INFORMATION ON THE PROCESSING OF PERSONAL DATA OF THE BANK EUROBANK DIREKTNA A.D. PURSUANT TO THE LAW ON PERSONAL DATA PROTECTION (“OFFICIAL GAZETTE OF RS” NO.87/2018)

1. Your identification, verification of your data and the communication with you during the pre-contractual and contractual stage, as well as during any other transaction between you and the Bank.
2. The evaluation of your requests, the formation of a contract with you, its execution and smooth operation, the fulfillment of each counterparty’s obligations and the defense of interests and exercise of the Bank’s rights.
3. The service, support execution and monitoring of your transactions including the ones via electronic banking (e.g. e-banking, mobile banking).
4. In case of granting any loan or credit for:
   • the assessment of the credit risk the Bank will be or has already been exposed to;
   • the prevention or mitigation of the possibility of a failure by your part to fulfill your obligations arising from the contract you will enter into with the Bank;
   • the pursuing of the collection of any possible debts to the Bank due to the performance of your contract you will sign.
5. The communication with you, your information on the best use of the Bank’s products and/or services (i.e. new features or functionalities of these products or new opportunities to use products/services to your benefit, etc).

1. The Bank’s compliance with obligations imposed by the legal and other relevant framework in force, as well as with authorities’ decisions (supervisory, independent, prosecution etc).
2. The prevention and repression of money laundering and terrorism financing, as well as the prevention, detection and repression of frauds against the Bank or its clients, as well as of any other illegal act.
3. The protection of the Bank’s clients, personnel and visitors and their property as well as the Bank’s facilities and property in general.
4. The Bank’s compliance with obligations imposed by legislation or international agreements regarding the exchange or provision of financial information (e.g. FATCA).
5. Activities with the aim of implementation of status change of the Bank.

• For purposes of promotion activities, the Bank may carry out profiling by using combined data, mentioned above under 1 (indicatively your commercial behavior analysis, response level to the Bank’s promotion activities, answers to surveys etc). Said processing within the framework of your information and/or participation to promotion activities for new products/services, other the ones you have already received from the Bank, its cooperating companies is based on your consent.
• For the risk assessment of money laundering and terrorism financing the Bank compiles your profile using internationally acknowledged models for the combined evaluation of data. Said processing is carried out for the Bank’s compliance with its legal obligations.

• this is deemed necessary for the signing and execution of your contract with the Bank,
• his is allowed from national law,
• you have provided us with your explicit consent for said processing, especially in cases where automated decision-making cannot be based on any of the above-mentioned legal bases.

• The Bank`s employees and persons engaged by the Bank.
• Call centers.
• Companies conducting customer satisfaction surveys or market surveys in general.
• Companies for the promotion of products and/or services - advertising companies.
• Companies responsible for storage, management and destruction of files, records and data.
• Natural or legal persons processing data in order to update them (including the update of your contact data in case you have omitted to notify the Bank of said amendment).
• Lawyers, law firms, notaries, auditors, consulting providers (such as financial consultants etc.) within the framework of their duties, public executors.
• Services providers (including cloud services providers), and/or information and electronic systems and network support providers of any kind, including but not limited to online systems and platforms. Electronic communication and information society services providers (telecommunication providers, e-mail, web hosting, messaging applications).
• Security companies.
• Insurance companies.
• Public company Pošta Srbije.
• Commercial agents, products and services suppliers, intermediaries acting on your or our behalf, your legal consultants or representatives.
• redit bureau of the Association of Serbian Banks, Fraud prevention Forum of the Chamber of Commerce and Industry of Serbia, credit and/or financial institutions, electronic money institutions, service payment providers or providers that are involved for the execution of contracts with you or transactions that you asked for or activated such as SWIFT, VISA, MASRTERCARD, etc.
• Authorities, entities or parties that are responsible for the supervision/monitoring of the Bank’s activities within their competence (National Bank of Serbia, external auditors, Administration for the Prevention of Money Laundering etc).
• Lawyers and, if permitted by valid legislation, debt collection agencies – in case of debt collection or initiation of proceedings. In case of assignment of claims that the Bank has against you, your data will be delivered to the acquirers of claims, provided that the prescribed protection of your data is ensured.
• Companies responsible for the issuance of digital certificates and digital signatures.
• Any third parties that submit a request for information to the Bank, when the legal conditions have been met.
• The Bank receiver in the process of implementation of status change of the Data Controller, in accordance with legal and contractual obligations.
• Other companies with which the Bank has established business cooperation and signed a Data Protection Agreement.

• f the third country, territory or one or more specified sectors within that third country or an international organization ensures an adequate level of protection; or
• if appropriate safeguards for data processing have been provided, pursuant to the law.
• In the absence of the abovementioned circumstances a transfer may take place in following cases:

1. You have explicitly consented to the transfer;
2. The transfer is necessary for the execution of a contract between you and the Bank, such as for the execution of orders (i.e. transfer to a bank account of a third country) or for the implementation of pre-contractual measures pursuant to your request or for the signing or execution of a contract that was made for your benefit;
3. The transfer is necessary for the establishment, exercise or defense of legal claims; or
4. The transfer is necessary for important reasons of public interest.

• In case you enter a contract with the Bank, your personal data will be stored for as long as the contract stands.
• n case data processing is imposed by law, personal data will be stored for the period provided by the relevant legal or regulatory provisions and in any case for the time necessary for the exercise of claims or defense of rights and legitimate interests (e.g. at least 10 years from the date of the end of business relationship, performed transaction, or access to the safe deposit box, in accordance with the Law on the Prevention of Money Laundering and the Financing of Terrorism).
• Data and documentation may be stored for longer than certain periods, for the purposes of conducting judicial, extrajudicial, administrative and other proceedings before state authorities, arbitrations and third parties, regardless of whether the proceedings were initiated by you, the Bank or third parties, and to protect the legitimate interest of the Bank or third parties.

• To demand to know the purposes for which we process your personal data, the categories of the data that we store and process, where they come from, the categories of their recipients (especially the recipients in third countries or international organizations), the period of storage as well as your relevant rights (right of access).
• To demand the rectification or/and amendment to your data completed so that they are complete and accurate (right to rectification) by providing any necessary document justifying the need for rectification.
• To ask for a restriction of the processing of your personal data (right to restriction of processing).
• To object to any further processing of your stored personal data (right to object).
• To obtain the erasure of your personal data from the records we keep (right to erasure).
• To ask for the transfer of your data kept by the Bank to any other controller (right to data portability).
• n case of solely automated individual decision making, including profiling which produces legal effects concerning you or significantly affecting you in a similar way, the Bank implements suitable measures and safeguards for the protection of your rights, freedom and legitimate interests and offers you meaningful intervention carried out by humans, the right to express your opinion and ask for a justification οf the decision based within this framework as well as the right to contest such a decision. These rights can be exercised within a limit of 30 days from the day such decision was made known.
• To withdraw your consent at any time. The legality of the processing based on your consent before its withdrawal remains unaffected.
• Right to complain to the Commissioner: In case you consider that your rights are in any way violated, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection. The address of the Commissioner is: Bulevar Kralja Aleksandra 15, 11000 Beograd, tel: +381 11 3408 900.

7. How can you exercise your rights?For the exercise of your rights you may contact in writing the Clients Relations Department, Vuka Karadžića Street 10, Beograd or send an email to office@eurobank-direktna.rs. The Bank shall use its best endeavors to address your request within 30 days of its receipt. The abovementioned period may be prolonged for 60 more days, if deemed necessary, at the Bank’s absolute discretion taking into consideration the complexity and the number of the requests. The Bank shall inform you within 30 days of the request’s receipt in any case of prolongation of the abovementioned period. The abovementioned service is provided by the Bank free of charge. However, in case the requests manifestly lack foundation and/or are excessive and repeated, the Bank may, after informing the client, impose a reasonable fee or refuse to address your requests.

8. Data Protection OfficerYou may contact the Data Protection Officer for any matter regarding the processing of your personal data at the address Ulica Vuka Karadžića 10, Beograd or by sending an email to dpo@eurobank-direktna.rs.

9. How does the Bank protect your personal data?In accordance with the nature, extent, circumstances and purpose of the processing, as well as the probability of occurrence of risks and the level of risk to the rights and freedoms of individuals, the Bank implements protection measures in order to achieve an appropriate level of security in relation to the risks. We implement appropriate organizational, technical and staff-related measures to ensure the security and confidentiality of your personal data, and their protection from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access and any other form of unlawful processing.Access to personal data in the Bank is protected by a series of measures that include physical protection and technical protection systems. Banking applications and databases are protected by adequate protection systems to guarantee confidentiality, integrity and availability. Access to data is allowed only to authorized users.Access to data is allowed only to authorized users, processes or programs, with authentication and authorization. Each employee who accesses banking applications has his own username and password. In case of data transfer abroad or in case the Bank engages sub-processors, the protection measures prescribed by law are applied in order to achieve an adequate level of data protection.

10. Amendments of this InformationThe Bank may amend the present Information. In such case the Bank will notify you accordingly via posting on its website.