Company: NWFL
Filing Date: 2025-10-28
Form Type: 424B3
Source: 0001193125-25-252482
Chunk: 317

Company: NORWOOD FINANCIAL CORP
Filing Date: 2025-10-28
Form: 424B3
Chunk 317
---
 Norwood Subsidiary has closed or removed any underground storage tanks from any properties owned or operated by Norwood or
any Norwood Subsidiaries or any Participation Facility except in material compliance with applicable Environmental Law.

Section 4.13

(a) Norwood and each of the Norwood Subsidiaries (i) has collected Personal
Information in compliance, in all material respects, with all applicable Privacy Laws; (ii) has the requisite consent or other authority under all applicable laws regarding the collection, use, storage, disclosure, or other processing of
Personal Information to use, disclose, store, and otherwise process Personal Information, which consent or other authority is sufficient for the business as currently conducted; and (iii) has taken commercially reasonable steps to secure the
business data related to Norwood’s and the Norwood Subsidiaries’ business from unauthorized access or unauthorized use by any Person. No communication from any Governmental Entity with respect to or alleging non-compliance with any law regarding the collection, use, storage, disclosure or other processing of Personal Information has been received by Norwood or any of the Norwood Subsidiaries. A copy of all internally or
externally prepared reports or audits that describe or evaluate the information security procedures of Norwood or the Norwood Subsidiaries, all material policies related thereto and any failures to comply therewith have been provided to Bankshares.
Except as set forth on Schedule 4.13(a), to the Knowledge of Norwood, there has been no unauthorized access gained by any Person to Personal Information held or collected by Norwood or any

A-36

Norwood Subsidiary, their employees, or third party contractors in the course of conducting Norwood’s and the Norwood Subsidiaries’ business.

(b) Norwood and each of the Norwood Subsidiaries is subject to a written information privacy and security program that maintains commercially
reasonable measures to protect the privacy, confidentiality and security of all Personal Information against any Security Breach. Except as set forth in Schedule 4.13(b), since December 31, 2024, neither Norwood nor any Norwood Subsidiary has,
to its Knowledge, experienced any Security Breach and there are no data security or other technological vulnerabilities with respect to Norwood’s or the Norwood Subsidiaries’ information technology systems or networks.

Section 4.14

(a) Norwood has in place “disclosure controls and procedures” as defined in Rules