Δήλωση Προστασίας Προσωπικών Δεδομένων

1 - Introduction

RCB Bank Ltd
Registration No.: HE 72376
2, Amathountos Street., P.O. Box 56868, 3310, Limassol, Cyprus
Tel.: +35725355722
Fax: +35725342192
Email: rcb@rcbcy.com
You can also contact our data protection officer at: 2, Amathountos Street., P.O. Box 56868, 3310, Limassol, Cyprus
Email: dpo@rcbcy.com

RCB Bank Ltd (“RCB” or the “Bank”) is dedicated to protecting the confidentiality and privacy of information entrusted to it. As part of this fundamental obligation, RCB is committed to the appropriate protection and use of personal information (sometimes referred to as “personal data”, "personally identifiable information" or "PII". In this document, ‘we’, ‘us’ and ‘our’ refer to RCB. We do not disclose your information to anyone, other than as set out in this Privacy Notice.

This privacy statement sets out our current policies and demonstrates our commitment to privacy. RCB provides financial products and services through its online systems / sites and at branches located in Cyprus and Luxembourg. We may also collect customer information through our representative offices located in London and Moscow. Privacy and personal data protection principles are applied based on this Privacy Notice at all relevant locations where hosting and processing takes place.

Generally, our intent is to collect only the personal information that is provided voluntarily by customers or online visitors so that we can offer information and/or services to those for specific and legitimate purposes. Please review this Privacy Notice to learn more about how we collect, use, share and protect the personal information that we obtain. Since our Privacy Notice may change at any time you will be receiving an update notification letter and your continued access to or use of our online systems / sites will mean that you agree to the changes.

The RCB’s Privacy Notice applies to personal information held by RCB as a data controller and as described in this Privacy Notice. The Notice explains what information we collect about our customers, how we use that information, who we share it with, and the circumstances when we may share it and what steps are taken to make sure it stays private and secure.

It is important to know that the Notice continues to apply even if the customer agreement for banking or other products and services with RCB ends and it covers any products or services customers have with RCB, including, for example, deposit accounts, savings accounts, loans, credit cards and investments, retail financing, commercial financing and payment services. This Notice should also be read alongside the relevant product terms and conditions provided under each customer agreement, as these may include sections relating to the use and disclosure of information that also apply. In addition, some of the links on RCB websites may lead to other non-RCB websites with their own data protection policies, which may be different to this Notice. Customers will need to ensure that those policies are acceptable to them prior to using those other sites.

As clearly stated, RCB takes the privacy of information seriously and we ask that you read this Privacy Notice carefully as it contains important information on:

• The personal information we collect about you (What we Need)
• What we do with your information (Why we Need it and What we Do with it),
• Who your information might be shared with, and
• What your rights are.

2 - Collection and Use of Personal Information

We obtain personal information about you if you choose to provide it — for example, to fulfill your request and to provide the requested and / or agreed services. In some cases, you may have previously provided your personal information to RCB (if, for example, you are a former customer or have had an established agreement or contract with RCB). By submitting personal information to RCB, you are also acknowledging that RCB may use this information in accordance with this Privacy Notice. Your personal information is not used for purposes other than those listed in this document, unless we obtain your permission, or unless otherwise required by law. In general we collect and generate the following information:

• Individual personal information (e.g. name, previous names, date and place of birth).
• Individual personal contact details (e.g. address, email address, landline, fax and mobile numbers).
• Identity information (e.g. photo ID, passport, utility bill, national ID card and nationality).
• Market research (e.g. information and opinions voluntarily expressed when participating in market research).
• User authentication login and subscription data (e.g. login credentials for online banking and mobile banking apps, and voice print).
• Financial information.
• Information about the ways you interact with RCB (e.g. channels used, payment history from and to your account, transaction information, ATM usage information, geographic information, software used and information concerning your complaints).
• Any information received from external authoritative registers required for compliance purposes.
• Information captured in customer documentation or data exchange such as application forms or advice documents or via telephone (e.g. records of advice).
• Marketing and promotional information (e.g. details of the services and your preferences).
• Cookies and similar technologies used to remember your preferences and tailor content.
• Risk rating information (e.g. credit risk rating and transactional behavior).
• Investigations data (e.g. due diligence checks, sanctions and anti-money laundering checks).
• Data or records of correspondence related to relevant exchanges of information (e.g. emails).
• Information to fulfill regulatory obligations (e.g. transaction details, user activity).
• Information from other entities (e.g. relevant transaction information).
• Information from third parties providing information to identify and manage fraud.
• Closed circuit television (CCTV) in and around RCB facilities (these may collect photos or videos of you).
• Voice recorded for quality and security purposes through voice call enquiries made at RCB Call Center.
• Other information about you that is voluntarily provided by filling in forms or by communicating with us, whether face-to-face or via other available channels (e.g. by phone, email, online).

If you send us a resume or curriculum vitae (CV) to apply online for a position with RCB, we will use the information that you provide to match you with available RCB job opportunities provided that a separate consent is given while application for the interested job opportunity is filled prior on submission.

Other information we collect may depend on the privacy settings you have set with your social media provider, so please review the privacy statement of the applicable service. In some cases where you have registered for certain services we may store your email address temporarily until we receive confirmation of the information you provided via an email (i.e. where we send an email to the email address provided as part of your registration to confirm a subscription request).

RCB generally collects only the personal information necessary to fulfill your request and to provide the requested and / or agreed services. Where additional, optional information is sought, you will be notified of this at the point of collection. The applicable law allows us to process personal information, so long as we have a ground under the law to do so. It also requires us to tell you what those grounds are. As a result, when we process your personal information, we will rely on one of the following processing conditions:

• Performance of a contract: this is when the processing of your personal information is necessary in order to perform our obligations under a contract but also to be able to complete our acceptance procedure so as to enter into a contract;
• Legal obligation or for public interest: this is when we are required to process your personal information in order to comply with a legal obligation, such as keeping records for complying with any tax obligations, regulatory purposes, or providing information to a public body or law enforcement organization;
• Legitimate interests: where necessary, we may process information about you where there is a legitimate interest for us or a third party in pursuing commercial and business interests, except where such interests are overridden by your interests, fundamental rights and freedoms; or
• Your consent: we may occasionally ask you for specific permission to process some of your personal information for some or more specific purposes, and we will only process your personal information in this way if you agree to us doing so. You may withdraw your consent at any time by contacting RCB at rcb@rcbcy.com.

RCB only collects "sensitive" personal information when the relevant individuals have explicitly provided us with their consent or where such information is otherwise required or permitted to be collected by law. Sensitive information includes, for example, personal information regarding a person’s ethnicity and criminal record. Please use your discretion when providing sensitive information to RCB, and under any circumstances, do not provide sensitive information to RCB, unless you thereby consent to RCB's use of that information for its legitimate business purposes and consent to the transfer and storage of such information to and in RCB databases. If you have any questions about whether the provision of sensitive information to RCB is, or may be, necessary or appropriate for particular purposes, please contact RCB at rcb@rcbcy.com.

In general we process, transfer and disclose customer information to:

• Verify your identity (e.g. for authentication or for anti-money laundering procedures).
• Provide services and delivery products (including via online platforms).
• Provide alerts and notifications.
• Deal with your transactions or carry out instructions.
• Perform data analytics and understand your preferences and how you use the provided services.
• Use technology for decision making purposes.
• Keep a record of correspondence (e.g. to check instructions given or to enhance service quality).
• Meet compliance and legal obligations such as to comply with FATCA and CRS regulatory framework.
• Manage our relationship with you (including any marketing activities you agree to).
• Collect any money owed to us.
• Obtain reports of an online problem (e.g. with the RCB sites or Mobile applications).
• Perform credit checks and obtain or provide credit references.
• Enforce or defend the rights of a member of RCB.
• For internal operational support and administrative purposes (e.g. product development, audit, credit and risk management).
• Complete surveys that we use for research purposes, although you do not have to respond to them.
• Perform any warranted risk and crime detection and management activities.
• Ensure security and business continuity.
• For service quality management and product improvement.
• Correspond with third parties (e.g. surveyors, valuators, intermediaries).

In the event that you cease to be a client of ours, according to our Data Retention Policy, and in compliance with Directives 1/2017 and 2/2017 issued by the Personal Data Commissioner, we shall retain your data for a period of up to ten (10) years. For a period of eight (8) years, the data will be retained and be easily accessible on a need to know basis to all such Bank officers as may be authorized. Following the expiration of the eight year period, and provided no legal proceedings or other investigations from a public office of the Republic have commenced, the data shall be archived in such a manner that they are kept separately from other data, and access to them shall be restricted. In the event that there are legal proceedings or investigations in connection with your data retained by us, we note that we shall retain your data for ten years from the date of resolution and/or completion of any such legal proceedings or investigations, provided we were informed of the commencement of these within the period of ten years from the date of delivery of the information.

If we have communicated to you that your application to become a client of ours has been rejected and/or that you have withdrawn your application, we shall retain your data for six months from any such communication and/or withdrawal.

After expiration of any of the aforementioned periods as applicable, your personal data will be irreversibly destroyed. This allows us to comply with legal and regulatory requirements or fulfill our legitimate purposes such as managing your account and dealing with any disputes that may arise, respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc. If we do not need to retain information for this period of time, we may destroy, delete or anonymize it more promptly. Any personal data held by us for marketing and service update notifications will be kept by us until such time that you notify us that you no longer wish to receive this information.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (EEA). The data may also be processed by staff operating outside of the EEA who work for RCB or for one of our third party service providers. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your data, you agree to this transfer, storing and/or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. We maintain security standards and procedures with a view to preventing unauthorized access to data by anyone, including our staff. We use technologies (e.g. data encryption, firewalls) to protect the security of data in transit and data at rest by following a risk based approach. All RCB members, all our staff and third parties are required to observe our privacy standards and to allow us to audit them for compliance.

We do not share personal information with unaffiliated third parties, except as necessary for our legitimate professional and business needs, to carry out your requests, and/or as required or permitted by law. This include:

• Service providers: RCB works with reputable partners and service providers so they can process your personal information on our behalf where required. RCB will only transfer personal information to them when they meet our standards set in our third party information security policy on the processing of data and security. We only share personal information that allows them to provide their services.
• Courts, law enforcement or regulatory bodies: RCB may disclose personal information in order to respond to requests of courts, government or law enforcement entities or where it is necessary to comply with applicable laws, court orders or rules, or government regulations.
• Audits: disclosures of personal information may also be needed for data privacy or security audits and/or to investigate or respond to a complaint or security threat.

In addition, RCB may transfer certain personal information outside of the EEA to external entities working with us or on our behalf for the purposes described in this Privacy Notice (e.g. in order to provide you with products or services you requested, or due to public or legal duty to do so). RCB will not transfer the personal information you provide to any third parties for their own direct marketing use.

As such information may be transferred and disclosed to authorities, law enforcement, government, persons acting on your behalf, payment recipients, beneficiaries, intermediaries, nominees, clearing houses, agent banks, fraud prevention agencies, debt recovery agencies, third party introducers, guarantee providers, other financial institutions, lenders and holders of security over any property relevant to RCB, tax authorities, credit reference agencies, payment service providers, fund managers, technology providers, support service providers, anyone who provides instructions or operates any of your accounts on your behalf (e.g. Power of Attorney), etc. We may also share aggregated or anonymized information with partners such as research groups, universities or advertisers.

We sometimes use systems to make automated suggestions or decisions, including profiling, based on personal information we have, or that are allowed to collect from other authorized sources, about you. This helps us ensure our decisions are quick, fair, efficient and correct, based on what we know. These automated decisions can affect the products, services or features we may offer you now or in the future. The types of automated decision we make include:

• Tailored Products and Services: We may place you in groups with similar customer segments. We use these to study and learn about our customers’ needs, and to make decisions based on what we learn. This helps us to design products and services for different customer segments, and to manage our relationships with them.
• Detecting fraud: We use your personal information to help decide if your personal accounts are potentially used for fraud or money-laundering/ terrorist financing or if you are under international sanctions. We may detect that an account is being used in ways that fraudsters work or in a way that is unusual for you or your business. If we think there is a risk of fraud, we may stop activity on the accounts or refuse access to them.
• Approving credit: We use systems to suggest whether to lend money to you when you apply for credit such as a loan. This is called credit scoring. It uses past data to assess how you’re likely to act while paying back any money you borrow.

We sometimes process personal data for purposes other than those for which the personal data were initially collected where the processing is compatible with the purposes for which the personal data were initially collected. In order to ascertain whether the processing for another purpose is compatible with the purpose for which the personal data were initially collected:

• Any link between the original and proposed new purposes.
• The context in which data have been collected (in particular the relationship between us and your reasonable expectations).
• The nature of the data (particularly whether they are sensitive data or criminal offence data).
• The possible consequences of the proposed processing.
• The existence of safeguards (including encryption).

Where the data subject has given consent or the processing is based on the law we are allowed to further process the personal data irrespective of the compatibility of the purposes.

Where we intend to process the personal data for a purpose other than that for which they were collected, we will provide you, prior to that further processing, with information on that other purpose and other necessary information.

3 - Automatic Collection Cookies & IP Addresses

In some instances, RCB and its service providers uses cookies and other technologies to automatically collect certain types of information when you visit RCB online platforms, as well as through emails exchanged. The collection of this information allows RCB to customize your online experience, improve the performance and security, usability and effectiveness of RCB's online presence, and to measure the effectiveness of marketing activities. We may collect information about your computer or mobile device, including where available operating system and browser type, for system administration or for our own commercial purposes.

Cookies may be placed on your computer or internet-enabled device whenever you visit RCB online. This allows the site to remember your computer or device and serves a number of purposes. Usually, a notification banner will appear requiring your consent to collect cookies. If you do not provide consent, your computer or internet-enabled device will not be tracked to allow for the activities explained above. A secondary type of cookie referred to as "user-input" cookies may still be required for necessary functionality. Such cookies will not be blocked through the use of this notification banner. Your selection will be saved in a cookie and is valid for a short period (e.g. 90 days). If you wish to revoke your selection, you may do so by clearing your browser's cookies.

Although most browsers automatically accept cookies, you can choose whether or not to accept cookies via your browser's settings (often found in your browser's Tools or Preferences menu). You may also delete cookies from your device at any time. However, please be aware that if you do not accept cookies, you may not be able to fully experience some of our web sites' features. Further information about managing cookies can be found in your browser's help file or through sites such as www.allaboutcookies.org. Below is a list of the types of cookies used on our web sites:

Other third party tools and widgets may be used on our individual web pages to provide additional functionality. Use of these tools or widgets may place a cookie on your device to make their service easier to use, and ensure your interaction is displayed on our webpages properly. Cookies by themselves do not tell us your email address or otherwise identify you personally. In our analytical reports, we may obtain other identifiers, but this is for the purpose of identifying the number of unique visitors to our web sites and geographic origin of visitor trends, and not to identify individual visitors. RCB may also collect and use the geographical location of your computer or mobile device. This location data is collected for the purpose of providing you with information regarding services which we believe may be of interest to you based on your geographic location, and to improve our location-based products and services.

BY NAVIGATING ON OUR WEB SITES AND ACCEPTING COOKIES OR ENTERING YOUR LOGIN DETAILS TO ACCESS AREAS RESERVED FOR REGISTERED USERS, YOU AGREE THAT WE CAN PLACE THESE COOKIES ON YOUR COMPUTER OR INTERNET ENABLED DEVICE.

An IP address is a number assigned to your computer whenever you access the internet. It allows computers and servers to recognize and communicate with one another. IP addresses from which visitors appear to originate may be recorded for IT security and system diagnostic purposes. This information may also be used in aggregate form to conduct web site trend and performance analysis.

4 - Your Rights

RCB may ask for your permission for certain uses of your personal information, and you can agree to or decline those uses. If you opt-in for particular services or communications, such as an e-newsletter or sms notifications, you will be able to unsubscribe at any time by following the instructions included in each communication. If you decide to unsubscribe from a service or communication, we will try to remove your information promptly, although we may require additional information before we can process your request.

As described in "Cookies" above, if you wish to prevent cookies from tracking you as you navigate our sites, you can reset your browser to refuse all cookies or to indicate when a cookie is being sent. Note, however, that some portions of our sites may not work properly if you elect to refuse cookies.

In general if you have submitted personal information to RCB, you have the following rights:

- The right to access information about you and to obtain information about how it is processed.
- The right to request that your information is corrected if it is inaccurate or incomplete.
- The right to request that your information is erased (depending on the circumstances and agreements in place). We may continue to retain your information if another legitimate reason for doing so exists. You have the right to have you personal data erased if:

• The personal data is no longer necessary for the purpose which it was originally collected or processed for.
• RCB is relying on consent as the lawful basis for holding the data, and you withdraw your consent.
• RCB is relying on legitimate interests as the basis for processing, you object to the processing of your data, and there is no overriding legitimate interest to continue this processing.
• RCB is processing the personal data for direct marketing purposes and you object to that processing.
• RCB has processed the personal data unlawfully (i.e. in breach of the lawfulness requirement).
• It has to be done to comply with a legal obligation.
• RCB has processed the personal data to offer banking services to a child.

- The right to object to the use of your personal data in certain circumstances. However, RCB may continue to use your personal data, despite your objection, where there are compelling legitimate grounds to do so or we need to use your personal data in connection with any legal claims.
- The right to request that we restrict our processing of your information if the information provided to RCB are not accurate, the processing is unlawful and your request for erasure is opposed or when we no longer need your data for the purpose of processing but they are required by you for the establishment, exercise or defence of legal claims.
- The right to withdraw your consent to our processing of your information (depending on the circumstances and agreements in place). We may continue to process your information if another legitimate reason for doing so exists.
- The right to receive certain information you have provided to us in an electronic format and / or request that it is transmitted to a third party. This applies when:

• The lawful basis for processing this information is consent or for the performance of a contract.
• The processing is carried out by automated means.

- The right to ask us not to process your personal data for marketing purposes. Prior to collecting data, we will usually inform you if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data.
- The right to lodge a complaint with the Data Protection Commissioner if you think that RCB has not processed your personal data in accordance with data protection legislation.

You can exercise your rights by contacting us using the details set out in the “Questions and Enforcement” section. We will make all reasonable and practical efforts to comply with your request, if it is consistent with applicable laws and regulations. In such a case every effort to comply within one month shall be made or to inform you of refusal and the basis of this, or of an extension to the period to comply.

5 - Other Relevant Information

RCB has security policies and procedures in place to protect personal information from unauthorized loss, misuse, alteration, or destruction. Despite RCB's best efforts, however, security cannot be absolutely guaranteed against all threats. To the best of our ability, access to your personal information is limited to those who have a need to know. Those individuals who have access to the data are required to maintain the confidentiality of such information. A series of technology and Cyber Security platforms and solutions are utilized to protect data within the RCB environment including, but not limited to perimeter security mechanisms, end point security mechanisms, encryption, etc.

You are responsible for ensuring that the information provided to RCB on your behalf is accurate and up to date, and you must inform us if anything changes as soon as possible. If you provide information for another person on your account, you must direct them to this notice and ensure they also agree to us using their information as described in it.

RCB is committed to protecting the online privacy of your personal information. If you have questions or comments about our administration of your personal information, please contact us at rcb@rcbcy.com or visit one of our branches. You may also use this contact information to communicate any concerns you may have regarding compliance with our Privacy Notice.

If you are not satisfied with the response you receive, you may escalate your concern to the Data Protection Commissioner by visiting their website at www.dataprotection.gov.cy.

This Privacy Notice may be updated from time to time and the most recent version can be found at www.rcbcy.com.