Privacy at Columbia Banking System, Inc.

FACTS

WHAT DOES COLUMBIA BANKING SYSTEM DO WITH YOUR PERSONAL INFORMATION?

Why?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What?

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Social Security number and income

• Account balances and payment history

• Credit history and credit score

When you are no longer our customer, we continue to share your information as described in this notice.

How?

All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Columbia Banking System chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information

Does Columbia Banking System share?

Can you limit this sharing?

For our everyday business purposes — such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus

Yes

No

For our marketing purposes — to offer our products and services to you

Yes

No

For joint marketing with other financial companies

Yes

No

For our affiliates’ everyday business purposes — information about your transactions and experiences

Yes

No

For our affiliates’ everyday business purposes — information about your creditworthiness

No

We don’t share

For our affiliates to market to you

No

We don’t share

For non-affiliates to market to you

No

We don’t share

Questions?

Call 1-833-427-5227 or go to columbiabank.com/privacy

Who we are

Who is providing this notice?

Columbia Banking System, Inc., parent company of Columbia Bank and their family of companies, including Financial Pacific Leasing, Inc.

What we do

How does Columbia Banking System protect my personal information?

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.

Additionally, we assess current risks to design specific safeguards that protect customer information and have processes in place to deal with information security incidents if they occur.

How does Columbia Banking System collect my personal information?

We collect your personal information, for example, when you:

• Open an account or make deposits or withdrawals from your accounts

• Direct us to buy or sell your securities

• Provide your employment history or employment information

We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.

Why can’t I limit all sharing?

Federal law gives you the right to limit only:

• Sharing for affiliates’ everyday business purposes—information about your creditworthiness

• Affiliates from using your information to market to you

• Sharing for non-affiliates to market to you

State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.

Definitions

Affiliates

Companies related by common ownership or control. They can be financial and nonfinancial companies.

• Our affiliates include Columbia Bank and Financial Pacific Leasing.

Non-affiliates

Companies not related by common ownership or control. They can be financial and nonfinancial companies.

• Columbia Banking System does not share with non-affiliates so they can market to you.

Joint marketing

A formal agreement between non-affiliated financial companies that together market financial products or services to you.

• Our joint marketing partners include such companies as credit card providers.

Other important information

You may have other privacy protections under applicable state laws. To the extent a state law applies, we will comply when we share information about you, and in some cases you may limit information we share.

California Residents: For further details concerning your privacy rights, please see our Privacy Notice for California Residents: columbiabank.com/privacy/privacy-notice-for-california-residents/

Nevada Residents: Pursuant to Nevada law, we are providing this notice, which applies to accounts with Nevada mailing addresses, to inform you that you may elect to be placed on our internal “do not call” list. If you would like to be placed on the list, please let us know by simply calling us at 1-833-427-5227. You may also contact the Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington Avenue, Suite 3900, Las Vegas, Nevada 89101; telephone: 1-702-486-3132; email: bcpinfo@ag.state.nv.us.

Vermont Residents: We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit report, or health information to non-affiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures.