Privacy and Security Policy Privacy Statement FACTS WHAT DOES CECIL BANK DO WITH YOUR PERSONAL INFORMATION? Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. What? The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and Payment History Income and Credit History Account Balances and Credit Scores How? All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons CECIL BANK chooses to share; and whether you can limit this sharing Reasons we can share your personal information Does CECIL BANK share? Can you limit this sharing? For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus Yes No For our marketing purposes— to offer our products and services to you Yes No For joint marketing with other financial companies No N/A For our affiliates’ everyday business purposes— information about your transactions and experiences Yes No For our affiliates’ everyday business purposes— information about your creditworthiness No N/A For nonaffiliates to market to you No N/A Questions? Call 410-398-1650 or go to www.cecilbank.com Who we are Who is providing this notice? CECIL BANK What we do How does CECIL BANK protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. Our Employees are bound by our financial privacy policy and information security program to treat customer information confidentially. How does CECIL BANK protect my personal information? We collect your personal information, for example, when you Open an account or deposit money pay your bills or apply for a loan use your credit or debit card We also collect your personal information from others, such as credit bureaus, affiliates, or other companies. Why can’t I limit all sharing? Federal law gives you the right to limit only sharing for affiliates’ everyday business purposes – information about your creditworthiness affiliates from using your information to market to you sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. Definitions Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies. The following lists our family of affiliate companies to which this policy applies as of August 1, 2011. Cecil Bancorp, Inc., Cecil Bank, Cecil Financial Services Corporation Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial companies. Check Printers, fraud prevention agencies, appraisers, credit reporting agencies and taxing authorities Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Non-applicable Other Important Information We make every attempt to ensure your personal and financial information is kept up to date and accurate. if you discover that any of your information is inaccurate, we encourage you to contact us in writing at P.O. Box 469, Elkton, MD 21922-0469, or you may call 410-398-1650. We will make any required correction after verifying the authenticity of your request. We reserve the right to share nonpublic personal information with any affiliates or nonaffiliates in the future and to revise this policy accordingly. Security Statement Our website brings together a combination of industry-approved security technologies to protect data for the bank and for you, our customer. It features a VeriSign-issued Digital ID for the bank's Internet Service Provider hosting our website, Secure Sockets Layer (SSL) protocol for data encryption, and a router and firewall to regulate the inflow and outflow of server traffic. Secure Data Transfer Once a server session is established on an https secure page, the user and the server are in a secured environment. Because the server has been certified as a 128-bit secure server by VeriSign, data traveling between the user and the server is encrypted with Secure Sockets Layer (SSL) protocol. With SSL, data that travels between the bank and customer is encrypted and can only be decrypted with the public and private key pair. In short, the bank's server issues a public key to the end user's browser and creates a temporary private key. These two keys are the only combination possible for that session. When the session is complete, the keys expire and the whole process starts over when a new end user makes a server session. Router and Firewall Secure forms must filter through a router and firewall before they are permitted to reach the server. A router, a piece of hardware, works in conjunction with the firewall, a piece of software, to block and direct traffic coming to the server. The configuration begins by disallowing ALL traffic and then opens holes only when necessary to process acceptable data requests, such as retrieving web pages or sending customer requests to the bank. Using the above technologies, your Internet loan application and check reorder transactions are secure. Important Information About Procedures For Opening A New Account To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see your driver's license or other identifying documents.