Online Privacy Policy

Last Updated: September 2026

We respect your privacy and are committed to protecting it through our compliance with this Online Privacy Policy (this "Policy"). This Policy applies when you visit, use, or interact with us online through our website, https://www.wafdbank.com, ("Website"), our mobile applications ("Apps"), our branded social media sites or pages, or any other online or mobile services offered by WaFd Bank that link to or reference this Policy (collectively, the "Sites"). This Policy also describes the types of information we may collect from you or that you may provide when you use the Sites and our practices for collecting, using, maintaining, protecting, and disclosing that information. The terms "we", or "us" means WaFd Bank. "You", "your", or "user" means a person or entity who visits, uses, or interacts with the Sites.

Depending on the products and services you use, how you interact with us, and where you live, other privacy notices, disclosures, and privacy rights may also apply. If you have or apply for a financial product or service with us, we will collect, use, disclose, and otherwise process your personal information in accordance with this Policy, any applicable privacy notices and policies available in our Privacy Center, and applicable state and federal laws and regulations. Where applicable, materials in the Privacy Center supplement this Policy. If there is a conflict between this Policy and another policy or notice, the more specific policy or notice will govern with respect to the applicable product, service, or processing activity. Please review this Policy carefully, as it describes our privacy practices and how we collect, use, disclose, and otherwise process your personal information.

This Policy applies to information we collect:

• Through the Sites
• In email, text messages, chat communications, recorded communications, and other electronic messages between you and WaFd Bank
• Directly and indirectly from your activities related to your use of features, resources, or services available on or through the Sites
• Through the Apps that provide a dedicated non-browser-based interaction with our products and services
• When you interact with our advertisements, applications on third-party websites or services, where those advertisements or application link to this Policy

Information We Collect

The type of information we collect from and about you varies depending on how you use and interact with the Sites and the products and services you obtain from us. This information we collect may include:

• Personal Information. Personal information may include:
  • Contact Information. Information such as your name, postal address, email address, telephone number, and other contact information you provide to us.
  • Application Information. Information such as information you provide when applying for a product or service, including credit, income, employment, demographic and other application-related information.
  • Account Information. Information associated with your accounts, such as account number(s), username(s), password(s), other authentication credentials, and account preferences.
  • Financial Information. Information such as payment card numbers, expiration dates, security or verification codes, account balances, transaction information, and other financial information necessary to provide the products and services you request.
  • Government Identifiers. Government-issued identifiers such as your Social Security number, tax identification number, driver's license number, passport number, or other government-issued identification numbers or documents.
• Commercial and Transaction Information. Information about the products and services you obtain from us, your account activity, payment history, transaction records, and other information relating to your relationship with WaFd Bank.
• Communications. The content of your communications with us, such as emails, chat communications, customer service interactions, survey responses, and other correspondence with WaFd Bank.
• Device, Internet Activity, and Usage Information. Information about your computer and mobile devices and how you access, navigate and interact with the Sites and our online services, such as device type, unique identifiers, Internet Protocol (IP) address, browser type, operating system, mobile network information, pages viewed, features used, links clicked, referring websites, and date and time of access.
• Cookies and Similar Tracking Technologies. Information collected through cookies, pixels, web beacons, and similar technologies used to recognize your browser or device and support the operation of the Sites.
• Location Information. General location information, such as your state or city, and, where you provide your consent or as otherwise permitted by law and reasonably necessary to provide a requested service, precise geolocation information, for example, to help locate a nearby branch or ATM.
• Images, Voice Recordings, and Biometric Information.
  • Images and voice recordings collected in connection with the products and services we provide, such as images of government-issued identification used to verify your identity or recordings of customer service telephone calls.
  • Biometric information, where permitted by law and with any required notice or consent, such as voiceprints used to authenticate you for voice-activated banking services.
• Information from Third Parties. Information we receive from consumer reporting agencies, identity verification providers, service providers, publicly available sources, marketing partners, and other third parties, as permitted by law.
• Non-Personal Information. Information that does not identify or reasonably relate to an identifiable individual, including aggregated, de-identified, anonymized, or statistical data.

How We Collect Information

We collect information about you from a variety of sources, including:

• Directly from you when you provide information to us, such as when you obtain or use a product or service, respond to surveys, contact customer support, engage in chat features, or otherwise interact with us
• From authorized agents or family members, when they provide information on your behalf and are authorized to do so
• Through your use of the Sites and our services, including features and resources such as our chatbot, text messaging services, surveys, or other digital tools
• Automatically from your devices and browsers as you access and navigate the Sites, including through cookies and similar tracking technologies
• From our affiliates and service providers that assist us in providing products and services
• From credit bureaus and consumer reporting agencies, as permitted by applicable law
• From publicly available sources and other third parties, as permitted by applicable law

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with the Sites, including third-party applications and services made available through the Sites, we, our service providers, and other third parties may use cookies, web beacons, pixels, and other automatic data collection technologies to collect information about your use of the Sites and those applications and services, as well as your devices and other equipment.

These technologies may collect information such as device, browser, usage, and interaction information, including information about pages viewed, features used, links clicked, referring and exit pages or URLs, data and time of access, and other information about your interactions with the Sites.

We may also collect device and event information through server logs, such as browser activity, system activity, crashes and referring website URLs.

We use information collected through these technologies to operate and improve the Sites, understand how they are used, and provide a more personalized experience. We may also use these technologies to collect information about your online activities over time and across third party websites or other online services for behavioral tracking.

For information about our use of cookies and similar technologies, including how to manage your cookie preferences and how we respond to web browser signals and other mechanisms that enable you to exercise choices regarding behavioral tracking, please review our Cookie Policy and Cookie Controls available in our Privacy Center.

We may aggregate or de-identify information collected through the Sites so that it no longer identifies an individual.

How We Use the Information We Collect

We may use or disclose information that we collect about you or that you provide to us, including any personal information, for one or more of the everyday business purposes or other legitimate business purposes, such as:

• To communicate with you, respond to your inquiries, and provide customer support
• To present, operate, maintain, improve, and customize the Sites and its contents to you
• To provide you with information, products, or services that you request from us
• To process applications, transactions, and other requests or purposes for which you provide it
• To provide you with notices about your accounts, changes to the Sites, or any products or services we offer
• To carry out our obligations and enforce our rights arising from agreements with you, and to enforce our policies and other terms applicable to the Sites, products, and services
• To conduct surveys, research, analytics, marketing, and data enrichment activities, as permitted by law
• To maintain the security and integrity of our systems and services and to detect, investigate, and prevent fraud, identity theft, cybersecurity incidents, and other illegal or malicious activity
• To comply with applicable laws, regulations, court orders, legal process, and governmental request
• To protect the rights, property, safety, and security of WaFd Bank, our customers, employees, or others
• For any other purpose disclosed at the time the information is collected or with your consent, where required by law

We may use aggregated or de-identified information that does not identify you personally for analytics, research, product development, operational improvements, and other lawful business purposes.

Artificial Intelligence and Automated Technologies

We may use artificial intelligence ("AI"), machine learning, or other automated technologies to support, operate, secure, and enhance our products, services, and interactions with you. For example, we may use an AI chatbot to respond to your questions, improve customer support, analyze service performance, identify and help prevent fraud, and strengthen the security of our systems.

When we use AI or other automated technologies to process personal information, we do so in accordance with applicable law, this Policy, and any other applicable privacy notice. Where appropriate, AI-generated decisions or recommendations may be reviewed by us before we take action based on those decisions or recommendations. We may also use service providers that offer AI-enabled technologies to assist us in providing our products and services. Our service providers are contractually required to protect personal information and use it only for authorized purposes. We do not permit service providers to use personal information processed on our behalf to train or improve general-purpose AI models except as otherwise disclosed or permitted by applicable law.

Text Messaging Communications

If you choose to receive text messages from us, we may use your mobile telephone number to provide account alerts, security notifications, one-time passcodes, and other messages relating to the products and services you request. We will not sell or share your mobile telephone number with third parties for their own marketing purposes. We may your mobile telephone number and related information with service providers, aggregators, or others that support our messaging programs and related services on our behalf.

How Long We Retain Personal Information

We retain your personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy or as otherwise permitted or required by law.

Retention periods are based on factors including:

• Providing and maintaining our products and services.
• Complying with applicable laws and regulations and internal policies.
• Detecting, investigating, and preventing fraud or security incidents.
• Enforcing our agreements, policies, and legal rights.

When your personal or other information is no longer required for these purposes, we will securely delete, destroy, anonymize, or de-identify it in accordance with applicable law and our records retention policies.

Sale of Personal Information

WaFd Bank does not sell your personal information. For purposes of this Policy, "sell" means the exchange or transfer of personal information to a third party for monetary consideration. For additional state-specific information regarding whether we sell or share personal information, as those terms are defined under applicable state privacy laws, please refer to our applicable state privacy notices.

Categories Of Third Parties With Whom We May Share Personal Information

We may disclose personal information to the following categories of third parties or service providers for business purposes, operational purposes, and other lawful purposes:

• Our parent company, subsidiaries, and affiliates
• Service providers that perform services on our behalf, including technology providers, payment processors, cloud and hosting providers, analytics providers, fraud prevention providers, communications providers, and other service providers we use to support our business
• Financial institutions that jointly offer, endorse, or sponsor financial products or services with us
• Consumer reporting agencies, regulators, law enforcement agencies, courts, and governmental authorities when required or permitted by law
• Other individuals or entities when necessary to investigate fraud, prevent financial loss, protect WaFd Bank, our customers, employees, or others, or enforce our agreements and policies
• A buyer or other successor in connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of WaFd Bank's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about individuals is among the assets transferred

Third-Party Sites and Services

The Sites may contain links to third-party websites and online services that are not governed by this Policy. We encourage you to review the privacy and security practices of those third parties. We are not responsible for the privacy or security practices of third-party websites or services, or for their collection, use, or sharing of personal information.

Third Party Financial Data Sharing Services

Some companies offer financial account aggregation or personal financial management services that allow you to access information from different sources, such as your accounts with us or with other financial institutions, in one location or perform actions related to your accounts using their services. To provide these services, a third party may ask you to authorize access to your WaFd Bank accounts by providing your online banking credentials to the third party or, where available, by providing your consent to share information directly through our online banking services.

If you authorize one of these services by providing your online banking credentials or otherwise granting access to your account:

• The third party may access information about you, your relationship with us, and your accounts with us.
• Your relationship with the third party is governed by its own privacy policy, terms of use, and security practices.
• You should carefully review the third party's privacy and security practices before providing access to your accounts, including whether it sells personal information or transfers information outside of the United States.
• WaFd Bank is not responsible for the collection, use, disclosure, or security practices of any third party you authorize to access your account.
• If you revoke a third party's authorization to access your account, we strongly recommend changing your WaFd Bank online banking password to prevent continued access.

Mobile Security and Location Information

Mobile Security Information

WaFd Bank has implemented mobile security standards and practices to protect the privacy of your personal information. The WaFd Bank Apps; Zelle^®; and Mobile Deposit present "Blind Data." This means our mobile services do not present full names, Social Security Numbers, or other personal information. Account numbers are truncated, and Mobile Deposit does not store check images in persistent memory.

Location Information

If you enable location services on your device and agree to the collection of your location information, the WaFd Bank Apps may periodically collect, transmit, and use geolocation information, including approximate location data and precise GPS coordinates, while the Apps are in use or running in the background. The purpose of collecting location information is to support the Apps' functionality, analytics, fraud prevention, mapping services, and account management. Your location information may be transmitted to our service providers (e.g., analytics providers and data aggregators) as necessary to provide services to you or as required to comply with applicable laws and regulations, legal obligations, or valid governmental requests. If you do not want us to collect your location information, you may decline location access when prompted or adjust the location services settings on your device at any time. Disabling location access may affect certain features or functionality of the WaFd Bank Apps.

We retain geolocation information for as long as reasonably necessary to fulfill the purposes described in this Policy or as otherwise permitted or required by law, including maintaining the services; complying with applicable laws and regulations, legal obligations, and governmental requests; detecting or preventing fraud; or enforcing applicable agreements or policies. Upon expiration of the applicable retention period, or once your location information is no longer necessary for the purposes for which it was collected, we will take reasonable steps to securely delete, destroy, or de-identify such information in accordance with applicable law.

Text Messages and Chat Privacy

For your protection, WaFd Bank will not ask you to provide confidential personal information or financial information through text messages or online chats. Text messaging and chat are not a secure method for transmitting confidential information such as account numbers, Social Security numbers, passwords, or other personal or financial information. Please do not send personal or financial information through these channels. If you need to discuss your personal or financial information, please call or visit your local branch or office.

Recording of Calls, Text Messages, and Chats

Telephone calls, text messages, and chat sessions with WaFd Bank may be recorded, transcribed, summarized, monitored, and analyzed for purposes including:

• Customer service and quality assurance
• Employee training
• Fraud prevention and security
• Regulatory compliance
• Improving our products and services

These communications may include personal information you provide during your interactions with us.

Our authorized service providers and other third parties may process these communications on our behalf to provide recording, transcription, storage, analytics, monitoring, and other related services. Our service providers are contractually obligated to use your information only as necessary to provide services to us and for the purposes for which they are engaged. We will retain these communications in accordance with our records retention policies and applicable law.

Email Privacy

WaFd Bank will not ask you to provide confidential personal or financial information through unencrypted email. Unencrypted email is not a secure method for transmitting personal or financial information including:

• Social Security numbers
• Account numbers and loan number
• Driver license or state ID numbers

If you need to send personal or financial information to WaFd Bank, please contact us or visit your local branch or office to learn more about our secure email options.

Online Authentication

When you apply for products or services online or access certain online banking services, you may be required to complete an identity verification process. As part of this process, we or our identity verification service providers may:

• Verify information you provide against third-party data sources
• Ask you questions based on information associated with your financial history or public records to confirm your identity
• Collect device identifiers, IP addresses, browser information, cookies, JavaScript identifiers, and other technical information associated with the device used to access the Sites

Information collected through these authentication processes is used to verify your identity, detect fraud, prevent unauthorized access, and help secure your accounts. Identity verification inquiries performed for authentication purposes generally do not affect your credit score or credit file.

Accuracy of Your Information

The accuracy of your personal information is important to us. If you have a financial product or service with us and believe that any personal information we have or have reported to another party is inaccurate, please write to us at:

WaFd Bank Attn:
Client Care Center
9929 Evergreen Way
Everett, WA 98204

Please include the information that you believe is inaccurate and any other relevant information.

Social Media

WaFd Bank participates in social media platforms, such as Facebook^®, X^®, and LinkedIn^®, which enable online sharing and collaboration among their users. Any information or other content you post on these platforms, such as pictures, opinions; or personal information, is subject to the platform's terms of use and privacy and security policies; please refer to their policies to better understand your rights and obligations regarding such content.

Protecting Children's Online Privacy

In accordance with the Children's Online Privacy Protection Act, we are committed to protecting children's privacy online. The Sites are not directed to children under the age of 13, and we do not knowingly collect personal information directly from children under 13 through the Sites, except as permitted by law. We do not accept applications directly from children under 13 and do not knowingly send unsolicited marketing or promotional communications to children under 13, except as reasonably necessary in connection with an account, product, or service established, managed, or maintained by a parent, legal guardian, or other authorized adult on the child's behalf.

We may receive information about a child from a parent, legal guardian, or other authorized adult in connection with establishing, maintaining or servicing an account, product, or service for the benefit of the child. In those circumstances, we use and protect the child's information in accordance with this Policy and applicable law. If we become aware that we have collected personal information directly from a child under 13 through the Sites without appropriate authorization or as otherwise permitted by law, we will take reasonable steps to delete the information. Parents or legal guardians who believe that a child under 13 may have provided personal information through the Sites may contact us using the information provided in the "Contact Us" section below.

Your State Privacy Rights

State consumer privacy laws may provide residents of certain states with additional rights regarding our use of their personal information. If you are a resident of California, please review our California Consumer Privacy Act Notice, located in our Privacy Center, to learn more about the additional rights available to you under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Visitors Residing Outside the United States

The Sites and services are controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any country or territory other than those of the United States. If you visit or use the Sites or online services, your personal and non-personal information may be collected, stored, used, and processed in and transferred to, from, and within the United States. In such instances, applicable U.S. federal and state laws shall govern. If you are a non-U.S. resident, such laws may not provide the same level of protection as the laws of the country of your residence.

Changes to Our Online Privacy Policy

We reserve the right to update this Policy from time to time to comply with applicable laws and to reflect changes in the Sites, online services, and our privacy practices. For this reason, we encourage you to periodically review this Policy. If we make changes to this Policy, we will revise the "Last Updated" date shown at the top of this Policy and post the revised Policy on the Sites. Changes will become effective when the revised Policy is posted, unless otherwise stated in the revised Policy. Your visit, use, or interaction with any of the Sites or other online services following such posting means that you accept the revised Policy.

Contact Us

If you have any questions or comments regarding this Online Privacy Policy, please contact us at:

WaFd Bank
Attention: Legal Department
425 Pike Street,
Seattle, WA 98101