Privacy Policy

Your Information and New Direction Trust Company

This Online Privacy Policy (“Online Policy”) applies to consumers, (“consumer(s)”, “you”, “your”, “their”, or “them”). It explains how New Direction Trust Company, New Direction IRA, Inc. and our Affiliate(s) (“we,” “our,” or “us”) collect, disclose, share, use, and protect information when you visit or use our ndtco.com, similar websites offered by New Direction Trust Company that link to or reference this Online Policy (collectively, our “Sites”), or use our New Direction Trust Company Application (“Mobile App” or “App”). This Online Policy specifically applies to our collection, use, and disclosure of information collected from visitors during use of the Sites, such as for employment purposes, transactional purposes, or through tracking technology, including cookies or other tracking technologies. This Online Policy should be read together with the Privacy Notice required by the Gramm-Leach-Bliley Act (GLBA), which, among other things, describes how New Direction Trust Company may disclose information gathered from you and how you can opt out or limit certain types of information sharing.

Information We Collect (“Information”)

Your Information

When you visit or use our Sites, we may collect information provided by you through the Sites, including, but not limited to, your name, email address, mailing address, telephone number(s), username and password, and account numbers. We may also collect tax identification numbers, driver’s license numbers (or comparable), and credit qualification information where we believe it is reasonably required for ordinary business purposes. We may also collect information for employment purposes, such as work history and prior employer, information from background checks, resumés, personnel files, and education, as applicable.

Site Visit and Usage Information

We or our third-party partners may use cookies, web beacons, or other technologies to collect and store information about your visit to or use of our Sites. In addition, we may later associate the usage and other information we collect online with personal information about you. We collect the following information we call “Site Visit Information” when you visit our Sites or use our Apps:

• • network or device-related information like your operating system, browser, or IP address
  • your physical location, but only with your permission (i.e. for branch location finder services)
  • limited location information for other purposes
  • information about which sections or pages you visit and certain interactions you make on our Sites
  • information about the webpage you visited just before our Sites
  • information about the webpage you visit through a link from our Sites

If you submit any information to us relating to other people or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Online Policy.

Mobile Applications (“Mobile Apps” or “Apps”)

If you download and use our Mobile App, in addition to the information discussed above, we will also automatically collect and keep certain information about your mobile device, such as your device’s unique identification number, its operating system, certain device settings and preferences, information about how you interact with your device while using our Apps, and information about how you are interacting with our Apps. If you use our mobile deposit services and take photographs of checks using our App, we will collect an image of your check solely to process your deposit.

Additional Sources of Information

We may also collect information about you from additional online and offline sources, including commercially available third-party sources, such as credit reporting agencies. We may combine this information with the personal and other information we have collected about you under this Online Policy.

Use of Information

We use the information discussed above in the following ways:

• Processing transactions
• Processing employment applications
• Supporting employment, human resource management, and related reasons to provide benefits, managing compensation activities, process employment applications, and to fulfill similar purposes, internally or in partnership with professional services providers and business partners
• Authenticating users (such as when you access your account information)
• Preventing fraud and enhancing the security of your account or our Sites
• Responding to your requests and communicating with you
• Managing your preferences
• Performing analytics concerning your use of our Sites, including your responses to our emails and the pages and advertisements you view
• Providing tailored content and marketing messages
• Operating, evaluating, and improving our business (including developing new products and services
• Improving existing products and services
• Performing data analytics
• Performing accounting, auditing, and other internal functions
• Complying with and enforcing applicable legal requirements, relevant industry standards, contractual obligations, and our policies
• For any other purposes that we may specifically disclose at the time you provide, or we collect, your information

We may disclose the information we collect from and about you with our affiliates and other third parties as described below. We may disclose your information to:

Disclosure of Information

We may disclose the information we collect from and about you with our affiliates and other third parties as described below. We may disclose your information to:

• Our affiliates
• Third-party service providers
• Third-party “Analytic Providers” for analytics and advertising purposes to provide more relevant advertisements to customers or potential customers. For more information about this, please read the section of this Online Policy on “Online Behavioral Advertising.”
• Other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security, or technical issues; to respond to an emergency; or otherwise, to protect the rights, property, or security of our customers or third parties.

As described in the Privacy Policy – New Direction Trust Company  and the “Opting Out of Online Behavioral Advertising” section, we will limit the sharing of your information in accordance with the choices you have provided us.

Cross-Context or Online Behavioral Advertising (OBA)

We may disclose anonymous or aggregated information with third parties to help deliver products, services, and content better tailored to our Sites’ users and for other purposes.

To deliver relevant digital advertising to you, we utilize cookies and pixels (also called beacons) or similar technologies to evaluate our Sites and track digital advertising performance.

Cross-Context or Online Behavioral Advertising “OBA”

OBA allows advertisers to display relevant ads and personalized marketing messages to users based on their web browsing behavior. We use Site Visit Information to deliver advertising content that is more likely to be of interest to you. For more information regarding OBA, please visit YourAdChoices.com | Welcome to YourAdChoices.com.

Analytics Providers

We engage third-party service providers to conduct OBA activities on our behalf. We call these third parties “Analytics Providers” and we use them to determine which of our ads are more likely to appeal to you and deliver them. We share Site Visit Information with our Analytics Providers through cookies, beacons, or similar technologies to get better insights into the use of our Sites and to engage in Online Behavioral Advertising.

Cookies

A “cookie” is an electronic file our Sites place on your computer or device(s) to store information that makes your visit to our Sites more efficient. Cookies let our Sites recognize if your computer or mobile device has visited our Sites before and what security requirements and browser preferences your computer or mobile device requires. We use cookies for fraud prevention, security, to improve the functionality and performance of our Sites, and to monitor advertising and marketing campaign performance. Additional information about cookies and how they work is available at All About Cookies | Online Privacy and Digital Security.

You can block cookies by either changing the settings on your internet browser or through the use of software programs specifically designed to block cookies. Please note, however, that if you choose to block cookies, you will not be able to log into our secure Online Banking service, and you may limit other functionality we can provide when you visit our Sites. To block targeting cookies used in Online Behavioral (OBA) without losing other functionality, you can opt out of targeting cookies as described in the Opting Out of Online Behavioral Advertising (OBA) section.

Beacons/Pixels

A “beacon” or “pixel tag” is a type of tracking technology associated with cookies. Unlike cookies, beacons or pixel tags are typically one-pixel, transparent images embedded on websites, not downloaded on your computer or device. We may also use technologies, such as cookies or pixel tags to provide you with personalized online display advertising tailored to your interests. Please refer to the Cross-context or Online Behavioral Advertising (OBA) section for more information, including how to opt out of personalized advertising.

Opting Out of Online Behavioral Advertising (OBA)

You can also opt out by clicking on the “Cookie Settings” link in the cookie banner presented when you first visit our Sites, or anytime by clicking on the “Cookie Settings” link in our Site footer. Keep in mind that this opt-out works using cookies, so if you delete cookies, you will need to opt out again. Also, if you use different browsers or devices, you will need to opt out for each one individually.

Please note: Even if you opt out, you may still see advertisements from New Direction Trust Company while browsing online. These advertisements may be less relevant to you and your interests because they won’t be based on information collected about you.

Global Privacy Control (GPC)

Our Sites process global browser opt-out preferences for consumers in California only. If we detect a global opt-out preference signal from a California IP Address, you will receive a notification, and your opt-out preference signal will be honored.

Site and App Security

Protecting your information is a priority for New Direction Trust Company. To protect your information from unauthorized access and use, we use reasonable administrative, technical, and physical controls to protect your information. While we take these important steps to protect you and your information.

Other Websites

For your convenience, our Sites may contain links to other websites or may refer you to other websites. Those other sites may be operated by other companies affiliated with us or by third-party companies not affiliated with us. Once you leave our Sites and access another website, you should be aware that you are subject to the privacy and security policies of that website.

Children’s Online Privacy

Our Sites and our Apps are not intended for children under the age of 13. Please do not access or use our Sites or our Apps if you are under 13 years of age. By using our Sites or using our Apps, you affirm that you are 13 years of age, or older. For more information about the Children’s Online Privacy Protection Act (COPPA), visit the FTC website: Federal Trade Commission | Protecting America’s Consumers.

Accuracy

This Online Policy is accurate to the best of our knowledge. New Direction Trust Company performs monitoring of our Sites to ensure this Online Policy accurately reflects our practices.

Changes to this Online Privacy Policy

We may add to, delete from, or otherwise amend and update this Online Policy from time to time without prior notice. The date of the last update to this document is provided at the beginning of this Online Policy. Use of our Sites after an update indicates acceptance of the most current version.

Questions

You may contact us with questions or concerns about this Online Policy and our practices by:

1. Call us toll-free at 877-742-1270

2. Email: info@ndtco.com

CALIFORNIA CONSUMER PRIVACY ACT PRIVACY POLICY AND NOTICE AT COLLECTION:

Applicability

This California Consumer Privacy Act (“CCPA”) Privacy Policy and Notice at Collection (“Notice”) applies only to California residents (“consumer(s),” “you,” “your,” “their,” or “them”). It explains the online and offline information practices of New Direction Trust Company and Affiliate(s) (“we,” “our,” or “us”), along with outlining consumers’ rights regarding their Personal Information and the instructions necessary for them to exercise those rights. For the purposes of this Notice, our ndtco.com, NDTCO Portal® and similar websites will be referred to as “our websites.” Additionally, the information within provides timely notice about the categories of Personal Information to be collected from you during online and offline interactions with us, the purposes for which the Personal Information is collected or used, and whether that Personal Information is sold or shared. This, therefore, serves as our Notice at Collection. Please note that the CCPA, and this Notice, do not apply to information covered by the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or certain other laws.

Categories of Personal Information

We collect Personal Information in a variety of contexts. The specific Personal Information that we collect relating to consumers will vary based on our relationship or interaction with them. In the past 12 months, we have collected, and do collect, for our disclosed purposes, each of the following categories of Personal Information.

Personal Information:

• Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, Social Security Number, driver’s license number, passport number, or other similar identifiers
• Characteristics of protected classifications under California or federal law, such as sex and marital status
• Commercial Information, such as records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Biometric information, such as fingerprint and voiceprint
• Internet or Online Activity Information, such as browsing history, search history, and information regarding consumers’ interaction with FirstBank’s websites, applications or advertisements
• Geolocation Data, such as device location and Internet Protocol (IP) location
• Audio, Electronic, Visual, or Thermal (or similar) Information, such as call and video recordings
• Professional or Employment-related Information, such as work history and prior employer, information from background checks, resumés, and personnel files
• Education information, such as details of your education and qualifications
• Inferences drawn from any of the Personal Information listed above to create consumers’ profiles reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
• Sensitive Personal Information:
  • Social Security, driver’s license, state identification card, or passport number
  • Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, or credentials allowing access to an account
  • Precise geolocation
  • Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs
  • Biometric information processed for identification

Categories of Sources of Personal Information

The categories of sources pertaining to the Categories of Personal Information described in this Notice include the following:

• You or Your Representative(s) through physical (for example, paper application), audible (for example, by phone), and electronic/online (for example, our websites and online application/intake systems) sources.
• Service Providers, Consumer Data Resellers, Credit Reporting Agencies and other similar persons or entities who provide it to us, including your current or prior employer(s), and/or current or prior education provider(s).
• Public Records or Widely Available Sources like information from the media and other records and information that are made available by federal, state, and local government entities.
• New Direction Trust Company and affiliates.
• Website/Mobile App Activity/Social Media Activity, as use of any features or resources available on or through an app or website may automatically trigger disclosure, from your device and browser, certain information may constitute Personal Information.

Business Purposes for the Collection, Disclosure, and Use of Personal Information

We collect, use, and disclose for our business and commercial purposes Personal Information to operate, manage, and maintain our business and to provide our products and services, including the following:

• Communicating with you through any means, including email, phone, text message, social media, post or in-person
• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services (except for cross-context behavioral advertising, a type of targeted advertising), providing analytic services, facilitating event management and execution, managing our real estate portfolio, or for similar reasons
• Helping to ensure security and integrity to the extent the use of Personal Information is reasonably necessary and proportionate for these purposes
• Short-term, transient use, including but not limited to, non-personalized advertising shown as part of a current interaction with us, where the information is not used to build a profile or otherwise alter consumers’ experience outside the current interaction with us
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with specifications and other standards
• Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance that service
• Debugging to identify and repair errors that impair existing intended functionality
• Undertaking internal research for technological development and demonstration
• Complying with laws and regulations and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes, or opinions)
• Supporting employment, human resource management, and related reasons to provide benefits, manage compensation activities, process employment applications, and to fulfil similar purposes, internally or in partnership with professional services providers and business partners

Sale or Sharing of Personal Information

For purposes of this Notice:

• “Sale,” “Sold,” or “Sell(s)” means the disclosure of Personal Information to a third-party for monetary or other valuable consideration.
• “Share” or “Shared” means the disclosure of Personal Information to a third-party for cross-context behavioral advertising.

In August 2022, the California Attorney General’s office interpreted the term “Sale” under the CCPA as follows: “SALE USING ONLINE TRACKING TECHNOLOGY means SALE where the business discloses or makes available consumers’ personal information to third-parties through the use of online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies, in exchange for monetary or other valuable consideration, including, but not limited to: (1) personal information or other information such as analytics; or (2) free or discounted services.” Under this interpretation, New Direction Trust Company has determined that our third parties used it for advertising and analytics purposes, in which these third parties obtaining analytics data from the users of our websites would constitute a “Sale.” Sale activities deliver advertising and marketing using Personal Information we collected or that you provided to assist in determination of trust ads or offers that might appeal to you, to display them to you, and to monitor your responses.

If you opt-in on our websites, New Direction Trust Company may sell/share your Personal Information gathered from use of our websites to third-party advertising and marketing vendors for cross-context behavioral advertising (also referred to as Online Behavior Advertising or OBA) through use of technologies such as Targeting Cookies. We do not otherwise sell your Personal Information.

The categories of Personal Information that we have sold/shared in the 12 months preceding the date of this Notice for cross-context behavioral advertising through use of technologies such as Targeting Cookies on our websites include the following:

• Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, or other similar identifiers
• Internet or Online Activity Information, such as browsing history, search history, and information regarding consumers’ interaction with an Internet website application or advertisement
• Geolocation Data, such as device location and Internet Protocol (IP) location
• Inferences drawn from any of the Personal Information listed above to create consumers’ profiles reflecting their preferences, characteristics, psychological trends, predispositions, behavior, and attitudes, intelligence, abilities, and aptitudes

Consumers Under 16 Years

We do not have knowledge of selling the personal information of consumers under 16 years of age.

Categories of Third Parties to Whom Personal Information Was Disclosed

With respect to the Categories of Personal Information described in this Notice, the categories of persons or entities to whom we disclosed that Personal Information include the following:

• Service Providers and Contractors who provide services such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure, customer service, email delivery, auditing, marketing, marketing research activities, credit financing, event management, employee support and administration, and real estate management
• Other Service Providers and Contractors who enable customers to conduct transactions online and via mobile devices, support mortgage and fulfillment services, vehicle loan processes and aggregators (at the direction of consumers)
• Other persons or entities to whom we transfer Personal Information as an asset that is part of a merger, acquisition, or other transaction in which such other person or entity assumes control of all or part of the business
• Government Agencies as required by laws and regulations
• Other persons or entities with which you may use or direct us to intentionally interact or to which you may use or direct us to intentionally disclose your Personal Information

Statement Regarding Other Purpose(s)

We do not use or disclose Sensitive Personal Information for purposes other than to perform services or provide goods reasonably expected; prevent, detect, and investigate security incidents; resist or respond to malicious, deceptive, fraudulent, or illegal actions directed at us; ensure physical safety of individuals; use short-term, such as for non-personalized advertising; perform services on our behalf; verify, maintain, improve, upgrade, or enhance the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us; or collect or process Sensitive Personal Information where the collection or processing is not for the purpose of inferring characteristics about consumers. Given our limited use and disclosure of Sensitive Personal Information, we do not offer the right to limit its use or disclosure.

How Long We Retain Personal Information

The length of time that we intend to retain each category of Personal Information will depend on a number of criteria, including the length of time we are required to retain Personal Information in order to comply with applicable legal and regulatory requirements; the length of time we may need to retain Personal Information in order to accomplish the business purposes for which such Personal Information is collected, used, or disclosed (as indicated in this Notice); and whether you choose to exercise your right, subject to certain exceptions, to request deletion of your Personal Information.

Explanation Of Rights Regarding Personal Information

You may have one or more of the following rights. Please see the sections following the descriptions of your rights to learn how to exercise the rights described.

1. KNOW – Right to request information, from the 12-month period preceding receipt of your request, about:
   • the categories of your Personal Information that we collected
   • the categories of sources from which your Personal Information was collected
   • the purpose for collecting, selling, or sharing your Personal Information
   • the categories of third parties to whom we disclosed your Personal Information
   • the specific pieces of Personal Information we collected about you
2. DELETE – Right to request deletion of Personal Information that we collected from you
3. CORRECT – Right to request we correct inaccurate Personal Information that we maintain about you
4. OPT-OUT of the Sale/Sharing of Personal Information, which directs us to stop selling or sharing your Personal Information
5. BE FREE FROM UNLAWFUL DISCRIMINATION for exercising your rights under the CCPA requests

How To Exercise Your Rights to Know, Delete, or Correct Personal Information & What to Expect

You may submit a request to know, delete, or correct your Personal Information by doing any one of the following:

1. Call us toll-free: 877-742-1270
2. Email: info@ndtco.com

When you submit a request as described, we will acknowledge receipt of your request and advise you how long we expect it will take to respond if we are able to verify your identity. Requests for specific pieces of Personal Information will require additional information to verify your identity.

In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or if we cannot verify that you have the authority to make a request on behalf of another individual. Third Parties are unable to accept a request from us on your behalf. Additionally, we will not honor your request where an exception applies, such as where the disclosure of Personal Information would adversely affect the rights and freedoms of another California resident or where the Personal Information that we maintain about you is not subject to the CCPA’s access or deletion rights.

We will advise you in our response if we are not able to honor your request. We will not provide Social Security, driver’s license, or government-issued identification numbers, financial account numbers, unique biometric data, health care or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

We will work to process all verified requests within 45 days pursuant to the CCPA. If we need an extension for up to an additional 45 days in order to process your request, we will provide you with an explanation for the delay.

How To Exercise Your Right to Opt-Out of the Sale/Sharing of Personal Information & What to Expect

We do our best to automatically opt-out consumers visiting our websites, however, you may exercise your right to opt-out of your Personal Information being sold or shared for cross-context behavioral advertising through use of technologies, such as Targeting Cookies, on our websites by doing any one of the following:

1. Managing your cookies preferences when the banner is presented to you when visiting our websites. You may also access the option to manage your cookies preferences by clicking the “Cookie Settings” link displayed in our website’s footer. Clicking on the “Do Not Sell or Share My Personal Information” link displayed in our website’s footer will lead you to this Notice.
2. Setting Global Privacy Control on your browser accordingly, as we honor opt-out requests submitted via this method.

You may use Option 1 within this section at any time to update or manage your cookies preferences to opt-in or opt-out. Unless you authorize us to do so by opting-in, we will not sell or share your Personal Information collected through use of the websites listed.

Authorized Agents

You may authorize an agent (“Authorized Agent”) to make a request on your behalf. Authorized Agents may make requests on consumers’ behalf by using the methods described in the How to Exercise Your Right(s) sections within this Notice. For Authorized Agents who are individuals, we may require proof of authorization and verification of identity directly from the person for whom the request is made. For Authorized Agents that are companies or organizations, we may require proof of authorization from the individual, such as a Power of Attorney and verification of identity directly from the person for whom the request is made.

Questions or Concerns

You may contact us with questions or concerns about this Notice and our practices by doing any one of the following:

1. Call us toll-free: 877-742-1270
2. Email: info@ndtco.com

Changes to This Privacy Policy Notice

We may change or update this Notice from time to time. When we do, we will post the revised Notice on this page with a new “Last Updated” date. The Notice was last updated 2/11/25.