Privacy Policy

What Does F&A Credit Union Do With Your Personal Information?

F&A Federal Credit Union ("we," "us," or "our") is committed to protecting your privacy. We respect your right to privacy and understand the importance of maintaining the security of your personal information.

Who This Policy Covers

This Privacy Policy applies to the information and data that we collect when a visitor or member:

• Visits our website or uses our digital banking platform
• Applies for an account
• Applies for one of our products or use our services
• Contact us through our website or in digital banking

The Policy describes how we collect, use, store, share, retain, transfer and process your Personal Information and how to exercise your choices and rights regarding it. "Personal Information" means information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household.

By using our website and our digital banking platform, you agree to the terms below.

We may amend this policy from time to time. We encourage you to review it periodically — changes will be posted on this page, and we will provide prominent notice of any material changes. If you do not agree with this policy, please do not use our website, products, or services.

Information Collected Automatically When You Visit Our Website

When you use our website, we may automatically collect information such as your IP address, browser and device information (browser type, device type, and similar technical data automatically sent by your browser), pages visited, date and time of access, and approximate geolocation collected through cookies and similar technologies. See "Cookies and Other Tracking Technologies" below and our Cookie Policy for details.

Information Collected When You Use Our Products or Services

When you use our products and services, we collect other types of Personal Information required to respond to an inquiry, to do business with us.

These types of Personal Information may include:

• Username
• IP Address
• Name
• Email address
• Street Address
• Telephone Number
• Age
• Gender
• Job Title/Employer
• Government-issued Identification Information
• Income
• Other

We also collect payment and billing information when you register for the use of our products and services. For example, we may ask you to provide a billing address for your account and payment information. We use this information solely to process payments and deliver our products and services.

Unless otherwise noted in this Policy, we act as the "controller" or "business" of personal data that we collect and process.

How We Use Your Information

Some of the information listed above — specifically government-issued identification information and income — is considered "Sensitive Personal Information" under California law. We use and disclose Sensitive Personal Information only for the purposes permitted by law and described in this policy, such as verifying your identity, providing services you request, communicating with you, and preventing fraud, and we do not use it to infer characteristics about you. You have the right to limit our use of Sensitive Personal Information; see "Your California Privacy Rights" below.

We retain personal information for as long as needed to provide our services, fulfill the purposes described in this policy, and meet our legal and regulatory obligations, and for a reasonable period afterward.

How We Share Information

We do not sell your personal information. As permitted by law and described below, advertising cookies may result in "sharing" as that term is defined under California law; see "Cookies and Other Tracking Technologies." Other than that, we disclose personal information only as permitted by law and only with:

• Trusted service providers and contractors who help us operate our business — for example, our payment processor, email platforms, and website vendors — solely to provide the services you request and to communicate with you.
• These service providers and contractors are contractually prohibited from using your personal information for any purpose other than providing contracted services, from using it for their own marketing, and from sharing it for marketing purposes.
• Government authorities or other parties, in response to a legal summons or subpoena, or as otherwise required by law.

Cookies and Other Tracking Technologies

Cookies are small pieces of data stored by your browser when you visit a website. Session cookies expire when you close your browser; "persistent cookies" remain longer and can store preferences such as your password. Cookies may collect your IP address, browser settings, and information about how you use the website, and your general location may be estimated from your IP address.

Some cookies on our site are used to deliver personalized advertising to you on this and other websites. Under California law, this activity may be considered "sharing" of personal information for cross-context behavioral advertising, even though we do not sell information for money.

To opt out, you may:

• Toggle on the "Do Not Sell or Share My Personal Information" switch in the cookies settings on our website;
• Change your browser settings to reject or delete cookies, or enable a recognized opt-out preference signal (such as Global Privacy Control), which we will honor as a valid opt-out request, or
• Visit www.cookiesandyou.com for more information about cookies and interest-based advertising opt-outs.
• You may unsubscribe from our emails at any time using the link in the message.

Third-Party Website Links

We may provide links to websites owned or operated by other companies. When you visit a third-party website, you will be subject to that website's privacy and security policies, which may differ from ours. Please review any third party's policies before providing personal information on their website.

Children's Privacy

The Children's Online Privacy Protection Act of 1998 ("COPPA") restricts the collection, use, or disclosure of personal information from children under age 13. Our site and digital banking platform is not directed to children under 13, and we ask that children under 13 not provide personal information through these channels; users who identify as under 13 will not be permitted to submit personal information online. We do not knowingly collect, use, or disclose personal information from children under 13 without prior verifiable parental consent. We do not sell or share the personal information of consumers we know to be under 16 years of age. Visit the Federal Trade Commission's website for more information about COPPA.

Protecting Your Information, Confidentiality and Security

We maintain physical, electronic, and procedural safeguards designed to comply with applicable federal and state standards to protect your personal information, and we maintain oversight of our third-party service providers to help ensure your information remains private and secure.

Your California Privacy Rights

If you are a California resident, you have the following rights with respect to your personal information, subject to certain exceptions and limitations under California law:

• Right to Know / Access — request the specific pieces and categories of personal information we have collected about you, the sources, our purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — request deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to Correct — request correction of inaccurate personal information we maintain about you.
• Right to opt out of Sharing — direct us not to "share" your personal information, including for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information — direct us to limit our use of Sensitive Personal Information (such as government-issued ID or income) to what is necessary to provide our services.
• Right to Data Portability — request a copy of your personal information in a portable format, where technically feasible.
• Right to non-discrimination — we will not deny you goods or services, charge different prices, or provide a different level or quality of service because you exercised any of these rights.

A Note on Financial Privacy Law: Personal information we collect and use in connection with your credit union membership, deposit accounts, loans, and other financial products and services is generally governed by the Gramm-Leach-Bliley Act (GLBA). Please reference our separate Deposit Account Agreement which is exempt from many CCPA requirements. This Policy's CCPA-specific rights described herein apply most directly to personal information collected from website visitors and others who may not be members, and to any information not otherwise covered by GLBA. If you are a member, please refer to our Deposit Account Agreement, provided at account opening.

Changes to This Policy

We may update this policy from time to time. The latest version will always be posted on this page with a revised date.

How to Contact Us

If you have questions about this policy, or would like to request to see, correct, or delete your personal information please contact us at (800) 222-1226 or write to us:

F&A Credit Union
PO Box 30831
Los Angeles, CA 90030-0831

This policy is updated as of 8/7/2026 and will be updated annually or as needed.