Information on personal data processing
by Zagrebačka banka d.d.

You can download this information on personal data processing in the form of a PDF document at the link:

Information on personal data processing by Zagrebačka banka d.d. (PDF)

The purpose of the information provided in this document is to give you an overview of the manner in which the Bank processes personal data, and to inform you of the rights you have in connection with the processing of such data. The information applies to the following data subjects: clients (individuals), potential clients and other natural persons whose personal data Zagrebačka banka d.d. collects on a particular lawful basis (e.g., guarantors, joint and several debtors, lien debtors, proxy holders, guardians, heirs, representatives of minors, and natural persons who have ended their business relationship with Zagrebačka banka d.d.).

Document sections:

1. CONTROLLER AND DATA PROTECTION OFFICER
2. PERSONAL DATA WHICH ARE PROCESSED AND THE MANNER IN WHICH THE BANK COLLECTS PERSONAL DATA
3. SOURCES OF PERSONAL DATA
4. LAWFUL BASES AND PURPOSES FOR WHICH THE BANK PROCESSES THE PERSONAL DATA IT COLLECTS
5. WITHDRAWAL OF CONSENT
6. SHARING PERSONAL DATA WITH THIRD PARTIES
7. TRANSFERRING PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
8. PERSONAL DATA RETENTION PERIOD
9. DATA SUBJECT RIGHTS
10. AUTOMATED DECISION-MAKING AND PROFILING

1. Controller and Data Protection Officer

The controller is Zagrebačka banka d.d., Tax No. (OIB): 92963223473, having its registered office at Trg bana Josipa Jelačića 10, 10000 Zagreb, Republic of Croatia, email: zaba@unicreditgroup.zaba.hr, phone: 01/3773 333 (“Bank”).

The Data Protection Officer is available to you at: sluzbenik.za.zastitu.osobnih.
podataka@unicreditgroup.zaba.hr or at the above-stated registered address of the Controller.

2. Personal Data Which are Processed and the Manner in Which the Bank Collects Personal Data

Personal Data means any information that directly or indirectly identifies an individual, i.e., any information or a combination of information that relates to an identified or identifiable natural person (“data subject” or “you”), e.g., name, surname, personal identification number, address, photograph, account number, income data. Depending on the business relationship, business needs and obligations, the Bank may process all or only certain categories of your personal data. To give you a better insight into the afore-stated, below we provide particular explanations and examples of the data that the Bank processes in its business operations.

In its business operations, the Bank may process the following types of data:

1. Identification and General Personal Data
   The data used to identify an individual, and the data the Bank is obligated to collect in connection with the regulations, including name and surname, personal identification number (OIB), address, citizenship, data contained on the identification document (and a copy of such document), tax residency data, etc.
2. Financial Data and Data Relating to Your Business Relationship
   The data that includes information about the contracts you have entered into with the Bank (products and services you have purchased), the data regarding your accounts, financial situation and management of funds (e.g., transaction records – payments and withdrawals, estimated creditworthiness, pre-loan approval data, data relating to savings or trading in shares, funds, etc.).
3. Contact Data
   The data including email address, phone number/mobile phone number, and similar.
4. Socio-Demographic Data and Data Concerning Your Use of the Bank’s Products and Services
   The data that includes details, e.g., about your job (occupation), employment status, education, the manner in which you use the Bank’s products and services, transactions that you make (e.g., the channel you use, how often you make them, etc.).
5. Technical Data
   The data that includes, for example, information about your user accounts required for using the Bank’s online products and services (e.g., login credentials), IP address when accessing the Bank’s online products and services, information about the device you use to access such products and services, information about your preferences, and the manner in which you use the Bank’s online products and services.
6. Video Surveillance Footage and Conversation Recordings
   The data that includes video recordings of persons who have visited the Bank’s branches, buildings and/or ATMs captured by the Bank’s video surveillance system, and the data in the form of audio recordings of the phone calls you have made to the Bank.
7. Data Relating to Your Communication with the Bank
   The data that includes information relating to your communication with the Bank via the various available channels of communication (calls, online chats, letters, and other types of communication), as well as your inquiries/information provided (e.g., calls related to service/product activation, inquiries about your business relationship or applications/requests submitted to the Bank, inquiries about the complaints you submitted to the Bank (including disputes with the Bank), and the responses, information and advice provided to you by the Bank.
8. Data Regarding your Choices
   The data that includes, for example, your consent to receive marketing messages or invitations to participate in market research, as well as your preferred communication channels.
9. Special Categories of Data and Sensitive Data Associated with Risk Management
   The data that include, for example, health data (if you have provided such data to the Bank for the purpose of, e.g., getting approval for a moratorium on loan repayments, or if you have, on the other hand, enclosed such data in communication with the Bank without the Bank asking you to do so), information on union membership (provided voluntarily as grounds for getting a lower interest rate on a loan), biometric data (e.g., a piece of biometric data generated in the identification process when establishing a business relationship with the Bank remotely). Sensitive data associated with risk management include information relating to, for example, the management of money laundering and terrorism financing risk (e.g., politically exposed person, information regarding criminal offences, etc.), fraud risk, and/or reputational risk.
10. Publicly Available Data and/or Data Obtained from Other Sources
    The data that includes information that the Bank collects from publicly available sources (such as the Unified Accounts Registry, information available on the internet, e.g., the court register, etc.), and information that the Bank obtains from other non-public sources (e.g., from credit intermediaries, i.e., from the Basic Registry System (“OSR System”) via Hrvatski registar obveza po kreditima d.o.o. (Croatian Registry of Credit Obligations).

3. Sources of Personal Data

The Bank’s relies on the following sources of data:

(a) The Bank primarily collects data directly from the data subject through any kind of communication with the Bank (whether oral or written). The most common example of collecting data in this manner is the situation when an application for a particular service or product offered by the Bank is submitted, in which case the data is collected through a standard application/request or form (e.g., KYC questionnaire, My Data form, application for a credit product, etc.).

(b) The Bank also collects data in the course of any kind of communication with the data subject conducted at a branch or through e-branch, via online channels, such as m-zaba and e-zaba, and its website (e.g., data/logs containing information on how the client uses different products and services and his/her preferences associated with the same, data regarding his/her access device(s), collected through the use of cookies and similar technologies), using other channels of communication, in the process of resolving complaints, etc.

(c) The Bank also collects the data generated through the processing of any piece of information in the course of providing banking and financial services or selling products and services offered by its contractual partners, e.g., information regarding transactions, personal spending habits and interests.

(d) The Bank may also collect data from third parties, such as Hrvatski registar obveza po kreditima d.o.o. (Croatian Registry of Credit Obligations) – Basic Registry System (“OSR System”). In cases where accounts are opened in the name of minors or persons (partially) deprived of legal capacity, personal data are collected from their legal representatives/guardians. The Bank also collects data from third parties when it acts as a participant in a payment system (whether international or national), e.g., for the purpose of executing (performing) payments and preparing statements, payment confirmations, and similar, or when it, for example, relies on publicly available or other relevant sources to gather the necessary data (e.g., Unified Registry of Accounts, Document Authenticity Verification System (pravosudje.hr), Sanctions Lists), all in accordance with the applicable regulations and business needs.

(e) The Bank may also collect data from the members of the Zagrebačka banka Group and the members of the UniCredit Group ( www.zaba.hr/home/en/about-us/about-us/structure, Controlled companies - UniCredit (unicreditgroup.eu)), to which it belongs, for the purpose of managing business risks, including: credit risk, liquidity risk, interest risk, operational risk, and other risks to which the Bank and members of its Group are exposed.

4. Lawful Bases and Purposes for Which the Bank Processes the Personal Data It Collects

a) Processing is necessary for compliance with the Controller’s legal obligations

The processing is necessary to enable the Bank to comply with the obligations laid down in the regulations, or for other purposes set forth by the law (e.g., Anti-Money Laundering and Terrorist Financing Act or Act on Administrative Cooperation in the Field of Taxation regulating the implementation of the Agreement between the Government of the Republic of Croatia and the Government of the United States of America to Improve International Tax Compliance and to Implement FATCA), as well as to enable the Bank to act in accordance with particular documents adopted by the relevant institutions of the Republic of Croatia or other bodies whose orders the Bank is obligated to respect pursuant to statutory and other regulations.

The data processed in this regard primarily include: identification data from a valid identification document, and such data that the Bank is obligated to process in accordance with the regulations (including name and surname, permanent and/or temporary residence address, personal identification number (OIB), date, place and country of birth, citizenship(s), tax residency data (whether the data subject is a taxpayer in a country other than the Republic of Croatia), financial data, and data relating to the business relationship, the use of banking services, transactions (e.g., the purpose and scope of doing business with the Bank).

b) Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the data subject's request prior to entering into a contract

The data processed in this regard primarily include: personal data necessary for the purposes of the business relationship with the Bank, which depends on the product/service arranged with the same (e.g., general personal data, name and surname, personal identification number (OIB), financial data, and data associated with the contracting process and the use of different products and/or services, e.g., email address when applying for e-zaba and mobile phone number when applying for m-zaba). In the case of minors or persons (partially) deprived of legal capacity, the Bank, for example, collects the data that concern their legal representatives/guardians. In addition, if, when establishing a business relationship and/or during the business relationship, the client agrees with the Bank a particular method of delivery of information/documents associated with that business relationship, such delivery and all communication with the client (including sending information/documents about products and services) will be done in the chosen/agreed manner.

Consequence of NonProvision of Data/Missing Data

The provision (collection) of personal data with regard to what is stated above in points a) and b) is mandatory. If the data subject (or, where applicable, his/her representative) refuses to provide any of the data necessary for compliance with legal obligations and/or entry into and performance of a contract to which the data subject is a party, including personal data collected for the purposes of risk management in the manner and to the extent prescribed by applicable laws and subordinate legislation, the Bank may not be able to provide certain services, or it may refuse to enter into a contractual relationship, and limit or terminate an existing business relationship..

c) Processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party (including the interests of the members of the Zagrebačka banka Group and the members of the UniCredit Group)

A legitimate interest of the Bank and/or a third party (including the UniCredit Group) is relied on as the basis for processing personal data only in cases where this is necessary considering the Bank’s business needs and operations (i.e., when no legal obligation or other lawful basis for data processing exists), and primarily in connection with certain processing activities carried out in the context of:

• risk management, i.e., management of particular credit and operational risks, which includes taking measures to protect people, premises and property of the Bank (e.g., in the event of incidents/unacceptable behaviour on the part of clients at the branch, in the process of assessing the threat, preventing the occurrence of damage, controlling and/or checking the access), reputational risk, risk of certain types of fraud (e.g., document authenticity verification, conducting additional controls) and other risks to which the Bank is exposed at the level of the UniCredit Group, to which it belongs, and the Zagrebačka banka Group;
• taking measures associated with the management of the Bank’s business operations and IT systems (including the infrastructure and the web pages) to ensure business continuity and guarantee IT security, as well as further development of products/services. This includes performing updates, system (re)calibration, maintenance, product and/or service optimization activities (including IT systems, applications, and related functions), reporting activities and certain statistical analyses, all for the purpose of guaranteeing data reliability and accuracy, and the ability to identify and quickly resolve all problems associated with the technical functioning of IT systems;
• segmentation of data concerning the use of different products and services by clients with the aim of creating products and services sales reports, as well as for the purpose of adjusting the products and services, which is based on the Bank’s interest to manage its business operations and provide better and higher quality service to its clients;
• ensuring an adequate response to client demands and expectations with respect to products and services, and enabling the introduction of new features requested by the clients, such as, for example, sending real-time notifications that improve user experience (e.g., a notification that a payment has been made to the account, sending instructions/information regarding the use of the Bank’s application/product/service at the moment when the client is using it and needs the information), and similar;
• processing personal data within members of the Zagrebačka banka Group and members of the UniCredit Group for internal administrative purposes, and for the purpose of protecting property and computer and electronic communications systems;
• establishing and defending legal claims the circumstances of which have been stated in written communication with the Bank and/or during the proceedings held before a court or other competent authority, when acting in accordance with the guidelines issued by the regulators and/or other competent authorities, and similar.

Consequence of NonProvision of Data/Missing Data

If the data whose processing is based on a legitimate interest are necessary in connection with the provision (or continued provision) of services, provision of personal data is deemed necessary for pursuing legitimate interests and failure to provide such data will render the provision of services impossible. The Bank, however, always esnures that such processing may only be carried out in cases where, in accordance with the assessment of the legitimate interest, the Bank’s interest is not overridden by the interests and fundamental rights and freedoms of the data subject. In addition, the data subject has the right to object to the processing of personal data based on a legitimate interest.

d) The data subject has given consent to the processing of his/her personal data for one or more specific purposes

The Bank may rely on the data subject’s consent as the basis for processing in connection with, for example:

• provision of marketing information about the Bank’s offers, in which context the Bank may deliver to the data subject information regarding the offers and benefits associated with new products and services, or the products and services already arranged with the Bank and/or its contractual partners, which includes individualized offers relating to the use of banking and financial services, and the related services of the Bank and members of the Group based on a generated profile (which may also include automated individual decision-making);

If you have given consent for the afore-mentioned purpose, the Bank will, for example, process such data that relates to the use of different products and services, such as the data about the type and location, amount and frequency of transactions, account balance, card use, and data regarding visits to the branch, and similar.

• participation in market research, in which case the Bank may invite you to express your opinion about its products and services in periodic research;
• unique data subject identification resulting in the creation of biometric data. Biometric Data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as the biometric processing of a photograph and a video recording when establishing a business relationship remotely. Additional information is provided at the time when consent for biometric processing is requested.

Giving consent is entirely voluntary, and provision of such data which is collected exclusively on the basis of consent for the specific purpose stated in the consent is not mandatory.

5. Withdrawal of Consent

A consent given may be withdrawn at any time, which will, however, not affect the lawfulness of the processing based on consent prior to withdrawal. In addition, the data subject has the right to deny his/her consent. The Bank will not refuse to provide its banking services to the data subject if he/she denies or withdraws consent. When giving consent, the data subject will be informed of the manner in which consents can be withdrawn. In general, consents can be withdrawn at the Bank’s branches. However, besides at the branches, consents given for marketing and market research purposes can also be withdrawn via direct channels (e-zaba and m-zaba).

Additional Information

In addition, the Bank may also process personal data, e.g., special categories of personal data (such as health data), if one of the conditions laid down in Article 9 of the General Data Protection Regulation applies, including situations where:

• processing is necessary for reasons of substantial public interest based on the EU or Member State law which is proportionate to the aim pursued, and respects the essence of the right to data protection,
• processing is necessary for the establishment, exercise or defence of legal claims, or whenever courts are acting in their judicial capacity, and
• the data subject has given explicit consent to the processing of such personal data.

Furthermore, the processing activities that constitute exemptions from the obligation to provide information to data subjects (as determined in Article 14(5) of the General Data Protection Regulation) are not described in this Information on Personal Data Processing.