ONLINE AND MOBILE BANKING SERVICES PRIVACY NOTICE

Primis Online and Mobile Banking Services (the “Services”) help you manage your money, view your transactions and accounts, and make it easy to manage your finances on the go. Our Services are offered on behalf of Primis Bank (“we,” “us,” or “our”). This Online and Mobile Services Privacy Notice (the “Privacy Notice”), together with any other privacy notice that we provide to you pursuant to applicable federal and state financial privacy laws, informs you of our practices regarding the collection, use, and disclosure of personal information. The specific capabilities of our Services available to you may vary.

WHAT INFORMATION DOES PRIMIS COLLECT?

When you visit us using our Services, we may collect the following information:

Personal Information
Our Services may collect personal information from you when you open a new financial account or register for other financial services, such as:

• Your first and last name
• Address
• Email address
• User IDs
• Telephone number
• Social Security number

If you provide feedback or contact us via email, we will collect your name, email address, and any other content included in your message to respond to you.

Our Services also collects other types of personal information that you voluntarily provide, including any information requested by us when you contact us via email for support related to our Services.

Personal Information Usage
Primis may use information collected through Primis sites to do any of, but not limited to, the following:

• Responding directly to questions or inquiries
• Delivering tailored advertising, communication, surveys or offers to you
• Personalizing site interactions and experiences
• Allowing access to planning tools and calculators
• Developing and improving products and services
• Enhancing sites
• Identifying trends and effectiveness of promotional campaigns
• Detecting fraud and security enhancements
• Utilizing features within our site that require contact information or geo-location

Personal Information Sharing
Reference the Primis Consumer Privacy Notice for details on how personal information may be shared and how you may be able to limit certain types of information sharing.

Other Information
Device images or videos may be accessed when you deposit a check or use a QR code to make peer-to-peer payments using Zelle or other payment functionality. Device contacts may be accessed when you make peer-to-peer payments using payment functionality, such as Zelle or similar payment services. Device location information may be accessed to detect and prevent card transaction fraud and deposit fraud, as well as to provide branch and ATM locations.

We may collect the financial and transaction information necessary to provide you with our Services, including account numbers, payment card expiration dates, payment card identification and verification numbers, and transaction and payment history.

Personal Information Collected from Third Parties
We may collect certain information from identity verification services and consumer reporting agencies, including credit bureaus, to provide some of our Services.

Personal Information Collected Via Technology
We may, as well as our service providers, automatically log information about you, your computer or mobile device, and your interactions over time with our Services, our communications, and other online services, such as:

• Device data, such as your computer or mobile device operating system type and version, manufacturer and model, browser type, screen resolution, RAM and storage capacity, device type (e.g., phone or tablet), IP address, unique device identifiers, language settings, mobile carrier, and network information (e.g., Wi-Fi, 4G, LTE, 5G). We may also collect general location information, such as your city, state, or geographic region.
• Online activity data, such as the pages or screens you view, the time spent on each page or screen, navigation paths between pages or screens, information about your interactions with a page or screen, access times, and the duration of your sessions.
• Cookies, which are text files that websites store on your device to uniquely identify your browser or to store information or settings. Cookies help you navigate between pages efficiently, remember your preferences, enable certain functionality, and allow us to understand user activity and usage patterns.
• Location Information. An IP address is a unique number automatically assigned by your internet service provider to every computer and mobile device. If you have enabled location services on your device and consent to the collection of your location when prompted by our Services, we will collect your location information when you use our Services—for example, to support fraud-detection measures. If you prefer not to share this information, you may decline the request when prompted or adjust your device’s location-services settings.

DISCLOSURE OF YOUR PERSONAL INFORMATION

Our Services may disclose your personal information as described below.

Third-Party Service Providers
Because we are responsible for the Services you use, your personal information may be shared within the systems and partners that support those Services when necessary to operate them. Any sharing of your information occurs under our direction, and we remain responsible for how your information is used. Service providers that support our Services may use your information for the purposes described in this Privacy Notice, including:

• Providing you with our Services
• Conducting quality assurance testing
• Facilitating the creation of accounts
• Optimizing the performance of our Services
• Providing technical support

Corporate Restructuring
We may share some or all of your personal information in connection with, or during the negotiation of, any merger, financing, acquisition, or dissolution transaction involving the sale, transfer, divestiture, or disclosure of all or a portion of our business or assets. In the event of insolvency, bankruptcy, or receivership, personal information may also be transferred as a business asset. If our company, business, or assets are acquired by another entity, that entity will possess the personal information collected by our Services and will assume the rights and obligations regarding your personal information as described in this Privacy Notice.

Authorities and Others
Regardless of any choices you make regarding your personal information, our Services may disclose your personal information to law enforcement, government authorities, or private parties for the compliance and protection purposes described above.

Additional Required Disclosures
Primis Bank does not sell customer personal information and does not track users across apps or websites owned by other companies.

SMS PROGRAM DISCLOSURES

By enrolling in SMS alerts, you agree to receive text messages related to your account activity, security notifications, and service updates. Primis Bank will not share your opt-in with other affiliates or non-affiliates. Unique services offered by Primis Bank or affiliates that offer the use of SMS require separate opt-in

Message Frequency
Message frequency varies based on your account activity and alert settings.

Cost
Your carrier message and data rates may apply.

Opt-Out Instructions
You may text STOP to discontinue SMS alerts at any time. You may also disable SMS alerts by unlinking your mobile number in the Primis Mobile app or contact Primis Bank Customer Care.

Supported Carriers
Major U.S. carriers are supported, but delivery is not guaranteed and may be affected by carrier network conditions.

Data Use for SMS
Your phone number, device information, and carrier details are used solely to deliver SMS alerts and authenticate your device. No SMS-related data is sold or used for advertising.

ADVERTISING

Information Primis collects, such as general preferences, user behavior and other user attributes, is used to create informed advertising and marketing strategies and determine its effectiveness. Advertising may include:

Online Behavioral Advertising

• Certain information about your user behavior will help us determine advertisements that may be most interesting to you. This information may be used for online and offline advertising, such as direct mail, email, social media, display, and behavioral ads.
• If you prefer not to receive tailored online and offline content and advertising based on the behavioral information available, you may opt out of online behavioral advertising through your personal privacy settings. If you opt out, you may still receive untailored advertising from Primis.

Advertising on Third-Party Sites and Mobile Applications

• Primis contracts with advertising companies to advertise our products and services on sites and mobile applications (apps) not associated with Primis.
• Primis may share some of the information you provide to us to these third-party sites so that they can tailor the ads served to you.
• Some of our online behavioral advertising may be served using data collected by third-party providers. Ads served on behalf of third-party providers will not contain unencrypted personal information and these companies are only given limited use of the information provided.
• Third-party sites and apps are not subject to this Privacy Notice and you should refer to their individual privacy policies and opt-out policies.

Relationship-based Advertising

• General information about your relationship with Primis may be used to determine the advertisements or offers we present to you.

Email Direct Marketing

• General information about your relationship with Primis and certain information about your user behavior will be used to determine marketing offers sent to you via email.
• If you prefer not to receive marketing offers via email, opt-out of these solicitations by clicking on the “opt out” button at the bottom of a Primis email.

LINKS TO OTHER SITES

Our Services may contain links to third-party websites. When you click on a link to any other website or location, you will leave our Services and be directed to another site, where a different entity may collect personal and/or anonymous information from you. Our provision of a link to any other website or location is for your convenience and does not constitute our endorsement of that website, its location, or its contents. Our Services have no control over, do not review, and are not responsible for these external websites or their content. Please be aware that the terms of this Privacy Notice do not apply to external websites. We encourage you to review the privacy notice of every website you visit.

YOUR CHOICES REGARDING YOUR INFORMATION

You have several choices regarding use of information on our Services.

Access, Update, or Correct Your Information
You can access, update, or correct your information by accessing your account. You can also contact Primis for any additional requests, as we are the entity providing our Services to you.

Opting Out SMS Communications
If you provide your phone number through our Services, we may send you SMS notifications, such as fraud alerts. You may opt out of SMS communications by unlinking your mobile phone number through our Services.

Opting Out of Location Tracking
If you initially consented to the collection of geo-location information through our Services, you may stop the collection of this information at any time by adjusting the preferences on your mobile device. Please note that if you withdraw consent to the collection of location information, you may no longer be able to use certain features of our Services.

How We Respond to Do Not Track Signals
Some web browsers transmit “Do Not Track” signals to the websites and online services with which they communicate. There is currently no standard that governs how websites should respond to these signals. We do not take action in response to Do Not Track signals. If and when a standard is established, we may make revisions regarding how we respond to such signals.

You may opt-out of SMS communications using the instructions in the SMS Program Disclosures of this Privacy Notice.

SAFEGUARDS AND RETENTION

We implement reasonable administrative, technical, and physical measures to safeguard the information in our custody and control against theft, loss, and unauthorized access, use, modification, or disclosure. However, transmission over the internet is not completely secure, and we cannot guarantee the security of your information.

All personal information is encrypted in transit and encrypted at rest.

Federal laws and regulations require U.S. financial institutions to retain original, active, and historical records. Your personal and financial data will be retained for a period of five to ten years, depending on applicable laws, regulations, and legitimate business needs.

ACCOUNT DELETION

You may request account deletion by contacting us. Data required for regulatory compliance will be retained; all other data will be deleted or de-identified.

SOCIAL MEDIA SITES

Primis operates various social media channels including, but not limited to, Facebook®, Twitter®, YouTube®, Instagram ®, LinkedIn® and TikTok®. Any content users post on an official Primis manage social page, such as pictures, information, opinions or personal information, is subject to the terms of use and privacy policies for the respective social platform. Understand your rights and obligations regarding this content by reviewing the social channel’s individual privacy policies, terms and conditions. When engaging with a Primis social channel, you are subject to this Privacy Notice and the Primis Social Media Community Disclosures located on PrimisBank.com.

LINKING TO THIRD-PARTY SITES

From time to time, we may provide you with links to third-party sites, which are not controlled by Primis. If you choose to visit these sites, review and understand the site’s individual privacy policies, terms and conditions. Primis does not guarantee or accept responsibility for the privacy and security of these third-party sites.

A NOTE ABOUT CHILDREN

Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has submitted personal information, we will attempt to delete the information as soon as possible.

PRIVACY NOTICE UPDATES

This Privacy Notice, and any other privacy notice issued by us is subject to occasional revision. We may, in our sole discretion, notify you of any material changes to the collection, use, or disclosure of your personal information by posting a notice on our Services. Any material changes to this Privacy Notice will be effective thirty (30) calendar days after such notice is posted on our Services, or immediately if no notice is provided. These changes will take effect immediately for new users of our Services. If you object to any such changes, you must notify us before the effective date of the changes and request that your account be deactivated. Continued use of our Services following notice of any changes (or use of our Services after such changes take effect) will constitute your acknowledgment of those changes.

CONTACT US

If you have any questions about this Privacy Notice or if you wish to report any security violations, please contact the Primis Bank Customer Care at 1-833-477-4647 or email [email protected].