Company: NWFL
Filing Date: 2025-10-28
Form Type: 424B3
Source: 0001193125-25-252482
Chunk: 301

Company: NORWOOD FINANCIAL CORP
Filing Date: 2025-10-28
Form: 424B3
Chunk 301
---
 general or specific authorizations, and (iii) the recorded accountability for assets is compared with existing assets at reasonable intervals and
appropriate action is taken with respect to any difference.

A-27

Section 3.27 .

(a) Bankshares and each of the Bankshares Subsidiaries (i) has collected Personal Information in compliance, in all material respects,
with all applicable Privacy Laws; (ii) has the requisite consent or other authority under all applicable laws regarding the collection, use, storage, disclosure, or other processing of Personal Information to use, disclose, store, and otherwise
process Personal Information, which consent or other authority is sufficient for the business as currently conducted; and (iii) has taken commercially reasonable steps to secure the business data related to Bankshares’s and the Bankshares
Subsidiaries’ business from unauthorized access or unauthorized use by any Person. No communication from any Governmental Entity with respect to or alleging non-compliance with any law regarding the
collection, use, storage, disclosure or other processing of Personal Information has been received by Bankshares or any of the Bankshares Subsidiaries. A copy of all internally or externally prepared reports or audits that describe or evaluate the
information security procedures of Bankshares or the Bankshares Subsidiaries, all material policies related thereto and any failures to comply therewith have been provided to Norwood. Except as set forth on , to the Knowledge
of Bankshares, there has been no unauthorized access gained by any Person to Personal Information held or collected by Bankshares or any Bankshares Subsidiary, their employees, or third party contractors in the course of conducting
Bankshares’s and the Bankshares Subsidiaries’ business.

(b) Bankshares and each of the Bankshares Subsidiaries is subject to a
written information privacy and security program that maintains commercially reasonable measures to protect the privacy, confidentiality and security of all Personal Information against any (i) loss or misuse of Personal Information,
(ii) unauthorized or unlawful operations performed upon Personal Information, or (iii) other act or omission that compromises the security or confidentiality of Personal Information (clauses (i) through (iii), a “Security
Breach”). Except as set forth in since December 31, 2024, neither Bankshares nor any Bankshares Subsidiary has, to its Knowledge, experienced any Security Breach and there are no data security or other
technological vulnerabilities with respect to Bankshares’s or the Bankshares Subsidiaries’