Citizens State Bank of New Castle Digital Privacy Policy

Date of most recent update:  04/21/2025

This Digital Privacy Policy (“Policy”) describes how Citizens State Bank of New Castle and its subsidiaries (collectively, “Citizens,” “Citizens State Bank”, the “Bank,” “we,” “us,” “our”) collects and uses personal information when you visit, use, or interact with us through one of our “Sites.” When we use the word “Site” or “Sites” in this Policy, we intend for it to be interpreted broadly to include, without limitation: (i) any of our online or mobile banking applications (e.g., CSBI Mobile Banking); (ii) any Citizens State Bank website (e.g., https://www.mycsbin.com/); (iii) any Citizens State Bank branded social media site or page; and (iv) any current or future digital advertising campaign in which the Bank may engage.

This Policy also explains how we may use or share personal information collected through any of our Sites to deliver products and services to you, as well as for advertising purposes. If you seek, apply for, or obtain a financial product or service with us, we will use and share any information that we collect from or about you in in accordance with our consumer Privacy Policy.

Agreement to the Terms and Conditions of this Policy

By using any of our Sites, you agree to the terms and conditions of this Policy as well as any disclosures, terms of service, end-user license agreements, or other agreements included on, or applicable to, each Site you visit or use. Where we have a presence on a site owned by a third party, such as a social media site, that third party’s privacy policy and terms of use will apply to the third party’s collection, use, and disclosure of data, unless we have specifically stated otherwise.

Types of Information We May Collect

Information that we may collect about you through our sites includes:

  • Personal Identifiers – Such your name, postal address, email address, phone number, date of birth, government-issued identifier (e.g., Social Security number, tax ID number, driver’s license, or other government ID), username and password, and other information that directly identifies you.
  • Account and Financial Information – Like account number, credit/debit card number, account history, account balances, loan details, vehicle or property information, information about beneficiaries and joint account holders, and other information related to your accounts, applications, financial goals, and personal finance interests.
  • Business Information – Like business-related information (e.g., business name, address, revenue, and industry type), business contact, and professional information.
  • Transaction Information – Like transaction details when you transfer money to or from your accounts, third-party billing information or statements, credit/debit card purchases, payment or transaction history, and payment card details.
  • Credit Report Information – Like your credit score, credit history, and other information that we receive from credit reporting agencies.
  • Demographic Information – Like gender, marital status, age, citizenship, household size/composition, education information, income, occupation, veteran or military status, and employment status.
  • Biometric Information – Like fingerprints, voiceprints, scans of your facial geometry, keystroke and mouse movement patterns.
  • Geolocation Information – Like internet protocol address, device location, and any information used to identify your physical location.
  • Device Information – Like your device type, web browser type and version, operating system type and version, display/screen settings, language preferences, device contacts (e.g., to facilitate payments), photos (e.g., to add a profile photo or to deposit checks), files or other media (e.g., to attach a document to chat), mobile network information, general location (e.g., city, state, or country), precise location (e.g., latitude/longitude to find a nearby branch or ATM), cookie IDs, device IDs, mobile advertising IDs, and likely connections among different browsers and devices that you use.
  • Online/Mobile Activity Information – Like login data, communication preferences, search history, information about how you use and interact with our Site (including content viewed, links clicked, and features used), when and how often you use our Site, and the webpage from where you were directed to our Site.
  • Marketing Information – Like your marketing preferences, information about products or services we think you might like, and inferences based on your interactions with us or our partners (e.g., Online/Mobile Activity Data used for targeted advertising).
  • Survey and Research Information – Like your responses to questionnaires, surveys, requests for feedback, and research activities.

If you inquire about or apply for a job at Citizens using our Site, we may also collect:

  • Employment Application Information – Like professional, employment-related, and education history collected through the Site about job applicants, employees, associates, contractors, or other members of our workforce.

What are cookies and how do we use them? 

Cookies are pieces of information stored directly on your device. Cookies provide information that is used for security purposes, to facilitate navigation, to display information more effectively and to personalize/customize your online experience. When you visit one of our Sites, we, or our service providers, may use cookies or other similar technologies to collect information on our Site. Cookies may also be used to make offers to you via online ads, email, U.S. mail, or telephone. We also use cookies for purposes such as maintaining continuity during an online session, collecting data about the use of our Sites, monitoring online promotions, and anti-fraud and information security purposes.

Other parties, such as our service providers, may collect information about your web browsing behavior when you use one of our Sites to market products and services to you and to improve their and our products and services. We may also provide certain links on our Sites that allow you to interact with third parties who offer additional features, such as allowing you to share information on another platform. At other times, information from a third party may be embedded on our Site. These features may function through the use of third-party cookies and may enable such third party to access information about your interaction with our Sites.

Industry standards are currently evolving, and we may not separately respond to or take any action with respect to a “do not track” configuration set in your internet browser.

Our Sites may use “local shared objects” known as “Flash cookies”. Flash cookies, unlike browser cookies, are not stored in the browser and will not be deleted when you clear cookies from your browser. Flash cookies are generally used for the purposes of information security and fraud prevention. If you choose to limit or disable Flash cookies, it may limit the functionality we can provide when you visit one of our Sites.

Additional Collection & Tracking Technologies

We, or our third-party service providers, may also use the following, and other current or future, technologies for purposes such as measuring the effectiveness of our advertisements or other communications, determining viewing and response rates, and determining which offers to present to you on our own Sites or on third party sites.

  • Server Logs – Server logs automatically capture details of your online interactions with us, such as the time and date of your website visit.
  • Pixels/Web Beacons/Web tags – Pixels, web beacons and web tags are an image or small code in a website or online ad. They enable companies (us or our service providers) to set or read cookies or transfer data to their servers when you load a webpage or interact with online content. For instance, we or our service providers might use pixels to see if you have interacted with part of our website or viewed an online ad.
  • SDKs – Software Development Kits (“SDKs”) are code integrated in mobile apps to connect them to third-party technologies and services, such as in-app ad displays and tools for analytics. SDKs may be used to track users with an advertising ID (such as Apple’s IDFA and Google’s Advertising ID) to identify your mobile device over time for advertising purposes. They can also be used to collect information such as geolocation or IP address.
  • Third-Party Plugins – Plugins from other companies, including social media companies (for example, through a “Share” or "Like” button). Plugins might collect data about your page visits and share it with the plugin creator, even if you do not click on a button. Their use is governed by the creators' privacy policies and terms.
  • Session Replay Technology – Trackers added to a user’s browser to record how they navigate a website (mouse clicks and scrolling) and interact with content.

Using Information

In addition to the uses described above, we may use information for purposes as allowed by law such as:

  • Providing Products and Services – Like evaluating your applications for our products and services, managing your accounts, offering customer support, communicating with you, and providing online tools.
  • Processing Transactions – Like transferring funds, processing payments and other transactions, fulfilling orders, conducting settlements and billing, clearing or reconciliation activities.
  • Identity Verification and Fraud Prevention – Like verifying your identity when you apply for products or services, authenticating your login credentials, confirming your location to grant access to your accounts, storing security questions for future verification, assessing fraud risk, and detecting fraudulent transactions.
  • Security – Like monitoring network logs, detecting incidents, conducting investigations, and protecting against malicious activities.
  • Advertising – Like sending you offers, displaying online ads, targeting offers or promotions, providing and administrating sweepstakes or contests, conducting market research, and improving our marketing.
  • Analytics – Like analyzing website usage, performance, mobile application features, user interface and experience, feature testing, and debugging.
  • Improving Products and Services – Like personalizing and optimizing website and mobile experiences, recognizing users across devices and browsers, enhancing existing products and services, and developing new ones.
  • Legal and Business Purposes – Like complying with laws, responding to lawsuits and investigations, defending legal claims, exercising our rights (including for collections on delinquent accounts), resolving disputes, conducting credit risk analysis and reporting, performing compliance and institutional risk control activities, managing human resources, and overall business operations.
  • Aggregating or Deidentifying Information – Like using or modifying information to prevent identification of you, for example, compiling aggregated statistics to understand trends or feature usage. Aggregated and de-identified data is not subject to this Online Privacy Policy.

Disclosing Information

We may disclose information that we collect, or you provide as described in this Digital Privacy Policy.

  • Affiliates and Acquisitions – We may share information with our corporate subsidiaries and affiliates to deliver products and services and for other business purposes as stated in our consumer Privacy Policy. If we are to be acquired by another business, we will share information with the acquiring entity, including during negotiations.
  • Business Partners – We may share information with companies that we have partnered with to offer or enhance products and services.
  • Advertising Providers – We may allow companies to collect information through our Site to provide us with advertising services, including targeted or behavioral advertising.
  • Service Providers – We may share your information with service providers who assist us with website administration, surveys, technical support, payment processing, and service fulfillment.
  • Credit Reporting Agencies – We share information with credit reporting agencies like Experian, Transunion, and Equifax to report or learn about your financial history and for other lawful purposes.
  • Legal Obligations – We may disclose information due to legal requirements, such as subpoenas, warrants, court orders or other legal process. Information may also be shared to establish or exercise our rights, defend against legal claims, investigate illegal activities, suspected fraud, safety issues, or policy violations, or to fulfill your request for third-party services.
  • Aggregate or De-identified Data – We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.
  • Other Third Parties with Your Consent – We may disclose your information to third parties with your consent. For example, you might authorize third parties to access your information for financial services like account aggregation, payments, or tax preparation. Their privacy policies govern the use of your data. We may block third-party access without notice for security reasons.

Please see our consumer Privacy Policy for more information on how we may share information with affiliates and third parties that was collected when you seek, apply for, or obtain a financial product or service with us.

Online Advertising

We advertise online and offline. In order to understand how advertising performs, we may collect certain information on our Sites and other sites and mobile apps through our advertising service providers. We use collection and tracking technologies from third-party partners for marketing purposes that allow us to display promotional material to you on other sites you visit across the internet. We may also share IP addresses and other information. The collected information may include the number of page visits, pages viewed on our Sites, search engine referrals, browsing activities over time and across other sites following your visit to one of our Sites, and responses to advertisements and promotions on the Sites and on sites where we advertise. We use such information to present tailored ads to you.

Relationship-Based Advertising

To help make our advertising informative and useful, we may use information about your relationship with us (such as types of accounts, transactional information or the city in which you bank) to help determine which advertisements or offers to present to you.

Online Behavioral Advertising

We or our advertising service providers may use certain information about your activities on our Sites and other websites, such as pages visited and search key words entered to help determine which of our advertisements or offers may be of interest to you. We limit access and collection of information for specific purposes by advertising service providers. We may use this online information for online and offline advertising.

Advertising on Third-Party Sites and Mobile Apps

We contract with advertising companies to advertise our products and services on sites and mobile apps not affiliated with us. These companies use non-personally-identifiable information (e.g., click stream information, browser type, time and date, subject of advertisements clicked or scrolled over, hardware/software information, cookies and session ID) and personally-identifiable information (e.g., static IP address) during your visits to this and other websites in order to provide advertisements about goods and services likely to be of greater interest to you or advertising-related services, such as ad delivery, reporting, attribution, analytics, and market research. These parties typically use a cookie, pixel, web beacon or other similar tracking technologies to collect this information. Third party sites and mobile apps are not subject to Citizens State Bank privacy notices. We do not control these third parties’ data collection and tracking technologies or how they may be used. Please visit the individual sites and mobile apps for additional information on their data and privacy practices and opt out policies.

Social Media

We may participate in programs offered by various social media platforms, which enable us to display personalized ads to persons on our email list when they visit such platforms, respectively. We may provide personal information, such as your email address and phone number, to the social media provider to enable it to determine if you are a registered account holder. You may opt out of participation in this program by contacting us as at 888-529-5450. You may also opt out of receiving these ads from the social media network(s) directly.

You may set your advertising choices in the following ways:

[Universal Opt-Out: We support the Global Privacy Control (GPC) for www.mycsbin.com, which is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When we detect a GPC signal from a browser, our www.mycsbin.com treats the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser.]

Interest-Based Advertising: We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving some targeted ads by visiting the Digital Advertising Alliance Opt Out Page, Network Advertising Initiative Opt Out Page, and TrustArc Preference Manager and by adjusting the privacy settings on your mobile device.

Manage Cookies on Your Device: You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly. Please note that due to a lack of consistent standards across browsers, our Site does not respond to “do not track” browser settings.

Google: The Site sends aggregated information to Google Analytics for the purpose of providing us with the ability to conduct technical and statistical analysis on the Site’s performance. Google also uses pixels and cookies to track user behavior and personalize ads. Please review Google’s privacy policy for more information on Google’s privacy practices: https://policies.google.com/privacy. You can opt-out of having your Site activity available to Google Analytics by installing the Google Analytics opt-out browser add-on if you are using the Chrome browser: https://chromewebstore.google.com/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh?hl=en. You can manage your advertising preferences on Google sites and apps (including YouTube) here: https://myadcenter.google.com/.

HubSpot: The Site sends aggregated information to HubSpot for the purpose of providing us with the ability to conduct technical and statistical analysis on the Site’s performance. HubSpotot also uses pixels and cookies to track user behavior and personalize ads. Please review HubSpot’s privacy policy for more information on HubSpot’s privacy practices: https://legal.hubspot.com/privacy-policy.

Meta (Facebook and Instagram): The Meta pixel relies on Facebook and Instagram cookies, which enable Meta to match Site visitors to their respective Facebook and Instagram user accounts to deliver targeted advertisements. The Meta Pixel also allows us to track the effectiveness of Facebook and Instagram ads for statistical and market research purposes. Please review Meta’s privacy policy for more information on Meta’s privacy practices: https://www.facebook.com/policy.php and https://privacycenter.instagram.com/policy. You can manage your advertising preferences on Facebook and Instagram here: https://accountscenter.facebook.com/ads/ and https://accountscenter.instagram.com/ads/.

LinkedIn: The LinkedIn Insight Tag allows us to optimize our marketing campaigns on LinkedIn and retarget advertisements on LinkedIn to visitors of our Site. For more information on the LinkedIn Privacy Policy, go to https://www.linkedin.com/legal/privacy-policy. You can opt out of retargeting on LinkedIn here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

X (Twitter): X pixels and cookies share information about your interactions on our Site, which enable X to match Site visitors to X user accounts to deliver targeted advertisements. X pixels and cookies also allow us to track the effectiveness of X ads for statistical and market research purposes. Please review X’s privacy policy for more information on X’s privacy practices: https://x.com/en/privacy. You can manage your advertising preferences on X here: https://help.x.com/en/safety-and-security/privacy-controls-for-tailored-ads.

Bank-managed Direct Marketing: If you prefer we not deliver you marketing offers in email, postal mail or through telemarketing, you may manage your direct marketing choices by telephone at 888-529-5450.

Important Reminder: For online behavior advertising opt outs from our Sites and on other sites to work on your device, your browser must be set to accept cookies. If you delete cookies, buy a new device, access our Site or other sites from a different device, login under a different screen name, or change web browsers, you will need to opt out again. If your browser has scripting disabled, you do not need to opt out, as online behavioral advertising technology does not work when scripting is disabled. Please check your browser’s security settings to validate whether scripting is active or disabled.

Linking to Other Sites

We may provide links to third party sites. This Policy does not apply to third party sites. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions, as they may differ from those of our Sites. For more information regarding links to other sites, see our Terms of Use.

Social Media Sites

We may provide experiences on social media platforms that enable online sharing and collaboration among users who have registered to use them. Any content you post on official Citizens State Bank managed social media pages, such as pictures, information, opinions, or any personal information that you make available to other participants on these social platforms, is subject to the Terms of Use and Privacy Policies of those respective platforms. Please refer to them to better understand your rights and obligations regarding such content. In addition, please note that when visiting any official Citizens State Bank social media pages, you are also subject to any of Citizens State Bank’s terms and policies regarding social media. Whenever you visit a third-party website, you should review its privacy notice.

Aggregated Information and Digital Analytics

We collect information about your digital browsing experience through third-party analytics services for threat-monitoring and digital performance measurement. This information is not personally identifiable and is used in-aggregate to provide enhanced digital experiences. This information may include, but is not limited to, the type of device being used, type of browser being used and type of operating system. We may use this aggregate and anonymous data for various business purposes, where permissible by law and regulations.

Security

To protect personal information from unauthorized access and use, we use security measures that comply with applicable federal and state laws. We will use reasonable organizational, physical, technical and administrative measures to protect personal information within our organization. These measures may include device safeguards and secured files and facilities security to ensure information remains confidential and secure. We maintain customer authentication procedures to protect your personal information and accounts from identity theft.

Using Other Aggregation Websites

Other companies offer aggregation websites and services that allow you to consolidate your financial account information from different sources (such as your accounts with us or with other financial institutions) so that you can view all of your account information at one online location. To do this, an aggregation provider may request access to personal information, such as financial information, usernames and passwords. You should use caution and ensure that the aggregation provider has appropriate policies and practices to protect the privacy and security of any information you provide or to which they are gaining access. We are not responsible for the use or disclosure of any personal information accessed by any company or person to whom you provide any Site username and password. If you provide any Site username, password, or other information about your accounts with us to an aggregation website, we will consider that you have authorized all transactions or actions initiated by an aggregation website using access information you provide whether or not you were aware of a specific transaction or action.

If you decide to revoke the authority you have given to an aggregation website, we encourage you to revoke access through our online banking platform. This can be done through the "Settings" within our online banking platform. Additionally, we encourage you revoke authorization to receive your information directly with any third party you have authorized.

Making Sure Information is Accurate

Keeping your account information accurate and up to date is very important. If your account information is incomplete, inaccurate or not current, please use the “Contact Us” option on our Site or call or write to us at the telephone numbers or appropriate address for changes listed on your account statements, records, online or other account materials. You can also speak to a customer representative at one of our banking centers.

Protecting Children’s Privacy Online

Our Sites are not intended for use by or directed to individuals under the age of thirteen (13), and we do not knowingly collect personal information from such children. We request that these individuals do not provide personal information through any of our Sites. Visit the Federal Trade Commission website for more information about the Children’s Online Privacy Protection Act (COPPA).

Accessing, Modifying or Deleting Your Information

In certain jurisdictions, you may have a right to access your personal data, correct inaccurate data, or delete your personal data. You may contact us directly to request access to, modify, or delete your information. You should be aware, however, that we may not be able to provide access to, modify, or delete your information in all circumstances.

Under federal and state banking laws and regulations, it may be a violation of law for us to delete your information. Banks are required to implement customer identification programs and other measures in order to limit money laundering. These programs and other measures require banks to obtain and retain checking and savings account customer data, including contact, identification and tax information. FDIC and bank Secrecy Act regulations stipulate that banks must keep this information for at least five years after the account is closed.

Policy Updates and Effective Date

This Policy is subject to change. Please review it periodically. If we make updates or changes to this Policy, we will update the Policy with the changes and revise the “date of most recent update” posted at the top of this Policy. Any updates to the Policy become effective when we post the updates on the Site. To the extent permitted by applicable law, your use of the Site following the update to the Policy means that you accept the updated Policy.