Privacy policy

Privacy Policy

Last Updated: April 2025

Printer Friendly version (PDF)

Download Spanish version (PDF)

We recognize that you trust us with your personal and financial information. This Privacy Policy explains how the U.S. Bancorp family of financial service providers, including Elavon, Inc., talech, LLC, TravelBank (“Elavon,” “we,” “us,” and “our”) may use and share information collected when customers, clients, and site visitors visit or use our websites, mobile applications, and other online services to which a copy of this Privacy Policy is posted and including our branded social media pages (collectively, “our online services”). This Privacy Policy applies whether you visit or use our online services through your computer, smartphone, tablet, or other devices. It also explains your interactions with our advertisements, both with our online services and through our digital advertising campaigns.

Other privacy policies and privacy rights could also apply depending on how you interact with us, the financial products or services you may ultimately obtain from us, or the jurisdiction in which we are doing business with you. While this Privacy Policy describes how we collect, use, and share information, please be aware that additional terms and conditions may apply for certain parts of our online services.

However, if you or the entity you are authorized to represent (collectively, “you” or “your”) have previously entered into a services agreement with Elavon that governs the provision of transaction processing services (“Services Agreement”), the Services Agreement (and not this Privacy Policy) governs each party’s rights and obligations with respect to Cardholder Data, Transaction-related information (as those terms are defined in such Services Agreement) and other information gathered or submitted in connection with the transaction processing services provided under the Services Agreement are set forth in the Services Agreement. If the same information is both gathered by the Site and gathered or submitted in connection with the transaction processing services provided under the Services Agreement, the terms of the Services Agreement will govern each party’s rights and obligations with respect to such information. To the extent permitted by law, in the event this Privacy Policy conflicts with the terms of any Services Agreement or other agreement with us, the terms of such Services Agreement or other agreement shall control.

By using online services, you are accepting the practices described in this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use online services. To the extent permitted by applicable law, by using our online services or otherwise interacting with one of our advertisements or account on a third-party site, you consent to this Privacy Policy, including our use and disclosure of information about you in the manner described in this Privacy Policy. To the extent permitted by applicable law, if you give any information about other individuals to us in connection with our online services, you represent that you have the authority to give to us such information and the authority to permit us to use such information in accordance with this Privacy Policy. Under certain circumstances, we may also obtain additional consents if required under applicable law.

This Privacy Policy explains:

Information We Collect
How We Collect Information
How We Use Information
Why We Disclose Information/To Whom We Disclose Information
Online Tracking and Advertising
Linked Websites
Data Security
Preventing Identity Theft
Children’s Online Privacy
External Aggregation Services
Social Media Platforms
Retention Periods
Cross-Border Transfers
State and International Privacy Laws
Changes to the Privacy Policy
Who We Are and How to Contact Us
Accessibility

1. Information We Collect

We may collect personal information and other information about you, your device, and your company. For example:

Identifying Information and Background

Including name or alias, postal address, email address, and telephone number for your home or work

Including your assigned customer number, employee identification number assigned to you by your employer, social media and proprietary platform IDs (e.g., RampIDs), or other assigned reference numbers and touchpoints

Including education, employment, employment history, veteran or military status, and union membership Including account application information such as credit and income information or financial records

Government-Issued Identifiers

Including Social Security number, driver’s license and state identification card number, passport number, employer identification number (EIN), or other tax identification number (TIN)

Physical Characteristics and Demographic Data

Including age or birthdate, marital status, parental status, physical characteristics or description, race, color, ancestry, national origin, citizenship, religion or creed, or sex (including gender, gender identity, gender expression, sexual orientation) Including your signature

Account Information and Payment Information

Including account name and account number, security or access code, security questions and answers, password, or credentials allowing access to an account Including insurance policy number and other insurance information Including payment history, financial transactions, purchasing history, and travel preferences

Location Data, Biometrics, and Behavioral Characteristics

Including physical location or movements, which may include your actual location to help you in finding a nearby ATM, branch, or office

We do not access location data stored on your device without your permission. Some features will not fully function unless you have enabled access to your location data.

Including biometric information and behavioral characteristics (for example, verification by voiceprint with our call centers and tracking of keystroke and mouse movement patterns on our online services and with our advertising campaigns)

We do not however have access to the information your device uses to enable facial or fingerprint recognition, nor do we have access to or store your facial image or fingerprint data. Your device may store the information it needs to recognize your facial features or fingerprints. Our online services may use your device’s functionality to obtain a signal that your device recognizes your facial features or fingerprints when you sign on. You can always turn off facial or fingerprint recognition and go back to inputting user ID and password at any time. Your device’s user information will have additional information about its user controls and settings, including its privacy and security controls.

Company and Commercial Information

Including formation and organization documents, information about owners and employees, and financial records

Including banking information

Including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Including billing address, business contact information, travel preferences, and specific expenses

Audio and Visual Information

Including documents or images submitted via our online services, such as selfies, checks, and banking statements

Including audio and visual information, including audio, electronic, or similar information we capture through your communications with us (for example, voice recordings of telephone conversations, emails and instant messaging, and security images if you visit our branches or offices)

Including photographs, images, videos, and recordings of your voice (such as when we record customer service calls for quality assurance and training purposes)

Device Information and Other Unique Identifiers

Including unique personal identifier, online identifier, Internet Protocol address, hashed email address, hashed telephone number, mobile advertising IDs (MAID) (e.g., Android Advertising ID (AAID), Google Advertising ID (GAID), Google Click ID (GCLID), and Apple’s identifier for advertisers (IDFA)), or other identifiers

Including the type of operating system and browser you use, the parts of our online service you access, your Media Access Control (MAC) address and other device identifiers, computer type (Windows® or Macintosh®), screen resolution, operating system name and version, device manufacturer and model, language preferences, Internet browser type and version

Internet or Other Network Activity

Including data resulting from your activity, such as transaction information and the pages you visit on our online services, social media preferences, and log information such as your search and voice to text queries in the mobile app, Internet, or other electronic network activity information, including browsing history and the sites you visit, referring URLs, search history, information on you or your device’s interaction with our online services or other websites, applications, or advertisements

Including whether you received, accessed, or acted in response to the contents of your mail, email, text messages, and calendar invites that we send to you (or that others send on our behalf) or that you send to us

Including responses to advertisements on sites and mobile apps where we advertise

Including behavioral characteristics, such as keystroke and mouse movement patterns Including software crash reports, session identification number, and access time and other information regarding your use of our online services

Attitudinal Data and Inferences

Including attitudinal data from consumer satisfaction surveys, voice inflection, product desirability, and purchase criteria

Including inferences drawn from other personal information to create a profile about you reflecting preferences, characteristics, attitudes, and or similar trends (for example, we may later associate the usage and other information we and our ad partners collect online with personal information about you, your household, your device, your company, or others)

Additional Information

Including information to help virtual or in-person event management (for example, attendee names, dietary requirements, special assistance needs, and travel details for participants)

Including information collected when providing your business card or other contact information during business meetings, at trade shows, or other in person events

Including information about you from other online and offline sources, such as referral partner sites, public databases, social media platforms, data brokers, credit reporting agencies, identity verification services, aggregators, and other third parties

Analytics Information and De-identified Data

Including analytics data that we may directly or indirectly collect, including with the use third-party analytics tools such as Google Analytics® to help us measure traffic and usage trends for our online services and to understand more about the demographics of our users

You can learn more about Google’s practices at http://www.google.com/policies/privacy/partners and view its opt-out options at https://tools.google.com/dlpage/gaoptout.

Including de-identified data

We also maintain and use de-identified data for some purposes in such a way that any information can no longer be linked to you or any device associated with you. When using de-identified data, we take reasonable measures to ensure that the information cannot be reassociated with you or your device. We have also implemented technical and organizational safeguards as well as business processes designed to prohibit the reidentification of your information. We contractually obligate recipients of the de-identified data to comply with applicable laws about deidentification and we monitor compliance with any contractual commitments in accordance with our vendor due diligence programs. In certain limited circumstances, we may reidentify such data for the purposes of providing the online services and customized recommendations. In such circumstances, our use of such personal information is in accordance with our privacy commitments under applicable privacy policies.

2. How We Collect Information

We collect information from various sources. For example:

From You

We collect information from you or about you when you provide this information to us directly. For example, we may obtain information when you apply for or obtain products or services from us, engage our online services (including when using co-browsing, if available), register an online account with us, respond to surveys, contact customer support or our call centers, engage in chat features through our online services, visit our offices, or otherwise interact with us.

From Your Employer or Your Company

If you interact with us through your employer or company, we may receive your information from your employer or company, including from another representative of your employer or company.

From Tracking Technologies

We, and our third-party partners, may automatically collect (intercept, record, maintain, share, disclose) information about your activity when you are using our online services, receiving emails, or otherwise engaging with us. We typically collect this information through a variety of tracking technologies, including (i) cookies or small data files that are stored on your computer or other device, (ii) the use of sessionreplay tools or data collected through the deployment of video content, and (iii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies, and logging technologies (collectively, “tracking technologies”) and we may use third-party partners or technologies to collect this information. Information we collect automatically about you may be combined with other information we collect directly from you or receive from other sources. Please go to Online Tracking and Advertising below for more information.

From Other Online and Offline Sources

We may also receive information about you from other online and offline sources, such as public databases, social media platforms, and other third parties. We may also obtain information about you from other sources, such as data analytics providers, marketing or advertising service providers, social media platforms, aggregators, fraud prevention service providers, vendors that provide services on our behalf, or publicly available sources. We may also collect information about you that we receive from our offline interactions with you or your company.

From Models, Predictions, and Profiles

We also create information, models, predictions, and profiles about you, your company, and others based on our analysis of the information we have collected from and about you and others.

3. How We Use Information

We may use the information to:

• Offer and deliver products and services to your company or you, including evaluation of your company’s application

• Send you newsletters, offers, and promotions for our services, third party products and services, or special events by e-mail, text, or another medium

• Operate, evaluate, and improve our business (including improving existing and developing new products and services for us, our affiliates, or our partners)

• Perform accounting, auditing, and other internal business operations

• Respond to requests, communicate with you, provide customer support, resolve disputes, and manage your and your company’s preferences

• Provide you and other authorized users with access to your company’s accounts with us, including communicating with you about the account

• Personalize your online experience and allow you to use features within our online services, including autocompleting applications

• Provide advertising to you, your company, and others (including others like you)

• Detect and prevent fraud and enhance the security of our business, your accounts, or our online services

• Help improve credit risk management

• Verify your identity or location for security, fraud prevention, and other risk control purposes

• Conduct and publish aggregated research, industry indicators, and benchmarking

• Perform data analytics • Comply with and enforce applicable legal requirements, relevant industry standards, contractual obligations, and our policies and otherwise protect our rights and operations

• For any other purposes permitted by applicable law

• For any other purposes that we may specifically disclose at the time that we collect your information We may use artificial intelligence (AI), generative AI, predictive models, or machine learning, including third-party external consumer data and information sources, in compliance with applicable laws and regulations, to improve, promote, and deliver products and services and augment our business practices.

4. Why We Disclose Information/ To Whom We Disclose Information

We may disclose information in different ways and to different persons as permitted or required by law. For example, we may disclose or share information:

• To process transactions requested by you or your company

• To effect, administer, or enforce a transaction

• With your consent

• To protect the confidentiality of records, to protect against fraud, to resolve customer disputes

• To provide information to insurance rate advisory organization, rating agencies, persons assessing our compliance with industry standards or our attorneys, accountants, and internal and external auditors

• To comply with contractual and legal obligations and requirements

• To a consumer reporting agency (credit bureau)

• In connection with a proposed or actual sale or merger of all or part of our business, business line, portfolio, or portion of our business

• With our vendors, service providers, and other third parties

• With our affiliates and otherwise within the U.S. Bancorp family of financial service providers

• With law enforcement, regulatory and other governmental agencies, and other third parties to comply with relevant laws and regulations and properly authorized subpoenas or with other official agencies with authority over us, such as regulatory agencies

• With others in order to act under emergency circumstances to protect the person safety of us, our affiliates, agents or the users of our online services or the public

• With certain business partners, co-marketers, and other third parties (but not so that they may independently market to you)

• To persons holding a beneficial interest relating to you or persons acting on behalf of you • For any other lawful purpose or as otherwise required by applicable law

We may use and disclose information even when you are no longer our client.

5. Online Tracking and Advertising

We recognize Global Privacy Control (GPC), which is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When we detect a GPC signal from a browser, our online services are designed to treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser.

You can also opt out of certain targeted advertising by visiting the YourAdChoices.com | Welcome to YourAdChoices.com and by adjusting the privacy settings on your mobile device (e.g., “Limit Ad Tracking” on iOS or “Opt out of Ads Personalization” on Android). You may be able to set your web browser to tell you when cookies are set, delete your cookies, or block cookies altogether. Please check your browser’s settings or support pages to learn how to manage cookies and other tracking technologies on your browser or device.

We use advertising platforms Trade Desk and LiveRamp to help us execute our marketing campaigns. These third parties may also provide you with the ability to further limit the use and sharing of your information for advertising purposes with their other clients. You may visit Trade Desk at https://adsrvr.org/ and LiveRamp at liveramp.com/opt-out to learn more about their privacy practices and opt-out options.

Please note that your preferences will apply only to the specific browser or device from which you opt out. You will need to opt out separately on all your browsers and devices. If you delete cookies, change web browsers, reset your mobile advertising ID, or use a different device, you may need to opt out again. If you choose to reject cookies, some features of our online services may no longer function. Please see your Terms of Use with us for details.

Please note that even if you opt out, you may still receive online advertising from us. Opting out from a specific advertising provider means that the ads you do receive will not be based on your preferences or behavior. In addition, you may still see targeted pages based on your habits as you navigate our online services, including www.elavon.com or www.usbank.com.

You may have additional rights to opt-out of our use of your information depending on how you interact with us, the financial products or services you may ultimately obtain from us, or the jurisdiction in which we are doing business with you. For example, if you do not want us to serve you targeted advertising based on your visit to our online services, you can opt-out of targeted advertising by clicking the “Your privacy choices”.

6. Linked Websites and Other Offerings

Our online services may contain links to other websites, widgets, plug-in, applications, or solutions offered by us, our affiliates, or third parties. Please be advised that the practices described in this Privacy Policy may not apply. We encourage you to be aware when you leave our online services and to read the privacy policies and terms of use of any such websites or offerings that may collect your information, as they will likely differ from those of our online services. We do not guarantee, and we are not responsible for the privacy or security of these websites or offerings, including the accuracy, completeness, or reliability of their information or data practices.

For example, we may disclose your information to advertising platforms at your direction, or security service providers to help prevent unauthorized access to our online services. Please be aware that these parties’ privacy notice applies to the information that you share directly with them. For example, we use Google’s reCAPTCHA to prevent misuse of our online services.

In addition, we are not responsible for the information collection, use, and disclosure practices (including the data security practices) of other organizations, such as Meta, Instagram, and X, or any other app developer or provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer.

7. Data Security

The security of your personal information is important to us. We review our security procedures to consider appropriate technology and methods to secure information.

Our security procedures mean that we may occasionally request proof of a id="id_theft">identity before we disclose your information to you. In certain telephone and in person transactions we may ask for your full Social Security number, account number or other information to verify your identity before conducting the transactions you have requested. Note that we will never initiate a request via email for your sensitive information (e.g., Social Security number, personal ID, password, PIN or account number). If you receive an email asking for your sensitive information, you should be suspicious of the request and promptly contact us to report the suspicious activity.

Please understand, however, that while we try our best to safeguard you and your company’s information once we receive it, no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure.

8. Children’s Online Privacy

We do not use our online services to knowingly solicit personal information from or market to children under the age of 13 without parental consent. We request that such individuals do not provide personal information through our online services. If parents or guardians becomes aware that their child has provided us with information without their consent, they should promptly contact us in accordance with the Contact Us section below and we will delete such information from our files.

9. Social Media Platforms

We may interact with users of various social media platforms, including Meta®, Instagram®, X® and LinkedIn®. Please note that any content you post to such social media platforms (for example, pictures, information, or opinions), as well as any personal information that you otherwise make available to users (for example, your profile), is subject to the applicable social media platform’s terms of use and privacy policies. We recommend that you review this information carefully to better understand your rights and obligations with regard to such content.

10. Retention Periods

We store information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

11. Cross-Border Transfer

The online services linking to this Privacy Policy are controlled and operated by us from the United States. We have service providers in the United States and other countries. Therefore, we and our service providers may transfer your personal information to, or store or process your information in any country where we have facilities or in which we engage service providers, including in jurisdictions that may have different data protection rules than those of your country. We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it.

For non-U.S. online services, please review the privacy policy applicable to that service to understand how your information will be collected, processed, and safeguarded. If you are uncertain whether this Privacy Policy conflicts with the applicable local privacy laws where you are located, you should not use these online services or submit your information to Elavon.

12. California

If you live in California and want to learn about your privacy rights and how we comply with California privacy laws, please visit our California Privacy Center.

13. Changes to the Privacy Policy

From time to time, we may update this Privacy Policy to accommodate new technologies, industry practices, regulatory requirements, or for other purposes. We encourage you to review this Privacy Policy periodically to ensure that you understand what we collect and how we use and share information through the online services. If we do update this Privacy Policy, we will let you know by posting the revised policy with a new “Last Updated” date posted at the top of this policy. We may also provide you with an additional notice (such as by adding a statement to our online services or sending you a notification), in connection with making material changes to this Privacy Policy. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

If we intend to apply the modifications or amendments to this Privacy Policy retroactively or to personal information already in our possession, we will provide you with notice of the modifications or amendments and if required by law, obtain your consent.

Any changes to this Privacy Policy will become effective when the revised policy is posted (and subject to any advance notice that may be required under applicable law). By continuing to use the online services following such changes, you are agreeing to accept the terms of the revised Privacy Policy.

14. Your Obligations

When using our online services, you promise to: (a) provide true, accurate, current and complete information about yourself and your business, and (b) maintain and promptly update the registration information to keep it true, accurate, current and complete. If you provide any information that is untrue, inaccurate, not current or incomplete, or we have reasonable grounds to suspect that such information is untrue, inaccurate, not current or incomplete, Elavon has the right to suspend or terminate your account and refuse any and all current or future use of the onsite services (or any portion thereof).

You are entirely responsible for the security and confidentiality of your password and account. Furthermore, you are entirely responsible for any and all activities that occur under your account. If you suspect that your account or password have been compromised, you must inform Elavon promptly. We may need to suspend access until we are able to issue new credentials to access your account. Any transactions in your account will be considered authorized by you unless you have informed us of your compromised account or password.

15. Assignment

We may change our ownership or corporate organization while providing the online services or sell certain assets associated with the online services. In such events, we will comply with applicable laws that govern the transfer of personal information in business transactions and provide with appropriate notification and choice, as required by law. As a result, please be aware that in such event and to the extent permitted by law we may transfer some or all of your information to a company acquiring all or part of our assets or to another company with which we have merged. Under such circumstances we would, to the extent possible, require the acquiring party to follow the practices described in this Privacy Policy, as it may be amended from time to time. Nevertheless, to the extent permitted by law, we may not be able to promise that an acquiring company or the merged company will have the same privacy practices or treat your information the same as described in this Privacy Policy.

16. Who We Are and How to Contact Us

If you have any questions or comments about this Privacy Policy or our privacy practices generally, we encourage you to contact us by mail or email: Elavon Attn: Compliance/Privacy Policy Two Concourse Pkwy Suite 800 Atlanta, Georgia 30328 privacypolicyinfo@elavon.com

California Privacy Center

U.S. Bank is dedicated to doing the right thing. The information on this disclosure provides details on how we respond to and implement processes to uphold applicable state laws. The laws on this disclosure give individuals certain rights regarding the personal information that U.S. Bank or our affiliates have collected from or about them. The information on this disclosure complements the notices and disclosures regarding your rights under federal laws and regulations (e.g., the Gramm-Leach-Bliley Act [“GLBA”]). For more information, please visit usbank.com/privacy.

U.S. Bank California Privacy Notice for California Residents

Last updated: October 2025 This Privacy Notice for California Residents (this “Notice”) applies solely to residents of the State of California (“consumers” or “you”) and supplements the information contained in any other privacy policies, notice or other disclosures provided by U.S. Bank and its affiliates (collectively, “U.S. Bank,” “our” or “we”). Please note that some of our affiliates may provide a separate privacy notice, in which case that notice will apply to your personal information. We adopt this Notice to comply with the California Consumer Privacy Act of 2018 and, as amended by, the California Privacy Rights Act of 2020 (together, “CPRA”). This Notice describes how U.S. Bank collects, uses, and discloses information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“personal information”). This Notice applies to personal information we collect online and offline, such as when you apply for our products or services, use our websites or mobile applications, respond to surveys or interact with our advertisements, contact customer support, when you visit our offices or attend a U.S. Bank event, or otherwise interact with us (collectively, “Services”).

The rights contained in this Notice may not apply in certain situations depending on your relationship with U.S. Bank and U.S. Bank’s other legal obligations, and as otherwise provided for in the CPRA, and the exemptions contained therein. We may, from time to time, make changes to this Notice. If we do make changes to the Notice, we will let you know by posting the revised Notice with a new “Last updated” date posted near the top of the Notice. Any changes to this Notice will become effective when posted unless indicated otherwise. We encourage you to review this Notice regularly to stay informed about our information practices and the choices available to you.  

Contents

Categories of Personal Information We Collect
Where We Collect Your Personal Information
Use of Personal Information
Disclosure of Personal Information for a Business or Commercial Purpose
Retention Period
Sharing or Selling Your Personal Information
Use of Sensitive Personal Information
Summary of Prior 12-Month Personal Information Handling Practices
Your Rights and Choices
Accessibility
Contact Information

Categories of Personal Information We Collect

We may collect the following categories of personal information when you engage our Services:

• Identifiers – A name, alias, postal address, email address, unique personal identifier, online identifier, internet protocol identifier, account name, Social Security number, driver’s license number, passport number, signature, or other identifier

• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80) – A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number and ATM card number, or any other financial information, medical information, or health insurance information

• Sensitive personal information – Social Security number, driver's license, state identification card, or passport number; your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; racial or ethnic origin, citizenship or immigration status, religious beliefs, or union membership; the contents of your mail, email, and text messages unless U.S. Bank was the intended recipient of the communication; health data; precise geolocation data; biometric information; and sex life or sexual orientation data 

• Protected classification characteristics under California or federal law – Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)

• Commercial information – Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

• Biometric information – Fingerprints, faceprints, voiceprints and behavioral patterns

• Internet or other electronic network activity information – Browsing history, search history, social media preferences, television viewing, information on a consumer’s interaction with a website, application, or advertisement; behavioral characteristics, e.g., keystroke or mouse movement patterns

• Geolocation data – Physical location or movements

• Audio and visual Information – Audio, video, digital images, voice recordings, or similar information we capture through your communications with us such as call recordings for quality assurance and training purposes, and security recordings if you visit our branches or offices. This also includes images submitted via our online services (e.g., checks, bank statements, and government issued documents, photographs, selfies, videos).

• Employment information – Current or past job history

• Inferences drawn from other personal information – Inferences drawn from any of the information identified above to create a profile about you reflecting preferences, characteristics, attitudes and/or similar trends

Where We Collect Your Personal Information

We collect the personal information described above from one or more of the following sources: • Directly from you or your company when you provide this information to us, when you request information, apply for products or services from us, use our websites or applications, respond to surveys, contact customer support, when you visit our ATMs, branches or offices or attend a U.S. Bank event, or otherwise interact with us • From our affiliates, co-owners, partners and other related parties • From tracking technologies, including cookies and other related technologies such as web beacons, pixels, mobile SDKs, and logging technologies • From other online and offline sources, such as public databases, social media platforms, and others, e.g., data analytics providers, aggregators, connected television and other viewing devices, and third parties • Vendors who provide services on our behalf  

Use of Personal Information

We may use or disclose personal information that we collect for one or more of the following business purposes to, among other things:

• Provide you with, or evaluate your eligibility for, products and services that you or your company request from us.

• Communicate with you about your accounts or transactions with us.

• Send you important information regarding our products and services, changes to this Notice and other similar administrative information.

• Enter into transactions and conduct business dealings with our business partners, service providers and contractors.

• Allow you to participate in surveys, sweepstakes, contests, and similar promotions, and to administer such promotions (note that these promotions may contain additional disclosures regarding our collection and/or use of your information).

• Consistent with local law, required disclosures, and choices and controls that may be available to you:

o Send you offers and promotions for our products and services, or products and services that may be of interest to you; o Personalize content and experiences on our Services;

o Verify your identity and/or location (or the identity or location of your authorized representative) for security, fraud prevention and other risk control purposes; and

o Provide you with advertising based on your activity on our Services and on third-party websites and applications. For additional information regarding our use of your information for personalization and tracking, please refer to the Online Tracking and Advertising section of the Privacy Policy.

• Optimize or improve our products and services.

• Enhance business performance and streamline enterprise processes.

• Help to ensure security and integrity. Detect, investigate, and prevent activities that may violate our policies or be illegal.

• Report to credit bureaus.

• Comply with our legal and regulatory obligations.

• Enforce our terms and conditions and otherwise protect our rights and operations.      

Disclosure of Personal Information for a Business or Commercial Purpose

We may disclose your personal information for a business purpose to the following categories of parties:

• Our affiliates and other related parties

• Service providers and contractors who help manage, develop, and analyze our business and/or deliver services to us and our clients, such as:  Professional services organizations, such as auditors and law firms o Our business partners Online advertising services and networks o Internet service providers  Data analytics providers o Operating systems and platforms Social networks o Data brokers

• Agencies and organizations working to prevent fraud in financial services

• Law enforcement, regulatory and other governmental agencies

Retention Period

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

Sharing or Selling Your Personal Information

We do not sell personal information to third parties for monetary consideration without your prior consent, but we may share your personal information with third parties for cross-context behavioral advertising.

The categories of personal information that we may have shared are:

• Identifiers, including unique personal identifier, online identifier, Internet Protocol address, hashed email address, hashed telephone number, mobile advertising IDs (MAID) (e.g., Android Advertising ID [AAID], Google Advertising ID [GAID], Google Click ID [GCLID], and Apple’s identifier for advertisers [IDFA]), or other identifiers

• Account information

• Protected classification information

• Internet or other electronic network activity information

• Professional or employment information

• Inferences drawn from personal information

We do not purposefully sell or share the personal information of children under the age of 16.

For more on your personal information share/sale rights, see Right to Opt Out of Sharing or Selling.

We reserve the right to transfer any personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

Use of Sensitive Personal Information

Under the CPRA, we collect the types of sensitive personal information described in the Categories of Personal Information We Collect section above. U.S. Bank only collects and uses sensitive personal information for certain limited purposes, such as providing services and products to consumers, detecting data security incidents and protecting against fraud (“Limited Purposes”). Because U.S. Bank uses this sensitive personal information for Limited Purposes, there is no need for us to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

Summary of Prior 12-month Personal Information Handling Practices

We provide in the chart below a summary of our prior 12-month personal and sensitive information handling practices. You can learn more about the information we collect at or before the point of collection above in the Categories of Personal Information We Collect, Where We Collect Your Personal Information, Use of Personal Information, and Disclosure of Personal Information for a Business or Commercial Purpose sections.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us through one of the following methods:

• Current, Former or Prospective Customer Requests:
  • Please complete the Personal Information Request Form. This form allows you to request the details of the personal information that U.S. Bank has about you and to request access to that information. Once received, U.S. Bank must use reasonable methods to verify the identity of the requestor before responding. If we cannot verify the requestor, we will either deny the request or ask for additional identifying information. U.S. Bank will respond within 45 days of the request unless additional time is required.
  • If you are a U.S. Bank customer, you can log in to online banking. You can locate the “Personal information” link within the Data sharing & privacy area under Profile & settings.
  • Or call us at 800-872-2657.
• Workforce (employee, prospective, current, or former) Requests:
  • Please complete the Personal Information Request Form. This form allows you to request the details of the personal information that Elavon has about you and to request access, to that information. Once received, Elavon must use reasonable methods to verify the identity of the requestor before responding. If we cannot verify the requestor, we will either deny the request or ask for additional identifying information. Elavon will respond within 45 days of the request unless additional time is required.
  • Or call us at 1-800-806-7009.

You may only make a verifiable consumer request for access twice within a 12-month period.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will generally verify your identity by asking you to provide personal information related to your recent interactions with us. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Requests by Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf.

Nondiscrimination

You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services; and (e) retaliating against you for exercising your privacy rights.