PRIVACY POLICIES
Effective as of April 10, 2024

Banking services made available through ONE are issued by Coastal Community Bank, Member FDIC. Below are the Privacy Notices and Policies applicable to your ONE account from ONE and Coastal Community Bank.

ONE GLBA Privacy Notice

Coastal Community Bank U.S. Consumer Privacy Notice

ONE Privacy Policy

ONE GLBA Privacy Notice

                                                                                                                                                               Rev. Dec 2023

Coastal Community Bank U.S. Consumer Privacy Notice

Revised:  June. 2023

ONE PRIVACY POLICY

Last Updated: April 10, 2024

This Privacy Policy describes how One Finance, Inc., and OneProgress Services LLC (collectively, “ONE”, or “we”, “our”, and “us”), receives, uses, shares and otherwise processes Personal Information (as defined below) in connection with the content, platform, services, products, and other functionality offered on or through our services (collectively, the “Services”), including our websites (www.one.app) and mobile applications (collectively, the “ONE Apps”).

1. GRAMM-LEACH-BLILEY ACT COVERED DATA
2. PERSONAL INFORMATION WE RECEIVE
3. HOW WE USE YOUR PERSONAL INFORMATION
4. THIRD PARTIES WHO MAY RECEIVE PERSONAL INFORMATION
5. CALIFORNIA RESIDENTS’ PRIVACY RIGHTS AND CHOICES
6. RETENTION
7. CHILDREN'S PERSONAL INFORMATION
8. THIRD-PARTY PRIVACY PRACTICES
9. UPDATES TO THIS PRIVACY POLICY
10. CONTACT US

1. GRAMM-LEACH-BLILEY ACT COVERED DATA

If you apply for or have a financial product or service with us, we will use and share any Nonpublic Personal Information (“NPI”), as defined by the Gramm-Leach-Bliley Act (“GLBA”), that we collect from or about you related to your use of that product or service in accordance with our GLBA Privacy Notice, which offers you certain choices with respect to our collection, use, sharing, and processing of your NPI.

When you obtain or use products or services from ONE that are issued by Coastal Community Bank, those products or services are further subject to Coastal Community Bank’s GLBA Privacy Notice. Coastal Community Bank’s use of NPI that it receives is subject to its GLBA Privacy Notice.

2. PERSONAL INFORMATION WE RECEIVE 

“Personal Information” means any data that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a person or household or any other data or information that constitutes “personal data,” “personal information,” or “personally identifiable information” under applicable privacy laws. When you use our Services we receive Personal Information in a variety of ways, including directly from you, from third parties (including our affiliates, banking partners, your employer, and other users), from publicly available sources, and through information that we collect automatically. We may receive the following categories of Personal Information when you use our Services:

• Identifiers: We receive identifiers, such as name, email, login credentials, address, phone number, password, date of birth, Social Security number, taxpayer identification number, military status, driver’s license or other government issued identification and numbers, and country of citizenship.
• Demographic Information: We may receive demographic information, such as marital status, language preferences, citizenship status, race and gender, when such information is included in documents, such as government issued identification and tax forms and returns, that you share with us.
• Biometric Information: We receive biometric information, such as facial imagery for identity verification purposes, where you provide your consent. We process biometric information through a third-party vendor, and do not store such information on our systems.
• Location Information: We may receive location information if you have location services enabled in the ONE Apps. You can withdraw your consent at any time by disabling location permission for the ONE Apps within your device settings.
• Financial Information: We receive financial information, including bank account and routing numbers, debit and credit cards details, direct deposit status, credit score and credit history, as well as, in certain circumstances, the information described in each of the below sub-bullets.
• Linked Account Data: When you link your bank account to ONE, we receive financial information from your bank or financial institution, such as your account balance, transaction history, and information about the account owner.
• Financial Institution Information: When you apply for and use a third-party financial institution’s product or service that we make available to you through the ONE Apps, we receive information related to your account with the financial institution, such as your account balance, transaction history, purchase history, and account status.
• Transaction Information: When you use certain Services we receive information about your transaction data, including payments into and out of such accounts, the date and time of the transaction, merchant or beneficiary details, or ATMs associated with the transaction.
• Employment Information: When you use certain Services, we receive information about your employment, such as your employee identification number, employment status, start and end dates, location of your workplace, payroll information, pay period, pay rate, shift schedule, and job title, and you may choose to provide us with your username and password for various payroll, time and attendance, or other human resources information systems, which will enable us to receive information about your employment from such third parties.
• Communications With Us: We receive the contents of your communications with us, such as when you provide survey responses, questionnaire answers, participate in promotions, provide referrals, submit inquiries on our Services, engage with customer support (e.g., through phone or automated chat, which may be recorded for customer service, training and quality assurance purposes), or participate in research.
• Social Media Information: When you interact with us through social media networks, we may receive information about you such as your username or handle, the contents of your posts, comments and direct messages you send to us. The data we receive is dependent upon your privacy settings with the social media network.
• Job Applicant Information: We may receive certain information, including  personal identifiers, employment history, education history, skills, language abilities, work permit status and sponsorship requirements, physical limitations and special accommodations needed, and other information provided, by you and/or third parties, such as job application platforms, your current employer, references, background check providers and recruiters, when you apply for a job with us.
• Device and Usage Information:  We receive information about the computers, phones, and other devices you use to interact with our Services, including IP address (which may be used to determine general location), hardware model, operating system information, mobile network information, device performance information, device identifiers, cookie IDs, the browser you use, and your network connection. We also receive information regarding your use of our Services, including the electronic path you take to our Services, through our Services and when exiting our Services, as well as your activity information on our Services, including your interaction with our chat feature. This information is typically collected through tracking technologies, such as cookies, web beacons, embedded scripts, and location-identifying technologies. To learn more about cookies and your ability to opt out of certain advertising cookies, please visit the following websites: http://www.aboutads.info/choices or http://www.networkadvertising.org/choices. You may also use your browser settings to manage your cookie preferences. Please note that if you disable certain cookies, you may not be able to receive or take full advantage of the Services.
• Device Content: With your consent, we may access your device camera, photos and files. We do so to scan or capture images, which may be used to provide Services, such as depositing checks, peer to peer transactions, other transactions, and for fraud detection and prevention purposes.
• Contacts: With your consent, we may receive information about your phone contacts, which may be used to provide Services, such as peer to peer transactions, for fraud detection and prevention purposes and to protect users’ accounts. You can update your phone setting to stop sharing phone contacts information at any time.

3. HOW WE USE YOUR PERSONAL INFORMATION

We use Personal Information for the following purposes depending on which Services you use:

• To Provide and Customize Our Services To You: We use your Personal Information to provide our Services to you and personalize your experience, including to assess your eligibility for and recommend new Services to you, to manage your account(s), provide an integrated user experience across our Services, to process transactions or payments, to operate and administer our rewards programs and other promotions that may be made available to you through our Services, and to carry out our obligations arising from any transactions you enter into with us (e.g., top-ups, bank transfers, electronic money exchanges, ATM withdrawals, and card purchases). We may link or combine your activities on our Services with information from you or other parties to provide you with a personalized experience.
• To Communicate With You: We use Personal Information to communicate with you about your account or use of our Services, including about product updates, security alerts, technical notices, changes to our policies and terms, to respond to you when you contact us, and to provide customer service and support.
• To Advertise and Market Services: We use Personal Information to advertise and market our Services, as well as the services of our affiliates and our partners, such as banks or financial institutions, including through third-party advertising companies to serve you personalized advertisements and offers, through SMS text with your consent, and through emails, messages, and push notifications. You may unsubscribe from such emails and text messages at any time: just follow the unsubscribe instructions contained in any such communications. We will not share your telephone number with third parties for their own marketing purposes.
• To Improve our Services and Perform Administrative Activities: We use Personal Information to operate, maintain, and improve our Services, including to research and develop new products and services; enhance, improve, debug and analyze our products and Services; manage our business relationships; and perform accounting, auditing, marketing and other functions.
• Authentication, Integrity, Security, and Safety: We use Personal Information to verify your identity, to protect against fraud, to detect, investigate, and prevent malicious conduct, fraudulent activity or unsafe experiences, to address security threats, protect public safety, and to secure the Services.
• Job Applications: We may use Personal Information to assess job applications, including to communicate with you about your employment application, to verify your information and carry out reference checks and/or background checks and to assist you with obtaining an immigration visa or work permit when requested by you.
• Legal Reasons: We may use Personal Information as needed, or when otherwise we deem it necessary or appropriate, to comply with applicable laws, including financial crime laws; respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; to enforce or investigate potential violations of our Terms of Service, Privacy Policy, and other policies; to detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; to protect our, your or others’ rights, privacy, safety or property; and to resolve disputes.
• With Your Consent: We may also use your Personal Information for other purposes, with your consent.

4. THIRD PARTIES WHO MAY RECEIVE PERSONAL INFORMATION

We may share any of the categories of Personal Information set out in Section 2, including for business purposes, with other brands, affiliates, subsidiaries or other entities in our family of companies and to the following categories of third parties:

• Vendors: We work with third-party service providers to provide services to us, including risk detection and prevention, customer service, email delivery, processing and authorizing payments, facilitate ownership of account transfers, and to support and improve our Services and technical infrastructure, and may share Personal Information with such service providers.
• Authorized Third Parties: We may share Personal Information with third parties who you authorize us to share your Personal Information with, such as your bank or ONE users who you have designated for purposes such as customer referrals or managing shared pockets.
• Other Users: We may share Personal Information, such as your name, contact information or  relationship with us, with other ONE users to facilitate peer to peer transfers. We will never share your payment card information or account numbers with other ONE users.
• Your Employer: We may share your Personal Information, such as your name, employee identification number, place of employment, and information related to your paycheck, with your employer to facilitate providing the Services. We do not share information about your purchases or spending, the transactions to or from your bank account, the balance of your account, or information regarding your individualized financial situation with your employer.
• Financial Services Partners. We partner with third-party financial services companies whose services or products may be accessed through our Services. If you choose to accept their services, we may share your Personal Information with such third-party financial services companies. This exchange of information is necessary to maintain business operations and to provide the ongoing services you've requested.
• Marketing, Advertising, and Analytics Partners: We may use third-party marketing, advertising, and business analytics partners, including Google Analytics, to deliver customized advertising on other websites or services you may use, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. Click here to learn more about Google Analytics. We participate in interest-based advertising and use third-party advertising companies to serve you targeted advertisements based on your browsing history. Typically, though not always, the information used for interest-based advertising is collected through tracking technologies, such as cookies, web beacons, embedded scripts, and location-identifying technologies, which recognize the device you are using and collect information, including device and usage information, as described in Section 2. We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. We may permit third-party online advertising networks, social media companies and other third-party services, to collect information about your use of our Services over time so that they may provide services to us, play or display ads on our Services, on other websites or services you may use, and on other devices you may use. We may also allow third parties, such as social media platforms, to collect information from our website visitors through a first-party pixel and such collection of information would be governed by the privacy policies of the company who provides the pixel.
• Change of Control: We may also share Personal Information with actual or prospective acquirers, their representatives and other relevant participants in the event of a corporate restructuring (e.g., merger, sale, joint venture, or other disposition) or change in control involving all or a portion of our business or assets, including in connection with bankruptcy or similar proceedings.
• Legal Reasons: We may share Personal Information as needed, or when otherwise we deem it necessary or appropriate, to comply with applicable laws, including financial crime laws; respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; to enforce or investigate potential violations of our Terms of Service, Privacy Policy and other policies; to detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; to protect our, your or others’ rights, privacy, safety or property; and to resolve disputes.
• With Your Consent: We may also share your Personal Information with other third parties, with your consent.

5.    CALIFORNIA RESIDENTS’ PRIVACY RIGHTS AND CHOICES

If you are a California resident, you may have certain rights to manage your Personal Information under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), as set forth below:

• Transparency: The CCPA requires that we notify consumers at or before the collection of their Personal Information of the categories of Personal Information we have collected about consumers in the preceding 12 months, the categories of sources from which such Personal Information is collected, our purposes for collecting such Personal Information, whether such Personal Information is “sold” or “shared”, and the length of time we intend to retain each such category of Personal Information, or if that is not possible, the criteria we use to determine our retention periods, among other information. This Privacy Policy contains such information. Please read it, as well as any other terms that are provided to you at or before the collection of your Personal Information, carefully.

• Access: Right to request access to the categories of your Personal Information that we have collected, disclosed, or “sold”, as well as the specific pieces of your Personal Information that we have collected, the categories of sources from which we have collected such Personal Information, the categories of third parties to whom we have disclosed, “sold” or “shared” such Personal Information, and our purposes for collecting, “selling” or “sharing” such Personal Information.
• Correction: Right to correct inaccurate or incomplete Personal Information in certain circumstances. Please note, however, that information related to your creditworthiness is maintained by the credit bureaus. If you find that there is an error or you want to dispute the information found in your credit report, please contact the credit reporting bureaus: Experian, Transunion, and Equifax.
• Deletion: Right to delete Personal Information about you, subject to certain exceptions.
• Opt Out of “Sales” and/or “Shares” for Cross-Context Behavioral Advertising: We do not sell your Personal Information in the conventional sense (i.e., for money). However, as is common practice among companies that operate online, we may use advertising and analytics services that are intended to analyze your interactions with our Services, based on information obtained from cookies or other trackers, including for delivering advertising to you (such as interest-based, targeted, or cross-context behavioral advertising). With respect to your interactions on www.ONE.app, we may disclose certain of this information, including device and usage information, to third parties in connection with our use of such cookies or other trackers, and such disclosure may be considered a “sale” and/or “share” under the CCPA. You can opt out of the “sale” or “sharing” of your Personal Information by implementing the Global Privacy Control (“GPC”) in your browser. For instructions on how to download and use GPC, please visit https://globalprivacycontrol.org.  You can also opt out of the “sale” or “sharing” of your Personal Information by clicking “Your Privacy Choices” on ONE.app. Your opt-out decision is specific to a particular device and browser. If you use a different browser or device, you will need to opt out on each. Additionally, if you clear your cookies you will need to opt out again. Please note that even if you opt out of the “sale” and “sharing” of your Personal Information, we may still use essential cookies to track your use of our Services, including for purposes of operating the Services and for legal and security reasons, such as detecting and preventing fraud. We do not have actual knowledge that we “sell” or “share” the Personal Information of consumers under 16 years of age.
• Limit the Use and Disclosure of Sensitive Personal Information:  We receive certain information that is considered sensitive under the CCPA, such as biometric information and precise geolocation, as described in more detail in Section 2 above. We only process such sensitive Personal Information in order to provide the Services, or as otherwise permitted by the CCPA, such that we are not required to provide the right to limit the use or disclosure of sensitive Personal Information.  

• Non-Discrimination: The right to not be discriminated against for exercising any of these rights. However, please note that if the exercise of these rights limits our ability to process Personal Information (such as in the case of a deletion request), we may no longer be able to provide you our products and Services or engage with you in the same manner.
• Shine the Light: California residents who have an established business relationship with us have rights to know how their information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law, or the right to opt out of such practices (Civ. Code §1798.83). We do not share Personal Information with third parties for such purposes.

To exercise your rights, please submit a request by contacting us at [email protected], 1-855-830-6200 or writing to us at: ONE Finance, Inc., P.O. Box 513717, Los Angeles, CA 90051. Before processing your request, we may need to verify your identity and confirm that you are a resident of the State of California. To do so, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional Personal Information from you, including, but not limited to, your email address and phone number. You can also correct and delete certain information directly in the ONE Apps.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems or where the CCPA does not apply to our processing of your Personal Information because it is collected and processed subject to GLBA. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request in our substantive response.

You may designate an authorized agent to submit your verified consumer request by providing written permission and verifying your identity, or through proof of power of attorney. The authorized agent must provide a letter signed by you confirming the agent has permission to submit a request on your behalf or must provide sufficient evidence to show that the authorized agent has been lawfully vested with power of attorney. For security purposes, we may need to verify your identity and confirm directly with you that you have provided the authorized agent permission to submit the request. We may deny a request in the event we are not able to verify the authorized agent’s authority to act on your behalf. Please note that for privacy and security reasons, we will direct future communications to the consumer on whose behalf the request was made.

6.   RETENTION

We may retain Personal Information for as long as necessary for the purposes described in this Privacy Policy, or as otherwise permitted or required by law. In determining our retention periods, we use the following criteria: our relationship with you, the choices you have made with respect to your Personal Information, the permissibility of retention (including for backup and archival purposes), our legal and regulatory rights and obligations (including with respect to the prevention of fraud and abuse).

We do not delete your Personal Information upon deactivation of your account. Although your deactivated status is reflected promptly in our user databases, we may retain your Personal Information for a variety of purposes, including legal compliance, backups and archiving, prevention of fraud and abuse, and analytics. Upon deactivation of your account, you will no longer receive emails from us and links to third-party financial accounts and services will automatically terminate. If you have a money transfer transaction pending at the time you deactivate your account, your link to this service from us will terminate but your pending transfer will continue to completion and your bank account will remain open.

7.   CHILDREN’S PERSONAL INFORMATION

Our Services are not directed to, and we do not intend to, or knowingly, collect or solicit Personal Information from children under the age of 16. If you believe that a child under age 16 may have provided us with Personal Information without parental consent, please contact us.

8.   THIRD-PARTY PRIVACY PRACTICES

This Privacy Policy covers our privacy practices only. This Privacy Policy does not apply to the practices of third parties, including third parties with whom we partner. Third-party websites, services and applications are governed by each such third party's privacy policy, which we encourage you to read carefully. We are not responsible for the privacy policies and practices of third parties, and we are not responsible for the failure of third parties to honor their privacy obligations. By including a link to a third-party website or application, we do not endorse or recommend any products or services offered or information contained therein. If you decide to visit a third-party website or application via a link contained on the Services, you do so at your own risk.

9.   UPDATES TO THIS PRIVACY POLICY

When we make changes to this Privacy Policy, we will change the date at the beginning of this document. If we make material changes to this Privacy Policy, we will notify individuals by either email to their registered email address, by prominently posting within the ONE Apps, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise provided.

10.  CONTACT US

If you have any questions or requests in connection with this Privacy Policy or other privacy-related matters, or if you need assistance exercising any of the choices described in this Privacy Policy, contact us at [email protected], call us at: 1-855-830-6200 or write to us at: ONE Finance, Inc., P.O. Box 513717, Los Angeles, CA 90051