Last Updated August 11, 2026

Your privacy is important to Southern First Bank. Please read this disclosure carefully. We recommend that you print and retain a copy for your records.

Southern First ("Southern First," “we,” “us,” or “our”) cares about the privacy of the information we collect about you. This Privacy Statement outlines how we collect, use, share, and protect your personal information and the rights and choices you can exercise in relation to your personal information. By using our Services, you agree to the terms outlined in this Privacy Statement. Please contact any member of our Client Services team at any office location or call us at 1-877-679-9646 if you have any questions or would like additional information regarding this Privacy Statement. We may update this Privacy Statement from time to time, so please check this Privacy Statement periodically for changes.

Scope of This Privacy Statement

This Privacy Statement applies to our collection of personal information via interactions with you across various platforms, including the below (collectively the “Services”):

• Websites and Mobile Applications: This includes any interaction you have with our websites and any associated mobile applications (“the Website”).
• Facilitating our banking services:  This includes information collected for applications (but does not include GLBA data, as described below) and other marketing programs.
• Phone, Text, Chat and Email Communications: Personal information may be collected when you communicate with us via phone, text, chat, or email, such as call logs, email addresses, and the content of the communications.
• Online Advertisements and Emails: If you view our online ads or emails, we may collect information about your interaction with these communications, such as click-through rates and preferences.
• Authorized Service Providers: We may also collect information through third-party service providers who are authorized to act on our behalf, including marketing firms and payment processors.

Personal information does not include: (i) publicly available information; (ii) deidentified or aggregated consumer information; or (iii) personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FRCA”) and the Gramm-Leach-Bliley Act (“GLBA”). For more information on information collected, processed, or disclosed pursuant to the GLBA and its implementing regulations, please refer to our
Southern First Bank's Privacy Notice.

Definitions

• Affiliates - Companies related by common ownership or control. They can be financial and non-financial companies. Southern First Bank has no affiliates.
• Nonaffiliates - Companies not related by common ownership or control. They can be financial and non-financial companies. Southern First Bank does not share with non-affiliates.
• Joint Marketing with other financial companies - A formal written agreement between non-affiliated financial companies that together market financial products or services to you. Southern First Bank doesn't have joint marketing agreements with non-affiliated financial companies.

Collection of Personal Information

As further described below, we collect personal information directly from you, automatically through your use of the Website, and from other, third-party sources. To the extent permitted by applicable law, we may combine the information we collect from publicly available or third-party sources.

Personal information We Collect Directly From You. While the personal information we collect varies depending upon your use of the Website and our interactions with you, in general, we may collect the following personal information directly from you:

• Contact Information. When you contact us, we collect your name, email address, phone number, and  postal address.
• Application Information. When you fill out an application for our services, we collect personal information, which may include:
  • Identifiers, including name, alias, telephone number, postal address, unique personal identifier, online identifier, email address, account name, financial and account information, social security number, driver’s license number, and passport number;
  • Information Listed in the Customer Records Statute, including name, signature, , postal address, telephone number, passport number, driver’s license or state identification card number, education, employment, employment history, account number, credit and/or debit card number, other financial information,;
  • Demographic and Protected Classifications, including age, citizenship, marital status, race/ethnic origin, or veteran status (as permitted by law);
  • Professional or Employment Information, including current or past job history; and
  • Sensitive Personal Information, including government-issued identifiers and certain demographic details. We only collect this information as necessary to provide our services or as authorized by you.
• Communications and Interactions. When you send email, text message, call, or otherwise communicate with us and with members of our team, we collect and maintain a record of your contact details, communications, and our responses.
• Responses and Feedback. If you participate in our surveys or questionnaires, we collect your responses and feedback, such as user satisfaction or other information related to your use of the Website, and any other information you so choose to provide.
• Marketing and Promotions. If you agree to receive marketing communications from us, we collect your email, name, phone number, preferences. If you participate in promotions we offer, we collect your name and other information related to the activities available through the Website.
• Inferences.  We may generate inferences about you based on other personal information we collect such as your preferences, behaviors, contact information, and demographics information.
• Preferences. We also may collect information about your preferences, including communications preferences.
• This policy does not replace or substitute the terms and conditions of individual products or services offered by the bank.

Special Category Information

Some of the information that we may collect as a result of providing credit solutions is particularly sensitive (e.g., social security number, driver’s license number, passport number, and racial or ethnic origin). We only collect this information as provided by or consented by you. 

Such sensitive information is only shared for the purpose of providing the Services you request or as consented for and will not be shared or used by us for any other purposes.

Personal information We Collect Automatically. We and our third-party providers automatically collect personal information related to your use of the Website, including using cookies and other similar technologies. The personal information we may automatically collect includes the below categories of information (collectively, “Usage Data”):

• Device and Browsing Information. When you visit the Website, we may collect IP address, browser type, domain names, access times, date/time stamps, operating system, language, device type, unique ID, Internet service provider, referring and exiting URLs, clickstream data, and similar device and browsing information.
• Activities and Usage. We also collect activity information related to your use of the Website, such as information about the links clicked, searches, features used, items viewed, time spent within the Website, your interactions with us within the Website, and other activity and usage information.
• Location Information. We may also collect or derive location information about you, such as through your IP address. If you choose to enable location-based sharing with us through your device settings, we may collect precise location information to provide content that is more relevant to your location and to otherwise improve your interactions with the Website. You may turn off location data sharing through your device settings. 
• Video viewing data.  We may collect internet protocol (IP) address and your activity and history regarding your interactions with videos contained on the Website.

For more information about our use of cookies and other similar technologies, please see the “USE OF COOKIES AND OTHER TECHNOLOGIES” section below.

Personal information We Collect from Other Sources

In addition, we may collect and receive personal information from third parties, such as business partners, public databases, and credit bureaus where permitted by law and in the course of providing the services you request. We may combine this information with personal information we collect directly from you, and use it to generate inferences about your preferences, behavior, or other characteristics, as permitted by applicable law.

Some parts of the Services allow you to provide us with personal information relating to other parties (collectively, “Third-Party Data”).  If you use any feature of the Services that allows you to communicate with other parties or to provide information regarding other parties (such as to refer another other party to the Website or to provide us information on a spouse, guarantor, dependent, or authorized user), either by submitting Third-Party Data to the Website or otherwise permitting the Website to automatically access Third-Party Data in your possession, you acknowledge, represent, and agree (a) that you have the authority of the relevant other party for us to access and use the relevant Third-Party Data, and (b) that you have notified these other parties and informed them how their information is collected and used by us to provide the Services.  We reserve the right to identify you as the person who has made the referral in any messages that are sent to other parties. We use Third-Party Data to (a) contact such party using the Third-Party Data provided, and/or (b) provide you with an editable template message designed to facilitate communication between you and such party through the Services. We may also send reminders or related messages to you and to other parties on your behalf from time to time, as and where permitted by applicable law.

We may also collect information about you from other online and offline sources, including credit reporting agencies and other third-party sources as permitted by law.

Use of Personal Information

We use your personal information for various purposes, including:

• Providing Information, Products, or Services. To fulfill your requests for information, products, or services.
• Website and Support. To provide and operate the Website, communicate with you about your use of the Website, respond to your inquiries, and to otherwise run our day-to-day operations.
• Analytics and Improvement. To better understand how users access and use the Website and Services, and for other research and analytical purposes, to develop the Website and its features, and for internal quality control and training purposes.
• Communicate With You. To respond to your inquiries, send you requested materials and newsletters, as well as information and materials regarding the Services and offerings. We also use this information to send administrative information to you, for example, information regarding the Services and changes to our terms, conditions, and policies.
• Marketing and Promotions. For marketing and promotional purposes. For example, to send you information about the Services, such as newsletters and other marketing content that you sign up to receive.  If you do not wish to receive promotional e-mails from us, you may opt out at any time by following the unsubscribe directions in the email or contact us.  If you opt out of a promotional e-mail, we may still send you transactional and administrative emails about this privacy notice or about the products or services you have purchased.
• Research, Development, and Surveys. To administer surveys and questionnaires, such as for market research or user satisfaction purposes and to develop new products and services, including market analysis and product testing.
• Security and Protection of Rights. To protect the Services and our business operations, and to protect our rights or those of our stakeholders; to prevent and detect fraud, unauthorized activities and access, and other misuse; where we believe necessary to investigate, prevent or act regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our terms and conditions.
• Compliance and Legal Process. To comply with applicable legal or regulatory obligations, including as part of a judicial proceeding; to respond to a subpoena, warrant, court order, or other legal process; or as part of an investigation or request, whether formal or informal, from law enforcement or a governmental authority.
• Auditing, Reporting, and Other Internal Operations. To conduct financial, tax, and accounting audits; audits and assessments of our operations, privacy, security and financial controls, risk, and compliance with legal obligations; our general business, accounting, record keeping and legal functions, and to maintain appropriate business records and enforce company policies and procedures.
• General Business and Operational Support. To assess and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financing, and to administer our business, accounting, auditing, compliance, recordkeeping, and legal functions.

Sharing of Personal Information

We may share your personal information for the purposes described above and as follows:

• Affiliates and Subsidiaries. We may disclose the personal information we collect to our corporate affiliates and subsidiaries. We may also partner with other businesses to offer our products, and we may disclose personal information to those business partners as necessary to facilitate your orders or requests.
• Vendors and Service Providers (“Service Providers”). We may disclose the personal information we collect to service providers who perform functions on our behalf, such as IT and website hosting, marketing, and marketing research providers, customer support, data storage, analysis and processing providers, auditors, consultants, and legal counsel.
• Business Partners, Including Advertising Partners and Analytics & Marketing Partners. We may also disclose your Usage Data to marketing and advertising networks, data analytics providers, and other companies who provide marketing or analytics services on our behalf.
• In Support of Business Transfers. If we or our affiliates are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may disclose or transfer the personal information we have collected from you with or to the other company. We may also disclose certain personal information as necessary prior to the completion of such a transaction or other corporate transactions such as a financing or restructuring, to lenders, auditors, and third-party advisors, including attorneys and consultants.
• Compliance and Legal Obligations. To comply with our legal and compliance obligations and to respond to the legal process. For example, we may disclose information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements.
• Security and Protection of Rights. Where we believe doing so is necessary to protect us, our rights and property, or the rights, property, and safety of others. We may also disclose personal information related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.
• Aggregate and Deidentified Information. Notwithstanding anything else in this Privacy Statement, we may use, disclose, and otherwise process aggregate and deidentified information related to our business and the Website with third parties for quality control, analytics, research, development, and other purposes.
• Other Disclosures. We may disclose personal information in other ways not described above, but will notify you and, if necessary, obtain your consent.
• Authorized Representatives. If another individual is managing your account or access to the Services on your behalf (for example, a wife managing the account of her husband), as authorized by you or as a personal representative under applicable law, that person can view all personal information about you in the Services.

Use of Cookies and Other Technologies

A cookie is a small data file that certain websites write to your hard drive when you visit them. A cookie file can contain information such as a user ID that the site uses to track the pages you’ve visited. The only personal information a cookie can contain is information you supply yourself. A cookie can’t read data off your hard disk or read cookie files created by other sites.

We and our third-party providers use cookies, pixel tags, and other technologies to collect Usage Data. We may allow third parties to collect this Usage Data on our behalf and to retain and use this Usage Data themselves. We use this Usage Data to, for example, analyze and understand how you access, use, and interact with us through the Website, to identify and resolve bugs and errors in the Website, to assess, secure, protect, optimize, and improve the performance of the Website, for marketing and advertising purposes, analytics purposes, and to personalize content in the Website. We may also aggregate such information to analyze trends, administer the Website, and gather broad demographic information. 

We use the term “Business Partners” to refer to our Marketing Partners, and Analytics Providers, as detailed below:

Third Party Analytics & Marketing Partners.  We use third party tools, which are operated by third party companies, to analyze ad traffic and usage of the Website. These tools collects data about your interaction with the Website via the cookies and through the standard implementation.

• Google Analytics and others.  We use analytics on the Website to help us analyze traffic and improve services.
  • For more information on Google Analytics’ processing of personal information, please see https://www.google.com/policies/privacy/partners/. You can opt-out of Google Analytics for Display Advertising and customize Google Display Network ads using the Ads Preferences Manager.  You can find out more about how Google uses cookies in advertising and opt-out via the following links: Google Display Network (DoubleClick) & Google Analytics Opt-out Browser Add-on.

    Cross-Device Tracking. We and our providers may use the information we collect about you within the Website and on other third-party websites and services to help us and these third parties identify other devices that you use (e.g., a mobile phone, tablet, other computer, etc.) to interact or engage with us or the Website.

    Do Not Track. Currently, the Website does not recognize all “Do-Not-Track” requests. You may, however, disable certain tracking by disabling cookies.

Security

We take information security very seriously and use reasonable administrative, technical, and physical measures to protect your personal information from unauthorized access. Unfortunately, no security system can be guaranteed to be 100% secure. Accordingly, we cannot guarantee the security of your information and cannot assume liability for improper access to it. Southern First will never contact you directly to request personal information, such as social security numbers, account numbers, PINs, or passwords, by email, phone calls or texts. If you receive a suspicious request via email, call, or text which appears to be from the bank, please contact our Client Services at 1-877-679-9646. 

Children’s Privacy

The safety and privacy protection of children is especially important to the Bank. Our Online Services are not intended for minor children. Children should always ask their parents or guardians for permission before sending personal information to anyone online. Our sites are not directed towards children, and we do not knowingly collect personal, nor locational information for a minor child without written consent from the parent or legal guardian. If you permit a minor child under the age of 13 or up to 17 to use Online Banking Services, or give the minor child your User ID, Password, or access, you understand that you are responsible for all activity the child initiates from or to any of your accounts, even if he/she exceeds your authorization. Additional information about Children’s Online Privacy Protection Act can be found by visiting the Federal Trade Commission’s website at https://www.ftc.gov/.

Modification

We may update this Privacy Statement from time to time to reflect changes to our privacy practices, and when we do, we will update the “Last Updated” date at the top of the Privacy Statement. If we make material changes,  we will provide prominent notice (such as through a notice or banner or, where feasible, via email). Your continued use of our Services after the “Last Updated” date constitutes your acceptance of the changes. If you do not agree to the changes, you should immediately stop using our Services.

Visiting Our Website From Outside of the United States

If you are visiting our Website from the European Union or other region outside of the United States or otherwise contacting us from outside of the United States, please be aware that your personal information will be transferred to, stored or processed in the United States, where our servers are located and our central database is operated. The data protection and other laws of the United States and other countries may differ and may not be as comprehensive as those in your country. We will protect your privacy in accordance with this Privacy Statement. By using our services or purchasing our products, you consent to the transfer of your personal information to our facilities in the United States and to those third parties with whom we share our facilities as described in this Privacy Statement.

Links to Other Websites

For your convenience, we may provide links to other websites and web pages that we do not control. We cannot be responsible for the privacy practices of any websites or pages not under our control and we do not endorse any of these websites or pages, the services or products described or offered on such sites or pages, or any of the content contained on those sites or pages. The inclusion of any Linked Site does not constitute as an endorsement of the website, the contents of the website or the operators of the website by Southern First Bank.

It's your responsibility to verify the identity, authenticity, privacy  and security of any site you visit. Please keep in mind that any relationship or transaction you enter into with a third party will be between you and that third party only and you must adhere to their privacy policies.

Retention

Personal information is retained no longer than necessary to fulfill the purposes set out in this Privacy Statement, unless a longer retention period is required (such as under applicable contracts with clients or business partners) or permitted by law (such as tax, accounting, or other legal requirements).

State-Specific Privacy Rights

United States Privacy Laws, Including California's CCPA

This section describes state specific consumer rights afforded to residents of California (“State Privacy Laws”).  Any terms defined in the applicable State Privacy Laws that we use here have the same meaning as the applicable State Privacy Law.

California's "Shine the Light."  California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of Personal Information, such as name, e-mail and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties' direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us with a reference to California Disclosure Information; however, we do not share your Personal Information to third parties for direct marketing purposes without your consent.

Information We Collect

As more fully described above, we collect (and have collected within the last twelve (12) months) the following categories of personal information:

• Identifiers
• Commercial information
• Internet or other electronic network activity
• Protected Classifications
• Geolocation data
• Employment Information
• Sensitive Personal Information
• Inferences

Disclosure of personal information to Third Parties and Other Recipients

Sales and Sharing of personal information; Use for Targeted Advertising

Certain state laws, including the California Consumer Privacy Act, define "sale" as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and “sharing” or “targeted advertising” as disclosing or making available personal information to a third-party for purposes of cross-contextual behavioral advertising. We do not sell or share your personal information as defined under State Privacy Laws.

Your Privacy Rights and Choices

Residents of states with generally applicable privacy laws may have the following rights regarding their personal information, subject to certain exceptions and qualifications under their respective state laws.

• Access and Data Portability. You have the right to request details about the personal information we have collected about you, such as whether we have collected personal information about you, the categories of sources, the purposes for which we have collected the personal information, the categories of recipients, and the specific pieces of personal information we have collected. You may also have the right to receive a copy of your personal information in a readily usable format. If we have maintained your Personal information for longer than 12 months, you may exercise your right to know looking back to January 1, 2022.
• Correction. You may have the right to request we correct incorrect or inaccurate personal information, subject to restrictions regarding the determination of accuracy of the existing personal information.
• Deletion. You may have the right to request deletion of your data unless an exception applies.
• Opt-Out of Sale, Sharing, or Targeted Advertising. You have the right to opt-out of “sales” and “sharing” of your personal information, and to opt-out of the use of your personal information for “targeted advertising” as those terms are defined under applicable state privacy laws.  We do not engage in such activities.
• Limit Use and Disclosure. We do not collect nor engage in uses of sensitive personal information that would trigger a right to limit use and disclosure of sensitive personal information under applicable state privacy law.
• Opt-Out of Profiling with Legal or Significant Effects. You may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. However, we do not engage in such activities as described under applicable state privacy law, so there is no need to exercise this right.

Consumer Requests and Verification

Right to Non-Discrimination

We may not discriminate against you because you exercise any of your privacy rights contained in this Privacy Statement including, but not limited to:

• Denying goods or services to you;
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Providing a different level or quality of goods or services to you; or
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Verifying Requests

You may request to exercise your rights of access, deletion, or correction by contacting us as described in the Data Requests section below. To help protect your privacy and maintain security, we will take steps to verify your identity before processing your request.  If you request access to or deletion of your personal information, we may require you to provide any of the following information: name, email address, telephone number, or postal address, and account information. When you make such a request, you can expect the following:

• As required under applicable law, we will verify your identity. You will need to provide us with your email address and full name.  We may ask for additional information if needed.
• We will confirm that you want your information accessed, corrected, and/or deleted.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us as listed below.
• We will respond to your request within 45 days upon receipt of your request. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, a request for access, correction, or deletion may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing services or completing an order. If we deny your request, we will explain why we denied it and delete any other information that is not protected and subject to denial.

Authorized Agents

You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf. Your agent may contact us as described in the Data Request section below to make a request on your behalf. Even if you choose to use an agent, we may, as permitted by law, require:

• The authorized agent provides proof that you provided signed permission to the authorized agent to submit the request;
• You to verify your identity directly with us; or
• You to directly confirm with us that you provided the authorized agent with permission to submit the request.

Former Customers

If you are no longer have a relationship with us, we continue to protect your information and only share it as allowed by law.

Data Requests & Contact Us.

To exercise your data rights described above or contact us regarding our data practices, you can contact us via: 1-877-679-9646  or https://southernfirst.com/contact/send-a-message