CELTIC BANK PRIVACY NOTICE

Legal Rights & Agreement Rules · Context

Celtic Bank provides this notice; no other entity is named

The form is Celtic Bank's FACTS privacy notice: the title asks what Celtic Bank does with the reader's personal information, and the 'Who is providing this notice?' entry names Celtic Bank. The supplied copy names no other entity, including Affirm, and it does not identify which Celtic Bank-issued accounts or programs it accompanies. That entry is the notice's statement of who provides it.

Supporting quotations

| FACTS | WHAT DOES CELTIC BANK DO WITH YOUR PERSONAL INFORMATION? |

| Who is providing this notice? | Celtic Bank |

Qualifications & exceptions

• The notice names only Celtic Bank; it does not mention Affirm or any product brand.

Not stated here

• Which Celtic Bank accounts or programs the notice accompanies is not stated in this copy.

Legal Rights & Agreement Rules · Context

Federal law supplies the notice's basis and a limited right to limit sharing

The 'Why?' entry says federal law gives consumers the right to limit some but not all sharing, and that federal law requires financial companies to tell consumers how they collect, share and protect personal information. The notice does not name the statute. The 'some but not all' scope is specified later under 'Why can't I limit all sharing?', which lists only three categories the right covers.

Supporting quotations

| Why? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |

Qualifications & exceptions

• The text refers to 'Federal law' without naming a statute.

Cross-references

• narrowed by (model-proposed): The federal right to limit sharing covers three listed categories — The general statement that federal law gives consumers the right to limit some but not all sharing is narrowed by the later section listing only three categories the right covers.

Data Access & Collection · Company practice

Collected and shared data types depend on the product

The types of personal information Celtic Bank collects and shares depend on the product or service the consumer has. The notice's examples are Social Security number and income, account balances and payment history, and credit history and credit scores. Because the list is introduced as what the information 'can include', it illustrates the kinds of data rather than listing every element.

Supporting quotations

| What? | The types of personal information we collect and share depend on the product or service you have with us. This information can include:  Social Security number and income  Account balances and payment history  Credit history and credit scores

Qualifications & exceptions

• The examples are introduced by 'can include' and are not a complete list.

Retention & Deletion · Company practice

Sharing continues after the customer relationship ends

The notice states that when a person is no longer Celtic Bank's customer, Celtic Bank continues to share their information as described in this notice. No duration, deletion point or end date is stated for that continued sharing. The notice's sharing table is the description it refers to; the only YES answer in that table is everyday business purposes.

Supporting quotations

When you are no longer our customer, we continue to share your information as described in this notice.

| For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus | YES | NO |

Qualifications & exceptions

• No time limit or deletion commitment is stated; the sentence refers to sharing 'as described in this notice'.

Not stated here

• Whether records are later deleted under another policy is not stated in this copy.

Sharing & Disclosure · Context

The table separates reason, Celtic Bank's answer and limitability

The notice explains that all financial companies need to share customers' personal information to run their everyday business. For each listed reason it gives Celtic Bank's answer and whether the consumer can limit the sharing. In the limit column, 'NO' means the consumer cannot limit that sharing, while 'We don't share' marks a reason Celtic Bank answers that it does not share.

Supporting quotations

| How? | All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Celtic Bank chooses to share; and whether you can limit this sharing. |

| Reasons we can share your personal information | Does Celtic Bank share? | Can you limit this sharing? |

Sharing & Disclosure · Company practice

Celtic Bank shares for everyday business and consumers cannot limit it

Celtic Bank answers YES to sharing personal information for its everyday business purposes and NO to whether the consumer can limit that sharing. The notice's examples are processing transactions, maintaining accounts, responding to court orders and legal investigations, and reporting to credit bureaus; 'such as' makes them illustrations of the category. Every other listed reason is answered NO.

Supporting quotations

| For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus | YES | NO |

| Reasons we can share your personal information | Does Celtic Bank share? | Can you limit this sharing? |

Qualifications & exceptions

• The consumer cannot limit this sharing according to the table's 'Can you limit this sharing?' column.
• The examples are introduced by 'such as' and are not exhaustive.

Sharing & Disclosure · Company practice

Celtic Bank answers NO to sharing for its own marketing

For Celtic Bank's marketing purposes, described as offering its products and services to the consumer, the notice answers NO to sharing and 'We don't share' in the limit column. The card concerns Celtic Bank's own marketing; affiliates and nonaffiliates marketing are separate rows.

Supporting quotations

| For our marketing purposes— to offer our products and services to you | NO | We don’t share |

| Reasons we can share your personal information | Does Celtic Bank share? | Can you limit this sharing? |

Qualifications & exceptions

• 'We don't share' appears in the 'Can you limit this sharing?' column, consistent with the NO answer to sharing.

Sharing & Disclosure · Company practice

Celtic Bank does not jointly market with other financial companies

The notice answers NO to sharing for joint marketing with other financial companies and states 'We don't share'. The definitions describe joint marketing as a formal agreement between nonaffiliated financial companies that together market financial products or services, then state 'Celtic Bank does not jointly market.' Both entries point to no joint-marketing sharing under this notice.

Supporting quotations

| For joint marketing with other financial companies | NO | We don’t share |

| Joint marketing | A formal agreement between nonaffiliated financial companies that together market financial products or services to you.  Celtic Bank does not jointly market. |

| Reasons we can share your personal information | Does Celtic Bank share? | Can you limit this sharing? |

Sharing & Disclosure · Company practice

Celtic Bank answers NO to all listed affiliate sharing

Celtic Bank answers NO, with 'We don't share', to each listed affiliate reason: affiliates' everyday business purposes involving transaction and experience information, affiliates' everyday business purposes involving creditworthiness information, and affiliates marketing to the consumer. The definitions add that Celtic Bank 'does not share with our affiliate'; that sentence is unqualified and uses the singular, without naming the affiliate. Read together, the notice states no affiliate sharing for the listed purposes and no sharing with 'our affiliate'.

Supporting quotations

| For our affiliates’ everyday business purposes— information about your transactions and experiences | NO | We don’t share |

| For our affiliates’ everyday business purposes— information about your creditworthiness | NO | We don’t share |

| For our affiliates to market to you | NO | We don’t share |

| Affiliates | Companies related by common ownership or control. They can be financial and nonfinancial companies.  Celtic Bank does not share with our affiliate. |

| Reasons we can share your personal information | Does Celtic Bank share? | Can you limit this sharing? |

Qualifications & exceptions

• The definition's negative sentence is unqualified and uses the singular 'our affiliate'.
• Affiliate creditworthiness sharing and affiliate marketing are two of the three categories the limit section says federal law lets consumers limit; the table answers both NO.

Not stated here

• The supplied copy does not identify Celtic Bank's affiliates.

Cross-references

• referred to by (model-proposed): The federal right to limit sharing covers three listed categories — The limit section names affiliate creditworthiness sharing and affiliate marketing; the affiliate card records Celtic Bank's NO answers to those same categories.

Sharing & Disclosure · Company practice

Celtic Bank does not share with nonaffiliates for their marketing

The notice answers NO, 'We don't share', to nonaffiliates marketing to the consumer. Its definition describes nonaffiliates as companies not related by common ownership or control, which can be financial or nonfinancial, and states that Celtic Bank does not share with nonaffiliates so they can market to the consumer. The definition ties the negative statement to that marketing purpose.

Supporting quotations

| For nonaffiliates to market to you | NO | We don’t share |

| Nonaffiliates | Companies not related by common ownership or control. They can be financial and nonfinancial companies  Celtic Bank does not share with nonaffiliates so they can market to you. |

| Reasons we can share your personal information | Does Celtic Bank share? | Can you limit this sharing? |

Qualifications & exceptions

• The definition limits its negative statement to sharing 'so they can market to you'; it does not state that no other sharing with nonaffiliates occurs.

Cross-references

• referred to by (model-proposed): The federal right to limit sharing covers three listed categories — The limit section names nonaffiliate marketing; the nonaffiliate card records Celtic Bank's NO answer to that category.

Legal Rights & Agreement Rules · User right or choice

The federal right to limit sharing covers three listed categories

Under 'Why can't I limit all sharing?', the notice says federal law gives the consumer the right to limit only affiliate everyday-business sharing about creditworthiness, affiliate use of information to market, and nonaffiliate marketing. It adds that state laws and individual companies may give additional rights to limit sharing. Because the table answers NO to each of those three categories, the notice identifies no sharing in them that the federal right would limit. The notice also gives no opt-out form, address or online mechanism; it directs questions to 800.854.7848 and www.celticbank.com.

Supporting quotations

| Why can’t I limit all sharing? | Federal law gives you the right to limit only  Sharing for affiliates’ everyday business purposes—information about your creditworthiness  Affiliates from using your information to market to you  Sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. |

| For our affiliates’ everyday business purposes— information about your transactions and experiences | NO | We don’t share |

| For our affiliates’ everyday business purposes— information about your creditworthiness | NO | We don’t share |

| For our affiliates to market to you | NO | We don’t share |

| For nonaffiliates to market to you | NO | We don’t share |

| Questions? | Call 800.854.7848 or go to www.celticbank.com |

Qualifications & exceptions

• State laws and individual companies may give additional rights to limit sharing.
• No opt-out form, mailing address or online mechanism is stated; the only contact channel is the phone number and website for questions.

Not stated here

• Which additional state-law rights apply to a particular consumer is not stated.

Cross-references

• narrows (model-proposed): Federal law supplies the notice's basis and a limited right to limit sharing — The general statement that federal law gives consumers the right to limit some but not all sharing is narrowed by the later section listing only three categories the right covers.
• refers to (model-proposed): Celtic Bank answers NO to all listed affiliate sharing — The limit section names affiliate creditworthiness sharing and affiliate marketing; the affiliate card records Celtic Bank's NO answers to those same categories.
• refers to (model-proposed): Celtic Bank does not share with nonaffiliates for their marketing — The limit section names nonaffiliate marketing; the nonaffiliate card records Celtic Bank's NO answer to that category.

Security & Safeguards · Company commitment

Security measures described as complying with federal law

Celtic Bank says it uses security measures that comply with federal law to protect personal information from unauthorized access and use. The notice names two categories: computer safeguards and secured files and buildings. It gives no further technical, physical or incident-response detail.

Supporting quotations

| How does Celtic Bank protect my personal information? | To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. |

Not stated here

• The notice does not describe specific controls beyond computer safeguards and secured files and buildings.

Data Access & Collection · Company practice

Information is collected from the consumer and from other companies

Celtic Bank says it collects personal information, for example, when a consumer opens an account or applies for a loan, and also collects it from others such as credit bureaus, affiliates or other companies. The direct-collection examples are introduced by 'for example' and the third-party sources by 'such as', so neither list is exhaustive.

Supporting quotations

| How does Celtic Bank collect my personal information? | We collect your personal information, for example, when you  Open an account  Apply for a loan We also collect your personal information from others, such as credit bureaus, affiliates, or other companies. |

Qualifications & exceptions

• Both lists are illustrative ('for example', 'such as'), not exhaustive.

Legal Rights & Agreement Rules · Procedure

Questions go to a phone number and the Celtic Bank website

The notice's stated channel for questions is the telephone number 800.854.7848 or www.celticbank.com. The supplied copy does not provide an opt-out form, a privacy-specific mailing address or an online privacy-request mechanism.

Supporting quotations

| Questions? | Call 800.854.7848 or go to www.celticbank.com |

Legal Rights & Agreement Rules · Context

The notice shows a January 2015 revision marker and no effective date

Both pages carry 'Rev. January 2015'. The supplied copy states no separate effective date, announces no successor version and includes no linked policy text. The revision label is therefore the only date in the document; it does not by itself establish when the notice took effect or whether it remains the current version.

Supporting quotations

Rev. January 2015

Rev. January 2015

Qualifications & exceptions

• A revision label is not proof of an effective date or current in-force status.

Not stated here

• Effective date and current applicability are not stated in the supplied copy.

Unresolved · Context

The 'Other Important Information' heading has no body text in this copy

The saved copy ends with the heading 'Other Important Information' followed only by 'Page | 2'. No body text appears under the heading, so any state-specific or other terms the heading would introduce are not in this copy. This card records the gap; it does not infer the missing content.

Details not recorded for this card

Supporting quotations

Other Important Information

Page | 2

Qualifications & exceptions

• The absence is in the supplied saved copy.

Not stated here

• The content the heading would introduce is not supplied in this copy.