Cross River Bank Privacy Policy

Legal Rights & Agreement Rules · Context

Policy covers website visitors and business clients, not individual clients

Cross River Bank describes this Online Privacy Policy as telling website users (“visitors”) and business clients (“customers”) what information it collects, how it uses it, and when it shares it with third parties. It states that an individual client of the bank is not covered by this Online Privacy Policy; that client’s information is described in a separate Cross River Bank Privacy Notice linked from the website homepage footer.

Supporting quotations

This privacy policy is designed to inform you of the types of information we collect from our website users (“visitors”) and from our business clients (“customers”).

if you are an individual client of Cross River Bank, our collection, use ,and sharing of your information is not governed by this Online Privacy Policy, and is discussed in our separate Cross River Bank’s Privacy Notice found in the footer of the homepage of our website

Qualifications & exceptions

• The named audiences are website visitors and business clients; an individual client of the bank is expressly outside this Online Privacy Policy.

Not stated here

• The separate Cross River Bank Privacy Notice linked from the homepage footer is not supplied in this source, so its terms are not analyzed here.

Legal Rights & Agreement Rules · Context

Version dated effective 12/2024 and last updated 7/2026

The page identifies the version it publishes with an effective date of 12/2024 and a last update of 7/2026. The policy later defines these two dates and states how amendments apply.

Supporting quotations

Effective Date: 12/2024

Last Update: 7/2026

Not stated here

• The source does not state here what the 7/2026 update changed or whether an earlier version remains applicable to information already submitted.

Data Access & Collection · Company practice

Categories of visitor and customer information the bank collects

The bank says it collects visitor and customer information in these categories: identifiers such as real name, postal address, IP address, email address and phone number; the categories of personal information listed in subdivision (e) of California Civil Code Section 1798.80; commercial information such as transaction information and payment history; internet or other electronic network activity information; and inferences drawn from that information.

Supporting quotations

We collect visitor and customer information from the following sources:

Identifiers such as a real name, postal address, Internet Protocol address, email address, phone number, or other similar identifiers.

Categories of personal information described in subdivision (e) of California Civil Code Section 1798.80.

Commercial information such as transaction information and payment history.

Internet or other electronic network activity information.

Inferences drawn from any of the information identified above.

Qualifications & exceptions

• The lead-in calls the list “sources,” but the items enumerate categories of information rather than collection channels.
• The California Civil Code Section 1798.80 reference is classified by its wording only; the cited statute is not reproduced in this source.

Not stated here

• The listed items do not state the collection channels or which categories apply to visitors as opposed to business clients.

Data Access & Collection · Company practice

Sensitive identifiers and account credentials collected

The policy lists sensitive information it collects: a business owner’s social security number, driver’s license, state identification card or passport number, and a customer’s account login, financial account, debit or credit card number combined with any required security code, password or credentials allowing access to an account.

Supporting quotations

Sensitive information such as a businessowner’s social security number, driver’s license, state identification card, or passport number, a customer’s account log in, financial account, debit card or credit card number in combination with any required security code, password or credentials allowing access to an account.

Qualifications & exceptions

• The items are attributed to a business owner or a customer; the list does not say whether website visitors who are neither also provide them.

Data Access & Collection · Context

“Nonpublic personal information” defined around customer business data

For the policy, nonpublic personal information means personally identifiable financial information a customer provides to Cross River Bank as a financial institution, that results from a transaction or a service performed for the customer’s business, or that the bank otherwise obtains as a financial institution.

Supporting quotations

For the purposes of this Privacy Policy, nonpublic personal information means any personally identifiable financial information provided by a customer to Cross River Bankas a financial institution, resulting from any transaction or any service performed for the customer’s business, or otherwise obtained by Cross River Bank as a financial institution.

Qualifications & exceptions

• The definition is tied to information provided by a customer and to the customer’s business, or otherwise obtained by the bank in its capacity as a financial institution.

Sharing & Disclosure · Company practice

Sharing with marketing, support and joint-marketing providers

The bank may disclose the information it collects to companies that perform marketing services for it, provide technology or management support, or are other financial institutions with which it has joint marketing arrangements. Third-party service providers that receive the information, such as loan stress testers and companies that originate or service loans, must use it only to provide services to the bank or as otherwise permitted by law.

Supporting quotations

Cross River Bank may disclose the information we collect, as described above, to companies that perform marketing services on our behalf or provide technology or management support to us or to other financial institutions with whom we have joint marketing arrangements. The third-party service providers who receive this information, such as loan stress testers and companies that originate or service loans, are required to use the information we share with them only to provide services to us, or as otherwise permitted by law.

Qualifications & exceptions

• Recipients are limited to using the shared information to provide services to the bank, or as otherwise permitted by law.

Sharing & Disclosure · Company practice

Sharing with corporate affiliates and prospective acquirers

The bank may share information with corporate affiliates such as its parent company, sister companies, subsidiaries, joint ventures or other companies under common control. If another company acquires, or plans to acquire, the bank, its business or its assets, the bank will also share information with that company, including at the negotiation stage.

Supporting quotations

We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage.

Qualifications & exceptions

• Sharing with a prospective acquirer begins at the negotiation stage, before any acquisition is completed.

Sharing & Disclosure · Company practice

Analytics and advertising partners, with browser-scoped opt-out

The bank uses third-party service providers such as Google Analytics to analyze its website and shares information about visitors’ website use with social media, advertising and analytics partners. It directs visitors who want to opt out of online tracking technologies such as cookies to its Cookies Settings, and states that any opt out applies only to the specific browser or device from which the visitor opts out.

Supporting quotations

We also utilize third party service providers to conduct analytics on our website, such as Google Analytics. Learn more about Google Analytics’ data practices by clicking here. We also share information about our visitors’ use of our website with our trusted social media, advertising, and analytics partners. To opt-out of online tracking technologies (e.g., cookies) refer to our

Cookies Settings

. Please note that any opt out will apply only to the specific browser or device from which is opted out.

Qualifications & exceptions

• Any opt out applies only to the specific browser or device from which it is made.
• The opt-out route named for online tracking is the site’s Cookies Settings.

Not stated here

• The Cookies Settings control and the Google Analytics help page are outside this source; their text and operation are not supplied here.

Legal Rights & Agreement Rules · Company practice

Disclosure in response to subpoenas, warrants and legal process

The bank may disclose information in response to subpoenas, warrants or court orders, in connection with any legal process, or to comply with relevant laws.

Supporting quotations

We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws.

Legal Rights & Agreement Rules · Company practice

Sharing to defend claims, investigate fraud or protect safety

The bank may share information to establish or exercise its rights, defend against a legal claim, investigate, prevent or take action regarding possible illegal activities, suspected fraud, the safety of a person or property, or a violation of its policies.

Supporting quotations

We may also share information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies.

Sharing & Disclosure · Company practice

Disclosure to third parties with consent or direction

The bank may disclose information to other third parties when it has consent or is directed to do so.

Supporting quotations

We may disclose information to other third parties when we have consent or are directed to do so.

Sharing & Disclosure · Company practice

Sharing with service providers for website and marketing support

The bank may share information with other service providers, which may help it administer the website, conduct surveys, assist in marketing and provide technical support.

Supporting quotations

We may share information with other service providers. Among other things service providers may help us to administer our website, conduct surveys, assist in marketing, and provide technical support.

Sharing & Disclosure · Company commitment

Phone numbers and text-message marketing data not shared for promotion

The bank states that it will not share a phone number, or other information collected for its text message marketing program, with third parties or affiliates for marketing or other promotional purposes.

Supporting quotations

Note that we will not share your phone number or other information collected for our text message marketing program with third parties or affiliates for marketing or other promotional purposes.

Qualifications & exceptions

• The commitment covers a phone number and other information collected for the text-message marketing program; it does not address other information or other purposes.

Use & Processing · Company practice

Information processed in the EU is brought to the US under GDPR safeguards

When information is processed in the European Union, the bank says it brings that information back to the United States applying mechanisms established by the EU’s General Data Protection Regulation 2016/679, in particular the Standard Contractual Clauses approved by the EU Commission.

Supporting quotations

When your information is processed in the European Union, we bring it back to the US applying the strict mechanisms established by the EU’s General Data Protection Regulation 2016/679 (“GDPR”), in particular the Standard Contractual Clauses approved by the EU Commission.

Qualifications & exceptions

• The named mechanism is the EU Commission-approved Standard Contractual Clauses; the clauses themselves are not reproduced in this source.

Not stated here

• The GDPR text and the Standard Contractual Clauses are external instruments not supplied here; this source does not state which entities are parties to them.

Security & Safeguards · Company practice

Access limited to staff with a business reason and safeguards maintained

The bank restricts access to customer information to associates, meaning persons it employs, who have a business reason for knowing the information. It educates associates about confidentiality and privacy of customer and consumer information, and maintains physical, electronic and procedural safeguards that comply with federal and international standards against unauthorized access.

Supporting quotations

We restrict access of customer information to those associates (persons employed by Cross River Bank) who have a business reason for knowing such information. We educate our associates about the importance of confidentiality and privacy of customer and consumer information. We maintain physical, electronic and procedural safeguards that comply with federal and international standards to protect customer information from unauthorized access.

Qualifications & exceptions

• “Associates” is defined in the source as persons employed by Cross River Bank.

Security & Safeguards · Context

Bank does not guarantee absolute security

The policy states that no security program is 100% secure, so the bank cannot guarantee the absolute security of information.

Supporting quotations

However, no security program is 100% secure, and thus we cannot guarantee the absolute security information.

Security & Safeguards · Procedure

Breach notice to customers where law requires it

If the bank is required by law to inform a customer of a breach of personal information, it may notify the customer electronically, in writing or by telephone, if the law permits it to do so.

Supporting quotations

In the event that we are required by law to inform the customer of a breach of personal information we may notify the customer electronically, in writing, or by telephone, if permitted to do so by law.

Qualifications & exceptions

• The notice commitment applies only where the bank is required by law to inform the customer, and only through channels the law permits.

Retention & Deletion · Company practice

Retention limited to the time needed for the policy’s purposes

The bank retains personal information only as long as necessary to fulfill the purposes outlined in the policy, including satisfying legal, accounting or reporting requirements, unless a longer period is required or permitted by law. It says the retention period is set by considering the amount, nature and sensitivity of the information, the risk of harm from unauthorized use or disclosure, the purposes of collection, whether those purposes can be met another way, and applicable legal requirements.

Supporting quotations

We retain personal information for only as long as necessary to fulfill the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required or permitted by law. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can achieve those purposes through other means, as well as applicable legal requirements.

Qualifications & exceptions

• A longer retention period applies where the law requires or permits one.
• The stated limits are purposes and legal requirements, not a fixed retention period.

Not stated here

• The source states no concrete retention period for any information category.

Legal Rights & Agreement Rules · User right or choice

California rights to know, confirm, delete and correct information

For California residents the policy lists rights to request disclosure of certain information about the collection and use of personal information over the past 12 months, to confirm that the bank holds personal information, to request more information about the categories of personal information, if any, shared with third parties or affiliates for those parties’ direct marketing, to request deletion of collected personal information, and to request changes to personal information.

Supporting quotations

For California residents, California law provides specific rights regarding personal information, including:

the right to request that we disclose certain information about our collection and use of personal information over the past 12 months.

the right to confirm that we have personal information.

the right to request more information concerning the categories of personal information (if any) we share with third parties or affiliates for those parties to use for direct marketing.

the right to request that we delete any personal information that we have collected, subject to certain exceptions.

the right to request that we make changes to personal information,

Qualifications & exceptions

• The deletion right is stated to be subject to certain exceptions.
• These rights are stated for California residents.

Not stated here

• The source does not enumerate the exceptions to the deletion right in this list.

Legal Rights & Agreement Rules · User right or choice

California opt-out of sale or sharing for behavioral advertising

California residents have the right to opt out of the sale of their personal information or of the sharing of their personal information for cross-context behavioral advertising. The policy says this right can be exercised by adjusting cookie settings.

Supporting quotations

the right to opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising. You can exercise this right by adjusting your cookie settings

here

Qualifications & exceptions

• The stated route for exercising the opt-out is adjusting cookie settings.
• The policy states elsewhere that any opt out applies only to the specific browser or device from which it is made.

Not stated here

• This section does not restate the browser-or-device limit on an opt-out, or say whether other opt-out channels exist for it.

Legal Rights & Agreement Rules · User right or choice

Text-message STOP and other targeted-advertising opt-outs

A California resident who receives a promotional text message can opt out of future text messages by replying “STOP.” The policy also says other forms of targeted advertising can be opted out of by contacting the bank using the contact information that follows.

Supporting quotations

If you receive a text message from us that contains promotional content, you can opt out of future text messages by replying "STOP."

. You may also opt out of other forms of targeted advertising by contacting us using the information below.

Qualifications & exceptions

• The STOP reply is described for text messages that contain promotional content.
• The other-targeted-advertising route is contacting the bank, not the cookie settings.

Legal Rights & Agreement Rules · Procedure

How to submit a California privacy rights request

Requests go to privacy@crossriver.com, 1-877-55CRB55, or Cross River Bank c/o Online Banking Department, 2115 Linwood Ave., Fort Lee, NJ 07024. A request must put “California Privacy Rights Request” in the first line of its description and include name, street address, city, state and ZIP code. The bank may ask the requester to verify identity with name, last name, driver’s license or California card ID number, and account numbers, and says it makes an official request for sensitive identifying information to ensure secure transmission.

Supporting quotations

To make such a request, contact us at privacy@crossriver.com, call 1-877-55CRB55, or send a written inquiry to Cross River Bank c/o Online Banking Department; 2115 Linwood Ave., Fort Lee, NJ 07024. Requests must include “California Privacy Rights Request” in the first line of the description and include name, street address, city, state, and ZIP code. If a request is submitted, we may ask to verify the customer’s identity by submitting: name, last name, driver’s license or California card ID number, and account number(s). Please note that the Bank will make an official request for sensitive identifying information to ensure secure transmission.

Qualifications & exceptions

• The request must be labeled “California Privacy Rights Request” and carry the stated address details.
• Identity verification may be required, including a driver’s license or California card ID number and account numbers.

Not stated here

• The source states no response deadline for a California rights request.

Legal Rights & Agreement Rules · User right or choice

No discrimination for exercising rights; agents may act in writing

Customers have the right not to be discriminated against for exercising California privacy rights. A customer may designate an agent in writing to exercise those rights, and the bank may require identity verification and documentation of the agent’s authorization before responding.

Supporting quotations

Customers also have the right not to be discriminated against if they exercise any rights under California privacy law. Customers may designate in writing an agent to exercise these rights on their behalf. Cross River Bank may require identity verification and provide documentation of the agent’s authorization before we respond to the request.

Qualifications & exceptions

• The bank may require identity verification and proof of the agent’s authorization.

Sharing & Disclosure · Company practice

Identifiers disclosed for business purposes and shared for advertising

In the past 12 months the bank may have collected identifiers such as a real name, postal address, IP address, email address, phone number or similar identifiers. It disclosed this category for a business purpose to affiliates or subsidiaries, business partners, data analytics providers, joint marketers, other service providers, financial institutions, professional services organizations and social networks, and shared it for cross-context behavioral advertising with advertising networks.

Supporting quotations

We may have collected the following categories of personal information of California residents in the past 12 months:

Identifiers such as a real name, postal address, Internet Protocol address, email address, phone number or other similar identifiers.

Disclosed for a business purpose: affiliates or subsidiaries, business partners, data analytics providers, joint marketers, other service providers, financial institutions, professional services organizations, social networks.

Sharing for cross context behavioral advertising: Advertising networks

Qualifications & exceptions

• The statement covers the past 12 months and uses “may have collected.”
• The recipient lists are stated per category, not for every category collectively.

Sharing & Disclosure · Company practice

Section 1798.80 categories disclosed for business purposes

In the past 12 months the bank may have collected the categories of personal information described in subdivision (e) of California Civil Code Section 1798.80. It disclosed this category for a business purpose to affiliates or subsidiaries, business partners, other service providers, financial institutions and professional services organizations.

Supporting quotations

Categories of personal information described in subdivision (e) of California Civil Code Section 1798.80.

Disclosed for a business purpose: affiliates or subsidiaries, business partners, other service providers, financial institutions, professional services organizations.

Qualifications & exceptions

• The source gives no cross-context behavioral advertising sharing line for this category; that omission is local to this row and does not establish that the category is never shared.

Not stated here

• The source does not identify which specific data elements fall within the cited Section 1798.80 categories.

Sharing & Disclosure · Company practice

Commercial information disclosed and shared for advertising

In the past 12 months the bank may have collected commercial information such as transaction information and payment history. It disclosed this category for a business purpose to affiliates or subsidiaries, business partners, data analytics providers, joint marketers, other service providers, professional services organizations and social networks, and shared it for cross-context behavioral advertising with advertising networks.

Supporting quotations

Commercial information.

Disclosed for a business purpose: affiliates or subsidiaries, business partners, data analytics providers, joint marketers, other service providers, professional services organizations, social networks.

Sharing for cross context behavioral advertising: Advertising networks

Qualifications & exceptions

• The recipient list for commercial information omits financial institutions, which appear on other rows.

Sharing & Disclosure · Company practice

Internet activity information disclosed and shared for advertising

In the past 12 months the bank may have collected internet or other electronic network activity information. It disclosed this category for a business purpose to affiliates or subsidiaries, business partners, data analytics providers, joint marketers, other service providers, financial institutions, professional services organizations and social networks, and shared it for cross-context behavioral advertising with advertising networks.

Supporting quotations

Internet or other electronic network activity information.

Disclosed for a business purpose: affiliates or subsidiaries, business partners, data analytics providers, joint marketers, other service providers, financial institutions, professional services organizations, social networks.

Sharing for cross context behavioral advertising: Advertising networks.

Sharing & Disclosure · Company practice

Inferences disclosed and shared for advertising

In the past 12 months the bank may have collected inferences drawn from the other listed information. It disclosed this category for a business purpose to affiliates or subsidiaries, business partners, other service providers, financial institutions and professional services organizations, and shared it for cross-context behavioral advertising with advertising networks.

Supporting quotations

Inferences drawn from any of the information identified above.

Disclosed for a business purpose: affiliates or subsidiaries, business partners, other service providers, financial institutions, professional services organizations.

Sharing for cross context behavioral advertising: Advertising networks.

Qualifications & exceptions

• The business-purpose recipient list for inferences omits data analytics providers, joint marketers and social networks, which appear on other rows.

Sharing & Disclosure · Company practice

No sale in past 12 months, but cross-context behavioral advertising continues

The bank states it has not sold California residents’ personal information in the past 12 months, but does engage in cross-context behavioral advertising using online tracking technologies. It directs residents to the opt-out described in the Information Sharing and California Privacy Rights sections. It may have disclosed any of the listed categories with the individual’s consent or under a written contract with a service provider for a business purpose in the past 12 months.

Supporting quotations

This information is collected and used for the purposes disclosed in this Privacy Policy. Cross River Bank has not sold personal information of California residents in the past 12 months. Cross-River does, however, engage in cross context behavioral advertising using online tracking technologies. You can opt-out of cross-context behavioral advertising as described in the Information Sharing and and California Privacy Rights sections above. Cross River Bank may have disclosed any of the above categories of personal information pursuant to an individual’s consent or under a written contract with a service provider for a business purpose in the past 12 months.

Qualifications & exceptions

• The no-sale statement is limited to the past 12 months.
• Cross-context behavioral advertising is stated as a current practice, so “no sale” does not mean no advertising-related sharing.
• Disclosures with consent or under a written service-provider contract are stated as possible in the same 12-month period.

Data Access & Collection · Company practice

California sensitive information: categories, purposes and limits

For California the bank identifies the sensitive personal information it collects: a business owner’s social security number, driver’s license, state identification card or passport number, and a customer’s account login, financial account, debit or credit card number combined with any required security code, password or credentials allowing account access. It says this information is collected to process transactions, comply with laws, manage its business or provide services, and that it does not use it for purposes not identified in the California Privacy Rights Act Section 1798.121.

Supporting quotations

California Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under California law): a business owner’s social security number, driver’s license, state identification card, or passport number, a customer’s account log in, financial account, debit card or credit card number in combination with any required security code, password or credentials allowing access to an account.

This information is collected in order to process transactions, comply with laws, manage our business, or provide services.

Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121.

Sensitive information such as a businessowner’s social security number, driver’s license, state identification card, or passport number, a customer’s account log in, financial account, debit card or credit card number in combination with any required security code, password or credentials allowing access to an account.

Qualifications & exceptions

• The stated purposes are processing transactions, legal compliance, managing the business and providing services.
• The purpose limit is tied to the cited California Privacy Rights Act section, whose text is not reproduced here.

Not stated here

• The source does not list the purposes that Section 1798.121 identifies, so the exact statutory limit cannot be read from this document alone.

Sharing & Disclosure · Company commitment

Sensitive information not sold or shared for behavioral advertising

The bank states that it does not “sell” or “share” sensitive personal information for purposes of cross-context behavioral advertising. The quoted terms are the policy’s own, and the section does not define them further here.

Supporting quotations

We do not “sell” or“ share” sensitive personal information for purposes of cross-context behavioral advertising.

Qualifications & exceptions

• The commitment is stated with the quoted terms “sell” and “share,” without a definition in this section.
• It is limited to sensitive personal information and to cross-context behavioral advertising.

Legal Rights & Agreement Rules · Procedure

EU data protection rules and how to exercise the listed rights

The policy says the EU General Data Protection Regulation lays down rules for protecting natural persons in the EU in relation to processing of their personal data, and defines personal data for the policy as any information relating to an identified or identifiable natural person. To exercise the rights described, it directs people to call toll-free 1-877-55CRB55, send a written inquiry to Cross River Bank c/o Online Banking Department, 2115 Linwood Ave., Fort Lee, NJ 07024, or email privacy@crossriver.com.

Supporting quotations

The European Union (“EU”) General Data Protection Regulation (“GDPR”) lays down rules relating to the protection of natural persons in the EU with regard to the processing of their personal data. For the purposes of this Privacy Policy, personal data means any information relating to an identified or identifiable natural person.

To exercise any of the rights described below, please contact our Group by calling toll-free at 1-877-55CRB55; by sending a written inquiry to Cross River Bank c/o Online Banking Department, 2115 Linwood Ave., Fort Lee, NJ 07024

Qualifications & exceptions

• The rights described are for people in the EU under the GDPR.

Not stated here

• The source states no response deadline for access, rectification, erasure or restriction requests; only portability states a period of up to 90 days.

Legal Rights & Agreement Rules · User right or choice

EU rights of access, rectification and erasure

People in the EU have the right to access, update, correct or delete their personal data, and the right to rectify inaccuracies in it.

Supporting quotations

Right to Access, Rectification, or Erasure. You have the right to access, update, correct, or delete your personal data. You also have the right to rectify any inaccuracies in your personal data.

Legal Rights & Agreement Rules · User right or choice

EU right to restrict processing, with stated exceptions

People in the EU may ask the bank to restrict processing of their personal data where it is inaccurate or unlawful, under contest, or no longer being processed for the original purpose. The bank may continue processing if necessary to resolve legal claims, protect another person’s rights, or for important public interest reasons, and says it will notify the person promptly if it objects to the restriction.

Supporting quotations

Right to Restrict Data Processing. You have the right to restrict the processing of your personal data upon request if it is (a) inaccurate or unlawful, (b) under contest, or (c) no longer being processed for the original purpose. Cross River Bank may continue to process the data if it is necessary to resolve legal claims, for the protection of the rights of another person, or for reasons of important public interest. If Cross River Bank objects to the restriction of data processing, we will notify you promptly after receiving your request.

Qualifications & exceptions

• The right applies to the three stated situations: inaccurate or unlawful data, data under contest, or data no longer processed for the original purpose.
• The bank may keep processing for legal claims, another person’s rights, or important public interest.

Legal Rights & Agreement Rules · User right or choice

EU data portability within 90 days

People in the EU can request and obtain the personal data they provided, or that the bank collected through their consent or contractual agreements. The bank says it provides the information in a commonly used, machine-readable format promptly but no longer than 90 days from the initial request, depending on complexity and volume, and will explain and suggest further steps if it cannot complete the request.

Supporting quotations

Right to Data Portability. You have the right to request and obtain your personal data that you provided to us or that we collected through your consent or contractual agreements. We will provide your information in a commonly used, machine-readable format promptly, but no longer than 90 days from the initial request depending on the complexity and volume of requests. If circumstances arise where we are unable to complete your request, we will promptly provide a relevant explanation, as well as inform you of additional steps that you may take.

Qualifications & exceptions

• The 90-day outside limit depends on the complexity and volume of requests.
• The right covers data the person provided or that was collected through consent or contractual agreements.

Retention & Deletion · Company practice

EU retention tied to legal obligations and service provision

For EU personal data the bank says it retains data to comply with legal obligations, resolve disputes and enforce its agreements, and retains personal information for as long as needed to provide its services, but no longer than necessary to fulfill the policy’s purposes.

Supporting quotations

Retaining Your Personal Information and Data. We will retain your personal data to comply with our legal obligations, resolve disputes, and enforce our agreements. We will retain your personal information for as long as needed to provide you with Cross River Bank services, but no longer than the period necessary to fulfill the purposes outlined in this Privacy Policy.

Qualifications & exceptions

• The stated retention grounds are legal obligations, dispute resolution, enforcing agreements and providing services.
• The policy’s purposes set the outer limit.

Use & Processing · Company commitment

Consent obtained before promotional emails

The bank says it will obtain consent before sending promotional, newsletter or product information emails it thinks may interest the recipient, and may obtain that consent through a website contact or consent form or by email.

Supporting quotations

Receiving Promotional and Other Communications. We will obtain your consent before sending you promotional, newsletter, or product information emails that we feel may interest you. We may obtain consent from you through a website contact or consent form or by email.

Qualifications & exceptions

• The commitment covers promotional, newsletter and product information emails.
• Consent may be collected through a website contact or consent form or by email.

Use & Processing · User right or choice

Opting out of promotional messages; non-promotional messages continue

A recipient can opt out by checking the relevant box on the communication consent form, following the opt-out instructions in the bank’s emails, or emailing a specific request. If the recipient opts out, the bank may still send non-promotional communications such as security alerts, notices about access to or use of its products or services, and notices about ongoing business relations.

Supporting quotations

You may opt out by either checking the relevant box on the communication consent form, by following the optout instructions provided in our emails to you, or by emailing us with your specific request.

If you opt out, we may still send you non-promotional communications, such as security alerts and notices related to your access to or use of any Cross River Bank products or services or about our ongoing business relations.

Qualifications & exceptions

• Three opt-out routes are stated: the consent-form box, email instructions, or an emailed request.
• Non-promotional communications are excluded from the opt-out.

Legal Rights & Agreement Rules · User right or choice

Withdrawing consent, and what may follow

A person may withdraw any consent previously given for processing of personal data. The bank says it will apply the preferences going forward within a reasonable time as required by applicable law, and may still process the data for limited purposes such as giving effect to the request or safeguarding its business. In some circumstances, withdrawing consent to use or disclosure means the person cannot use the bank’s products or services.

Supporting quotations

Withdrawing Your Consent. You may withdraw any consent you previously provided to us for the processing of your personal data. As required by applicable law, we will apply your preferences going forward, within a reasonable amount of time. Even where you withdraw your consent, we may still process your personal data for limited purposes, for example, to give effect to your request or to safeguard our business. In some circumstances, withdrawing your consent to our use or disclosure of your personal information will mean that you cannot use our products or services.

Qualifications & exceptions

• Preferences apply going forward, within a reasonable time, as required by applicable law.
• Limited processing may continue to give effect to the request or safeguard the business.
• Withdrawal can mean loss of access to the bank’s products or services in some circumstances.

Legal Rights & Agreement Rules · User right or choice

Right to complain to an EU supervisory authority

A person may complain to an EU supervisory authority if they believe their personal data was processed in a way that is not compliant with the GDPR, or if the bank cannot comply with the data portability right or does not respond to the request in a timely manner.

Supporting quotations

Lodging a Complaint with a Supervisory Authority. You have the right to submit a complaint to an EU supervisory authority if you believe that your personal data has been processed in a manner that is not compliant with the GDPR. You also have the right to submit a complaint to an EU supervisory authority if Cross River Bank is unable to comply with your right of data portability or does not respond to your request within a timely manner.

Qualifications & exceptions

• The complaint routes are a GDPR compliance concern, a portability failure, or a late response.

Legal Rights & Agreement Rules · Context

Summary repeats that the policy covers only visitors and business clients

The closing summary says the policy applies only to visitors to the bank’s website and to its business clients, and restates the bank’s commitment to maintaining the privacy of customer information as expressed in the policy.

Supporting quotations

We appreciate our customer’s business and we are committed to maintaining the privacy of our customer’s information, as expressed in this Privacy Policy. This Privacy Policy applies only to visitors to our website and our business clients.

This privacy policy is designed to inform you of the types of information we collect from our website users (“visitors”) and from our business clients (“customers”).

Qualifications & exceptions

• The summary repeats the exclusion of anyone who is neither a website visitor nor a business client.

Legal Rights & Agreement Rules · Company practice

Amendments, version dates and how a prior policy governs

The bank reserves the right to amend the privacy policy at any time. Where a change is material, the policy in place when personal information was submitted generally governs that information unless the bank receives consent to the new policy. The effective date is when the current version took effect, and the last updated date is when it was last substantively modified. On a material change the bank will attempt to notify people by email or a website pop-up.

Supporting quotations

We reserve the right to amend the Privacy Policy at any time. To the extent that our policy changes in a material way, the policy that was in place at the time that personal information was submitted to us will generally govern that information unless we receive consent to the new privacy policy. Our privacy policy includes an “effective” and “last updated” date. The effective date refers to the date that the current version took effect. The last updated date refers to the date that the current version was last substantively modified. If we make a material change to our privacy notice, we will attempt to notify you through email or through a website pop-up.

Qualifications & exceptions

• The prior policy “generally” governs earlier information, so the rule is not stated as absolute.
• Consent to the new policy displaces that default.
• Material-change notice is an attempt by email or website pop-up, not a guaranteed delivery.

Not stated here

• The source does not define a material change or state how consent to a new policy is obtained.

Legal Rights & Agreement Rules · Procedure

Contact route for privacy questions and alternative formats

Questions, comments or complaints about privacy practices, and requests to receive the privacy policy in an alternative format because of a disability, go to Customer Service at 1-877-55CRB55 or privacy@crossriver.com.

Supporting quotations

For questions, comments, or complaints concerning our privacy practices or the need to access this privacy policy in an alternative format due to having a disability, please contact Customer Service at 1-877-55CRB55

privacy@crossriver.com

Qualifications & exceptions

• The stated route is Customer Service by telephone or email.

Legal Rights & Agreement Rules · Context

Spain employment privacy notices are linked, not included

The page points readers to separate Cross River Technologies (Spain) employment-related privacy notices through a link. Those notices are a different document from this policy.

Supporting quotations

For Cross River Technologies (Spain) employment related privacy notices, click

here

Qualifications & exceptions

• The link concerns employment-related notices of Cross River Technologies (Spain), not consumer banking privacy.

Not stated here

• The linked Spain employment privacy notices are not supplied here; their text is not analyzed.

Legal Rights & Agreement Rules · Context

Israel employment privacy notices are linked, not included

The page points readers to separate Cross River Technologies (Israel) employment-related privacy notices through a link. Those notices are a different document from this policy.

Supporting quotations

For Cross River Technologies (Israel) employment related privacy notices, click

here

Qualifications & exceptions

• The link concerns employment-related notices of Cross River Technologies (Israel), not consumer banking privacy.

Not stated here

• The linked Israel employment privacy notices are not supplied here; their text is not analyzed.

Legal Rights & Agreement Rules · Context

Spanish version restates the policy’s visitor and business-client scope

A Spanish-language text headed “DECLARACIÓN DE PRIVACIDAD ONLINE” follows the English policy. Its introduction says it informs users of the website (“visitantes”) and business clients (“clientes”) about the data collected, its use and when it is shared with third parties, and it likewise states that an individual client of Cross River Bank is not governed by this Online Privacy Policy but by the separate Cross River Bank Privacy Notice linked from the website homepage.

Supporting quotations

DECLARACIÓN DE PRIVACIDAD ONLINE

La presente política de privacidad está diseñada para informarle de las clases de datos que recogemos de los usuarios de nuestro sitio web (“visitantes”) y de nuestros clientes empresariales (“clientes”).

si se trata de un cliente persona física de Cross River Bank, la recogida, uso y comunicación por nuestra parte de su información no se rigen por la presente Política de Privacidad Online, sino que se describe por separado en nuestro Aviso de Privacidad de Cross River Bank, que se encuentra a pie de la página principal de nuestro sitio web

This privacy policy is designed to inform you of the types of information we collect from our website users (“visitors”) and from our business clients (“customers”).

Qualifications & exceptions

• The Spanish text parallels the English introduction and does not present itself as a separate policy with different terms.

Not stated here

• The source does not state whether the Spanish or the English text controls if their wording diverges.

Data Access & Collection · Company practice

Spanish version lists the same collection categories

The Spanish text says the bank collects information about visitors and clients from the following sources and lists identifiers; the categories described in subdivision (e) of Article 1798.80 of the California Civil Code; commercial information such as transaction information and payment history; internet or other electronic network activity information, with inferences drawn from it; and sensitive information such as a business owner’s social security number, driver’s license, identity document or passport number, and a client’s account login, financial account, debit or credit card with the required security code, password or credentials allowing account access.

Supporting quotations

Recogemos información sobre los visitantes y clientes de las siguientes fuentes:

Identificadores, tales como nombre real, dirección postal, dirección de protocolo de Internet, dirección de email, número de teléfono, u otros identificadores similares.

Categorías de información personal descritas en el subapartado (e) del Artículo 1798.80 del Código Civil de California.

Información comercial, como información sobre operaciones e historial de pagos.

Información sobre actividad en Internet u otras redes electrónicas. Conclusiones sacadas de la información antedicha.

Información sensible, como, por ejemplo, número de seguridad social, permiso de conducir, documento nacional de identidad o número de pasaporte, acceso a la cuenta de cliente, cuenta financiera, o tarjeta de débito o crédito del titular de un negocio, en combinación con el código de seguridad necesario, contraseña, o credenciales que permitan el acceso a una determinada cuenta.

Qualifications & exceptions

• The Spanish list puts internet activity information and inferences in one bullet, while the English list states them as separate items.
• The lead-in again says “fuentes” (sources) while the items enumerate categories of information.

Not stated here

• The list does not identify collection channels or attribute categories between visitors and business clients.

Data Access & Collection · Context

Spanish version defines nonpublic personal information the same way

For the policy’s purposes, “información personal no pública” means any personally identifiable financial information provided by a client to Cross River Bank as a financial institution, resulting from a transaction or a service performed for the client’s business, or otherwise obtained by the bank as a financial institution — the same definition the English text gives for nonpublic personal information.

Supporting quotations

A efectos de esta Política de Privacidad, ‘información personal no pública’ hace referencia a cualquier información financiera personal identificable, facilitada por un cliente a Cross River Bank como entidad financiera, y resultante de alguna operación o servicio realizado para el negocio del cliente, u obtenida de otro modo por Cross River Bank como entidad financiera.

Qualifications & exceptions

• The definition remains tied to a client’s business information or information the bank obtains as a financial institution.

Sharing & Disclosure · Company practice

Spanish version restates sharing with marketing and service providers

The Spanish text says the bank may disclose collected information to companies that provide marketing services on its behalf or administrative or technological support, or to other financial entities with which it has joint marketing agreements. Third-party service providers receiving the information, such as credit-risk migration analysts and companies that originate or facilitate loans, must use it only to provide services to the bank or as the laws permit.

Supporting quotations

Cross River Bank podría divulgar la información que recogemos, según lo antedicho, a empresas que prestan servicios de marketing en nuestro nombre, o nos prestan soporte administrativo o tecnológico, o a otras entidades financieras con las que tenemos acuerdos de marketing conjuntos. Los terceros proveedores de servicios que reciben esta información, tales como los analistas de migración de riesgo crediticio y empresas que originan o facilitan créditos, deberán utilizar la información que les proporcionamos únicamente para prestarnos servicios a nosotros, o según les permitan las leyes.

Qualifications & exceptions

• The Spanish example for service providers reads “analistas de migración de riesgo crediticio” where the English text says “loan stress testers”; the use restriction is the same.
• Recipients may use the information only to provide services to the bank or as permitted by law.

Sharing & Disclosure · Company practice

Spanish version restates affiliate and acquisition sharing

The Spanish text says the bank may share information with affiliated companies such as a parent, group companies, subsidiaries, joint ventures or other companies under common control, and will also share information with a company that acquires or plans to acquire the bank, its business or assets, including during the negotiation phase.

Supporting quotations

Podremos compartir información con nuestras empresas afiliadas (por ejemplo, matriz, empresas del grupo, filiales, joint ventures, u otras compañías bajo control común). Si otra empresa adquiere, o planea adquirir, nuestra compañía, negocio o activos, también compartiremos información con tal empresa, incluso durante la fase de negociación.

Qualifications & exceptions

• The negotiation-phase sharing appears in the Spanish text as in the English.

Sharing & Disclosure · Company practice

Spanish version restates analytics, advertising partners and cookie settings

The Spanish text says the bank uses third-party providers such as Google Analytics to analyze the website and shares information about visitors’ use of the site with social media, advertising and analytics partners. For refusing online tracking technologies such as cookies it refers readers to the “Configuración de Cookies” section.

Supporting quotations

También utilizamos terceros proveedores de servicios para realizar análisis de nuestro sitio web, como Google Analytics. Puede obtener más información sobre las prácticas de Google Analytics con respecto a los datos, haciendo clic aquí. También compartimos la información sobre la utilización por parte de nuestros visitantes de nuestro sitio web con nuestros socios de confianza de redes sociales, publicidad y analistas. Para rechazar el uso de tecnologías de seguimiento en línea (por ejemplo, cookies), consulte nuestra sección

Configuración de Cookies

Qualifications & exceptions

• The opt-out route named is the site’s cookie settings, as in the English text.
• The browser-or-device limit on an opt-out is stated in the following Spanish paragraph, outside this packet’s primary blocks.

Not stated here

• The Google Analytics help page linked from this text is outside this source and is not supplied here.

Legal Rights & Agreement Rules · Company practice

Spanish version restates legal-process, rights and fraud disclosures

The Spanish text says the bank may disclose information in response to subpoenas, warrants or court orders, in relation to any judicial proceeding, or to comply with relevant laws, and may share information to obtain or exercise its rights, defend against legal claims, investigate, prevent or act on possible illegal activities, suspected fraud, the safety of persons or property, or breaches of its policies.

Supporting quotations

Podremos divulgar información en respuesta a citaciones, mandatos u ordenes judiciales, o con relación a cualquier procedimiento judicial, o para cumplir con las leyes relevantes. Asimismo, podremos compartir información a fin de obtener o ejercer nuestros derechos, defendernos frente a reclamaciones legales, investigar, impedir o emprender acciones con respecto a potenciales actividades ilícitas, supuestos fraudes, la seguridad de las personas o los bienes, o el incumplimiento de nuestras políticas.

Sharing & Disclosure · Company practice

Spanish version restates disclosure with permission or instructions

The Spanish text says the bank may also disclose information to other third parties when it has the corresponding permission or is given instructions to do so.

Supporting quotations

También podremos divulgar información a otros terceros, cuando dispongamos del correspondiente permiso o se nos dé instrucciones para hacerlo.

Sharing & Disclosure · Company practice

Spanish version restates sharing with other service providers

The Spanish text says the bank may share information with other service providers, which may help it administer the website, run surveys, assist with marketing and provide technical support.

Supporting quotations

Podríamos compartir información con otros proveedores de servicios. Entre otras cosas, los proveedores de servicios pueden ayudarnos a administrar nuestro sitio web, realizar encuestas, colaborar en las tareas de marketing, y proporcionarnos soporte técnico.

Sharing & Disclosure · Company commitment

Spanish version restates the text-message marketing data restriction

The Spanish text says the bank will not share the recipient’s phone number, or other information collected for its text-message marketing program, with third parties or affiliates for marketing or other promotional purposes.

Supporting quotations

Tenga en cuenta que no compartiremos su número de teléfono, u otra información recogida con respecto a nuestro programa de marketing mediante mensaje de texto, con terceros o filiales para fines de marketing u otros fines promocionales.

Qualifications & exceptions

• The commitment covers the phone number and other information collected for the text-message marketing program.

Use & Processing · Company practice

Spanish version restates EU-to-US transfers under GDPR safeguards

The Spanish text says that when information is processed in the European Union, the bank brings it back to the United States applying mechanisms established by the EU General Data Protection Regulation 2016/679 (“RGPD”), specifically the Standard Contractual Clauses approved by the EU Commission.

Supporting quotations

Cuando el tratamiento de su información se realiza en la Unión Europea, la devolvemos a EE.UU. aplicando los estrictos mecanismos establecidos por el Reglamento General de Protección de Datos 2016/679 de la UE (“RGPD”), en concreto las Cláusulas Contractuales Tipo aprobadas por la Comisión de la UE.

Qualifications & exceptions

• The clauses themselves are not reproduced in this source.

Not stated here

• The GDPR text and the Standard Contractual Clauses are external instruments not supplied here.

Sharing & Disclosure · Context

Spanish version limits an opt-out to the browser or device used

The Spanish text states that any exclusion (opt out) applies only to the specific browser or device from which the refusal is expressed.

Supporting quotations

. Tenga en cuenta que cualquier exclusión será de aplicación únicamente al navegador o dispositivo concreto desde el que exprese tal rechazo.

Qualifications & exceptions

• The block is a sentence fragment beginning with a period because extraction split it from the preceding cookie-settings sentence.
• The limit is stated for an opt-out expressed from a browser or device.

Security & Safeguards · Company practice

Spanish version restates staff access limits and safeguards

The Spanish text says the bank restricts access to a client’s information to associates (persons employed by Cross River Bank) who have a business reason to know it, trains associates on confidentiality and privacy of client and consumer information, and maintains physical, electronic and procedural safeguards meeting federal and international standards against unauthorized access.

Supporting quotations

Restringimos el acceso a su información como cliente a aquellos asociados (personas empleadas por Cross River Bank) que tienen un motivo empresarial para conocer dicha información. Formamos a nuestros asociados en la importancia de la confidencialidad y la privacidad del cliente y la información del consumidor. Disponemos de mecanismos de protección físicos, electrónicos y de procedimiento, que cumplen con los estándares federales e internacionales, para proteger su información como cliente frente al acceso no autorizado.

Qualifications & exceptions

• “Asociados” is defined in the source as persons employed by Cross River Bank.

Security & Safeguards · Context

Spanish version restates the security guarantee limit

The Spanish text states that no security system is 100% secure, so the bank cannot guarantee the absolute security of the client’s information.

Supporting quotations

No obstante, no existe sistema de seguridad 100% seguro, por lo que no podemos garantizar la absoluta seguridad de su información.

Security & Safeguards · Procedure

Spanish version restates breach notice where law requires it

The Spanish text says that if the bank is obliged by law to inform a client of a breach of personal information, it may notify the client electronically, in writing or by telephone, if the laws permit it.

Supporting quotations

En el supuesto de que estemos obligados por ley a informar al cliente de una violación de la información personal, podríamos notificar al cliente electrónicamente, por escrito o por teléfono, si así lo permitieran las leyes.

Qualifications & exceptions

• Notice applies only where the law obliges the bank to inform the client, and only through channels the law permits.

Retention & Deletion · Company practice

Spanish version restates retention limits and factors

The Spanish text says personal information is kept only for the time needed to fulfil the policy’s purposes, including legal, accounting or communication requirements, unless the laws require or permit a longer retention period. It lists the amount, nature and sensitivity of the information, the risk of harm from unauthorized use or disclosure, the purposes of collection, whether those purposes can be met another way, and applicable legal requirements as the factors for setting the period.

Supporting quotations

Conservamos la información personal, únicamente, durante el tiempo necesario para cumplir con los fines señalados en esta Política de Privacidad, incluso a efectos de satisfacer cualquier requisito legal, contable o de comunicación, a menos que las leyes requieran o permitan un plazo de conservación mayor. A fin de determinar el plazo de conservación oportuno relativo a la información personal, tenemos en cuenta el importe, naturaleza y carácter sensible de la información, el posible riesgo de daños derivado del uso o la divulgación de la información no autorizados, los fines para los que obtuvimos dicha información y si podemos alcanzar dichos fines a través de otros medios, así como los requisitos legales aplicables.

Qualifications & exceptions

• A longer period applies where the laws require or permit one.
• The text states no fixed retention period.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates the California rights list

The Spanish text says California residents have specific rights over personal information: to request disclosure of certain information about collection and use over the past 12 months, to confirm that the bank holds personal information, to request more information about categories shared, if any, with third parties or affiliates for their direct marketing, to request deletion subject to certain exceptions, and to request changes to personal information.

Supporting quotations

Si reside en California, las leyes de este lugar le otorgan derechos específicos con respecto a la información personal, incluido:

el derecho a solicitar que comuniquemos cierta información sobre el modo en que recogemos y utilizamos la información personal durante los últimos 12 meses.

el derecho a confirmar que disponemos de información personal.

el derecho a solicitar más información relativa a las categorías de información personal que compartimos (en su caso) con terceros o filiales de dichos terceros para su uso con fines de marketing directo.

el derecho a solicitar que eliminemos alguno de los datos de carácter personal que hubiéramos recabado, con ciertas excepciones.

el derecho a solicitar que realicemos cambios a la información personal.

Qualifications & exceptions

• The deletion right is subject to certain exceptions.
• The rights are stated for California residents.

Not stated here

• The source does not list the exceptions to deletion.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates the opt-out of sale or advertising sharing

The Spanish text gives California residents the right to reject the sale of their personal information or the sharing of their personal information for cross-context behavioral advertising, and says the right is exercised by adjusting cookie settings.

Supporting quotations

el derecho a rechazar la venta de su información personal ni compartiendo de su información personal para fines de publicidad basada en el comportamiento en un contexto transversal. Puede ejercer este derecho ajustando la configuración de cookies

aquí

Qualifications & exceptions

• The stated route is adjusting cookie settings.
• The browser-or-device limit on an opt-out appears in the preceding Spanish paragraph.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates the STOP reply and other ad opt-outs

The Spanish text says a recipient of a promotional text message can refuse future text messages by replying to it with the word “STOP,” and can opt out of other forms of targeted advertising by contacting the bank using the contact information provided below.

Supporting quotations

si recibe un mensaje de texto nuestro con contenido promocional, podrá rechazar la recepción de futuros mensajes de texto, contestando al mismo con la palabra "STOP"

. Asimismo, puede optar por no recibir otras formas de publicidad dirigida poniéndose en contacto con nosotros utilizando la información de contacto proporcionada a continuación.

Qualifications & exceptions

• The STOP reply covers promotional text messages.
• The other-targeted-advertising route is contacting the bank.

Not stated here

• The contact details are stated in the paragraph that follows, which is analyzed where it is a primary block.

Legal Rights & Agreement Rules · Context

Spanish text lists the California rights twice

After the first California rights list, the Spanish text repeats the same items — disclosure, confirmation, direct-marketing sharing details, deletion, correction, the sale or advertising opt-out and the STOP reply. The second opt-out item combines the cookie-settings route and the contact route in a single bullet.

Supporting quotations

el derecho a solicitar que comuniquemos cierta información sobre el modo en que recogemos y utilizamos la información personal durante los últimos 12 meses.

el derecho a confirmar que disponemos de información personal.

el derecho a solicitar más información relativa a las categorías de información personal que compartimos (en su caso) con terceros o filiales de dichos terceros para su uso con fines de marketing directo.

el derecho a solicitar que eliminemos alguno de los datos de carácter personal que hubiéramos recabado, con ciertas excepciones.

el derecho a solicitar que realicemos cambios a la información personal.

el derecho a rechazar la venta de su información personal ni compartiendo de su información personal para fines de publicidad basada en el comportamiento en un contexto transversal. Puede ejercer este derecho ajustando la configuración de cookies aquí. Asimismo, puede optar por no recibir otras formas de publicidad dirigida poniéndose en contacto con nosotros utilizando la información de contacto proporcionada a continuación.

si recibe un mensaje de texto nuestro con contenido promocional, podrá rechazar la recepción de futuros mensajes de texto, contestando al mismo con la palabra "STOP".

Qualifications & exceptions

• The repetition is present in the extracted source text and adds no new right or condition.
• The second pass states the same conditions, including the exceptions to deletion.

Not stated here

• The source does not explain why the rights appear twice.

Legal Rights & Agreement Rules · Procedure

Spanish version states the California request procedure

The Spanish text directs requests to privacy@crossriver.com, 1-877-55CRB55, or Cross River Bank c/o Online Banking Department, 2115 Linwood Ave., Fort Lee, NJ 07024. A request must put “California Privacy Rights Request” in the first line and include name, street name, city, state and postal code. The bank may ask the client to verify identity by giving name, surnames, driver’s license or California identity card number and account number(s), and says it makes a formal request for sensitive identifying information to ensure secure transmission. The English text states the same procedure with the same routes and required details.

Supporting quotations

Para realizar tal solicitud, puede ponerse en contacto con nosotros enviando un email a privacy@crossriver.com, llamando al 1-877-55CRB55, o enviando una solicitud por escrito a Cross River Bank c/o Online Banking Department; 2115 Linwood Ave., Fort Lee, NJ 07024. Las solicitudes deberán indicar, en la primera línea de la descripción, “California Privacy Rights Request” [solicitud sobre derechos de privacidad en California], e incluirán nombre, nombre de la calle, ciudad, estado y código postal. Si se presenta una solicitud, podemos pedir que se verifique la identidad del cliente, facilitando su nombre, apellidos, número de permiso de conducir o tarjeta de identidad de California, y número(s) de cuenta. Tenga en cuenta que el Banco realizará una solicitud formal con respecto a la información identificativa sensible, para garantizar una transmisión segura.

To make such a request, contact us at privacy@crossriver.com, call 1-877-55CRB55, or send a written inquiry to Cross River Bank c/o Online Banking Department; 2115 Linwood Ave., Fort Lee, NJ 07024. Requests must include “California Privacy Rights Request” in the first line of the description and include name, street address, city, state, and ZIP code. If a request is submitted, we may ask to verify the customer’s identity by submitting: name, last name, driver’s license or California card ID number, and account number(s). Please note that the Bank will make an official request for sensitive identifying information to ensure secure transmission.

Qualifications & exceptions

• The request label and address details are required.
• Identity verification may include a driver’s license or California ID card number and account numbers.

Not stated here

• The source states no response deadline for a California rights request.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates non-discrimination and authorized agents

The Spanish text says clients have the right not to be discriminated against for exercising any of their rights under California privacy laws. Clients may designate an agent in writing to exercise those rights, and the bank may require identity verification and documentation of the agent’s authorization before responding to the request.

Supporting quotations

Los clientes también tendrán derecho a no ser discriminados si ejercen cualquiera de sus derechos en virtud de las leyes de California en materia de privacidad. Los clientes podrán designar por escrito a un agente que ejerza tales derechos en su nombre. Cross River Bank podrá requerir que se verifique la identidad y se facilite documentación de la autorización del agente antes de que respondamos a la solicitud.

Qualifications & exceptions

• Identity verification and proof of the agent’s authorization may be required.

Sharing & Disclosure · Company practice

Spanish version lists identifiers and their recipients

In the past 12 months the bank may have collected identifiers such as a real name, postal address, IP address, email address, phone number or similar identifiers from California residents. It disclosed this category for business purposes to affiliates or subsidiaries, business partners, data analytics providers, associated companies, other service providers, financial institutions, professional services organizations and social networks, and shares it for cross-context behavioral advertising with advertising networks.

Supporting quotations

Podríamos haber recogido las siguientes categorías de información personal de residentes en California en los últimos 12 meses:

Identificadores, tales como nombre real, dirección postal, dirección de protocolo de Internet, dirección de email, número de teléfono u otros identificadores similares.

Divulgados con fines comerciales: filiales o subsidiarias, socios comerciales, proveedores de servicios de análisis de datos, empresas asociadas, otros proveedores de servicios, instituciones financieras, organizaciones de servicios profesionales, redes sociales.

Se comparten con fines de publicidad basada en el comportamiento en un contexto transversal: Redes publicitarias

Qualifications & exceptions

• The statement covers the past 12 months and uses “podríamos haber recogido” (we may have collected).

Sharing & Disclosure · Company practice

Spanish version lists the Section 1798.80 categories and recipients

For California residents the Spanish text lists the categories of personal information described in subdivision (e) of Article 1798.80 of the California Civil Code, disclosed for business purposes to affiliates or subsidiaries, business partners, other service providers, financial institutions and professional services organizations.

Supporting quotations

Categorías de información personal descritas en el subapartado (e) del Artículo 1798.80 del Código Civil de California.

Divulgadas con fines comerciales: filiales o subsidiarias, socios comerciales, otros proveedores de servicios, instituciones financieras, organizaciones de servicios profesionales.

Qualifications & exceptions

• The source gives no cross-context behavioral advertising sharing line for this category; that omission is local to this row and does not establish that the category is never shared.

Not stated here

• The source does not identify which data elements fall within the cited Article 1798.80 categories.

Sharing & Disclosure · Company practice

Spanish version lists commercial information and its recipients

The Spanish text lists commercial information collected from California residents in the past 12 months, disclosed for business purposes to affiliates or subsidiaries, business partners, data analytics providers, associated companies, other service providers, professional services organizations and social networks, and shared for cross-context behavioral advertising with advertising networks.

Supporting quotations

Información comercial.

Divulgada con fines comerciales: filiales o subsidiarias, socios comerciales, proveedores de servicios de análisis de datos, empresas asociadas, otros proveedores de servicios, organizaciones de servicios profesionales, redes sociales.

Se comparten con fines de publicidad basada en el comportamiento en un contexto transversal: Redes publicitarias

Qualifications & exceptions

• The Spanish recipient list for commercial information also omits financial institutions, as the English list does.

Sharing & Disclosure · Company practice

Spanish version lists internet activity information and its recipients

The Spanish text lists internet or other electronic network activity information, disclosed for business purposes to affiliates or subsidiaries, business partners, data analytics providers, associated companies, other service providers, financial institutions, professional services organizations and social networks, and shared for cross-context behavioral advertising with advertising networks.

Supporting quotations

Información sobre actividad en Internet u otras redes electrónicas.

Divulgada con fines comerciales: filiales o subsidiarias, socios comerciales, proveedores de servicios de análisis de datos, empresas asociadas, otros proveedores de servicios, instituciones financieras, organizaciones de servicios profesionales, redes sociales.

Se comparten con fines de publicidad basada en el comportamiento en un contexto transversal: Redes publicitarias.

Sharing & Disclosure · Company practice

Spanish version lists inferences and their recipients

The Spanish text lists inferences drawn from the other information, disclosed for business purposes to affiliates or subsidiaries, business partners, other service providers, financial institutions and professional services organizations, and shared for cross-context behavioral advertising with advertising networks.

Supporting quotations

Conclusiones sacadas de la información antedicha.

Divulgación con fines comerciales: filiales o subsidiarias, socios comerciales, otros proveedores de servicios, instituciones financieras, organizaciones de servicios profesionales.

Se comparten con fines de publicidad basada en el comportamiento en un contexto transversal: Redes publicitarias.

Qualifications & exceptions

• The business-purpose recipient list for inferences omits data analytics providers, associated companies and social networks, which appear on other rows.

Sharing & Disclosure · Company practice

Spanish version: no sale in past 12 months but advertising use continues

The Spanish text says the bank has not sold personal information of California residents in the past 12 months but has used cross-context behavioral advertising through online tracking technologies. It says residents may reject that advertising as provided in the earlier “Comunicación de la Información” section, and that the bank may have disclosed any of the listed categories in the past 12 months with the individual’s consent or under a written contract with a service provider for business purposes.

Supporting quotations

Esta información se recoge y utiliza para los fines divulgados en esta Política de Privacidad. Cross River Bank no ha vendido información personal de residentes en California en los últimos 12 meses. Cross-River sí ha utilizado, sin embargo, publicidad basada en el comportamiento en un contexto transversal, a través de tecnologías de seguimiento en línea. Podrá rechazar la publicidad basada en el comportamiento en un contexto transversal, según lo dispuesto en el apartado Comunicación de la Información, anterior. Cross River Bank podría haber divulgado, en los últimos 12 meses, cualquiera de las anteriores categorías de información personal, con el consentimiento de una persona física, o conforme a un contrato escrito con un proveedor de servicios para fines comerciales.

Qualifications & exceptions

• The Spanish opt-out cross-reference names only the “Comunicación de la Información” (Information Sharing) section; the English text names the Information Sharing and California Privacy Rights sections.
• The no-sale statement covers the past 12 months while advertising use is stated as continuing.

Data Access & Collection · Company practice

Spanish version restates the California sensitive-information disclosure

The Spanish text lists sensitive personal information collected from California residents — a business owner’s social security number, driver’s license, national identity document or passport number, and a client’s account login, financial account, debit or credit card with the required security code, password or access credentials. It says the information is collected to process transactions, comply with laws, manage the business or provide services, is not used for purposes outside Article 1798.121 of the California Privacy Rights Act, and that the bank neither “sells” nor “shares” sensitive personal information for cross-context behavioral advertising.

Supporting quotations

Divulgación de información sensible en California. Recogemos las siguientes categorías de información personal sensible (según lo previsto en la legislación californiana): número de seguridad social, permiso de conducir, documento nacional de identidad o número de pasaporte, acceso a la cuenta de cliente, cuenta financiera, o tarjeta de débito o crédito del titular de un negocio, en combinación con el código de seguridad necesario, contraseña, o credenciales que permitan el acceso a una determinada cuenta.

Esta información se recoge para procesar operaciones, cumplir con las leyes, gestionar nuestro negocio o prestar servicios.

Tenga en cuenta que no utilizamos dicha información para fines que no estén recogidos en el Artículo 1798.121 de la Ley sobre Derechos de Privacidad de California.

No “vendemos” ni “compartimos” información personal sensible con fines de publicidad basada en el comportamiento en un contexto transversal.

Qualifications & exceptions

• The purpose limit is tied to the cited Article 1798.121, whose text is not reproduced here.
• The quoted terms “vendemos” and “compartimos” are the policy’s own.

Not stated here

• The source does not list the purposes that the cited Article identifies, so the statutory limit cannot be read from this document alone.

Legal Rights & Agreement Rules · Procedure

Spanish version states the EU rights framework and contact routes

The Spanish text says the EU General Data Protection Regulation establishes rules for protecting natural persons in the EU in relation to processing of their personal data, and defines personal data as any information relating to an identified or identifiable natural person. To exercise the rights described, it directs people to contact the Group by calling toll-free 1-877-55CRB5, writing to Cross River Bank c/o Online Banking Department, 2115 Linwood Ave., Fort Lee, NJ 07024, or emailing privacy@crossriver.com.

Supporting quotations

El Reglamento General de Protección de Datos de la Unión Europea (“UE”) (“RGPD”) establece las normas relativas a la protección de las personas físicas en la UE, con respecto al tratamiento de sus datos de carácter personal. A efectos de la presente Política de Privacidad, la expresión ‘datos de carácter personal’ hace referencia a cualquier información relativa a una persona física identificada o identificable.

Para ejercer cualquiera de los derechos descritos a continuación, le rogamos se ponga en contacto con nuestro Grupo, llamando al teléfono gratuito 1-877-55CRB5; enviando una solicitud por escrito a Cross River Bank c/o Online Banking Department; 2115 Linwood Ave., Fort Lee, NJ 07024; o por email a privacy@crossriver.com.

Qualifications & exceptions

• The Spanish text prints the toll-free number as 1-877-55CRB5, one digit shorter than the 1-877-55CRB55 used in the English text and in the Spanish California request paragraph.
• The rights described are for people in the EU under the GDPR.

Not stated here

• The source states no response deadline for access, rectification, erasure or restriction requests; only portability states a period of up to 90 days.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates access, rectification and erasure rights

The Spanish text gives people the right of access, updating, correction or elimination of their personal data, and the right to rectify inaccuracies in it.

Supporting quotations

Derecho de acceso, rectificación o eliminación. Usted tendrá derecho de acceso, actualización, corrección o eliminación con respecto a sus datos de carácter personal. También tiene derecho a rectificar las imprecisiones de sus datos de carácter personal.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates the right to restrict processing

The Spanish text gives the right to restrict processing of personal data on request where it is inaccurate or unlawful, under challenge, or no longer being processed for its original purposes. The bank may continue processing if necessary to resolve legal claims, protect another person’s rights or for important public-interest reasons, and says it will notify the person immediately after receiving a request if it opposes the restriction.

Supporting quotations

Derecho a restringir el tratamiento de los datos. Tendrá derecho a restringir el tratamiento de sus datos de carácter personal previa solicitud, si (a) fuera impreciso o ilícito, (b) estuviera impugnado o (c) no se estuviera realizando ya para sus fines originales Cross River Bank podría continuar tratando sus datos si fuera necesario para resolver reclamaciones legales, para la protección de los derechos de otra persona, o por motivos importantes de interés público. Si Cross River Bank se opone a la restricción del tratamiento de datos, se lo notificaremos inmediatamente tras la recepción de su solicitud.

Qualifications & exceptions

• The source runs the list of grounds directly into the next sentence (“…sus fines originales Cross River Bank podría…”), so the boundary between the grounds and the following sentence is unclear in the text.
• The bank may continue processing for legal claims, another person’s rights or important public interest.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates portability within 90 days

The Spanish text gives the right to request and obtain personal data the person provided or that the bank collected through their contractual or consent agreements. The bank says it will provide the information quickly in a commonly used, machine-readable format and at most within 90 days of the initial request depending on complexity and volume, and will explain and suggest further steps if it cannot complete the request.

Supporting quotations

Derecho a la portabilidad de los datos. Tendrá derecho a solicitar y obtener sus datos de carácter personal que nos proporcionó, o que recogimos a través de sus acuerdos contractuales o de consentimiento. Le proporcionaremos rápidamente su información en formato de uso común y legible por máquina y, como máximo, dentro de los 90 días siguientes a la solicitud inicial, dependiendo de la complejidad y volumen de solicitudes. Si se diera alguna circunstancia por la que no podamos completar su solicitud, le ofreceremos oportunamente la explicación correspondiente, y le informaremos de los pasos adicionales que puede dar.

Qualifications & exceptions

• The 90-day outside limit depends on the complexity and volume of requests.
• The right covers data the person provided or that was collected through consent or contractual agreements.

Retention & Deletion · Company practice

Spanish version restates EU retention limits

The Spanish text says the bank keeps personal data to comply with legal obligations, resolve disputes and give effect to its agreements, and keeps personal information while needed to provide Cross River Bank services, but not beyond the period necessary for the policy’s purposes.

Supporting quotations

Conservación de su información y datos de carácter personal. Conservaremos sus datos de carácter personal para cumplir con nuestras obligaciones legales, resolver conflictos, y dar efecto a nuestros acuerdos. Conservaremos su información personal mientras se necesite para prestarle los servicios de Cross River Bank, aunque no más allá del período necesario para cumplir con los fines señalados en la presente Política de Privacidad.

Qualifications & exceptions

• The stated grounds are legal obligations, dispute resolution, enforcing agreements and providing services.

Use & Processing · Company commitment

Spanish version requires consent before promotional emails

The Spanish text says the bank will obtain consent before sending promotional emails, newsletters or product information emails it thinks may interest the recipient, and may obtain that consent through the website, a consent form or email.

Supporting quotations

Recepción de comunicaciones promocionales y otras. Obtendremos su consentimiento antes de enviarle emails promocionales, boletines informativos o emails con información sobre productos que entendemos puedan ser de interés para usted. Podremos obtener el consentimiento mediante contacto por el sitio web, formulario de consentimiento o por email.

Qualifications & exceptions

• The commitment covers promotional emails, newsletters and product information emails.
• Consent may be collected through the website, a consent form or email.

Use & Processing · User right or choice

Spanish version restates the promotional opt-out and its limits

A recipient can reject promotional messages by checking the relevant box on the communications consent form, following the exclusion instructions in the bank’s emails, or sending a specific request by email. If they do so, the bank may still send non-promotional communications such as security alerts and notices about access to or use of Cross River Bank products or services, or about existing business relations.

Supporting quotations

Podrá rechazarlo marcando la casilla relevante del formulario de consentimiento a comunicaciones, siguiendo las instrucciones de exclusión que se le faciliten en los emails que le enviemos, o enviándonos su solicitud concreta por email.

Si lo hace, puede que sigamos enviándole comunicaciones no promocionales, como alertas de seguridad y notificaciones relativas a su acceso a, o uso de, productos o servicios de Cross River Bank, o sobre nuestras relaciones comerciales existentes.

Qualifications & exceptions

• Three opt-out routes are stated: the consent-form box, instructions in the bank’s emails, or an emailed request.
• Non-promotional communications are excluded from the opt-out.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates withdrawal of consent and its effects

A person may withdraw consent previously given for processing of personal data. Where applicable law requires it, the bank will take the preferences into account going forward within a reasonable period, and may still process personal data for limited purposes such as giving effect to the request or protecting its business. In certain circumstances, withdrawing consent to use or disclosure means the person cannot use the bank’s products or services.

Supporting quotations

Retirada del consentimiento. Podrá retirar el consentimiento que nos haya otorgado previamente para el tratamiento de sus datos de carácter personal. Cuando lo requieran las leyes aplicables, tendremos en cuenta sus preferencias en el futuro, dentro de un período de tiempo razonable. Incluso cuando retire su consentimiento, podríamos continuar tratando sus datos de carácter personal para fines limitados, por ejemplo, para dar efecto a su solicitud o proteger nuestro negocio. En determinadas circunstancias, la retirada de su consentimiento a que utilicemos o divulguemos su información personal supondrá que no podrá utilizar nuestros productos o servicios.

Qualifications & exceptions

• Preferences apply going forward within a reasonable period where the law requires it.
• Limited processing may continue to give effect to the request or protect the business.
• Withdrawal can prevent use of the bank’s products or services in certain circumstances.

Legal Rights & Agreement Rules · User right or choice

Spanish version restates the supervisory-authority complaint right

The Spanish text gives the right to complain to an EU supervisory authority where the person believes their personal data was processed in breach of the GDPR, or where Cross River Bank cannot comply with the data portability right or does not respond to the request in a timely manner.

Supporting quotations

Presentar una reclamación ante la Autoridad Supervisora. Usted tendrá derecho a presentar una reclamación ante una autoridad supervisora de la UE, si estima que sus datos de carácter personal han sido tratados incumpliendo el RGPD. También tendrá derecho a presentar una reclamación ante una autoridad supervisora de la UE, si Cross River Bank no pudiera cumplir con el derecho que usted ostenta a la portabilidad de datos, o no responde a su solicitud de manera oportuna.

Qualifications & exceptions

• The complaint routes are a GDPR breach concern, a portability failure or a late response.

Legal Rights & Agreement Rules · Context

Spanish summary limits the policy to visitors and business clients

The Spanish closing summary restates the bank’s commitment to maintaining the privacy of client information as expressed in the policy, and says the policy applies only to visitors to its website and to its business clients.

Supporting quotations

Apreciamos el negocio de nuestros clientes y nos comprometemos a mantener la privacidad de la información de nuestros clientes, según lo dispuesto en la presente Política de Privacidad. Esta Política de Privacidad es sólo de aplicación a los visitantes de nuestro sitio web y a nuestros clientes empresariales.

Qualifications & exceptions

• The summary repeats that anyone who is neither a website visitor nor a business client is outside the policy.

Legal Rights & Agreement Rules · Company practice

Spanish version restates amendment and version governance

The Spanish text says the bank reserves the right to modify the policy at any time. Where the policy changes in any substantial respect, the policy in force when the personal information was provided generally governs that information unless the bank receives approval of the new privacy policy. It explains the “entrada en vigor” (effective) and “última actualización” (last updated) dates, and says a substantial change will be notified by attempting an email or a website pop-up message.

Supporting quotations

Nos reservamos el derecho a modificar la Política de Privacidad en cualquier momento. En la medida en que cambie nuestra política de privacidad en cualquier aspecto sustancial, la política que estuviera en vigor en el momento en que se nos facilitó la información personal regirá, en general, dicha información, a menos que recibamos la aprobación de la nueva política de privacidad. Nuestra política de privacidad incluye la fecha de “entrada en vigor” y la de “última actualización”. La fecha de entrada en vigor hará referencia a la fecha a partir de la cual la versión actual surte efectos. La fecha de última actualización hará referencia a la fecha en la que la versión actual fue modificada sustancialmente. Si realizamos un cambio sustancial a nuestro aviso de privacidad, intentaremos notificárselo a través de un email o a través de un mensaje emergente en el sitio web.

Qualifications & exceptions

• The Spanish text conditions the default on receiving “aprobación” (approval) of the new policy, where the English text says “consent.”
• The governing-policy rule is stated as general, not absolute.

Not stated here

• The source does not define a substantial change or state how approval of a new policy is obtained.
• The source does not say whether “aprobación” and the English text’s “consent” describe the same act.

Legal Rights & Agreement Rules · Procedure

Spanish version states the contact route for privacy questions

The Spanish text directs questions, comments or complaints about privacy practices, and requests for the policy in a different format because of a disability, to the Customer Service telephone number 1-877-55CRB55 or to privacy@crossriver.com.

Supporting quotations

Para formular preguntas, y realizar comentarios o quejas relativas a nuestras prácticas en materia de privacidad, o la necesidad de acceder a esta política de privacidad en un formato distinto por razones de discapacidad, le rogamos se ponga en contacto con el Servicio de Atención al Cliente en el teléfono 1-877-55CRB55, o mediante email dirigido a privacy@crossriver.com.

Qualifications & exceptions

• The phone number here matches the English text’s 1-877-55CRB55.

Legal Rights & Agreement Rules · Context

Spanish Spain-notice link points to a different URL than the English link

The Spanish text points readers to employment-related privacy notices for CRT (Spain) through a link labeled “aquí.” That link targets crossriver.com/legal/spanish-privacy-statements, while the English text’s Spain notice link targets crossriver.com/legal/spanish-privacy-notices.

Supporting quotations

Con relación a los avisos de privacidad en materia laboral en CRT (España), haga clic

aquí

Qualifications & exceptions

• The two language versions use different target URLs for the Spain employment notices.
• The Spanish text abbreviates Cross River Technologies as “CRT.”

Not stated here

• The source does not say whether the two Spain notice URLs lead to the same page; the linked notices themselves are not supplied here.

Legal Rights & Agreement Rules · Context

Spanish version links Israel employment notices separately

The Spanish text points readers to employment-related privacy notices for CRT (Israel) through a link labeled “aquí” to crossriver.com/legal/privacy-policy-crt, the same target the English text uses.

Supporting quotations

Con relación a los avisos de privacidad en materia laboral en CRT (Israel), haga clic

aquí

Qualifications & exceptions

• The target URL matches the English text’s Israel notice link.

Not stated here

• The linked Israel employment notices are not supplied here; their text is not analyzed.