Privacy Policy

Purpose and Objectives

This policy reaffirms and formalizes Digital Access, LLC’s (“DA”) realization of and respect for the privacy expectations and rights of our customers regarding financial information and other related information, which DA has or gathers in the normal course of business. It is intended to provide guidance to DA personnel with respect to the physical safeguarding of information, as well as assurance to our customers. The rules apply only to information about individuals who obtain financial products or services to be used for personal, family or household purposes. Therefore, the rules do not apply to information about businesses, corporations, partnerships or similar entities or about individuals who obtain financial products or services for business purposes. Attempts to identify all customers or signers will be made prior to the release of information. We will also act in compliance with all applicable laws and regulations.

This policy applies to:

• Employees
• Any organization or individual with whom we have a contractual or fiduciary relationship
• Information in all forms, including oral, written, image and electronic
• Physical and logical (non-physical) protection
• All modes of information processing, including but not limited to, manual methods, hardware and software networks, other devices and information disposal techniques
• Information used by DA which originates outside including, but not limited to, vendors, contractors, customers, regulators, other enterprises and the public domain.
• DA’s information resources used by, shared by or in the custody of others
• Proper disposal of customer information and consumer information

NOTE: This statement of scope should not be interpreted to mean that all information resources must be protected equally.

DA expects that our processing partners will provide no less a level of customer privacy protection than that provided by DA. Conversely, DA will make every reasonable effort to apply the required level of customer privacy protection to partner information resources in our custodianship. These agreements should be concluded before accepting information resources from third parties.

Responsibility

The Board of Directors has the ultimate responsibility to appropriately establish and maintain this policy and assure that it is being observed in the daily operations of DA. The Compliance Team is responsible for carrying out this policy and making recommendations to the Chief Executive Officer (“CEO”) as to necessary or desirable changes to the policy.

Privacy Principles

DA recognizes the following eight elements of its privacy policy:

1. Recognition of Customer’s Expectation of Privacy
2. Use, Collection and Retention of Customer Information
3. Maintenance of Accurate Information
4. Limiting Employee Access to Information
5. Protection of Information via Established Security Procedures
6. Restrictions on the Disclosure of Consumer Information
7. Maintaining Customer Privacy in Business Relationship with Third Parties
8. Disclosure of Privacy Principles to Customer

Recognition of Customer’s Expectation of Privacy

Customers are entitled to the absolute assurance that the information concerning their financial circumstances and personal lives, which DA has obtained through various means, will be treated with the highest degree of confidentiality and respect. Certain expectations of privacy also contain legal rights of customers which are either granted or confirmed to them through various federal and state laws and regulations. All employees are directed by this policy to assure customers of DA’s commitment to preserving the privacy of their information. DA will post a notice on its website, which contains an abbreviated version of this policy. A notice will be given to any potential customer or current customer upon request.

Standards of Administrative, Technical & Physical Safeguards

Each department will secure information from unauthorized viewers or recipients by keeping open work areas free from customer or consumer information when areas are unattended. This includes removing and securing information on computer terminals, written documents on desks or counters or any other means information may be available to unauthorized persons.

Use, Collection and Retention of Consumer Information

It is the policy and practice of DA to collect, retain and use information about consumers and customers (both individually and corporate) only where DA reasonably believes the gathering of such information would be useful and allowed by law to administer DA’s business and/or to provide products, services or opportunities to its customers.

Maintenance of Accurate Information

Management is directed to establish procedures to ensure that, to the extent practicable, all customer financial information is accurate, current and complete in accordance with reasonable commercial standards. DA will respond promptly and affirmatively to any legitimate customer request to correct inaccurate information, including forwarding of corrected information to any third party who had received the inaccurate information. DA will further undertake to record such corrective action was requested by the customer and follow up with any third party to ensure that they have received notice of the required correction.

Procedures to ensure customer records are accurate and regularly updated will be maintained. Every opportunity will be given to customers to correct information held at DA. All attempts to have changes of information, addition or deletion will be done in writing whenever possible. Attempts to detect identity theft through unauthorized means will be strictly adhered to.

Limitation on Employee Access

Management will take all steps necessary to ensure that only employees with a legitimate business reason for knowing personally identifiable customer information shall have access to such information. To the extent practicable, access will be limited by computer access codes and grating limited access to areas in which sensitive customer information is retained. Employees will be informed at the time of their initial employment of these standards and will periodically be reminded of these standards during training sessions at least once during each calendar year. Willful violation of this element of this policy will result in disciplinary action against the offending individual. Inadvertent violations will be dealt with in a manner to ensure that such violations are not repeated.

Protection of Information

DA will maintain appropriate security standards and procedures to prevent unauthorized access to customer information. Such procedures should prevent access by not only unauthorized employees, but others as well. Such other include but are not limited to, all non-employees with otherwise legitimate reasons for being on DA premises, computer “hackers” and any intruders on DA premises. Unauthorized use of non-public personal information by non-DA employees will be reported under a Suspicious Activity Report (“SAR”) and appropriate notification to law enforcement.

Properly disposing of customer information and consumer information

Customer or consumer Non-public personal information (“NPPI”) will be safeguarded from unauthorized persons during its use within DA. This may be by keeping documents in non-public areas or in locked drawers, locked cabinets, locked offices or locked rooms when these areas could be assessable to non-authorized persons. Documents will be retained for the proper retention period as outlined in DA’s retention schedule and will be destroyed using proper disposal methods either within DA using shredders or placed in locked shred bins for pick up and disposal by our third-party shred/disposal company.

Access of Information by Customers and Consumers

Customers or consumers may access their information only after sufficient identification has been made. When requesting information in person, visual identification documents will be requested, and ownership rights will be verified prior to releasing information.

Customers and consumers who request information over the phone may be refused the information and requested to personally appear so identification may be made or if sufficient information may be obtained to verify the identity which would be any information a customer would know but a thief or other unauthorized person would have to guess.

ATM information access requires a customer-initiated PIN number as well as other authentication information. This PIN is the personal information of the customer and is not to be requested by an employee.

General Restriction on the Disclosure of Customer Information

DA will not, except in cases allowed or required under the law, reveal specific information about customer account or other nonpublic personal information to any nonaffiliated third parties unless the customer has been provided the required privacy disclosure and is given opportunity to decline or opt out.

Incident Response Procedures

In the event of a breach of customer or consumer non-public information, a report will be submitted to the CEO. The CEO may designate another employee to research and notify the effected customer or consumer of the breach. Refer to DA’s Incident Response Plan for additional information.

Business Relationships with Third Parties

If DA is requested to provide personally identifiable information to a third party, from which the consumer has no right to opt out, and that request is in all respects consistent with other elements of this policy, DA will accede to the request only if DA believes that the party adheres to similar privacy principles, no less stringent than set forth in this policy, that provide for the keeping of such information confidential.

DA will not enter into an agreement with any entity covered under the first category of exceptions, listed below, without first requiring the entity to maintain the confidentiality of the information to at least the same extent that DA must maintain that confidentiality and limit the third party’s use of the information solely to the purposes for which it is disclosed or as otherwise permitted by law.

Exceptions to the Opt Out Requirements

The requirements for initial notice, for opt out, and for service providers and joint marketing do not apply if DA discloses nonpublic personal information:

• As necessary to effect, administer, or enforce a transaction requested or authorized by the consumer.
• To service or process a financial product or service requested or authorized by the consumer.
• To maintain or service the consumer’s account.
• In connection with a proposed or actual securitization or similar transaction related to a transaction of the customer.

Record Keeping and Reporting

The Compliance team will maintain a separate file for the purpose of retaining any customer complaints which relate to this policy. The information regarding any complaint should include the exact nature of the complaint, describe the corrective actions taken, and confirm that the corrective actions resolved the complaint.

The Compliance Team will make an annual report, or more frequent, to the CEO concerning customer complaints related to privacy concerns which shall include the frequency and nature of such complaints and corrective action taken.