– FIRST FEDERAL SAVINGS protects customer information to achieve confidentiality, integrity

and availability. Confidentiality means that NPPII is not available or disclosed to unauthorized persons. Integrity means that NPPII is not altered / destroyed in an unauthorized manner. Availability means that NPPII is accessible and usable on demand by an authorized person.

– FIRST FEDERAL SAVINGS attains administrative safeguards by implementing security measures that reduce risks/vulnerabilities to a reasonable and appropriate level.

– FIRST FEDERAL SAVINGS achieves physical safeguards by limiting physical access to its facilities while ensuring that authorized access is allowed and follows the appropriate procedures established.

– FIRST FEDERAL SAVINGS achieves technical safeguards by implementing technical policies and procedures that allow only authorized users to access electronic

NPPII. Electronic measures must be put in place to confirm that NPPII has not been improperly altered or destroyed.

– FIRST FEDERAL SAVINGS will achieve organizational safeguards by taking reasonable steps to cure any activity or practice that constitutes a material breach or violation. Violations include the failure to implement safeguards that reasonably and appropriately protect NPPII.

– FIRST FEDERAL SAVINGS will adopt reasonable and appropriate procedures to comply with this Policy. FIRST FEDERAL SAVINGS must maintain written security procedures and written records of required actions, activities or assessments.

– FIRST FEDERAL SAVINGS must perform a risk assessment if a breach occurs to evaluate probability of that the protected information has been compromised.

the institution privacy practices.

– The privacy notice will be provided so that each recipient can reasonably be expected to receive actual notice in writing or electronically.

– Privacy notices will be available in FIRST FEDERAL SAVINGS’ website.

– The privacy notice includes the following information:

• Categories of information collected,

• Categories of information disclosed,

• Categories of affiliates and nonaffiliated third parties to whom FIRST FEDERAL SAVINGS may disclose information,

• Policies and practices with respect to the treatment of former customers’

information,

• Categories of information disclosed to nonaffiliated third parties that perform services for FIRST FEDERAL SAVINGS or functions on FIRST FEDERAL SAVINGS’s behalf and categories of third parties with whom FIRST FEDERAL SAVINGS has contracted,

•

•

•

An explanation of the opt out right and methods for opting out, Policies and practices for protecting the security and confidentiality of information, and

A statement that FIRST FEDERAL SAVINGS makes disclosures to other nonaffiliated third parties for everyday business purposes or as permitted by the law.

each customer, no later than the time a customer relationship is established.

– Gramm-Leach-Bliley Act (GLBA) gives rule making authority to the CFPB and modifies Regulation P on the requirements of Annual Notice indicating that

Provide nonpublic personal information to nonaffiliated third parties only in

accordance with the provisions of § 1016.13, § 1016.14, or § 1016.15; and (ii) Have not changed their policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer under § 1016.6(a)(2) through (5) and (9) in the most recent privacy notice provided pursuant to this part.”

Therefore, it is the policy of FIRST FEDERAL SAVINGS to provide the ongoing annual Privacy Notice to existing customers only if at any giving point in time a change in policies and/or practices occurs in regards to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer under § 1016.6(a)(2) through (5) and (9) in the most recent privacy notice provided pursuant to this part.

– A new notice will be provided to an existing customer when the customer obtains a new financial product or services, only if the initial or annual notice most recently provided to the customer was not accurate with respect to

the financial product or service.

– FIRST FEDERAL SAVINGS will notify the customers of new account the requirement of the

following information: his/her name, address, date of birth, profession, origin of income, and any other information that will allow the identification of the customer. This applies to both, deposits and credit accounts, and any other type of account offered by FIRST FEDERAL SAVINGS.

– FIRST FEDERAL SAVINGS might also request the license ID, Passport or any other identification documents to the customer or representative, if applicable.

– FIRST FEDERAL SAVINGS will notify that they will reserve the right of requesting additional documents to the accounts primary signature, authorized signatures, and/or origin of funds reflected on the account, and/or customers’ income.

– FIRST FEDERAL SAVINGS will notify that the client is not required to accept the disclaimers when opening a new account. If clients are not in agreement with the disclaimers, FIRST FEDERAL SAVINGS will close the new account and return the available funds by Check or via wire transfer without any cost to the client.

– FIRST FEDERAL SAVINGS will send an initial notice of its privacy policies and practices via e-

mail, providing this is the official method of communication, as all customers

– The information sent to the consumer will include an opt out notice.

– The opt out notice will allow a period of no less than 30 days for the consumer to opt out.

– FIRST FEDERAL SAVINGS will notify its new clients that their account or transaction information could be disclosed in the following scenarios:

• Verification of existence and condition of clients account to third party

(e.g. credit bureau, merchants)

• Complying with warrants made from courts or governmental agencies,

• When required in order to process or complete a transaction,

• When the customer authorizes in writing, and

• When required or permitted by legislation and applicable laws.

– FIRST FEDERAL SAVINGS will not disclose any nonpublic personal information to non- affiliated third parties except under the enumerated exceptions.

– FIRST FEDERAL SAVINGS will provide a revised notice before it begins to share a new category of nonpublic personal information or shares information with a

new category of nonaffiliated third party in a manner that was not described in the previous notice.

execution of this policy, the task of monitoring the proper compliance of this

policy and/or pertinent procedure.

– All recommendations identified as a result of the monitoring process will be discussed with upper management in the Regulatory Compliance Committee.

– Action plans and/or corrective measures will be documented, approved and distributed within the affected area and management.

– The areas to be evaluated are:

• Initial privacy notice,

• Annual privacy notice (if considered applicable),

• Content privacy notice,

• No Opt-out notice,

• Revised notice,

• Delivery methods,

• Limits on disclosure to nonaffiliated third parties,

• Limits on disclosure and reuse of information,

• Exceptions to notice and opt out requirements for processing servicing transaction, and

• Other exceptions to notice and opt out requirements.

– FIRST FEDERAL SAVINGS has in place a risk-based response, including customer notification

procedures, to address unauthorized access to or use of customer information maintained by a FIRST FEDERAL SAVINGS or its service provider that could

disclosure of a data security breach if the covered entity concludes that misuse of its information about a customer has occurred or is reasonably possible, pursuant to the guidance, substantial harm or inconvenience is most likely to result from improper access to “sensitive customer information”.

– FIRST FEDERAL SAVINGS’s response program general procedures are:

• Assessing through an investigation the nature and scope of an incident and identifying what customer information systems and types of customer information have been accessed or misused; assessing the situation could include the support of a third party, as considered necessary.

• Notifying its primary regulators once FIRST FEDERAL SAVINGS becomes aware of an incident involving unauthorized access to or use of sensitive customer information; consistent with the Agency’s Suspicious Activity Report (“SAR”) regulations,

• Notifying appropriate law enforcement authorities;

• Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information (e.g., by monitoring, freezing, or closing affected accounts and preserving records and other evidence); and

• Notifying the affected customers when warranted. Customer notice may only be delayed if an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and provides the institution with a written request for the delay.

• A general description of the incident,

• Type of information subject to unauthorized access,

• A telephone number customers can call for further information and assistance,

• A reminder «to remain vigilant» over the next 12 to 24 months,

• A recommendation that incidents of suspected identity theft be reported promptly, and

• A general description of the steps taken by the financial institution to protect the information from further unauthorized access or use.

• Depending on the situation, FIRST FEDERAL SAVINGS may choose to contact all

Suspicious Activity

Report (“SAR”)

– FIRST FEDERAL SAVINGS is required to file a suspicious activity report no later than 30

calendar days after the date of initial detection of unusual facts that may constitute a basis for filing a suspicious activity report.

– If no suspect was identified on the date of detection of the incident requiring the filing, FIRST FEDERAL SAVINGS may delay filing a suspicious activity report for an additional 30 calendar days to identify a suspect.

– In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

– FIRST FEDERAL SAVINGS must use the regular channels in order to submit Suspicious

Activity Reports.