CCPA Privacy Policy

This Old Second National Bank (“Old Second”) Notice for California Residents is applicable to consumers residing in California only and is considered a supplement to, and not a replacement of, Old Second’s U.S. Privacy Policy found here. The California Consumer Privacy Act of 2019 (“CCPA”) give consumers the right to request that a business that collects a consumer’s personal information disclose to that consumer the categories and specific pieces of personal information the business has collected. The CCPA defines “personal information” as: information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information does not include de-identified or aggregated consumer information, or publicly available information that is lawfully made available to the general public from federal, state, or local government records. The majority of personal information Old Second collects is covered by other laws, rules and regulations, including but not limited to the Gramm-Leach-Bliley Act and its related implementing regulations, and is therefore exempt from the provisions of the CCPA. As such, while most of the categories below are exempt from coverage under the CCPA, below are the categories of personal information collected, the categories of sources collected from, the purposes and the parties we share with:


Categories of Personal Information Categories of sources collected from Business or commercial purposes for collection Categories of third parties with whom we share
Identifiers, such as name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. Consumers, our customers, or their agents, third party referral or due diligence sources. Evaluating, establishing, servicing or maintaining account(s) or finance arrangements. Our processors and technology vendors internally used in the normal course of evaluating, establishing, servicing or maintaining account(s).
Legally protected classifications Consumers Evaluating, establishing, servicing or maintaining account(s) or finance arrangements Our processors and technology vendors internally used in the normal course of evaluating, establishing, servicing or maintaining account(s)
Commercial information, such as personal property records, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. This may include account numbers and various financial statements or other summaries of financial information. Consumers, our customers, or their agents, third party referral or due diligence sources. Evaluating, establishing, servicing or maintaining account(s) or finance arrangements Our processors and technology vendors internally used in the normal course of evaluating, establishing, servicing or maintaining account(s)
Voice recordings (biometric information) Consumer Servicing or maintaining account security when consented to Our technology and third-party security providers
Internet, geolocation or other electronic network activity Consumer Internet monitoring and security Our technology and third-party security providers
Professional or employment related information Consumers, our customers, or their agents, third party referral or due diligence sources. Evaluating, establishing, servicing or maintaining account(s) or finance arrangements Our processors and technology vendors internally used in the normal course of evaluating, establishing, servicing or maintaining account(s)
Inferences drawn from other personal information Consumers, our customers, or their agents, third party referral or due diligence sources. Evaluating, establishing, servicing or maintaining account(s) or finance arrangements Our processors and technology vendors internally used in the normal course of evaluating, establishing, servicing or maintaining account(s)

How We Use Personal Information

Old Second may use or disclose personal information we collect as necessary to perform a business purpose. Old Second does not sell any California consumer’s personal information to any third parties, and we have not done so in the preceding twelve (12) months. Old Second will not collect additional categories of personal information or use personal information collected for additional purposes without providing the consumer with notice.

Non-discrimination

Further, it is Old Second’s policy not to discriminate against a consumer because the consumer has exercised any of the consumer’s rights under the CCPA, including, but not limited to, by:

  • Denying goods or services to the consumer.
  • Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
  • Providing a different level or quality of goods or services to the consumer.
  • Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

Rights Under CCPA to Request/Delete

The CCPA gives a California consumer the right to request from Old Second:

  • The categories of personal information collected about that consumer.
  • The categories of sources from which the personal information is collected.
  • The business or commercial purpose for collecting or selling personal information.
  • The categories of third parties with whom Old Second shares personal information.
  • The specific pieces of personal information collected about that consumer.

Further, the CCPA also gives a California consumer the right to request deletion of the specific pieces of information collected about that consumer. However, Old Second is not required to comply with a request to delete a consumer’s personal information if it is necessary for Old Second, or one of our service providers, to maintain the consumer’s personal information in order to:

  • Complete the transaction for which the personal information was collected, provide a good or service requested by the consumer, or reasonably anticipated within the context of Old Second’s ongoing business relationship with the consumer, or otherwise to perform a contract between Old Second and the consumer.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
  • Debug to identify and repair errors that impair existing intended functionality.
  • To otherwise use the personal information in a lawful manner allowed by relevant laws, rules or regulations, including to comply with a legal obligation.
  • To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.
  • Otherwise use the consumer’s personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.

Verifiable Consumer Request Procedure

Upon receipt of a verifiable consumer request (as defined below) for any or all of the items above, Old Second will provide a report describing such items within 45 days, but no later than 90 days. If more than 45 days is needed, we will inform you of the reasons and how much additional time is needed. If we cannot comply with a request, our response will explain why. A verifiable consumer request may be made as either:

  • a written request submitted through our CCPA Inquiry Page found here.
  • a verbal request made to our toll free number at 833-625-0546 .

In order to comply with a request, it must be a “verifiable consumer request.” To be considered a verifiable consumer request, we must be able to verify the consumer’s identity and/or right to access the information and the request is described with sufficient detail that allows us to properly understand, evaluate, and respond to it. Further, a verifiable consumer request must be made by the consumer, by a consumer on behalf of the consumer’s minor child, or by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumer’s behalf, and that Old Second can reasonably verify. We may require at least two forms of identity verification. If we provide information responsive to a verifiable consumer request in electronic form, the information will be in a portable and, to the extent technically feasible, readily useable format that allows the consumer to transmit this information to another entity without hindrance. Further, this information will only cover the twelve (12) month period prior to the request. A consumer is allowed to make no more than two (2) requests for information or deletion during any twelve (12) month period.