Shelby State Bank Mobile Banking App (the “App”)– powered by Fiserv – helps you control your credit

and/or debit cards through your mobile device, making it easy to manage your finances on the go.

The App allows you to:

• check the balances of your accounts

• manage your money

• view your transactions and statements

• make transfers

• pay your bills and manage billers

• deposit a check

• receive alerts

• manage cards

This Privacy Policy, in combination with other relevant privacy notices that we provide to you (e.g.,

pursuant to financial privacy laws), inform you of the policies and practices regarding the collection, use

and disclosure of any personal information that we and our service providers collect from or about users

in connection with the App’s website and mobile application (the “Services”).

Through your use of the Services, we may collect personal information from you in the following ways:

(a) Personal Information You Provide to Us.

• We may collect personal information from you, such as your first and last name, address, e-mail,

telephone number, and social security number when you create an account.

• We will collect the financial and transaction information necessary to provide you with the

Services, including account numbers, payment card expiration date, payment card identification,

verification numbers, and transaction and payment history.

• If you provide feedback or contact us via email, we will collect your name and email address, as

well as any other content included in the email, in order to send you a reply.

• We also collect other types of personal information that you provide voluntarily, such as any

information requested by us if you contact us via email regarding support for the Services.

(b) Personal Information Collected from Third Parties. We may collect certain information from identity

verification services and consumer reporting agencies, including credit bureaus, in order to provide

some of our Services.

(c) Personal Information Collected Via Technology. We and our service providers may automatically log
information about you, your computer or mobile device, and your interaction over time with our
Services, our communications and other online services, such as:

• Device data, such as your computer’s or mobile device’s operating system type and version,

manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device

type (e.g., phone, tablet), IP address, unique identifiers, language settings, mobile device carrier,

radio/network information (e.g., WiFi, LTE, 3G), and general location information such as city,

state or geographic area.

• Online activity data, such as pages or screens you viewed, how long you spent on a page or

screen, the website you visited before browsing to the Service, navigation paths between pages

or screens, information about your activity on a page or screen, access times, and duration of

access.

• Cookies, which are text files that websites store on a visitor’s device to uniquely identify the

visitor’s browser or to store information or settings in the browser for the purpose of helping

you navigate between pages efficiently, remembering your preferences, enabling functionality,

and helping us understand user activity and patterns.

• Local storage technologies, like HTML5 and Flash, that provide cookie-equivalent functionality

but can store larger amounts of data, including on your device outside of your browser in

connection with specific applications.

• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a

webpage or email was accessed or opened, or that certain content was viewed or clicked.

• Location Information. If you have enabled location services on your phone and agree to the

collection of your location when prompted by the Services, we will collect your location

information when you use the Services; for example, to provide our fraud detection services. If

you do not want us to collect this information, you may decline the collection of your location

when prompted or adjust the location services settings on your device.

(a) General Use. In general, we use your personal information collected through your use of the Services
to respond to your requests as submitted through the Services, to provide you the Services you request,
and to help serve you better. We use your personal information, in connection with the App, in the
following ways:

• facilitate the creation of, and secure and maintain your account;

• identify you as a legitimate user in our system;

• provide improved administration of the Services;

• provide the Services you request;

• improve the quality of experience when you interact with the Services;

• send you administrative e-mail notifications, such as security or support and maintenance

advisories; and

• send surveys, offers, and other promotional materials related to the Services.

(b) Compliance and protection. We may use your personal information to:

• comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas

or requests from government authorities;

• protect our, your or others’ rights, privacy, safety or property (including by making and

defending legal claims);

• audit our internal processes for compliance with legal and contractual requirements and

internal policies;

• enforce the terms and conditions that govern the Service; and

• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal

activity, including cyberattacks and identity theft.

(c) Creation of Non-Identifiable Data. The App may create de-identified information records from
personal information by excluding certain information (such as your name) that makes the information
personally identifiable to you. We may use this information in a form that does not personally identify
you to analyze request patterns and usage patterns to enhance our products and services. We reserve
the right to use and disclose non-identifiable information to third parties in our discretion.

We disclose your personal information collected through your use of the Services as described below.

(a) In Accordance with Our Other Privacy Notices. Other than as described in this Privacy Policy in
connection with the App, this Privacy Policy does not apply to the processing of your information by us
or third parties with whom we share information.

(b) Third Party Service Providers. We may share your personal information with third party or affiliated
service providers that perform services for or on behalf of us in providing the App, for the purposes
described in this Privacy Policy, including: to provide you with the Services; to conduct quality assurance
testing; to facilitate the creation of accounts; to optimize the performance of the Services; to provide
technical support; and/or to provide other services to the App.

(c) Authorities and Others. Regardless of any choices you make regarding your personal information,
The App may disclose your personal information to law enforcement, government authorities, and
private parties, for the compliance and protection services described above.

The App may contain links to third party websites. When you click on a link to any other website or
location, you will leave the App and go to another site and another entity may collect personal and/or
anonymous information from you. The App’s provision of a link to any other website or location is for
your convenience and does not signify our endorsement of such other website or location or its
contents. We have no control over, do not review, and cannot be responsible for, these outside
websites or their content. Please be aware that the terms of this Privacy Policy do not apply to these
outside websites. We encourage you to read the privacy policy of every website you visit.

You have several choices regarding use of information on the Services.

(a) How We Respond to Do Not Track Signals. Some web browsers transmit “do not track” signals to the
websites and other online services with which your web browser communicates. There is currently no
standard that governs what, if anything, websites should do when they receive these signals. We
currently do not take action in response to these signals. If and when a standard is established, we may
revise its policy on responding to these signals.

(b) Access, Update, or Correct Your Information. You can access, update or correct your information by
changing preferences in your account. For additional requests, please contact us.

(c) Opting Out of Email or SMS Communications. If you have signed-up to receive our email marketing
communications, you can unsubscribe any time by clicking the "unsubscribe" link included at the bottom
of the email or other electronic communication. Alternatively, you can opt out of receiving marketing
communications by contacting us at the contact information under "Contact Us" below. If you provide
your phone number through the Services, we may send you notifications by SMS, such as provide a
fraud alert. You may opt out of SMS communications by unlinking your mobile phone number through
the Services.

(d) Opting Out of Location Tracking. If you initially consented to the collection of geo-location
information through the Services, you can subsequently stop the collection of this information at any
time by changing the preferences on your mobile device. Please note, however, that if you withdraw
consent to our collection of location information, you may no longer be able to use some features of the
App.

We implement reasonable administrative, technical and physical measures in an effort to safeguard the
information in our custody and control against theft, loss and unauthorized access, use, modification
and disclosure. Nevertheless, transmission via the internet is not completely secure and we cannot
guarantee the security of your information.

The Services are not directed towards individuals under the age of 18, and we do not, through the App,
intentionally gather personal information about visitors who are under the age of 18. If a child under 18
submits personal information to us through the App and we learn that the personal information is the
information of a child under 18, we will attempt to delete the information as soon as possible.

This Privacy Policy is subject to occasional revision. We will notify you of any material changes in its
collection, use, or disclosure of your personal information by posting a notice on the Services. Any
material changes to this Privacy Policy will be effective thirty (30) calendar days following notice of the
changes on the Services. These changes will be effective immediately for new users of the Services. If
you object to any such changes, you must notify us prior to the effective date of such changes that you
wish to deactivate your account. Continued use of the Services following notice of any such changes
shall indicate your acknowledgement of such changes.

If you have any questions or complaints about this Privacy Policy or The App’s data collection or
processing practices, or if you want to report any security violations to The App, please contact The App
by email at: ibanking@shelbybank.com; or by mail at: Shelby State Bank, 242 North Michigan Avenue,
Shelby MI 49455