California Consumer Privacy Act Policy

This California Consumer Privacy Act Policy (“CCPA Disclosure”) supplements the information contained in any other Privacy Statement or Notice provided by Oak Valley Community Bank, its subsidiary Eastern Sierra Community Bank, and Oak Valley Bancorp ("we" or "our”) and applies solely to residents of the State of California. It describes our practices both online and offline to comply with the California Consumer Privacy Act of 2018 (“CCPA”) regarding the collection, use, disclosure, and sale of personal information and the rights of California residents (“consumers” or “you”) regarding their own personal information.

Under the CCPA, “personal information” is information that identifies, relates to, or could reasonably be linked directly or indirectly with a particular consumer. The specific personal information that we collect, use, and disclose relating to a consumer will vary depending on our relationship or interaction with that individual.

This CCPA Disclosure does not apply to information collected, processed or disclosed pursuant to the Gramm-Leach-Bliley Act and its implementing regulations or the California Financial Information Privacy Act. It also does not apply to information we collect of job applicants, employees, contractors, temporary employees, directors and shareholders, which are subject to our Human Resources CCPA Disclosure - https://www.ovcb.com/california-privacy-hr.html.

1. The Information We Collect
   Below is a list of the categories of personal information we have collected about consumers in the past 12 months. For each category of personal information, we have provided the categories of the sources used to collect, our business or commercial purpose for collecting the information, and the categories of third parties with whom we share personal information.

* Please refer to Section 2 for additional information on “Source” and Section 1 of our Privacy Statement for more details about the information we collect.

2. Sources of Personal Information
   We obtain the categories of personal information listed in the table above from the categories of sources specified therein.

   Examples of sources and when information would be collected are listed below:

   Directly from you. For example, when creating an account, receiving products and/or services.

   From your Device or your use of our Services. For example, from observing your actions on our website, device fingerprinting and similar technologies.

   From third parties. For example, from public databases, social media platforms, other industry-standard data vendors.

3. How We Use and Disclose Your Personal Information
   We may use, or disclose to a third party, the personal information we collect for one or more of the following purposes:
   
   

   Purpose	Categories of Personal Data*
   Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.	A, B, C, D, E, F, G, H, I, K
   Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.	A, B, C, D, F, H, I, K
   Complying with laws and regulations and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes or opinions).	A, B, C, D, F, G, H, I, K
   Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance the service controlled by the business.	A, B, C, D, F, H, I, K
   Auditing related to a current interaction and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.	D, F, K
   Debugging to identify and repair errors that impair existing intended functionality.	D, F, K
   Undertaking internal research for technological development and demonstration.	D, F, K

* Please refer to the categories of data listed in Section 1

3.1	Disclosure of Personal Information for a Business Purpose In the preceding twelve (12) months, we may have disclosed personal information for a business purpose. We share your personal information with the categories of third parties identified in the table in Section 1 and for the following general purposes:
	Service Providers: We also may disclose personal information to third-party service providers that assist us with our operations. For example, data subject access-request or verification management, analytics, contract management, log management, payment processing and data storage and processing facilities. Protecting our Rights: We may disclose personal information to third parties if we believe that doing so is legally required or is in our interest to protect our property or other legal rights (including, but not limited to, enforcement of our agreements), or the rights or property of others. Corporate Transaction: Personal information may be disclosed as part of a corporate transaction, such as a merger, acquisition, debt financing, sale of company assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which personal information could be transferred to third parties as one of our business assets.
3.2	Sales of Personal Information for a Business Purpose In the past 12 months, we have not sold any personal information about consumers for a business or commercial purpose, nor do we intend to do so in the future.

4. Your Rights and Choices
   

   Your Right to Know About Personal Information Collected, Disclosed, or Sold
   You have the right to request that we disclose the personal information we have collected, used, disclosed and sold about you during the past 12 months.

   Only you or your authorized agent may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

   Your Right to Request Deletion of Personal Information
   You have the right to request we delete any personal information about you which we have collected or maintained.

   Once we receive and confirm your verifiable consumer request we will delete your personal information from our records, unless an exception applies.

   Only you or your authorized agent may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

   Your Right to Opt-Out of the Sale of Personal Information
   You have the right to opt-out of the sale of your personal information. As stated above, we do not and will not sell the personal information of consumers to third parties.

   Your Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
   Discrimination may exist where a business takes or suggests that it will take the following actions in response to a consumer exercising their rights under the CCPA:
   

   • Deny access to or use of goods or services.
   • Charge different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
   • Provide a different level or quality of goods or services.

You have a right not to receive discriminatory treatment by us for exercising any of your privacy rights under the CCPA.

5. Exercising Your Rights
   
   To exercise your rights described above, please submit a verifiable consumer request to us by either:
   • Completing an online request at CCPA Request Form – https://www.ovcb.com/ccpa-request.html.
   • Calling us at 866-844-7500, Monday thru Friday from 8:00 AM to 5:00 PM Pacific Time.
   
   
   Verifiable Consumer Request
   You may only make a verifiable consumer request twice within a 12-month period. The verifiable consumer request must:
   • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
   • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information such as name, date of birth, email address, telephone number, postal address, and your business relationship with Oak Valley Community Bank.
   • If you designate an authorized representative to make a request on your behalf, we may require you to verify your identity directly to us and provide a copy of the authorized written permission.

To verify your identity, we will use the personal information provided in the verifiable consumer request. We cannot respond to your request if we cannot verify your identity or your authorized agent’s authority to make the request and confirm the personal information relates to you.  We may require you, or your authorized agent, to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

Authorized Agent
A consumer may designate an authorized agent to make a request under the CCPA on their behalf.

If you wish to have an authorized agent make a verifiable consumer requests on your behalf, they will need to provide us with sufficient written proof that you have designated them as your authorized agent.

An authorized agent is someone who has registered with the California Secretary of State to act on your behalf, or whom you have provided power of attorney pursuant to California Probate Code sections 4000 to 4465.

If your authorized agent makes a request on your behalf, we will still require you to provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information. However, we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you.

Response Timing and Format
We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days from the date of receiving your request), we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding the date of the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

6. More Information
   
   Contact Information
   If you have any questions or concerns about our privacy policies and practices, please call 1-866-844-7500, Monday thru Friday 8:00 AM to 5:00 PM Pacific Time or email us at customerservice@ovcb.com.

Changes to our California Consumer Privacy Act Policy
We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on our website and update the notice’s effective date.

Date last updated: September 20, 2022.