Notice of JSC "CREDIT AGRICOLE BANK" on the processing of personal data

Dear customers, potential customers, counterparties, shareholders (members) of JSC "CREDIT AGRICOLE BANK" (hereinafter referred to as "the Bank") and its managers, founders/members/owners, employees, representatives and other persons with whom the Bank maintains business relations, in accordance with the requirements of the Law of Ukraine "On Personal Data Protection" and the Regulations of the National Bank of Ukraine on the Provision of Information by Banks to Customers on Banking and Other Financial Services, the Bank hereby informs you, as the personal data subject, about:

• the personal data controller,
• the composition and content of the personal data collected,
• the rights of the personal data subject in connection with the inclusion of his/her personal data in the personal data base (PDB) of the Bank in accordance with the Law of Ukraine "On Personal Data Protection",
• the purposes of processing personal data and the persons to whom personal data is transferred,
• procedures for protecting the personal data of customers (excerpts).

In case of changes in the applicable legislation of Ukraine or significant changes in the processes of personal data processing, the Bank will amend this Notice accordingly and inform you by publishing the relevant information on the Bank's website.

The controller of your personal data is JSC "CREDIT AGRICOLE BANK", a banking institution registered in Ukraine, licence of the National Bank of Ukraine No. 99 dated 12.10.2011, registration No. 149 in the State Register of Banks, address: 42/4, Yevhena Chykalenka Str., Kyiv, Ukraine, 01024.

If you have any questions regarding the processing of your personal data, you may contact the Bank through any of the communication channels indicated on the Bank's official website at https://credit-agricole.ua/en/o-banke/yakist-obslugovuvannya

Composition and content of personal data collected:

The composition and content of personal data processing by the Bank depends on the type of relationship between you and the Bank, including for the Bank’s customers - the composition and content of personal data processing depends on the products and services provided by the Bank.

The content of the personal data processed by the Bank corresponds to the information received from the persons – subjects of the personal data, or lawfully received from their representatives or third parties, including from credit history bureaus, from the NBU credit register, from the NBU BankID System, from the persons represented by the subjects of the personal data, or received by the Bank from publicly available sources, and also includes the information that is known/became known to the Bank in connection with the performance of contractual and other legal relations with you.

The Bank processes the following types of the personal data:

• data processed in the personal data base “Customers”:
  • Personal details: information on the surname, name and patronymic (if any) of the person; date of birth; place of birth; citizenship; gender; marital status; information about children (surname, name and patronymic (if any), date and place of birth, gender, citizenship, place of residence); information about dependents (surname, name and patronymic (if any), date and place of birth, gender, citizenship, place of residence); information about the Customer's authorised persons; information on the place of work and position; information on the registration of the Customer as a private entrepreneur; information on the Customer's affiliation with politically exposed persons; information on the Customer's financial situation; information on the place of registration/actual residence or place of stay/temporary residence; information on means of communication (contact telephone numbers, e-mail addresses, postal address); information on the availability of accounts, special payment instruments (payment cards), issued banking products; information on the Customer's financial transactions;
  • Passport or other identity document data: information on the series (if any) and number of the passport or other identity document; information on the date of issue and the authority (authority code) that issued the passport or other identity document; information on the registration of the place of residence/actual residence or place of stay/temporary residence;
  • Data on the taxpayer’s registration card: information on the registration number of the taxpayer’s registration card; information on the date of issue and the issuing authority of the document confirming the taxpayer’s registration in the State Register of Individual Taxpayers;
  • Data on the state registration of a private entrepreneur / information from the Unified State Register of Legal Entities, Private Entrepreneurs and Public Associations or of a person engaged in independent professional activity (if the Customer is a private entrepreneur or a person engaged in independent professional activity): information on the document confirming the right of an individual to engage in independent professional activity (registration certificate / permit / certificate, etc.); information on the date of issue of the document and the issuing authority.
• Data processed in the personal data base “Counterparties”:
  • Personal details in the “Counterparties” personal database: information on a person’s surname, name and patronymic (if any); citizenship; marital status; place of employment and position, speciality, qualifications and information on documents confirming them; information on authorised persons of the counterparty; information on place of residence or place of stay/temporary stay; information on means of communication (contact telephone numbers, e-mail addresses, postal address).
  • Passport or other identity document data: information on the series (if any) and number of the passport or other identity document; information on the date of issue and the authority (authority code) that issued the passport or other identity document; information on the registration of the place of residence/actual residence or place of stay/temporary stay;
  • Data on the taxpayer’s registration card: information on the registration number of the taxpayer’s registration card (hereinafter referred to as the "RNOKPP"); information on the date of issue and the issuing authority of the document confirming the taxpayer’s registration in the State Register of Individuals – Taxpayers.
  • Data on state registration of a private entrepreneur / information from the Unified State Register of Legal Entities, Private Entrepreneurs and Public Associations аor a person engaged in independent professional activity (if the Counterparty is an private entrepreneur or a person engaged in independent professional activity): information on the document confirming the right of an individual to conduct independent professional activity (registration certificate / permit / certificate, etc.); information on the date of issue and the issuing authority.

• Data received and created in the course of servicing by the Bank and when visiting the Bank’s ATMs, including: sound/voice recordings (for example, telephone records), photo and video images (for example, when performing photo and/or video verification of customers), messages and letters sent by the Bank or to the Bank; any other analytical or statistical data about the Customer, and other data;
• data relating to the use of the Bank’s websites and mobile applications: cookies, data on user interaction with websites and mobile applications, session duration, operating system information, device information, browser information, screens viewed by the user in the application, information on failures when using the application. The Bank receives such data from the Web browser you use when using the Bank’s websites, and from your device;
• other information, data that became known to the Bank in connection with the provision of banking services or the implementation of legal relations with an individual, in compliance with the requirements of the legislation of Ukraine and internal documents of the Bank.

The purpose, grounds and other specifics of personal data processing may be supplemented and specified in the agreement with the Bank.

Your rights under the Law of Ukraine “On Personal Data Protection”:

• to know about the sources of collection, location of your personal data, the purpose of their processing, location or place of residence (stay) of the data controller and administrators or to give a corresponding order to obtain this information to persons authorised by you, except in cases established by law;
• to receive information on the conditions for granting access to personal data, including information about third parties to whom your personal data is transferred;
• to have free access to your personal data;
• to receive a response on whether your personal data is processed in the Database no later than thirty calendar days from the date of receipt of the request, except as provided by law, and to receive the content of your personal data;
• to submit a reasoned request to the data controller with an objection to the processing of your personal data;
• to submit a reasoned request to change or destroy your personal data by any data controller and administrator, if this data is processed illegally or is unreliable;
• to protect your personal data from unlawful processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision of such data, as well as to protect against the provision of information that is inaccurate or discrediting to the honour, dignity and business reputation of an individual;
• to file a complaint against the processing of your personal data with the Commissioner or the court;
• to apply legal remedies in case of violation of the legislation on personal data protection;
• to make reservations regarding the restriction of the right to process your personal data when giving consent;
• to withdraw consent to the processing of personal data;
• to know the mechanism of automatic processing of personal data;
• to be protected against an automated decision that has legal consequences for you.

The full text of the Law of Ukraine "On Personal Data Protection" is available on the official website of the Verkhovna Rada of Ukraine at https://www.rada.gov.ua/

For more detailed information on the scope and application of the Law of Ukraine "On Personal Data Protection", please visit the official website of the Ministry of Justice of Ukraine at https://minjust.gov.ua/ or on the official website of the Ukrainian Parliament Commissioner for Human Rights at https://ombudsman.gov.ua/

Purpose of processing your personal data:

The Bank hereby informs you that your personal data will be entered into the Personal Database "Customers/Counterparties" (hereinafter referred to as the Database) in order to:

• exercise rights, obligations and interests in establishing legal relations with the Bank in the provision of banking and financial services in accordance with the current legislation of Ukraine, as well as to ensure the maintenance/storage of the necessary statistical information;
• ensure the implementation of civil, economic, administrative, legal, tax, financial, accounting and other areas of relations that are directly related to the establishment of your legal relations with the Bank and require the processing of personal data in accordance with the Law of Ukraine "On Personal Data Protection", the Civil Code of Ukraine, the Commercial Code of Ukraine, the Tax Code of Ukraine, the Law of Ukraine "On Accounting and Financial Reporting in Ukraine", the Law of Ukraine "On Banks and Banking», the Law of Ukraine "On Prevention and Counteraction to Legalization (Laundering) of Proceeds of Crime, Terrorist Financing and Financing of Proliferation of Weapons of Mass Destruction", the Law of Ukraine "On Organization of Formation and Circulation of Credit Histories", other laws and regulations, including those of the NBU, the National Securities and Stock Market Commission, other regulations governing the banks' activities, as well as the Bank's Charter and internal documents of the Bank;
• comply with the requirements of the applicable laws and the Bank’s internal regulations when concluding, registering, executing and maintaining agreements, including agreements on banking operations, etc.;
• provide information about the Bank’s products and services, conduct surveys on the quality of services, identify needs, opinions and considerations;
• for automated data processing to assess various aspects of the behaviour and interests/preferences of the Bank's customers/partners, to draw up development strategies, to develop and offer the Bank's products and services, to analyse and target advertising, including on the basis of anonymous data;
• ensure the Bank’s operations, protect and realise its rights and interests and/or take actions necessary to ensure the fulfilment of its obligations, including the transfer to foreign parties to the relationship (provided that the relevant state ensures proper protection of personal data in cases established by law or international treaty of Ukraine).

Persons to whom personal data is transferred:

Your personal data may be provided to state and local authorities, as well as enterprises, institutions, organisations and individuals, including foreign legal entities and individuals, in accordance with the Law of Ukraine “On Personal Data Protection” and in accordance with the Consent to the processing of personal data provided by you and in accordance with the procedure established by the current legislation on banking secrecy.

The legal grounds for processing your personal data are:

• the consent of the data subject to the processing of his/her personal data;
• the authorisation to process personal data granted to the Bank in accordance with the law, solely for the purpose of exercising its powers;
• the conclusion and execution of a transaction to which the data subject is a party or which is concluded for the data subject's benefit or for the purpose of taking steps, at the data subject's request, prior to the conclusion of a transaction;
• the protection of the vital interests of the personal data subject;
• the need to comply with the Bank's legal obligations;
• the need to protect the legitimate interests of the Bank or a third party to whom personal data is transferred, except when the need to protect the fundamental rights and freedoms of the personal data subject in connection with the processing of his/her data outweighs such an interest.

Deletion or destruction of personal data:

The Bank deletes or destroys personal data in accordance with the requirements and procedure established by the legislation of Ukraine and internal documents of the Bank.

Storage of your personal data:

The databases of personal data processed by the Bank are located on servers in Ukraine. To ensure the continuity of critical business processes, your personal data may also be processed using Amazon Web Services and Office365 cloud technologies on servers located within the European Economic Area.

Procedures and procedures for the protection of your personal data (excerpts from them)

Bylaws on the procedure for processing personal data at JSC "CREDIT AGRICOLE BANK" (Excerpt)

Information Classification Policy of JSC "CREDIT AGRICOLE BANK" (Excerpt)