U.S. Online Privacy Notice

DATED 2023-09-29 · VERSION 20231002_rev01 · COMPARED WITH 20230202_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20230202_rev01 to 20231002_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 ## Bank of America U.S. Online Privacy Notice
+Last updated January 31, 2023
+Last updated September 29, 2023
 Your privacy is important to us. We conduct regular assessment reviews and abide by rigorous privacy standards to ensure personal information we collect, use and share is protected. This U.S. Online Privacy Notice ("Notice") describes how Bank of America and our affiliates manage personal information about you when you interact with us online through our websites, event registration sites, mobile applications and social sites ("Sites and Mobile Apps") through your computer, smartphone, tablet or other mobile devices ("computer or mobile devices").
 ### This Notice explains
 - How we collect personal information when you visit, use or interact with us online, and through our ads displayed through online services operated by us or non-affiliated third parties.
 - Register as a participant in one of our events
 - Complete a survey, contest or sweepstakes or other promotion
 - Use aggregation services such as My Portfolio® and My Financial Picture® in order to consolidate your financial account or information at one online location
 We may use third-party providers to process personal information for business purposes on our behalf. Third-party providers are contractually obligated to comply with our policies to protect information we share with them or they collect on our behalf.
+We also may obtain personal information from a sponsor for individuals onboarded via a Commercial Prepaid card program with us. If we combine such personal information with information collected through the Mobile Services, we will treat the combined information as personal information in accordance with this Notice.
 The personal information we collect is limited to what is required to provide our products or services and to support legal and risk requirements. For additional information, please review the **How do we use your personal information** section of this Notice.
 #### Types of personal information we collect online
 The type of personal information we collect from and about you online will depend on how you interact with us and may include:
+- **Contact Information** such as name, mailing address, email address, telephone and mobile number(s)
+- **Account Application information** such as credit and income information
+- **Identifiers** such as Social Security number, account number(s), driver's license number (or comparable) or other information that identifies you for ordinary business purposes
+- **Access Authorization** such as user ID, alias, PIN and password and security questions and answers
+- **Documents or images** submitted via our Site or Mobile Apps to support account opening, such as statements and voided checks
+- **Contact Information** such as name, mailing address, email address, telephone and mobile number(s).
+- **Account Application information** such as credit and income information.
+- **Identifiers** such as Social Security number, account number(s), driver's license number (or comparable) or other information that identifies you for ordinary business purposes.
+- **Access Authorization** such as user ID, alias, PIN and password and security questions and answers.
+- **Documents or images** submitted via our Site or Mobile Apps to support account opening, such as statements and voided checks.
+- **Debit/Credit Card Information** such as card number, expiration date, CVV2, billing address.
 - **Information from your computer and mobile devices where allowed by individual browsers and/or operating systems**, such as:
 - Unique device identifiers (for example Media Access Control (MAC) and Internet Protocol (IP) addresses)
 - Browser type, version, language, and display/screen settings
+- Information about how you use and interact with our Sites and Mobile Apps (for example activities on pages visited, links clicked or unique and measurable patterns such as keystrokes, mouse clicks and movements, swipes and gestures)
+- Communications data, such as your communication preferences and details or the content of your communications with us (e.g., chat messages)
+- Information about how you use and interact with our Sites and Mobile Apps (for example, activities on pages visited, links clicked or unique and measurable patterns such as keystrokes, mouse clicks and movements, swipes and gestures)
+- Communications data, such as your communication preferences and details or the content of your communications with us (e.g., text messages, chat messages)
 - Responses to advertisements on sites and mobile apps where we advertise
 - Log information such as your search and voice to text queries in the mobile app
 - Search engine referrals
+- Geolocation information with consent (for example ATM or financial center location, fraud prevention)
+- Geolocation information (for example, for real time ATM or financial center location, upon request, or for fraud prevention)
 - Social media preference
+- Information to facilitate virtual or in-person event management (for example attendee names, dietary requirements, special assistance needs, and travel details for participants)
+- **Information to facilitate virtual or in-person event management** (for example, attendee names, dietary requirements, special assistance needs, and travel details for participants).
 ### How We Use and Share Personal Information
 #### How do we use your personal information?
 Personal information collected from and about you online described in this Notice may be used for many purposes such as:
 #### With whom do we share your personal information?
 We may share the personal information we collect from and about you online described in this Notice (and subject to other legal restrictions and notices you may have received depending on your relationship with us) with:
 - **Affiliates and Subsidiaries of Bank of America**, such as Merrill.
+- **Third-Party Providers** who have contracts with Bank of America including event vendors, organizers, volunteers, contractors, and sponsors.
+- **Third-Party Providers** who have contracts with Bank of America.
 - **Government Agencies** as required by laws and regulations.
 #### Aggregated / De-identified Information
 Collected personal information may be aggregated and/or de-identified (we remove any details that identify you personally). We may share this aggregated and/or de-identified information with third-party providers to help deliver products, services, and content that are better tailored to the users of our online services and for our own business purposes where permissible under applicable laws and regulations.
 #### How to limit sharing
+You have choices regarding the sharing of some personal information. Where appropriate, we will limit sharing of your personal information based on your privacy choices. You can register your choices online at [Set your Privacy Choices](https://secure.bankofamerica.com/customer/public/privacy.go).
+You have choices regarding the sharing of some personal information. Where appropriate, we will limit sharing of your personal information based on your marketing and information sharing choices. You can register your choices online at [Control How We Can Share Your Data and Market To You](https://secure.bankofamerica.com/customer/public/privacy.go).
 ### Online Behavioral Advertising
 Personal information collected from and about you online, as described in this Notice, is used and shared to deliver advertising and marketing, including prescreened offers of credit, which may be of interest to you.
 We present tailored ads to you:
 - **Advertising on our sites, mobile apps and off-line channels such as financial centers, call centers, and through direct marketing (for example email, mail, phone):** We may use personal information about your activities on our Sites and Mobile Apps, such as pages visited and key words entered, to help determine which of our ads or offers may be of interest to you. We may use personal information about your relationship with us (such as types of accounts, transactional information or the location in which you bank) to help determine which advertisements or offers to present to you.
 - **Advertising on non-affiliated third-party sites and mobile apps:** Bank of America contracts with advertising companies to advertise our products and services on sites and mobile apps not affiliated with us. We may use personal information we have collected or that you have provided to assist our non-affiliated third-party sites and mobile apps to select bank ads or offers that may appeal to you, display them to you and monitor your responses. Non-affiliated third-party sites and mobile apps are not subject to Bank of America Privacy Notices.
 #### How you can opt out of Online Behavioral Advertising
+You have choices about how Bank of America advertises to you based on your online behavior.
+- **Advertising on our Sites and Mobile Apps and off-line channels such as financial centers, call centers, and through direct marketing (for example email, mail, phone):** If you prefer we not provide you with tailored content and advertising based on your online behavior with our Sites and Mobile Apps, you may opt out of online behavioral advertising layer. Please review the important **Reminder** section that follows.
 - **Advertising on Non-Affiliated Third-Party sites:** Bank of America participates in the Digital Advertising Alliance ("DAA") self-regulatory Principles for Online Behavioral Advertising and uses the Advertising Options Icon on our behavioral ads on non-affiliated third-party sites (excluding ads appearing on platforms that do not accept the icon). Ads served on our behalf by these companies do not contain unencrypted personal information and we limit the use of personal information by companies that serve our ads. To learn more about ad choices, or to opt out of interest-based advertising with non-affiliated third-party sites, visit [YourAdChoices layer](http://www.aboutads.info/choices/) powered by the Digital Advertising Alliance or through the [Network Advertising Initiative's Opt-Out Tool layer](https://www.networkadvertising.org/choices). You may also visit the individual sites for additional information on their data and privacy practices and opt out-options.
 Industry standards continue to evolve around web browser "do not track" signals or configurations set in your internet browser. In addition to the advertising opt-out options above, Bank of America captures opt out preference signals, and to the extent users have rights under applicable law, treats them as valid requests to opt out of sale/sharing at the browser level.
 #### Reminder