Online Privacy Notice

Last Updated: February 12, 2024

Live Oak Banking Company (“Live Oak”) respects your privacy. This Online Privacy Notice describes the types of personal information we obtain on our websites (“Sites”) and mobile applications (“Mobile Apps”) (collectively, “Online Services”), how we use the information, with whom we may share it and the choices available to you regarding our use of the information. We also describe measures we take to protect the information and how you can contact us about our privacy practices.

Unless indicated otherwise, this Online Privacy Notice applies solely to our Online Services. Live Oak also provides certain individuals with supplemental privacy notices, as described below:

• Financial Privacy Notice: If you are a consumer who has a financial product or service with Live Oak, please see our U.S. Consumer Privacy Notice, which federal law requires us to give to certain consumers to explain what we do with their personal information, how we may share it and how the law allows consumers to limit our sharing of the information.
• Notices for California Residents: If you are a California resident, please see our California Consumer Privacy Statement .

We obtain certain personal information about you when you interact with our Online Services, including:

• Contact information, such as name, telephone number and postal and email address;
• Login credentials, such as username and password; fingerprint or other biometric identifiers used to support or enable authentication;
• Account information, financial history and transaction information, such as account number, loan number, routing number and other unique customer identification numbers, credit or debit card information, account balances, payment history, insurance information, income information, assets and investment experience;
• If you are using our Mobile Apps, you may choose to provide access to your device’s: (1) contact list and images, to enable you to engage in transactions with your contacts and (2) camera, photos, pictures, and images, to enable you to engage in mobile deposits and personalize your account profile;
• Demographic information and similar details, such as age, nationality, citizenship status, date of birth, signature, education or professional information, marital status, sex, gender and military or veteran status;
• Government-issued identification information, such as Social Security number or tax identification number, passport or driver’s license data, and other information related to government-issued identification;
• Location information based on services you request, such as helping you locate the nearest ATM (we will obtain your consent before collecting fine or precise geolocation information);
• Information provided by identity verification and fraud prevention platforms;
• Publicly-available information, such as from social media services; and
• Other information you choose to provide, such as through emails or other communications, social media pages, surveys, registrations and sign-up forms.

Sites: When you visit our sites, we may obtain certain information by automated means, such as cookies, web beacons, web server logs, session replay and screen capture technology, and other technologies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an internet tag, pixel tag or clear GIF, links web pages to web servers and cookies and may be used to transmit information collected through cookies back to a web server. The information we collect in this manner may include your device IP address, unique device identifier, web browser characteristics, device characteristics, operating system, language preferences, referring URLs, clickstream data, and dates and times of website visits.

We also may use session replay and screen capture technology to collect, on a real-time basis, information on how you use and navigate the sites. This may include mouse movements, how you scroll through the sites, and certain keystroke information.

Mobile Apps: When you use our Mobile Apps, we also may collect certain information by automated means, such as through device logs, server logs and other technologies. The information we collect in this manner may include the device type used, the mobile operating system, device identifiers and similar unique identifiers, device settings and configurations, IP addresses, WiFi network identifiers and signals, battery and signal strength, usage statistics, referring emails and web addresses, dates and times of usage, actions taken on the Mobile Apps, and other information regarding use of the Mobile Apps. In addition, as indicated above, we may collect your device’s geolocation information with your consent which assists us with the security of the products and services and assists us with offering features like search results for branch and ATM locations, credit card controls, and messages based on your general location. Please note that if you decline to allow the Mobile Apps to collect your fine or precise geolocation, you may not be able to use all of the Mobile Apps’ features or the offers available through the Mobile Apps.

We may use these automated technologies on our Online Services to collect information about your equipment, browsing actions, and usage patterns. These technologies help us (1) remember your information so you do not have to re-enter it; (2) track and understand how you use and interact with our Online Services; (3) tailor the Online Services around your preferences; (4) measure the usability of our Online Services and the effectiveness of our communications; and (5) otherwise manage and enhance our products and services, and help ensure they are working properly.

Your browser may tell you how to be notified about certain types of automated collection technologies and how to restrict or disable them. Please note, however, that without these technologies, you may not be able to use all of the features of our Online Services. For mobile devices, you can manage how your device and browser share certain device data by adjusting the privacy and security settings on your mobile device.

As part of our ongoing efforts to protect your information, we may place a private key on your device to help us identify the device as belonging to you. The use of a private key on your device assists you in conducting your online banking transactions.

We may use the personal information we obtain to:

• Provide our products and services;
• Process and fulfill transactions in connection with our products and services;
• Communicate with you (including providing you with offers and other communications about our products and services), respond to inquiries and offer customer support;
• Establish and manage accounts;
• Report to credit bureaus;
• Verify your identity;
• Personalize your experience on our Online Services;
• Advertise and market our products and services;
• Administer participation in surveys, sweepstakes, promotions or other programs;
• Establish and manage our business relationships;
• Provide products and services to our B2B clients and facilitate their end-users’ use of our products and services;
• Perform analytics (including, but not limited to, market research, trend analysis, financial analysis, and analysis of our customer base), and anonymization of personal information;
• Ensure that our products and services are working as intended, such as tracking outages or troubleshooting issues that you report to us;
• Operate, evaluate and improve our business (including developing new products and services; enhancing, improving and analyzing our products and services; managing our communications; and performing accounting, auditing and other internal functions);
• Authenticate an online transaction or assist you in conducting your online transactions;
• Maintain and enhance the safety and security of our Online Services, products and services and prevent misuse;
• Exercise our rights and remedies and defend against legal claims;
• Protect against, identify and prevent fraud and other criminal activity, claims and other liabilities;
• Comply with and enforce applicable legal requirements, relevant industry standards and Live Oak policies, including, but not limited to, those relating to anti-money laundering, economic sanctions, and anti-terrorism; and
• Comply with and enforce any relevant terms of use located on our Online Services.

As described in the “Information We Obtain” section of this Online Privacy Notice, if you use our Mobile Apps, you may choose to provide access to your device’s: (1) contact list and images, to enable you to transact with your contacts and (2) camera, photos and images, to enable you to engage in mobile deposits and personalize your account profile.

We also may use the information in other ways for which we provide specific notice at the time of collection.

Third-Party Analytics Services

We may use third-party analytics services on our online services, such as Google Analytics. We also may use third-party session replay and screen capture services that record users’ interactions with the sites. The providers of these analytics services use technologies such as cookies, web beacons, session replay and screen capture technology, and similar automated technologies to help us analyze your use of the online services. The information we obtain through the online services may be disclosed to or collected directly by these services. To learn more about Google Analytics, please visit https://www.google.com/policies/privacy/partners/.

Interest-Based Advertising

On our online services, we may obtain information about your online activities to provide you with advertising about products and services that may be tailored to your interests. This section of our online privacy notice provides details and explains how to exercise certain choices.

You may see our ads on other websites because we use third-party ad services. Through these ad services, we can target our messaging to users considering demographic data, users’ inferred interests and browsing context. These services track your online activities over time and across multiple websites and apps by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other similar technologies. The ad services use this information to show you ads that may be tailored to your individual interests. The information that ad services may collect includes data about your visits to websites that serve Live Oak advertisements, such as the pages or ads you view and the actions you take on the websites or apps. This data collection takes place both on our online services and on third-party websites and apps that participate in these ad services. This process also helps us track the effectiveness of our marketing efforts.

The online services are not designed to respond to “do not track” signals from browsers.

To learn how to opt out of interest-based advertising, please visit the Digital Advertising Alliance, the Network Advertising Initiative and TRUSTe Advertising Choices .

We may share the information we obtain about you with our affiliates and subsidiaries and with our business partners. We also may share the information we obtain about you with third-party vendors and other entities to perform services on our behalf, such as website hosting, data analytics, marketing, payment processing, fraud prevention, and other services. In addition, we may share personal information with (1) other financial institutions; (2) accounting services; (3) other companies in connection with co-branded products, services or programs; and (4) consumer reporting agencies.

We also may disclose personal information (1) if we are required to do so by law or legal process (such as a court order or subpoena); (2) in response to requests by government agencies, such as law enforcement authorities, or self-regulatory organizations; (3) to establish, exercise or defend our legal rights and those of our affiliates, subsidiaries or business partners; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (5) in connection with an investigation of suspected or actual illegal activity; or (6) otherwise with your consent or as directed by your representative.

We reserve the right to transfer any personal information we have about you in the event of an actual or prospective sale or transfer of all or a portion of our business or assets (including in the event of an actual or prospective merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

We offer you certain choices in connection with the personal information we collect from you. You can unsubscribe from our marketing mailing lists by following the “Unsubscribe” link in our emails. You also may be able to update certain aspects of your account details and settings by logging into your account on our Online Services.

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide against accidental, unlawful or unauthorized access, destruction, loss, alteration, disclosure, disposal or use.

Our Online Services are designed for a general audience and are not directed to children. We do not knowingly collect personal information online from children under the age of 13, or such other age as may be stipulated by applicable law.

For your convenience and information, our Online Services may provide links to other online services, and may include third-party features such as apps, tools, widgets and plug-ins. These online services and third-party features may operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, are subject to the privacy statements of these parties, which we strongly suggest you review. To the extent any linked online services or third-party features are not owned or controlled by us, we are not responsible for these third parties’ information practices.

This Online Privacy Notice may be updated periodically and without prior notice to you to reflect changes in our personal information practices. We will post a notice on our Online Services to notify you of significant changes to our Online Privacy Notice and indicate at the top of the Online Privacy Notice when it was most recently updated.