Card Control Privacy Policy

Effective as of 1/1/21

1. Introduction. This Privacy Policy describes the types of "Personal Information" (information that is identifiable to a particular person) that is collected (directly or through service providers) in connection with the CardValet downloadable application ("German American Card Control") and related services (collectively, the "Service") offered by your financial institution ("we" or "us"). This Privacy Policy is intended to supplement the disclosures in any Privacy Policy that you may have already been presented by us in connection with online banking or other services.
2. Eligibility. The Service is offered only to individual residents of the United States, excluding its territories, who can form legally binding contracts under applicable law. Without limiting the foregoing, the Service is not offered to minors. Other restrictions and eligibility requirements for the Service apply as described in the Card Valet Terms of Use. We do not knowingly collect any Personal Information from or about individuals under 18 years of age. Please do not submit such information to us, and as a parent or legal guardian, please do not allow your children to submit Personal Information without your permission. By using German American Card Control or the Service, you represent that you meet these requirements and that you agree to the terms of this Privacy Policy.
3. What Types of Personal Information We May Collect. We may collect Personal Information about you, which may include: name, postal address, zip code, e-mail address, telephone number, account numbers, payment card expiration date, payment card identification or verification numbers, social security number, mobile device location, and other information that we can use to contact you, verify your identity, provide the functionality available through use of German American Card Control and the Service, and manage risks, such as information maintained about you by identity verification services and consumer reporting agencies, including credit bureaus, and payment and other transaction information, and history for payments and other transactions in which you participate through the Service, and any Personal Information that you may enter into information blocks present in the German American Card Control interface or made available through the Service.
4. How We May Collect Personal Information About You. We may collect Personal Information about you from the following sources:
   1. Information that you input to German American Card Control or that German American Card Control collects automatically;
   2. Your use of German American Card Control and the Service, and your interactions with customer care, including information you enter or speak, and information transmitted by your computer or mobile device or other devices you use as part of your receipt of the Service; and
   3. We may also collect Personal Information about you from others, such as Affiliates, or other companies (such as for fraud detection).

5. How We May Share Personal Information About You. We share Personal Information about you only as permitted by law. For Personal Information that is nonpublic and that we collect in connection with a financial service, U. S. federal law permits us to share such information only for the purposes shown in the following table:

   Card Control Reasons We Can Share Personal Information

   Reasons we can share personal information about you:	Do we share?	Can you limit this sharing?
   For our everyday business purposes - such as to process your transactions, respond to court orders and legal investigations, and report to credit bureaus;	Yes	No
   For our marketing purposes - to offer our products and services	Yes	No
   For Joint Marketing with other financial companies;	No	We Do Not Share
   For our Affiliates' everyday business purposes (information about your transactions and experiences);	Yes	No
   For our Affiliates' everyday business purposes (information about your creditworthiness);	No	We Do Not Share
   For our Affiliates to market to you;	No	We Do Not Share
   For Nonaffiliates to market to you	No	We Do Not Share

6. How We May Use Personal Information About You. We use Personal Information about you only as permitted by law, including but not limited to the following purposes:

   1. To complete transactions and render services authorized by you;

   2. Other everyday business purposes, such as to maintain your ability to access the Service, to send you information about the Service, to effect, administer and enforce transactions, to perform fraud screening, to prevent actual or potential fraud and unauthorized transactions, to verify your identity, to determine your credit history, to verify the information you provide to the Service, to perform collections, to report to credit bureaus (including furnishing delinquent account information), to comply with laws, regulations, court orders and lawful instructions from government agencies, to protect the personal safety of users of the Service or the public, to prevent and defend claims, to resolve disputes, to troubleshoot problems, to enforce our Terms of Use, to protect our rights and property, and to customize, measure, and improve the Service and German American Card Control, including pattern recognition, modeling, enhancement and improvement, system analysis, and Service performance analysis;

   3. For marketing purposes - to offer products and services to you, although you may opt-out of receiving commercial email marketing messages from us by following the opt-out processes described in those messages; and

   4. If we are involved in a merger, acquisition, or sale of all or a portion of our assets that results in a change of the majority ownership of German American Card Control or the Service or the entity that owns them, you will be notified of this via email and/or a prominent notice on German American Card Control, as well as any material change in uses of your Personal Information, as well as any choices you may have regarding Personal Information about you.

7. Other Important Information. Vermont: Under Vermont law, we will not share information we collect about Vermont residents with companies outside of our Affiliates, unless the law allows. We will not share information about your credit worthiness with our Affiliates except with your consent, but we may share information about our transactions or experiences with you with our Affiliates without your consent.

   California: Under California law, we will not share information we collect about you with Nonaffiliates, unless the law allows. For example, we may share information with your consent, to service your accounts, or to provide rewards or benefits you are entitled to. We will limit sharing among our Affiliates to the extent required by California law.

8. Definitions.

   1. "Affiliates" means companies related by common ownership or control. They can be financial or nonfinancial companies.

   2. "Nonaffiliates" means companies not related by common ownership or control. They can be financial or nonfinancial companies.

   3. "Joint Marketing" means a formal agreement between nonaffiliated financial companies that together market financial products or services to you.

9. How We Protect Personal Information About You. To protect Personal Information about you from unauthorized access and use, we maintain physical, electronic, and procedural safeguards, including but not limited to security measures that comply with applicable federal and state laws. We also require our service providers and business partners to whom we disclose the information to do the same. When you enter sensitive information (such as a debit or credit card number) into German American Card Control, we encrypt the transmission of that information using secure socket layer technology (SSL). We may retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

10. Data Retention. We will retain, protect, use and share Personal Information about you as long as it is reasonably required for the purposes described in this Privacy Policy, and as required by law, including but not limited to for risk management, regulatory compliance, and audit purposes.

11. Amendments. We may amend this policy at any time by posting a revised version in German American Card Control. The revised version will be effective immediately at the time it is posted unless a delayed effective date is expressly stated therein. You may (in our discretion) also be provided with an email notification of such amendments. If we make any change in how we use your Personal Information, we will notify you by email or by means of a notice in German American Card Control prior to the change becoming effective. You may (in our discretion) be required to affirmatively acknowledge or accept the revised Privacy Policy in order to continue using German American Card Control and the Service. Any use of German American Card Control or the Service after a notice of change will constitute your express agreement to such changes.

12. Contacting Us. If you have any questions about this Privacy Policy, or wish to provide updates or corrections to information about you, you may contact us by calling us at the phone number, or writing to us at the address, of our main offices.

13. Any accounts you currently hold with German American Bank will remain subject to the German American Bank Privacy Policy, as agreed upon during account opening. This policy can be found at https://germanamerican.com/privacy.