Gulf Coast Bank & Trust Co California Consumer Privacy Act (CCPA) Disclosure

This California Consumer Privacy Act Disclosure explains how we collect, use, and disclose personal information related to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”).

This Notice explains how California residents can exercise their rights under the CCPA to request that we: (1) provide certain personal information that we have collected about them during the past 12 months, along with related information described below, or (2) delete certain personal information that we have collected from them.

The CCPA only applies to information about residents of California.

Under the CCPA, “personal information” is information that identifies, relates to, or could reasonably be linked with a particular California resident or household. The CCPA, however does not apply to information subject to the Gramm-Leach-Bliley Act (“GLBA”).

We also must provide in this online disclosure certain details about our collection and handling of categories of personal information. The information that follows shows the types of personal information we may collect about California residents who are subject to the CCPA, the sources from which we collect it, and the ways in which we use and disclose it.

Categories and Sources of Personal Information

Categories of Personal Information

  • Identifiers, such as name and government-issued identifier (e.g., Social Security number);
  • Personal information such as contact information and financial information;
  • Commercial information, such as transaction information and purchase history;
  • Biometric information, such as fingerprints and voiceprints;
  • Internet or network activity information, such as browsing history and interactions with our website;
  • Geolocation data, such as device location and Internet Protocol (IP) location;
  • Audio, electronic, visual and similar information, such as call and video recordings;
  • Professional or employment-related information, such as work history and prior employer;
  • Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s preferences and characteristics.

Category of Sources from which we collect Personal Information

  • Information provided from a California resident when applying  for a product or service
  • We collect personal information from public record  or available resources including information from the media and other records available by federal, state or local government
  • We receive your personal information from third parties who provide it to us (e.g., our customers; credit reference agencies; and law enforcement authorities)
  • We receive your personal information from outside companies or organizations that provide data to support activities such as fraud prevention, underwriting, and marketing.
  • Outside companies or organizations from whom we collect personal data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples include companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.
  • We collect or obtain personal information when you visit any of our websites, mobile app activity, social media or use any features or resources available on or through a Site. When you visit a Site, your device and browser may automatically disclose certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site and other technical communications information), some of which may constitute Personal Information

Use of Personal Information

How we use your personal information Examples
Marketing/business development
  • Communicating with you via any means (including via email, telephone, text message, social media, post or in person) subject to ensuring that such communications are provided to you in compliance with applicable law; and maintaining and updating your contact information where appropriate
Managing products and services
  • Establish and process transactions for our products and services
  • Support the ongoing management and maintenance of our products and services including to provide account statements, online banking access, customer service, payments and collections, and account notifications
Manage our everyday operations, including legal, compliance and risk related
  • Perform accounting, monitoring, and reporting
  • Enable information security and anti-fraud operations, as well as credit, underwriting, and due diligence
  • Enable the use of service providers for business purposes
  • Comply with policies, procedures, and contractual obligations
  • Audit, compliance, controls and other risk management
  • Detecting, preventing and investigating fraud

Sharing and Disclosure of Information

We do not share your information except as allowed by law. We share information only with those vendors providing servicing of your products and services and require that they do not sell or share or use your information for any other purpose.

Sale of Personal Information

 Gulf Coast Bank & Trust  has not “sold” Personal Information   and does not engage in the sale of personal information as contemplated by the CCPA and therefore does not offer an opt-out from the sale of personal information. For purposes of this CCPA Policy, “sold” means the disclosure of Personal Information to a third party for monetary or other valuable consideration.

Rights for California Residents

A California resident has the right to request that we:

  • Disclose to you the following information covering the 12-month period prior to your request (“Access Request”):
    • The categories of Personal Information we collected about you
    • The categories of sources from which we collected the Personal Information;
    • The business or commercial purpose for collecting Personal Information about you;
    • The categories of third parties to whom we disclosed Personal Information about you, and the categories of Personal Information disclosed;
    • The specific pieces of Personal Information we collected about you; and
  • Delete Personal Information we collected from you (“Deletion Request”).
  • If you are a California resident, a business may not discriminate against you for exercising your rights under the CCPA.

The right to allow an authorized agent to make a request

  • You may designate an authorized agent to make a request under the CCPA on your behalf. We retain the right to verify the legitimacy of that designation, and to identify both you and the agent. We will identify you with information you have previously provided to us and with information about your account(s) or transactions.

Responding to Requests

Privacy and data protection laws, other than the CCPA, apply to much of the Personal Information that we collect, use, and disclose. When these laws apply, Personal Information may be exempt from, or outside the scope of, Access Requests and Deletion Requests. As a result, in some instances, we may decline all or part of an Access Request or Deletion Request related to this Personal Information. This means that we may not provide some or all of this Personal Information when you make an Access Request. Also, we may not delete some or all of this Personal Information when you make a Deletion Request.

As examples, our processing of or response to an Access Request or Deletion Request may not include some or all of the following Personal Data:

  • Consumer Accounts. Personal Data connected with consumer accounts used for personal, family, or household purposes. We have other privacy notices describing use and sharing of this data, for example, the Gulf Coast Bank & Trust Company Privacy Notice, available at www.GULFBANK.COM/privacy.
  • Business-to-Business Relationships. Certain Personal Data we collect in the course of providing a product or service to another business, or in the course of receiving a product or service from another business.

The types of Personal Data described above are examples. We have not listed all types of Personal Data that may not be included when we respond to or process Access Requests or Deletion Requests.

In addition to the above examples, we may not include Personal Information when we respond to or process Access Requests or Deletion Requests when the CCPA recognizes another exception. For example, we will not provide the Personal Information about another individual where doing so would adversely affect the data privacy rights of that individual. As another example, we will not delete Personal Information when it is necessary to maintain that Personal Information to comply with a legal obligation.

We will acknowledge your request within 10 business days, and will provide the requested information within 45 days. If we are not able to respond within 45 days, we will inform you and respond within an additional 45 days. You may request this information up to two times per 12 month period. We reserve the right to verify the legitimacy of all requests, using any information you have given us, or any transactional information we have.

How to Make Requests

If you are a California resident, you can make an Access Request or a Deletion Request by:

Contacting us at 1-800-223-2060

Request to Know or Delete Personal Information under the CCPA


Changes to this Disclosure

We may change this disclosure from time to time. When we do, we will let you know by appropriate means such as by posting the revised disclosure on our CCPA web site with a new “Last Updated” date. Any changes to this disclosure will become effective when posted unless indicated otherwise.

Last update: January 1, 2020