Mobile Privacy

 Rev 03/2022 

 Jiko Privacy Policy 

Privacy Policy 

This Privacy Policy (“Policy”) covers the following affiliated companies in the Jiko family of companies: Jiko Technologies, Inc., Jiko Securities, Inc., and Jiko Bank, a division of Mid-Central National Bank, including products and services branded with Jiko, as well as Mid-Central National Bank. Together, these entities as well as other affiliated companies with whom we conduct business are referred to as “Jiko,” “our affiliates,” “we,” “us,” or “our” in this Policy. 

This Privacy Policy applies to your interaction with Jiko: (1) at any online or mobile application or website that we own and control, unless a different online and/or mobile or other privacy policy is posted relating to a particular application, website, product, or service, or is made available to you and by its terms supplants this Policy; (2) via a Jiko advertisement, page, or account on a Third-Party Site, or (3) at physical offices of Mid-Central National Bank. We may collect, retain, use, and disclose personal and other information about you in accordance with this Policy. Other privacy policies may also apply in addition to the terms of this Policy. With respect to Mid-Central National Bank and its privacy practices, please also see its Privacy Notice. With respect to your personally identifiable financial information other than as described in Mid-Central National Bank’s Privacy Notice, please also see Jiko’s Privacy Notice. With respect to Jiko Securities, Inc. and its practices, please also see the Jiko U.S. Treasuries Risk Disclosures. 

To the extent permitted by applicable law, by using an application or website or interacting with a Jiko advertisement or page or account on a Third-Party Site, you consent to this Policy, including your consent to our use and disclosure of information about you in the manner described in this Policy. 

We are committed to maintaining the privacy and confidentiality of your personal information. This Policy explains what personal information we collect about you, how we use and share that information, and the rights you have in connection with that information, including how you can limit certain uses and sharing of your information. Certain rights, requirements, and disclosures in this Policy may be subject to exemption or otherwise may not apply to you based, for example, on applicable law or regulations. This information is required by law and is not a promotion of Jiko’s products and services. This policy is not a contract and does not seek any basis for contractual rights. 

1. Information we may collect 

As described in this Policy, we may collect personal information from or about you in order to provide, enhance, market, and offer our products and services, including the products and services of our affiliates (together, “Services”) to you and to our institutional clients. “Services” include, among other things, maintaining or servicing accounts, providing customer service, processing or fulfilling trades and other transactions, verifying customer information, processing payments, providing financing, determining eligibility for Services, recordkeeping, and related activities. 

This section describes the categories of personal information we may collect, including personal information we have collected in the past twelve months. For purposes of this Policy, personal information generally includes information that may be used to identify you. You are not required to give us all the personal information identified in this Policy; however, if you do not provide requested personal information, we may not be able to provide you with some or all of the Services. We only collect personal information in accordance with applicable law.

In addition, we may compile aggregate, anonymous, or de-identified data from various sources, including, but not limited to, accounts and transactions. This data, which we may use for our business purposes consistent with applicable law, does not identify an individual and is not personal information. 2. Sources of Information and Purposes of Collection and Disclosure This section describes the sources from which we may collect personal information and why we may collect and, if applicable, share personal information.

2. Sources of Information and Purposes of Collection and Disclosure 

This section describes the sources from which we may collect personal information and why we may collect and, if applicable, share personal information. 

3. Information We May Share and With Whom We May Share It 

This section describes the categories of personal information we may share, including personal information we have shared in the past twelve months, and the parties we may share it with. We may share your personal information for the purposes described in Section 2, when you have provided your consent for disclosure, or as otherwise permitted or required by law. We do not sell personal information and have not sold personal information in the past twelve months. 

4. Use of Cookies and Similar Technologies and Interest-Based Advertising 

4.1 Cookies and Similar Technologies 

We and our third-party service providers may use cookies and similar technologies on our mobile applications and websites to improve user experience, for performance and analytics, and to improve our content, products, and services. We also use cookies and similar technologies for purposes of marketing and advertising, including interest-based advertising. For more information on interest-based advertising, see the “Interest-Based Advertising” section. Certain information may be stored or accessed using tracking technologies such as “cookies” and “web beacons” that may be downloaded to your Device when you visit or interact with our mobile applications and websites. This information may include, but is not limited to: 

• IP address, UDID or other unique device identifier, a number that is automatically assigned to your Device and used by us to identify your Device; 
• Device functionality and characteristics (including browser, operating system, hardware, and mobile network information); 
• The URL that referred you to our websites; 
• The areas within our mobile applications or websites that you visit and your activities, including remembering your preferences; and 
• Device location. 

A “cookie” is a small text file that a web server stores in browser software. A browser sends cookies to a server when the browser makes a connection to the server (for example, when requesting a web page from the same domain that created the cookie). The purpose of cookies is to remember the browser over time and distinguish one browser instance (or user) from all others. We use both HTML cookies and Local Shared Objects (sometimes referred to as Flash cookies) that are built for use with the Adobe® Flash® Player for authentication purposes and to enhance navigation and website functionality. Cookies can remember login information, preferences, and similar information. If you access your account online, cookies may be used to verify your identity, to authenticate you as a user on our system and to personalize aspects of your experience on our websites. We also use cookies to let us know how our customers and other visitors are using our websites so that we can optimize their experience. We permit certain third-party advertising providers to set cookies and use related technology such as web beacons or “clear GIFs” through our websites and other websites on which we advertise, and via HTML email messages, to track performance of advertisements and to collect aggregate data on web page viewing. Some cookies and other technologies may serve to track personal information previously entered by a web user on our websites. We may also use web beacons or “pixels,” and in certain circumstances may collect IP address, screen resolution and browser software and operating system types, clickstream patterns, dates and times that our websites are accessed, and other categories of data. In addition, we currently use Google Analytics. Please read How Google uses data when you use our partners’ sites or apps for information about how Google Analytics collects and processes data. If you wish to opt out of Google Analytics, please visit https://tools.google.com/dlpage/gaoptout. 

Most browsers allow you to control cookies, including whether to accept them and how to remove them. You can manually delete HTML cookies and set most browsers to refuse to accept HTML cookies. For information on how to disable cookies, refer to your browser’s documentation. Flash cookies or other Local Shared Objects may be removed by managing your Adobe® Flash® Player settings or in your browser’s settings. To delete or prevent placement of Flash cookies, visit the Adobe® Flash® Player Help site at www.adobe.com/go/settingsmanager, click on the hyperlink for “Website Privacy Settings Panel” on the left side of the screen, and follow the instructions for preventing third-party Flash content from storing data on your computer. If you choose to erase or block your cookies, doing so may affect your website experience, and certain parts of our websites may not function correctly. 

4.2 Interest-Based Advertising 

We may use “interest-based” ads, also known as “online behavioral advertising.” Interest-based advertising is advertising that is targeted to you based on your web browsing and app usage over time and across websites or apps. You have the option to restrict the use of information for interest-based advertising and to opt-out of receiving interest-based ads. We may partner with ad networks and other advertising providers (“Advertising Providers”) who serve ads on behalf of us and others on non-affiliated sites. Some of these third parties may use cookies and other technologies to collect information about your online activities over time and across third-party websites or online services to deliver advertising based on your interests and preferences, as inferred from your browsing history. Some of these ads may be personalized, meaning that they are intended to be relevant to you based on information that Jiko and its Advertising Providers collect about your visits to our websites and elsewhere over time. 

To learn more about this type of advertising and how to opt-out of this form of advertising, you may either visit http://www.aboutads.info to opt-out of sites and services participating in the Digital Advertising Alliance (“DAA”) self-regulatory program, or visit www.networkadvertising.org/choices/ to opt-out of this form of advertising by members of the Network Advertising Initiative (“NAI”). Note that electing to opt-out will not stop advertising from appearing in your browser or applications, although it may make the ads you see less relevant to your interests. In addition, if you use a different browser or erase cookies from your browser, you may need to renew your opt-out choice. 

4.3 Do-Not-Track 

Do-Not-Track is a public-private initiative that has developed a “flag” or signal that an Internet user may activate in the user’s browser software to notify websites that the user does not wish to be “tracked” by third-parties as defined by the initiative. Our websites do not alter their behavior when we receive a “Do-Not-Track” signal from browser software. Currently, we do not monitor or take any action with respect to these signals or other similar mechanisms. 

5. How to Exercise Your Rights 

In certain cases, you may be able to limit the types of communications you receive and certain sharing of your personal information. This section describes how to exercise those rights. 

5.1 Updating Your Information 

If you believe that your personal information is inaccurate, incomplete, or out-of-date, you also may contact us using the information in the “Contact Us” section of this Policy. 

5.2 Limiting Direct Marketing 

If you would like to stop receiving newsletters or other marketing or promotional messages, notifications, or updates from us, you may follow the unsubscribe instructions that appear in those e-mail communications or you may opt out by contacting us through the information in the “Contact Us” section of this Policy. You may not be able to opt out of receiving certain service or transactional messages from us, including, for example, legal notices.

6. Information on Individuals Under 18 Years 

We do not knowingly collect information from individuals under the age of 18 years without parental consent. If you become aware that an individual under 18 years of age has provided us with personal information without parental consent, please contact us using the information in the “Contact Us” section of this Policy. If we become aware that an individual under 18 years has provided us with personal information without parental consent, we will take steps to remove the data as permitted by law. 

7. Location of Data Storage and Processing 

The personal information we collect from you will be stored in the United States and may be stored in other countries that may have different privacy laws and standards than those in your country of residence. Your personal information may be transferred to or processed in the United States by us or by a third-party service provider working for us. If you are located outside of the United States, the transfer of personal information is necessary to provide you with the requested information, products, and services and/or to perform any requested transaction. When we transfer or disclose your personal information to other countries, we will protect that information as described in this Privacy Policy. By submitting personal information via our websites or other means, you agree to such storage, transfers, and processing. 

8. Data Security 

We maintain reasonable physical, administrative, and technical safeguards to protect your personal information. Our employees and third-party service providers have access to your personal information on a “need to know” basis. We conduct regular internal audits of our business practices and procedures in order to protect your personal information. 

We take measures to delete your personal information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period, as described in our records management policy. 

9. Links to Other Sites 

Our mobile applications or websites may contain links or otherwise provide access to another mobile application, website, or Internet location (collectively “Third-Party Sites”). We have no control over and are not responsible for Third-Party Sites, their content or any goods or services available through the Third-Party Sites. This Policy does not apply to Third-Party Sites. We encourage you to read the privacy policies of any Third-Party Site with which you choose to interact. 

One Third-Party Site our mobile applications or websites may use is Plaid Inc. (“Plaid”). Plaid explains how it collects, uses, and shares information in its End User Privacy Policy, and for purposes of using Plaid in connection with your interactions with us you agree to that End User Privacy Policy and to Plaid’s collection, use, and sharing of your information as described in that End User Privacy Policy.

10. Notice to California Residents 

This section describes your rights under the California Consumer Privacy Act (“CCPA”) and how to exercise those rights. Your CCPA rights are in addition to the rights described in Section 5. 

10.1 Description of Your Rights 

Subject to certain exceptions and limitations, you have the following rights with respect to covered personal information. 

• Right to request access to personal information. You have the right to request the following information from us. o Specific pieces of personal information we have about you; 
• Categories of personal information we have collected about you; 
• Categories of sources from which the personal information is collected; 
• Categories of personal information sold or disclosed, if any; 
• Categories of third parties with whom the personal information was sold or disclosed; and 
• The purpose(s) for collecting or selling the personal information. 
• Right to delete personal information: You have the right to request that we delete the personal information we have collected about you. 
• Right to opt-out of the sale of personal information: You have the right to request to be opted out from the sale of your personal information; however, as set forth in Section 3, we do not and will not sell personal information to third parties and have not sold personal information in the past twelve months. The CCPA requires that we state that we do not have actual knowledge that we sell personal information of consumers under 16 years of age. 
• Right to Data Portability: In certain circumstances, you may have the right to receive personal information concerning you in a portable format. 
• Right not to be discriminated against for exercising the rights identified above: You have the right not to be denied goods or services, charged different prices or rates for goods or services, or receive a differing level of quality of goods or services as a result of exercising the above rights. 

10.2 Covered Personal Information 

The rights described in Section 10.1 do not apply to certain categories of personal information. The personal information excluded from coverage under the CCPA includes, among other things: 

• Personal information we collect from or about you when you apply for or obtain a product or service for personal, family or household purposes; 
• Personal information about communications or transactions with you when you are acting on behalf of a company or government agency to do business with us; and 
• Personal information sold or bought from a consumer reporting agency for use in a consumer report in compliance with applicable law. 

We will apply verifiable consumer requests to covered personal information. Rev 03/2022 

10.3 How to Submit a Request 

You or your authorized agent may submit a CCPA request using one of the following methods: 

• Call Jiko at (833) 333-JIKO (833-333-4556) or 
• Access our website at http://www.jiko.io/ 
• Email us at support@jiko.io 

We will respond to authorized requests as soon as practicable and as required by law. The above rights are subject to our ability to reasonably verify your identity and authority to make these requests. In order to verify that you are authorized to submit a request, you may be required to provide the following information. 

• Customers: If you are a customer, you may verify your identity through account login. 
• Non-Customers: If you are not a customer, you may verify your identity by submitting certain non-sensitive identifiers. To help protect the security of your personal information, we may use a third-party service provider to verify your information, which may include receiving a one-time password via text message. By submitting your mobile phone number for identity verification, you consent to receiving text messages for this purpose. 
• Authorized Agents: If you are an authorized agent, you may verify your own identity by submitting certain non-sensitive identifiers. To help protect the security of your personal information and the personal information you are requesting, we may use a third-party service provider to verify your information, which may include receiving a one-time password via text message. By submitting your mobile phone number for identity verification, you consent to receiving text messages for this purpose. As an authorized agent, you also may be required to submit a legally sufficient Power of Attorney appointing you to act on behalf of the owner of the personal information a similar document deemed sufficient by Jiko to establish your authority. 

Your CCPA rights are subject to various exclusions and exceptions under the law. Under certain circumstances, we may be unable to implement your request, pursuant to applicable law. We will advise you of any reason for denying or restricting a request to the extent permitted by law. 

We will not provide social security numbers, driver’s license numbers or government issued identification numbers, financial account numbers, health insurance or medical identification numbers, account passwords or security questions and answers, or other specific pieces of personal information if the disclosure presents an unreasonable risk to the security of personal information, customer accounts or our systems and network security. 

11. Notice to Nevada Residents 

We are providing you with this notice pursuant to state law. You may be placed on our internal Do Not Call list by calling us at (833) 333-JIKO (833-333-4556). For further information, contact the Nevada Attorney General’s office at 555 E. Washington Ave., Suite 3900, Las Vegas, NV 89101; by phone at 702-486-3132; or by email at BCPINFO@ag.state.nv.us. 

12. Updates to this Policy 

We may update this Policy from time to time. We encourage you to periodically review this Policy to learn about updates to our privacy practices. 

13. Contact Us 

For more information about our privacy practices, or if you have questions or concerns, please visit the Contact Us page on our website at http://www.jiko.io/ or call (833) 333-JIKO (833-333-4556) (from within the U.S.). You may also email us at Support@jiko.io contact us by mail at the following address: 

2000 Allston Way, PO Box, 327, Berkeley, CA 94701