Legal notice

INFORMATION MEMORANDUM OF PERSONAL DATA PROTECTION

The objective of this Information Memorandum of Personal Data Protection is to provide information related to processing of personal data pursuant to provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and repealing Directive 95/46/EC.

In this Information Memorandum of Personal Data Protection you will find information about the purposes we process your personal data for, whom they may be provided to, what your rights are, as well as information where you can contact us in case you have a question related with processing of your personal data.

With regard to this we recommend you to get to know the information contained herein. Any changes related to processing of your personal data will be provided in form of an update of this document published on our websites and available at Tatra-Leasing branches.

1. Information about controller

The controller is Tatra-Leasing, a. s., Organization ID.: 31 326 552, registered office at Cernyševského 50, 851 01 Bratislava, registered in the Bratislava I District Court Companies, Section: Sro, Insert No.: 2992/B, contact data: INFOLEASING +421 2 5919 5019, e-mail:infoleasing@tatraleasing.sk  (hereinafter referred to as “Tatra-Leasing”).

Ensuring protection of your personal data is very important for us and therefore we pay proper attention to compliance with the valid legal regulations at personal data processing, especially the principles and requirements resulting from GDPR. We have set the respective technical and organisational measures that contribute to ensuring protection of the processed personal data of our clients.

In case of any questions related to processing of your personal data please contact our DPO (Data Protection Officer) who is authorised to supervise processing of personal data in our company. You may contact DPO by e-mail on dpo@tatrabanka.sk or in writing at: DPO, Tatra banka, a. s., Hodžovo namestie 3, 811 06 Bratislava 1.

 

2. Basic Terms

GDPR

 

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Data subject

Natural person whose personal data are processed. It is a person who can be identified directly or indirectly, especially with reference to the identifier such as name, identification number, online identifier or one or several elements specific for physical, physiological, genetic, mental, economic, cultural or social identify of this natural person.

Client

Person with whom Tatra-Leasing, performing its formation, change or termination of contractual relationships between the client and Tatra-Leasing. The client is also the person with whom Tatra-Leasing discussed the conclusion of the transaction, even if the transaction was not concluded, the person who ceased to be the client of Tatra-Leasing, the person providing the security and also the client's representative, who was on the client's behalf concluded the transaction or negotiated our conclusion. For the purposes of this document, the Client is also a beneficiary defined by AML Act.

Processing

Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Anti Money Laundering (AML)

Prevention of legalization of proceeds from criminal activity and financing of terrorism.

Client filing system

An organized set of personal data processed by Tatra-Leasing for the purpose of: provision of financial services and related services, identification of Tatra-Leasing clients and identification of contractual partners * Tatra-Leasing (* A contractual partner is an entity with which Tatra-Leasing cooperates in providing financial services as far as it could not be an Client.

Marketing filing system

Organised set of personal data processed by Tatra-Leasing for the following purpose: Informing about products, innovations and services provided by Tatra-Leasing in connection with obtaining benefits from Tatra-Leasing.

Controller

Any person who, alone or together with other parties, determines the purposes and means of personal data processing and processes personal data on their behalf. For purposes hereof the controller is Tatra-Leasing.

Processor

Any person who processes personal data on behalf of the controller on basis of authorisation  in compliance with Article 28 GDPR.

Act of income tax

No. 595/2003 Coll. on Income tax.

Act on Consumer Loans and Other Credits and Borrowings for Consumers

No. 129/2010 Coll on Consumer Loans and Other Credits and Borrowings for Consumers

ALM act

No. 297/2008 Coll. on the Prevention of Legalization of Proceeds of Criminal Activity and Terrorist Financing on Amendments and supplements to Certain Acts as amended.

Act on Financial Intermediation and Financial Counselling

Act No. 186/2009 Coll. Financial Intermediation and Financial Counselling

Act on Accounting

No. 431/2002 Coll. on accounting.

3. What are personal data and why do we process them?

Personal data are any information related with the identified or identifiable natural person who can be determined directly or indirectly, especially by referring to the identifier such as name, identification number, localisation data, online identifier or by referring to one or several elements specific for physical, physiological, genetic, mental, economic, cultural or social identity of the respective natural person.

Tatra-Leasing processes only those personal data which are required for achieving the particular processing purposes. Personal data are processed always for the pre-determined and legitimate purpose while it would not be possible to achieve such purpose without processing of the respective data.

Provision of the respective data is a legal requirement of yours and no banking transaction can be executed without them being provided in case of processing of personal data on legal grounds determined by legal regulations such as in case of processing for purpose of provision of services, financial and related services, identification of clients and identification of contract partners. Hence, non-execution of a transaction results from non-provision of the respective data.

Provision of data by the Client is voluntary in case of processing of personal data based on Client's consent, such as in case of processing in terms of the Marketing filing system. With the aim to adjust the offer of products and services directly to your requirements, Tatra-Leasing evaluates information processed about you in order to provide you with a targeted offer and this way eliminate sending of non-targeted marketing offers. Granting the approval is voluntary. If you decide not to grant the approval, Tatra-Leasing will not be allowed to send you marketing information or offers in this particular case.

Recording telephone calls at INFOLEASING
Tatra-Leasing records all telephone calls executed via INFOLEASING. Personal data obtained in this way are processed in the filing systems of the leasing company – Client filing system and Marketing filing system, and that for purposes determined for the respective filing systems.

 

4. Categories of personal data that can be processed by Tatra-Leasing

Tatra-Leasing's activities include processing of various categories of personal data which differ depending on the purpose of processing and nature of the particular processing activity. Such personal data categories are as follows:

In case of Client filing system:

  • Identification data (for instance name, surname, date of birth, birth identification number, data from the identification document, nationality, identification document photography, client number, product number),
  • Contact data (for instance permanent/temporary residence address, e-mail address, telephone number),
  • Data about the utilised products and services (e.g. data about the utilised products and services, data related with processing of your suggestions),
  • Sociological and demographic data (for instance age, sex, family status, education, number of persons in household, information about income, type of employment, information related to politically exposed person),
  • Economic data (for instance data about ownership of movable and immovable objects, data about total revenues or regular household costs, data about the type of housing),
  • Data whether the Client or potential client is in a special relationship with the Tatra-Leasing,
  • Data of the Client who have as an unusual business operation of the Tatra-Leasing concidered, and data of the Clients that are subject to international sanctions and similar data showing the client's risk.
  • Audio recordings (for instance camera recordings executed at conclusion of transactions, recordings of telephone calls executed by means of INFOLEASING),
  • Copies of documents including identification documents (and photographs from the respective documents),
  • Data related with utilisation of our websites and applications (for instance cookies),
  • Other relevant data (for instance data about execution proceedings, bankruptcy proceedings, personal bankruptcy, data related with meeting your contract duties and obligations, data about your payment discipline, data from credit registers, data about inclusion in the list of clients the international sanctions relate to).

In case of Marketing filing system:

  • Data related with utilisation of websites and applications (for instance cookies),
  • Relevant data processed about you in the Client filing system.

The number of personal data categories set forth herein represents a full and complex account of all personal data categories which can be considered in terms of the particular purpose of processing at provision of the comprehensive scope of banking products and services in all states of a contract relationship. Individual account of personal data categories for individual clients will therefore be just a sub-group of this account.

 

5. Purpose and legal ground for personal data processing

Tatra-Leasing processes your personal data always for the pre-determined and legitimate purpose of processing while respective legal grounds for such processing must always exist. Tatra-Leasing would like to assure you that your personal data are never further processed for purposes which are incompatible with the originally determined purposes of processing.

Tatra-Leasing's activities might include processing of your personal data for the processing purposes as follows:

5.1     Providing banking services, financial and related services, identification bank clients and identification of contract partners of the bank

This purpose includes especially:

  • Identification of clients,
  • Conclusion of contract relationships with the Client including pre-contract relationships,
  • Maintenance of contract relationships including changes and termination of contract relationships,
  • Acceptance and processing of suggestions and complaints of Clients,
  • Relationship management,
  • Protection and seeking the rights of Tatra-Leasing towards Clients,
  • Meeting Tatra-Leasing´s obligations in the field of AML,
  • Activities related with performance of the tasks and obligations of Tatra-Leasing pursuant to valid legal regulations,
  • Maintenance of the list of persons with a special relationship with Tatra-Leasing,
  • Maintenance of separate records of Clients who do not meet their obligations ensuing from the contract relationships with the bank duly and on time,
  • Clients who have committed action considered by the bank as unusual business transaction and Clients the international sanctions relate to
  • Activities related with meeting the archive duties.

In this case your personal data are processed in the extent required for meeting the legal obligations of Tatra-Leasing while legal base for processing in this case rests in the following legal regulations:

  • AML Act,
  • Act on Income tax,
  • Act on Consumer Loans and Other Credits and Borrowings for Consumers,
  • Act on Financial Intermediation,
  • Act on Insurance services,
  • Act on Accounting.

Tatra-Leasing may proceed to processing of your personal data in cases when the scope of personal data set forth by the legal regulations set forth herein is not sufficient for achieving the determined purpose of processing, also under the following legal grounds:

  • if it is necessary for performance of the contract concluded between you and Tatra-Leasing including precontract relationships pursuant to Article 6 par. 1 b) GDPR,
  • if you have granted consent to processing of your personal data for the particular purpose/purposes pursuant to Article 6 par. 1 a) GDPR,
  • if you have granted consent to processing of your personal data for the particular purpose/purposes pursuant to Article 9 par. 2 a) GDPR,
  • if it is necessary for purposes of legitimate interests followed by Tatra Leasing or a third party pursuant to Article 6 par. 1 f) GDPR,
  • if processing is necessary for proving, claiming or justification of legal claims pursuant to Article 9 par. 2 f) GDPR.

Tatra-Leasing is obligated to proceed with expert care in terms of its activities and in connection therewith has legitimate interest in prevention against criminal activity or other illegal action which can cause damage or harm reputation of the bank or any other detriment, or against action which can negatively impact the activity of the bank or put its employees or other data subjects in danger, and for this purpose it is entitled to keep the list of persons with potential risk while this processing may lead to termination of the contract relationship or rejection of transaction execution.

5.2.   Marketing

Tatra-Leasing processes your personal data on legal grounds of your prior voluntary consent or under legitimate interests of Tatra-Leasing for purposes of informing about products, innovations and services provided by Tatra-Leasing, and also in connection with obtaining advantages by Tatra-Leasing including creation of offers for such advantages at utilisation of profiling.

In case you have granted your consent to processing of your personal data for the purpose set forth herein to Raiffeisen Group, your personal data may be processed (i) by entities with direct or indirect property interest in Tatra-Leasing, (ii) by entities in which Tatra-Leasing has direct or indirect property interest, (iii) by entities in which the entity with property interest in Tatra-Leasing has direct or indirect property interest, (iv) by entities having direct or indirect property interest in the entity with property interest in Tatra-Leasing. For purposes of this document these are especially the following entities:

  • Tatra banka, a.s., seated at Hodžovo namestie 3, 811 06 Bratislava, Company ID No: 00 686 930,
  • Doplnková dôchodková spoločnosť Tatra banky, a. s., seated at Hodžovo namestie 3, 811 06 Bratislava, Company ID No: 36 291 111,
  • Tatra Asset Management, správ. spol. a. s., seated at Hodžovo namestie 3, 811 06 Bratislava, Company ID No: 35 742 968,
  • Centrum bývaniaTB seated at Hodžovo namestie 3, 811 06 Bratislava, Company ID No: 35 707 682.

Tatra-Leasing has legitimate interest in taking care for its Clients and developing business relations with its Clients, and hence informing them about its products, innovations, services or offers of various benefits. In relation thereto Tatra-Leasing can contact you yet without your prior consent while it will inform you of such processing of your personal data and instructs you about your rights, especially about the right to object to processing of your personal data. Naturally, this is not the case if you have expressed your disapproval of such contact or if you object it.

Tatra-Leasing may communicate with you for the above purpose by means of automatic calling system, telephone, e-mail, text message or via other means of distance communication. With the aim to adjust the offer of products and services directly to your requirements, Tatra-Leasing evaluates information processed about you in order to provide you with a targeted offer and this way eliminate sending of non-targeted marketing offers.

For the purposes set forth in this section, the Client also means a person with whom Tatra-Leasing discussed or wishes to discuss an execution of transaction, although this transaction was not executed, the person who ceased to be a client of Tatra-Leasing, a person providing security and the representative of a client who concluded a banking transaction on behalf of the client or negotiated such conclusion.

 

6. Automated decision making including profiling

Automated decision making including profiling belongs to the processing operations which are worth special attention, executed by the Client filing system.

Processing of a request for provision of a banking service results in automated decisions made on basis of profiling. Profiling of a Client considers the data obtained by Tatra-Leasing at the time of request and also data registered by Tatra-Leasing in terms of previous Client's history in Tatra-Leasing, as well as data obtained in compliance with valid legal regulations from external resources and the system executes automated decisions on basis of these data. Tatra-Leasing considers several data at profiling, which can impact the decision regarding the request both positively and negatively. The data which are considered are data about potential Client risk rate, Client's assets and liabilities with Tatra-Leasing, Client's payment discipline, regularity of utilisation of products at the time when conclusion of the given transaction is negotiated. Tatra-Leasing evaluates the respective data in regular intervals and estimates the risk profile of the Client based on these data. In case of a Client with no previous history in Tatra-Leasing evaluates the data obtained from the Client's request and data obtained in compliance with the valid legal regulations from external resources. The request is considered at the automated decision making on basis of the obtained risk profile of the Client.

This decision may affect automatic request refusal, maximum approved amount of individual loans, possibility of provision of individual products, maximum maturity of the requested product. Client's risk profile as such has direct impact on the proposal of conditions and it basically applies that the better the Client's risk profile, the better the conditions for the Client suggested by the Tatra-Leasing. The data set forth herein and also data about behaviour of clients at payment delay can be used for the process of decision making regarding the optimum recovery process and can affect selection of the loan recovery or restructuring strategy. Data can also be used for the activities for the purpose of avoiding the delay of the client.

In case of automated decision making including profiling pursuant to Article 22 GDPR at processing of your request for a banking product, you will be entitled to human intervention by Tatra-Leasing on your own standpoint and also to object the decision adopted on basis of automated decision making including profiling.

Automated decision making happens when a loan transaction conclusion is negotiated.

 

7. Credit registers

In connection with the assessment of the Client’s ability to repay a loan, your data may be provided and disclosed to the relevant registers:

  • Non-Banking Credit Bureau – Consumer Credit Register (hereinafter referred to as the “Register”) is a register according to Section 7(3) of the Act on Consumer Loans and also a register according to Section 8(20) of the Act on Housing Loans in the extent according to Section 7(9) of the Act on Consumer Loans. According to the Act on Consumer Loans and Act on Housing Loans, Tatra-Leasing is obliged to provide data to the Register and obtain data from the Register without consent of the Client.  The legal basis for the processing of personal data in the Register is Article 6(1)(c) of the Regulation, Act on Consumer Loans and Act on Housing Loans. The categories of personal data and the purpose of the processing of personal data in the Register are stipulated by the Act on Consumer Loans and the Act on Housing Loans; the purpose of the processing of personal data in the Register is granting of consumer loans and/or housing loans and the assessment of the consumer’s ability to repay the consumer loan and/or housing loan.

The provision of personal data in the above-mentioned instances is a statutory requirement.

  • Non-Banking Credit Bureau (hereinafter referred to as the “Credit Bureau”) is a register which processes, by automated means of processing, personal data of natural persons and legal entities who/which applied for the conclusion of a contract, as well as of those persons who concluded a contract with non-banking creditors and other entities published by the association of legal entities called Non Banking Credit Bureau, záujmové združenie právnických osôb, Company ID No.: 42 053 404, with its registered office at Mlynské Nivy 14, 821 09 Bratislava (hereinafter referred to as “NBCB”) which is the controller of the Credit Bureau. Tatra-Leasing is a founding member of NBCB. The legal basis for the processing of personal data in the Credit Bureau is the consent of the Client granted according to Article 6(1)(a) of the GDPR Regulation. The Client shall have the right to withdraw the granted consent at any time. The categories of personal data are data in the extent provided in the application for conclusion of a contract or, in the case that the contract has been concluded on the basis of the application, data in the extent provided in the contract; the purpose of the processing is mutual provision of information between non-banking creditors and other entities published on www.nbcb.sk, namely information about solvency, credibility and payment discipline of their clients, protection of legitimate economic interests and prevention against credit frauds.

Personal data processed in the Credit Bureau are provided to non-banking creditors and other entities published on www.nbcb.sk

Complete information according to Article 14 of the GDPR Regulation on the processing of personal data in the Credit Bureau and the Register is provided in Annex No. 1 hereto.

 

8. Who can we provide your personal data to?

Tatra-Leasing shall not provide your personal data to other entities, except for the cases in which you have granted your consent or written instruction to Tatra-Leasing for such provision of data or if other legal ground for provision of your personal data to other entities exists, for instance in case of performance of the legal obligation of Tatra-Leasing as the controller. Provision of your personal data to other entities in terms of performance of the legal obligation can be executed in the environment of Tatra-Leasing only in cases set under the relevant legislations.

Tatra-Leasing may provide personal data to other entities without your consent in terms of meeting the legal duties:

  • in the area of protection against legalisation of incomes from criminal activities and financing of terrorism pursuant to the AML Act,
  • in connection with reporting to the law enforcement authorities about suspicion that a crime is being prepared, being committed or was committed,
  • in connection with consideration of the ability to repay a consumer loan pursuant to the Act No. 129/2010 on Consumer Loans and Other Credits and Loans for Consumers and on amendments to certain laws as amended,
  • in connection with meeting the reporting duty towards the National Security Authority in the field of cybersecurity pursuant to the Act No. 69/2018 Coll. on Cybersecurity.

Also please note that Tatra-Leasing and entities from the Raiffeisen Group have legitimate interest in mutual sharing of personal data processed in the Client filing system which can lead also to cross-border transfer of data, and that in terms of:

  • protection against legalisation of incomes from criminal activities and financing of terrorism,
  • meeting the duties connected with the execution of banking activities at the level of the Raiffeisen Group,
  • in connection with consideration of financial standing and credibility of clients.

Tatra-Leasing does not publish your personal data.

8.1.   Processors

Tatra-Leasing may process your personal data in certain cases also by means of its processors. Processor is an entity authorised by Tatra-Leasing to process personal data in compliance with the Article 28 GDPR. Authorisation for processing of your personal data by an processor does not require your consent or other legal ground such as in case of provision of data to other controllers. In such case the processor processes your personal data on behalf of Tatra banka as the controller.

Processing of personal data by means of an processor has no negative impact on performance and application of your rights as the data subject determined in Chapter III GDPR while the client can apply the respective rights with Tatra-Leasing as the controller also directly with the particular processor which processes your personal data.

Tatra-Leasing wants to assure you that it only uses the processors providing appropriate technical, organisational and other measures so that processing meets the GDPR requirements and protection of rights of the data subject is provided in full extent. Tatra-Leasing uses the following categories of processors at processing of your personal data:

  • companies which provide or execute financial and related services,
  • companies which execute customer satisfaction surveys,
  • companies which provide marketing activities,
  • companies which provide print services and services of mass correspondence,
  • companies which execute maintenance of registry records pursuant to separate regulations,
  • companies which provide recovery and maintenance of receivables,
  • companies which provide execution of mortgage by means of public auction.
8.2   Transfer of personal data to third countries

Personal data are not the subject of cross-border transfer to third countries that do not ensure an adequate level of personal data protection except for the cases specified by valid legal regulations or specific situations when the Client must be notified of such transfer in advance.

8.3 Processing of personal data using cloud solutions

When processing personal data, cloud solutions or solutions of a similar technical nature are used in many cases. The use of such solutions is, for example, in many cases required as part of the implementation of state-of-the-art software tools, or improves efficiency and cost-effectiveness. Last but not least, such solutions also help maintain the integrity of the processed data and contribute towards the security of processing.

Depending on the type of processing activities, in such processing the providers of cloud or similar services act mainly as processors in accordance with Article 28 of the GDPR. In selecting its partners and in the course of the processing activities, Tatra-Leasing is very careful to avoid any risk of data security breach or any negative impact on the rights of data subjects. Tatra-Leasing also consistently makes sure to select only partners who have demonstrably implemented appropriate technical and organisational measures to ensure the level of security pursuant to point (c) Article 28 par.3 c) and Article 32 of the GDPR, so that the processing is performed in compliance with the valid legal regulations, in particular the GDPR, and to ensure protection of the rights of data subjects.

In such processing, personal data are not transferred to third countries which do not guarantee an adequate level of protection under the GDPR“

9. How long do we store your personal data?

Tatra-Leaisng shall retain your data in a form enabling your identification for the period necessary to achieve the purpose of personal data processing.

If your personal data are being processed with your consent, Tatra-Leasing will store personal data after the consent is revoked or its validity expires only for the period required to demonstrate, apply or defend legal claims of Tatra-Leasing. This also applies in case of processing under the contract.
If your personal data are being processed in terms of performance of the legal obligation of Tatra-Leasing, the respective legal regulations specify the period during which Tatra-Leasing is obligated to store your personal data and related documents. Such legal regulations include especially:

  • Act on Accounting, which Tatra-Leasing is required to keep and protect for ten years following the year to which the accounting documents relate,
  • AML Act, which stipulates that Tatra-Leasing is obligated to store during the period of five years:
    • after the contract relationship with the client terminated: data and written documents obtained in connection with care provided for the client and in connection with detecting unusual business transaction,
    • after the execution of transaction: all data and written documents about the client
  • Act on Financial Intermediation, which stipulates the period for storing documentation for the period of at least ten years after commencement of validity of the contract on provision of financial service and the period of at least five years after termination of the contract on provision of financial consulting (§ 36).

 

10. How do we protect your personal data?

We adopt technical and organisational measures with the aim to protect your personal data against intentional or neglectful deletion, loss or change and unauthorised accession of your personal data. Tatra-Leasing employees, as well as Tatra-Leasing contract partners who process personal data on behalf of Tatra-Leasing are bound by the obligation of secrecy which lasts yet after the contract relationship terminates.

 

11. What are your rights in relation to personal data processing?

In connection with processing of personal data you have the right to file a compliant to the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovak Republic.

You have the right to correct the personal data related to you that are incorrect or to complete the personal data that are incomplete. Please do not hesitate to contact us in case you find out that the data we process in relation to you are incorrect or incomplete.

If your personal data are being processed based on the consent pursuant to Article 6 par. 1 GDPR or pursuant to Article 9 par. 2 GDPR, you are entitled to withdraw this consent at any time. However, withdrawal of consent has no impact on lawfulness of processing resulting from consent before its withdrawal.

Right to object to processing of your personal data

As the data subject, you have the right to object to processing of your personal data if the processing is being carried out on the legal grounds of the legitimate interests of Tatra-Leasing, including objecting to profiling based on legitimate interests. Tatra-Leasing may further process your personal data on grounds of legitimate interests only in case it proves the existence of inevitable legitimate grounds for processing which prevail over your interests, rights and freedom, or grounds for demonstrating, application or defending of legal grounds.

You are entitled to object to processing of your personal data at any time for purposes of direct marketing including profiling in the extent in which it is related to such direct marketing, and that in case of processing on legal grounds of legitimate interests of Tatra-Leasing. If you object to processing for purposes of direct marketing, Tatra-Leasing will not further process your personal data for purposes of direct marketing. As the data subject you are entitled to access your personal data. In case of meeting the terms and conditions defined by GDPR you can apply for a statement of your personal data which we process about you. In certain circumstances you can apply for restriction of processing, transfer of your personal data and you are also entitled to deletion of your personal data.

You can exercise your rights in writing, by telephone via our INFOLEASING, by e-mail sent to info@tatraleasing.sk or in person at any branch. Tatra-Leasing may ask you to provide additional information required for verification of your identity.

 

Bratislava, 13.11.2018

 

Annex No. 1 to INFORMATION MEMORANDUM ON PERSONAL DATA PROTECTION

 

Information according to Article 14 of the GDPR Regulation on the processing of personal data in registers

Non-Banking Credit Bureau – Consumer Credit Register (hereinafter referred to as the “Register”) is a register according to Section 7(3) of Act No. 129/2010 Coll. on Consumer Loans and Other Credits and Loans to Consumers (hereinafter referred to as the “Act on Consumer Loans”) and also a register according to Section 8(20) of Act No. 90/2016 Coll. on Housing Loans (hereinafter referred to as the “Act on Housing Loans”), namely in the extent according to Section 7(9) of the Act on Consumer Loans. When a creditor grants a consumer loan according to the Act on Consumer Loans, the creditor is obliged according to the Act on Consumer Loans and Act on Housing Loans to provide data to the Register and obtain data from the Register without consent of the client.

Non Banking Credit Bureau, záujmové združenie právnických osôb, Company ID No.: 42 053 404, with its registered office at Mlynské Nivy 14, 821 09 Bratislava (hereinafter referred to as “NBCB”) is the controller of Non-Banking Credit Bureau (hereinafter referred to as the “Credit Bureau”) which processes, by automated means of processing, personal data of natural persons and legal entities who/which applied for the conclusion of a contract, as well as of those persons who concluded a contract with non-banking creditors and other entities published on the NBCB website www.nbs.sk (hereinafter referred to as the “Third Parties”) in the extent of data provided in the application and/or contract.     

According to Section 7(6) of the Act on Consumer Loans and the relevant provisions of the Act on Housing Loans, personal data processed in the Register may also be disclosed to other persons identified by these legal regulations. A list of creditors, banks, foreign banks and branches of foreign banks, registers of data on consumer loans and their controllers according to the Act on Consumer Loans to whom the personal data processed in the Register are disclosed is provided on the website of the National Bank of Slovakia www.nbs.sk.

Personal data processed in the Credit Bureau are provided to the Third Parties who are published and updated on a regular basis on the NBCB website www.nbcb.sk.

Personal data processed in the Register and in the Credit Bureau are also provided to other entities according to the relevant provisions of the Act on Consumer Loans, Act on Housing Loans and other generally binding legal regulations.

The categories of personal data and the purpose of the processing of personal data in the Register are stipulated in the Act on Consumer Loans and the Act on Housing Loans.

The categories of personal data processed in the Credit Bureau are data in the extent provided in the application for conclusion of a contract or, in the case that the contract has been concluded on the basis of the application, data in the extent provided in the contract; the purpose of their processing is provision of personal data to Third Parties with the aim to mutually provide information between the Third Parties about the solvency, credibility and payment discipline of their clients (data subjects), protection of legitimate economic interests of the Third Parties and prevention against credit frauds.

The personal data processed in the Credit Bureau and the Register come from the Third Parties to which they were provided by data subjects as clients or potential clients of the Third Parties.

The legal basis for the processing of personal data in the Register is Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “Regulation”), the Act on Consumer Loans and the Act on Housing Loans.

The legal basis for the processing of personal data in the Credit Bureau is the consent of the data subject granted according to Article 6(1)(a) of the Regulation. The grant of consent according to the previous sentence is voluntary and the data subject shall have the right to withdraw his/her consent to the processing of personal data relating to the data subject at any time. The withdrawal of the consent shall not affect the lawfulness of personal data processing based on the consent before its withdrawal.

The duration of processing and the period for which the personal data of the data subject will be stored in the Register are stipulated by the Act on Consumer Loans.

The duration of processing and the period for which the personal data of the data subject will be stored in the Credit Bureau is five years after the consent was granted and, in the case of conclusion of a contract with a person who is user of the Credit Bureau and/or the Register, for the term of the contract and five years after the cessation of obligations ensuing from the contract. The personal data of the data subject will be then placed under pre-archiving care in accordance with generally binding legal regulations.

Personal data processed in the Register and in the Credit Bureau are not disclosed or transferred to third countries. Personal data of data subjects are further provided and processed by the companies CRIF – Slovak Credit Bureau, s.r.o., with its registered office at Mlynské nivy 14, 821 09 Bratislava, Slovak Republic, and CRIF S.p.A., with its registered office at Via M.Fantin 1-3, 40131 Bologna, Italy, as processors for NBCB for the purposes mentioned above.

More information about the Register and the Credit Bureau, and the services they provide can be obtained from the Credit Bureau Customer Centre with its seat at: Mlynské Nivy 14, 821 09 Bratislava, Phone: +421 2 59207518, e-mail: nbcb@nbcb.sk

The Client as a data subject shall have the right to require from NBCB as a controller:

  • confirmation of processing or non-processing of personal data concerning the data subject according to the Information on the processing of personal data in registers;
  • general information on personal data processing in the filing system;
  • information on the source from which the controller has obtained personal data for the processing;
  • a list of personal data of the data subject which are subject to the processing;
  • rectification of personal data;
  • erasure of personal data from the Credit Bureau and erasure of personal data from the Register provided that the personal data:
  • are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • have been unlawfully processed;
  • have to be erased for compliance with a legal obligation;
  • restriction of processing of personal data;
  • portability of personal data processed in the Credit Bureau;
  • return of official documents containing personal data if they were provided.

Data subject shall also have the right to lodge an application initiating proceedings according to Article 100 of Act No. 18/2018 Coll. on Personal Data Protection. More specific conditions for the exercise of rights of data subjects are regulated in Chapter III of the Regulation.

Contact data of the data protection officer appointed by NBCB as controller of the Credit Bureau: postal address – Mlynské Nivy 14, 821 09 Bratislava, e-mail – dpo@nbcb.sk.