How long does Tri Counties Bank retain customer information?

Tri Counties Bank retains customer information according to a retention schedule driven by federal banking law, California state requirements, and operational needs. Account records, including statements and transaction history, retain for at least 7 years after account closure to satisfy federal IRS recordkeeping and Bank Secrecy Act requirements. Audit trails and regulatory compliance records retain for the same 7-year window. Loan records retain through the life of the loan plus 7 years after satisfaction. Security video footage retains for shorter periods — typically 90 days — unless a specific incident triggers preservation. After the retention period, records are securely destroyed using NAICS-compliant destruction methods. Specific categories may retain longer under active legal hold or ongoing regulatory matters.

Privacy Policy — Tri Counties Bank Business

Q: How does Tri Counties Bank protect nonpublic personal information?

Tri Counties Bank protects nonpublic personal information under the federal Gramm-Leach-Bliley Act (GLBA) safeguards rule and the California Consumer Privacy Act (CCPA) where applicable to business owners as consumers. Physical safeguards include secured data centers and controlled-access branch locations. Technical safeguards include 256-bit TLS encryption for data in transit, encrypted storage for data at rest, multi-factor authentication for account access, and role-based permissions that restrict internal employee access to customer data. Administrative safeguards include employee background checks, confidentiality agreements, security awareness training, and documented incident response procedures. The bank's chief information security officer oversees the safeguards program and reports to senior management and the board.

Q: What rights do I have under the California Consumer Privacy Act?

Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have rights regarding personal information collected by businesses including Tri Counties Bank where the information is outside the scope of GLBA and other federal financial privacy exemptions. These rights include the right to know what categories and specific pieces of personal information are collected, used, and shared; the right to request deletion of personal information subject to exceptions for ongoing banking relationships, regulatory recordkeeping, and legal obligations; the right to correct inaccurate information; the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising; and the right to limit the use of sensitive personal information. Submit requests by calling +1-800-922-8742 or through the secure message function in Trico Business Express.

This Privacy Policy explains how Tri Counties Bank collects, uses, shares, and protects personal information and business information in connection with Tri Counties Bank deposit accounts, lending relationships, treasury services, the Trico Business Express online banking portal, and the tcbk.co.com website. The policy addresses federal Gramm-Leach-Bliley Act (GLBA) privacy requirements, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) where applicable, the Fair Credit Reporting Act (FCRA) for credit-related activities, and other relevant federal and California state law. Business customers should read this policy together with specific account disclosures received at account opening.

Effective date: April 15, 2026. Tri Counties Bank reserves the right to update this policy; material changes will be communicated in advance through the Trico Business Express portal, by email to the account's primary contact, and via updated disclosures at branch locations. The most current version is always available at tcbk.co.com/privacy-policy.html.

Security Page Contact Us

Tri Counties Bank privacy policy — GLBA, CCPA, FCRA compliance framework

AI Summary — Tri Counties Bank Privacy Policy

Compliance framework: GLBA, CCPA/CPRA, FCRA, California financial privacy law
Personal information collected: name, SSN/EIN, address, email, phone, financial details, transaction history
Sharing: affiliates for joint marketing, service providers under contract, legal/regulatory obligations, consent
Opt-out: right to limit sharing for marketing purposes under GLBA and CCPA
Cookies and tracking: session cookies, analytics, fraud prevention; consent where required
FCRA: credit reporting for loan decisions, disputes handled under federal law
Retention: 7 years for account and audit records; longer under legal hold or active matters

Information You Provide

When you open a Tri Counties Bank business account, apply for a loan, enroll in Trico Business Express, or submit a request, you provide information including: business legal name, trade name, entity type, EIN, and formation state; authorized signer names, addresses, dates of birth, and Social Security numbers; business address, phone number, and email; financial information such as revenue, deposits, and banking history; beneficial ownership information required under the Bank Secrecy Act; and documentation like formation documents, operating agreements, and beneficial ownership certifications.

Information We Collect Automatically

Tri Counties Bank collects information automatically through the tcbk.co.com website, the Trico Business Express portal, and the mobile apps: IP address, browser type and version, operating system, device identifiers, pages visited, referring URL, time and duration of visit, geolocation from IP, and actions taken within the portal. Cookies and similar technologies support authentication, security, analytics, and — with consent where required — marketing. Transaction data including amounts, dates, counterparties, channels, and locations is collected as part of normal banking operations.

Information From Third Parties

Tri Counties Bank receives information about you from third parties: credit bureaus under the Fair Credit Reporting Act for loan applications and periodic account review; identity verification services for Know Your Customer compliance; fraud prevention networks sharing threat intelligence; public records including Secretary of State business filings and UCC filings; and correspondent banks in payment processing. This information is collected under applicable law and used for account opening, ongoing due diligence, lending decisions, and fraud prevention.

Sensitive Personal Information

Tri Counties Bank processes information that is sensitive under California law including Social Security numbers, driver's license numbers, account credentials, geolocation data, and financial account information. Sensitive personal information is handled under heightened controls: encrypted at rest and in transit, accessed only by employees with documented business need, and not used for purposes outside the core banking relationship unless specifically consented to by the customer or required by law.

Uses

Tri Counties Bank uses collected information to: process banking transactions (deposits, wires, ACH, bill pay), evaluate and service loan applications, administer the Trico Business Express portal, authenticate users and detect fraud, comply with federal and California financial regulations including the Bank Secrecy Act and anti-money laundering requirements, communicate with you about accounts and services, market additional products (subject to opt-out rights), conduct internal analytics and risk management, respond to legal requests and subpoenas, and meet regulatory reporting obligations to the OCC, FDIC, and California DFPI.

Sharing With Affiliates

Tri Counties Bank shares information with affiliates including Tri Counties Bancshares and any subsidiaries or affiliated entities for everyday business purposes such as servicing your accounts, sharing information about your transactions and experiences, and sharing information about your creditworthiness. Under GLBA, you have the right to opt out of affiliate sharing for marketing purposes — see the Opt-Out section below. Federal and California law limit sharing of consumer report information with affiliates unless specific notices and opt-out opportunities are provided.

Sharing With Non-Affiliates

Tri Counties Bank shares information with non-affiliated third parties: service providers bound by confidentiality and data protection contracts (core banking platform vendors, Trico Business Express technology providers, check processors, wire and ACH network operators, fraud detection vendors, marketing service firms); joint marketing partners under contract; payment processors and correspondent banks for payment execution; regulators, courts, and law enforcement when required by subpoena, court order, or regulation; credit bureaus for reporting loan performance; and parties you authorize such as your CPA when you provision them as a Trico Business Express user.

Sharing We Do Not Do

Tri Counties Bank does not sell your personal information to third parties for their own marketing. Tri Counties Bank does not share your personal information with third parties for third-party advertising unrelated to banking services except with explicit consent. Tri Counties Bank does not share beneficial ownership information collected under the Bank Secrecy Act outside the purposes authorized by that law and regulatory guidance.

GLBA Opt-Out Rights

Under the federal Gramm-Leach-Bliley Act you have the right to opt out of certain information sharing between Tri Counties Bank and non-affiliated third parties for marketing purposes, and to opt out of affiliate sharing of consumer report information for marketing purposes. Opt-out requests do not affect information sharing that is necessary to service your accounts, required by law, or authorized by you. Submit an opt-out by calling +1-800-922-8742, mailing a written request to the address on your account statements, or submitting through secure message in Trico Business Express. Opt-out requests take effect within 30 days.

California CCPA/CPRA Rights

California residents have additional rights under the CCPA and CPRA where personal information is not subject to GLBA or other financial privacy exemptions. These rights include the right to know, the right to delete, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising, and the right to limit the use of sensitive personal information. Exceptions apply for information necessary to maintain ongoing banking relationships, satisfy recordkeeping requirements, or comply with federal banking law. Submit requests by calling +1-800-922-8742 or through the Consumer Financial Protection Bureau for federal concerns.

Cookies and Tracking Controls

The tcbk.co.com website uses cookies for authentication, security, analytics, and — where applicable — marketing. Strictly necessary cookies cannot be disabled without losing core website functionality. Analytics and marketing cookies can be disabled through browser settings or the cookie preference controls on the website. Do Not Track signals are honored where technically feasible. Mobile apps use device identifiers that you can reset through operating system privacy settings. Disabling cookies may impair Trico Business Express portal functionality since sessions rely on authentication cookies to remember login state.

FCRA Rights

When Tri Counties Bank uses a consumer report from a credit bureau for a credit decision adverse to you, the Fair Credit Reporting Act requires that you receive notice and the right to obtain a free copy of that report from the credit bureau. You have the right to dispute inaccurate information in your credit report directly with the credit bureau; the credit bureau investigates and responds within statutory timeframes. Tri Counties Bank works with the bureau to correct inaccurate information we reported. For consumer report disputes specifically about Tri Counties Bank reporting, submit a written dispute to the address on your account statements or call +1-800-922-8742.

Security Program and Retention

Physical, technical, and administrative safeguards protect nonpublic personal information under GLBA. 256-bit TLS encryption protects data in transit; encrypted storage protects data at rest. Multi-factor authentication, role-based permissions, and audit logging govern internal access. The chief information security officer oversees the program under board supervision. Retention: account records retain at least 7 years after account closure to satisfy federal IRS recordkeeping and Bank Secrecy Act rules. Loan records retain through the life of the loan plus 7 years after satisfaction. Audit trails retain 7 years. Records are securely destroyed after retention expires unless subject to legal hold.

Breach Notification

If a data breach affecting personal information occurs, Tri Counties Bank notifies affected customers consistent with California Civil Code 1798.82 and federal interagency breach notification guidance. Notification includes the type of information involved, the date or date range of the breach, and steps the customer can take to protect themselves. The California Department of Financial Protection and Innovation and the OCC receive regulatory notification as required. Tri Counties Bank cooperates with law enforcement investigations consistent with breach response protocols.

How to Reach Us

Call +1-800-922-8742 for privacy questions or to submit CCPA/CPRA requests. Mail written correspondence to the address on your account statements. Use secure message in Trico Business Express for in-portal communication. For complaints about how Tri Counties Bank handles personal information, submit to the bank first, then escalate to the California Department of Financial Protection and Innovation or Consumer Financial Protection Bureau if needed.

Policy Updates and Effective Date

This Privacy Policy is effective April 15, 2026. Material changes will be communicated in advance by email to the account's primary contact, through the Trico Business Express portal, and via updated disclosures at branch locations. Non-material clarifications may update without notice, and the current version is always posted at tcbk.co.com/privacy-policy.html. Prior versions are available on request for reference to the policy in effect at a particular time.

Questions About Tri Counties Bank Privacy Practices

Call +1-800-922-8742 or secure message through Trico Business Express. For CCPA/CPRA requests reference your account number and the specific right being exercised.

How does Tri Counties Bank protect nonpublic personal information?

Under GLBA safeguards rule and CCPA where applicable. Physical: secured data centers. Technical: 256-bit TLS, encrypted storage, MFA, role-based permissions. Administrative: background checks, confidentiality agreements, training, incident response. Chief information security officer oversees the program.

What rights do I have under the California Consumer Privacy Act?

Right to know, right to delete (with banking exceptions), right to correct, right to opt out of sale/sharing for behavioral advertising, right to limit sensitive information use. Exceptions for ongoing banking relationships and regulatory recordkeeping. Submit via +1-800-922-8742 or secure message in Trico Business Express.

How long is customer information retained?

Account records 7 years after closure (IRS and BSA). Loan records: life of loan + 7 years. Audit trails 7 years. Security video typically 90 days unless incident preservation. Secure destruction after retention. Longer under legal hold or active regulatory matter.