If there is more than one reason for the processing of your personal data, we always do so only to the extent required for a given purpose. The main aim of this processing is to enable us to provide you our services and customer care associated with delivery of our products and services that you actively use or consider to use.
We set out the main categories of our purposes below.
Providing products and services
As part of discussing a product or service, we will process the data you provide through these channels to facilitate your interest in the product or service, and we will contact you as part of discussing the product or service.
If you decide that the product or service you discussed with us is suitable for you, we are obliged to ascertain your personal identification data and collect and retain any other data needed to draw up the relevant contract for the product or service. For credit and investment products, we will require a larger set of data from you, and shall be the subject of further processing.
So that we can ensure the quality of the products and services you use, we are obliged to retain, update and process the relevant data. Based on our legitimate interest we are also obliged to provide you with this information through the channels you have selected for these products and services, i.e. at our point of sale and through our direct banking channels. If you also decide to use direct banking channels for servicing these products and services, we collect information on your IP address, etc. We record and evaluate this data so that we can minimise any risks related to the misuse of these direct channels.
If necessary, we will inform you – via SMS, e-mail, messages in our direct channels or another standard way – of any events concerning your products and services together with change of your banking advisor, etc.
In this case, the legal basis for processing your personal data is the fulfillment of controller’s legitimate interests. To safeguard our legal claims, we will continue to retain this personal data after the product or service has ended – for more details see How long do we retain your data?
Safeguarding our legal claims
We also process your personal data, including your communications history and information about products and services, to the extent required for any legal claims or potential legal claims against you, especially on the basis of your contractual relationship with us. We also use third parties for debt recovery.
The legal basis for presented processing is the protection of our legitimate interests.
Preventing, checking, detecting and investigating fraud, and preventing money laundering
We also use your personal data to check for and prevent any potentially unethical or fraudulent conduct. We are bound by the legislation that stipulate the obligation to act with due professional care in matters concerning the prevention, detection and investigation of such conduct. To this end we also collect your personal data and data on the products and services you use. We can then create indicators based on this data that help prevent potential fraud and allow for better protection of your money. This may involve for instance information on the theft of your ID card or credit card, or data on the country where you normally use your direct banking channels.
The legal basis for such processing is compliance with our legal obligation as the controller.
Tax and accounting requirements
We also collect and process your personal data to comply with our legal obligations as the controller with regard to the state and the regulatory authorities. We are obliged to do so by the Accounting Act, the VAT Act and many other regulations, including the laws derived from the agreement on implementation of the US Foreign Account Tax Compliance Act (FATCA). We also transfer all of this mandatory information within KB’s Financial Group.
We process and transfer this data to comply with our legal obligation as the controller, and in our legitimate interest.
Protecting against market abuse
The legislation also obliges us to check compliance with the Capital Market Undertakings Act and prevent its abuse, which could harm our other clients or our KB Group. We process your personal data for this reason too.
The legal basis for above mentioned processing is the compliance with our legal obligations as the controller and our legitimate interest.
Prevention and control for investment products
In compliance with the regulatory requirements, we also collect and retain records of all communications with you concerning investment products (e.g. recordings of telephone calls, minutes from meetings, e-mail communication, Skype calls and messages, etc.). In line with the regulatory requirements for reporting your transactions, we collect data on your instructions and your transactions with investment instruments.
The legal basis for such processing is compliance with our legal obligation as the controller.
The company’s internal needs and reporting
Our employees may process your personal data for the company’s internal needs, e.g. for reporting on the efficiency of our services.
The legal basis for such processing is our legitimate interest.
Assessing credit risk
To minimise risk, the bank keeps records of persons who have provided false information, experienced difficulties paying their debts, etc.
The legal basis for such processing is compliance with our legal obligation as the controller, and also our legitimate interest.
Regulatory reporting
Your personal data and information on selected products and services are being used for regulatory reporting. Based upon this data we conduct our internal reporting, and at the same time we are obliged to transfer information on certain products and services to the regulator.
The basis for such processing is compliance with our legal obligation as the controller.
Debt recovery and factoring
If you have problems repaying any loans we have provided, our primary objective is to resolve these problems with you efficiently and to our mutual satisfaction. Sometimes, it might not be possible to resolve aforementioned problems amicably. In these situations we have to use the personal data we have recorded on you, and in some cases we may also use data, especially contact data, from publicly accessible sources such as social networks, etc., so that we can contact you. Under certain circumstances (you fail to respond, you are unreachable, you have no interest in resolving the situation, etc.) we may have to transfer your debts to a company that specialises in debt recovery. In such cases we will provide the relevant personal data to the company, together with any other relevant data concerning the debt in question. We also transfer this data if we decide to assign the debt.
The basis for processing and transferring the relevant data is our legitimate interest.
Marketing as a legitimate interest
As part of marketing as a legitimate interest, we carry out basic analyses of your data concerning your use of our products and services. At the same time this legitimate interest allows us to segment our clients in order to choose the most important form of servicing and offer suitable products and services, and it also allows us to find out clients’ opinions. You may object to marketing as a legitimate interest.
