Personal data processing

• · Entering into an agreement by the Bank and the performance there of, where a personal data subject is also a party or which is concluded to the benefit of a personal data subject or taking certain actions before entering into an agreement on demand of a personal data subject.

• · Necessity of fulfilment of the Bank’s duty provided for by the laws of Ukraine and (if applicable to the Bank) the requirements of the legislation of the European Union;

• · Protecting vitally important interests of a personal data subject;

• · Private individual’s consent to the processing of his/her personal data (if provided).

For example, the preparation of tailored offers for you from the Bank and its partners, including by means of profiling (automated data processing for evaluation of behavior, transactions templates, economic, social and other interests); sending you informational, advertising messages and proposals on the services of the Bank, its partners, for participation in the programs of the Bank and its partners;

• · Permission to personal data processing provided to the Bank according to the law and for the exercise of the Bank’s powers exclusively.

• · Need to protect the legitimate interests of the Bank or a third party to which the Bank transfers personal data, except to the extent that the need to protect the fundamental rights and freedoms of private individuals in connection with their data protection prevails over such interests.

For example, the improvement and the development of the Bank’s services and products; ensuring the quality and security of servicing, counteraction to fraud and ensuring the Bank’s information security; filing lawsuits and defense in litigations; information exchange on your loan obligations via credit bureaus and checking the information on you in the debtor databases in order to mitigate the Bank’s risks when granting and servicing loans.

In certain cases we process your data to protect our legitimate interest. In particular, fort he purpose of developing our products, ensuring service quality, counteraction to fraud, risk mitigation and information security.

• · Provision of banking and other financial services, carrying out other activities according to the Bank’s Articles of Association, the laws ofUkraine and concluded agreements;
• · Entering into and fulfillment of the terms and conditions of the agreements that were/will be concluded by the Bank, for the exercise and the protection of the parties’ rights thereunder;
• · Ensuring the quality of banking services and security in the Bank’s activities, improving and creating new services/products of the Bank;
• · Evaluating the availability of our proposals, products and services to you;
• · Ensuring and organizing the provision of information and/or consulting services to you by third-party suppliers (partners of the Bank);
• · Sending information, advertising notices and offers of the services of the Bank, its partners, for participation in the programs of the Bank and its partners;
• · Provision of advisory and information support in relations with the Bank and dispute resolution;
• · Profiling, automatic processing of the data to assess various aspects of behavior, economic, social and other interests/preferences of the customers/counterparties of the Bank, to build the development strategy, develop and offer products and services of the Bank, analyze and target our advertisements, including based on anonymized data;
• · Compliance with legal and regulatory requirements, the rules of theBank’s internal documents and the terms of the agreements concluded, the fulfilment of the collective agreement, court decisions, the decisions of theBank’s management bodies;
• · Protection of legitimate interests of the Bank or a third party to which the Bank transfers personal data, except to the extent that the needs of the protection of fundamental rights and freedoms of individuals in connection with the processing of their data prevails over such interests;

The purpose of processing may change as a consequence of change in the conditions/nature of our business relationships or changes in the laws of Ukraine.

The key goal of your personal data processing is the provision of banking, financial services and the fulfilment of the terms and conditions of concluded agreements.

The processing is also carried out to ensure quality and security of servicing, development of the bank’s produсts (including the development and filing of proposals on such services from the Bank and its partners to you) and in order to fulfill the requirements of the law.

According to article 8 of the Law on Data Protection, a personal data subject shall have the right to:

1. Know about the sources of collection, location of his/her personal data, the purpose of their processing, the location and/or place of residence (stay) of the personal data controller or processor or instruct his/her proxies to receive the respective information, except for the cases stipulated by the laws of Ukraine/European Union, if applicable to the Bank.

• · Identification and contact details: surname, name, patronymic, gender, date and place of birth, tax id, passport series and number, issue date and place of issue, copies and content of documents issued in the name of a private individual or on his/her behalf, signature sample, electronic signature, place of residence and place of registration, conditions of residence, citizenship, email addresses, internal identifiers in the Bank’s systems; phone numbers;   
• · Data on the family, educational and professional activities: marital and family status, information on relatives, education, profession, speciality, length of employment and working experience, information on place of employment and position, financial standing, income, types of accruals and deductions; information on the working activities of the Bank’s employees and the results of the respective actions that took place during the fulfilment of the employment agreements concluded with the Bank; information on activities as an entrepreneur or an independent professional practitioner;
• · Data on products and services: account numbers, payment card details, information on payments and transactions made, including the information on the payment senders and recipients, credit and other obligations, depository operations, information on the use of ATMs, terminals, remote channels of servicing, visiting of branches, information on habits, interests, participation in loyalty programs, level of satisfaction with services;
• · Credit history and any information on the status of fulfilment of a private individual’s obligations under agreements concluded with the Bank, as well as other legal acts, information on the telecommunications behavior of the Bank’s customers;
• · Data received in the course of communication with the Bank and when visiting the Bank, ATMs, including: audio/ voice records (e.g., records of telephone conversations), photo and video images (e.g., when carrying out photo and video identification, verification of customers), as well as the data on compliance and other data that are comparable with the category mentioned above; notices and letters sent by the Bank;
• · Data concerning the use of websites and mobile applications of the Bank:  cookie files, data on users’ interaction with websites and mobile applications, duration of sessions, information on operation system, information on the device, information on the browser, user review screens in an application, information on failures in the use of an application. The Bank receives such data from the Web browser you use when browsing the Bank’s websites, as well as from your device;
• · Data on the number, type and/or class of shares held by private individual (PI) shareholders and their parts in the Bank’s share capital, the data on interaction of PI shareholders with the Bank, the participation of the shareholders, their representatives in the General Shareholders’ Meeting of the Bank; 
• · Sensitive data categories: membership in political parties and/or organizations, professional unions, religious organizations or public organizations of ideological orientation, data on administrative or criminal liability, sanctions taken towards a person as part of pre-trial investigation or actions stipulated by the Law of Ukraine On Operative Investigation Activities; data concerning health; whereabouts and/or movement paths of a personal data subject, ethnic origin;
• · Your geolocation data (if you grant access to geolocation from your device settings);
• · Other information that became known to the Bank in connection with legal relations with a private individual, when fulfilling the requirements of the laws of Ukraine and the Bank’s internal documents.

We are processing the data that we received from you or your representatives, the data that the documents provided by you contain. In particular, identification data, contact details, data on a family, education and professional activities.

In the process of your servicing we also process the information regarding the products and services that you use, the information received in the course of communication with the bank and the use of our website and the mobile application.

In addition, pursuant to the requirements of the law or for risk minimization we can obtain the data on you from public registers or from third parties, such as credit bureaus, the NBU credit register, BankID System, Diia.

In most cases, the data are processed within the Bank by the employees holding the respective access rights required for the exercise of the duties/functions assigned to them only. But the personal data can be transferred to third parties in the following cases:

• · for the purpose of exercise by third parties  (including by the Bank customers’ personal data processor) of their functions or provision of the Bank’s services, in particular, to the auditors, insurance companies, appraisal companies, payment systems, institutions carrying out  transactions’ identification, authorization and processing, to banks-counterparties;
• · to the Bank’s shareholders, the Parent Company - Raiffeisen Bank International AG, (Vienna, Austria) and other legal entities linked to it /to the Bank by corporate relations, including abroad;
• · to the persons providing to the Bank the services related to the organisation of postal communication, telephone calls, sending SMS-messages, email messages;
• · to the NBU credit register according to the procedure and in the scope provided for by the legislation of Ukraine and to the credit bureaus with the aim of obtaining and forming of the credit histories, as well as to the persons providing the services of debt collection to the Bank and to other persons in relation to the collection of the overdue exposure to the Bank;
• · to the person purchasing or acquiring as collateral the claim rights under loans issued by the Bank;
• · to the insurance companies – for exercising of the rights and/or fulfilment of the obligations towards the Bank as the beneficiary;
• · to the persons providing the services of storage of the customers’ documents, generation and storage of their electronic copies (archives, databases) to the Bank;
• · to the companies ensuring implementation of promotion programs, loyalty programs and other advertising activities;
• · to the companies conducting statistical and marketing studies;
• · to the NBU BankID System to ensure electronic remote customers’ identification, in accordance with the requirements of the legislation of Ukraine;
• · in response to legitimate requests of the NBU, prosecution authorities, state, judicial, investigation and other law enforcement authorities, other  authorities and persons, if there are valid justifications for receipt of the respective information;
• · in other cases provided for by the Law of Ukraine “On Banks and Banking”, other regulatory acts of Ukraine, upon the consent/permission granted by you or pursuant to the terms and conditions of the agreements concluded with the Bank.

To ensure the required level of security during the personal data processing by the Bank, the appropriate measures of technical and organizational nature are applied, namely:

• · personal data pseudonymization and encryption; 
• · continuous ensuring of confidentiality, integrity, accessibility of personal data, resilience of the data processing systems and services; 
• · only the persons having respective permissions have access to the personal data for the purposes stipulated by the law;
• · implementation of the policy regulating personal data processing; 
• · regular training of employees in the personal data protection issues.

If your data are depersonalized with no possibility to relate it to you, such data can be stored and processed by the Bank for an unlimited period of time.

The Ombudsman holds the powers in the area of the personal data protection defined in article 23 of the Law of Ukraine “On Personal Data Protection”, including the right to handle private individuals’ complaints on personal data protection issues.

The Ombudsman’s contact details:

Address: 01008, Kyiv, 21/8 Instytutska Str.

Helpline: 0800-50-17-20 (free calls) 

[email protected]

Web-sites: https://ombudsman.gov.ua/

The personal data subjects residing on the territory of the European Economic Area, according to article 77 of GDPR, can submit a complaint to the supervisory authority, in particular in the member state of their permanent residence, employment or the place of occurrence of the alleged violation.

The list of the supervisory authorities of the European Economic Area countries can be found on the website of the  European Data Protection Board at the following link https://edpb.europa.eu/about-edpb/about-edpb/members_en.