Privacy and Security Policy

We, our and us, when used in this notice, mean Hawthorn Bank. This is our privacy notice for our customers. When we use the words "you" and "your" we mean the following types of customers:

• All of our consumer customers who have a continuing relationship with us, such as:
• Deposit Account
• Loan account
• Credit Card
• Safe deposit box
• Self-directed Individual Retirement Account where we act as custodian or trustee
• All former customers

We first define some terms.

Nonpublic personal information means information about you that we collect in connection with providing a financial product or service to you. Nonpublic personal information does not include information that is available from public sources, such as telephone directories or government records.

An affiliate is a company we own or control, a company that owns or controls us, or a company that is owned or controlled by the same company that controls us. Ownership does not mean complete ownership, but means owning enough to have control.

A nonaffiliated third party is a company that is not an affiliate of ours.

We collect nonpublic personal information about you from the following sources:

• Information we receive from you on applications or other forms
• Information about your transactions with us
• Information about your transactions with nonaffiliated third parties
• Information from a consumer reporting agency

We restrict access to nonpublic personal information about you to those employees who need to know that information to provide products or services to you. We maintain physical, electronic, and procedural safeguards that comply with federal standards to guard your nonpublic personal information.

We will not disclose nonpublic personal information about you to anyone except as disclosed in this policy or as permitted by law.

If you decide to close your account(s)or become an inactive customer, we will follow the privacy policies and practices as described in this notice.

We may disclose the following information to other financial institutions with whom we have joint marketing agreements:

• Nonpublic personal information we receive from you on an application or other forms, such as
  • Name
  • Address

Types of Businesses. Here are the types of businesses with whom we may disclose nonpublic personal information under this section

• Financial service providers, such as
  • Securities broker-dealers
  • Insurance agents

Here is why we may disclose nonpublic personal information about you to other financial institutions with whom we have joint marketing agreements:

Our website brings together a combination of industry-approved security technologies to protect data for the bank and for you, our customer. It features a VeriSign-issued Digital ID for the bank's Internet Service Provider hosting our website, Secure Sockets Layer (SSL) protocol for data encryption, and a router and firewall to regulate the inflow and outflow of server traffic.

Secure Data Transfer

Once a server session is established on an https secure page, the user and the server are in a secured environment. Because the server has been certified as a 128-bit secure server by VeriSign, data traveling between the user and the server is encrypted with Secure Sockets Layer (SSL) protocol. With SSL, data that travels between the bank and customer is encrypted and can only be decrypted with the public and private key pair. In short, the bank's server issues a public key to the end user's browser and creates a temporary private key. These two keys are the only combination possible for that session. When the session is complete, the keys expire and the whole process starts over when a new end user makes a server session.

Router and Firewall

Secure forms must filter through a router and firewall before they are permitted to reach the server. A router, a piece of hardware, works in conjunction with the firewall, a piece of software, to block and direct traffic coming to the server. The configuration begins by disallowing ALL traffic and then opens holes only when necessary to process acceptable data requests, such as retrieving web pages or sending customer requests to the bank.

Using the above technologies, your Internet loan application and check reorder transactions are secure.