Custodia Bank, Inc.
Privacy Notice

Last updated: June 27, 2023

Custodia Bank, Inc. (dba Custodia Digital Services, Inc. where applicable) (“Custodia” or “we”, “us” or “our”) respects your privacy. We will only use your Personal Data in accordance with the terms of this Privacy Notice (“Notice”). This Notice describes how we collect, use, protect and disclose Personal Data received from your use of our website, www.custodiabank.com, along with the features, functionalities, applications, browser extensions and other services available through our website (collectively, our “Website”) and our products and services (our “Services”). We refer to our Website and Services collectively as our “Platform.”

You can access and interact with our Platform in many ways, including from a computer or mobile device. This Notice applies regardless of how you access or interact with our Platform. Depending on how you interact with our Platform, there may be some cases where we need to provide you with additional information about how we use your Personal Data and/or what options you have regarding our use of your Personal Data. We may provide this additional information via notices on the Platform or via direct communications with you. If we do this, unless we tell you otherwise, the additional information will apply in addition to what is described in this Notice.

Please read this Notice carefully. If you do not want us to collect, use or disclose your Personal Data in the ways described in this Notice, please do not use our Platform, provide us with your Personal Data or authorize a third party to make your Personal Data available to us. By using the Platform, providing us with your Personal Data or otherwise making your Personal Data available to us, you acknowledge that you understand that we may use your Personal Data as described in this Notice. If you have any questions about how we collect, use, protect, disclose or otherwise process Personal Data, including whether we have received your Personal Data from a third party, please contact us by email at [email protected].

1. WE COLLECT PERSONAL DATA AND USAGE INFORMATION

   Our primary goals in collecting Personal Data are to verify the identity of individuals who are principal owners of entities that apply for and maintain a financial account with us, provide and improve our Platform, conduct our operations, communicate with you and enable visitors to our Platform to enjoy and easily navigate it. This section describes what Personal Data we collect.

   When we refer to “Personal Data” in this Notice, we mean information that identifies, relates to, describes or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a specific person. This might be information that directly identifies someone, such as their name, or it may be information that identifies someone only when combined with other information available to us. Please note, except as provided under applicable laws, Personal Data does not include information that is publicly available through government records or information that has been deidentified or aggregated in a way that it cannot be used to identify a specific individual.

   In addition to Personal Data, we, or third parties acting on our behalf, may collect certain information about the device you use when you interact with our Platform through the normal operation of our Platform and through the use of cookies, pixels, and other web technologies on our Platform (collectively, “Usage Information”). Usage Information, by itself, generally does not identify the specific person using the device that generated it. This means that unless required pursuant to applicable law, Usage Information usually will not be considered Personal Data and the ways we use Usage Information may differ from what is described in this Privacy Notice. However, if we link Usage Information directly with your Personal Data or other information that could identify you, we will treat the linked Usage Information as Personal Data and use the linked Usage Information as described in this Privacy Notice.

   1. Categories of Personal Data We Collect. Depending on the type of activity you are performing on the Platform or how you use or interact with our Platform, we may collect and disclose the following Personal Data:

      1. identifiers and contact information, such as your real name, alias, email address, telephone number, postal address, physical address, unique personal identifier, government-issued identification numbers, date of birth, online identifier, IP address and other similar information;
      2. demographic information, such as your age, gender, ethnicity, national origin, and other similar information;
      3. internet and other similar network activity information, such as your browsing history, search history, interactions with the online portions of our Platform and online advertisements and other similar information;
      4. financial information, such as bank account number, account balances, digital wallet information and other similar information;
      5. professional or employment-related information, including current or past job history and other similar information;
      6. online identifiers you use, such as your username, social media handles and other similar information;
      7. communication information, such as information contained in voicemails, chats, emails, audio and video recordings of customer service calls and other similar information;
      8. location information, such as where you live, where you are located and other similar information;
      9. other information you provide us or authorize us to collect about you.

   2. Usage Information. Depending on how you access, interact with, or use our Platform, the Usage Information that we, or third parties acting on our behalf, collect may include:

      1. device information, such as the IP address, general geographic location, operating system, browser type, language preferences, mobile phone number, device identifier and other similar information associated with a computer or mobile device used to access or interact with our Platform;
      2. information about your interactions with our Platform, such as links that are clicked, information contained in session replay recordings of access to and use of our Website, such as mouse movements and information entered into non-sensitive data fields (even if such information is not submitted to us through the Website), pages or screens that are viewed, access and session times, interactions with emails we send and other similar information associated with your actions and activities on our Platform;
      3. information about Internet and network activity, such as websites visited, search engine results and other similar information associated with a computer or mobile device that accesses or interacts with our Platform;
      4. information automatically collected by cookies and other technologies on our Platform; and
      5. any other information that a computer or mobile device automatically sends whenever connected to a website or an online application.

      For more information about how we collect Usage Information, please see the “How We Collect Usage Information” section below.

2. HOW WE COLLECT YOUR PERSONAL DATA

   1. Directly From You. When you engage with us in connection with our Platform, such as requesting information, creating an account, communicating with us or otherwise interacting with us, we may ask you to provide certain Personal Data. Some of the Personal Data we request may not be required, however, we will specifically indicate what Personal Data is required to engage in such activity. For example, we may need to verify your identity and provide additional information via a video call to process a withdrawal request. If you elect to not participate in the video call or provide the requested information, we may not be able to process the applicable withdrawal request.

   2. From Third Parties. We, or third parties acting on our behalf, may collect Personal Data about you from third parties, including, without limitation, online and offline sources, entities affiliated with us, our service providers, social media platforms, advertising networks and other public or commercial sources (collectively, “Third Party Sources”). The collection of Personal Data from these Third Party Sources can occur in a variety of ways, including, without limitation:

      1. When you interact with us on other platforms, including, but not limited to, social media sites such as LinkedIn and Twitter (the “Third Party Sites”) or share our content via the Third Party Sites, we may receive information about you from those sites. As a result, we, and third parties acting on our behalf, may share, store, use, and otherwise process any Personal Data we receive from or in connection with those Third Party Sites.
      2. Third parties whose content is linked to on our Platform. Any links to other websites, applications or other third party content on our Platform, are not an endorsement, authorization, or representation of our affiliation with that third party and we are not responsible for the content, privacy and security policies and practices of any third party. We encourage you to read the privacy policies or statements applicable to any third party websites, applications, or content you access.
      3. We, or third parties acting on our behalf, may receive Personal Data about you from third parties that provide services to us through or in connection with our Platform (“Service Providers”). Service Providers may include, without limitation, third parties that host our Platform, parties that provide us services related to the communications we send and receive, and other financial institutions and financial services companies that we partner with to provide our Services.
      4. We, or third parties acting on our behalf, may also receive Personal Data about you from other third parties, such as other users of our Platform and those that refer you to our Platform.

      Our collection, use, disclosure, and storage of the Personal Data we receive from Third Party Sources will be as described in this Privacy Notice.

   3. Please note, we may combine the Personal Data and other content and information we receive about you from multiple sources, including, without limitation, Personal Data we collect directly from you and one or more Third Party Sources.

3. HOW WE COLLECT USAGE INFORMATION

   We, and third parties acting on our behalf, collect Usage Information in a variety of ways. Some Usage Information, such as the IP address of a device attempting to access, use or interact with our Platform, is necessary for us to make certain portions of our Platform available. Other Usage Information, such as information about which features of our Platform are popular, helps us improve and advertise our Platform. The primary systems and technologies used to collect Usage Information in connection with our Platform are:

   1. the systems we use to make our Platform available to you, including the systems we use to help us identify and address technical issues and errors. When you access, use, or interact with our Platform, these systems automatically record certain information that your browser or device sends whenever you visit a website or utilize an online application as well as information about how long your device is connected to our Platform and the activities that device engages in while connected. These systems also automatically collect information about your actions and activities on our Platform.

   2. cookies, which are small data files that are uploaded to the hard drive or other storage on devices that access, use, or interact with portions of our Platform. Among other things, cookies help us improve our Platform and our users’ experience. We use cookies to see which areas and features are popular and to understand usage of our Platform. We use first party cookies, served directly by us to the devices that access our Platform, to recognize those devices when they revisit. We also use third party cookies, which are cookies that are placed by other parties we work with, such as Google or LinkedIn. These third parties may upload unique cookies to your device to collect information about your use of our Platform and potentially other online activities you engage in over time across different Platform and other online applications. The Options/Settings section of most internet browsers will tell you how to manage cookies and other technologies that may be uploaded to your device, including how to disable such technologies. You can disable our cookies, or all cookies, through your browser settings, but please note, disabling cookies may impact some of the features of our Platform and prevent them from operating as intended. You can learn more about cookies, including how to see what cookies have been uploaded to your device and how to manage and delete them, by visiting https://www.allaboutcookies.org/.

   3. other tracking technologies, such as web beacons, clear gifs, and pixel tags. These technologies may be used on or in connection with our Platform, including, without limitation, in emails we send. We may use these technologies to deliver cookies, count visits, understand usage, and observe data on email delivery, open rates, click rates, bounces, unsubscribes and other information.

   4. tracking solutions provided through certain Third Party Sources on our Platform, including Google Analytics. Google Analytics is a web analytics service provided by Google, Inc. (“Google”), to assist us in understanding how our Platform is used. Google Analytics will place cookies on your computer or mobile device that will generate information that we select about your use of the Platform, including your computer’s or mobile device’s IP address. That information will be transmitted directly to and stored by Google. The information will be used for the purposes of evaluating use of our Platform, compiling reports on activity on our Platform for our use and providing other services relating to activity on, and usage of, our Platform. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that by doing so, you may not be able to use the full functionality of our Platform. The use of cookies by Google Analytics is covered by Google’s privacy policy, available at https://policies.google.com/privacy. Google allows you to opt out of Google Analytics. You may opt-out by visiting https://tools.google.com/dlpage/gaoptout.

   Please note, we have not yet developed a response to browser “Do Not Track” signals, and do not change any of our data collection practices when we receive such signals. We will continue to evaluate potential responses to “Do Not Track” signals in light of industry developments or legal changes.

4. HOW WE USE SESSION REPLAY SOFTWARE

   Session replay software allows a website operator to record and play back a user’s journey through the operator’s website or mobile app. We may use session replay software provided by third parties that help us to better understand each individual’s user experiences on our Website (like how much time users spend on which pages, which links they click, what they like and don’t like) and use that knowledge to fix bugs on the Website, improve user experience throughout our Platform, and improve how the Website functions. Session replay software may use cookies and other technologies to collect data about the behavior of our users, including, without limitation, mouse movement, click information, and text entered as a user navigates through our Website, as well as information about the devices that accessor interact with our Website, including, but not limited to, IP address of the device, screen size, device type, unique device identifiers, information about the browser used, general location of the device, and the preferred language for displaying our Website. The third parties that provide session replay software to us store this information on our behalf in a pseudonymized user profile and are contractually prohibited from selling the data they collect on our behalf through the session replay software.

   You can block session replay software in several ways. If you have cookies disabled, you won’t be tracked by any session replay software using cookies. You can visit www.allaboutcookies.org in order to obtain more information on deleting or controlling cookies. Some session replay software providers also respect the Do-Not-Track (DNT) headers in browsers, meaning that you may be able to use the DNT setting in your browser to avoid certain session replay software from tracking any data about your visit. DNT is implemented through your browser, so you’ll need to check if the setting is enabled or disabled within your own browser.

5. HOW WE USE YOUR PERSONAL DATA AND USAGE INFORMATION

   This section describes the primary purposes for which we use the Personal Data we, or third parties acting on our behalf, collect.

   1. Operational Uses and Disclosures. We may use the Personal Data we, or third parties acting on our behalf, collect for non-marketing purposes, including:

      • operating and improving our Platform;
      • verifying your identity;
      • processing, fulfilling and administering transactions and orders for products and services;
      • carrying out our obligations and enforcing our rights arising from any contracts we have entered into, including, without limitation, any contracts between you and us;
      • sending you emails, text messages, or calls to provide you with alerts and updates about your engagement with our Platform;
      • conducting statistical or demographic analysis;
      • complying with legal and regulatory requirements;
      • customizing your experience with our Platform;
      • protecting and defending Custodia against legal actions or claims;
      • preventing fraud;
      • cooperating with law enforcement or other governmental agencies for purposes of investigations, national security, public safety or matters of public importance when we are legally required to do so or believe that disclosure of Personal Data is necessary or appropriate to protect the public interest;
      • registering or servicing your online account;
      • contacting you about or in response to questions or other correspondence we receive from you;
      • providing customer service;
      • calling or sending service-related text messages to you;
      • facilitating your use of features on the Platform, including, without limitation, troubleshooting any issues with identity verification;
      • those you authorize or instruct us to do; and
      • other business purposes permitted under applicable law.

   2. Marketing Purposes. We may use the Personal Data we, or third parties acting on our behalf, collect for marketing purposes, including notifying you of special promotions, opportunities, offers and events e-mail and other means, all subject to our compliance with applicable laws (“Marketing Purposes”). We may also link Personal Data (including your name, mobile phone number, and email address) with other information (including information we automatically collect as described in this Notice) and use such linked information for Marketing Purposes.

   3. Anonymized Data. Please note, we may use and disclose aggregated, anonymized or de-identified information collected in connection with our Platform and other information that does not identify any individual (“Anonymized Data”) for any lawful purposes, which may include, without limitation, purposes not described in this Notice. Except as otherwise required under applicable laws, our use and disclosure of such Anonymized Data is not subject to this Notice.

6. HOW – AND WHY – WE SHARE YOUR PERSONAL DATA WITH THIRD PARTIES

   We will not, without your permission, sell, publish or share information you entrust to us that identifies you or any person, except as described below.

   We may share your Personal Data with certain third parties under the following circumstances:

   • With your consent. Except for as outlined below, we only share your information with third parties when you have directed us to do so.
   • With our Service Providers. We may share your Personal Data with our Service Providers as needed to complete any transaction or provide any Service you have requested or in connection with the services they provide to us, including, without limitation, order fulfillment, marketing of our products and services, data hosting, fraud protection and prevention, and as otherwise provided in this Notice. We require these Service Providers to exercise reasonable care to protect your Personal Data and restrict their use of your Personal Data to the purposes for which it was provided to them.
   • For identity verification. We are required by law to verify the identity of certain individuals associated with an entity that has an account with us pursuant to a Customer Deposit Account Agreement. If we need to verify your identity, we may provide your Personal Data to one or more third parties that provide identity verification services to us as necessary for those third parties to verify your identity. We may also receive Personal Data about you from these third parties in connection with their verification of your identity. The third party identity verification service providers may include, without limitation, Socure and Middesk. For more information about Socure’s privacy practices, please visit https://www.socure.com/socure-products-and-services-statement. For more information about Middesk’s privacy practices, please visit https://www.middesk.com/privacy.
   • For mergers and acquisitions. We may share your Personal Data with applicable third parties in connection with a merger, acquisition, bankruptcy or other sale of all or a portion of our assets. We reserve the right, in connection with these types of transactions, to transfer or assign your Personal Data and other information we, or third parties acting on our behalf, have collected to third parties or to authorize such third parties to use any such information. Except as ordered by a bankruptcy or other court, the use and disclosure of all transferred Personal Data will be subject to this Notice. However, any Personal Data you submit or that is collected after this type of transfer may be subject to a new privacy Notice adopted by the successor entity.
   • For legal reasons. We may share your Personal Data with government and law enforcement officials or private parties where necessary to enforce and comply with the law. To the extent permitted under applicable law, we may disclose any Personal Data and other information to government or law enforcement officials or private parties as we believe is necessary or appropriate to investigate, respond to and defend against legal claims, for legal process (including subpoenas), to protect our property and rights of those of a third party, to protect us against liability, for the safety of the public or any person, to prevent or stop any illegal, unethical, fraudulent, abusive or legally actionable activity, to protect the security and integrity of our Platform and any equipment used to make our Platform available or to comply with applicable laws.
   • With financial service providers. We may share your Personal Data with other companies, lawyers, agents, and government agencies in connection with issues related to fraud or debt collection.
   • When you publicly post the information. We may provide opportunities for you to publicly post reviews, questions, comments, suggestions or other content, which may include Personal Data, such as your name or username. Anything you share in a public forum is public, and you should think carefully before you decide to share.

7. MANAGING YOUR PERSONAL DATA

   We offer you several choices with respect to how we use your Personal Data. This section describes the mechanisms available to you to control the Personal Data we use about you in connection with our Platform.

   1. Tools to Contact Us. If you want to update any Personal Data you have provided to us, update your preferences, control communications we send you or otherwise contact us about your Personal Data, please email us at [email protected].
   2. Additional Tool for Communications. For email communications you receive from us, you may opt-out of receiving such communications by following the unsubscribe instructions contained in most email messages from us. Your unsubscribe request or email preference changes will be processed promptly, though this process may take several days. During that processing period, you may receive additional emails from us. Please note, opting out of email communications will only apply to marketing and other promotional emails and will not apply to any email or other communications sent for non-marketing purposes, including, but not limited to, emails and other communications about your interactions with our Platform.
   3. Marketing Opt-Out. If you do not want us to use your Personal Data to deliver targeted advertisements to you according to our target audience preferences, you can opt out by sending us an email with your request to [email protected]. We do not control third parties’ collection or use of your Personal Data to serve interest-based advertising. However, these third parties, which may include our Marketing Partners, may provide you with ways to choose not to have your Personal Data used to deliver targeted to you according to their target audience preferences. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website, located at https://www.networkadvertising.org, and from members of the Digital Advertising Alliance (“DAA”) on their website, located https://youradchoices.com. Please note, even if you opt out from receiving targeted advertisements, you may still see advertisements based on factors such as your general location derived from your IP address, your browser type and your search terms.

8. PROTECTING YOUR PERSONAL DATA

   We are committed to protecting the security of your Personal Data. We maintain commercially reasonable safeguards to maintain the security and privacy of Personal Data we collect and use in connection with our Platform. Nevertheless, when disclosing Personal Data, you should remain mindful that there is an inherent risk in the transmission of information via the internet and mobile platforms. Although we take precautions to protect against the risk of unauthorized access to your Personal Data, we cannot guarantee the security of any information, including your Personal Data, that you disclose online, and you do so at your own risk.

9. CHILDREN’S PRIVACY

   We do not direct or target any piece of our Platform to children under the age of 18. If we learn that we have collected the Personal Data of anyone under the age of 18, we will take appropriate steps to delete this information. If you are a parent or guardian of someone under the age of 18 and discover that your child has submitted Personal Data to us, please contact us at [email protected]. We will make reasonable efforts to remove such information from our databases.

10. CALIFORNIA PRIVACY RIGHTS

    If you are a California resident, under California’s Shine the Light Law (California Civil Code Section 1798.83) you have the right to request the following information regarding our disclosure of your Personal Data third parties for direct marketing purposes: (1) the categories of Personal Data we disclosed to third parties for their direct marketing purposes during the preceding calendar year; (2) the names and addresses of the third parties that received the information; and (3) if the nature of the third party’s business cannot be determined from their name, examples of the products or services they marketed. This information may be provided in a standardized form that is not specific to you.

    You are permitted to obtain this information from us once a year, free of charge. To make such a request, please submit your request in writing to:

    Custodia Bank, Inc. Attn: CA Privacy Rights Request 2120 Carey Ave. Cheyenne, WY 82001

11. INTERNATIONAL TRANSFERS

Personal Data collected in connection with the use and operation of our Platform is initially collected in the United States and may be stored or processed in any jurisdiction where our service providers are located. This means that your Personal Data may be collected, stored, or otherwise processed in a jurisdiction outside of where you reside, including, without limitation, in the United States. Please note, the United States has not been assessed as having adequate privacy laws by some countries and economic regions.

11. CHANGES AND UPDATES TO THIS NOTICE

Because the methods used to protect your Personal Data and the Services we provide are continually evolving, this Notice may change at any time. Unless otherwise noted, those changes will be effective as soon as they are posted. If changes are made to this Notice, we will make it known on our Platform or by email and will indicate the last date it was updated above. Please check back periodically to see if our Notice has been updated.

Your continued use of our Platform after any changes to this Notice become effective, constitutes your continued acknowledgement that you understand that we may continue to use your Personal Data as described in this Notice.

12. CONTACT US

We welcome your questions, comments and concerns about privacy. Please email us at [email protected] with any questions or feedback you have pertaining to our privacy practices.