BOC U.S.A.’s California Privacy Policy

This Privacy Policy for California Residents (“California Privacy Policy”) supplements the information contained in the BOC U.S.A.’s. Privacy Policy, and it applies to California Resident, a natural person (as opposed to a corporation or other business entity) who resides in California, even if the person is temporarily outside of the state. BOC U.S.A. adopts this California Privacy Policy to comply with the California Consumer Privacy Act of 2018 and implementing regulations. Any terms defined in the CCPA have the same meaning when used in this California Privacy Policy. If you are a resident of California, the CCPA provides you with rights regarding your Personal Information. This California Privacy Policy describes the information we collect about you, how we use your personal information it, your rights under CCPA, and how you can exercise your privacy rights under the CCPA. Unless we otherwise agree in writing, this California Privacy Policy applies to Personal Information we collect from California Residents, including when they visit any page of this Website, including any material made available for download.

Information We Collect About You

In the course of our business, BOC U.S.A. collects information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (collectively, “Personal Information”). Depending on how you have interacted with us, we may have collected certain information within the following categories of Personal Information from you in the last twelve (12) months. The categories below are those identified in the CCPA. Please note that we have not collected every type of Personal Information identified in the examples below, and the categories of Personal Information we collect may vary for each California Resident.

In the last twelve (12) months, we may have collected the following categories of Personal Information (for consumers) about you marked ‘YES’ under column ‘Collected’:

Table A1

Category	Purpose	Examples	Collected
Identifiers	Used for opening and servicing accounts, verifying identity, processing payments and detecting fraud.	Full name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers.	YES
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Used for account servicing, payment processing, and compliance with anti-money laundering and other regulatory obligations.	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number and ATM card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.	YES
Protected classification characteristics under California or federal law	Used only for regulatory reporting, eligibility verification, and compliance with applicable laws.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic status.	YES
Commercial information	Used to provide customer support, analyze product usage, and improve specific banking products or services	Records of personal property, Products and Services or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
Biometric information	NA	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
Internet or other similar electronic network activity	Used to monitor website security and detect unusual login behavior.	Browsing history, search history, information on a California Resident’s interaction with a website, application, or advertisement.	YES
Geolocation data	Used to detect potentially fraudulent transactions, identify unusual activity patterns, and comply with anti-money laundering requirements.	Physical location or movements, such as device location and Internet Protocol location.	YES
Sensory data	NA	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
Professional or employment-related information	NA	Current or past job history or prior employer.	NO
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	NA	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
Inferences drawn from other personal information	NA	Inferences drawn from any of the information above to create a profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO

In the last twelve (12) months, we may have collected the following categories of Personal Information (for our California employees or potential candidates) about you marked ‘YES’ under column ‘Collected’:

Table A2

Category	Purpose	Examples	Collected
Identifiers	Used for human resources services and payroll.	Full name, signature, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, telephone number, social security number, Date of Birth, bank account number, driver's license number, passport number, or other similar identifiers.	YES
Internet or other similar electronic network activity	Used to monitor website security and detect unusual login behavior.	Browsing history, search history, information on a California Resident’s interaction with a website, application, or advertisement.	YES
Geolocation data	Used to detect potentially fraudulent transactions, identify unusual activity patterns, and comply with anti-money laundering requirements.	Physical location or movements, such as device location and Internet Protocol location.	YES
Professional or employment-related information	Used for human resources purposes.	Current or past job history or prior employer.	YES
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Used for human resources purposes.	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	YES

Categories of Sources from which BOC U.S.A. Collects Personal Information

BOC U.S.A. collects this Personal Information: (a) directly from you when you provide it to us online (on this Website and in our mobile application); (b) over the phone, or in one of our branches; (c) automatically as you navigate through and use this Website (e.g., using cookies and similar tracking technologies); (d) from third party sources to help us provide our Products and Services (such as credit reporting agencies); or (e) in limited circumstances, when you provide it to one of our affiliates.

Your privacy rights under the CCPA do not apply to all information that we might collect, use, or disclose. For example, the CCPA does not apply to publicly available information from government records, de-identified or aggregated consumer information, and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the California Financial Information Privacy Act. When we collect, use, or disclose information not covered by the CCPA, we do so as describe in the BOC U.S.A. Privacy Policy.

Use of Personal Information

BOC U.S.A. uses your Personal Information to provide our Products and Services, and to accomplish our business purposes and objectives. To that end, Personal Information may be used:

To perform services, including maintaining or servicing accounts, providing Customer service, processing or fulfilling orders and transactions, verifying Customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.
To fulfill or meet the reason you provided the information. For example, if you provide your Personal Information to purchase Products and Services, we will use that information to process your payment and facilitate delivery of the Products and Services. We may also save your Personal Information to facilitate new Products and Services purchases.
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
To user browsing history and online activity data to personalize your online banking dashboard and provide relevant financial product recommendations, including offers that may be interested to you (with your consent where required by law).
To detect security incidents, to protect against malicious, deceptive, fraudulent, or illegal activity, and to prosecute those responsible for that activity.
To undertake activities to verify or maintain the quality or safety of Products and Services controlled by us.
To debug to identify and repair errors that impair existing intended functionality.
To use account and transaction data to process payments, provide customer service, and comply with regulatory obligations.
To perform targeted analysis of customer needs in order to improve specific banking products and enhance fraud detection capabilities.
To comply with laws, regulations, and other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes, or opinions).
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
To establish, exercise, or defend legal rights in legal proceedings.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our Website users is among the assets transferred.

BOC U.S.A. does not share the non-public personal information with anyone except as permitted or required by law. In the last twelve (12) months, we have disclosed only when necessary certain categories of information set out below to third parties for a business or operational purpose:

Categories of Third Parties with Whom BOC U.S.A. Shares Personal Information

Service Providers, Contractors and affiliates: to assist us in performing services, including maintaining or servicing accounts, providing Customer service, processing or fulfilling orders and transactions, verifying Customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
Professional Consultants and Vendors: to provide services necessary for us to operate or to complete a consumer’s requested transaction.
Please refer to Table A1 and Table A2.

Categories of information we disclose to third parties

California Resident Privacy Rights

If you are a California resident, you have the following major privacy rights:

Right to Correct: You may ask businesses to correct inaccurate information they have about you.

Right to Limit the use and disclosure of sensitive personal information: You can direct us to only use your sensitive personal information (for example, your social security number, financial account information, precise geolocation data, or genetic data) for limited purposes, such as providing you with the services you requested.

Right to Know: You have the right to request that we provide certain information to you about our collection and use of your Personal Information over the past twelve (12) months. Upon verifying your identity, we will provide you: (a) with the categories and/or specific pieces of Personal Information we have collected about you, subject to certain exceptions under applicable law; (b) the categories of sources for that personal information; (c) the purposes for which we uses that information; (d) the categories of third parties with whom we discloses the information; and (e) the categories of information we sells or discloses to third parties. You can make a request to know up to twice a year, free of charge.

Right to Deletion: You have the right to request that we delete the Personal Information we collect and maintain about you, subject to certain exceptions. Once we receive your request, we will conduct reasonable due diligence to confirm your identity and assess legitimacy of your request. For legitimate request, we will conduct a reasonable search of our records in order to locate any Personal Information we have collected about you that is eligible for deletion, and delete such Personal Information. To the extent we have shared any Personal Information collected about you with service providers that is eligible for deletion, we will direct those service providers to delete that Personal Information as well. We are not required to delete any Personal Information we have collected about you that is necessary for us and our service provider(s) to:

Complete the transaction for which the Personal Information was collected, fulfill the terms of a written warranty or Products and Services recalls conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between BOC U.S.A. and you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for such activities.
Debug Products and Services to identify and repair errors that impair existing intended functionality.
Comply with a legal obligation, such as retaining records for a period of time as set out in local, state, or federal laws. For example, comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
Establish, exercise, or defense of legal claims.
Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided your information.

Following a deletion request, any Personal Information about you that was not deleted from our systems due to the above exceptions will only be used for the purposes described in the applicable exceptions. Thus, all Personal Information about you that is not subject to a deletion exception will fulfilled in one of the three ways:

permanently and completely erased from our existing systems (with the exception of archived or back-up systems maintained for non-commercial purposes such as emergency disaster recovery and business continuity purposes)
de-identifying the personal information so the de-identified information cannot reasonably be used to infer information about, or otherwise be linked to you; or
aggregating the personal information where individual identities have been removed, and the information cannot be reasonably linked to you.

Right to Opt-out of the Sale: You may request us stop selling or sharing (for cross-context behavioral advertising) your personal information (“opt-out”), including through a user-enabled opt-out preference signal. We cannot sell or share your personal information after we receive your request to opt-out of sale/sharing unless you later consent to the sale or sharing of your personal information. However, BOC U.S.A. does not sell your Personal Information.

Right to Equal Treatment: BOC U.S.A. will not discriminate against you for exercising any of your privacy rights under the CCPA or applicable law, including discrimination in the form of: (a) denying you goods or services; (b) charging you different prices or rates, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level of quality of goods or services; or (d) suggesting that you will receive a different price or rate for goods or services or a different level of quality of goods or services.

How to Exercise Your Privacy Rights

To submit privacy rights under CCPA, please e-mail us at [email protected] or click here to fill out a request form. To process these requests, we must verify your identity and confirm the Personal Information relates to you. To do so, we need to collect information such as physical address, IP address, or other identifying data to confirm residency and match you to existing account information. We also may contact you by e-mail or by telephone to verify your identity and ask you additional questions so that we can match your identity with the data we have about you. In some instances, we may ask you to directly confirm your residency or provide proof.

However, inquiries and requests should not include sensitive personnel information, such as account numbers, SSN and passwords, unless and until BOC U.S.A. provides you with separate instructions for transmitting that information to BOC U.S.A.

You also may designate an authorized agent to make a request for you. To use an authorized agent, you or your authorized agent must:

Submit evidence that your agent has valid power of attorney to act as your agent pursuant to the California Probate Code; or
Provide the authorized agent written and signed permission to act on your behalf, verify both agent and your identity with us. Please note without a valid power of attorney, an authorized agent must be a person or business entity registered with the California Secretary of State.

We may deny a request from an authorized agent who does not submit sufficient proof to act on your behalf.

Response Timing and Format

BOC U.S.A. will make our best effort to respond to a legitimate request by a California Resident. For request to exercise right to delete, correct, or know, we will confirm receipt of your request within 10 business days and will substantively respond to your request to delete, correct, or know your personal information within 45 calendar days. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing. For request to opt-out of sale/sharing or limit the use of sensitive personal information, we will comply with your request as soon as feasibly possible, up to a maximum of 15 business days from the date we received your request. We will maintain records of consumer requests made pursuant to the CCPA as well as our response to said requests for a period of at least five years.

We will deliver our written response electronically, at the email you provided us when you submitted your request. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will inform you why we made that decision and provide you with a cost estimate before completing your request.

Changes to Our Privacy Policy for California Residents

BOC U.S.A. reserves the right to amend this California Privacy Policy at our discretion and at any time. When we make changes to this California Privacy Policy, we will post the updated notice on this Website and update the notice's effective date.

Other California Privacy Rights

In addition to your rights under the CCPA, California Civil Code Section 1798.83 permits you to request from us, once per year, a list of the categories of personal information shared with third parties for our direct marketing purposes and the names and addresses of those third parties. To make such a request, please send an email to [email protected]. Please submit a written request to the business, providing your contact information, proof of identity, and a clear description of the information you are requesting.

Automated Decision-Making Technology (ADMT) Disclosure

BOC U.S.A. does not use ADMT in any manner that produces legal or similarly significant effects for consumers (e.g., credit line approval). If we change our practice regarding the usage of ADMT in the future, we will update this California Privacy Policy to describe the specific logic of ADMT, system input, system output, data source and assumptions used in ADMT modeling.

Contact Us

If you have any questions or concerns with this Policy, you may contact BOC U.S.A. by making an inquiry at [email protected]. However, inquiries should not include sensitive personal information, such as account numbers, SSN and passwords, unless and until BOC U.S.A. provides you with separate instructions for transmitting that information to BOC U.S.A.

California Privacy Policy last updated: October 16, 2025.