Your privacy is important to us and we are committed to protecting it through our compliance with this Online Privacy Policy (the "Policy"). The terms "GBank" and "we", "us" or "our" in this Policy refers to GBank and any banking or non-banking U.S. affiliates of GBank that refer or link to this Policy.

This Policy describes how we manage personal information about you when you interact with us online through our websites, mobile applications and social sites (a "Site" or the "Sites"), using your computer, smartphone, tablet or other mobile device (a "Device" or the Devices"). We maintain our Sites and provide services through them for your information and communication purposes, as well as for purposes associated with the marketing, origination, and servicing of our products and services (the "Service" or "Services"). This Policy also explains how GBank collects personal information that you may provide when you visit, use or interact with us online, and through our ads displayed through online services operated by us or non-affiliated third parties. In addition, this Policy explains how we may use or share personal information collected to provide our Services to you and for advertising purposes.

Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Sites. By using our Sites, you agree to the terms and conditions of this Policy.

Our Sites and Services are intended for use only by United States residents, while located in the United States. If you are not a United States resident, or are located in a country other than the United States, you may not use our Sites or request and obtain Services from us through those Sites.

Additional privacy rights and notices will apply if you are a California resident. See the section below called Your California Privacy Rights for more information about your rights under California law.

A different privacy policy applies if you request or receive a financial product or service from us by using this Site or otherwise. See our Privacy Policy | GBank | Las Vegas, Henderson - Nevada for more information about how we collect and disclose nonpublic personal information about you and other consumers who may request or receive a financial product or service from us.

We work with third party providers that are contractually obligated to comply with our policies for protecting information. However, if you visit or access one of these third party provider sites or mobile apps, please review the online privacy policies that apply to the third party provider's site or mobile app to understand the specifics of how your online personal information may be collected, used and shared.

Updates To This Policy

This Policy may change from time to time, so please check this Policy periodically for updates. For example, we may update this Policy periodically to comply with updates to federal, state, and local laws, or to reflect our own business choices and preferences. If we make changes to this Policy, we will revise the "last updated" date at the top of this Policy. You are responsible for periodically reviewing this Policy to check for any changes. If we change the Policy on this Site and you continue to use it, you agree that your continued use of the Site will mean you have accepted all of the changes described in our updated Policy.

GBank's Online Privacy Practices

GBank is committed to transparency about your personal information. In some cases, we may ask for your express consent to use or disclose your personal information (for example, if we determine that your express consent is required or advisable under applicable law). Otherwise, when you use our Site and Services, you consent to the collection, use and sharing of your personal information as described by this Policy, subject to applicable law and other notices we may have provided to you based on our relationship with you and based on the Services you obtain from us using our Sites or otherwise.

Linking To Other Sites

We may provide links to non-affiliated third party sites, such as credit bureaus, service providers or merchants. If you follow links to any site that is not affiliated with or controlled by GBank, you should review their privacy and security policies and other terms and conditions, because the policies of those third parties may be different from those that apply to our Sites and Services. We do not guarantee and are not responsible for the privacy or security of these third party sites or for the accuracy, completeness, or reliability of information found on those other sites.

Protecting Your Personal Information

We use security measures that comply with applicable federal and state laws to protect personal information from unauthorized access and use. Security measures may include device safeguards and secured files and buildings, as well as oversight of our third party providers to ensure personal information remains confidential and secure.

Persons Under 18 Years of Age

Our Site is not intended for children under 18 years of age. No one under age 18 is allowed to provide personal information on this Site. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on this Site or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information.

Keeping Your Personal Information Accurate and Updated

Keeping your personal information accurate and up to date is very important. If your personal information is incomplete, inaccurate or not current, please use the Contact Us or similar option on our Sites, or call us at the telephone numbers or write to us at the appropriate address for changes listed on your account statements, records, online or other account materials.

Personal Information We Collect

How do we collect personal information online? Cookies and similar technologies

We collect personal information about you through your Devices by using "cookies" and similar tracking technologies (including pixels or clear GIFs, tags, web beacons and Flash objects). Cookies are text files containing small amounts of information that are downloaded to your Devices when you visit a website. Tracking technologies may collect information about you and your use of our Sites. Cookies allow a site or mobile app to recognize your Device, keep track of pages visited, and remember your preferences. This information is used for security purposes, to facilitate navigation, to display information more effectively and to personalize the user's experience. Cookies and similar tracking technologies are also used to gather information to improve website design and functionality and assist with resolving questions regarding our Sites.

Cookies set by GBank and cookies created and set by third party providers on our behalf are called "first-party" cookies. Cookies set by third-party providers, but which are not set on our behalf, are called "third-party" cookies. Information obtained from a third-party cookie can be used only for the purposes we have stated in our contracts with the third party. There can be first-party and/or third-party cookies within any of the Categories of Cookies described below.

Cookies that expire at the end of a browser session are called "session" cookies. Cookies that are stored longer are called "persistent" cookies. Generally, there can be session and/or persistent cookies within any of the below Categories of Cookies.

The Sites we administer or control use cookies that we consider necessary for our Sites to function properly and that cannot be switched off in our systems. These cookies are used to set your privacy preferences, gather geolocation data to prevent or detect potential fraudulent activity, or for logging in a secured area requiring authentication. Geolocation cookies are only session cookies.

We will retain personal information collected through cookies for as long as needed or permitted by law in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods includes the purpose for which the personal information was collected, whether there is a legal obligation that applies to us, and whether retention is advisable in light of our legal position, including with respect to applicable statutes of limitations, litigation or regulatory investigations.

We work with certain third party providers that are contractually required to comply with our policies to protect information. We may contract with a third party provider to provide support to us through their sites. If you are on one of our Sites and you click a link to one of their sites, you will be presented with a notice explaining that you are continuing to a site that we do not own. The third party provider is solely responsible for cookies, cookie tracking and your choices for managing cookies on its site. Please refer to the privacy policy and terms of use posted by the third party provider for more information. When we contract with a third party provider to manage the content of the information within our Sites, the third party provider is solely responsible for cookies, cookie tracking and your choices for managing cookies.

Other means of collecting personal information

GBank also collects personal information that you provide when you visiting or using our Sites and Services. This may occur when you apply for or open a new account, register for a new product or service, or request information about a product or service. We may also use third party providers to process personal information for business purposes on our behalf. These third party providers are contractually required to keep this information confidential and to comply with our policies to protect information we share with them or they collect on our behalf. The personal information we collect is limited to what is required to provide our Services and to support legal, risk management and regulatory compliance requirements. For additional information, please review the "How We Use and Share Personal Information" section of this Policy.

Types of personal information we collect online

The type of personal information we collect from and about you online will depend on how you interact with us and may include:

• Contact information, such as name, mailing address, email address, telephone and mobile number(s);
• Account application information, such as credit and income information;
• Identifiers such as Social Security number, account number(s), driver's license number (or comparable) or other information that identifies you for ordinary business purposes;
• Access authorization, such as user name, alias, PIN and Passcode and security questions and answers;
• Information from your computer and mobile devices, where allowed by individual browsers and/or operating systems. such as:
• Unique device identifiers (for example Media Access Control (MAC) and Internet Protocol (IP) addresses); and
• Browser type, version, language, and display/screen settings;
• Information about how you use and interact with our Sites and use our Services (for example, activities on pages visited, links clicked or unique and measurable patterns such as keystrokes, mouse clicks and movements, swipes and gestures);
• Responses to advertisements on the sites and mobile apps where we advertise;
• Log information, such as your search and voice to text queries using our Sites;
• Search engine referrals;
• Geo-location information with consent (for example, ATM or financial center location, fraud prevention); and
• Social media preferences

How We Use and Share Personal Information

How do we use your personal information?

Personal information collected from and about you online described in this Policy may be used for many purposes, such as:

• Delivering products and services to you (for example, to verify your identity when you access your account information, or when we process your applications or requests for prequalified offers, or otherwise request or obtain our Services using the Sites or otherwise);
• Personalizing your digital and mobile experience by enhancing the organization and design of our Sites and by analyzing data to create relevant alerts, products or services;
• Providing advertising on our Sites, as well as non-affiliated third party sites and through off-line channels like call centers and direct marketing (for example email, mail and phone);
• Detecting and preventing fraud, identify theft and other risks to you or us;
• Performing analytics concerning your use of our online services, including your responses to our emails and the pages and advertisements you view;
• Complying with and enforcing applicable legal requirements, industry standards, contractual obligations and our policies;
• Allowing you to use features within our Sites when you grant us access to personal information from your Device, such as contact lists, or geo-location when you request certain Services that requires such access (for example, to locate an ATM); and
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Site users and consumers are among the assets transferred.

We keep personal information for as long as applicable law requires or allows and will use it for our legitimate business purposes. When we determine that personal information is no longer needed or that we are no longer required or allowed to keep it, we will securely delete that personal information.

With whom do we share your personal information?

Subject to other legal restrictions and notices you may receive from us based on our relationship with you, we may share the personal information we collect from and about you online described in this Policy:

• Among our affiliates and subsidiaries;
• With third party providers that have contracts with us, including contractors and technology service providers;
• To fulfill the purpose for which your personal information is provided;
• To comply with any court order, law, or legal process, including responding to any government or regulatory request;
• With your consent;
• To conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Site users and consumers are among the assets transferred; and
• For any other purpose we disclosed when obtaining the personal information.

Aggregated and De-identified information

We may aggregate or de-identify personal information, meaning we may remove any details that identify you personally. We may share this aggregated and/or de-identified information with third party providers to help deliver products, services and content that are better tailored to the users of our Services and for our own business purposes, where permissible under applicable laws and regulations.

How to limit sharing

You have choices regarding the sharing of some personal information. Where appropriate, we will limit sharing of your personal information based on your privacy choices.

Industry standards are currently evolving and we may not separately respond to or take any action with respect to a "do not track" configuration set in your Internet browser.

Additional Information

Third party data sharing

Some companies may offer aggregation websites and services that allow you to share your data with them to consolidate your account information from different sources (such as your accounts with us or with other financial institutions), so you can view it in one location or perform actions related to your accounts using their services. To do this, a third party may request you to authorize access to your GBank accounts by providing your GBank username and passcode or by providing your information-sharing consent directly to GBank. Please be careful about using these third parties and keep the following details in mind if you choose to use these third party service providers:

• The third party may access, on your behalf, detailed and personally identifiable information about you, about your accounts, transactions, and relationship with us, and about the Services you obtain from and through us;
• You should use caution and ensure the third party has appropriate policies and practices to protect the privacy and security of any personal information you provide or to which they are gaining access;
• Use of your information by the third party is governed by your agreement with them, not by any agreement you have with us;
• We are not responsible for the use or disclosure of any personal information accessed by any company or person to whom you provide your username and passcode;
• If you share your GBank username and passcode or other information about your accounts with others, we will consider your decision to share this information with others to mean that you have authorized any transaction or action that is initiated using the access information you provided;
• If you decide to revoke the authority you have given to a third party, we strongly recommend that you change your GBank passcode to ensure that the third party cannot continue to access your account.

Social media

We may engage with customers and potential customers on social media platforms, such as Facebook^®, Twitter^®, YouTube^® and LinkedIn^®.

• Any content you post on official GBank managed social media pages, such as pictures, information, opinions or any personal information that you make available to other participants on these social platforms, is subject to the Terms of Use and Privacy Policies of those respective platforms.
• When interacting with official GBank social media pages, GBank's privacy notices and any applicable social media user terms and community guidelines may apply.
• Please review the privacy policy for the specific social media service you are using to better understand your rights and obligations with regard to such content.

We may allow social share buttons on our sites that enable users to easily share information on social media platforms. The non-affiliated third parties that own these widgets may have access to information about your browsing on pages of our Sites where these widgets are placed.

Information We Collect

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device ("personal information").

Personal information does not include:

• Publicly available information from government records;
• Deidentified or aggregated consumer information; and
• Information excluded from the CCPA's scope, such as personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you. For example, from forms you complete or products and services you purchase.
• Indirectly from you. For example, from observing your actions on our Site.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to request a prequalified offer or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to obtain a product or service, we will use that information to process your request and facilitate delivery. We may also save your information to facilitate new orders or process transactions.
• To provide, support, personalize, and develop our Site, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests, purchases, transactions, and payments and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To personalize your Site experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Site and via email or text message (with your consent, where required by law).
• To help maintain the safety, security, and integrity of our Site, products and services, databases and other technology assets, and business.
• For testing, research, analysis, and product development, including to develop and improve our Site, products, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Site users and consumers are among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may share your personal information by disclosing it to a third party for a business purpose. We make these business purpose disclosures only under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract.

In the preceding twelve (12) months, we have disclosed personal information for a business purpose to the categories of third parties indicated in the chart below.

We do not sell personal information and have not sold personal information to third parties in the preceding twelve (12) months.

Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months (the "right to know"). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will disclose to you:

• The categories of personal information we collected about you;
• The categories of sources for the personal information we collected about you;
• Our business or commercial purpose for collecting that personal information;
• The categories of third parties with whom we share that personal information;
• If we disclosed your personal information for a business purpose, a list that describes the disclosures we made for a business purpose, identifying the personal information categories that each category of recipient obtained; and
• The specific pieces of personal information we collected about you (also called a data portability request).

Right to Delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions (the "right to delete"). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
• We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact us using the contact information included in the section above called Exercising Your Rights to Know or Delete.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.