Cross River Bank Privacy Policy

Data Access & Collection · Company practice

Categories of visitor and customer information the bank collects

The bank says it collects visitor and customer information in these categories: identifiers such as real name, postal address, IP address, email address and phone number; the categories of personal information listed in subdivision (e) of California Civil Code Section 1798.80; commercial information such as transaction information and payment history; internet or other electronic network activity information; and inferences drawn from that information.

Supporting quotations

We collect visitor and customer information from the following sources:

Identifiers such as a real name, postal address, Internet Protocol address, email address, phone number, or other similar identifiers.

Categories of personal information described in subdivision (e) of California Civil Code Section 1798.80.

Commercial information such as transaction information and payment history.

Internet or other electronic network activity information.

Inferences drawn from any of the information identified above.

Qualifications & exceptions

• The lead-in calls the list “sources,” but the items enumerate categories of information rather than collection channels.
• The California Civil Code Section 1798.80 reference is classified by its wording only; the cited statute is not reproduced in this source.

Not stated here

• The listed items do not state the collection channels or which categories apply to visitors as opposed to business clients.

Data Access & Collection · Company practice

Sensitive identifiers and account credentials collected

The policy lists sensitive information it collects: a business owner’s social security number, driver’s license, state identification card or passport number, and a customer’s account login, financial account, debit or credit card number combined with any required security code, password or credentials allowing access to an account.

Supporting quotations

Sensitive information such as a businessowner’s social security number, driver’s license, state identification card, or passport number, a customer’s account log in, financial account, debit card or credit card number in combination with any required security code, password or credentials allowing access to an account.

Qualifications & exceptions

• The items are attributed to a business owner or a customer; the list does not say whether website visitors who are neither also provide them.

Data Access & Collection · Context

“Nonpublic personal information” defined around customer business data

For the policy, nonpublic personal information means personally identifiable financial information a customer provides to Cross River Bank as a financial institution, that results from a transaction or a service performed for the customer’s business, or that the bank otherwise obtains as a financial institution.

Supporting quotations

For the purposes of this Privacy Policy, nonpublic personal information means any personally identifiable financial information provided by a customer to Cross River Bankas a financial institution, resulting from any transaction or any service performed for the customer’s business, or otherwise obtained by Cross River Bank as a financial institution.

Qualifications & exceptions

• The definition is tied to information provided by a customer and to the customer’s business, or otherwise obtained by the bank in its capacity as a financial institution.

Data Access & Collection · Company practice

California sensitive information: categories, purposes and limits

For California the bank identifies the sensitive personal information it collects: a business owner’s social security number, driver’s license, state identification card or passport number, and a customer’s account login, financial account, debit or credit card number combined with any required security code, password or credentials allowing account access. It says this information is collected to process transactions, comply with laws, manage its business or provide services, and that it does not use it for purposes not identified in the California Privacy Rights Act Section 1798.121.

Supporting quotations

California Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under California law): a business owner’s social security number, driver’s license, state identification card, or passport number, a customer’s account log in, financial account, debit card or credit card number in combination with any required security code, password or credentials allowing access to an account.

This information is collected in order to process transactions, comply with laws, manage our business, or provide services.

Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121.

Sensitive information such as a businessowner’s social security number, driver’s license, state identification card, or passport number, a customer’s account log in, financial account, debit card or credit card number in combination with any required security code, password or credentials allowing access to an account.

Qualifications & exceptions

• The stated purposes are processing transactions, legal compliance, managing the business and providing services.
• The purpose limit is tied to the cited California Privacy Rights Act section, whose text is not reproduced here.

Not stated here

• The source does not list the purposes that Section 1798.121 identifies, so the exact statutory limit cannot be read from this document alone.

Data Access & Collection · Company practice

Spanish version lists the same collection categories

The Spanish text says the bank collects information about visitors and clients from the following sources and lists identifiers; the categories described in subdivision (e) of Article 1798.80 of the California Civil Code; commercial information such as transaction information and payment history; internet or other electronic network activity information, with inferences drawn from it; and sensitive information such as a business owner’s social security number, driver’s license, identity document or passport number, and a client’s account login, financial account, debit or credit card with the required security code, password or credentials allowing account access.

Supporting quotations

Recogemos información sobre los visitantes y clientes de las siguientes fuentes:

Identificadores, tales como nombre real, dirección postal, dirección de protocolo de Internet, dirección de email, número de teléfono, u otros identificadores similares.

Categorías de información personal descritas en el subapartado (e) del Artículo 1798.80 del Código Civil de California.

Información comercial, como información sobre operaciones e historial de pagos.

Información sobre actividad en Internet u otras redes electrónicas. Conclusiones sacadas de la información antedicha.

Información sensible, como, por ejemplo, número de seguridad social, permiso de conducir, documento nacional de identidad o número de pasaporte, acceso a la cuenta de cliente, cuenta financiera, o tarjeta de débito o crédito del titular de un negocio, en combinación con el código de seguridad necesario, contraseña, o credenciales que permitan el acceso a una determinada cuenta.

Qualifications & exceptions

• The Spanish list puts internet activity information and inferences in one bullet, while the English list states them as separate items.
• The lead-in again says “fuentes” (sources) while the items enumerate categories of information.

Not stated here

• The list does not identify collection channels or attribute categories between visitors and business clients.

Data Access & Collection · Context

Spanish version defines nonpublic personal information the same way

For the policy’s purposes, “información personal no pública” means any personally identifiable financial information provided by a client to Cross River Bank as a financial institution, resulting from a transaction or a service performed for the client’s business, or otherwise obtained by the bank as a financial institution — the same definition the English text gives for nonpublic personal information.

Supporting quotations

A efectos de esta Política de Privacidad, ‘información personal no pública’ hace referencia a cualquier información financiera personal identificable, facilitada por un cliente a Cross River Bank como entidad financiera, y resultante de alguna operación o servicio realizado para el negocio del cliente, u obtenida de otro modo por Cross River Bank como entidad financiera.

Qualifications & exceptions

• The definition remains tied to a client’s business information or information the bank obtains as a financial institution.

Data Access & Collection · Company practice

Spanish version restates the California sensitive-information disclosure

The Spanish text lists sensitive personal information collected from California residents — a business owner’s social security number, driver’s license, national identity document or passport number, and a client’s account login, financial account, debit or credit card with the required security code, password or access credentials. It says the information is collected to process transactions, comply with laws, manage the business or provide services, is not used for purposes outside Article 1798.121 of the California Privacy Rights Act, and that the bank neither “sells” nor “shares” sensitive personal information for cross-context behavioral advertising.

Supporting quotations

Divulgación de información sensible en California. Recogemos las siguientes categorías de información personal sensible (según lo previsto en la legislación californiana): número de seguridad social, permiso de conducir, documento nacional de identidad o número de pasaporte, acceso a la cuenta de cliente, cuenta financiera, o tarjeta de débito o crédito del titular de un negocio, en combinación con el código de seguridad necesario, contraseña, o credenciales que permitan el acceso a una determinada cuenta.

Esta información se recoge para procesar operaciones, cumplir con las leyes, gestionar nuestro negocio o prestar servicios.

Tenga en cuenta que no utilizamos dicha información para fines que no estén recogidos en el Artículo 1798.121 de la Ley sobre Derechos de Privacidad de California.

No “vendemos” ni “compartimos” información personal sensible con fines de publicidad basada en el comportamiento en un contexto transversal.

Qualifications & exceptions

• The purpose limit is tied to the cited Article 1798.121, whose text is not reproduced here.
• The quoted terms “vendemos” and “compartimos” are the policy’s own.

Not stated here

• The source does not list the purposes that the cited Article identifies, so the statutory limit cannot be read from this document alone.