U.S. STATE PRIVACY NOTICE

OakNorth Bank plc (“We”, “us”, “our” “OakNorth” or “Bank”) is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register No. 629564). Registered in England No. 08595042. Registered Office: 57 Broadwick Street, London, W1F 9QS.

References to “You” or “Your” is to the applicant who wishes to avail any service or product of the Bank and from whom the Bank shall collect and process the personal data to provide the service and/or product, as well as previous and current customers of the products and/or services.

We’ve created this U.S. State Privacy Notice (“Notice”) to provide additional information for residents of U.S. states that provide for the privacy rights described below as specified under state law.

You can contact our Business Desk:

i) By writing:
OakNorth Bank plc
445 Park Avenue, 6th Floor
New York, NY 10022

ii) By emailing:
questions@oaknorth.com

You can contact our Data Protection Officer directly by emailing: DPO@oaknorth.co.uk

WHAT DOES OAKNORTH DO WITH YOUR PERSONAL INFORMATION?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing of personal information. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

In the section below, we list the reasons we share customers’ personal information; the reasons we choose to share such information; and whether you can limit sharing of such information.

We may transfer personal information to other countries, for example, for customer service or to process transactions. If your account has a California mailing address, we will disclose personal information we collect about you only with your written authorization unless otherwise permitted or required by law.

COLLECTION, USE, AND DISCLOSURES PRACTICES

We collect various types of personal information, categorised and exemplified below. Some data elements may fit into multiple categories. This information is gathered or generated through multiple sources, depending on our services and relationship with you. While most information is obtained directly from you, other sources are also indicated.

RETENTION OF PERSONAL INFORMATION

When determining the retention period for personal information, we consider our legal and regulatory obligations, our retention policies as well as our legitimate business interests. These interests include managing our services, preventing fraud, responding to regulatory or supervisory inquiries, and establishing, exercising, or defending legal claims, disputes, or complaints.

COOKIES AND OTHER TRACKING TECHNOLOGIES

When you visit our website, we will set essential cookies on your device but request your consent to set non-essential cookies. You can find out more about how we use cookies in our Cookie Policy.

ADDITIONAL CHOICES

If you decide at any time that you no longer wish to receive marketing emails from us, please follow the “unsubscribe” instructions provided in such emails. Please note that even if you unsubscribe, we may continue to send transactional or administrative emails, such as legally required, regulatory, billing, or service.

OTHER IMPORTANT INFORMATION

Any individual using the Site or services must be at least 13 years old. If you are accessing the Site or services from outside the United States, please be aware that your information may be transferred to, stored, or processed in the United States. The data protection and other laws of the United States and other countries may not be as protective as those in your state, province, or country.

CHANGES TO THIS POLICY

We shall inform you by way of email if our privacy notice has changed because of an update in the law or if there are changes to the nature of the processing of your personal data. We will not email you when we make minor changes (such as to correct typographical errors, or to add information about other products or services which do not affect the processing of personal data), but we shall make the updated privacy notice available on our website at all times.

RESIDENTS OF CALIFORNIA

California residents should note that this section does not apply to personal information governed by specific sectoral privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations, the California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994. Additionally, it does not apply to other information that falls under an exception to the California Consumer Privacy Act (CCPA).

We may have previously disclosed each category of personal information listed in the “Our Collection, Use and Disclosure Practices” section to one or more of the categories of recipients listed in the “Who Do We Share Data With?” sections for the business purposes listed in “Why Do We Collect This Data?” sections.

We may create, maintain, and use deidentified information of California residents, and if we do, we will not attempt to reidentify that information unless permitted by Californian Law.

YOUR RIGHTS

California residents have certain rights in relation to their personal information pursuant to the California Consumer Privacy Act of 2018 (‘CCPA’). These include the right to:

1. Information about the personal information that we collect about you;
2. Information about the manner in which we use, process and disclose your personal information;
3. Obtain the specific pieces of personal information that we have collected about you;
4. correct inaccurate personal information that we maintain about you;
5. Delete certain personal information that we have collected about you;
6. Opt-out of the sale or sharing of your personal information to third parties under certain circumstances; and
7. Not be discriminated against as a result of exercising any of the aforementioned rights.

Although we collect certain categories of sensitive personal information as described in “Our Collection, Use, And Disclosures Practices”, we do not use sensitive personal information in ways that the CCPA permits you to limit.

Selling and Sharing

The CCPA requires that we describe disclosures of personal information where:

1. We receive monetary or other valuable consideration (i.e., selling, as defined under the CCPA); or
2. We disclose personal information about you through our Sites to a third party for cross- context behavioural advertising (i.e., sharing, as defined under the CCPA).

We do not sell personal information to third parties for cross-context behavioural advertising.

While we don’t “share” your personal information for cross-context behavioural advertising, we may share your personal information for allowed business purpose(s) or at your direction. For example, we share your personal information with our data hosting and storage providers. We enter into agreements with our service providers in which they can only use your information for specific purposes and are required to ensure its confidentiality.

We do not knowingly sell or share the personal information of minors under 16 years of age.

Exercising Your Rights

If you would like to discuss or exercise such rights to access, delete, or correct your personal information, please contact our Data Protection Officer directly by emailing: DPO@oaknorth.co.uk

The CCPA mandates that we verify the requests we receive from you when you exercise certain rights listed above. To verify your request, we will compare the information you provide with third-party identity verification tools and confirm that any personal information pertains to you. As part of this process, we may contact you by phone after you submit your request to verify the information. You may also designate an authorized representative to exercise certain rights on your behalf. To do so, you must provide the authorized representative with power of attorney pursuant to the California Probate Code or execute other documentation as required.  The authorized representative can then make the request on your behalf by following the instructions provided. If an authorized representative submits a request on your behalf, we will contact you to verify their authority to act on your behalf.