Tatra Leasing Broker

PERSONAL DATA PROTECTION INFORMATION MEMORANDUM
of the company Tatra Leasing Broker, s.r.o.

The objective of the Personal Data Protection Information Memorandum is to provide information regarding processing of personal data in compliance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

In this Personal Data Protection Information Memorandum you will find information about processing of personal data, information about the rights of data subjects as well as the contact information of the Data Protection Officer supervising personal data protection.

Considering the above we recommend that you familiarize yourself with the information contained in this document. Any changes related to the processing of your personal data will be published as an update of this document which is available on our website.

1. Data controller information

The data controller shall be Tatra Leasing Broker, s.r.o., Corporate ID: 44,426,682, Registered office: Hodžovo námestie 3, Bratislava - town district Staré Mesto, 811 06, (hereinafter as “Tatra Leasing Broker“). Tatra Leasing Broker is an insurance broker.

The security of your personal data is very important to us, therefore, when processing personal data, we rigorously follow all applicable legal regulations, in particular the principles and requirements set forth by the GDPR. We have adopted appropriate technical and organizational measures which help protect the personal data of Data subjects.

Should you have any questions related to the processing of your personal data, please contact our DPO (Data Protection Officer) responsible for supervision of the processing of personal data at our company. To contact the DPO, please write an e-mail to dpo@tatrabanka.sk or write a letter to the following address: DPO, Tatra Leasing Broker, Hodžovo námestie 3, 811 06 Bratislava-Staré Mesto.

2. Basic terms

GDPR	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
Personal data	Any information relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject	A natural person whose personal data are being processed. It is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing	Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data controller	Anyone who alone or together with others determines the purpose and terms of personal data processing, and processes data in its own name; For the purposes of this document Tatra Leasing Broker shall be the Data controller.
Processor	Anyone processing personal data on behalf of the Data controller based on an authorization in compliance with Article 28 of the GDPR.
Income Tax Act	The Act No. 595/2003 Coll. on Income Tax
Financial Brokerage Act	The Act No. 186/2009 Coll. on financial brokerage and financial consulting services
Accounting Act	The Act No. 431/2002 Coll. on accounting.

3. What is personal data and why do we process it?

Personal data is any information relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Tatra Leasing Broker shall only process personal data which is necessary to achieve the specific purpose of its processing. Personal data is always processed for a beforehand specified legitimate purpose which could not be fulfilled by other means.

When processing personal data on a legal basis stipulated by legal regulations, such as when processing personal data for purposes of providing financial and other related services, or for purposes of identification of clients and contractual partners, provision of personal data by you, represents a legal requirement and the service cannot be provided without such personal data. If you fail to provide the required personal data, we will not be able to provide the financial service. When personal data is processed on the basis of the Client’s consent, the provision of personal data by the Client is voluntary. 

Recording of phone calls as part of the INFOLEASING service

Tatra Leasing Broker records phone calls made using the INFOLEASING service. Such personal data is processed by our Information systems - the Client information system and the Marketing information system - for purposes defined for these information systems.

4. Categories of personal data which Tatra Leasing Broker may process:

As part of its activities, Tatra Leasing Broker processes different categories of personal data which differ depending on the purpose of the processing and the nature of the specific processing activity. Such personal data categories include:

In case of the Client information system:

• identification data (e.g. name, surname, date of birth, birth identification number, information from an ID, nationality, photograph from an ID, client number, product number),
• contact information (e.g. the permanent or temporary residence address, e-mail address, phone number),
• information related to the brokered products, 
• socio-demographic data (e.g. age, gender, marital status, education, number of people in the household, type of employment, information pertaining to a political figure),
• economic data (e.g. ownership of movable assets and properties, information about the total income or regular household outlays, and the type of housing),
• information about whether the assigned broker fulfils his/her contractual obligations in a due and timely manner
• voice recordings (e.g. recording of the calls made using the INFOLEASING hotline), 
• copies of documents, including identification documents (including the photographs on those documents),
• information related to the use of our websites and applications (e.g. cookies), 
• other relevant data (e.g. information about execution proceedings, insolvencies or personal bankruptcies, information related to the fulfilment of your personal obligations and commitments, information about your payment discipline, data from credit registers). 
• Abstract from the criminal record 

In case of the Marketing information system:

• information related to the use of websites and applications (e.g. cookies),
• relevant data processed about you in the Client information system.

The above list of categories of personal data represents a full and comprehensive list of all categories of personal data which may be processed for a specific purpose of processing when providing the full range of our financial products and services in all stages of our contractual relationship. The specific categories of personal data kept for a specific client always form a subset of the above.

5. Purpose and legal basis of personal data processing

Tatra Leasing Broker is always processing personal data for a beforehand specified legitimate purpose and there must always exist the respective legal basis for such processing. Tatra Leasing Broker would like to assure you that personal data is not being processed for any purposes considered to be incompatible with the initial purposes. 

Tatra Leasing Broker is processing personal data of Data subjects for the following purposes of processing:

5.1 Provision of financial and thereto related services, identification of clients and identification of contractual partners 

This purpose includes in particular the following activities:

• Assessment of clients and keeping of financial brokerage related records.
• Identification and verification of identity of clients, potential clients and their representatives and documentation of the financial brokerage activities.
• Registration of assigned brokers in the NBS registers.
• Documents and commissions of the assigned brokers.
• Processing of complaints regarding the assigned brokers.
• Prevention of conflict of interest.
• Receiving and processing of client’s suggestions and complaints.
• Relationship management.
• Activities related to the fulfilment of tasks and obligations of Tatra Leasing Broker arising out of the valid legal regulations.
• Keeping of records of Clients or assigned brokers who don’t fulfil their contractual obligations with Tatra Leasing Broker in a due and timely manner.
• Activities related to the fulfilment of archiving obligations. 

In this case, your personal data is processed within the scope necessary to comply with the legal obligations of Tatra Leasing Broker, whereby the legal basis of such processing are in particular the following legal regulations:

• The Income Tax Act
• The Financial Brokerage Act
• The Insurance Industry Act
• The Accounting Act

When the scope of personal data specified by the above legal regulations is not sufficient to achieve the respective purpose of processing, Tatra Leasing Broker may process your personal data also based on the following legal bases:

• if it is necessary to ensure performance of a contract concluded between Tatra Leasing Broker and you, including any pre-contractual relationships pursuant to Article 6 (1) b) of the GDPR,
• if you have consented to our processing of your personal data for a specific purpose or specific purposes pursuant to Article 6 (1) a) of the GDPR,
• if you have consented to our processing of your personal data for a specific purpose or specific purposes pursuant to Article 9 (2) a) of the GDPR,
• if this is necessary for the purposes of the legitimate interests pursued by Tatra Leasing Broker or a third party pursuant to Article 6 (1) f) of the GDPR,
• if the processing is necessary for the establishment, exercise or defence of legal claims pursuant to Article 9 (2) f) of the GDPR).

In performing its business activities, Tatra Leasing Broker is obliged to proceed with due professional care, and, in this regard, it is its legitimate interest to prevent criminal activity and other illegitimate acts, which could inflict damage to it or damage its reputation, and to prevent acts which could negatively impact its activities, endanger its employees or other Data subjects, and for this purpose it is entitled to keep records of potentially risky individuals. This type of data processing may result in the termination of the business relationship or the refusal of a specific business deal.

5.2 Marketing

In order to provide to you information about products, innovations, and services provided by Tatra Leasing Broker, as well as in connection to obtaining different benefits from Tatra Leasing Broker (including the preparation of offers of such benefits) Tatra Leasing Broker is processing your personal data based on its legitimate interests.

It is the legitimate interest of Tatra Leasing Broker to take care of its Clients and develop the business relationships with them, i.e. to notify them of its products, innovations, services, and offered benefits. In this regard, Tatra Leasing Broker may contact you even without your prior consent, whereby you will be able to find the information about such processing of your personal data in the section regarding your rights, in particular the right to object to the processing of your personal data. Naturally, this does not apply if you did not give your consent to be contacted in this manner or if you are going to object against it.

If you have consented to the processing of your personal data by the entities of the Raiffeisen group for purposes of providing information about products, innovations, and services provided by those entities, and in connection to obtaining certain benefits from those entities (including the preparation of offers of such benefits) using profiling, your personal data may be processed by (i) entities with direct or indirect ownership share in Tatra Leasing Broker, (ii) entities in which Tatra Leasing Broker has a direct or indirect ownership share, (iii) entities in which an entity with a direct ownership share in Tatra Leasing Broker has an ownership share, (iv) entities which have a direct or indirect ownership share in entities with an ownership share in Tatra Leasing Broker. For the purposes of this document, those are in particular:

• Tatra-Leasing, s.r.o., with its registered office at Hodžovo námestie 3, 811 06 Bratislava, Corporate ID: 31 326 552, Tatra banka, a. s., with its registered office at Hodžovo námestie 3, 811 06 Bratislava, Corporate ID: 00 686 930, 
• Doplnková dôchodková spoločnosť Tatra banky, a. s., with its registered office at Hodžovo námestie 3, 811 06 Bratislava, Corporate ID: 36 291 111,
• Tatra Asset Management, správ. spol. a. s., with its registered office at Hodžovo námestie 3, 811 06 Bratislava, corporate ID: 35 742 968.

Tatra Leasing Broker may communicate with your for the purposes specified above using an automated call placement system, by phone, e-mail, SMS or using other means of remote communication. 

Aiming to tailor the offered products and services to your needs, Tatra Leasing Broker evaluates the information processed about you so it can provide you with a personalized offer, thus limiting the number of general marketing offers.

6. Who do we provide your personal data to?

Tatra Leasing Broker does not provide your personal data to any other parties except where you have given your consent (oral or written) to Tatra Leasing Broker to do so, or if there’s a different legal basis to provide your personal data to a third party, e.g. to meet the legal obligation of Tatra Leasing Broker, as a Data controller.

Tatra Leasing Broker may provide your personal data to third parties in fulfilling its legal obligations only in cases stipulated by the respective legal regulations as part of the general obligation to provide cooperation

Tatra Leasing Broker may also provide your personal data to third parties without your consent when fulfilling its statutory obligations: 

• in connection with notifying law enforcement authorities of suspected or prepared crimes, crimes being committed or crimes that have been committed,
• in connection with assessing the ability of an individual to pay a consumer loan pursuant to the Act No. 129/2010 Coll. on consumer credits and other credits and loans for consumers,
• in connection with fulfilling the notification obligation towards the National Security Authority in the field of cybersecurity pursuant to the Act No. 69/2018 Coll. on Cybersecurity.

We would also like to notify you that Tatra Leasing Broker as well as the other entities belonging to the Raiffeisen group pursue a legitimate interest of sharing the personal data processed in the Client information system, and that as part of this activity cross-border transfers of data may take place:

• as part of prevention against money laundering and against terrorist financing, 
• as part of performance of obligations related to banking activities within the Raiffeisen group, 
• in connection with assessing the creditworthiness and trustworthiness of clients.

Tatra Leasing Broker does not disclose your personal data.

6.1 Data processors

In certain cases, Tatra Leasing Broker may use Data processors to process your personal data. A Data processor is an entity authorized by Tatra Leasing Broker to process personal data in compliance with Article 28 of the GDPR. No other consent or legal basis is required to authorize a Data processor to process your data besides the consent or legal basis used when providing data to other Controllers, In this case the Data processor processes your personal data on behalf of Tatra Leasing Broker, as the Controller.
 
The processing of personal data by the Data processor has no negative impact on the enforcement and exercise of your rights as a Data subject, stipulated in Chapter III of the GDPR, whereby the Client may exercise the respective right with Tatra Leasing Broker, as the Controller, or directly with the specific Data processor processing your data. 

Tatra Leasing Broker would like to assure you that it only uses Data processors providing sufficient technical, organizational and other measures ensuring that the processing complies with the requirements of the GDPR and that full protection of the Data subject’s rights is ensured. 

In processing your personal data Tatra Leasing Broker may use the following categories of Data processors:

• companies offering or providing financial and thereto related services,
• companies performing client satisfaction surveys,
• companies performing marketing activities,
• companies providing printing services and mass correspondence services,
• companies managing registry entries pursuant to special legislation,
• companies involved in recovery and management of receivables,
• companies implementing security systems,
• companies involved in exercise of the right of lien by means of a voluntary auction.

6.2 Transfer of personal data to third countries

Personal data is not subject to cross-border transfer to third countries which don’t guarantee an adequate level of personal data protection, save for the cases specified in the valid legal regulations, and special situations when the Client must be notified of such transfer in advance.

6.3 Processing of personal data using cloud solutions

When processing personal data, cloud solutions or solutions of similar technical nature are used in many cases. In many cases, the use of such solutions is required as part of implementation of state-of-the-art software tools, or improves the efficiency and cost-effectiveness. And last, but not least, such solutions also help maintain integrity of the processed data and improve the security of processing.

Depending on the type of processing activities, in such processing the providers of cloud or similar services act mainly as Data processors in accordance with Article 28 of the GDPR. In selecting its partners and in the course of the processing activities Tatra Leasing Broker is very careful to avoid any risk of data security breach or any negative impact on the rights of Data subjects. Tatra Leasing Broker is especially careful to only select partners who have demonstrably implemented appropriate technical and organizational measures to ensure the level of security pursuant to Article 28 (3) c) and Article 32 of the GDPR so that the processing is performed in compliance with the valid legal regulations, in particular the GDPR, and to ensure protection of the rights of Data subjects.

In such processing the personal data is not transferred to any third countries which don’t guarantee an adequate level of protection in compliance with the GDPR.

7. How long do we retain your Personal Data?

Tatra Leasing Broker only retains your data in a form allowing your identification for the period necessary to achieve the purpose of its processing.
If your personal data is being processed on the basis of your consent, following the withdrawal or expiry of your consent, Tatra Leasing Broker will only retain your data for the period necessary for the establishment, exercise or defence of legal claims of Tatra Leasing Broker. The same applies when data is being processed on the basis on a contract. 
If your personal data is being processed on the basis of fulfilling a statutory obligation of Tatra Leasing Broker, the time period during which Tatra Leasing Broker is obliged to retain your personal data and any related documentation is stipulated in more detail in the respective legal regulations. Such legal regulations are in particular:

• The Accounting Act based on which Tatra Leasing Broker is obliged to retain and protect such data for a period of ten years following the year to which such accounting documents pertain.
• The Financial Brokerage Act which in Section 36 stipulates a documentation retention period of at least ten years from the commencement of validity of a Financial Service Contract and a retention period of at least five years following the termination of a Financial Consulting Contract.
   

8. How do we protect your personal data?

We implement appropriate technical and organizational measures with the objective to protect your personal data from intentional or negligent erasure, loss or modification and from unauthorized disclosure. Employees of Tatra Leasing Broker and the contractual partners of Tatra Leasing Broker processing personal data on its behalf are bound by a confidentiality obligation which shall survive the termination of the contractual relationship.  

9. What are your rights with regard to the processing of personal data?

In connection to the processing of personal data you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic with its registered office at Hraničná 12, 820 07 Bratislava, Slovak Republic.
 
You have the right to rectification of incorrect and completion of incomplete personal data that relate to you. Should you discover that the data we process about you is incorrect or incomplete, please, don’t hesitate to contact us. 
 
If your data is processed on the basis of a consent pursuant to Article 6 (1) of the GDPR, or pursuant to Article 9 (2) of the GDPR, you have the right to withdraw your consent at any time. Withdrawal of your consent does not affect the lawfulness of the processing that was based on your consent prior to withdrawal. 

The right to object against the processing of personal data

As a Data subject you have the right to object against the processing of your personal data when the processing takes place on the basis of the legitimate interests of Tatra Leasing Broker, and you can also object against profiling based on such legitimate interest. The Tatra Leasing Broker may continue to process your personal data on the basis of its legitimate interest if it can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or grounds for the establishment, exercise or defence of legal claims. 

You shall have the right to object, at any time, against the processing of your personal data for marketing purposes, including for profiling purposes, to the extent that it is related to direct marketing, provided that such processing takes place on the legal basis of the legitimate interests of Tatra Leasing Broker. If you object to processing for direct marketing purposes, Tatra Leasing Broker will not continue to process your personal data for direct marketing purposes. 

As a Data subject you have the right of access to your personal data. When the terms stipulated in the GDPR have been met, you can request from us the list of your processed personal data. Under certain circumstances, you can also request restriction of processing, transfer of your personal data, or erasure of your personal data. 

You may exercise your rights in writing, by phone using the INFOLEASING service, via e-mail to info@tatraleasing.sk or in person at one of our branches. Tatra Leasing Broker may ask you to provide additional information required to verify your identity.

In Bratislava, dated: 26 January 2023 

Information on personal data processing