Last Updated: January 1, 2023
Effective Date: January 1, 2023
This General Privacy Policy (“Privacy Policy”) describes how Pathward Financial, Inc., Pathward®, National Association, and its divisions, including, without limitation, EPS Financial, and Refund Advantage (collectively “Pathward,” “we,” “us,” “our”) collect, use and disclose information about visitors and users (collectively, “users”) of our websites (the “Site”), features, products, and services (collectively, “Services”).
This Privacy Policy applies to Personal Information (defined below) that we collect via online or offline means, where applicable. For the purposes of this Privacy Policy, Pathward is the controller (i.e., responsible party) for the Personal Information addressed in this Privacy Policy. If you have any questions or concerns about our use of your Personal Information, please contact us using the information provided in the “Contact Us” section of this Privacy Policy.
This Notice of Collection is provided to all California consumers subject to this Privacy Policy. You can access specific topics in this Privacy Policy by clicking on the relevant links below:
Collection and Use of Your Personal Information
Sources of Your Personal Information
Disclosure of Your Personal Information
Cookies and Similar Technologies
Security of Your Personal Information
Retention of Your Personal Information
Changes to this Privacy Policy
Pathward recognizes and respects the privacy of our customers who receive Services and Site visitors. “Personal Information” generally refers to any information that can be linked to an identified or identifiable person. The Personal Information that we collect about you varies depending on the context of our interactions with you, though it typically pertains only to business-related contexts. The following describes the types of Personal Information that we collect from you for our purposes and how we use that information. We also provide information regarding the legal basis of processing such Personal Information, as required by certain privacy laws.
| Context | Types of Data | Primary Purpose for Collection and Use of Data |
|---|---|---|
| Enrollment/Application | When you enroll or apply for an account, we collect your username and password, your name and the following business-related information: email address, and telephone (and/or fax) number. We may also collect information relating to the actions that you perform while logged into your account. If you choose to provide it, we may also collect information such as product and service preferences. | We have a legitimate interest in providing account related functionalities to our users and performing our contract with you and your organization. We also use this information to authenticate and protect your account. |
| Prepaid Card Registration | When you register a prepaid card, we may collect your name and mailing address. | We have a legitimate interest in assisting you in registering prepaid cards and we may use this data to comply with existing legal obligations. |
| Demographic and Contact Information | We may collect Personal Information, such as your name, date of birth, address, Social Security Number, email address, and telephone number. In some instances, we may collect certain background or screening information to the extent needed and in accordance with applicable law. | We use this information to better understand our users and provide tailored Services. We have a legitimate interest in using this information to comply with applicable laws. |
| Financial Account Information | We may collect financial information, including your bank account details (including accounts held with other institutions), and debit or prepaid card information. Consumer credit applications may also include collection of data about your creditworthiness. | We have a legitimate interest in managing your accounts with us and to better understand our users and provide tailored Services. |
| Commercial Customer Relationship Management | We collect certain contact and related business information about you (name, email address, professional contact information) when you or your organization obtains products or services from or does business or partners with us. We also use such information to administer and maintain our relationship with your organization. | We use this information to better understand our users and provide tailored Services. We have a legitimate interest in using this information to comply with applicable laws. |
| Site Analytics/Cookies | We use cookies and other methods to track Site activity. For more information relating to the use of such tools, review the “Cookies and Similar Technologies” section below. | We have a legitimate interest in making our Site and Services operate efficiently, providing accountrelated functionalities, improving our platform, Services and product offerings, and maintaining security standards. |
| Email Interconnectivity | If you receive email from us, we use certain tools to capture data related to when you open our message, click on any links or banners it contains and make purchases. For more information relating to the use of such tools, review the “Cookies and Similar Technologies” section below. | We have a legitimate interest in using this information to understand how you interact with our communications to you. |
| Feedback/Support | If you provide us feedback or contact us for support via our Site, we will collect your name and e-mail address, as well as any other content that you send to us, in order to reply. | We have a legitimate interest when we use this information in order to receive, and act upon, your feedback or issues. |
| Mobile Devices | We collect information from your mobile device such as unique identifying information broadcast from your device. For more information relating to the use of such tools, review the “Cookies and Similar Technologies” section below. | We have a legitimate interest in using this information to identify unique visitors and understand how users interact with us on their mobile devices. |
| Mailing List | When you sign up for one of our mailing lists, we collect your email address or postal address. We may also purchase or receive mailing lists or Personal Information from third parties. | We have a legitimate interest in disclosing information about our products or Services with you and otherwise providing you with marketing or promotional materials. In addition, we may rely on your consent to receive certain marketing communications. |
| Website Interactions | We use technology to monitor how you access and interact with our Site and Services. This may include which links you click on, or information that you type into our online forms. This may also include information about your device or browser. For more information relating to the use of such tools, review the “Cookies and Similar Technologies” section below. | We have a legitimate interest in using this information to understand how you interact with our Site and Services to better improve it, and to understand your preferences and interests in order to select offerings that you might find most useful. We also have a legitimate interest in detecting and preventing fraud. |
| Web Logs | We collect information, including your browser type, operating system, Internet Protocol (IP) address (a number that is automatically assigned to a computer when the Internet is used), domain name, click-activity, referring website, and/or a date/time stamp for visitors. For more information relating to the use of such tools, review the “Cookies and Similar Technologies” section below. | We have a legitimate interest in monitoring our networks, providing and maintaining the functionality of our Site or Services, including identifying and repairing errors or problems, security incidents, and in investigating, preventing, or taking action regarding possible malicious, deceptive, fraudulent, or illegal activity, including attempts to manipulate or violate our policies, procedures, and terms and conditions. |
| Partner Promotion | We collect information that you provide as part of a co-branded promotion with an affiliated or partnered entity, company, or financial institution. | We have a legitimate interest in using this information to offer promotions to you or run, fulfil, and complete any of our promotions. |
We collect Personal Information from you directly, and we may also receive Personal Information about you from other sources, including third parties such as credit bureaus, our partners, and other services you may elect to utilize (including from companies that also provide marketing lead information and/or your employer to the extent your organization is acting as our customer), or publicly available sources.
If you do not provide us with certain Personal Information, we may not be able to fulfill the requested purpose of collection, such as to respond to your queries or request for customer service or provide our Services to you. Although the table above describes our primary purpose in collecting your information, in many situations we have more than one purpose. As a result, our collection and processing of your information may be based in different contexts upon your consent, our need to perform a contract, our obligations under law, and/or our general interest in conducting our business.
Social security number, certain financial account information, username, and/or password, are considered sensitive Personal Information. The provision of the sensitive Personal Information listed above is voluntary. In certain instances, we will not be able to process your request for our Services without the requested Personal Information.
We collect your Personal Information in the following ways, pursuant to applicable law:
Directly From You, when you use our Services, register for an account, contact us, respond to a survey, sign up to receive emails, text messages, and/or postal mailings.
Through Our Use of Cookies and Other Automatic Data Collection Technologies, when you visit our websites, use our mobile applications, open or click on emails we send you, or interact with our advertisements. We or third parties we work with automatically collect certain information using technologies such as cookies, web beacons, clear GIF, pixels, internet tags, web server logs, and other data collection tools. For more information, please see the “Cookies and Similar Tracking Technologies” section below.
From Our Third‑Party Partners, including from third parties that we have partnered with to provide you the Services that you have requested from us.
We may disclose your Personal Information in the following circumstances:
- Within Pathward. We may share your Personal Information with our corporate affiliates (e.g., parent company, sister companies or subsidiaries, and other companies under common control) or joint ventures to which we are a party.
- Service Providers. We may disclose such information to service providers who assist us in providing products and Services, information technology support, and customer service support.
- Other Disclosures with Your Consent. We may ask to collect certain information, or if you would like us to disclose your information with other unaffiliated third parties who are not described elsewhere in this Privacy Policy.
- Corporate Transaction. We may disclose your Personal Information in the context of merger, consolidation or other corporate reorganization, to a purchaser of all or a portion of our assets (including for example, the sale of loans or other assets), or pursuant to a financing arrangement or co-promotional agreement. Such recipient will be bound by terms and conditions reasonably similar to those set out in this Privacy Policy.
- Other Parties. We may disclose Personal Information in response to subpoenas, warrants, court orders, or in connection with a legal process, to comply with relevant laws, or to comply with a government request. We may also disclose such information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, risk to the safety of a person or property, or a violation of our policies.
In accordance with applicable law, we may use cookies, web beacons, or other tracking technologies (collectively, “Cookies”) on our Site. A Cookie is a small amount of data that is transferred to visitors’ web browsers and/or stored on your device as you are browsing; they are processed and stored by your web browser.
We may use the following types of cookies on our Site:
| Cookie Type | Description |
|---|---|
| Essential Cookies | These are cookies that our Site needs in order to function, and that enable you to move around and use the Site and features. Without these essential cookies, the Site will not perform as smoothly for you as we would like it to and we may not be able to provide the Site or Services you request. Examples of instances where these cookies may be used include: to determine when you are signed in, to determine when your account has been inactive, and for other troubleshooting and security purposes. |
| Analytics Cookies | Analytics cookies allow us to understand more about how many visitors we have to our Services, how many times they visit us and how many times a user viewed specific pages within our Site. Although analytics cookies allow us to gather specific information about the Site that you visit and whether you have visited our Site multiple times, we cannot use them to find out details such as your name or address. |
| Advertising Cookies | Depending on your location and in certain circumstances, Pathward may work with third‑party online or mobile network advertisers that use cookies to help us manage advertising and measure its effectiveness. These cookies enable third-party ad networks to recognize a unique cookie on your computer or mobile device and may be placed by us or our network advertising firm that works with our third-party network advertiser. The information that is collected and shared by cookies may be linked to the device identifier of the device you are using to allow us to keep track of all the sites and mobile applications you have visited that are associated with the ad network. This information may be used for the purpose of targeting advertisements on the Pathward Services or third party sites. |
We may use the information collected through tracking technologies for several reasons, including:
- To make our Site easier to use.
- To gather metrics about how users interact with our Site and Services.
- For security reasons.
Commercially Recognized Opt-Out Preference Signals: Pathward recognizes commercially recognized opt-out preference signals (e.g., Global Privacy Controls). Recognition of this signal applies only to the specific device and/or browser that communicates the signal and does not cross over to all devices/browsers you use to access the Services.
We take the privacy of your Personal Information seriously. We use commercially reasonable technical, administrative and physical security measures to protect your Personal Information, including generally accepted industry standards to protect the Personal Information submitted to us during transmission and once we receive it. However, no method of transmission over the Internet or method of electronic storage is 100 percent secure, so we unfortunately cannot guarantee absolute security. In the event of a breach that we are required by law to inform you of, we may notify you electronically, in writing, or by telephone, if permitted to do so by law. If you have reason to believe that your interaction with us is no longer secure (e.g., if you feel that the security of any account you might have with us has been compromised), please contact us immediately as detailed under the “Contact Us” heading below.
How long we retain your Personal Information depends on the context in which, and purpose for which, we collected it. We generally retain Personal Information for as long as necessary for achieving the purpose for which it was collected, unless a different retention period is required by applicable law.
We may provide links to other websites that are not owned or controlled by Pathward. Please note that these websites’ privacy policies may differ from those of Pathward and that this Privacy Policy only applies to Personal Information collected on this Site or through the use of our Services. We have no control over third-party websites and are not responsible or liable for the privacy or business practices of any third party websites linked to on our Site or Services. We encourage you to read the privacy policy of any website you may visit, as we are not responsible for such websites’ content and policies.
Pathward does not knowingly collect Personal Information from children under the age of 13, and users under the age of 13 should not submit any Personal Information to Pathward. If you learn that your child has provided us with Personal Information without your consent and he/she is under the age of 13, please alert us at the contact information detailed in the “Contact Us” section below. We will take prompt steps to remove the Personal Information from our systems.
Except to the extent limited by applicable law, we reserve the right to update this Privacy Policy to reflect changes to our practices by prominently posting notice of the update on our Site or through our Services. Any updates will become effective 30 days after posting the updates to this Privacy Policy and apply to all information collected about you. If we make any changes to this Privacy Policy that materially impact previously collected Personal Information about you, we will, to the extent that we have your email address, notify you by email and/or obtain consent where required by applicable law.
Depending on where you are located, you may have additional rights, as detailed below:
- Right to withdraw your consent: To the extent a specific element of our processing of your Personal Information relies upon your consent, you may withdraw such consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.
- Right to request access to your Personal Information: You may have the right to obtain from us confirmation as to whether or not Personal Information concerning you is being processed, and, where that is the case, to request access to the Personal Information. This access information includes — inter alia — the purposes of the processing, the categories of Personal Information concerned, and the recipients or categories of recipient to whom the Personal Information have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access. You may have the right to obtain a copy of the Personal Information free of charge. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
- Right to request rectification: You may have the right to obtain from us the rectification of inaccurate Personal Information concerning you. Depending on the purposes of the processing, you may have the right to have incomplete Personal Information completed, including by means of providing a supplementary statement.
- Right to request erasure (right to be forgotten): Under certain circumstances, you may have the right to obtain from us the erasure of Personal Information concerning you. Under applicable law, we may not be able to erase certain Personal Information.
- Right to request restriction of processing: Under certain circumstances, you may have the right to obtain from us restriction of processing your Personal Information. In such case, the respective data will be marked and may only be processed by us for certain purposes.
- Right to request data portability: Under certain circumstances, you may have the right to receive the Personal Information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit those data to another entity without hindrance from us.
- Right to object: Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Information by us, and we can be required to no longer process your Personal Information. Such right to object may especially apply if we collect and process your Personal Information for profiling purposes in order to better understand your interests in our products and Services or for direct marketing. If you have a right to object and you exercise this right, your Personal Information will no longer be processed for such purposes by us. You may exercise this right by contacting us as stated in the “Contact Us” section of this Privacy Policy. Such a right to object may, in particular, not exist if the processing of your Personal Information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
- Opt Out of the “Sale” or “Sharing” of Personal Information: Our use of cookies or other tracking technologies is deemed a “sale” or “sharing” under California law (in this context “sharing” means cross contextual behavioral advertising) of Personal Information. As such, you can opt out of our use of tracking technologies and cookies by clicking the “Do not Sell or Share My Personal Information” button at the bottom of the website.
- The following categories of Personal Information disclosed are considered “sale”/ “sharing” under California law: web log and web site interactions.
- The following categories of third parties to whom Personal Information was disclosed are considered “sale”/ “sharing” under California law: advertising networks.
- Right to Limit the Use and Disclosure of Sensitive Personal Information. You have the right to request the restriction of processing of your sensitive Personal Information. At the current time, however, we do not use or disclose sensitive Personal Information for purposes other than those expressed in this Privacy Policy or as otherwise permitted by applicable law, and these uses cannot be limited under California law.
- Right to Non-Discrimination. We do not discriminate against individuals who exercise any of their rights described in this Privacy Policy. However, Pathward may require use of your Personal Information to provide access to the Services. Therefore, when you exercise your deletion right, in particular, you may lose access to certain aspects of the Services that require your Personal Information.
If you choose to assert any of these rights under applicable law, we will respond within the time period prescribed by applicable law. Please note that many of the above rights are subject to exceptions and limitations. Your rights and our responses will vary based on your country or territory of residency.
To exercise your rights, please contact us as stated in the “Contact Us” section of this Privacy Policy. You also have the right to lodge a complaint with the competent data protection supervisory authority if we have not addressed your questions or concerns about Personal Information. In certain situations, we may direct you to our Partner’s website to exercise your rights.
Authorized Agent
In certain jurisdictions, a person authorized to act on your behalf may make a verifiable consumer request related to your Personal Information. If you designate an authorized person to submit requests to exercise certain privacy rights on your behalf, we will require verification that you provided the authorized agent permission to make a request on your behalf. You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us.
Your verifiable request must: (i) provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Personal Information or an authorized representative; and (ii) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
The Personal Information that we collect or receive about you may be transferred/made accessible to and processed by recipients that are located outside of your home country, including in certain instances to countries not considered to provide an adequate level of protection to Personal Information from a local law perspective. To appropriately protect Personal Information, we will base the transfer on appropriate safeguards, including but not limited to standard contractual clauses adopted by the European Commission and/or similar contractual obligations for the United Kingdom. Depending on your location, you may have the right to request a copy of such appropriate safeguards by contacting us as set out at the end of this Privacy Policy.
If you have any questions, comments, or complaints concerning our privacy practices please contact us at the appropriate address below. We will attempt to respond to your requests and to provide you with additional privacy-related information.
Email: privacy@pathward.com
Telephone: 1-833-898-0023
Mail: Privacy Department, 5501 S. Broadband Lane, Sioux Falls, South Dakota 57108