to third parties:

• Personal Identifiers
• Personal Information
• Characteristics of Protected Classes
• Commercial Information
• Biometric Information
• Internet or other electronic activity information
• Geolocation data
• Audio and visual information
• Professional or employment-related information
• Education Information
• Inferences Information

We may disclose any of the above Personal Information to the following third parties:

• Service providers
• Your authorized representative or other designated party
• Consumer Reporting Agencies
• Government Entities
• Third party marketing and advertising technology providers
• Third party advertising partners including social media platforms
• Data analytics providers
• Data aggregation services

We may disclose Personal Information to the above third parties, including service providers, for the following purposes:

• For our everyday business purposes – such as to process your transactions, maintain accounts, respond to court orders and legal investigations, or report to credit bureaus
• For our marketing purposes to offer our products to you
• For joint marketing with other financial companies
• Detect and investigate security incidents
• Process and fulfill directions, maintain and service accounts, provide customer service, verify customer information, and process payments

We may collect the following categories of sensitive personal information:

• Sensitive identification numbers such as social security number, driver’s license, state identification card, or passport number
• Access or login credentials such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
• Precise geolocation
• Racial or ethnic origin
• Religious or philosophical beliefs
• Biometric data
• Health information

We may use Sensitive Personal Information for the following purposes:

• To ensure security and integrity of systems and accounts
• For short-term, transient use, including nonpersonalized advertising
• To perform services on behalf of Northwest and our customers
• To undertake activities to verify or maintain the quality or safety of a service, or to enhance the service

We retain Personal Information for as long as reasonably necessary to provide services, maintain records required by law, resolve disputes, enforce agreements, and meet regulatory and compliance requirements. Retention periods vary depending on the type of information and the reason it was collected.  We may need to hold records longer due to regulatory requirements or in response to a regulatory audit, investigation, or other legal matters.

If you are a California resident, you may may a request regarding the following rights related to the Personal Information we have collected under this notice.

• Know Information: The right to know what Personal Information we have collected including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom the business discloses Personal Information, and the specific pieces of Personal Information the business has collected about you.
• Delete: The right to delete Personal Information that we have collected, subject to certain exceptions.
• Correct: The right to correct inaccurate Personal Information that we collected about you. 
• Opt Out of Sale or Sharing: The right to opt out of the sale or sharing of Personal Information for the purpose of cross context behavioral advertising. In addition, our website provides you the opportunity to opt out of the sale or sharing of Personal Information for the purposes of cross context behavioral advertising. Our website responds to global privacy controls (also known as GPC) signals, which means that if we detect that your browser is communicating a GPC signal, we will process that as a request to opt that particular browser out of the sale and sharing via cookies and tracking tools on our website. 
• Non-Discrimination: The right not to be discriminated against for exercising any of these rights.

• We do not offer the right to limit our use and disclosure of Sensitive Personal Information because we do not use or disclose Sensitive Personal Information in such a manner as to require provision of the right

We have no actual knowledge that we collect or share Personal Information from consumers under 16 years of age.

We provide two methods for submitting a rights request:

• Option 1: Submit an online request
• Option 2: Contact us at 1-866-520-3601, Monday – Friday 8am to 8pm, Saturday 9am to 1pm, all times are eastern.

To verify your request, we will ask you to provide information to attempt to verify your identity using commercially reasonable methods as well as the Personal Information in our records. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. We will determine whether you have reached your request limit (no more than two for the preceding 12 months), determine whether you reside in California, and determine whether you are ineligible under any exception.  We may take up to 45 days to fulfill your request though we may extend the time to fulfill your request by another 45 days; however, we will notify you when we make this extension.  We will provide you with your response via your chosen communication method (mail or email).

Authorized agents may also submit a verifiable request on behalf of another consumer for whom they have been duly appointed. Authorized agents will be required to provide proof of authorization, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

We may change or update this Notice periodically. When we do, we will post the revised Notice on this webpage indicating when the Notice was “Last Updated.”

For questions or concerns about Northwest’s privacy policies and practices, please contact us at privacy@northwest.com

Much of the data that we handle is governed by privacy and data protections laws other than the CCPA.  Where these other laws apply, Personal Information including Sensitive Personal Information, may be exempt from, or outside the scope of, your rights outlined under “Requests Under the CCPA” above. As a result, we may decline all or part of your request to the extent that it relates to exempt Personal Information.  For example, Personal Information related to a consumer account used for personal, family, or household purposes and applications for such accounts are exempt from CCPA requests.  This data is subject to our Northwest Bank Privacy Notice available here.