Privacy policy | National Bank Privacy policy To build and maintain a trust-based relationship Updated : September 3, 2025 We invite you to read the overview of our Privacy Policy, which clearly and and concisely summarizes how we manage your personal information. On this page: Why we adopted this policy Types of information we may collect and how How we may use and disclose your information and to whom When we must obtain your consent Your rights and how to exercise them Security safeguards to retain your information How we can make changes to this policy How to reach us with any questions, comments or complaints 1. Why we adopted this policy The personal information (hereafter “information”) that you entrust to us is essential to our business relationship with you. We understand that this information is valuable and we are committed to protecting it. Our goal is to be transparent with you, which is why we adopted this policy. This policy describes our practices to protect your information and privacy. That is why we adopted this policy, which describes our practises to protect your information and privacy. This policy applies to the collection, use and disclosure of the information you entrust to the Bank and its subsidiaries i. It is in effect as long as we have your information on file, including after the end of our business relationship. This policy is supplemented by our Digital data policy, which describes how we use cookies and similar technologies when you visit or use our websites or mobile apps. Certain products and services may also be subject to specific terms governing how your information is handled.  Our Chief Privacy Officer is responsible for overseeing our privacy practises across the Bank and its subsidiaries. If you have any questions about this policy, please contact us at:  Chief Privacy Officer, Transit 5403-1 National Bank Place 800 Saint-Jacques Street Montreal, Quebec H3C 1A3 [email protected] You may also contact us as indicated in Section 8 below if you have any questions. 2. Types of information we may collect and how  2.1. Types of information we may collect We may collect the following types of information: Information used to identify you Names Date of birth  Marital status  Contact information (e.g., email address, phone number, mailing address)  Information from identification documents (e.g., driver’s licence, passport, Social Insurance Number*)  Job title or occupation  Account numbers Information related to your role as an authorized representative, director, officer or shareholder  *You are not required to provide your Social Insurance Number or Social Security Number. However, it does facilitate your identification with credit reporting and assessment agencies. In certain cases, we are required to collect it, particularly for tax purposes, if an account generates income. Information used to confirm your identity  User ID Signatures  Account information  Biometric data (e.g., voice print, facial geometry)* *You are never required to provide biometric data for identification purposes. We obtain your express consent before we collect and use this information to verify or confirm your identity. Financial information to check whether you qualify for products and services and to assess your creditworthiness Income, salary and account balances  Products as well as related conditions (e.g., term, repayment frequency, limits, rates and expiry)  Credit reports and credit score Professional situation, and financial and criminal background Information about your transactions  Information about your transactions History of the transactions and interactions in your accounts  Participation in rewards programs   Investment instructions  Knowledge and goals for investments and financial planning   Risk tolerance Health and lifestyle information for the subscription of insurance products or services*  Your family medical history  Your activities, behaviours and lifestyle choices  Travel, sports and dangerous hobbies  *Due to its sensitive nature, health and lifestyle information will not be used or shared for marketing purposes or to assess loan applications. It will also not be shared with subsidiaries of the Bank that do not offer insurance products or services. Information for training, quality control, identification, and security purposes, or to record your consent to a transaction History, recordings, metadata and transcripts of phone calls, video conferences and chat sessions History of visits to branches and one-on-one meetings Images captured by our surveillance cameras in and around our branches, ABMs and other locations Digital information and details about your devices Device information (e.g., IP address, VPN, proxies, device type and operating system). Some services may also request access to your device’s camera or photo library (e.g., for mobile cheque deposit), or your contact list (e.g., to send Interac  e-Transfers®). Approximate location inferred from your IP address when you visit our online services.   Browsing preferences and history, such as the pages you visit and use. For further details, please consult our Digital data policy. Other information you provide or that we generate Your reason for doing business with us  Language and communication preferences  Information we may derive or generate about you based on your transactions, credit history, or other interactions with us. For example, we may generate risk scores or other predictions and indicators using analytical or automated tools. Information you provide about other individuals* For example, information regarding a person given power of attorney, secondary cardholders, beneficiaries, your spouse or common-law partner or dependents insured under an insurance product or having rights with regard to a registered plan, an authorized user of your account, and the contact information of someone you believe may be interested in a product or service offered by the Bank and its subsidiaries - if permitted by law)   *If you provide us with information about another individual, we will assume that you are authorized to do so and that you have obtained that individual’s consent for the collection, use or disclosure of that information for the purposes set out in this policy. IMPORTANT: We limit the collection of your information to what is necessary to help us serve you properly. 2.2. How we may collect your information We may collect your information in the following ways:  Directly from you, when you contact us or interact with us in person, by phone, in writing or via our online services.  Automatically, when you interact with us online, by phone or in person, including through: Cookies and similar technologies, which collect digital information and details about your devices when you visit or use our websites or mobile apps. For more details, see our Digital data policy. Surveillance cameras, which may record images in and around our branches, ABMs and other locations to help protect clients, employees and property. Call recordings and written transcripts of conversations with customer support, to confirm instructions, ensure service quality and support staff training. From third parties and other sources, only with your consent or as otherwise permitted or required by law. These sources may include: Individuals or entities related to your products and services  Other financial institutions, lenders or insurers (if we need to verify the accuracy of the information provided) Brokers, dealers or other stakeholders in securities or other fields  Credit evaluation reporting and assessment agencies Publicly available sources or records  Regulatory bodies and self-regulatory organizations The Bank or its subsidiaries  Program partners  Our websites or mobile apps and digital or social media platforms. For more details, please refer to our Digital data policy