US METRO
BANK CALIFORNIA PRIVACY POLICY NOTICE FOR CALIFORNIA RESIDENTS

Last Updated: January 9, 2023

INTRODUCTION

This Privacy Policy Notice for California Residents (this “Notice”) applies solely to residents of the State of California (“consumers” or “you”) and supplements the information contained in any other Privacy Statement or Notice provided by US Metro Bank (“Bank,” “our” or “we”).

This Notice is adopted to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and as amended, the California Privacy Rights Act of 2020 (collectively, “CCPA”).

This Notice describes how US Metro Bank collects, uses, and discloses information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“personal information”).

The information on this page complements the notices and disclosures regarding your rights under federal laws and regulations (e.g., the Gramm-Leach-Bliley Act).

For more information, please visit https://www.usmetrobank.com/privacy-policy/

Keeping Personal Information secure is one of our most important priorities.

Consistent with our obligations under applicable laws and regulations, we maintain physical, technical, electronic, procedural and organizational safeguards and security measures that are designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access, whether it is processed by us or elsewhere.

COLLECTION OF PERSONAL INFORMATION

We may collect, for our business purposes, certain personal information to provide financial products and services, and for employment purposes.

In the past 12 months, we may have collected and disclosed:

Sensitive Personal Information: We may collect, as permissible by law, certain sensitive personal
information to provide financial products and services, and for employment
purposes. In the past 12 months, we may have collected and disclosed:

SOURCE OF PERSONAL INFORMATION

The categories of sources from whom we collected this
Personal Information are:

·   Directly from a California resident or the individual’s representatives through paper applications, telephone, or electronic means.

·   Service Providers and other third parties to provide products and services or process transactions requested by you, or transfers of sales and assets.

·   Public Record Sources (Federal, State or Local Government Sources)

·   Information from Corporate Clients about individuals associated with the Clients (e.g., an employee or board member)

·   Outside companies we used to support Human Resources and workforce management activities

USE OF PERSONAL INFORMATION

In the past 12 months, we have used Personal Information relating to California residents to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives, that are permissible by law, including the following:

·   Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.

·   Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

·   Short-term, transient use where the information is not disclosed to a third party and is not used to build a profile or
otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

·   Auditing related to a current interaction and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.

·   Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance the service controlled by the business.

·   Debugging to identify and repair errors that impair existing intended functionality.

·   Complying with laws and regulations and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes or opinions)

SHARING or SELLING OF PERSONAL INFORMATION

We do not share or sell Personal
Information (including sensitive personal information) subject to the CCPA,
including Personal Information of minors under the age of 16. For purposes of
this Disclosure, “sharing” means the disclosure of Personal Information to a
third-party for cross-context behavioral advertising while “selling” means the
disclosure of Personal Information to a third-party for monetary or other
valuable consideration.

In the past 12 months, we also
have not shared your Personal Information subject to the CCPA including
Personal Information of minors under the age of 16 with third parties for
cross-context behavioral advertising. We also have not sold Personal
Information subject to the CCPA, including Personal Information of minors under
the age of 16.

For this reason, we do not offer
a right to opt-out of sale or sharing.

CATEGORIES OF THIRD PARTIES

The categories of third parties to whom we disclosed
Personal Information for our business purposes described in this privacy
disclosure are:

·   Vendors and Service Providers who provide
services such as information technology and related infrastructure, customer
service, email delivery, and auditing

·   Partners and Third Parties who provide services
such as payment, banking and communication infrastructure, storage, legal
expertise, tax expertise, notaries and auditors, who promote the bank and its
financial services and products to customers and other prospective buyers

·   Other Third Parties who enable customers to
conduct business online and via mobile devices

·   Government Agencies as required by laws and
regulations

·   Outside companies in connection with routine or
required reporting, including consumer reporting agencies

YOUR RIGHTS

Right To Know

You have the right, subject to certain exceptions defined in
the CCPA and other applicable laws and regulations, to request that US Metro
Bank disclose certain information to you about our collection and use of your
personal information over the past 12 months. Once we receive and confirm your
verifiable consumer request, we will disclose to you:

·   The categories of personal information we
collected about you.

·   The categories of sources for the personal
information we collected about you.

·   The business or commercial purpose for
collecting, selling, or sharing the personal information.

·   The categories of third parties with whom we
disclose that personal information.

·   The categories of personal information that each
recipient received.

·   The specific pieces of personal information we
collected about you.

You have the right to receive
this information in a format, to the extent technically feasible, that is portable,
usable, and allows you to transmit the personal information to a person without
impediment, where the processing is carried out by automated means.

Right to Request Deletion

You have the right, subject to
certain exceptions defined in the CCPA and other applicable laws and
regulations, to request that US Metro Bank delete any of your personal
information that we collected from you and retained. Once we receive and
confirm your verifiable consumer request we will delete (and direct the
recipients of your personal information to delete) your personal information
from our records.

Right to Correct Your Personal Information

You have the right, subject to
certain exceptions defined in the CCPA and other applicable laws and
regulations, to submit a request to correct any inaccurate personal information
that we may have about you.

HOW TO EXERCISE YOUR RIGHT

You may only make a verifiable consumer request for access twice
within a 12-month period.

If you are a California resident, you may submit a request thru
one of the following methods:

1) Emailing privacy@usmetrobank.com

2) Calling 888-620-0018

3)  Visiting a nearest branch and fill out a CCPA Consumer Rights Request Form

We cannot respond to your
request or provide you with personal information if we cannot verify your
identity or authority to make the request and confirm the personal information
relates to you. Making a verifiable consumer request does not require you to
create an account with us. We will only use personal information provided in a
verifiable consumer request to verify the requestor’s identity or authority to
make the request.

Requests by Authorized Agents

You may exercise your privacy
rights through an authorized agent. If we receive your request from an
authorized agent, we may ask for evidence that you have provided such agent
with a power of attorney or that the agent otherwise has valid written
authority to submit requests to exercise rights on your behalf.

NONDISCRIMINATION

You have the right not to be
discriminated against for exercising any of your privacy rights. This includes
us not: (a) denying you goods or services; (b) charging you different prices or
rates for goods or services, including through the use of discounts or other
benefits or imposing penalties; (c) providing you a different level or quality of
goods or services; (d) suggesting to you that you will receive a different
price or rate for goods or services or a different level or quality of goods or
services; and (e) retaliating against you for exercising your privacy rights.

RESPONDING TO YOUR REQUEST

Privacy and data protection
laws, other than the CCPA, apply to much of the Personal Data that we collect,
use, and disclose. When these laws apply, Personal Data may be exempt from, or
outside the scope of, Access Requests and Deletion Requests. For example,
information subject to certain federal privacy laws, such as the
Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability,
is exempt from CCPA Requests. As a result, in some instances, we may decline
all or part of an Access Request or Deletion Request related to Personal Data
exempt from CCPA Requests. This means that we may not provide some or all of
this Personal Data when you make an Access Request. Also, we may not delete
some or all of this Personal Data when you make a Deletion Request.

QUESTIONS OR CONCERNS

You may contact us with questions or concerns about this
Disclosure and our practices by:

Writing us at:

US Metro Bank 

Attn: Compliance Department

9866 Garden Grove Blvd.

Garden Grove, CA 92844.

Calling us at 888-620-0018

CHANGES TO THIS CALIFORNIA CONSUMER PRIVACY ACT DISCLOSURE

We may change or update this Disclosure from time to time.
When we do, we will post the revised Disclosure on this page with a new “Last
Updated” date.