Privacy and Other Policies

Metropolitan Commercial Bank Online Privacy Policy

We at Metropolitan Commercial Bank (“MCB,” “we,” “us,” or “our”) have created this Online Privacy Policy (“policy”) because we know that you care about how information you provide to us is used and shared. This Online Privacy Policy relates to the information collection and use practices of MCB in connection with our website located at https://www.mcbankny.com (the “Website”).

Metropolitan Commercial Bank Online Privacy Policy

By visiting our Website, you are agreeing to the terms of this Online Privacy Policy.

The Information We Collect

By visiting our Website, you are agreeing to the terms of this Online Privacy Policy.

1. Personal Information

When you request information about our products and services or sign up or submit a request to receive information from us, you may be required to provide us with personal information about yourself, such as your name, company, title, address, e-mail address, and phone number. We do not collect any personal information from you when you access and use the Website for informational purposes unless you provide such information voluntarily. We do not recommend that you provide any personal information to us through the Website except for use of our online services as described immediately below. All information we collect and/or receive under this section is collectively called “Personal Information.” When you use our online services through our Website, such as online banking or mobile banking, we and third party service providers acting on our behalf may request Personal Information from you solely for the purpose of providing the service to you. This personal information is, in general, limited to your company ID, user ID, facility ID, login, username, and/or password to access such online services.

2. Other Information

In addition to the Personal Information, we may collect additional information (collectively, the “Other Information”). Such Other Information may include:

a. From Your Activity. Information that we or our technology providers may automatically collect when you visit, access, and/or use the Website, such as your IP addresses, Internet service provider, browser type and language, referring and exit pages and URLs, date and time, amount of time spent on particular pages, what sections of the Website you visit, number of links you click while on the Website, search terms, and operating system.

b. From Cookies or Other Tracking Mechanisms. Information that we may collect using “cookie” technology or other tracking mechanisms. Cookies are small files of data that a website stores on your device so that your device will “remember” information about your visit. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your device until you delete them) to help us collect Other Information and to enhance your experience using the Website. If you do not want us to place a cookie on your device, you may be able to turn that feature off on your device. Please consult your Internet browser’s documentation for information on how to do this and how to delete persistent cookies. However, if you decide not to accept cookies from us, the Website may not function properly. We may use tracking data to help us tailor and optimize our website and potentially provide you relevant MCB advertisements outside of our Website.

How We Use and Share the Information

We may use the Personal Information and the Other Information (collectively, the “Information”) to administer our marketing programs; to improve our Website and services to you; to request your feedback; and to inform you about our products and services.

We may also use and/or share Information as described below.

• We may employ other companies and individuals to perform functions on our behalf. Examples may include providing technical assistance, customer service, and marketing assistance. These other companies will have access to the Information only as necessary to perform their functions and to the extent permitted by law.
•  In an ongoing effort to better understand visitors to our Website and our services, we may analyze the Other Information in aggregate form in order to operate, maintain, manage, and improve the Website and/or our services. This aggregate information does not identify you personally. We may share this aggregate data with our affiliates, agents, and business partners. We may also disclose aggregated user statistics in order to describe our products and services to current and prospective business partners and to other third parties for other lawful purposes.
•  In order to provide our services and administer our marketing programs, we may share your Personal Information and Other Information with our third-party promotional and marketing partners, including, without limitation, businesses participating in our various programs.
•  As we develop our businesses, we may sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, sale of assets, dissolution, or similar event, the Information may be part of the transferred assets.
•  We do not sell your Personal Information to third parties. We may share your Personal Information with our (i) affiliates, parent companies, or other companies under common control with us and (ii) service providers that have agreed to confidentiality restrictions and use any Personal Information they collect on our behalf solely for the purpose of providing the contracted service to us, to confirm the status of your transactions or accounts for a legitimate third party (such as a credit bureau, a biller, etc.), or to investigate an error or potential fraud.
•  To the extent permitted by law, we may also disclose the Information: (i) when required by law, court order, or other government or law enforcement authority or regulatory agency; or (ii) whenever we believe that disclosing such Information is necessary or advisable, for example, to protect the rights, property, or safety of MCB or others.

Accessing and Modifying Information and Communication Preferences

You may manage your receipt of marketing and communications via e-mail by clicking on the “unsubscribe” link located on the bottom of any MCB marketing e-mail, as required by law. We will use commercially reasonable efforts to process such requests in a timely manner. You should be aware, however, that it is not always possible to completely remove or modify information in our subscription databases.

Protection of Information

MCB will treat as confidential any information it collects. MCB maintains an Information Security Program that provides guiding policies and procedures that promote practices and methodologies that protect the security and confidentiality of this information by limiting employee access to and use of this information. We take commercially reasonable steps to protect the Information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Please understand, however, that no security system is impenetrable. We cannot guarantee that the Information that you supply will not be intercepted while being transmitted over the Internet. In particular, e-mail sent to or from the Website may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail. For more information regarding this policy, call us at 800-852-7632.

Links to Third Party Sites and Third Party Sites

The Website may contain links to third-party websites. MCB has no control over the privacy practices or the content of these websites. As such, we are not responsible for the content or the privacy policies of those third-party websites. You should check the applicable third-party privacy policy and terms of use when visiting any other websites.

MCB’s Investor Relations website located at https://investors.mcbankny.com/corporate-profile is hosted and operated by third party provider Q4 Inc. on behalf of MCB. Please refer to Q4 Inc.’s online privacy policy located at https://www.q4inc.com/privacy-center for more information on how your information is collected and used when you access MCB’s Investor Relations website.

When you visit pages that are “owned” by MCB through social media platforms, such as Facebook, LinkedIn, Twitter, etc., you understand that you are subject to the privacy policy of the social media platform and MCB has no control over the privacy practices, the content, or the information collected by these social media platform websites. MCB advises you to be cautious of pages on social media platforms appearing to be owned or operated by MCB but are not.

Children’s Privacy

From our web pages, we do not knowingly collect personal information from individuals under the age of 13 without obtaining verifiable consent from their parents.

For more information about the Children’s Online Privacy Protection Act (COPPA), visit the FTC website: www.ftc.gov.

Changes to This Online Privacy Policy

This Online Privacy Policy is effective as of the date set forth below. We may change this policy from time to time. By accessing and/or using the Website after we make any such changes to this policy, you are deemed to have accepted such changes. Please be aware that, to the extent permitted by applicable law, our use of the Information is governed by the Online Privacy Policy in effect at the time we collect the Information. Please refer back to this Online Privacy Policy on a regular basis.

Effective Date: April 27, 2021

Metropolitan Commercial Bank California Consumer Privacy Act Privacy Policy and Notice

Printer Friendly version (PDF)

This California Consumer Privacy Act Privacy Policy and Notice (“Notice”) applies only to California residents (“California residents,” “you,” or “your”) covered by the California Consumer Privacy Act, (as amended from time to time, “CCPA”). This Notice explains what personal information Metropolitan Commercial Bank (“we,” “us,” or “our”) collects related to California residents, and the sources of such personal information; how we use such personal information; to whom we disclose such personal information; how long we keep such personal information; and the rights that California residents may have, and how to exercise such rights. This Notice serves as our notice at collection and our privacy policy pursuant to the CCPA.
Under the CCPA, “personal information” is any information that identifies, relates to, or could reasonably be linked to you or your household. The specific personal information that we collect, use, and disclose relating to you will vary based on the relationship or interaction that you have with us and your use of our website. In addition, the personal information that we collect, use, and disclose may be subject to other privacy laws other than the CCPA, such as the Gramm-Leach Bliley Act, and as such, the CCPA does not apply to such personal information covered by such other privacy laws. For more information about how we collect, use, and disclose such other covered information, please refer to https://mcbankny.com/privacy-policy.

Categories Of Personal Information

In the past 12 months, we may have collected personal information in the following categories:

• Personal identifiers (including those listed in other California statutes), such as real name, alias, postal address, Internet Protocol address, online identifier, email address, social security number, driver’s license number, passport number, or other similar identifiers
• Financial information, such as bank account numbers, debit/credit card numbers, transaction details, and any other financial information
• Characteristics of protected classes or groups under California or federal law, such as date of birth, age, race, color, religion, national origin, gender, marital status, citizenship, request for family care leave, request for leave for employee’s own serious health condition, and request for pregnancy leave
• Commercial information, such as records of personal property; products and services purchased, obtained or considered; and purchasing or consuming histories or tendencies
• Biometric information, such as imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint or a voiceprint, can be extracted, keystroke patterns or rhythms, and gait patterns or rhythms
• Internet or other electronic network activity Information, such as browsing history, search history, and information regarding your interaction with a website, application, advertisement
• Geolocation data, such as information used to identify your physical location (e.g., Internet Protocol location or device location)
• Audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information such as work history and prior employers
• Information related to your education and qualifications, such as schools attended and dates of attendance
• • Inferences, such as any derivation of information, data, assumptions, or conclusions drawn from certain of the above categories used to create a profile about you, such as a profile reflecting your preferences, characteristics, behavior, attitude, intelligence, abilities, and aptitude
• • Sensitive personal information, such as government-issued identifiers (such as social security number, passport number, driver’s license); account log-in, financial account, debit or credit card number with any required security code, password, or credentials allowing access to an account; precise geolocation; information concerning health or sexual orientation; information concerning racial or ethnic origin, religious or philosophical beliefs, union membership; and biometric data processed to identify an individual, contents of mail/email/texts

Categories Of Sources of Personal Information

In the past 12 months, we may have collected personal information listed above about California residents from the following categories of sources:

• Directly from you or your representative, when you or your representative provides such personal information to us digitally or physically (e.g., where you contact us via email or telephone, or by any other means)
• Our affiliates (if applicable)
• Public records or widely available sources, including information from the media, and information that is made available by federal, state, and local government entities
• Service providers, consumer data resellers, credit reporting agencies and other similar persons or entities
• Your devices when interacting with our websites, online banking portals, and mobile apps (such as website/mobile app activity)
• Corporate clients providing information about individuals associated with the corporate client (such as an employer providing information about one of its employees)

Purposes for Collecting Personal Information

We collect, use, and disclose personal information for the following business purposes:

• Performing services for you, including opening, servicing, and maintaining accounts, providing customer service, processing or fulfilling transactions, verifying your information, processing payments, or providing financing
• Detecting security incidents; protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for such activity
• Complying with laws, regulations, legal process, law enforcement requirements, and internal policies, including for purposes of auditing, accounting, internal investigations, and legal processes
• Helping to ensure the security and integrity of systems and data
• Conducting analytics and improving online banking and mobile app performance

Disclosure and Sharing of Personal Information

In the past 12 months, we may have shared the following list of categories of personal information with third parties for our business purposes:

• Identifiers such as a real name, postal address, social security number, driver’s license number, passport number, or other similar identifiers
• Personal information, such as bank account number, debit card number, or any other financial information
• Characteristics of protected classifications under California or federal law, such as race, color or gender
• Commercial information, such as records of personal property or products or services purchased, obtained, or considered
• Biometric information
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with our internet website
• Geolocation data, such as Internet Protocol (IP) location
• Audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information, such as employment history
• Education information, such as schools attended and dates of attendance
• Inferences drawn from any of the information identified above to create a profile about you, such as your preferences and characteristics

In the past 12 months, we may have disclosed the categories of personal information described above for our business purposes to some or all of the following categories of third parties:

• You and, where appropriate, your family, your associates and your representatives
• Our affiliates (if applicable)
• Anti-fraud service providers
• Service providers and third parties to provide products and services to you, such as account transactions and maintenance, and online and mobile banking services
• Identity verification services, such as to verify your identity
• Government, legal, regulatory, or other similar authorities and/or local government agencies, upon request or where required by laws and regulations

Your Rights to Make Requests

As a California resident, you may have one or more of the following rights under the CCPA, including the right to receive this Notice at or before the point of collection of your personal
information:

Right to Know: You have the right to request that we disclose to you free of charge the following information covering the 12 months preceding your request:

• The categories of personal information we have collected about you;
• The categories of sources from which personal information is collected;
• The business or commercial purpose for collecting personal information about you;
• The purpose for sharing personal information about you;
• The categories of third parties to whom we disclosed personal information about you and the categories of personal information that were disclosed (if applicable) and the purpose for disclosing the personal information about you;
• The categories of personal information (including sensitive personal information) about you that we shared and the categories of third parties to which we shared such personal information and/or sensitive personal information; and
• The specific pieces of personal information we have collected about you.

Right to Delete: You have the right to request that we delete any personal information that we have collected from you.

Right to Correct: You have the right to request that we correct inaccurate personal information that we have about you.

Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information.

These rights are subject to exceptions and other limitations. For example, we are not required to comply with a request to delete personal information if the personal information is necessary for us to complete a transaction for which the information was collected, or if we must retain the personal information to comply with a legal obligation. In addition, if we receive one of the above requests that involves personal information subject to another privacy law, we may deny part or all of your request relating to such personal information as such personal information is exempt from the CCPA. We will inform you of an exemption in response to your request.

How to Submit Requests

California residents may exercise one or more of their rights described in this Notice, subject to exceptions and other limitations. To exercise one or more of your rights, you or your authorized agent (on your behalf) may make a request by:

(1) By calling us at 800-852-7632 (toll-free);
(2) Submitting a request on MCB’s website, at https://www.mcbankny.com/ccpa-request; or
(3) Sending an email to ccparequest@mcbankny.com

When we receive a request from you, we will verify your identity to confirm the personal information we maintain relates to you. We may request information from you, not limited to your name, address, and contact information, to verify your identity. We may use a two-step process for online requests to delete personal information where you must first submit a request to delete and then second, we will separately confirm you want your personal information deleted. If you submit a request on behalf of another individual, we may require proof that you are authorized to submit such a request on behalf of that individual.

Sales of Personal Information

We do not offer an opt-out from the sale of personal information because we do not sell personal information as defined by the CCPA, and we have not sold such information within the last 12 months.

Sales or Sharing of Personal Information of Persons Under 16 Years of Age

We do not knowingly sell or share personal information of minors under the age of 16. As such, we do not have actual knowledge that we sold or shared personal information of minors under the age of 16 within the past 12 months.

Non-Discrimination

You have the right not to be discriminated against for exercising your rights under the CCPA. We will not discriminate against you for exercising any of your rights.

Use and Disclosure of Sensitive Personal Information

We do not provide a right to limit our use or disclosure of sensitive personal information because we do not use or disclose sensitive personal information in such a manner as to require the provision of such right (such as using sensitive personal information for purposes of inferring characteristics about an individual).

Contact for More Information

You may contact us with any questions or concerns that you may have about our privacy policies and practices or this Notice by sending an email to: ccparequest@mcbankny.com.

Changes to this Notice

We may change this Notice from time to time. When we do, we will post the updated Notice on our website with the new “Last Updated” date. The updated Notice will become effective when posted, unless otherwise indicated.

Effective: December 29, 2025
Updated: December 29, 2025

Consumer Privacy Notice

Printer Friendly version (PDF)

Reasons we can share your personal information	Does Metropolitan Commercial Bank share?	Can you limit this sharing?
For our everyday business purposes – such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus	Yes	No
For our marketing purposes – to offer our product and services to you	Yes	No
For joint marketing with other financial companies	No	We don’t share
For our affiliates’ everyday business purposes – information about your transactions and experiences	No	We don’t share
For our affiliates’ everyday business purposes – information about your creditworthiness	No	We don’t share
For nonaffiliates to market to you	No	We don’t share

Questions?

Call 1-800-852-7632 or go to www.mcbankny.com

What we do

How does Metropolitan Commercial Bank protect my personal information?	To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. We also maintain other physical, electronic and procedural safeguards to protect this information and we limit access to information to those employees for whom access is appropriate.
How does Metropolitan Commercial Bank collect my personal information?	We collect your personal information, for example, when you • Open an account • Apply for financing • Provide account information • Give us your contact information • Show your driver’s license We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.
Why can’t I limit all sharing?	Federal law gives you the right to limit only • sharing for affiliates’ everyday business purposes – information about your creditworthiness • affiliates from using your information to market to you • sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.

Definitions

Affiliates	Companies related by common ownership or control. They can be financial and non-financial companies. • Metropolitan Commercial Bank does not share with our affiliates.
Nonaffiliates	Companies not related by common ownership or control. They can be financial and non-financial companies. • Metropolitan Commercial Bank does not share with nonaffiliates so they can market to you.
Joint marketing	A formal agreement between nonaffiliated financial companies that together market financial products or services to you. • Metropolitan Commercial Bank does not share with nonaffiliated financial companies for joint marketing.

Other Important Information

For Alaska, Illinois, Maryland and North Dakota Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing – without your authorization. For California Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing – without your authorization. We will also limit our sharing of personal information about you with our affiliates to comply with all California privacy laws that apply to us. Further, we may collect personally identifiable information about you through our website, including but not limited to your first and last name, home address, e-mail address, telephone number, or any other identifier that permits the physical or online contacting of a specific individual. If we change our privacy policy for our website, you will be notified as required by law. For Massachusetts, Mississippi and New Jersey Customers. We will not share personal information from deposit or share relationships with nonaffiliates either for them to market to you or for joint marketing – without your authorization. For Vermont Customers. • We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures. • Additional information concerning our privacy policies can be found at www.mcbankny.com or call 1-800-852-7632.