We collect personal information, meaning information that is linked or reasonably linkable to you, in two ways.

What you give us. Most of what we collect comes straight from you. That includes information you enter when you fill out forms, apply for a product, respond to a survey, enter a contest or promotion, send us an email, chat with our virtual assistant, or use mobile or online banking. It also includes the contents of your emails and chats with us, and the check images and information you provide when you deposit a check from your phone. We may keep copies of those messages and chat transcripts.

What we collect automatically. When you use our Sites, we and our service providers collect certain information through cookies and similar technologies, described in “Cookies and Other Tracking Technologies” below:

• Usage information: the pages you view, how often you visit, the site you came from, and what you click or tap.
  Device information: your hardware model, operating system, app version, browser, and, for mobile devices, the device type and carrier.
• Location information: your IP address, from which we estimate your general location, such as your city or region. We do not collect your device’s GPS location. See “Your Location” below.
• Interaction information: screens and pages visited, buttons and links used, taps, mouse movements, and limited information you enter.
• Sign-in and security information: records of your online banking sign-ins, including dates and times, how often you visit, and which pages you use, plus information about failed sign-in attempts and other activity we consider a threat to our systems. We use these records for internal review, product evaluation, and security.

Device features you may allow. Depending on what you use, the app may ask for permission to use your camera (for example, to deposit a check), or notifications. You can change these permissions at any time in your device settings.

Our mobile app and website receive your IP address whenever you use them, and we use it to estimate your general location, such as your city or region. Your device’s GPS location is not asked for or collected.

Why we use it. We use this information to detect and investigate fraud, such as when a sign-in or transaction comes from somewhere unexpected.

Who sees it. We share this information only with the service providers that help us run our Sites and protect your accounts, as described in “Who We Share Information With.” We do not sell it.

How long we keep it. We currently keep IP addresses, and the general locations we estimate from them, without a fixed deletion date. See “How Long We Keep Information.”

Your say. Your IP address is shared whenever a device connects to the internet, so there is no setting that can turn this off. You can ask us questions about, or ask us to delete, information we hold about you, as described in “Your Choices.”

We use the information we collect to serve you and to keep ACU safe and sound. In particular, we use it to:

Serve you

• Provide our products and services, and review and process your applications and transactions, including checking your eligibility and pre-qualifying you for products.
• Maintain and service your accounts.
• Verify your identity so we can let you in and protect your accounts.
• Respond to your questions and requests.
• Tell you about important changes to your accounts, services, terms, and policies.
• Personalize your experience and remember your preferences.

Run and improve our business

• Maintain and improve our Sites and Services, including debugging, session management, and security.
• Analyze how our Sites are used and how well our marketing works.
• Develop new products and improve existing ones.
• Create aggregated or de-identified information, which we may use for any lawful purpose.
• Operate our business, including audits, credit risk analysis, resolving complaints and disputes, credit reporting, and compliance and human resources activities, including processing job applications.

Market to you

• Send you marketing communications and ads that we think may interest you. You can opt out as described in “Your Choices.”
• We may combine information from our social media pages and other online interactions with information we already have, or obtain, to help verify your identity or account status.

Protect and comply

• Detect, prevent, and investigate fraud, illegal activity, security threats, and breaches of our policies and agreements, including by using your IP address to estimate your general location.
• Protect the safety of our members, workforce, premises, and systems, and the physical safety of any person.
• Comply with the law, industry standards, contracts, and legal or regulatory requests.
• Establish, exercise, and defend our legal rights and those of others.
• Enforce this policy and our Terms of Use.

We may also use your information for other purposes we describe to you when we collect it, or for purposes that are reasonably related to the reason we collected it.

We do not sell your personal information. We do share it in the following ways, and only as the law allows.

• Service providers that work on our behalf, such as email, hosting, maintenance, backup, analytics, and digital banking providers. They are bound by contract to use the information only to carry out the services we ask for.
• Credit reporting agencies, to report on your financial history and for other lawful purposes.
• Analytics providers such as Google Analytics, which help us understand how our Sites are used, as described in “Cookies and Other Tracking Technologies.”
• Anyone you ask us to, or with your consent, for example when you use a third-party service to manage your finances across institutions.
• Anyone who needs it to service or process a product or service you requested.
• Other companies, agencies, and law enforcement officials, when we share information about failed sign-in attempts and other activity we consider a threat to our systems, as we decide is necessary or the law requires.
• Government agencies and other third parties, when we believe it is necessary to respond to a subpoena, warrant, court order, or other legal process, or a supervisory exam or law enforcement or government request. That also includes detecting and preventing fraud or other illegal activity, enforcing our terms and collecting past-due accounts, protecting the rights, property, safety, or security of ACU, our workforce, our members, or others, and otherwise complying with the law. This includes legal proceedings, current or expected, and people we reasonably believe could obtain a court order for the information.
• A buyer or successor, if we sell or transfer all or part of our business or assets, or prepare to, such as in a merger, acquisition, reorganization, bankruptcy, or liquidation.

We may also share information that does not identify you, such as aggregated, de-identified, or anonymous information, and information that is publicly available.

How we share your nonpublic personal financial information more generally, and your choices about that, are explained in our GLBA Privacy Notice.

What these tools are. Like most organizations, we use cookies and similar technologies, such as pixels and web beacons (together, “cookies”). Cookies are small files that your browser or device stores. Web beacons, also called pixels or pixel tags, are tiny, often invisible images or bits of code on web pages and emails. They report back to whoever placed them, such as how often you visit, what you view, and whether you opened an email. Server logs also record details of each visit, such as the time and day.

What we use them for. We use them to:

• Recognize you when you return, and remember your preferences.
• Estimate audience size and usage patterns, and gather aggregate data on traffic and interactions so we can fix problems and improve the Sites.
• Keep track of our ads and search results, and tell you about content and services that fit your interests.
• Help protect your account. For example, if we do not recognize your device, you may be asked extra security questions at sign-in.

We set some cookies ourselves. Others are set by companies we work with, such as Google, to help us improve our Sites and understand how they are used. Together, cookies and beacons can link your activity to a unique ID and recognize you across visits.

Google Analytics. Our Sites use Google Analytics, a web analytics service from Google, to learn how people use them. Google Analytics uses cookies to recognize your browser on later visits, and it collects information such as how often you visit, which pages you view, and which site you came from. We use this information only to improve our Sites. We do not send Google your name, account number, or other information that directly identifies you, and we do not combine Google Analytics data with that kind of information. Google’s use and sharing of this information is limited by the Google Analytics Terms of Service and the Google Privacy Policy. You can learn more in Google’s How Google uses information from sites or apps that use our services. To opt out, see “Your Choices.”

Online banking cookie. Online banking uses a cookie to keep you signed in and to time out your session after a period of inactivity. It holds only the information we need for security. We do not store your access code, user ID, or password in a cookie. If your browser blocks this cookie, you will not be able to sign in.

Some internet browsers have a “Do Not Track” feature that tells the websites you visit that you do not want your online activity tracked. Browsers do not send this signal in a uniform way, so our Sites do not currently interpret, respond to, or change their practices when they receive a “Do Not Track” signal.

Likewise, if “Do Not Track” or a similar mechanism is turned on in your browser, we do not respond to it or take any action because of it. In other words, we do not disable tracking. You can still manage cookies as described in “Your Choices.”

You are in control of a lot of this.

App permissions. On your phone, open Settings, find our app, and choose which permissions it has, such as camera and notifications. You can change them at any time.

Cookies. Most browsers let you see when cookies are set, delete them, or block some or all of them. Check your browser’s settings or help pages. If you block them, parts of our Sites may not work. For example, we may not recognize your device, and you may need to answer challenge questions each time you sign in to mobile or online banking.

Google Analytics. To stop Google Analytics from collecting information about your visits to our Sites, you can install Google’s Google Analytics opt-out browser add-on.

Marketing emails. Use the unsubscribe link in any marketing email. It can take up to 10 business days to take effect. We may still send you messages about your accounts and other non-marketing matters.

Your information. To ask about, correct, or delete information we hold about you, contact us using the details at the end of this policy. We may need to keep some information where the law requires it or to protect against fraud.

We keep information only as long as we need it for the purposes in this policy, and for as long as the law or our record retention schedule requires. We currently keep IP addresses, and the general locations we estimate from them, without a fixed deletion date, because we may need them to investigate fraud. Account and transaction records are kept for the periods that applicable law and our record retention policy require.

When we no longer need information, we delete it or de-identify it. Removing the app stops new collection from the app, but it does not by itself delete what we have already collected. To ask us to delete information, contact us as described below.

How we protect your information. We use administrative, technical, and physical safeguards, including encryption of data in transit and digital server authentication when you use online banking. No system is completely secure, so we cannot promise absolute security. Please protect your sign-in credentials, use a strong password that you change regularly, close your browser when you finish (especially on a shared or public computer), and tell us right away if you suspect someone has accessed your account. We will never ask you for personal or financial information by unsecured email. Please do not use regular email to send us account information or to ask us to make a transaction or change your information, because we cannot be sure the message is from you and we will not act on it. Use online banking, call us, or visit us instead.

Children. Our Sites are not directed to children under 13, and we do not knowingly collect, use, or disclose personal information from children under 13.

Links to other sites. We link to sites we do not own or control, such as credit bureaus, service providers, and merchants. Their privacy and security practices may differ from ours, so please review their policies. ACU is not responsible for the privacy or security of those sites, or for the accuracy, completeness, or reliability of their content.

Call toll-free 800.687.4328  or

Visit us online: www.alliancecutx.com/contact-us