Evolve Bank and Trust Privacy Notice

Data Access & Collection · Company practice

Collected data varies by product and sharing survives membership

The types of personal information Evolve collects and shares depend on the product or service. The notice's examples include Social Security number, account transactions, payment history, account balances, credit history, and transaction or loss history. Evolve adds that it continues to share the information after the person is no longer a member, as described in the notice.

Supporting quotations

The types of personal information we collect and share depend on the product or service you have with us.

This information can include: ■ Social Security number and account transactions ■ payment history and account balances ■ credit history and transaction or loss history

When you are no longer our member, we continue to share your information as described in this notice.

Qualifications & exceptions

• The listed data types are examples ("can include"), not an exhaustive inventory.
• Post-membership sharing is stated without a separate retention period or end date.

Not stated here

• The notice does not state how long information is kept after the member relationship ends.

Data Access & Collection · Company practice

Evolve collects from consumers and from outside sources

Evolve collects personal information when a consumer opens an account or provides account information, uses a credit or debit card or applies for financing, or gives contact information. It also collects from others, such as credit bureaus, affiliates or other companies.

Supporting quotations

| How does Evolve Bank & Trust collect my personal information? | We collect your personal information, for example, when you ■ open an account or provide account information ■ use your credit or debit card or apply for financing ■ give us your contact information We also collect your personal information from others, such as credit bureaus, affiliates, or other companies. |

Qualifications & exceptions

• The listed events follow "for example" and are not exhaustive.
• The outside sources follow "such as" and are examples.

Not stated here

• The notice does not identify every outside source or the data obtained from each.