This policy serves as formal documentation of [YU FINANCIAL ADVICE]’s ongoing commitment to the privacy of its customers. All employees will be expected to read, understand, and abide by this policy and to follow all related procedures to uphold the standards of privacy and security set forth by [YU FINANCIAL ADVICE]. This Policy, and the related procedures contained herein, is designed to comply with applicable privacy laws, including the GLBA, and to protect nonpublic personal information of [YU FINANCIAL ADVICE]’s customers.
Scope of Policy
Overview of the Guidelines for Protecting Customer Information
In Regulation S-P, the Securities and Exchange Commission (the “SEC”) published guidelines, pursuant to section 501(b) of the GLBA, which address the steps a financial institution should take in order to protect customer information. The overall security standards that must be upheld are:
- Ensure the security and confidentiality of customer records and information;
- Protect against any anticipated threats or hazards to the security or integrity of customer records and information; and
- Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.
- Each employee has a duty to protect the nonpublic personal information of customers collected by [YU FINANCIAL ADVICE].
- No employee is authorized to disclose or use the nonpublic information of customers on behalf of [YU FINANCIAL ADVICE].
- Each employee has a duty to ensure that nonpublic personal information of [YU FINANCIAL ADVICE]’s customers is shared only with employees and others in a way that is consistent with [YU FINANCIAL ADVICE]’s Privacy Notice and the procedures contained in this Policy.
- Each employee has a duty to ensure that access to nonpublic personal information of [YU FINANCIAL ADVICE]’s customers is limited as provided in the Privacy Notice and this Policy.
- No employee is authorized to sell, on behalf of [YU FINANCIAL ADVICE] or otherwise, nonpublic information of [YU FINANCIAL ADVICE]’s customers.
- Employees with questions concerning the collection and sharing of, or access to, nonpublic personal information of [YU FINANCIAL ADVICE]’s customers must look to [YU FINANCIAL ADVICE]’s CCO for guidance.
Violations of these policies and procedures will be addressed in a manner consistent with other Company disciplinary guidelines.
Types of Permitted Disclosures – The Exceptions
Regulation S-P contains several exceptions, which permit [YU FINANCIAL ADVICE] to disclose customer information (the “Exceptions”). For example, [YU FINANCIAL ADVICE] is permitted under certain circumstances to provide information to non-affiliated third parties to perform services on [YU FINANCIAL ADVICE]’s behalf. In addition, there are several “ordinary course” exceptions, which allow [YU FINANCIAL ADVICE] to disclose information that is necessary to effect, administer, or enforce a transaction that a customer has requested or authorized. A more detailed description of these Exceptions is set forth below.
- Service Providers. [YU FINANCIAL ADVICE] may from time to time have relationships with nonaffiliated third parties that require it to share customer information in order for the third party to carry out services for [YU FINANCIAL ADVICE]. These nonaffiliated third parties would typically represent situations where [YU FINANCIAL ADVICE] or its employees offer products or services jointly with another financial institution, thereby requiring [YU FINANCIAL ADVICE] to disclose customer information to that third party. Every nonaffiliated third party that falls under this exception is required to enter into an agreement that will include the confidentiality provisions required by Regulation S-P, which ensure that each such nonaffiliated third party uses and re-discloses customer nonpublic personal information only for the purpose(s) for which it was originally disclosed.
- Processing and Servicing Transactions. [YU FINANCIAL ADVICE] may also share information when it is necessary to effect, administer, or enforce a transaction for our customers or pursuant to written customer requests. In this context, “Necessary to effect, administer, or enforce a transaction” means that the disclosure is required, or is a usual, appropriate, or acceptable method.
- To carry out the transaction or the product or service business of which the transaction is a part, and record, service, or maintain the consumer’s account in the ordinary course of providing the financial service or financial product.
- To administer or service benefits or claims relating to the transaction or the product or service of which it is a part.
- To provide a confirmation, statement, or other record of the transaction, or information on the status or value of the financial service or financial product to the consumer or the consumer's agent or broker; or
- To accrue or recognize incentives or bonuses associated with the transaction that is provided by [YU FINANCIAL ADVICE] or any other party.
Sharing as Permitted or Required by Law[YU FINANCIAL ADVICE] may disclose information to nonaffiliated third parties as required or allowed by law. This may include, for example, disclosures in connection with a subpoena or similar legal process, a fraud investigation, recording of deeds of trust and mortgages in public records, an audit, or examination, or the sale of an account to another financial institution. [YU FINANCIAL ADVICE] has taken the appropriate steps to ensure that it is sharing customer data only within the above noted Exceptions. [YU FINANCIAL ADVICE] has achieved this by understanding how [YU FINANCIAL ADVICE] shares data with its customers, their agents, service providers, parties related to transactions in the ordinary course or joint marketers.
Safeguarding of Client Records and Information[YU FINANCIAL ADVICE] has implemented internal controls and procedures designed to maintain accurate records concerning customers’ personal information. [YU FINANCIAL ADVICE]’s customers have the right to contact [YU FINANCIAL ADVICE] if they believe that Company records contain inaccurate, incomplete, or stale information about them. [YU FINANCIAL ADVICE] will respond in a timely manner to requests to correct information. To protect this information, [YU FINANCIAL ADVICE] maintains appropriate security measures for its computer and information systems, including the use of passwords and firewalls.
Additionally, [YU FINANCIAL ADVICE] will use shredding machines, locks and other appropriate physical security measure to safeguard client information stored in paper format. For example, employees are expected to discard documents not required to be kept by placing them in the appropriate bin for shredding.[YU FINANCIAL ADVICE] protects confidential client information including but not limited to consumer report or any compilation of consumer report information derived from a consumer report by maintaining some information in locked areas and shredding such information when then information is no longer needed by [YU FINANCIAL ADVICE].
Security Standards[YU FINANCIAL ADVICE] maintains physical, electronic, and procedural safeguards to protect the integrity and confidentiality of customer information. Internally, [YU FINANCIAL ADVICE] limits access to customers’ nonpublic personal information to those employees who need to know such information in order to provide products and services to customers. All employees are trained to understand and comply with these information principles.
Privacy Notice[YU FINANCIAL ADVICE] has developed a Privacy Notice, as required under Regulation S-P, to be delivered to customers initially and on an annual basis. The notice discloses [YU FINANCIAL ADVICE]’s information collection and sharing practices and other required information and has been formatted and drafted to be clear and conspicuous. The notice will be revised as necessary any time information practices change. A copy of [YU FINANCIAL ADVICE]’s Privacy Notice is available on [YU FINANCIAL ADVICE]’s website.
- Privacy Notice Delivery
- Initial Privacy Notice - As regulations require, all new customers receive an initial Privacy Notice at the time when the customer relationship is established, for example on execution of the agreement for services.