Privacy Statement

What Information We Collect | What Information We Disclose | Our Security Procedure | Purpose | Definitions
Authority | Privacy Principles | Disclosure of Privacy Principles | Exceptions to Notice and Opt-Out Requirements for Service Providers
Training | Record Keeping and Reporting

Protecting your privacy is important to Home Savings Bank of Wapakoneta and our employees. We want you to understand what information we collect and how we use it. In order to provide our customers with a broad range of financial products and services as effectively and conveniently as possible, we use technology to manage and maintain customer information. The following policy serves as a standard for all Home Savings Bank employees for collection, use, retention, and security of nonpublic personal information.

What Information We Collect:

We may collect “nonpublic personal information” about you from the following sources:

• Information we receive from you on applications or other forms;

• Information about your transactions with us; and

• Information we receive from a consumer reporting agency.

“Nonpublic personal information” is nonpublic information about you that we obtain in connection with providing a financial product or service to you. For example, nonpublic personal information includes information regarding your account balance, payment history, and overdraft history.

What Information We Disclose:

We do not disclose any nonpublic personal information about you to anyone, except as permitted by law.

We are permitted under law to disclose nonpublic personal information about you to other third parties in certain circumstances. For example, we may disclose nonpublic personal information about you to third parties to assist us in servicing your loan or account with us, to government entities in response to subpoenas, and to credit bureaus.

We are also permitted under law to disclose all of the information we collect to companies that perform marketing services on our behalf with which we have joint marketing arrangements.

If you decide to close your account(s), or become an inactive customer, we will continue to adhere to the privacy policies and practices described in this notice.

Our Security Procedures:

We also take steps to safeguard customer information. We restrict access to your personal and account information to those employees who need to know that information to provide products or services to you. Employees who violate these standards will be subject to disciplinary measures. We maintain physical, electronic, and procedural safeguards that comply with federal standards to guard your nonpublic personal information.

PURPOSE

This policy reaffirms our bank’s realization of, and respect for, the privacy expectations and rights of our customers regarding financial information and other related information which the bank has or gathers in the normal course of business. It is intended to provide guidance to bank personnel as well as assurance to our customers. We will also, of course, act in compliance with all applicable laws and regulations.

DEFINITIONS

Employee: As used in this policy, “employee” includes all directors, officers, and employees of the bank, as well as, attorneys, agents, or outside vendors who become privy to customer information.

Consumer: An individual, or their legal representative, who obtains or has obtained, a financial product or service from a bank that is to be used primarily for personal, family, or household purposes. (An example of a consumer would be a loan applicant. A consumer is not necessarily a customer.)

Customer: A person who has established a “continuing relationship” with our bank. (For example, an approved loan applicant who signs a note would become a customer.)

Nonpublic Personal Information: Personally identifiable information relating to a consumer, except when there is a reasonable belief that the information is publicly available. (For example, the fact of a customer relationship with the bank would presumably be nonpublic personal information. It is only if personally identifiable information relating to a consumer is publicly available that such information is excluded from nonpublic information.)

Publicly Available Information: Any information that a bank has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records; widely distributed media; or disclosures to the general public that are required to be made by federal, state, or local law. (For example, a published telephone directory or the public record of real estate transactions.)

AUTHORITY

The Board of Directors has the ultimate responsibility to appropriately establish and maintain this policy and assure that it is being observed in the daily operations of the bank. The Managing Officer and/or the Assistant Managing Officer will be responsible for carrying out this policy and making recommendations to the Board of Directors as to necessary or desirable changes to the policy. At a minimum, the privacy policy shall be reviewed annually.

PRIVACY PRINCIPLES

The bank recognizes the following elements of its privacy policy, which have become standard within the banking industry:

Note: Although the regulatory focus applies only to nonpublic personal information about consumers who obtain financial products or services for personal, family, or household purposes, our bank will also embrace these principles and provide similar support to those companies or individuals who obtain financial products or services for business purposes:

1. Recognition of Customer’s Expectation of Privacy: Customers of the bank are entitled to the absolute assurance that the information concerning their financial circumstances and personal lives, which the bank has obtained through various means, will be treated with the highest degree of confidentiality and respect. Certain expectations of privacy also contain legal rights of customers which are either granted or confirmed to them through various federal and state laws and regulations. All employees are directed by this policy to assure customers of the bank’s commitment to preserving the privacy of their information.
   In addition, the bank shall make customers aware of this commitment by posting in the office. The bank’s privacy notice is included as part of this policy.
2. Use, Collection, and Retention of Consumer Information: It is the policy and practice of the bank to collect, retain, and use information about consumers and customers (both individual and corporate) only where the bank reasonably believes the gathering of such information would be useful and allowed by law to administer the bank’s business and/or to provide products, service, or opportunities to its customers.
3. Maintenance of Accurate Information: Management is directed to establish procedures to ensure that, to the extent practicable, all customer financial information is accurate, current, and complete in accordance with reasonable commercial standards. The bank will respond promptly and affirmatively to any legitimate customer request to correct inaccurate information, including forwarding of corrected information to any third party who had received the inaccurate information. The bank will further undertake to record that such corrective action was requested by the customer and follow up with any third parties to ensure that they have processed the correction.
4. Limitation on Employee Access to Information: Management will take all steps necessary to ensure that only employees with a legitimate business reason for knowing personally identifiable customer information shall have access to such information. To the extent practicable, access will be limited by computer access codes and granting limited access to areas in which sensitive customer information is retained. Employees will be informed at the time of their initial employment of these standards and periodically reminded of these standards during training sessions at least once during each calendar year. Willful violation of this element of this policy will result in disciplinary action against the offending individual. Inadvertent violations will be dealt with in a manner to ensure that such violations are not repeated.
5. Protection of Information via Established Security Procedures: The bank will maintain appropriate security standards and procedures to prevent unauthorized access to customer information. Such procedures should prevent access by not only unauthorized employees, but others as well. Such others include, but are not limited to, all non-employees with otherwise legitimate reasons for being on bank premises, computer “hackers”, and all intruders on bank premises.
6. Restrictions on the Disclosure of Customer Information: The bank will not, except in cases allowed under the law, reveal specific information about customer accounts or other nonpublic personal information to any nonaffiliated third parties unless the customer has been provided the required privacy disclosures and is given the opportunity to decline or “opt out”.
7. Maintaining Customer Privacy in Business Relationships with Third Parties: If the bank is requested to provide personally identifiable information to a third party and that request is in all respects consistent with other elements of this policy, the bank will accede to the request only if the third party agrees to adhere to similar privacy principles, no less stringent than set forth in this policy, that provide for keeping such information confidential.

DISCLOSURE OF PRIVACY PRINCIPLES

Initial Privacy Notice: At the time a consumer approaches the bank to obtain pre-qualifying information
for a product or service, open an account, request a loan, transact a banking service, or reestablish a
customer service, a privacy notice will be provided. The notice may be delivered by hand, by mail, or
electronically, as specified in the pertinent banking regulation. If the notice is provided electronically,
the consumer must be required to acknowledge receipt as a necessary condition for obtaining a financial
product or service.

Content of Privacy Notices: The privacy notice provided initially and in subsequent annual issuance’s
will contain the following information:

• Insights regarding the information collected;
• Statement that the bank does not disclose any nonpublic personal information about consumers or customers to anyone, except as permitted by law;
• Statement that if a customer decides to close their account or become an inactive customer, the bank will adhere to the privacy policies and practices as described in the notice;
• Details regarding the bank’s policies and practices with respect to protecting the confidentiality, security, and integrity of nonpublic personal information.

Limitations: The bank will not be able to directly, or through any future affiliation, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless:

• The bank has provided the consumer with a revised privacy notice;
• The bank has provided to the consumer an opt-out notice;
• The bank has given the consumer a reasonable opportunity, deemed to be 30 days after the notice has been mailed, to opt out of the disclosure before the institution discloses the information to the nonaffiliated third party;
• The consumer does not opt out.

EXCEPTIONS TO NOTICE AND OPT-OUT REQUIREMENTS FOR SERVICE PROVIDERS.

The bank does not provide opt-out option for customers or consumers.

The requirements for initial notice, and for service providers, do not apply when the bank discloses nonpublic personal information in the following circumstances:

• With the consent or direction of the consumer, provided that the consumer has not revoked the consent or direction.
• For the following protective or legal situations:
  a) To protect the confidentiality or security of the bank’s records pertaining to the consumer, service, product, or transaction.
  b) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
  c) For required institutional risk control or for resolving consumer disputes or inquiries.
  d) To persons holding a legal or beneficial interest relating to the consumer.
  e) To persons acting in a fiduciary or representative capacity on behalf of the consumer.
• To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating the bank, persons that are assessing the bank’s compliance with industry standards, and the bank’s attorneys, accountants,
  and auditors.
• To the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act, to law enforcement agencies.
• To consumer reporting agencies as permitted under the Fair Credit Reporting Act, or from a consumer report reported by a consumer reporting agency.
• In connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business unit.
• To comply with federal, state, or local laws, and other applicable legal requirements (e.g. investigation, subpoena, or summons by federal, state, or local authorities).

TRAINING

Management and staff will receive in-depth training on the bank’s privacy policy. Annually, this training will be provided as a refresher to all management and staff. It is critical that all new hires receive this training before having access to any consumer and customer information. Training schedules will be established and monitored by the Managing Officer and Assistant Managing Officer.

RECORD KEEPING AND REPORTING

The Managing Officer and Assistant Managing Officer will maintain a separate file for the purpose of retaining any customer complaints that relate to this policy. The information regarding any complaint should include the exact nature of the complaint, describe the corrective actions taken, and confirm that the corrective actions resolved the complaint.

The Managing Officer and Assistant Managing Officer will make an annual report to the Board concerning customer complaints which shall include the frequency and nature of such complaints and corrective actions taken. Complaints of a nature sufficient to present a risk of regulatory enforcement action and/or civil money penalties are required to be reported if and when they occur.