Privacy Policy

  Please review this document carefully and download or print a copy for your reference. You can access a PDF version of this document that you can download or print by clicking here.

NEW COVENANT DOMINION FEDERAL CREDIT UNION
PRIVACY POLICY

Effective Date: February 2026

1. Purpose and Scope

This Internet & Digital Services Privacy Policy (“Policy”) describes how the New Covenant
Dominion Federal Credit Union (the “Credit Union”) collects, uses, and discloses
information obtained through its digital channels.

This Policy applies to the Credit Union’s public website accessible via
https://newcovenantcu.org, the Credit Union’s online banking platform, the Credit Union’s
mobile application, and any other digital or Internet-based services made available by the
Credit Union (collectively, “Digital Services”). This Policy applies to both accountholders
and non-accountholders (collectively, “you” and “your”) who access or use the Digital
Services.

The Credit Union is a federally chartered financial institution subject to Title V of the Gramm-Leach-Bliley Act and related federal regulations governing the protection of nonpublic personal information. The Credit Union’s treatment of information collected in connection with financial products or services (“GLBA Information”) is governed by those federal requirements, the Credit Union’s general Privacy Notice, and where applicable, this Policy. Note that this Policy is separate from the Credit Union’s general Privacy Notice provided at account opening and updated periodically pursuant to federal law.

Certain information collected in connection with the Digital Services, including technical
and usage information (Non-GLBA Information), may not constitute nonpublic personal
information subject to the Gramm-Leach-Bliley Act. The Credit Union’s treatment of such
information is handled in accordance with this Policy and applicable law.

This Policy operates within the Credit Union’s overall framework of agreements governing
electronic and internet-based activity. In addition to this Policy, your use of Digital Services
is subject to the Credit Union’s Terms of Use and Online Banking Agreement, as amended
from time to time. These agreements collectively define the rights and obligations
associated with the Digital Services, and a full understanding of those rights and obligations requires review of all applicable agreements.

By accessing or using the Digital Services and/or clicking “I ACCEPT” or its equivalent when
presented with a link to the Policy, you acknowledge and agree to be bound by this Policy.

2. Information We Collect

A. Information You Voluntarily Provide. The Credit Union collects information that you
voluntarily provide when using Digital Services. This may occur when you submit a
contact form, engage in online chat, apply for membership or other products, enroll
in online banking or mobile banking, schedule an appointment, register for financial
counseling, complete a survey, participate in a promotion, or otherwise
communicate with the Credit Union electronically. Depending on the nature of the
interaction, the information you provide may include identifying information such as
your name, address, email address, telephone number, date of birth, Social Security
number or taxpayer identification number, account information, financial
information, identification documents, authentication credentials, and any other
information you choose to submit. You are responsible for ensuring that information
you provide is accurate and complete.

B. Information Collected Automatically: When you access the Digital Services,
certain technical and usage information may be collected automatically. This may
include your Internet Protocol (IP) address, browser type, operating system, device
type, pages visited, the date and time of access, referring website addresses, and
general usage data.

The Credit Union uses cookies and similar technologies to support essential website
functionality, maintain session integrity, enhance security, and conduct basic
performance analytics. Cookies may be either session-based or persistent. These
technologies help ensure that Digital Services operate properly and securely.

If you use the Credit Union’s mobile application, additional device-related
information may be collected, including device identifiers, operating system
information, application version, and diagnostic data necessary to maintain
functionality and security. If you elect to enable biometric login features, the
application may record that biometric authentication has been activated; however,
biometric data itself is not stored by the Credit Union. If you authorize the application
to access location services, location data may be used solely to support functionality
such as identifying branch locations or enhancing fraud prevention controls.

3. How We Use Information

Information collected through Digital Services is used for legitimate business purposes
consistent with the Credit Union’s operations as a regulated financial institution. These may be for purposes such as providing and maintaining online and mobile banking services, authenticating users, processing transactions, preventing fraud, protecting the security and integrity of systems, responding to inquiries, administering programs or promotions, complying with legal and regulatory obligations, and maintaining records as required by law. Information may also be used to evaluate and improve the performance and functionality of Digital Services.

4. Disclosure of Information

The Credit Union may disclose GLBA Information collected through Digital Services to third
parties to operate its systems and provide financial services. Such disclosures may be made to service providers that support essential operations, including core processing systems, online banking platforms, mobile application providers, cloud hosting providers, identity verification vendors, payment networks, fraud detection services, data storage providers, and document processing vendors. These service providers receive only the information necessary to perform their contracted services and are contractually required to maintain confidentiality, implement appropriate safeguards, and comply with applicable federal laws and regulatory standards.

The Credit Union may also engage third-party providers to support ancillary functions related to the Digital Services, such as website analytics, email communications, marketing
support, appointment scheduling tools, online chat functionality, survey administration, and similar service enhancements. These providers assist the Credit Union in delivering and improving Digital Services but are not part of the Credit Union’s core banking or transaction processing systems. To the extent information is disclosed to such providers, it is limited to Non-GLBA Information.

The Credit Union may compile, generate, or permit its authorized service providers to
compile or generate aggregated, anonymized, or de-identified information derived from user interactions with Digital Services. Such information does not identify any individual user and does not constitute nonpublic personal information under applicable law.

The Credit Union may share aggregated or de-identified information with its authorized
service providers, including their affiliates, subcontractors, agents, and permitted assigns,
for purposes of evaluating, operating, maintaining, improving, or enhancing Digital Services
and related functionalities, including billing, payment, and presentment services.

Authorized service providers may use such aggregated or de-identified information for data analytics, performance analysis, service optimization, benchmarking, fraud detection, and other operational purposes related to the Digital Services. Results of such analytics,
provided they remain aggregated and do not identify individual users or accounts, may be
shared with additional third parties for purposes reasonably related to the operation,
evaluation, or improvement of Digital Services.

All such activities shall be conducted in compliance with applicable federal and state
privacy, data security, and user tracking laws.

Information may further be disclosed as required by law, in response to lawful process, to
regulatory authorities including the National Credit Union Administration, to law
enforcement, to prevent fraud or unauthorized activity, to protect the safety or property of
the Credit Union or others, or in connection with a merger, consolidation, or transfer of
assets. By using the Digital Services, you acknowledge that such disclosures may occur as
necessary to provide services and comply with legal requirements.

5. Cookies and User Controls

You may control cookies through your browser settings. Disabling cookies may a􀆯ect the
functionality of certain features of the Digital Services.

The Credit Union does not currently respond to browser “Do Not Track” signals.

6. Data Security

The Credit Union maintains administrative, technical, and physical safeguards designed to
protect the confidentiality, integrity, and availability of information collected through Digital Services. These safeguards may include encryption of data in transit, secure login protocols, multi-factor authentication, access controls, system monitoring, and periodic testing of security measures.

Although the Credit Union employs reasonable safeguards consistent with applicable
regulatory guidance, no method of transmission over the Internet can be guaranteed to be
completely secure.

In the event of unauthorized access to nonpublic personal information, the Credit Union will provide notice in accordance with applicable law.

7. Data Retention

Information collected through Digital Services is retained in accordance with applicable
federal and state laws, regulatory requirements, operational needs, and legitimate business purposes. When information is no longer required to be retained, it is securely destroyed in accordance with the Credit Union’s record retention and destruction policies.

8. Children’s Privacy

The Digital Services are not directed to children under the age of 13. The Credit Union does
not knowingly collect personal information from children under 13 through its Digital
Services. If the Credit Union becomes aware that such information has been collected
without appropriate parental consent, it will take steps to delete the information. Minors
should use Digital Services only with the involvement and supervision of a parent or legal
guardian.

9. Third-Party Links

The Credit Union’s Digital Services may contain links to websites operated by third parties.
The Credit Union is not responsible for the privacy practices or content of such external
websites. Users are encouraged to review the privacy policies of any third-party sites they
access.

10. California Privacy Rights

This Section applies only to Non-GLBA Information collected from California residents.
Pursuant to Cal. Civ. Code §1798.145(e), personal information collected, processed, sold,
or disclosed pursuant to the Gramm-Leach-Bliley Act is exempt from certain provisions of
the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
Accordingly, the rights described in this Section do not apply to GLBA Information.
With respect to Non-GLBA Information, and subject to verification of identity, California
residents may have the right to:

• Request disclosure of the categories and specific pieces of personal information collected about them;
•  Request disclosure of the categories of sources from which personal information is collected;
•  Request disclosure of the business or commercial purposes for collecting personal information;
•  Request disclosure of the categories of third parties to whom personal information is disclosed for a business purpose;
•  Request correction of inaccurate personal information;
•  Request deletion of personal information, subject to applicable exceptions; and
•  Not be discriminated against for exercising applicable privacy rights.

The categories of personal information collected, sources of collection, business purposes,
and categories of third parties to whom information is disclosed are described in Sections 2, 3, and 4 of this Policy.

The Credit Union does not sell personal information for monetary consideration.

The Credit Union will respond to verifiable consumer requests within 45 days of receipt,
subject to a single 45-day extension where reasonably necessary and permitted by law. The
Credit Union may require reasonable verification of identity consistent with applicable law
and will use personal information collected in connection with a request solely for
verification and response purposes.

The Credit Union is not obligated to respond to more than two requests from the same
consumer within a 12-month period to the extent permitted by law.

This Section is updated at least once every 12 months.

11. Methods for Submitting Requests
Individuals who wish to submit a request regarding personal information collected through Digital Services may do so using any of the following methods:

•  Calling the Credit Union at 1-877-NCDCU-4U (1-877-623-2848)
• Emailing operations@newcovenantcreditunion.org; or
•  Submitting a request through the contact form available on the Credit Union’s Website.

Where required by applicable law, the Credit Union will verify the identity of the requestor before responding to a request. The Credit Union will not require an individual to create an account to submit a request; however, if the individual maintains an account with the Credit Union, the Credit Union may require the individual to submit the request through that
account for verification purposes.

12. Changes to This Policy
The Credit Union reserves the right to amend this Policy at any time. The Effective Date at the top of this Policy will indicate when it was last revised. Continued use of the Digital Services after changes are posted constitutes acknowledgment of the updated Policy.