Policy and procedure for the protection of customers’ personal data

This Policy and procedure for the protection of customers’ personal data (hereinafter referred to as the “Policy”) has been developed in accordance with the Law of Ukraine “On Personal Data Protection”, other laws and secondary legislation, taking into account international practices in the field of personal data protection. For the purposes of this Policy, the terms used herein shall have the meanings set out in the Law of Ukraine “On Personal Data Protection”. The controller of customers’ personal data is JSC ProCredit Bank, registered office: 107-A Beresteiskyi Avenue, Kyiv, 03115, Ukraine; EDRPOU identification code: 21677333 (hereinafter referred to as the “Bank”).

The purpose of processing customers’ personal data is to enable the Bank to exercise its rights and fulfil its obligations as a bank, including its functions as a primary financial monitoring entity, sanctions implementation entity, currency supervision agent, tax agent, lender and other functions, in the course of customer due diligence, provision of banking and other financial services, performance of other activities envisaged by the Law of Ukraine “On Banks and Banking Activities”, dissemination of informational and promotional communications regarding banking and other financial services, and protection of the Bank’s rights and legitimate interests.

The categories and content of customers’ personal data that may be processed by the Bank include:

• surname, first name, patronymic (where applicable), date and place of birth, sex, citizenship;
• series, number and date of issue of the passport of a citizen of Ukraine (or another identification document), and the issuing authority;
• other information contained in the passport of a citizen of Ukraine (or another identification document);
• taxpayer registration number and tax status;
• registered and/or actual residential address/place of stay and living conditions;
• email address and telephone number;
• education, profession, place of employment, length of service and position;
• financial status, amount of income, accruals and deductions, and property;
• voice recordings and/or photographic and video images;
• specimen signature and electronic signatures;
• information regarding the person’s status as a politically exposed person or a person associated with such individuals;
• membership in political parties and trade unions;
• information concerning criminal convictions and/or administrative liability;
• health-related data;
• information forming the customer’s credit history;
• information on the customer’s performance of obligations under agreements concluded with the Bank and/or other institutions;
• usernames, passwords, data concerning mobile devices, web browsers and online identifiers (IP address, cookies, radio-frequency identification tags or other identifiers by means of which a customer may be identified);
• identification data of a person opening an account in the customer’s name;
• identification data of a person authorised to act on behalf of and in the interests of the customer;
• data relating to the state registration of a sole proprietor or an individual engaged in an independent professional activity, types of business activity, licences (permits) for conducting business activities, etc.;
• other customer data.

Sources of customers’ personal data include information provided by customers and/or their representatives; applications, questionnaires, survey forms, agreements, payment instructions and other documents completed and/or signed by them, including electronic forms completed through remote communication channels; submitted documents and/or copies thereof; files containing voice recordings and/or photographic or video images created during verification procedures or in the course of providing banking and other financial services; publicly available sources (state registers, mass media, social media, etc.); online identifiers; and other relevant sources.

The Bank processes customers’ personal data received from third parties where such processing is provided for by the legislation of Ukraine or where such third parties provide assurances that the transfer of personal data is carried out in compliance with the requirements of Ukrainian legislation and does not infringe the rights of customers.

The legal grounds for processing personal data are established by Article 11 of the Law of Ukraine “On Personal Data Protection”.

Customers’ personal data shall be processed on the basis of:

• the customer’s consent;
• authorisation to process personal data granted to the Bank in accordance with the law solely for the exercise of its powers;
• the conclusion and performance of a transaction to which the customer is a party, or which is concluded for the benefit of the customer, or for the implementation of measures preceding the conclusion of a transaction at the customer’s request;
• protection of the customer’s vital interests;
• the necessity to fulfil an obligation of the Bank prescribed by law;
• the necessity to protect the legitimate interests of the Bank or a third party to whom the personal data are disclosed, except where the need to protect the customer’s fundamental rights and freedoms in connection with the processing of personal data overrides such interests.

The customer’s consent to the processing of personal data may be provided to the Bank:

• in writing (paper or electronic form) as a separate document or a relevant provision included in an application, questionnaire, survey form, agreement, etc.;
• by placing the relevant mark during registration in the Bank’s information and communication system, including on the Bank’s website or in its mobile application;
• verbally through electronic communication channels, including video communication with the Bank.

A person’s contact with the Bank or use of the Bank’s services constitutes that person’s consent to the processing of personal data by the Bank in connection with such contact or use of services.

Upon signing any agreement with the Bank, application (including an account opening application), questionnaire, survey form, payment instruction or any other document relating to a banking or other financial service, the customer’s personal data shall be included in the “Reporting” and “Customers” personal data databases located at: 107-A Beresteiskyi Avenue, Kyiv, 03115, Ukraine.

By signing any agreement with the Bank, application (including an account opening application), questionnaire, survey form, payment instruction or other document relating to a banking or other financial service, the customer confirms having been informed by the Bank of the sources from which personal data are collected, the categories and content of such data, the location of personal data databases, the purpose of processing personal data, the controller of personal data, the persons to whom personal data may be disclosed, and the customer’s rights as defined by the Law of Ukraine “On Personal Data Protection”.

The processing of customers’ personal data pursuant to the requirements of the Law of Ukraine “On Prevention and Counteraction to Legalisation (Laundering) of the Proceeds of Crime, Financing of Terrorism and Financing of the Proliferation of Weapons of Mass Destruction”, as well as personal data obtained by the Bank from public sources, shall be carried out without obtaining the customer’s consent.

The Bank processes customers’ personal data in paper form and in electronic form (within the automated banking system).

Changes to customers’ personal data shall be made on the basis of their reasoned written request. The Bank may also amend customers’ personal data at the request of other participants in personal data relations if the customer has consented thereto, or where such amendment is made pursuant to an order of the Ukrainian Parliament Commissioner for Human Rights (hereinafter referred to as the “Commissioner”), authorised officials of the Commissioner’s Secretariat, or pursuant to a court decision that has entered into legal force.

Inaccurate personal data shall be corrected immediately upon discovery of the inaccuracy.

The Bank shall process customers’ personal data for the period necessary to achieve the purpose of processing, but no less than the periods established by the legislation of Ukraine regarding the retention of documents generated in the course of banking activities and/or the Bank’s internal regulations.

Customers’ personal data shall be deleted or destroyed in the event of:

• expiry of the retention period necessary to achieve the purpose of processing and/or the retention period established by the legislation of Ukraine for documents generated in the course of banking activities and/or the Bank’s internal regulations;
• termination of the legal relationship between the customer and the Bank, unless otherwise provided by law;
• issuance of a relevant order by the Commissioner or authorised officials of the Commissioner’s Secretariat;
• entry into legal force of a court decision on deletion or destruction of customers’ personal data.

The procedure for deletion or destruction of customers’ personal data includes:

• recording the grounds for deletion or destruction;
• actual deletion of customers’ personal data from the automated banking system in accordance with the Bank’s internal regulations on information backup and event log retention requirements, or the physical destruction of material media containing customers’ personal data;
• preparation of a deletion or destruction report.

In accordance with Article 8 of the Law of Ukraine “On Personal Data Protection”, a customer as a data subject has the right to:

• know the sources of collection, location of personal data, purpose of processing, and the location or residence of the controller or processor of personal data, or to authorise representatives to obtain such information, except where otherwise provided by law;
• obtain information on the conditions for granting access to personal data, including information about third parties to whom personal data are disclosed;
• access their personal data;
• receive, no later than thirty calendar days from receipt of a request (except where otherwise provided by law), information as to whether their personal data are being processed and the content of such personal data;
• submit a reasoned objection to the controller regarding the processing of their personal data;
• submit a reasoned request for amendment or destruction of personal data by any controller or processor if such data are processed unlawfully or are inaccurate;
• protection of personal data against unlawful processing and accidental loss, destruction, damage, deliberate concealment, non-disclosure or late disclosure, as well as protection against dissemination of inaccurate information that damages personal honour, dignity or business reputation;
• lodge complaints regarding the processing of personal data with the Commissioner or with a court;
• use legal remedies in the event of violation of personal data protection legislation;
• enter reservations regarding restrictions on the right to process personal data when providing consent;
• withdraw consent to the processing of personal data;
• know the mechanisms of automated personal data processing;
• protection against automated decisions that have legal consequences for the customer

The procedure for access to customers’ personal data shall be determined independently by the Bank, taking into account the requirements of the Law of Ukraine “On Personal Data Protection”.

Only those Bank employees who require access in connection with their official duties and only to the extent necessary for the performance of such duties shall have access to customers’ personal data.

The procedure for access to personal data of third parties shall be determined by the terms of the customer’s consent to the processing of such data, agreements concluded by the Bank and/or legal requirements.

A third party shall not be granted access to personal data if that party refuses to undertake obligations regarding compliance with personal data protection legislation or is unable to ensure such compliance.

A request for access to customers’ personal data containing the information prescribed by the Law of Ukraine “On Personal Data Protection” must be submitted in writing to the Bank at: 107-A Beresteiskyi Avenue, Kyiv, 03115, Ukraine.

Where legal grounds for processing customers’ personal data exist, the Bank may disclose (transfer) such personal data to third parties, including foreign entities outside Ukraine, in particular:

• entities holding an ownership interest in the Bank’s authorised capital;
• entities which, under the legislation of Ukraine and/or agreements concluded with the Bank, are authorised to conduct inspections of the Bank’s activities;
• persons involved in providing services to the Bank and/or the customer (for example, issuers of electronic payment instruments, national and/or international payment systems, providers of electronic communications services, postal service providers, etc.);
• databases to which the Bank is obliged to provide information under legal requirements or contractual obligations, relating exclusively to the customer’s financial liabilities or overdue indebtedness owed to the Bank, including databases maintained by credit history bureaux, to which the Bank transfers information constituting the customer’s credit history in accordance with agreements concluded with such bureaux;
• the Credit Register of the National Bank of Ukraine, where the Bank conducts lending operations involving customers in accordance with Ukrainian legislation;
• third parties, in a form and scope determined by the Bank, where necessary for establishing, verifying or analysing customers’ financial standing for the purpose of granting loans, assessing collateral, ensuring or facilitating customers’ performance of obligations under credit and security agreements, assigning the Bank’s rights under credit and security agreements to third parties, or addressing breaches of agreements concluded between customers and the Bank;
• banking and other institutions belonging, through corporate relationships, to the group of which the Bank forms part (parent companies and subsidiaries), including the ProCredit Group, the Bank’s shareholders, rating agencies, audit companies conducting audits or ratings of the Bank, and legal entities participating in the securitisation of the Bank’s assets;
• foreign lenders of the Bank whose funds are used for lending to the Bank’s customers;
• law enforcement authorities when carrying out law enforcement activities, including on the basis of customer applications;
• authorised state authorities/persons in the cases and in accordance with the procedure established by the Law of Ukraine “On Banks and Banking”.

Customers’ personal data constitute confidential information and are subject to protection.

The protection of customers’ personal data is carried out in accordance with the legislation of Ukraine, national and international standards, and the Bank’s internal regulations. The Bank takes all necessary measures to protect such data and prevent unlawful processing, loss, destruction or damage.

Employees of the Bank who have access to customers’ personal data are obliged to ensure their protection, including protection against unauthorised disclosure. Such obligation remains in force indefinitely.

To prevent unauthorised disclosure of customers’ personal data, the Bank operates a Data Leakage Prevention (DLP) mechanism, which monitors the transmission of customers’ personal data through remote communication channels, as well as a Clean Desk Policy, which requires documents and information containing customers’ personal data in paper and electronic form (stored on physical devices) to be kept in securely protected cabinets and premises.

Where customers’ personal data are processed within the automated banking system, the Bank takes the necessary measures to create backup copies of such data, uses antivirus and network protection mechanisms, and secure data transmission channels.

The Bank maintains records of operations related to the processing of personal data and access thereto within the automated banking system by retaining logs relating to:

• creation, viewing, amendment, copying, transfer and deletion of customers’ personal data;
• user authorisation events;
• actions performed by administrators of the automated banking system and other privileged users.

Logs shall be retained for no less than three (3) years from the date of their creation in secure information systems that ensure their integrity and prevent unauthorised modification or deletion.

Access to logs shall be granted exclusively to Bank employees who require such access in connection with their official duties.

Where business relationships are established with third parties involving access to customers’ personal data, the Bank enters into a Non-Disclosure Agreement (NDA) in order to prevent unauthorised disclosure. Such agreement requires the third party not to disclose customers’ personal data and to ensure their proper protection.

Compliance with personal data protection legislation, within the powers provided by the legislation of Ukraine, is supervised by the courts and the Ukrainian Parliament Commissioner for Human Rights (21/8 Instytutska Street, Kyiv, 01008, Ukraine; Tel.: +380 (44) 299-74-08; 0-800-50-17-20; www.ombudsman.gov.ua).