California Privacy Notice at Collection

LAST UPDATED: August 2023

California Privacy Notice at Collection

This Notice at Collection is provided by Columbia Banking System, Inc. (“COLB”) and its subsidiaries, and affiliates (collectively, “Columbia”) and applies to all California residents ("consumers" or "you").

Please read this Notice carefully as it describes how we collect, use, and retain information that relates to you (“personal information”). This Notice also provides information on how California residents can opt-out of any processing activities deemed as a “sale” or “share” under California law.

If you have a disability that prevents or limits your ability to access this Notice, please contact us at 1-833-427-5227. We will work with you to provide this Notice in an alternative format.

Categories of Personal Information We May Collect

Depending on our relationship or specific interaction with individuals, we may collect the following categories of personal information:

Categories of personal information	Representative Data Elements
Identifiers	Real name Postal address Unique identifier or unique personal identifier Social Security number Passport number Driver’s license number Telephone number Email address
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code§ 1798.80(e))	Name Signature Physical characteristics or description State or government issued identification card number Insurance policy number Employment information and history Bank account number Credit or Debit Card Number Other financial information Medical Information Health insurance information
Protected classification characteristics under California or federal law	Date of birth/age Gender Military or veteran status Marital status Race Ethnicity or National Origin Religion Disability
Commercial information	Records of personal property Products or services purchased, obtained, or considered Other purchasing or consuming histories or tendencies
Biometric Information	Fingerprints Faceprints or face imagery Voiceprints and/or voice recordings that can be extracted
Internet or other similar network activity	Browsing history Search history Information regarding interaction with a website, application, or advertisement
Device Information *Note: Some information included in this category may overlap with other categories.	Device identifier or identifying information, characteristics, or settings about the device you use to access our online services IP Address Information in cookies, pixel tags or from collection technologies Mobile ad identifiers Mobile device information (with permission, such as location, contacts, camera)
Geolocation data	Physical Location Movements Precise geolocation
Sensory data	Audio Visual Electronic Note: these data types are typically collected during phone and in-person for security and training purposes.
Professional/Employment Information	Current or past job history or performance evaluation
Non-public education information (per the Family Educational Rights and Privacy Act)	Education records, such as, enrollment, grades, transcripts, student schedules Student financial information, including tuition costs and reimbursement
Inferences drawn from other personal information	Inferences based on information about an individual to create a summary about, for example, an individual’s preferences and characteristics *Note: Inferences are not performed based on any sensitive personal information collected
Sensitive Personal Information	Government identifiers (Social security, driver’s license, state identification card, or passport number) Complete account access credentials (usernames, account numbers or card numbers, combined with any security or access code, password, or credential required for allowing access to an account) Precise geolocation Racial or ethnic origin, Religious or philosophical beliefs, or Union Membership Biometric information when used for the purpose of uniquely identifying a consumer Personal information collected and analyzed concerning a consumer’s health *Note: Some information included in this category may overlap with other categories.

Purposes for Collection and Use of Personal Information

The purposes for which we collect and use each category of personal information and sensitive personal information depend on, among other things, our relationship or interaction with specific CA residents. We may use the personal information we collect for the following business or commercial purposes:

Purposes for Collection and Use	Example
Provide and manage products and services	Establish your account(s) and/or preferences, process transactions for our products and services including checking accounts, credit cards, loans, investment accounts, as well as additional products for businesses such as commercial financing and payment services Support the ongoing management and maintenance of our products and services including to provide account statements, online banking access, online services, customer service, payments and collections, and account notifications To respond to your inquiries and fulfill your requests To provide important information regarding the products or services for which you apply or may be interested in applying for, or in which you are already enrolled, changes to terms, conditions, and policies and/or other administrative information. To allow you to apply for products or services (for example, to prequalify for a mortgage, apply for a credit card, or to open an account) and evaluate your eligibility for such products or services.
Support our everyday operations, including to meet risk, legal, and compliance requirements	Perform accounting, monitoring, and reporting Enable information security and anti-fraud operations, verify your identity, as well as credit, underwriting, and due diligence Support audit and investigations, legal requests and demands, as well as exercise and defend legal claims Enable the use of service providers for business purposes Comply with policies, procedures, and contractual obligations For compliance, fraud prevention, and safety purposes, including protecting the security of account and personal information Collect information through our social media pages and other online interactions with you to assist in verifying your identity and account status. We may combine this online information with information collected from offline sources or information we already have. Defend or protect us, you, our client, or third parties, from harm or in legal proceedings. Respond to court orders, lawsuits, subpoenas, and government requests
Manage, improve, and develop our business	Personalize, develop, as well as improve our products and services Support customer relationship management to personalize your experience on our websites and enhance websites to allow you to participate in surveys and other forms of market research, sweepstakes, contests, and similar promotions and to administer these activities. Some of these activities have additional rules, which may contain additional information about how Personal Information is used and shared.
Research and Analytical Purposes	Understand how you use our websites, mobile applications, and other digital properties (collectively, the “Sites”) The methods and devices you use to access our Sites Make improvements to our Sites Conduct research and analysis, identify usage trends, determine effectiveness of promotional campaigns, and to drive product and services innovation
Marketing and Advertising Purposes	Send you marketing and advertising communications about our products and services
Provide and manage digital and mobile products and services	Information stored on your device, such as location, camera, contacts, or other features you are enrolled in to enrich and simplify your own user experience and improve our services, as well as provide additional security to protect your account.

Retention

We retain your personal information, including your sensitive personal information, for the period necessary to fulfill the purposes outlined in this notice unless a longer retention period is required or permitted by law. Please note that in many situations we must retain all, or a portion, of your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, to protect against fraudulent, deceptive, or illegal activity, or for another one of our business purposes

Requests to Opt Out of Selling or Sharing

While we do not disclose your Personal Information in exchange for money, We, our services providers, and third parties engaged on our behalf may use cookies, pixel tags, or similar online tracking technologies (collectively, “Collection Technologies”) to gather personal information when you use, access, or otherwise interact with our websites, mobile applications, or other digital properties, which may be deemed as a “sale” or “share” of Personal Information under California law. The categories of personal information we may sell, or share include:

Internet or other similar network activity
Device information
Unique identifiers or unique personal identifiers

For information about how you can opt out of the selling or sharing of your Personal Information, please see the Notice of Right to Opt Out of Sale and Sharing.

Additional Information

For a comprehensive description of how we collect and use your personal information, please see our CA Privacy Notice and Digital/Mobile Privacy Notice. For more information on our privacy practices and to exercise your rights, go to www.umpquabank.com/privacy or call us at 1-833-427-5227 (Toll Free).

Nov	Dec	Jan
	07
2023	2024	2025

Privacy at Columbia Banking Systems, Inc.