BMI Federal Credit Union Privacy Policy

Effective Date: August 17, 2026

We value your privacy and respect your choices. This Privacy Policy describes our policies on the collection, use, and disclosure of information about you, including through our Websites, App, Social Media Pages, and other communications with you. This Privacy Policy applies to our websites, microsites, and mobile versions of these websites, which include but are not limited to bmifcu.org (collectively, the "Websites") that expressly adopt and display or link to this policy as may be revised from time to time, and that are owned, operated, or controlled by BMI Federal Credit Union, its parents, affiliates, and subsidiaries (collectively, "BMI FCU", "we", "us", or "our"). "App" refers to our mobile application that we make available for download on your personal device. "Social Media Pages" are the official social media pages we operate on Facebook, X, YouTube, LinkedIn, Pinterest, Instagram, TikTok, and other social media platforms. If you have any questions about anything in this Privacy Policy, please email us at marketing@bmifcu.org.

Please note that this Privacy Policy does not address your rights under federal law with respect to your financial information. The collection, processing, and sharing of your financial information is governed by our BMI Federal Credit Union Privacy Notice.

INFORMATION WE COLLECT

We may collect the following categories of information about you:

• Contact Information: We may collect contact information, which includes personal information like name, email address, phone number, and physical address.
• Location Information: We may collect your location data in connection with your use of our Websites and App, including geolocation, beacon-based location, and GPS location. Our collection may depend on your device's settings for location services.
• Device Information: When you visit our Websites, use our App, interact with our Social Media Pages or online ads, or open our emails, we learn about your browser type and version, type of computer or mobile device, browser language, IP address, and other technical information about your device.
• Demographic Information: We may have access to demographic details about our Website and App users such as birth year, gender, zip code, and other similar details.
• Payment Details: We may collect your payment information, such as credit card number and expiration date, in connection with an order or your account.
• Call, Text, Mail, Chat, and Email Records: If you call, text, mail, chat, or email our customer service agents, we may keep records of those conversations. Our calls with you may be monitored and recorded for quality purposes.
• Website and App Interactions: We collect information about your interactions with our Websites or App including pages visited, interest in content, access times, search activity, the pages that you view, and other surfing behavior.
• Submitted Content: We collect any content you submit to our Websites, App, Social Media Pages, or to us in person including photos, videos, posts, or review contributions. This information could include personal information, depending on what information you provide.
• Profile Information: We may have access to profile details about consumers such as your preferences and online behavior.
• Job Applications: If you apply for employment, we have access to the content you provide such as your resume, cover letter, and any information contained therein. Your employment related information may include current or past job history or performance evaluations.
• Inferences: We may use any of the above information to draw inferences from these categories of information such as consumer preferences, behavior, and characteristics.
• Other information that we collect or you provide, such as when contacting us or through the course of visiting or using our Websites or App or otherwise interacting with us, including engaging with our Social Media Pages.

HOW WE COLLECT INFORMATION

We may collect the information described above directly from you, from third parties we partner with, or through cookies or other automated means. The categories of sources we collect information from include:

• You: We collect information directly from you, whenever you: visit our Websites; use our App; make a purchase; deposit checks or use other services; contact us with questions or comments; upload content or send attachments; enter our contests, sweepstakes, or promotions or contests or sweepstakes we are affiliated with; open or create an account; deposit money; apply for a loan or use your credit or debit card; update your account profile; write a review; or use or like our Social Media Pages.
• Your Device or Browser: Certain information is automatically collected from your device or browser and analyzed when you visit our Websites, use our App, or interact with our Social Media Pages or online advertising.
• Third Parties: We work with third parties who provide services to us such as payment processors, credit bureaus, analytics, research, or advertising companies. Your information may be collected and processed independently in accordance with the third parties' own privacy notices. These third parties may share information they have collected with us.
• Social Media Platforms: Social media platforms share information with us. You can learn more about how social media platforms collect and use your information by reviewing their privacy policies and settings.
• Cookies: We use cookies, web beacons, tags, scripts, pixels, and other similar technologies to automatically collect information when you visit our Websites or use our App.  We also contract with third party advertising or analytics companies to serve you online ads on other websites. These companies use cookies or similar technologies to collect information about your interactions with our Websites, App, and interactions with other websites. These advertising companies may use and share the information gathered to deliver ads more tailored to your interests. Any information collected by us or by third parties through the use of cookies or similar technologies may be linked with other information we collect about you. For a more thorough explanation of what cookies are and how they operate, please visit aboutcookies.org or allaboutcookies.org.

HOW WE USE THE INFORMATION WE COLLECT

We may use the information we collect for the following purposes:

• Fulfilling Your Requests: Fulfilling your orders, instructions, and other requests, including, but not limited to, processing your transactions, providing services to you, and populating forms for future transactions.
• Advertising: Presenting advertising online, by email, or through other communication channels, including through partnerships with social media platforms and internet search engines.
• Understanding Our Customers: Analyzing your activity with us (including your interactions with our Websites, Social Media Pages, App, and emails or other forms of communication), monitoring the effectiveness of our advertising and communications, and analyzing trends and statistics.
• Personalization: Using your preferences and other collected information to personalize our relationship with you, including presenting customized communication, advertising, and other experiences on our Websites, App, emails, and ads on social media.
• Communications: Communicating with you about our services, responding to your inquiries, and providing you certain administrative, promotional, transactional, or legal messages.
• Promotions: Running contests, sweepstakes, or other promotions.
• Considering You for Employment: We may use your information in connection with an application for employment with BMI.
• Customer Experience: Serving content on our Websites, App, and Social Media Pages, developing our services, and constantly improving our customers' experience, including but not limited to, troubleshooting customer service issues and improving Website and App functionality.
• Security: Protecting BMI and our customers from fraud, security threats, and other illegal or harmful activity.
• Legal Obligations: Complying with legal and regulatory requirements and responding to requests from courts or other government bodies.

HOW YOUR INFORMATION IS SHARED WITH SERVICE PROVIDERS AND THIRD PARTIES AND FOR WHAT PURPOSES

We may share personal information with third parties for certain purposes. For example, we share personal information with:

• Service Providers: We partner with third parties to assist with many aspects of our business, including providing you services, fulfilling your orders and requests, processing financial transactions, advertising, analyzing your interests and activity on our Websites, App, and Social Media Pages, and helping us communicate with you. These third parties may provide services related to any of the purposes described in HOW WE USE THE INFORMATION WE COLLECT, and we may share with them any types of information described in INFORMATION WE COLLECT. We may also receive information collected by these third parties and combine it with the information we have collected. These third parties process your information independently in accordance with their own privacy notices.
• Marketing Providers: We partner with third parties to assist with the advertising and marketing of our business. We may share with them the types of information described in INFORMATION WE COLLECT.
• Content Partners: We allow third party partners to use and display some of the public content available through the Websites and Apps, such as your reviews and other information.
• Other Third Parties: We will disclose information about you, including to government bodies or law enforcement agencies, when we believe it to be necessary for compliance with the law or to protect our Website or App users, our Websites or App, or the public.

YOUR PRIVACY CHOICES

You can control the information we collect and use in the following ways:

• Location Information: You can disable location-based services on your mobile device or web browser by adjusting the settings on your device or browser. This will prevent our Websites and App from accessing your location information. Note that some services may not be available if you disable location-based services, such as our map features.
• Emails: You can unsubscribe from emails by a link included in every such communication.
• Online Account: You can keep your contact information accurate and up to date by logging into your account on our Websites or App. If you wish to cancel your account, email us at marketing@bmifcu.org.
• Account Settings: When you sign up for an account or use certain features, you are opting to receive messages from other users, businesses, and from BMI FCU. You can manage some of your messaging preferences through your account settings, but note that you cannot opt out of receiving certain administrative, transactional, or legal messages from BMI FCU.
• Social Media: This Privacy Policy does not cover the privacy and security practices of social media platforms on which BMI has Social Media Pages. Please review the terms, policies, and settings of those social media platforms if you have questions about how they collect and use your data.
• Online Advertising: For information about opting out of third party advertising, visit: https://optout.networkadvertising.org or https://digitaladvertisingalliance.org. You will leave our Websites or App for a separately managed online site where you can specify your preferences. We may use more than one third party company for placing this advertising, which would require you to opt out of each company.
• Google Analytics: Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Websites. This data is shared with other Google services.  Google may use the collected data to contextualize and personalize the ads of its own advertising network. You can opt out of Google Analytics across all websites you use.  To do so, visit this website.  For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy.

CHILDREN'S PRIVACY

Our Websites, App, and Social Media Pages are intended for adults. We do not knowingly collect or retain any personal information from individuals under the age of 13 online. To learn more about the Children's Online Privacy Protection Act (COPPA) please visit the Federal Trade Commission's website at https://www.ftc.gov. To request the deletion of personal information relating to a child under the age of 13, please email us at marketing@bmifcu.org.

DATA RETENTION AND ACCOUNT TERMINATION

You can close your account by contacting us. We will delete your account, but we may retain information about you for the purposes authorized under this Privacy Policy unless prohibited by law. For example, we may retain information to prevent, investigate, or identify possible wrongdoing in connection with the Websites or App or to comply with our reporting or legal obligations.

We will retain your information for as long as necessary to fulfill the purpose for which your information was collected and in accordance with our internal retention procedures, or as otherwise necessary to satisfy our legal obligations. To determine the appropriate retention period for your information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of your information, the purposes for which we process your information, whether we can achieve those purposes through other means, and the applicable legal requirements.

SECURITY

We take steps to help protect the confidentiality and security of your personal information. Although we use measures to protect your personal information, in general, information transmitted through the Internet may not be completely secure. Accordingly, we cannot guarantee the security of information provided over the Internet. Your transmissions are, therefore, at your own risk. You can protect your information by selecting strong, unique passwords for the Websites, App, and any associated email addresses. If you have concerns about the security of your account, or wish to alert us of any potential vulnerabilities, please contact us at 614-707-4000.

SUPPORTED WEB BROWSERS AND DO NOT TRACK SIGNALS

We recommend that you use the latest web browser versions to optimize your experience. Older web browser versions may not be able to access or utilize all pages on our Websites as intended. We may not be able to receive or honor web browser "Do Not Track" signals and our Websites may continue to collect information in the manner described within this Privacy Policy.

OTHER POLICIES

Your use of our Websites and App is also subject to the applicable Terms of Use and other terms and conditions made available through those platforms. By accessing or continuing to use the Websites or App, you acknowledge and agree that your use is governed by such terms, as amended from time to time.

UPDATES

We reserve the right to modify, alter or otherwise update this Privacy Policy at any time, so we encourage you to review this policy from time to time. Changes to this Privacy Policy are effective at the time they are posted and your continued use of our Websites or App after posting will constitute acceptance of, and agreement to be bound by, those changes. If we make any material changes to our privacy practices, we will update this Privacy Policy and change the effective date at the top of this page.

CONTACT INFORMATION

Please send your privacy-related questions, comments, and concerns to us by visiting https://www.bmifcu.org/contact.html.

U.S. STATE-SPECIFIC PRIVACY RIGHTS

Certain U.S. states afford residents rights with respect to their Personal Data.  The rights described herein are subject to exemptions under applicable law. For purposes of this section, the term "Personal Data" includes both "Personal Information" and "Personal Data" as defined by applicable law.

If your Personal Data is subject to a privacy law in your state, you may have certain privacy rights with regard to that information. You may have the right to:

• Know, access, and confirm your Personal Data.
• Delete the Personal Data we have about you, subject to exceptions under applicable law.
• Correct inaccuracies in your Personal Data.
• Obtain your Personal Data in a portable and readily usable format.
• Opt-out of the use or processing of your Personal Data for profiling or targeted advertising.
• Opt-out of the sale or sharing of your Personal Data.
• Limit the use of sensitive Personal Data.

Under certain state laws, you may also have the right not to receive discriminatory treatment for the exercise of any of these privacy rights.  We will not discriminate against you because you have exercised any of your rights.  

Certain state laws may also provide you the right to appeal our decisions regarding your rights requests if we do not timely respond to your requests or do not take action regarding your requests. To appeal our decision with respect to your request, please contact us at 614-707-4000. Additionally, some states grant you the right to pursue legal action for improper handling of your Personal Data.

Submitting a Rights Request

If you wish to exercise the rights listed above, and are a resident of a state that provides such privacy rights, you may submit a request by emailing marketing@bmifcu.org, by calling us at 614-707-4000, or by using our Privacy Rights Request Portal. If you choose to submit your request via email, you must include "Privacy Rights Request" in the subject line and clearly provide us with the following information: what type of request you are making, your full name, email address, and physical address. You may only make one request per email.

We reserve the right to verify your identity in connection with requests regarding Personal Data to help ensure that we provide the information to the individual to whom it pertains or his or her authorized representative. We will compare the information you provide in your request with any information we may have in our possession in order to verify your request. We may also contact you to request additional information in relation to your request. The information you provide must match the information we have in our possession. This measure is in place to help ensure that Personal Data is not disclosed to any person who does not have the right to receive it. The information collected through this process will be used for verification purposes only. We will try to comply with your request as soon as reasonably practicable. Certain state laws may limit the number of times you may make access requests in a 12-month period.

Authorized Agent

Please note that you may authorize an agent to exercise any of these rights on your behalf by contacting us by email at marketing@bmifcu.org. If you use an agent, we will take measures to verify your agent's authorization similar to the verification described above for fulfilling any access or deletion requests. We may require more information to ensure proper verification of you and your agent's identity and authorization.

Categories of Personal Data Collected and Disclosed for a Business Purpose

We collect and disclose the categories of Personal Data that are indicated in the chart below.  Note that the specific pieces of Personal Data we collect about you may vary depending on the nature of your interactions with us and may not include all of the examples listed. 

We may also collect Personal Data about you that does not directly fit within one of the categories listed above, which information is described in INFORMATION WE COLLECT.

We share Personal Data about you with the parties listed in HOW YOUR INFORMATION IS SHARED WITH SERVICE PROVIDERS AND THIRD PARTIES AND FOR WHAT PURPOSES for business purposes, such as operational purposes and other purposes related to providing you with the services you seek from us.  For more information about the business purposes for which we disclose Personal Data, see HOW WE USE THE INFORMATION WE COLLECT.

Sources of Personal Data

We may collect your information from the categories of sources listed under HOW WE COLLECT INFORMATION.

Categories of Personal Information Sold 

While we do not sell your Personal Data for monetary consideration, certain state laws may characterize our sharing of Personal Data with companies that provide services to us, such as companies that help us to market or advertise our products and services to you, as "sales".

Categories of Personal Data disclosed that may be considered a "sale" under applicable law:  

• Identifiers
• Commercial information
• Internet or other similar network activity
• Inferences drawn from other personal information

Categories of Personal Data Shared for Cross-Context Behavioral Advertising, Profiling, or Targeted Advertising

We may use any of the categories of Personal Data listed under INFORMATION WE COLLECT for purposes of cross-context behavioral advertising, profiling, or targeted advertising.

Deletion Rights

You may request that we delete your Personal Data that we have collected directly from you.  Under applicable law, we may decline to delete your Personal Data under certain circumstances, for example, if we need the Personal Data to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims.  Note also that we are not required to delete your Personal Data that we did not collect directly from you.  We require a reasonable or high degree of certainty that the requester is the consumer for which a deletion request is applicable, depending on the sensitivity of the Personal Data.

There may also be residual data that will remain within our databases and other records, which will not be removed.

Sensitive Data and Sensitive Personal Information

We will not process your Sensitive Data or Sensitive Personal Information (as those terms are defined under applicable privacy law) without your prior consent. We do not sell your Sensitive Data or Sensitive Personal Information.

YOUR EEA/UK PRIVACY RIGHTS

We do not intentionally collect Personal Data pertaining to individuals located in the EEA or UK and do not target our services to any individuals located in the EEA or UK. However, if you are located in the EEA or UK and choose to share information with us, we will allow you to exercise certain rights with respect to our processing of that Personal Data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK version of the GDPR ("UK GDPR") (together "European Privacy Laws"). For purposes of this Section, the term "Personal Data" is as defined by applicable European Privacy Laws.

European Privacy Laws generally afford applicable data subjects the right to:

• Know whether we're processing your Personal Data.
• Request a copy of the Personal Data we hold about you, subject to exceptions under applicable law.
• Request that we correct inaccurate or incomplete Personal Data we hold about you.
• Request that we erase your Personal Data, subject to exceptions under applicable law.
• Request, in certain circumstances, that we transfer any Personal Data we hold about you to another company.
• Under certain circumstances, restrict certain types of processing.
• Object to having certain decisions made about you by automated processes or profiling.
• Withdraw your consent where we have processed your Personal Data based on your consent.
• Lodge a complaint with the relevant supervisory authority.

We do not make decisions about you based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way.

In addition to the security measures mentioned above, we will ensure that your Personal Data is adequately protected, for example, by entering into contracts which contain appropriate data protection provisions.

How to Submit a Request

If you are located in the EEA or the UK, to the extent we are subject to European Privacy Laws and you wish to exercise any of your rights under such European Privacy Laws where applicable, please submit your request by emailing us at marketing@bmifcu.org.

Please note that the above rights are not absolute and we may be entitled to refuse or limit requests, wholly or partly, where exceptions under the applicable law apply.

If you would like to make a complaint about how we handle your Personal Data, or make a complaint about a breach of data protection laws, please contact us using the contact information described above. Complaints will be investigated and the outcome of the investigation will be communicated to you after the complaint is made in accordance with applicable law. If European Privacy Laws apply, you also have the right to make a complaint with your local data protection authority (see below).

Legal Basis for Processing

We will process your Personal Data only where we have a lawful basis for doing so. These "lawful bases" for processing are set forth in applicable data protection law and, where European Privacy Laws apply, our processing will be on the basis of one or more of the following (where applicable): (a) the performance of a contract to which you are a party or in order to take steps at your request prior to entering a contract; (b) compliance with our legal obligations (for example, relating to anti-money laundering or counter-terrorist financing obligations or the prevention, detection, or prosecution of any crime); (c) for our legitimate interests (this includes carrying out the business of providing services and pursuing our general business interests) or overriding private interests; (d) the establishment, exercise or defense of legal claims; or (e) to carry out tasks in the public interest/reasons of substantial public interest.

In addition, in some circumstances we may process your information if you have provided your consent for us to do so. Please note that you have the right to withdraw any such consent by contacting us using the contact details below.

For the purposes of European Privacy Laws, and adopting the definitions used above in this Policy, namely the INFORMATION WE COLLECT and HOW WE USE THE INFORMATION WE COLLECT sections, we rely on the following lawful bases in respect of your information:

• We use Contact Information, Call, Text, Mail, and Email Records, Submitted Content and Demographic Information for our and your legitimate (or overriding) interests to provide our services to our customers, manage our customer relationship, resolve issues, develop our products/services, grow our business and update you regarding any changes to our terms, policies and any other technical updates.
• We use Contact Information and Call, Text, Mail, and Email Records for our and your legitimate (or overriding) interests to respond to your queries and provide any information and materials requested in order to generate and develop business.
• We use Contact Information for marketing communications which, unless we are relying on your consent, is for our legitimate (or overriding) interests to market our products/services, grow our business and to inform our marketing strategy.
• We use Device Information, Location Information, Website and App Interactions, and Submitted Content for online advertising, understanding our website users and website experience. This is in our legitimate (or overriding) interests to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy.
• We use Device Information, Location Information and Website and App Interactions for our legitimate (or overriding) interests in running our business, providing administration and IT services, network security, fraud prevention and in the context of a business reorganization.
• We use Job Applications for our legitimate (or overriding) business interests in selecting appropriate candidates, to fulfil our contract with you, and/or to retain data for future opportunities.

Data Protection Principles

When processing your Personal Data, we adhere to the following principles:

• Lawfulness, fairness and transparency: Personal Data must be processed lawfully, fairly, and in a transparent manner.
• Purpose limitation: Personal Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Data minimization: Personal Data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy: Personal Data must be accurate and kept up to date.
• Storage limitation: Personal Data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the Personal Data is processed.
• Integrity and confidentiality: Personal Data must be processed in a manner that ensures appropriate security of the data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by using appropriate technical and organizational measures.

Marketing Notice

We may process your Personal Data for marketing purposes, for example, to let you know about news or an event which we think you may be interested in.

If you are a data subject in the UK or the EEA, for email marketing to an individual (that is, a non-corporate email address), we need your consent to send you unsolicited email marketing. Where you provide consent, you can withdraw your consent at any time, but without affecting the lawfulness of processing based on consent before its withdrawal.

Your Personal Data may also be collected in our relationship management system when you register online to receive information, or when we otherwise receive your contact details.

You can opt out of direct marketing at any time by contacting us at marketing@bmifcu.org. You can also unsubscribe or opt-out from receiving further marketing communications by following the instructions at the bottom of each communication.

Data Protection Authority

If you have a concern about our processing of Personal Data that we are not able to resolve, you have the right to lodge a complaint with the applicable data protection regulator. Contact details for the relevant data protection regulator can be found using the links below:

Where the GDPR applies: https://edpb.europa.eu/about-edpb/board/members_en

Where the UK GDPR applies: https://ico.org.uk/global/contact-us