Privacy

WESTERN ALLIANCE BANK PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

Effective Date:  4/29/2025
Last Updated:  4/29/2025

This Privacy Notice for California Residents supplements the information contained in Western Alliance Bank’s Privacy Policy (https://www.westernalliancebancorporation.com/privacy-legal-home/privacy-policy) (divisions are Alliance Association Bank, Alliance Bank of Arizona, Bank of Nevada, Bridge Bank, First Independent Bank, and Torrey Pines Bank) (collectively, “we,” “us,” or “our”) and applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”) and any terms defined in the CCPA and CPRA that have the same meaning when used in this notice.

Information Collected

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information”), and sensitive personal information, as defined in the CCPA.

Personal and sensitive personal information does not include:

• publicly available information from government records;
• deidentified or aggregated consumer information;
• information excluded from the CCPA/CPRA's scope, such as:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the California Confidentiality of Medical Information Act ("CMIA") or clinical trial data; and
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act ("FCRA"), Gramm-Leach-Bliley Act ("GLBA"), California Financial Information Privacy Act ("CalFIPA"), and Driver's Privacy Protection Act of 1994.

Categories of Personal Information Collected

We may have collected the following categories of personal information from consumers within the last twelve (12) months:

Sources of Information Collected

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you or your agents. For example, from forms you complete or documents you provide us with related to the services for which we are engaged.
• Indirectly from you or your agents. For example, through information we collect from our clients in the course of providing services to them.
• Indirectly from our service providers and contractors. For example, web analytics data, such as type of browser software, during use of our digital services.

Purposes of Collecting Information

We may collect personal information for one or more of the following business or commercial purposes. They include:

• fulfillment of the reason(s) you provided the information, such as the:
  • provision of information, products, or services you request from us; and
  • processing of your requests, transactions, and payments;
• provision of support and responses to your inquiries, such as investigating and addressing your concerns and monitoring and improving our responses;
• prevention, detection, and investigation of security incidents that potentially compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted data;
• resistance to malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions;
• the carrying out of our obligations and enforcement of our rights arising from any contracts entered into between you and us;
• support of our ongoing operations and to maintain all our services and products, including audits and analytics collection, processing, debugging, and research;
• responding to law enforcement requests and as required by applicable law, court order, or governmental regulations;
• evaluation or conducting of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred; and
• any other purpose described to you during collection of your personal information or as otherwise set forth in the CCPA/CPRA.

No Selling or Sharing of Personal Information to Third Parties

In the preceding twelve (12) months, we did not sell or share personal information to or with third parties.

No Selling or Sharing of Personal Information of Consumers Under the Age of Sixteen

We do not have actual knowledge that we sell or share information of consumers under the age of sixteen (16).

No Disclosures of Sensitive Personal Information to Third Parties

In the preceding twelve (12) months, we did not disclose sensitive personal information to third parties. We only disclose personal information and sensitive personal information for a business purpose within our own company and to service providers/contractors with whom we enter a contract.

Retention of Your Information

Our retention periods are based on timeframes necessary to:

• fulfill the completion of transaction(s) for which we collected the personal information;
• take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• detect and mitigate security incidents, including malicious, deceptive, fraudulent, and illegal activity, or prosecute those responsible for such activities;
• debug products to identify and repair errors that impair existing intended functionality;
• engage in research in the public interest that adheres to applicable laws, if you provided informed consent;
• enable our operations and solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• comply with a legal obligation or exercise a right provided for by law; and/or
• make other internal and lawful uses of the information that are compatible with the context in which you provided it.

Your Rights and Choices

Rights You May Exercise

The CCPA/CPRA provide consumers (California residents) with specific rights regarding their personal information. This section describes your rights as a consumer under California law and explains how to exercise those rights.

A. Right to Know - You have the right to know what personal information we have collected about you. This includes a request for any or all of:

1. specific pieces of personal information we collected about you;
2. categories of personal information we collected about you;
3. categories of sources from which the personal information was collected;
4. categories of personal information we disclosed or sold for a business purpose about you;
5. categories of third parties to whom the personal information was sold or disclosed for a business purpose; and
6. the business or commercial purpose for collecting or selling personal information.

B. Right to Delete - You have the right to have your personal information that we have collected from you deleted, subject to certain exceptions.

C. Right to Correct - You have the right to have inaccurate personal information that we maintain about you corrected.

D. Right to Freedom from Discrimination - You have the right not to receive discriminatory treatment by us for the exercise of privacy rights described here and in the CCPA/CPRA, as conferred by those laws. This includes an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their CCPA/CPRA rights.

How to Exercise Your Rights and What to Expect from the Process

Methods for Exercising Your Rights

To exercise any of the above rights, you or your legally authorized agent may communicate your inquiry or request with us by:

• calling us toll-free at 1-888-995-2265; or
• mailing a written request addressed to: Western Alliance Bank, CCPA/CPRA Privacy Inquiries – Corporate Compliance, 1 East Washington Street, Suite 1400, Phoenix, AZ 85004.

Verification of your Identity

If you or your authorized agent submit a request to know, request to delete, and/or request to correct your personal information, we will need to first verify your identity in order to protect your confidentiality. You or your agent will be asked to provide via phone or in person three or more pieces of information we have in our records associated with your account. Once we verify this information, we will proceed with processing your inquiry or request.

Response Timing and Format

We will confirm receiving your request to know, correct, or delete within ten (10) business days of its receipt. We will endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. In the event we are unable to respond within 45 days, we may request this deadline be extended for an additional 45 days. We will inform you of the reason and extension period in writing.

The scope of personal information we are required to disclose is limited to the data collected over the 12-month period directly preceding the date we received a verifiable request. The response we provide will also explain the reasons we cannot comply with a request, where applicable. For data portability requests, we will select a format to provide your personal information to you that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

Fees

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes to Our Privacy Notice

We reserve the right to amend this notice at our discretion and at any time. When we make changes to this notice, we will post the updated notice on our website and update the notice’s effective date.

Contact Information

If you have any questions or comments about this notice, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Mail:
Western Alliance Bank
CCPA/CPRA Privacy Inquiries – Corporate Compliance
1 E. Washington Street, Suite 1400
Phoenix, AZ 85004

Phone:
1-888-995-2265