There are many reasons why we process your personal data, but we always do so only to the extent required for a given purpose. Most often we process your personal data so that we can provide you with the products and services you use or want to use. We also process your data so that we can satisfy our contractual obligations and the legal and regulatory requirements, and to pursue our legitimate interests.
In other cases we are only authorised to process your data with your explicit consent, unless there is an exemption in the legislation.
We set out the main categories of our purposes below.
Providing products and services
- Discussing a product or service
As part of discussing a product or service, you may model a suitable product on our website or at a branch. You may obtain information on the product or service from the internet, our branch network or our client centre. We will process the data you provide through these channels to facilitate your interest in the product or service, and we will contact you as part of discussing the product or service. We will retain the data you provide through these channels for a period of three months at most, and the legal basis here is the concluding of a contract.
- Concluding a contract on a product or service
If you decide that the product or service you discussed with us is suitable for you, we are obliged to identify you in detail and collect and retain any other data needed to draw up the relevant contract for the product or service. For credit and investment products, we will require a larger set of data from you, and we will carry out additional processing of your data, which you can read about in more detail in Assessing credit risk.
- Servicing a product or service
So that we can ensure the quality of the products and services you use, we are obliged to retain, update and process the relevant data. As part of the performance of the contract, we are also obliged to provide you with this information through the channels you have selected for these products and services, i.e. at our branches, through our direct banking channels, or at our client centre. If you also decide to use direct banking channels for servicing these products and services, we collect information on your location, IP address, etc. We record and evaluate this data so that we can minimise any risks related to the misuse of these direct channels.
If necessary, we will inform you – via SMS, e-mail, messages in our direct channels or another standard way – of any events concerning your products and services, and e.g. of any changes to our opening hours, any change of your branch or banking advisor, etc.
In this case, the legal basis for processing your data is the concluding and performance of a contract. To defend our legal claims, we will continue to retain this data after the product or service has ended – for more details see How long do we retain your data?
Defending our legal claims
We also process your personal data, including your communications history and information about products and services, to the extent required for any legal claims or potential legal claims against you, especially on the basis of your contractual relationship with us. We also use third parties for debt recovery. For this purpose we will retain your data for a period of 18 years following the termination of the contractual relationship.
The legal basis here is the protection of our legitimate interests.
Preventing, checking, detecting and investigating fraud, and preventing money laundering
We also use your personal data to check for and prevent any potentially unethical or fraudulent conduct. The legislation obliges us to exercise professional care in matters concerning the prevention, detection and investigation of such conduct. To this end we also collect your personal data and data on the products and services you use. We can then create indicators based on this data that help prevent potential fraud and provide better protection for your money. This may involve for instance information on the theft of your ID card or credit card, or data on the country where you normally use your direct banking channels.
The legal basis for such processing is compliance with our legal obligation as the controller.
Tax and accounting requirements
We also collect and process your personal data to comply with our legal obligations as the controller with regard to the state and the regulatory authorities. We are obliged to do so by the Accounting Act, the VAT Act and many other regulations, including the US Foreign Account Tax Compliance Act (FATCA), as part of compulsory reporting to the state and the regulatory authorities. We also transfer all of this mandatory information within KB Group.
We process and transfer this data to comply with our legal obligation as the controller, and in our legitimate interest.
Protecting against market abuse
The legislation also obliges us to check compliance with the Capital Market Undertakings Act and prevent its abuse, which could harm our other clients or our group. We process your personal data for this reason too.
We process and transfer this data to comply with our legal obligation as the controller, and in our legitimate interest.
Security
We use camera systems installed on our premises, in front of their entrances and at our ATMs to protect our property, i.e. our buildings and equipment, to protect individuals against unlawful conduct, and to prevent and investigate such conduct. We retain the recordings from these camera systems for the period strictly necessary, and when warranted, especially when there are security breaches, we subsequently process these recordings and transfer them to the appropriate public authorities, such as the law enforcement authorities.
The retention, processing and transfer of this data is essential for us to pursue our legitimate interests.
Prevention and control for investment and insurance products
Before making an investment, the legislation and the regulatory requirements oblige us to assess your knowledge and experience of investing in investment instruments, as well as your attitude to risk and your financial resources. We obtain information for these assessments from an Investment Questionnaire, which we retain (see How long do we retain your data?). In compliance with the regulatory requirements, we also collect and retain records of all communications with you concerning investment or insurance products (e.g. recordings of telephone calls, minutes from meetings, e-mails, Skype calls and messages, etc.). In line with the regulatory requirements for reporting your transactions, we collect data on your instructions and your transactions with investment instruments.
The legal basis for such processing is compliance with our legal obligation as the controller.
The company’s internal needs and reporting
Our employees process your personal data for the company’s internal needs, e.g. for reporting on the efficiency of our servicing and selling.
The legal basis for such processing is our legitimate interest.
Assessing credit risk
We use profiling to correctly assess risks when providing credit products. We use your personal data to create a unique profile so that we can determine whether you will be able to repay a loan. When you ask for a loan, we will for instance evaluate the credit risk using credit registers and our internal resources. We can also use automated processing to perform this evaluation.
To minimise risk, the bank keeps records of persons who have provided false information, experienced difficulties paying their debts, etc.
The legal basis for such processing is compliance with our legal obligation as the controller, and also our legitimate interest.
Regulatory reporting
We also use your personal data and information on selected products and services for regulatory reporting. We use this data to produce reports for our internal use, and we are obliged to transfer information on certain products and services to the regulator.
The basis for such processing is compliance with our legal obligation as the controller.
Debt recovery and factoring
Occasionally you may have problems repaying any loans we have provided. Our primary objective here is to resolve these problems with you efficiently and to our mutual satisfaction, but sometimes we may be unable to find common ground. In these situations we have to use the personal data we have recorded on you, and in some cases we may also use data, especially contact data, from publicly accessible sources such as social networks, etc., so that we can contact you for instance. Under certain circumstances (you fail to respond, you are unreachable, you have no interest in resolving the situation, etc.) we may have to transfer your debts to a company that specialises in debt recovery. In such cases we will transfer the relevant personal data to the company, together with any other relevant data on the debt in question. We also transfer this data if we decide to assign the debt.
The basis for processing and transferring the relevant data is our legitimate interest.
Marketing
We distinguish three basic types of marketing purposes: marketing as Komerční banka’s legitimate interest, direct marketing as a legitimate interest, and marketing on the basis of your consent.
- Marketing as a legitimate interest
As part of marketing as a legitimate interest, we carry out basic analyses of your data concerning your use of our products and services. At the same time this legitimate interest allows us to segment our clients in order to choose the most important form of servicing and offer suitable products and services, and it also allows us to find out clients’ opinions. You may object to marketing as a legitimate interest.
- Direct marketing as a legitimate interest
As part of direct marketing as a legitimate interest, we may offer you KB products and services through our branch network and direct channels, or via e-mail, SMS and social networks. You may object to direct marketing as a legitimate interest. If you object to such processing, we will automatically comply with your wishes.
Purposes for which we need your explicit consent to process your personal data are offering products and services (including via electronic channels) provided by KB Group and third parties who work with us, marketing processing, and analyses and profiling aimed at tailoring our offers to meet your needs and improving the services we provide. As we do not wish to annoy you with unnecessary and inappropriate communications, we use the personal data we collect to get a better idea of your needs so that we can offer you suitable solutions. We may offer you credit products or payment instruments, or congratulate you on your birthday.
We can use a wide range of channels to communicate with you: letters, telephone calls, e-mails, SMS, messages at ATMs, and messages (or pop-ups) in internet and mobile banking.
Information on the use of our products and services helps us to monitor and constantly improve their quality and retain your loyalty. We also process personal data to support our business decisions and identify business potential.
Before this information can be used it must be processed, which in particular involves data processing for marketing purposes. This refers to statistical and mathematical analyses aimed at gaining an insight into a client’s behaviour and anticipating the client’s future behaviour and business potential, as well as client profiling, various kinds of segmentation, reporting, etc. Processing can be manual or automated.
We process this data on the basis of your explicit consent. You can find detailed information on Group Marketing Consent in Marketing Consent.