KeyCorp Online Privacy Statement

KeyCorp (together with its subsidiaries and affiliates, “Key” or “we”) is committed to maintaining the privacy and security of personal information submitted by visitors of Key’s websites and mobile applications. This KeyCorp Online Privacy Statement (“Statement”) explains how Key’s online services collect, use, and share information. This Statement applies when visiting Key's websites, mobile applications, and affiliated websites displaying this Statement. Other Key policies, such as the KeyCorp Privacy Notice, may also apply.

Third-Party Websites
Key uses trusted third-party content and service providers to enhance our customers’ online experiences. The enhancements offered to you by these service providers and third-party websites may include surveys, advertisements, online calculators, forms, and other online tools and applications. As such, Key may provide links to websites neither owned nor operated by Key. This Statement does not apply to the online practices of these third-party websites.

When you click on a link and visit a third-party website, you will be subject to that website’s privacy and security practices. You should familiarize yourself with the privacy statement, terms of use, and security practices of the linked third-party website before providing any information.

Information We Collect
When you visit our websites and mobile applications, we collect information about your online session, as well as information that you provide to us during your session, such as when you log in or fill out an application for a product or service.

The following table describes the categories of personal information collected, as well as the business purpose for collecting each category of personal information.

Information Collected Business Purpose
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Debugging to identify and repair errors that impair existing intended functionality.
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Characteristics of protected classifications under California or federal law
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Undertaking internal research for technological development and demonstration.
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Biometric information
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Debugging to identify and repair errors that impair existing intended functionality
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an Internet Web site, application, or advertisement
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services,
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Debugging to identify and repair errors that impair existing intended functionality
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Geolocation data
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Debugging to identify and repair errors that impair existing intended functionality
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Audio, electronic, visual, thermal, or similar information
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Debugging to identify and repair errors that impair existing intended functionality
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Professional or employment-related information
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking internal research for technological development and demonstration.
Education information
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services Undertaking internal research for technological development and demonstration.
Inferences drawn from any of the above information to determine consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
  • Performing services including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services
  • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
  • Debugging to identify and repair errors that impair existing intended functionality
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
  • Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
  • Undertaking internal research for technological development and demonstration.

How We Collect Information
Information is collected when you provide it to us as well as through “cookies” and other tracking methods. Cookies are small amounts of data stored by your web browser that provide a web site with information such as the time of your last site visit and the pages you viewed.

Most web browsers allow you to delete or decline cookies, however doing so may impact your online experience. For example, you may have to identify yourself more frequently, as services like Online Banking require you to accept cookies or similar files in order to function properly.

If you are a customer or have applied for a product or service with Key, we may also obtain your information from credit reporting agencies or other service providers, in order to verify the information you have submitted.

Key also collects prospective customer contact information from its marketing partners and credit reporting agencies and via .referrals from business partners and customers.

Other Ways Information Is Collected

  • Online Surveys and Forms
    Information you provide while completing surveys and forms on Key’s websites or mobile applications may also be collected and stored. Unless otherwise stated, this information is used to help Key develop a superior Web experience and enhance products and services.
  • Email and Online Chat
    Information sent via email or Key’s Online Chat functionality may be retained in order to respond to your requests or inquiries and for quality assurance purposes.
  • Online Behavioral/ Interest-Based Advertising
    Key may partner with third-parties to deliver and monitor advertisements on Key’s websites and other sites across the web. Key and/or Key's partners may monitor and record advertisement "click-through" rates, Web traffic, activities on third-party websites, and other activities in order to improve visitor experience and provide relevant advertising. Key and/or Key's partners may use cookies, Web beacons, or other monitoring technology to compile statistics about website traffic.
    To learn more about this type of advertising, including how to opt out of certain types of online advertisements, please visit the Network Advertising Initiative's website at www.networkadvertising.org.
  • Adobe Device Co-Op
    Key participates in the Adobe Marketing Cloud Device Co-op, which helps companies build websites, applications, and advertisements that seamlessly flow across all user devices (desktops, laptops, tablets, phones, smart watches, etc.). The Adobe Marketing Cloud Device Co-op recognizes which of your devices are linked (used by the same person) through the use of technology that includes cookies and your IP address. Visit the Adobe website for more information on cross-device tracking and/or to unlink your devices.
  • Social Media
    Key provides information about our products, services, and community involvement on social media sites like Facebook and Twitter. Please keep in mind that any information you share on these social media sites is visible to all users. You should never post any sensitive personal information (such as account number or social security number) on these sites. Please carefully review the Terms of Use and Privacy Policy on these sites as they may be different than our own policies.

How We Share Information
The personal information described in the “Information We Collect” section above may be shared with third parties for Key’s business purposes and to comply with applicable law. These third parties may include: marketing partners and service providers, data analytics providers, consultants and advisors, technology service providers, and government agencies as required or permitted by law. We disclose this information for business purposes including to provide you with information regarding Key’s products and services; for analytics purposes; to our service providers to support our operations; and to maintain compliance with applicable laws and regulations.
Please see the KeyCorp Privacy Notice to learn more about how information may be shared by Key and how you may limit certain types of sharing.
Please note, Key does not sell personal information as that term is defined in the California Consumer Privacy Act.

How We Safeguard Information
At Key, we are committed to safeguarding personal information. We use physical, technical, and administrative security measures that comply with applicable federal and state laws and regulations. When you log in to Key’s online services or enter application information, Key uses technology to encrypt and privately transfer your information to our network. Additional details on how Key protects information online, plus measures you can take to protect yourself, can be found on the Privacy & Security page on key.com.

How You Can Manage Information Collected
Keeping your account information accurate and up to date is important. If your account information is incomplete, inaccurate or not current, please update your information through Online Banking, by calling KeyBank Customer Service, or by visiting a branch.

You can also limit how Key shares your information (as outlined in the KeyCorp Privacy Notice) and adjust your solicitation preferences by calling Key’s Privacy Line at 1-800-361-0968.

California Consumer Privacy Act (CCPA) Requests

If you are a California resident, the CCPA allows you to request information about the data Key collects and uses about you, including:

If you are a California resident and wish to make a request for the above information, please visit our CCPA request page. You may authorize another individual to submit this request on your behalf.

To submit this request, you must submit your:

Once your request is submitted, we will conduct a search of our systems and provide you with a response within 45 days.

California Non-Discrimination

California prohibits businesses from discriminating against you for exercising any rights under the CCPA, including, but not limited to, by:

However, you may be charged a different price or rate, or provided a different level or quality of goods or services, if that difference is reasonably related to the value provided to you by your data. Businesses may offer financial incentives to you, including payments as compensation, for the collection of personal information, the sale of personal information, or the deletion of personal information.

California Data Deletion Requests

If you are a California resident, you have the right to request that Key delete personal information we hold about you. To submit a deletion request, please visit our CCPA request page. You may authorize another individual to submit this request on your behalf. Please note, however, that there are many instances in which Key is required to maintain, or otherwise is not required to delete, your personal information. For example, Key is not required to delete your information if it is being used:

Online Tracking
How web browsers communicate Do Not Track signals is not yet uniform. As a result, this site is not currently equipped to interpret or respond to Do Not Track signals communicated by your browser. To learn more about online tracking, you can visit the Future of Privacy Forum’s “All About Do Not Track” website.

Children’s Information
Key’s websites, mobile applications, and online services are not directed to individuals under the age of thirteen, and do not knowingly collect information from these individuals. We request that those under the age of thirteen do not provide information through our websites or mobile applications. You can learn more about the Children's Online Privacy Protection Act (COPPA) at the Federal Trade Commission’s website.

Changes to Key's Online Privacy Statement
Key's Online Privacy Statement is subject to change from time to time. When changes are made, we will communicate these changes to you by posting the revised Statement on this page and adjust the “Last Updated” date. Any changes to this Statement will become effective on the date of posting unless indicated otherwise.

Last updated: February 4, 2020

(ID 1910-512)