Evolve Bank and Trust Privacy Notice

Legal Rights & Agreement Rules · Context

Evolve Bank & Trust provides this privacy notice, revision 12/22

The notice identifies Evolve Bank & Trust as the institution providing it and carries the revision label "Rev. 12/22". Its heading frames the document as answering what Evolve does with personal information.

Supporting quotations

Rev. 12/22

| FACTS | WHAT DOES EVOLVE BANK & TRUST DO WITH YOUR PERSONAL INFORMATION? |

| Who is providing this notice? | Evolve Bank & Trust |

| Who we are | |

Qualifications & exceptions

• The source gives no effective date beyond the revision label "Rev. 12/22".

Not stated here

• The supplied text does not mention Affirm or identify which Affirm products or bank-partner programs it accompanies.
• The notice does not state its general geographic scope; state-specific terms appear only for Vermont, Nevada and California.

Legal Rights & Agreement Rules · Context

Federal law sets the notice's limited sharing controls

Evolve explains that financial companies choose how they share personal information, that federal law gives consumers the right to limit only some sharing, and that federal law requires the company to tell consumers how it collects, shares and protects their information.

Supporting quotations

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

Qualifications & exceptions

• The introductory section states that the right is limited but does not enumerate the sharing categories; the enumeration appears later in the notice.

Data Access & Collection · Company practice

Collected data varies by product and sharing survives membership

The types of personal information Evolve collects and shares depend on the product or service. The notice's examples include Social Security number, account transactions, payment history, account balances, credit history, and transaction or loss history. Evolve adds that it continues to share the information after the person is no longer a member, as described in the notice.

Supporting quotations

The types of personal information we collect and share depend on the product or service you have with us.

This information can include: ■ Social Security number and account transactions ■ payment history and account balances ■ credit history and transaction or loss history

When you are no longer our member, we continue to share your information as described in this notice.

Qualifications & exceptions

• The listed data types are examples ("can include"), not an exhaustive inventory.
• Post-membership sharing is stated without a separate retention period or end date.

Not stated here

• The notice does not state how long information is kept after the member relationship ends.

Sharing & Disclosure · Context

The sharing table reports reasons, Evolve's practice and limitability

Evolve says all financial companies need to share members' personal information to run everyday business. It then presents a table listing the reasons a financial company can share, whether Evolve chooses to share for that reason, and whether the consumer can limit that sharing.

Supporting quotations

| How? | All financial companies need to share members’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ or members’ personal information; the reasons Evolve Bank & Trust chooses to share; and whether you can limit this sharing. |

Qualifications & exceptions

• The table reports Evolve's stated choices for the listed reasons; the notice does not describe every operational sharing arrangement.

Sharing & Disclosure · Company practice

Everyday business sharing cannot be limited

Evolve answers "YES" to sharing for its everyday business purposes and "NO" to whether the consumer can limit it. The row gives processing transactions, maintaining accounts, responding to court orders and legal investigations, and reporting to credit bureaus as examples.

Supporting quotations

| Reasons we can share your personal information Does Evolve Bank & Trust share? Can you limit this sharing? For our everyday business purposes – such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus YES NO |

Qualifications & exceptions

• The examples follow "such as" and are not exhaustive.
• The stored text flattens the first row's cells ("YES NO"); the table header orders the answers as "Does Evolve Bank & Trust share?" then "Can you limit this sharing?", and the parallel rows preserve those two columns.

Not stated here

• The notice does not identify every recipient or legal process covered by this everyday-business reason.

Sharing & Disclosure · Company practice

Evolve shares for its own marketing, and consumers cannot limit it

Evolve answers "YES" to sharing personal information for its marketing purposes, described as offering its products and services, and "NO" to whether consumers can limit that sharing.

Supporting quotations

| For our marketing purposes – to offer our products and services to you | YES | NO |

Qualifications & exceptions

• The notice does not identify the marketing recipients or the channels used.

Not stated here

• Whether the marketing row covers affiliates, service providers or other third parties is not specified in the row.

Sharing & Disclosure · Company practice

Evolve shares for joint marketing, and consumers cannot limit it

Evolve answers "YES" to sharing for joint marketing with other financial companies and "NO" to whether consumers can limit it. The notice defines joint marketing separately as a formal agreement between nonaffiliated financial companies that together market financial products or services.

Supporting quotations

| For joint marketing with other financial companies | YES | NO |

A formal agreement between nonaffiliated financial companies that together market financial products or services to you.

Qualifications & exceptions

• The notice does not name its joint marketing partners.

Sharing & Disclosure · Company practice

Affiliates receive transaction and experience data without a limit

Evolve answers "YES" to sharing information about the consumer's transactions and experiences with affiliates for the affiliates' everyday business purposes, and "NO" to whether the consumer can limit that sharing.

Supporting quotations

| For our affiliates’ everyday business purposes – information about your transactions and experiences | YES | NO |

Qualifications & exceptions

• This row covers transaction and experience information; the following row addresses creditworthiness separately.

Sharing & Disclosure · Company practice

Evolve says it does not share creditworthiness data with affiliates

For affiliates' everyday business purposes involving information about the consumer's creditworthiness, the notice answers "NO" to sharing; the row's limit column reads "We don't share" rather than offering a limit.

Supporting quotations

| For our affiliates’ everyday business purposes – information about your creditworthiness | NO | We don’t share |

Qualifications & exceptions

• This is one of the three categories the notice later says federal law lets consumers limit, but Evolve states it does not share for this purpose.

Not stated here

• The notice does not say whether this practice could change or whether a consumer can request a limit in advance.

Sharing & Disclosure · Company practice

Evolve says it does not share for affiliates' marketing

The notice answers "NO" to sharing personal information for affiliates to market to the consumer; its limit column reads "We don't share" rather than offering a limit.

Supporting quotations

| For our affiliates to market to you | NO | We don’t share |

Qualifications & exceptions

• This is one of the three categories the notice later says federal law lets consumers limit; Evolve states it does not share for it.

Not stated here

• The notice does not state whether affiliates may market to a consumer through other data sources.

Sharing & Disclosure · Company practice

Evolve says it does not share for nonaffiliates' marketing

The notice answers "NO" to sharing personal information for nonaffiliates to market to the consumer; its limit column reads "We don't share" rather than offering a limit.

Supporting quotations

| For nonaffiliates to market to you | NO | We don’t share |

Qualifications & exceptions

• This is one of the three categories the notice later says federal law lets consumers limit; Evolve states it does not share for it.

Use & Processing · Procedure

Privacy questions go to a phone line or Evolve's website

The notice directs questions to 866-395-2754 or www.getevolved.com.

Supporting quotations

| Questions? | Call 866-395-2754 or go to www.getevolved.com |

Qualifications & exceptions

• This section gives no mailing address or email for privacy questions; a Nevada address appears later for marketing-call requests.

Not stated here

• The notice does not state response times or whether the phone line handles opt-out requests.

Security & Safeguards · Company commitment

Evolve describes federally compliant safeguards

Evolve says it protects personal information from unauthorized access and use with security measures that comply with federal law, including computer safeguards and secured files and buildings.

Supporting quotations

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.

| What we do |

Qualifications & exceptions

• The measures are described with "include", so the list is illustrative rather than complete.
• The notice does not describe specific technical controls, audits or breach procedures.

Not stated here

• The notice does not state how long safeguards apply or how incidents are handled.

Data Access & Collection · Company practice

Evolve collects from consumers and from outside sources

Evolve collects personal information when a consumer opens an account or provides account information, uses a credit or debit card or applies for financing, or gives contact information. It also collects from others, such as credit bureaus, affiliates or other companies.

Supporting quotations

| How does Evolve Bank & Trust collect my personal information? | We collect your personal information, for example, when you ■ open an account or provide account information ■ use your credit or debit card or apply for financing ■ give us your contact information We also collect your personal information from others, such as credit bureaus, affiliates, or other companies. |

Qualifications & exceptions

• The listed events follow "for example" and are not exhaustive.
• The outside sources follow "such as" and are examples.

Not stated here

• The notice does not identify every outside source or the data obtained from each.

Legal Rights & Agreement Rules · User right or choice

Federal law gives consumers three sharing opt-outs

The notice says federal law gives the consumer the right to limit only three categories: sharing with affiliates for their everyday business purposes about creditworthiness, affiliates' use of information to market to the consumer, and sharing with nonaffiliates for them to market to the consumer. It adds that state laws and individual companies may give additional rights and points to the state-law section below.

Supporting quotations

Federal law gives you the right to limit only ■ sharing for affiliates’ everyday business purposes – information about your creditworthiness ■ affiliates from using your information to market to you ■ sharing for nonaffiliates to market to you

Qualifications & exceptions

• The passage limits the federal right to the three listed categories and says state law or individual companies may add rights.

Not stated here

• How a consumer exercises any of the three limits is not described in the supplied text.

Linking & Identification · Context

Affiliates are commonly owned or controlled companies

The notice defines affiliates as companies related by common ownership or control, which can be financial or nonfinancial. It says Evolve's affiliates include companies with an Evolve name, such as Evolve Bancorp, Inc.

Supporting quotations

| Affiliates | Companies related by common ownership or control. They can be financial and nonfinancial companies. ■ Our affiliates include companies with an Evolve name, such as Evolve Bancorp, Inc. |

| Definitions |

Qualifications & exceptions

• The word "include" signals examples, not an exhaustive affiliate list.

Not stated here

• The notice does not list all affiliates or describe the ownership structure.

Sharing & Disclosure · Context

Nonaffiliates cover a wide range of possible recipients

Nonaffiliates are companies not related by common ownership or control, whether financial or nonfinancial. The notice says nonaffiliates it shares with can include insurance companies, service providers, co-branded partners, retailers, data processors, membership clubs, companies engaged in selling consumer products and services, financial services companies, banks and mortgage servicing companies.

Supporting quotations

| Nonaffiliates | Companies not related by common ownership or control. They can be financial and nonfinancial companies. ■ Nonaffiliates we share with can include insurance companies, service providers, co-branded partners, retailers, data processors, membership clubs, companies engaged in selling of consumer products and services, financial services companies, banks, and mortgage servicing companies. |

Qualifications & exceptions

• The recipient list follows "can include" and is not a statement that Evolve shares with every listed category.

Not stated here

• The notice does not name specific nonaffiliates or give a purpose for each category.

Sharing & Disclosure · Context

Joint marketing requires a formal agreement between financial companies

The notice defines joint marketing as a formal agreement between nonaffiliated financial companies that together market financial products or services to the consumer. It says its joint marketing partners include financial services companies and other financial institutions.

Supporting quotations

| Joint marketing | A formal agreement between nonaffiliated financial companies that together market financial products or services to you. ■ Our joint marketing partners include companies such as financial services companies and other financial institutions. . |

Qualifications & exceptions

• The description of partners uses "include companies such as", so the list is illustrative.

Not stated here

• The notice does not identify any joint marketing partner by name.

Sharing & Disclosure · Restriction or exception

Vermont mailing addresses receive automatic sharing limits

For accounts with a Vermont mailing address, the notice says the account is automatically treated as if the consumer had limited the sharing described on page 1. Evolve says it will not share information about the consumer with nonaffiliated third parties, except as permitted by law.

Supporting quotations

VT: Accounts with a Vermont mailing address are automatically treated as if they have limited the sharing described on page 1 and we will not share information about you with nonaffiliated third parties, except as permitted by law.

Qualifications & exceptions

• The rule is keyed to a Vermont mailing address on the account.
• The non-sharing commitment is qualified by "except as permitted by law", whose scope the notice does not detail.

Not stated here

• The notice does not explain what is permitted by law or whether the automatic treatment can be changed.

Legal Rights & Agreement Rules · Procedure

Nevada residents may join an internal do-not-call list

Nevada consumers who prefer not to receive marketing calls may be placed on Evolve's internal Do Not Call List by calling 1-866-395-2754 or writing to 6000 Poplar Ave, Suite 300, Memphis, Tennessee 38119. The notice also provides the Nevada Attorney General's consumer protection office contact details.

Supporting quotations

NV: If you prefer not to receive marketing calls from us, you may be placed on our Internal Do Not Call List by calling 1-866-395-2754 or by writing to us at 6000 Poplar Ave, Suite 300, Memphis, Tennessee 38119. For more information about telemarketing practices, contact us at the address in the preceding sentence.

You may also contact the Nevada Attorney General's office: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; telephone number: 1–702–486–3132; email BCPINFO@ag.state.nv.us.

Qualifications & exceptions

• The provision addresses marketing calls, not all sharing of personal information.
• The request is described as placement on an internal list; the notice does not state how quickly it takes effect.

Not stated here

• The notice does not say whether the internal list covers calls by affiliates or service providers.

Sharing & Disclosure · Restriction or exception

California law restricts nonaffiliate and intra-company sharing

Under California law, the notice says Evolve will not share information it collects about the consumer with nonaffiliated third parties except as permitted by law. It gives consent, servicing accounts and providing rewards or benefits as examples of permitted sharing, and says it will limit sharing among its companies to the extent California law requires.

Supporting quotations

CA: Under California law, we will not share information we collect about you with nonaffiliated third parties, except as permitted by law. For example, we may share information with your consent, to service your accounts, or to provide rewards or benefits you are entitled to. We will limit sharing among our companies to the extent required by California law.

Qualifications & exceptions

• The examples of permitted sharing follow "For example" and are not exhaustive.
• The intra-company limit is expressly tied to "the extent required by California law".

Not stated here

• The notice does not spell out the scope of "as permitted by law" or the specific California requirements.

Use & Processing · Company practice

Evolve may monitor and record telephone calls

If a consumer communicates with Evolve by telephone, Evolve says it may monitor and record the call.

Supporting quotations

Telephone Communications: If you communicate with us via telephone, we may monitor and record the call.

Qualifications & exceptions

• The permission is stated for calls with Evolve and does not name particular purposes or retention periods.

Not stated here

• The notice does not state how long recordings are kept or who may access them.

Legal Rights & Agreement Rules · Context

The three federal opt-out categories are all "We don't share" rows

The three categories the notice says consumers may limit under federal law are affiliate creditworthiness sharing, affiliates' marketing use and nonaffiliate marketing. The sharing table answers "NO / We don't share" for each of those same three rows. The notice does not describe how a consumer would submit a limit request or whether a request would apply to future practices.

Supporting quotations

Federal law gives you the right to limit only ■ sharing for affiliates’ everyday business purposes – information about your creditworthiness ■ affiliates from using your information to market to you ■ sharing for nonaffiliates to market to you

| For our affiliates’ everyday business purposes – information about your creditworthiness | NO | We don’t share |

| For our affiliates to market to you | NO | We don’t share |

| For nonaffiliates to market to you | NO | We don’t share |

Qualifications & exceptions

• This comparison uses the notice's own categories; it does not establish that an opt-out request is unavailable or unnecessary.

Not stated here

• Whether Evolve would record a limit request for future changes in practice is not stated.