Global Supplemental Privacy Notice
LAST UPDATED: October 2025
Introduction
This Global Supplemental Privacy Notice (“Notice”) provides an overview of how Bank of America
Corporation and all banking and non-banking U.S. affiliates or subsidiaries (“we” or “our” or “us”) collect,
use or disclose Personal Information (as defined below) including information about our current and
former customers and clients (“you” or “your”). This Notice explains our data collection policies when we
engage in the processing activities, described in Processing Activities section below, to provide financial
services (“Services”).
Protecting your Personal Information is a top priority. Consistent with our obligations under applicable
laws and regulations, we have internal procedures and policies in place to maintain physical, technical,
electronic, procedural, and organizational safeguards and security measures that are designed to protect
Personal Information against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure,
or access, whether it is processed by us or elsewhere.
Consumers in the U.S. who seek, apply for, or obtain our financial products and services for personal,
family, or household purposes should also refer to our
U.S. Consumer Privacy Notice
. In the event of a
conflict between this Notice and our U.S. Consumer Privacy Notice, when applicable, the U.S. Consumer
Privacy Notice shall govern. California residents may have additional rights and are encouraged to review
our
California Consumer Privacy Notice
for additional information.
Updates to this Notice
This Notice is subject to change and is updated periodically to comply with applicable laws and
regulations. The “LAST UPDATED” date at the top of this Notice indicates when this Notice was last
revised. Changes are effective when we publish the revised Notice.
Personal Information We Collect
“Personal Information” is information that identifies an individual or relates to an identifiable individual.
The table below contains a list of the Personal Information we may collect from you or through your
interaction with the Services. Failure to provide the requested information, may prevent us from providing
the requested Services. In the table under Processing Activities, we have associated the categories of
Personal Information we collect with the categories of our processing activities/processing.
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
1/22
Categories of
Personal
Information
Types of Information
Account Activity
Transactional activity from an individual’s personal or business accounts (e.g., credit card,
checking account, etc.), such as: Account activity, transaction details, loan number, internal
identifier
Associated
Characteristics
An individual’s characteristics such as age or gender
Compensation
Information
Information pertaining to employment status and income sources, such as: Employer name,
business address, business phone number, business email address, salary, or other source of
income
Event Data
Confirmation of an individual’s attendance at in-person or virtual events. Information
gathered to enable attendance or to offer special accommodations, such as:
Events registration, check-in, dietary requests, travel, surveys, and other similar identifiers.
(Note: religion, disability and health concerns may be inferred from a person’s requests.)
Images/Videos/
Audio — People
Video of clients (ATMs, Financial Centers), Audio of clients (Contact Center, Financial Center
Outbound calls), such as: Photographs, video or audio recordings of individuals and/or
groups
Legal Transactions
Information from judiciary bodies regarding legal matters pertaining to an individual, such
as: Legal documents and/or decisions
Online
Authentication
Information
Information required to access an individual’s personal account, online or through mobile
applications, such as: User Identification (ID), PIN/Password, Internet Protocol (IP) address,
challenge questions, device ID, mobile phone number, biometric information
Online Behavior
An individual’s purchasing, browsing and consuming history and inferences drawn to
determine the individual’s tendencies online, such as: Purchasing, browsing, search, internet
interactions (site, application and/or advertisement) history behavior
Online Identifier
A means of identifying an individual by associating informational traces an individual leaves
when operating online, such as: Cookies, pixel tags, web beacons, locally stored objects,
unique device identifiers (for example, Media Access Control (MAC) and Internet Protocol (IP)
addresses, smart device information, mobile phone network information
Payroll Data
Payroll information including direct deposit bank details, payroll deductions and tax details,
such as: Direct deposit bank details, payroll deductions, tax details
Personal Assets/
Liabilities
Information regarding household expenses, income, asset ownership and/or debt
information, such as: Household expenses, source/frequency of funds, source/frequency of
income, investments, other expenses, financial plan
Personal Data —
Minors
Personal Information pertaining to an individual under 18 years of age such as: Name,
account information, relationships to other account holders, event registration information,
which may include special accommodations and dietary restrictions
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
2/22
Categories of
Personal
Information
Types of Information
Preferences
Such as language, interests, and other feedback/preferences that you might express during
your use of our Services.
Proof of Address
Information found on utility bills and/or financial statements
Sensitive Personal
Information
Information about an individual’s religious, ideological, political or trade union related views
or activities, health, racial or ethnic origin, social security measures and administrative or
criminal proceedings and sanctions, such as: Race, ethnicity, religion, disability information,
criminal records, political or philosophical belief
Signature
Any symbol, character, sound, or mark made by an individual with the intent to authenticate
or authorize a transaction, agreement, or written or electronic document, such as: Electronic
signature, digital signature (i.e., DocuSign), web signature, copy of written signature, ink/wet
signature
Categories of Personal Information
Types of Information
Account Activity
Transactional activity from an individual’s personal or business accounts (e.g., credit card, checking
account, etc.), such as: Account activity, transaction details, loan number, internal identifier
Associated Characteristics
An individual’s characteristics such as age or gender
Compensation Information
Information pertaining to employment status and income sources, such as: Employer name, business
address, business phone number, business email address, salary, or other source of income
Event Data
Confirmation of an individual’s attendance at in-person or virtual events. Information gathered to enable
attendance or to offer special accommodations, such as: Events registration, check-in, dietary requests,
travel, surveys, and other similar identifiers. (Note: religion, disability and health concerns may be inferred
from a person’s requests.)
Images/Videos/ Audio — People
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
3/22
Video of clients (ATMs, Financial Centers), Audio of clients (Contact Center, Financial Center Outbound
calls), such as: Photographs, video or audio recordings of individuals and/or groups
Legal Transactions
Information from judiciary bodies regarding legal matters pertaining to an individual, such as: Legal
documents and/or decisions
Online Authentication Information
Information required to access an individual’s personal account, online or through mobile applications,
such as: User Identification (ID), PIN/Password, Internet Protocol (IP) address, challenge questions, device
ID, mobile phone number, biometric information
Online Behavior
An individual’s purchasing, browsing and consuming history and inferences drawn to determine the
individual’s tendencies online, such as: Purchasing, browsing, search, internet interactions (site, application
and/or advertisement) history behavior
Online Identifier
A means of identifying an individual by associating informational traces an individual leaves when
operating online, such as: Cookies, pixel tags, web beacons, locally stored objects, unique device
identifiers (for example, Media Access Control (MAC) and Internet Protocol (IP) addresses, smart device
information, mobile phone network information
Payroll Data
Payroll information including direct deposit bank details, payroll deductions and tax details, such as: Direct
deposit bank details, payroll deductions, tax details
Personal Assets/ Liabilities
Information regarding household expenses, income, asset ownership and/or debt information, such as:
Household expenses, source/frequency of funds, source/frequency of income, investments, other
expenses, financial plan
Personal Data — Minors
Personal Information pertaining to an individual under 18 years of age such as: Name, account
information, relationships to other account holders, event registration information, which may include
special accommodations and dietary restrictions
Preferences
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
4/22
Such as language, interests, and other feedback/preferences that you might express during your use of
our Services.
Proof of Address
Information found on utility bills and/or financial statements
Sensitive Personal Information
Information about an individual’s religious, ideological, political or trade union related views or activities,
health, racial or ethnic origin, social security measures and administrative or criminal proceedings and
sanctions, such as: Race, ethnicity, religion, disability information, criminal records, political or
philosophical belief
Signature
Any symbol, character, sound, or mark made by an individual with the intent to authenticate or authorize a
transaction, agreement, or written or electronic document, such as: Electronic signature, digital signature
(i.e., DocuSign), web signature, copy of written signature, ink/wet signature
In addition, we may collect Personal Information from other sources, including:
Third-Party Logins: When you connect or login to our Services through a third-party service, you direct the
service to send us information as controlled by that service or as authorized by you via your privacy settings on
that service.
Client-related Persons: We may collect information from persons or institutions representing you. Where you
are accessing our Services because of a relationship with a corporate or institutional client (“Corporate Client”),
we also may collect information from the Corporate Client (e.g., where you are an employee or board member).
Other Third Parties: We may collect information from sources such as publicly available databases, marketing
partners, third-party providers, and data brokers.
If you are sharing information on behalf of another individual, please provide them with a copy of this
Notice. When you provide us with Personal Information about members of their family, dependents or
friends (e.g., individuals provided by a customer as a guarantor), it is your responsibility to inform
such individuals and obtain agreement that their data can be shared with us. Should the individual
have any questions, please refer them to the Contact Us section in this Notice. By disclosing Personal
Information about others to us in connection with our Services, you represent that you have the
authority to do so and permit us to use the information in accordance with this Notice.
Processing Activities
We need to collect and process Personal Information to provide the requested Services, or because
we are legally required to do so. The table below is a summary of our activities which may require the
processing of your Personal Information.
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
5/22
Purpose
Reasons for Processing
Categories of Personal
Information
Account Opening
and Management
To obtain all enterprise and regulatory
requirements for the opening, expansion of
services and account maintenance, which may
include identity verification requirements.
To meet all regulatory requirements to obtain the
necessary information to open accounts to enable
your trading or other activities.
Account Activity, Associated
Characteristics, Compensation
Information, Contact Data,
Identifiers, Images/Videos/Audio
— People, Personal
Assets/Liabilities, Personal Data
— Minors, Proof of Address,
Signature
Aggregation /
Anonymization
Aggregating and/or anonymizing Personal Information
so that it will no longer be considered Personal
Information.
Personal Information as relevant
for the specific business
purpose.
Analytics and
Modeling
To provide modeling and analytical insights about our
consumers.
Account Activity, Associated
Characteristics, Compensation
Information, Contact Data,
Identifiers, Online Activity,
Sensitive Personal Information
Client
Communications
and Relationship
Management
To directly communicate with you to help improve the
Services we provide or in relation to a Service
complaint.
Associated Characteristics,
Contact Data, Identifiers, or
other categories as relevant for
the specific communication
about our Services
Consumer and
Wealth Services
To provide overall support in connection with existing or
former accounts, including Trust Services that may
involve account transition and termination
Associated Characteristics,
Contact Data, Identifiers, Legal
Transactions, Online
Authentication
Information, Online Behavior,
Online Identifier, Personal Data
— Minors, Sensitive Personal
Information
Corporate Client
Services
To provide Corporate Client Services, including
corporate credit cards, benefit programs.
Account Activity, Associated
Characteristics, Contact Data,
Identifiers, Legal Transactions,
Online Authentication
Information, Online Behavior,
Online Identifier, Sensitive
Personal Information
Electronic
Communications/
Digital Services
To facilitate sending internal digital messages.
To enable your experience and interactions
through our mobile application or online banking.
To enable a customer to send their account
information, with consent and by request, to a
third-party application (e.g., Venmo, Mint).
Account Activity, Associated
Characteristics, Contact Data,
Identifiers, Images/
Videos/Audio — People, Online
Authentication Information,
Online Behavior, Online
Identifier
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
6/22
Purpose
Reasons for Processing
Categories of Personal
Information
Emergency and
Incident Response
Ensuring the safety of on-site personnel and visitors;
responding to, handling, and documenting on-site
accidents and medical and other emergencies; actively
monitoring properties to ensure adequate incident
prevention, response, and documentation (including
CCTV); requesting assistance from emergency services;
and sending notifications and alerts in the event of
incidents or emergencies (such as via SMS, email, call,
audio visual device prompts, etc.).
Personal Information as relevant
for the specific legal action,
regulatory investigation, and/or
legal processes in question.
Events
Management
To support event management and execution.
Associated Characteristics,
Contact Data, Event Data,
Identifiers, Images/Videos/Audio
— People, Personal Data —
Minors, Sensitive Personal
Information
Legal, Regulatory
and Compliance
To fulfill our legal and compliance-related
obligations.
To comply with applicable laws and regulations
(including any legal or regulatory guidance, codes,
or opinions), sanctions and non-financial regulatory
reporting requirements.
To comply with applicable Anti-Money Laundering
(AML)/ Know-Your-Customer (KYC) laws and
regulations, including identifying beneficial
owners, conducting background checks,
monitoring, and performing other checks to meet
anti-terrorism financing legal requirements. As
required by applicable laws, this may involve
processing your political affiliations, criminal
convictions, or allegations of offenses.
Account Activity, Associated
Characteristics, Contact Data,
Identifiers, Personal Information
including Personal Information
as relevant for each specific
regulatory and compliance
obligation, Proof of Address,
Sensitive Signature
Marketing /
Communications
Sending you newsletters, event invitations, and mailings
(digital and non-digital) that we think may be of interest
to you; providing and fulfilling event registration and
service requests.
Associated Characteristics,
Contact Data, Event Data,
Identifiers,
Monetary
Transactions
To enable the movement of money in/out of your
account.
Associated Characteristics,
Contact Data, Identifiers
Operations and
General Business
Administering online Services (including troubleshooting
and diagnostic testing, conducting performance
analyses of our systems and Services, testing new
system features to evaluate their impact, system and
log maintenance, technical support, system debugging,
and hosting data); and facilitating mergers, acquisitions,
and other reorganizations and restructurings of our
business (including prospective transactions).
Personal Information as relevant
for the specific business
operations
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
7/22
Purpose
Reasons for Processing
Categories of Personal
Information
Personalizing our
Services
Personalizing our interactions with you and providing
you with information and/or offers we believe will be
relevant and interesting to you.
Associated Characteristics,
Contact Data, Event Data,
Identifiers, Online Behavior,
Preferences
Risk Analysis
To manage our internal risk and analyzing our client
portfolio.
Account Activity, Associated
Characteristics, Compensation
Information, Contact Data,
Event Data, Identifiers, Online
Behavior, Personal
Assets/Liabilities, Sensitive
Personal Information
Specialized Services
To facilitate referrals to specialists.
To support payroll activities or other services
requested by the client.
Associated Characteristics,
Contact Data, Identifiers, Payroll
Data
Wealth
Management
To provide overall support in connection with existing or
former accounts, including Trust services that may
involve account transition and termination
Associated Characteristics,
Contact Data, Legal
Transactions, Online Activity,
Sensitive Personal Information
Purpose
Reasons for Processing
Categories of Personal Information
Account Opening and Management
To obtain all enterprise and regulatory requirements for the opening, expansion of services and account
maintenance, which may include identity verification requirements.
To meet all regulatory requirements to obtain the necessary information to open accounts to enable your
trading or other activities.
Account Activity, Associated Characteristics, Compensation Information, Contact Data, Identifiers,
Images/Videos/Audio — People, Personal Assets/Liabilities, Personal Data — Minors, Proof of Address,
Signature
Aggregation / Anonymization
Aggregating and/or anonymizing Personal Information so that it will no longer be considered Personal
Information.
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
8/22
Personal Information as relevant for the specific business purpose.
Analytics and Modeling
To provide modeling and analytical insights about our consumers.
Account Activity, Associated Characteristics, Compensation Information, Contact Data, Identifiers, Online
Activity, Sensitive Personal Information
Client Communications and Relationship Management
To directly communicate with you to help improve the Services we provide or in relation to a Service
complaint.
Associated Characteristics, Contact Data, Identifiers, or other categories as relevant for the specific
communication about our Services
Consumer and Wealth Services
To provide overall support in connection with existing or former accounts, including Trust Services that
may involve account transition and termination
Associated Characteristics, Contact Data, Identifiers, Legal Transactions, Online Authentication
Information, Online Behavior, Online Identifier, Personal Data — Minors, Sensitive Personal Information
Corporate Client Services
To provide Corporate Client Services, including corporate credit cards, benefit programs.
Account Activity, Associated Characteristics, Contact Data, Identifiers, Legal Transactions, Online
Authentication Information, Online Behavior, Online Identifier, Sensitive Personal Information
Electronic Communications/ Digital Services
To facilitate sending internal digital messages.
To enable your experience and interactions through our mobile application or online banking.
To enable a customer to send their account information, with consent and by request, to a third-party
application (e.g., Venmo, Mint).
Account Activity, Associated Characteristics, Contact Data, Identifiers, Images/ Videos/Audio — People,
Online Authentication Information, Online Behavior, Online Identifier
Emergency and Incident Response
Ensuring the safety of on-site personnel and visitors; responding to, handling, and documenting on-site
accidents and medical and other emergencies; actively monitoring properties to ensure adequate incident
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
9/22
prevention, response, and documentation (including CCTV); requesting assistance from emergency
services; and sending notifications and alerts in the event of incidents or emergencies (such as via SMS,
email, call, audio visual device prompts, etc.).
Personal Information as relevant for the specific legal action, regulatory investigation, and/or legal
processes in question.
Events Management
To support event management and execution.
Associated Characteristics, Contact Data, Event Data, Identifiers, Images/Videos/Audio — People, Personal
Data — Minors, Sensitive Personal Information
Legal, Regulatory and Compliance
To fulfill our legal and compliance-related obligations.
To comply with applicable laws and regulations (including any legal or regulatory guidance, codes, or opinions),
sanctions and non-financial regulatory reporting requirements.
To comply with applicable Anti-Money Laundering (AML)/ Know-Your-Customer (KYC) laws and regulations,
including identifying beneficial owners, conducting background checks, monitoring, and performing other checks
to meet anti-terrorism financing legal requirements. As required by applicable laws, this may involve processing
your political affiliations, criminal convictions, or allegations of offenses.
Account Activity, Associated Characteristics, Contact Data, Identifiers, Personal Information including
Personal Information as relevant for each specific regulatory and compliance obligation, Proof of Address,
Sensitive Signature
Marketing / Communications
Sending you newsletters, event invitations, and mailings (digital and non-digital) that we think may be of
interest to you; providing and fulfilling event registration and service requests.
Associated Characteristics, Contact Data, Event Data, Identifiers,
Monetary Transactions
To enable the movement of money in/out of your account.
Associated Characteristics, Contact Data, Identifiers
Operations and General Business
Administering online Services (including troubleshooting and diagnostic testing, conducting performance
analyses of our systems and Services, testing new system features to evaluate their impact, system and
log maintenance, technical support, system debugging, and hosting data); and facilitating mergers,
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
10/22
acquisitions, and other reorganizations and restructurings of our business (including prospective
transactions).
Personal Information as relevant for the specific business operations
Personalizing our Services
Personalizing our interactions with you and providing you with information and/or offers we believe will
be relevant and interesting to you.
Associated Characteristics, Contact Data, Event Data, Identifiers, Online Behavior, Preferences
Risk Analysis
To manage our internal risk and analyzing our client portfolio.
Account Activity, Associated Characteristics, Compensation Information, Contact Data, Event Data,
Identifiers, Online Behavior, Personal Assets/Liabilities, Sensitive Personal Information
Specialized Services
To facilitate referrals to specialists.
To support payroll activities or other services requested by the client.
Associated Characteristics, Contact Data, Identifiers, Payroll Data
Wealth Management
To provide overall support in connection with existing or former accounts, including Trust services that
may involve account transition and termination
Associated Characteristics, Contact Data, Legal Transactions, Online Activity, Sensitive Personal
Information
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
11/22
European Economic Area (EEA)/United Kingdom (UK) residents should refer to the EEA/UK Supplement
section of this Notice for more information regarding our legal basis for processing Personal Information.
Cookies and Similar Technologies
We may collect personal information using cookies and similar technologies. See our
Cookie Policy (PDF)
for additional details about cookies and tracking technologies including how you can manage cookies.
Disclosure of Personal Data
We may disclose Personal Information to affiliates and third parties in connection with the Services we
are providing. The recipients of any such information will depend on the Services that are being provided.
Disclosures may include the following categories of third parties listed in the table below:
Categories of third parties
Personal Information
Purpose of Disclosing your Personal Information
Account Management Software
Service Providers
Contact Data
To help process invoices and statements to you
on services we provided or transactions we
conducted with you. These providers help us
with the management of financial accounts and
processes with tools and controls that support
our organizational, operational, and legislative
requirements (includes maintenance and
support services).
Aggregators
Activity (Account/
Transaction), Personal
Assets/ Liabilities,
Personal Data, Business
Contact Data
To provide services in our mobile and online
banking experience such as My Financial Picture
and allow you with your consent to send data to
a third party (e.g., Venmo, Mint)
Analytics Providers
Personal Information
Categories provided
above
To aggregate and/or anonymize Personal
Information, improve the Services, conduct
marketing, personalize the Services and for
security and fraud prevention and operations
and general business.
Beneficial Owner Registries
required by relevant regulators
Personal Information as
required by law, rules, or
regulations
If you are a beneficial owner, to share your
Personal Data to the extent required by the
relevant Beneficial Owner Registries in the
jurisdiction applicable to you
Clients — Complaint matters
Personal Information,
Activity (Account/
Transaction),
Assets/Liabilities
Client complaint reporting
Communication and Collaboration
Software and Software Services
providers
Personal Data, Personal
Data — Minors, Business
Contact Data
To service your accounts and share transaction
documents with you. This includes providers
that enable individuals and teams to work
together over geographic distances by providing
tools that aid communication, collaboration and
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
12/22
Categories of third parties
Personal Information
Purpose of Disclosing your Personal Information
the process of problem solving (includes
appliances, maintenance, and support services).
Corporate Business Application
vendors
Contact Data
To send you service or transactional emails or
communications, as applicable and appropriate.
These vendors provide software and software
services to support our Global Banking and
Global Markets businesses, including technology
for Sales and Trading functions within Global
Equities, Fixed Income Currency and
Commodities, Global Research and technology
for Credit, Cash Management, FX, Equipment
Finance and Merchant Services within Global
Banking.
Customers — Offshore fund
companies
Identifiers, Contact Data,
Account Activity
Mutual fund rebates and reporting
Digital Commerce and Payment
Services Providers
Contact Data, Online
Authentication, Online
Identifier
If you are a client of Global Transaction
Services, to enable you to conduct transactions
online and via mobile devices, to authenticate
you when you log into online portals, to access
your account, review and conduct your
transactions.
Digital Process Automation
Software Services Providers
Signature, Contact Data
To enable you to review and sign contracts with
us electronically. This includes vendors who
automate and digitize our transaction
documentation workflow.
Digital Tracking Providers
Online Behavior, Online
Identifier
To improve technical and design features of our
websites and platforms, including
personalization. This includes companies that
provide digital tracking services (like cookies,
tags, etc.) and whose scripts we use to add to
our webpages.
External Law Firms and other
professional advisors, consultants,
experts
Personal Information as
relevant in each specific
situation
To provide legal and compliance support,
such as to prepare transactional
documents with you, in support of the
services we provide to you, or to defend
claims involving you.
To improve services and for security and
fraud prevention.
Hotels, Restaurants, Virtual event
platforms, Transportation
Companies, and Corporate Security
Contact Data, Identifiers,
Personal Data — Minors,
Event Data
To assist with our events management and
execution.
Partner Banks, including Vendors
Account Activity,
Compensation
To allow our Partner Banks to process payments
to or from individuals related to your account
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
13/22
Categories of third parties
Personal Information
Purpose of Disclosing your Personal Information
and Credit Card Partners
Information, Contact
Data, Identifiers,
Personal Data — Minors,
including Personal
Information as is
necessary to enable us
to provide you with the
services
with us in places where we do not have a
presence, or we are unable to provide the
relevant services. Partner Banks are banks with
which we have arrangements to enable us to
provide the Services to you.
Partners — Fund Companies
Identifiers, Contact Data,
Account Activity
To manage mutual fund rebates and reporting.
Regulators
Personal Information as
relevant in each specific
situation
To comply with regulatory requirements that
obligate us to share your Personal Information.
Tax Authorities and Service
Providers
Contact Data, Identifiers,
and other Personal
Information relevant to
the Services
To share your Personal Information for us
comply with Foreign Account Tax Compliance
Act (“FATCA”), Client Relationship Summary
(“CRS”) and other tax-related reporting
requirements.
Third parties, such as an acquiring
entity and its advisors, in
connection with a sale or business
transaction
Personal Information
categories relevant to
the transaction
We may disclose or transfer your Personal
Information in the event of any reorganization,
merger, sale, joint venture, assignment,
transfer, or other disposition of all or any
portion of our business, assets, or stock
(including in connection with any bankruptcy or
similar proceedings).
Categories of third parties
Personal Information
Purpose of Disclosing your Personal Information
Account Management Software Service Providers
Contact Data
To help process invoices and statements to you on services we provided or transactions we conducted
with you. These providers help us with the management of financial accounts and processes with tools
and controls that support our organizational, operational, and legislative requirements (includes
maintenance and support services).
Aggregators
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
14/22
Activity (Account/ Transaction), Personal Assets/ Liabilities, Personal Data, Business Contact Data
To provide services in our mobile and online banking experience such as My Financial Picture and allow
you with your consent to send data to a third party (e.g., Venmo, Mint)
Analytics Providers
Personal Information Categories provided above
To aggregate and/or anonymize Personal Information, improve the Services, conduct marketing,
personalize the Services and for security and fraud prevention and operations and general business.
Beneficial Owner Registries required by relevant regulators
Personal Information as required by law, rules, or regulations
If you are a beneficial owner, to share your Personal Data to the extent required by the relevant Beneficial
Owner Registries in the jurisdiction applicable to you
Clients — Complaint matters
Personal Information, Activity (Account/ Transaction), Assets/Liabilities
Client complaint reporting
Communication and Collaboration Software and Software Services providers
Personal Data, Personal Data — Minors, Business Contact Data
To service your accounts and share transaction documents with you. This includes providers that enable
individuals and teams to work together over geographic distances by providing tools that aid
communication, collaboration and the process of problem solving (includes appliances, maintenance, and
support services).
Corporate Business Application vendors
Contact Data
To send you service or transactional emails or communications, as applicable and appropriate. These
vendors provide software and software services to support our Global Banking and Global Markets
businesses, including technology for Sales and Trading functions within Global Equities, Fixed Income
Currency and Commodities, Global Research and technology for Credit, Cash Management, FX, Equipment
Finance and Merchant Services within Global Banking.
Customers — Offshore fund companies
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
15/22
Identifiers, Contact Data, Account Activity
Mutual fund rebates and reporting
Digital Commerce and Payment Services Providers
Contact Data, Online Authentication, Online Identifier
If you are a client of Global Transaction Services, to enable you to conduct transactions online and via
mobile devices, to authenticate you when you log into online portals, to access your account, review and
conduct your transactions.
Digital Process Automation Software Services Providers
Signature, Contact Data
To enable you to review and sign contracts with us electronically. This includes vendors who automate and
digitize our transaction documentation workflow.
Digital Tracking Providers
Online Behavior, Online Identifier
To improve technical and design features of our websites and platforms, including personalization. This
includes companies that provide digital tracking services (like cookies, tags, etc.) and whose scripts we
use to add to our webpages.
External Law Firms and other professional advisors, consultants, experts
Personal Information as relevant in each specific situation
To provide legal and compliance support, such as to prepare transactional documents with you, in support of
the services we provide to you, or to defend claims involving you.
To improve services and for security and fraud prevention.
Hotels, Restaurants, Virtual event platforms, Transportation Companies, and Corporate Security
Contact Data, Identifiers, Personal Data — Minors, Event Data
To assist with our events management and execution.
Partner Banks, including Vendors and Credit Card Partners
Account Activity, Compensation Information, Contact Data, Identifiers, Personal Data — Minors, including
Personal Information as is necessary to enable us to provide you with the services
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
16/22
To allow our Partner Banks to process payments to or from individuals related to your account with us in
places where we do not have a presence, or we are unable to provide the relevant services. Partner Banks
are banks with which we have arrangements to enable us to provide the Services to you.
Partners — Fund Companies
Identifiers, Contact Data, Account Activity
To manage mutual fund rebates and reporting.
Regulators
Personal Information as relevant in each specific situation
To comply with regulatory requirements that obligate us to share your Personal Information.
Tax Authorities and Service Providers
Contact Data, Identifiers, and other Personal Information relevant to the Services
To share your Personal Information for us comply with Foreign Account Tax Compliance Act (“FATCA”),
Client Relationship Summary (“CRS”) and other tax-related reporting requirements.
Third parties, such as an acquiring entity and its advisors, in connection with a sale or business
transaction
Personal Information categories relevant to the transaction
We may disclose or transfer your Personal Information in the event of any reorganization, merger, sale,
joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or
stock (including in connection with any bankruptcy or similar proceedings).
Third Party Services
This Notice does not address, and we are not responsible for, the privacy information or other
practices of any third parties, including any third party operating any website or service to which the
Services link. The inclusion of a link does not imply endorsement of the linked site or service by us or
by our affiliates.
Data Retention
We keep your Personal Information as long as needed or permitted by applicable laws and
regulations. The retention period may vary between regions and is determined by the reason for
which we collected it. The criteria we use to determine our retention periods include: (i) the length of
time we have a relationship with our client and Services we provide; (ii) whether there is a legal
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
17/22
obligation; and (iii) whether retention is advisable for legal purposes such as statutes of limitations,
litigation, or regulatory investigations.
Use of Services by Minors
Where Services allow for parents or guardians to authorize access for individuals under 18 (minors),
we will obtain all applicable consents required by law and collect, use, and disclose only necessary
information to provide such Services. Please see our
Children’s Privacy Policy
for more information.
Choices and Access
Receiving electronic communications from us
If you no longer wish to receive direct-marketing-related emails from us in the future, you may opt
out by following the instructions in the relevant electronic communication, or as described in other
relevant notices.
Individuals rights under applicable data protection law
You may have certain rights under applicable data protection laws regarding your access to,
information about or the processing of your Personal Information. Where permitted under applicable
law and subject to certain exceptions, you may request:
To access or see the Personal Information that we have about you
To correct or amend your Personal Information if it is incorrect
To delete or suppress your Personal Information under certain circumstances
Indonesia residents may also request the following, in accordance with applicable laws and
regulations:
To seek compensation if you have suffered harm due to the unlawful processing of your Personal Information.
To receive a copy of this Notice translated into Bahasa Indonesia
How individuals can excercise individual rights
If you would like to exercise any of the rights described above, you may contact us by emailing:
individualrightsrequests@bofa.com
with the following information:
Full name as it appears on your account
The Bank of America product or service processing your Personal Information, if known
Reference number provided by a Bank of America representative, if available
Clearly explain your request. If requesting a change or removal of your Personal Information, please specify
which data you are referencing
We process requests in accordance with the applicable laws for your region. For your protection,
requests for changes to your personal information may require further verification before processing.
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
18/22
Please note that we may need to retain certain information for recordkeeping purposes and/or to
complete any transactions that began prior to requesting a change or deletion.
Depending on your jurisdiction, you may file a complaint with the data protection authority for your
country or region, or where an alleged infringement of applicable data protection law occurs.
Jurisdiction and Cross-Border Transfer
Personal Information may be stored and processed in any province or country where we have
facilities or in which we engage service providers, including the United States (
Bank of America
Locations
). In certain circumstances, courts, law enforcement agencies, regulatory agencies or
security authorities in those other countries may be entitled to access Personal Information. Where
required, data transfer agreements including appropriate safeguards, such as standard contractual
clauses, will be put in place for transfers from countries outside of the United States.
EEA/UK Notice Supplement
We process Personal Information based on the following legal basis:
Processing purpose
Legal Basis
Account Opening and
Management
To manage our contractual relationship with you and/or to comply with a legal
obligation.
Aggregation and/or
Anonymization
Based on our legitimate interest, such as to generate anonymized data for our
own business purposes which does not identify you or another individual.
Analytics and Modeling
Based on our legitimate interest, to provide modeling and analytical insights
about our consumers.
Client Communications and
Relationship Management
To manage our contractual relationship with you, to comply with a legal
obligation, and/or based on our legitimate interest, such as improving our
Services.
Consumer and Wealth Services
To manage our contractual relationship with you and/or to comply with a legal
obligation.
Corporate Client Services
To manage our contractual relationship with you and/or to comply with a legal
obligation.
Electronic Communications/
Digital Services
To manage our contractual relationship with you, to comply with a legal
obligation, and/or based on our legitimate interest, such as improving our
Services.
Emergency and Incident
Response
To manage our contractual relationship with you, to protect individuals’ vital
interests, to comply with a legal obligation, and/or based on our legitimate
interest, such as ensuring the safety of our premises.
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
19/22
Processing purpose
Legal Basis
Events Management
To manage our contractual relationship with you and/or based on our legitimate
interest, such as improving the quality of our events and responding to
complaints and concerns relating to an event.
Legal, Regulatory and
Compliance
To manage our contractual relationship with you, to comply with a legal
obligation, including AML/KYC laws and regulations, and/or based on our
legitimate interest, such as our interest in enforcing our terms and conditions
and bringing and defending legal claims.
Marketing
Where required under applicable law, we obtain your consent to send you direct
marketing communications. Where permitted by applicable law, we also engage
in marketing activities based on our legitimate interest, such as to promote our
Services.
Monetary Transactions
To manage our contractual relationship with you and/or to comply with a legal
obligation.
Operations and General
Business
To manage our contractual relationship with you, to comply with a legal
obligation, and/or based on our legitimate interest, such as maintaining and
improving our Services, identifying and preventing fraudulent transactions and
cyberattacks.
Personalizing our Services
Where required under applicable law, we obtain your consent to provide
personalized Services. Where permitted by applicable law, we also personalize
the Services based on our legitimate interest, such as providing tailored Services
based on your preferences.
Risk Analysis
To manage our contractual relationship with you, to comply with a legal
obligation, and/or based on our legitimate interest, such as to manage our
internal risk and analyze our client portfolio.
Specialized Services
To manage our contractual relationship with you and/or to comply with a legal
obligation.
Processing purpose
Legal Basis
Account Opening and Management
To manage our contractual relationship with you and/or to comply with a legal obligation.
Aggregation and/or Anonymization
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
20/22
Based on our legitimate interest, such as to generate anonymized data for our own business purposes
which does not identify you or another individual.
Analytics and Modeling
Based on our legitimate interest, to provide modeling and analytical insights about our consumers.
Client Communications and Relationship Management
To manage our contractual relationship with you, to comply with a legal obligation, and/or based on our
legitimate interest, such as improving our Services.
Consumer and Wealth Services
To manage our contractual relationship with you and/or to comply with a legal obligation.
Corporate Client Services
To manage our contractual relationship with you and/or to comply with a legal obligation.
Electronic Communications/ Digital Services
To manage our contractual relationship with you, to comply with a legal obligation, and/or based on our
legitimate interest, such as improving our Services.
Emergency and Incident Response
To manage our contractual relationship with you, to protect individuals’ vital interests, to comply with a
legal obligation, and/or based on our legitimate interest, such as ensuring the safety of our premises.
Events Management
To manage our contractual relationship with you and/or based on our legitimate interest, such as
improving the quality of our events and responding to complaints and concerns relating to an event.
Legal, Regulatory and Compliance
To manage our contractual relationship with you, to comply with a legal obligation, including AML/KYC
laws and regulations, and/or based on our legitimate interest, such as our interest in enforcing our terms
and conditions and bringing and defending legal claims.
Marketing
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
21/22
Where required under applicable law, we obtain your consent to send you direct marketing
communications. Where permitted by applicable law, we also engage in marketing activities based on our
legitimate interest, such as to promote our Services.
Monetary Transactions
To manage our contractual relationship with you and/or to comply with a legal obligation.
Operations and General Business
To manage our contractual relationship with you, to comply with a legal obligation, and/or based on our
legitimate interest, such as maintaining and improving our Services, identifying and preventing fraudulent
transactions and cyberattacks.
Personalizing our Services
Where required under applicable law, we obtain your consent to provide personalized Services. Where
permitted by applicable law, we also personalize the Services based on our legitimate interest, such as
providing tailored Services based on your preferences.
Risk Analysis
To manage our contractual relationship with you, to comply with a legal obligation, and/or based on our
legitimate interest, such as to manage our internal risk and analyze our client portfolio.
Specialized Services
To manage our contractual relationship with you and/or to comply with a legal obligation.
Contact Us
If you have any questions about this Notice or complaints about our processing of your Personal
Information, please contact our Data Protection Officer at
dpo@bofa.com
.
Some of our Notices are available in additional languages. In the event of a discrepancy in the translated
version, the English text shall govern.
22/09/2026, 12:58
Global Privacy Notice
https://web.bankofamerica.com/en/privacy/global-privacy-notice
22/22