Privacy and Security Policy Privacy Statement Your privacy is important to Cecil Bank and we are committed to the protection of your financial information. At Cecil Bank, we believe we are privileged to have you as a customer. We believe that the most important part of a customer relationship is the bond of trust established between you and us. Because of this belief, we want you to know how we protect your information and to be cognizant of the data we do share. How We Protect Your Financial Information One of our top priorities at Cecil Bank is keeping your financial information secure. We limit access to customer information to those employees who need to know that information in order to provide products and services to you. Our employees are bound by our financial privacy policy and information security program to treat customer information confidentially and they are subject to disciplinary action if they fail to follow this policy. In accordance with applicable data security regulations, we also maintain physical, electronic and procedural safeguards to protect your nonpublic personal information and to assist us in preventing unauthorized access to such information. Information We Collect We generally collect only the information necessary to consummate transactions for you. The nonpublic personal information we collect comes from information you provide to us on applications and other forms, and from transactions you conduct with our affiliates, us and others. We also collect information about your transactions with us, our affiliates, and others, including your account balance, payment history and parties to your transactions. We also collect information we receive from certain outside sources such as credit reporting agencies. This information includes your creditworthiness and credit history. The information from you that we collect includes your name, address, phone number, demographic, transactional and other account information. How We Share Your Information At Cecil Bank, we do not share your nonpublic personal information with nonaffiliated third parties except for the routine processing of transactions made at your request and as otherwise permitted or required by law. Nor do we share nonpublic personal information about our former customers. In order to keep you abreast of products and services we think may be of interest to you, we may share information (as described above) with companies that perform marketing services on our behalf or with other financial institutions with which we have joint marketing agreements. We only share nonpublic personal information with companies that contractually agree to maintain the confidentiality and security of your information and they can only use it for the specific purpose we have identified. We may share information as permitted by law with our affiliates. This data includes identification information, such as name and address, and information regarding your transactions or experiences with us as described above. To facilitate the quick and efficient completion of your transactions, we also share information (as described above) with services providers such as check printers, fraud prevention agencies, appraisers, credit reporting agencies, taxing authorities and similar institutions. Maintaining Accurate Customer Information We make every effort to ensure your personal and financial information is kept up to date and accurate. If you discover that any of your information is inaccurate, we encourage you to contact us in writing at P.O. Box 469, Elkton, MD 21922-0469, or you may call 410-398-1650. We will make any required correction after verifying the authenticity of your request. We reserve the right to share any nonpublic personal information with any affiliates or nonaffiliates in the future and to revise this policy accordingly. Cecil Bancorp, Inc. Family of Affiliates The following lists our family of affiliate companies to which this policy applies, as of May 15, 2001: Cecil Bancorp, Inc. Cecil Bank Cecil Financial Services Corporation Cecil Service Corporation Columbian Bank Internet Privacy Statement We recognize the importance of protecting the privacy of personally-identifying information that may be submitted to us when you visit our website. The information we receive depends on what you do when you visit our site. This is how we handle the information we learn about you from your visit to our website. If you visit our site to read or download information on our web pages such as press releases and checking and savings account information: We collect and store only the following information about you: name of the domain from which you access the Internet (for example, aol.com, if you are connecting from an America Online account, or a similar domain corresponding to your Internet Service Provider "ISP"); date and time you access our website; pages you may have visited on our site; and Internet address of the website from where you came to visit our website. We use the information we collect to measure the number of visitors to the different pages and sections of our site, and to help us make our site more useful to visitors. If you visit our website to use interactive banking tools such as financial calculators and self-tests: You may be asked for personal information in order to complete the requested analysis or evaluation. This information is NOT retained. If you identify yourself by sending an e-mail or filling forms such as applications, check reorder forms, contact forms and guest registers: You may be asked for personally-identifying information in order to process your e-mail, form or application. This information may be retained by us and our business partners for processing and to facilitate decisions. Information you submit to us is treated no differently than any information you might provide in a written format such as a brochure application, reorder slip to order checks, or a letter. We Want To Be Very Clear We protect and safeguard the privacy of users of our on-line services, just as we do throughout the rest of our business. We will use personal information to identify you, to communicate with you, and to help us answer your questions. We will NOT sell personally-identifying information to a third party for the purpose of solicitation or provide personal information to a third party for its own use. Sometimes we send our customers information about our products and services. If you do not wish to receive this information, or if you believe that your personal information is incorrect please contact us. We will investigate the situation and if appropriate update our records. If you have any questions that are not answered in this section please contact us. Security Statement Our website brings together a combination of industry-approved security technologies to protect data for the bank and for you, our customer. It features a VeriSign-issued Digital ID for the bank's Internet Service Provider hosting our website, Secure Sockets Layer (SSL) protocol for data encryption, and a router and firewall to regulate the inflow and outflow of server traffic. Secure Data Transfer Once a server session is established on an https secure page, the user and the server are in a secured environment. Because the server has been certified as a 128-bit secure server by VeriSign, data traveling between the user and the server is encrypted with Secure Sockets Layer (SSL) protocol. With SSL, data that travels between the bank and customer is encrypted and can only be decrypted with the public and private key pair. In short, the bank's server issues a public key to the end user's browser and creates a temporary private key. These two keys are the only combination possible for that session. When the session is complete, the keys expire and the whole process starts over when a new end user makes a server session. Router and Firewall Secure forms must filter through a router and firewall before they are permitted to reach the server. A router, a piece of hardware, works in conjunction with the firewall, a piece of software, to block and direct traffic coming to the server. The configuration begins by disallowing ALL traffic and then opens holes only when necessary to process acceptable data requests, such as retrieving web pages or sending customer requests to the bank. Using the above technologies, your Internet loan application and check reorder transactions are secure. Important Information About Procedures For Opening A New Account To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see your driver's license or other identifying documents.