ONLINE PRIVACY POLICY

Online Privacy Policy
Effective as of January 1, 2023

Synchrony Bank and each of its affiliate companies (collectively, “Synchrony,” “we” or “us”) is committed to protecting your privacy. Please read this Privacy Policy (the “Privacy Policy”) carefully before using this website (the “Site”). This site is not directed to or intended for individuals under 18 years of age.

This Privacy Policy describes the types of information we may collect from visitors to the Site, what we do with this information, and how visitors can update and control the use of the information they provide on the Site. This Privacy Policy applies solely to information collected through this Site. The Privacy Policy does not apply to other information we may collect, including data collected on other websites, such as separate sites operated by our affiliates or business partners, or other information visitors may provide to us through other means.

INFORMATION COLLECTED

Through the use of or access to our Site for online inquiry regarding the products and services we offer (“Services”) or otherwise, we may collect personal information about you, which is information that identifies you as an individual, relates to you as an individual, or that, along with other information, could identify you (“Personal Information”). We collect the following types of Personal Information:

Information provided by you

We collect Personal Information from you when you:

• Create an account. When you create an account with us, you will provide Synchrony your contact information.
• Interact with our Site or Services. When you send us any feedback, questions, comments, or suggestions, participate in one of our surveys, or interact with Synchrony in any way, you may provide us with Personal Information, such as your name, telephone number, address, and email address.

Information collected automatically

We may automatically collect the following Personal Information as you use our Site or Services:

• Usage Information. Which pages on our Site you access, the frequency of access, what you click on while on the Site, how long you access the Site, and when you accessed the Site.
• Location Information. Information about your location, which may be determined through your IP address or mobile device.
• Device Information. Information about the device you are using, such as hardware model, operating system, browser, and IP address.
• Mobile Device Information. Mobile network information, such as the unique identifier assigned to the device, mobile carrier, operating system, and other device attributes.

Information obtained from third parties

We may obtain Personal Information about you from third parties, such as credit bureaus and demographic firms, when you use our Site or Services. We may also obtain information about you from Payfone, the vendor that assists us in verifying and authenticating your identity via mobile device.

Cookies and other tracking technologies

Cookies. “Cookies” are small pieces of information that are stored by your web browser software on your computer’s hard drive or temporarily in your computer’s memory. We seek to place and store Internet cookies on your hard drive. Cookies can save any of the types of information noted above. Cookies enable us to personalize your viewing experience and allow us to track statistical information about navigation to and throughout certain areas of the Site and to promotions on other sites. We also utilize third parties that may place and store Internet cookies on your hard drive for web analytics. These third-party cookies collect information about our Site traffic by tracking users across websites and across time and generating reports for us to better understand our Site users and to create audiences for our advertisements based on such understanding. Third-party ad network providers that help us present ads on the Site may also place cookies on your device to service you with ads or other content personalized to your interests.

Adobe Analytics. We use a tool called “Adobe Analytics” for analytics and advertising services. We use the information we get from Adobe Analytics to improve the Services and to improve our ad performance. Adobe’s ability to use and share information collected by Adobe Analytics about your use of the Services or visits to the Site or to another application which partners with Adobe, is restricted by Adobe Analytics Terms of Use and the Adobe Privacy Policy available at: https://www.adobe.com/privacy/marketing-cloud.html.

Google Analytics. We use a tool called “Google Analytics” to collect some information we listed above about your use of the Site and Services. We use the information we get from Google Analytics to improve the Services. In order to collect this information, Google Analytics may set cookies on your browser or mobile device, or read cookies that are already there. Google Analytics may also receive information about you from apps you have downloaded, that partner with Google. We do not combine the information collected through the use of Google Analytics with personally identifiable information. Google’s ability to use and share information collected by Google Analytics about your use of the Services or visits to the Site or to another application which partners with Google is restricted by the Google Analytics Terms of Use and the Google Privacy Policy available at: https://www.google.com/policies/privacy.

Social Media Widgets. Our Site includes social media features, such as Facebook, LinkedIn, and Twitter. These features may collect information about your IP address and which page you are visiting on our Site, and they may set a cookie to ensure the feature functions properly. These features may also provide you with personalized ad content. Social media features and widgets are either hosted by a third party or hosted directly on our Site. Your interactions with those features and platforms are governed by the privacy policies of the companies that provide them.

HOW WE USE COLLECTED INFORMATION

We use the Personal Information we collect to provide the Services to you, to improve our Site and Services, and to protect our legal rights. Specifically, we use the Personal Information we collect to:

• Provide you with the Services.
• Validate cell phone use.
• Communicate with you. To communicate with you about our Site or Services, to send you updates, or to inform you of any changes to the Site or Services.
• Provide customer support. To provide you support or other services you request.
• To communicate about new features. We will send you notifications about new features or information available on our Services or third-party products that we feel might be of interest to you.
• Maintain and improve our Site and Services. We analyze how our users interact with the Site in order to maintain and improve the Site and Services.
• Benchmarking. We aggregate your information in order to gain insights into our Services.
• Prevent fraud and abuse.
• Comply with applicable law.

HOW WE SHARE INFORMATION

We share your Personal Information with our service providers, among our entities, in connection with the provision of the Services, a corporate restructuring, to prevent harm, to comply with the law, and to protect our legal rights. The legal basis for this is our legitimate interest in providing our Services, complying with the law, and protecting our rights and those of others.

• Service Providers. We share Personal Information with service providers that help us perform Site functions and provide you with the Services, such as Adobe and Google Analytics.
• Advertising and Marketing. We may share your Personal Information with third parties so that they may provide you with information about products or services that may be of interest to you. We also share certain Personal Information with LiveRamp, our marketing service provider, to improve our marketing services. Personal Information gathered through the SMS (Short Message Service/Text Message) Program will not be shared with third parties.
• Corporate Restructuring. We may share your Personal Information if we are involved or intend to be involved in a merger, acquisition, consolidation, change of control, or sale of all or a portion of our assets or in connection with bankruptcy or liquidation proceedings.
• To Prevent Harm. We may share your Personal Information if we believe it is necessary in order to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person.
• To Protect Our Rights and As Required by Law. We will share Personal Information where we are legally required to do so, such as in response to court orders or legal process, to exercise our legal rights, to defend against legal claims or demands, or to comply with the requirements of any mandatory applicable law. We will also share Personal Information as necessary to enforce any other terms that you have agreed to, including to protect the rights, property, interest, or safety of Synchrony, its users, or any other person, or the copyright-protected content of the Services.
• With Your Consent. We will request your permission to use or share your Personal Information for a specific purpose that is not compatible with the purposes listed here. We will notify you and request consent before we provide the Personal Information or before the Personal Information you have already provided is shared for such purpose.

SECURITY

At Synchrony, our goal is to protect your Personal Information submitted to us through this Site. We maintain reasonable physical, electronic, and procedural safeguards designed to protect and limit access to your Personal Information. However, no method of transmission over the Internet or electronic storage technology is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

You are responsible for maintaining the confidentiality of your account username and password. We recommend that you choose a unique password for your account and that you do not use any password that you also use for any other accounts which may contain your sensitive information, such as financial accounts or email accounts. You agree to immediately notify Synchrony of any unauthorized use of your password or account or any other breach of security. We will not be responsible or liable for any loss or damage arising from your failure to comply with this provision.

If you access our Site from a public or shared computer, it may be possible for other users to review your online history. For this reason, you should always close your browser window after you finish any online banking session, including visiting our Site. If you access our Site from a shared computer, you should never set the Internet options to remember or store user IDs or passwords. Also, you should never go to websites or follow web links that are unfamiliar or seem suspicious to you.

CHOICES ABOUT YOUR INFORMATION

• Access, Correct, or View Your Personal Information. You may use your account to view, access, or correct certain Personal Information you provided to us and which is associated with your account.
• Do Not Track. We take no action in response to “Do Not Track” requests received from user’s web browsing software.
• Cookies. If you would like to opt out of accepting cookies altogether, you can generally set your browser to not accept cookies or to notify you when you are sent a cookie, giving you the chance to decide whether or not to accept it. However, certain features of our Site or other services may not work if you delete or disable cookies.
• Google Analytics. To prevent your data from being used by Google Analytics, you can download the Google Analytics opt-out browser add-on for Google Analytics which can be found here: https://tools.google.com/dlpage/gaoptout.
• Adobe Analytics. To prevent your data from being used by Adobe Analytics, you can download the Adobe Analytics opt-out browser add-on for Adobe Analytics, which can be found here: https://www.adobe.com/privacy/opt-out.html#customeruse.
• Third-Party Advertising and Marketing. If you do not wish for us to share your information with third parties for advertising or marketing purposes, you may choose to opt-out at any time by directing such request to 1-844-894-3960.
• Online Advertising. To opt out of interest-based advertising or to learn more about the use of this information by our service providers you can visit the Network Advertising Initiative website (http://www.networkadvertising.org/managing/opt_out.asp) or the Digital Advertising Alliance website (http://www.aboutads.info/choices/), or if you are in the EU, the EDAA (https://www.youronlinechoices.eu/). If you choose to opt out, we will place an "opt-out cookie" on your computer. The "opt-out cookie" is browser specific and device specific and only lasts until cookies are cleared from your browser or device. The opt-out cookie will not work for some cookies that are important to how our websites and mobile apps work. If the cookie is removed or deleted, if you upgrade your browser or if you visit us from a different computer, you will need to return to the applicable website to re-select your preferences.

THIRD-PARTY LINKS

If you access our Site from a public or shared computer, it may be possible for other users to review your online history. For this reason, you should always close your browser window after you finish any online banking session, including visiting our Site. If you access our Site from a shared computer, you should never set the Internet options to remember or store user IDs or passwords. Also, you should never go to websites or follow web links that are unfamiliar or seem suspicious to you.

CALIFORNIA PRIVACY RIGHTS

If you are a California user of our Services (“California Consumer”), you have certain rights with respect to the collection, use, transfer, and processing of your Personal Information, as defined by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We reserve the right to limit these rights where permitted under applicable law, including where your identity cannot be reasonably verified or to the extent your rights adversely affect the rights and freedoms of others. To exercise any of the rights below, please contact us via the contact information below. Only you or your authorized agent may make a verifiable consumer request related to your Personal Information. Unless otherwise defined in this Privacy Policy, the terms used in this section shall have the meanings ascribed to them in the CCPA or CPRA.

Collection of Personal Information

When California Consumers access our Site, we collect the following Personal Information:

Personal Identifiers

• Name
• Address
• Email address
• Telephone number

Internet or Other Electronic Network Activity Information

• The Internet Protocol address that relates to the machine or device used to access our Site
• The type of browser and operating system used
• The date and time when the Site is visited
• Device ID if you are on a mobile device
• Web pages displayed

The foregoing pieces of information have been collected about our consumers in the past 12 months.

Sources from which Personal Information Is Collected

We collect your identifiers from you directly. We collect your Internet or other electronic network activity information from your interactions with our Site.

Business or Commercial Purposes for which Personal Information Is Collected

Your Personal Information is used for the following purposes:

• Provide you with the Services.
• Validate cell phone use.
• Communicate with you. To communicate with you about our Site or Services, to send you updates, or to inform you of any changes to the Site or Services.
• Provide customer support. To provide you support or other services you request.
• To communicate about new features. We will send you notifications about new features or information available on our Services or third-party products that we feel might be of interest to you.
• Maintain and improve our Site and Services. We analyze how our users interact with the Site in order to maintain and improve the Site and Services.
• Benchmarking. We aggregate your information in order to gain insights into our Services.
• Prevent fraud and other illegal activities.
• Comply with applicable law.
• Defend our legal rights.

Third Parties with Whom Personal Information Is Shared or Sold

Synchrony shares your Personal Information with analytics and service providers, advertisers, business partners and law enforcement (if necessary).

In the preceding 12 months, we have not sold Personal Information about consumers for monetary consideration. Our use of cookies and other tracking technologies may be considered a sale of personal information under the CCPA. Categories of personal information that we have sold under the CCPA include identifiers and Internet or other similar network activity. Categories of third parties to whom personal information is sold under the CCPA include data analytics providers and advertising and marketing providers.

In the preceding 12 months, we have not knowingly sold or shared Personal Information of California Consumers under 16 years of age.

In the preceding 12 months, we have disclosed the following Personal Information about consumers for business purposes:

• Identifiers, Other Personal Information (Financial Information), Employment Information, and Commercial Information. We share this information with our service providers to allow them to perform services on behalf of Synchrony. We may also share this information with our business partners so that they may provide you with information about products or services that may be of interest to you.
• Internet or Other Electronic Network Activity Information. We share with or allow third parties to utilize cookies for marketing or advertising customized to your apparent interests or needs (more information located in the “Information Collected Automatically” section above).

Individual Rights

Right for You to Access Personal Information Collected, Disclosed, or Sold

You have the right to request that Synchrony disclose the Personal Information it collects, uses, and discloses about you to third parties:

If you make a Right to Access request, you will receive the following information about you:

1. Categories of personal information collected;
2. Categories of sources from which personal information are collected;
3. Specific pieces of personal information collected about you;
4. Business or commercial purpose for collecting, selling, or sharing; and
5. Categories of third parties to whom personal information was disclosed.

This information will be provided to you free of charge, unless Synchrony determines that your request is manifestly unfounded or excessive. You may request this information twice in a 12-month period. This Right to Access is subject to certain restrictions and is not available to consumers who have requested information about, applied for, or maintain business credit through Synchrony. Synchrony employees and employees of Synchrony business partners and service providers may also make a Right to Access request under the CPRA for Personal Information collected on or after January 1, 2022, subject to certain limitations.

Right to Opt Out of Targeted Advertising and the Sale or Sharing of Personal Information

Synchrony does not sell any Personal Information of California Consumers for monetary consideration. However, we use certain third-party advertising and analytical cookies that may be considered “sales” or “sharing” of data under California law.

California Consumers have the right to opt out of the sale or sharing of personal information. It also allows you the right to opt out from our processing of your personal data for targeted advertising or analytic purposes. If you wish to opt out of advertising or analytic cookies, you can do so via our Cookie Management Options banner. Within the Cookie Setting you can choose your cookie preferences.

Synchrony web properties respond to the Global Privacy Control (“GPC”), which allows you to opt out of the sale or sharing of your personal information if enabled. If you have the GPC enabled, we will not sell or share your personal information. To learn more about the GPC, please visit https://globalprivacycontrol.org/.

Please note that opt-out choices may be stored via cookies. If you clear cookies, if your browser blocks cookies, or if you visit the site from a different browser or device, your opt-out choices may not be recognized or honored.

Right of Erasure

You have the right to request that Synchrony and our service providers erase any Personal Information about yourself which Synchrony has collected from you upon receipt of a verifiable request. This right is subject to certain restrictions and is not available to consumers who have requested information about, applied for, or maintain business credit through Synchrony.

Right of Correction

You have the right to request that Synchrony and our service providers correct any Personal Information about yourself which Synchrony has collected from you upon receipt of a verifiable request. This right is subject to certain restrictions and is not available to consumers who have requested information about, applied for, or maintain business credit through Synchrony.

Submitting Requests

You can submit your request by calling us at 1-844-894-3960 or visiting our request website at https://www.synchronycredit.com/cpra/.

Verifying Requests

Synchrony provides California Consumers with an online webform to submit requests. The webform is accessible at https://www.synchronycredit.com/cpra/. As stated in the webform, Synchrony must verify that the person requesting information or deletion is the California Consumer about whom the request relates in order to process the request. To verify a California Consumer’s identity, we may request up to three pieces of Personal Information about you when you make a request to compare against our records. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity. We may also require your authorized agent to provide proof of authorization, such as requiring you to verify your own identity directly with us or directly confirm with us that you provided the authorized agent permission to submit the request on your behalf. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in your request to verify your identity. Synchrony reserves the right to take additional steps as necessary to verify the identity of California Consumers where we have reason to believe a request is fraudulent.

Right of No Retaliation

Synchrony will not discriminate against you because you exercised any of your rights, including, but not limited to, by:

• Denying goods or services to you.
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
• Providing a different level or quality of goods or services to you.
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
• Retaliating against an employee, applicant for employment, or independent contractor.

Annual Metrics

The following information is provided in accordance with the requirements of the CCPA:
Click here to access the Annual Metrics: https://www.syf.com/ccpametrics

INTERNATIONAL USERS

This is a United States-based website that is subject to United States law. This Site is controlled, operated and administered by Synchrony from its offices within the United States. This Privacy Policy is provided in accordance with and subject to applicable U.S. law. If you are accessing this Site using a computer that is located outside the United States, you are responsible to ensure that your Internet connection is secure and is not monitored, legally or otherwise, by any third party or jurisdiction. If you are unsure of the security of your international Internet access, you should refrain from accessing this Site until you have confirmed that your access is secure and not monitored. If you decide to continue to access this Site from your location outside the United States, you hereby agree that your use of this Site is subject to this Privacy Policy and U.S. law and that you are responsible for complying with applicable laws in all jurisdictions that govern your use and access of this Site.

EUROPEAN USERS INCLUDING THE UNITED KINGDOM

This section of our Policy provides certain required information to persons located in the United Kingdom (“UK”), European Union (“EU”), a European Economic Area (“EEA”) member state, or Switzerland. Before Synchrony collects any Personal Information from you, you are entitled under the EU General Data Protection Regulation (“GDPR”) to the information in this section of our Policy.

Purposes and Legal Basis for Processing Personal Information

Synchrony will only process your Personal Information for lawful purposes under the GDPR related to Synchrony's business purposes arising from your relationship with Synchrony. Synchrony will ordinarily collect and process your Personal Information because it is necessary for the performance of a contract to which you are a party or because Synchrony has another legitimate interest in doing so. When Synchrony cannot rely on either of such legal grounds, it will seek your prior consent.

Rights of Residents of the European Union (EU) or UK

If you use the Site and reside in the UK, EU, EEA, or Switzerland, you are entitled by law to access, correct, amend, or delete Personal Information about you that we hold. A list of these rights is below. Please note that these rights are not absolute and certain exemptions apply.

• The right to access. You have the right to ask us for copies of your Personal Information. This right has some exemptions, which means you may not always receive all the Personal Information we collect and process. When making a request, please provide an accurate description of the Personal Information you want access to.
• The right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• The right to erasure. You have the right to ask us to erase your Personal Information in certain circumstances, including: (i) when your Personal Information is no longer necessary for the purposes for which it was collected or processed, or (ii) your Personal Information must be erased to comply with a legal obligation in EU Union or Member State law.
• The right to restrict processing. You have the right to ask us to restrict the processing of your Personal Information in certain circumstances, including: (i) when the accuracy of the Personal Information is brought into question, or (ii) when we no longer need the Personal Information for purposes of the processing, but you require such Personal Information for the establishment, exercise, or defense of a legal claim.
• The right to object to processing. You have the right to object to processing of your Personal Information.
• The right to data portability. You have the right to ask that we transfer the Personal Information you gave us from one organization to another, or give it to you.
• The right to lodge a complaint with the supervisory authority. If you believe your rights under the GDPR have been violated, the GDPR gives you the right to file a complaint with the supervisory authority. A list of Supervisory Authorities is available here: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

To exercise these rights please email us at privacyoffice@syf.com. For your protection, we may need to verify your identity before responding to your request. In the event that we refuse a request under rights of access, we will provide you a reason as to why.

Right to Withdraw Consent

If Synchrony obtains your written consent to collect and process your Personal Information, you can subsequently withdraw such consent as to any further processing of information by emailing us at privacyoffice@syf.com.

Cross-Border Transfers of Personal Information

Personal Information that you provide while in the UK, EU, an EEA member state, or Switzerland will be transferred to the United States. Applicable European privacy law, such as the UK DPA and the GDPR permits such transfer when necessary for the performance of a contract between you and Synchrony, if Synchrony obtains your explicit consent to such transfer, or if it is in Synchrony’s legitimate interest to transfer the Personal Information. The laws in the United States may not be as protective of your privacy as those in your location. However, when transferring Personal Information to and processing Personal Information in the United States, Synchrony will implement appropriate safeguards and process the Personal Information in accordance with the terms of this Privacy Policy. By using our Site, you agree to the transfer and processing of your Personal Information to the United States.

Retention of Your Personal Information

We will retain your Personal Information until the Personal Information is no longer necessary to accomplish the purpose for which it was provided. We may retain your Personal Information for longer periods for specific purposes to the extent that we are obliged to do so in accordance with applicable laws and regulations, to protect you, other people, and us from fraud, abuse, and unauthorized access, as necessary to protect our legal rights, or for certain business requirements.

CHANGES TO THIS ONLINE PRIVACY POLICY

We reserve the right to modify or supplement this Privacy Policy at any time and without prior notice. If we make any material change to the Privacy Policy, we will update our Site to include such changes. We recommend that you review this Privacy Policy regularly for changes.

CONTACT

If you have any questions or concerns about this Privacy Policy, you can contact us at privacyoffice@syf.com.

[WF6710376B]
(6/18) GENERAL ONLINE PRIVACY POLICY (REV 3/2023)
HTML