Online Privacy Statement

Rev 6/2025

Online Privacy Statement

This Online Privacy Statement ("Privacy Statement") describes Credit One Bank's online and mobile privacy practices and applies to websites, mobile applications that run on smartphones, tablets, and other devices ("apps"), and additional services (collectively, the “Services”) that we offer which link to this Privacy Statement.

Information you provided Credit One Bank when you applied for or obtained a product or service from us is also governed by our Gramm-Leach Bliley Act Privacy Policy (“Privacy Policy”). If you are such an applicant or customer, please refer to that notice for additional information about our privacy practices.

By using the Services, you agree that your personal information will be collected, used, and shared in accordance with the terms and conditions of this Privacy Statement. Your use of the Services is subject to this Privacy Statement and our Terms of Use, which are incorporated by reference into this Privacy Statement.

Information We Collect – and How We Collect It

When you use our Services, we may collect Personal Information that you submit to us voluntarily, or Online Activity Data that we collect.

Personal Information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you such as your name, mailing address, email address, telephone number, Social Security number, or other information that identifies you. Personal information does not include: (1) publicly available information and (2) de-identified or aggregate consumer information. This information may be collected when you voluntarily provide it to us through forms on our website or in our apps. These forms could include survey forms, credit card applications, contest entries, and sign in pages for online banking or mobile application access.

Online Activity Data includes information such as your IP address, browser type, and display/screen settings; how you interact with our website and apps; mobile device IDs. This data may be collected using cookies and other online tracking devices such as web beacons, depending on your browser settings. Cookies are small pieces of data sent from a website and stored on your computer by your web browser that can allow other websites that you visit to track your browsing activities. A web beacon is a small string of HTML code that represents a graphic image on a website or email. Credit One Bank may engage service providers to monitor activities on our own website. These business partners may use their own cookies, web beacons, and/or other monitoring technologies to compile statistics about website visitors. Additionally, Credit One Bank may collect Online Activity Data when you use our apps or your mobile device browser to access our website. Credit One Bank may also collect Online Activity Data or information when you interact with our official pages on third party websites. Please refer to the policies of those companies to better understand your rights and obligations with regard to your activity on those websites.

How We Use Information

We may use Personal Information and Online Activity Data we have collected for a variety of reasons, including:

to enable you to apply for a credit card issued by Credit One Bank
to enable you to use online tools or perform certain online transactions
to service and manage your account, including responding to or updating you on inquiries, or to contact you about your accounts or feedback
to offer you special products and services and deliver advertisements to you in the form of banner ads, interstitial pages (ads that appear as you sign in or sign out of your online accounts), or other promotions
to analyze whether our ads, promotions, and offers are effective
to help us determine whether you might be interested in new products or services, and to improve existing products and services or develop new products and services
to identify and repair errors that impair existing intended functionality
for internal research related to technological development and demonstration
to verify your identity and/or location to allow access to your accounts, and conduct online transactions
to manage fraud and data security risk
to audit current interactions with you and related transactions (e.g., counting and verifying ad impressions, auditing compliance).
to personalize and optimize your website browsing and app experiences by examining which parts of our website you visit or which aspect of our apps you find most useful to comply with federal, state or local laws; civil, criminal or regulatory investigations; or other legal requirements
to enforce our terms and conditions, protect our operations or those of any of our affiliates, protect our rights, privacy, safety or property and/or that of our affiliates, you or others, or to allow us to pursue available remedies or limit the damages we may sustain
to share with our service providers who are contractually obligated to keep such information confidential and to use such information only to provide the specific services we have asked them to perform
as part of a merger, acquisition, bankruptcy, or other transaction where a third party assumes control of us.

How We Share Information

We may share your information with our affiliates, business partners, and third parties, including:

Affiliates. Our related businesses allow us to improve and streamline Services across our banking platform.
Business partners. We may offer co-branded services, joint promotions, or other products or services.
Yodlee. We may utilize Envestnet | Yodlee (“Yodlee”) in connection with the service we provide you. When you request data from a source connected to our service, Yodlee may be used to collect that data and provide it to us. For example, if you link your checking or savings account with a third party institution to your account with us for verification purposes, Yodlee would be utilized to access the third party account, gather the specified information, and pass it on to us. In such an instance, Yodlee acts on our behalf in this process, which means we may share your data with Yodlee as one of our third party service providers. For more information on how Yodlee collects, uses, stores, and handles your data please see Envestnet | Yodlee’s FastLink Terms of Service at (https://solutions.yodlee.com/fastlink-terms.html).
Other third-party service providers. Our service providers enable us to offer, maintain, and optimize the Services. They are also contractually obligated to keep such information confidential, and may be subject to various state privacy and data security requirements.
Government agencies and other third parties. Information may be shared to comply with the legal demands of subpoenas or court orders, to verify customer identities, to address fraud or security issues, to protect the rights or property of customers or third parties, in connection with a corporate transaction, or otherwise as required by law.
Credit Reporting Agencies. We may share information with credit reporting agencies for multiple purposes including fraud prevention, identity verification, underwriting, and marketing and to service your account.
Mergers and Acquisitions: We reserve the right to disclose and transfer your personal information: (i) to a subsequent owner, co-owner or operator of the Services or applicable database; or (ii) in connection with a corporate merger, acquisition, consolidation, restructuring, bankruptcy, the sale of substantially all of our membership interests and/or assets, or other corporate change, including during the course of any due diligence process./li>

Managing Your Online and Mobile Preferences

You are not required to provide Personal Information to browse our websites. If you provide us with Personal Information to obtain a product or service from us, our Privacy Policy governs how we share Personal Information with our affiliates and third parties.

As you access our online services, cookies and similar technologies allow us to customize content and advertisements for our products and services on our websites or apps. In order to make content and advertising as relevant as possible, we may use information about your relationship with us (such as types of accounts and transactional information). Using cookies can give you additional or easier access to certain features on our website (such as allowing you to sign in easier), and can allow us to provide you with more personalized offers. You can set your browser to not accept cookies or to indicate when cookies are sent.

Some mobile devices come with a non-permanent advertising identifier or ID which gives companies the ability to serve targeted ads to a specific mobile device. In many cases, you can turn off mobile device ad tracking or you can reset the advertising identifier at any time within your mobile device privacy settings. You may also choose to turn off location tracking on your mobile device. By turning off ad tracking or location tracking on your mobile device, you may still see the same number of ads as before, but they may be less relevant because they will not be based on your interests. User mobile data will not be shared.

Do Not Track Signals

Certain web browsers may provide an option by which you may have the browser inform websites or internet services you visit that you do not wish to have personally identifiable information about your activities tracked by cookies or other persistent identifiers across time and across third-party Internet websites, online or cloud computing services, online applications, or mobile applications. These are commonly called “do not track” signals. Our website and apps do not respond to such signals.

In addition, we do not allow third parties to collect personally identifiable information about a user's online activities, over time and across different sites, services, and applications, when that user uses our site, service, or application.

Advertising on Third-Party Websites

Behavioral advertising is when companies provide you ads that are intended to be tailored to your specific interests based upon your website browsing history and online activity. Certain Credit One Bank business partners may collect Online Activity Data and provide you with behavioral advertising for Credit One Bank products and services on third-party websites. Our business partners are subject to their own privacy policies. To explore options for opting out of behavioral advertising, visit http://optout.aboutads.info/ or click on the AdChoices icon in an ad and follow the instructions. You may also use the Network Advertising Initiative's (NAI) Opt-Out Tool or other tools provided by the publishing platform. Opting out relies on information in the unique cookies placed on your web browser by our business partners, so if you delete cookies, use a different device, or change web browsers, you may need to opt out of behavioral advertising again.

Additionally, we may work with websites like Google and Yahoo to display ads to you based on search terms you use on those websites. Please review the privacy policies of those websites for instructions on how to limit these ads.

Please note that you may still receive general online advertising from Credit One Bank even after you adjust your ad preferences with certain web search engines or opt out of behavioral advertising through AdChoices or the NAI tool. Such advertising, however, will not be based on Online Activity Data or search term information. Our marketing emails include instructions on how to opt out of receiving such emails in the future.

Updating Your Information

Keeping your account information up-to-date is important. You may review or update certain account information by signing in to your account online. If you cannot change the incorrect information online, or you prefer to request changes offline, please see the Customer Service section on our website, or call 877-825-3242 or write to us using the contact information listed on your account statements, records, or other account materials.

Links

Our websites or apps may include links to third-party websites. These third parties are not subject to this Privacy Statement or to the Privacy Policy. Please review their privacy notices when visiting these websites.

Biometric Information

Biometric information includes automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, hand or face geometry, or other unique biological patterns or characteristics. If you provide your consent, our Services may collect your biometric information to allow you to log on to your account more quickly, to confirm your identity, or to secure your account. Credit One Bank will never sell, lease, or disclose your biometric information to any third party. If you close all of your Credit One Bank accounts, we will delete any biometric information we may have about you within a reasonable time, but in no event more than one year after you close your account.

Children’s Online Privacy

Our Services are not intended to be used by children. We do not intentionally collect personal information from children under 13 without permission from their parent or legal guardians. If you become aware that a child has provided us with personal information without parental consent, please call us at 877-825-3242. For more information about the Children's Online Privacy Protection Act (COPPA), please refer to the FTC's website at https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy.

Information Security

At Credit One Bank, we are committed to protecting your personal and financial information. We use commercially reasonable administrative, technical, and physical security measures to protect personal information collected through the Services. These measures include computer safeguards and secured files and buildings. In the event we share personal information with third party service providers or joint marketers, we restrict the ability of such parties to use or disclose the personal information we furnish. We also require such parties to apply appropriate security measures to protect information. We retain your personal information for as long as needed: (i) to conduct business with you; (ii) as needed for the purposes outlined in this Privacy Statement or at the time of collection; or (iii) as necessary to comply with our legal obligations, resolve disputes, and enforce any agreements. No data transmission or storage system can be guaranteed to be absolutely secure, and we disclaim any representation or warranty that our information security systems or those of our service providers and joint marketers are invulnerable to breach or compromise.

Changes to this Privacy Statement

Credit One Bank may change its online privacy practices in the future and we may revise this Privacy Statement. If we make material changes to our privacy statement, we will provide you notice of such changes. If you use our Services after we revise the Privacy Statement, you agree to the updated terms and conditions of this Privacy Statement.

This Privacy Statement was last revised June 2, 2025 and is effective as of that date.

Glossary

AdChoices: Allows individuals to opt out of browser-enabled interest-based advertising by some or all participating companies, using opt-out cookies to store your preferences in your browser.

Browser: An application used for accessing websites or information on a computer network. Examples include Chrome, Safari, Edge, Internet Explorer, and Firefox.

Business partners: Companies we work with to jointly market and/or deliver products and services to you. Business partners include affinity or co-brand business partners. They may not use this information to independently market to you unless you consent.

Cookies: Small pieces of data sent from a website and stored on your computer by your web browser that can allow other websites that you visit, and the advertising companies and content partners for those websites, to track your browsing activities.

Privacy Policy: A Credit One Bank product-specific privacy notice, which we provide to customers at account opening and annually thereafter pursuant to federal law. It describes our privacy practices and provides you the right to opt out of certain types of information sharing.

IP address: A unique “Internet Protocol” number assigned to a device connected to the Internet. Credit One Bank treats IP addresses as non-personal information unless otherwise required by law.

Service providers: Vendors with whom we have a contractual relationship to perform services on our behalf. Vendors may not use personal information for any purpose other than carrying out those services.

Third-party websites: Sites that are not owned or operated by Credit One Bank and are not subject to our Privacy Statement.

Web beacon (alternatively referred to as a tracking bug, tag, page tag, tracking pixel, pixel tag, or clear gif): An often-transparent graphic image, usually no larger than 1 pixel x 1 pixel, that is placed on a website or in an email that is used to monitor the behavior of the user visiting the website or interacting with the email. Web beacons can be used for activities like site traffic reporting, unique visitor counts, advertising auditing and reporting, and personalization.