Privacy Policy (text version)

Rev. 07/2024

FACTS

WHAT DOES ORRSTOWN BANK DO WITH YOUR PERSONAL INFORMATION?

Why?	Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share and protect your personal information. Please read this notice carefully to understand what we do.

What?	The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and account balances Transaction history and credit history Account transactions and checking account information When you are no longer our customer, we continue to share your information as described in this notice.

How?	All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons Orrstown Bank chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information	Does Orrstown Bank share?	Can you limit this sharing?
For our everyday business purposes-- such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus	Yes	No
For our marketing purposes-- to offer our products and services to you	Yes	No
For joint marketing with other financial companies	Yes	No
For our affiliates' everyday business purposes-- information about your transactions and experiences	Yes	No
For our affiliates' everyday business purposes-- information about your creditworthiness	No	We don't share
For nonaffiliates to market to you	No	We don't share

Questions?

Call toll-free (888)677-7869 or go to www.orrstown.com

Who we are
Who is providing this notice?	Orrstown Bank

What we do
How does Orrstown Bank protect my personal information?	To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.
How does Orrstown Bank collect my personal information?	We collect your personal information, for example, when you Open an account or give us your contact information Pay us by check or provide your mortgage information Make a wire transfer We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.
Why can't I limit all sharing?	Federal law gives you the right to limit only sharing for affiliates' everyday business purposes - information about your creditworthiness affiliates from using your information to market to you sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. [See below for more on your rights under state law.]

Definitions
Affiliates	Companies related by common ownership or control. They can be financial and nonfinancial companies. - Our affiliates include financial companies, such as companies with an Orrstown Financial Services, Inc. name and financial companies such as investment management companies and advisory companies.
Nonaffiliates	Companies not related by common ownership or control. They can be financial and nonfinancial companies. - Orrstown Bank does not share with nonaffiliates so they can market to you.
Joint marketing	A formal agreement between nonaffiliated financial companies that together market financial products or services to you. - Our joint marketing partner(s) include brokerage companies, a merchant servicing company and a credit card company.

Other important information

Special Notice For California Residents

We will not share personal information with nonaffiliates either for them to market to you or for joint marketing - without your authorization. We will also limit our sharing of personal information about you with our affiliates to comply with all California privacy laws that apply to us.

Special Notice For Vermont Residents

We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures.

Special Notice For State Residents

For Alaska, Illinois, Maryland and North Dakota Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing - without your authorization.

For Massachusetts, Mississippi and New Jersey Customers. We will not share personal information from deposit or share relationships with nonaffiliates either for them to market to you or for joint marketing - without your authorization.

International Privacy Statement
Marketing

For European Union residents, we undertake marketing only with your expressive affirmative consent and in compliance with applicable data privacy laws. EU residents will not be added to the marketing lists unless they have already provided express affirmative consent consistent with applicable data protection laws. In general, we do not seek to offer goods and services in the EU, and we do not market to individuals in the EU unless they have expressly requests information about our financial products or services.

EU Data Right to be Forgotten

Individuals in Europe may have certain data subject rights which may be subject to limitations and/or restrictions. These rights may include the right to: (i) request access to and rectification or erasure of their personal data; (ii) obtain restriction of processing or to object to processing of their personal data; and (iii) the right to data portability. If you wish to exercise one of the above mentioned rights, please call us at (888) 677-7869. Individuals in Europe may also have the right to lodge a complaint about the processing of their personal data with their local data protection authority.

Access

In addition to the rights above, Orrstown is committed to providing all individuals with access to their personal data. If you believe that Orrstown may be processing data about you and wish to have access to that information, we can provide you with that data or at least an explanation of why we cannot do so in the particular context, such as if responding to the request would be unreasonably expensive.

Other Privacy Statement

Mobile Banking: Orrstown's consumer mobile banking application may access your device's photos, contacts, and location depending on how the application is used.

Additional information concerning our privacy policies can be found at www.orrstown.com or call (888) 677-7869.