Notice

PERSONAL DATA PROCESSING NOTICE

Who processes your personal data?

KD Capital Ltd. headquartered in L. Karavelov 2 street,  Plovdiv, Bulgaria, EU VAT number: 205391327 (us) collects and processes your personal information on behalf of Ferratum Bank p.l.c., entered in the Companies Register of Malta under number C 56251, based at the address St. Business Centre, 120 The Strand, Gzira, Malta (further: Ferratum or Bank), phone 0800 7707, e-mail info@ferratumbank.hr.

Ferratum bank p.l.c. is part of Ferratum Group – together with other companies whose majority member of the company is directly or indirectly Ferratum Oyi (number of Finnish Commercial Register 1950969-1, based at the address Ratamestarinkatu 11 A, Helsinki, Republic of Finland).

Ferratum is responsible for processing your Personal Information and as such should be considered a GDPR Data Processing Manager, and we, as the processing executor, process personal data as instructed by Ferratum.

More details about Ferratum’s processing method can be found at https://www.ferratumbank.hr/sites/ferratumbank.hr/files/20180510_HR%20Principles%20of%20processing%20personal%20data%20of%20clients.pdf

Why are personal data processed?

Your personal data are processed for the purpose of concluding and executing the credit/loan/borrowing agreement and if you do not wish to provide all the requested personal data, we will not be able to forward your request to the bank and the bank will not be able to conclude the contract with you.

That processing shall include the orderly identification of the applicant or credit/loan/borrowing applicant and the implementation of loan checks and assessments, verification and risk assessment on the applicant’s side, all for the purpose of deciding whether and under what conditions Ferratum will conclude a credit/loan/borrowing agreement with the applicant.

The legal basis for such processing is the conclusion and execution of a contract with the applicant, as well as the legitimate interests of Ferratum to ensure that the client is reliable and creditworthy and to collect all amounts owed, as well as Ferratum’s legal and regulatory obligations arising from applicable laws, including laws and regulations governing credit institutions/lenders, such as the obligation to report to regulators, anti-money laundering (AML) and terrorist financing rules, and regulations on orderly customer identification (KYC) and ensuring the reliability and creditworthiness of the client. 

What data are processed?

For achieving the purpose, the following personal data shall be collected:

1. identification information (e.g. name, personal identification number, date of birth, place of birth, identification document information and its copy, an identity card with photo in order to verify the identity);
2. contact details (e.g. address, telephone number, e-mail address);
3. bank details (e.g. bank ID, bank name, account holder, account number).

In addition, Ferratum may require you to provide other information for the purpose, such as:

1. Financial data (e.g. salary, income, assets, responsibilities);
2. Information related to the contract with the guarantee provider;
3. Data related to the origin of assets (e.g. data on employer, business partners, business activities and real users, data showing the source of your income and wealth);
4. Creditworthiness/reliability data (e.g. data related to payment behaviour, data on damage caused to Ferratum or other persons, data enabling Ferratum to carry out due diligence measures related to the prevention of money laundering and terrorist financing, and to ensure compliance with international sanctions, including the purpose of the business relationship and an indication of whether the client is a politically exposed person);
5. Data collected in the performance of legal obligations (e.g. information provided as part of enquiries submitted by investigating authorities, notaries, tax authorities, courts and executors);
6. Communication data (e.g. e-mails, recordings of telephone conversations);
7. Information relating to services (e.g. performance of the contract or failure to perform it, history of transactions executed, applications submitted, applications and objections).

Automated decision-making and profiling

The decision to conclude the contract with the client is taken by Ferratum and Ferratum decides on the basis of profiling and/or automated decision-making whether the loan application has been fully or partially adopted or rejected.

The decision shall be taken on the basis of the information provided by the applicant, data obtained from external sources, such as public and private registers and other third parties, as well as data from the client’s earlier behaviour in relation to payments to Ferratum. No specific categories of personal data (e.g. health-related data, genetic data) are processed.

Profiling and/or automated decision-making are necessary for the conclusion of contracts, as well as for fulfilling Ferratum’s legal obligations related to orderly client identification, assessment of the client’s creditworthiness, fraud prevention and money laundering. Automated decision-making helps Ferratum verify the identity of the client and verify that the client is reliable and creditworthy and capable of fulfilling his obligations under the contract. Automated decision-making helps Ferratum make fair and responsible loan decisions. Ferratum will not approve the credit/loan/borrowing and may terminate the contract if it learns that the client is not regular with payment or that the client has provided Ferratum with incorrect information. Automated decision-making also helps reduce the possibility of human error, discrimination and abuse of power, and enables decision-making in shorter periods of time, taking into account the amount of requests received by Ferratum.

However, if you wish to challenge the decision taken, express your own view, and exercise your right to human intervention by the controller, you can contact Ferratum by phone at 0800 7707, or via e-mail info@ferratumbank.hr.

Sharing personal information

As the processor, we forward all personal data we collect on behalf of Ferratum to Ferratum as controller.

Ferratum may share your personal data with the following third parties:

1. a person (physical or legal) who guarantees the fulfilment of the client’s obligations under Ferratum (e.g. guarantor). The legal basis for such sharing is Ferratum’s legitimate interest in ensuring the performance of the contract;
2. clients, for the fulfillment of whose obligations you are the guarantor. The legal basis for such sharing is Ferratum’s legitimate interest in ensuring the performance of the contract;
3. persons who maintain late payment databases. The legal basis of such sharing is Ferratum’s legitimate interest in ensuring the performance of the contract and the legitimate interest of third parties in being able to assess the creditworthiness of the Client;
4. debt collection agencies and bailiffs. The legal basis for such sharing is Ferratum’s legitimate interest in ensuring the performance of the contract;
5. Ferratum’s auditors. The legal basis for such sharing are Ferratum’s legal obligations.
6. Ferratum’s regulators. The legal basis for such sharing are Ferratum’s legal obligations.

For further processing and sharing of data by Ferratum, read the Ferratum Data Processing Principles at https://www.ferratumbank.hr/sites/ferratumbank.hr/files/20180510_HR%20Principles%20of%20processing%20personal%20data%20of%20clients.pdf.

Transfer of Personal Information outside the EEA

Ferratum transfers Personal Data to Ferratum Group entities and other recipients (including providing access to Personal Data) outside the European Economic Area, e.g. USA, Canada, India, Switzerland. This includes enabling access to Personal Data from those Member States. However, Ferratum only acts in this manner if there is a legitimate basis for such action, including the recipient who is: (i) in a country that provides an adequate level of protection for Personal Information; or (ii) subject to an instrument covering EU requests for the transfer of Personal Data outside the EU.

More detailed information regarding the transfer of Personal Information outside the EU can be obtained by contacting Ferratum by phone 0800 7707, or via e-mail info@ferratumbank.hr.

Retention of Personal Information

The executors store the personal data according to the instructions of the manager or Ferratum.

Ferratum retains your Personal Information in accordance with the guidelines of its business as necessary to fulfill the purpose for which it was collected or as necessary to protect its rights or as required by applicable legal acts.

The maximum period that can be applied is the deadline for all claims arising from transactions, which is 10 years from the date of the last transaction or account closure, whichever is the last.

Your rights

To the extent provided by applicable Personal Data Protection Regulations, you have all Respondent’s rights with respect to your personal information. This includes the following rights:

1. right to request access to your Personal Data;
2. right to obtain a copy of your Personal Data;
3. right to correct inaccurate or incomplete Personal data relating to you;
4. right to delete your Personal Data;
5. right to restrict the processing of your Personal Data;
6. right to portability of your Personal Data;
7. the right to object to the processing of your Personal Data, which is based on your overriding legitimate interest and which is processed for direct marketing purposes;

If you believe that your rights have been violated, you have the right to file a complaint:

– to Ferratum’s Customer Service or;

– to Ferratum’s Data Protection Officer or;

– to the Office of the Commissioner for Information and Data Protection, address: Floor 2, Airways House, Triq Il – Kbira, Tas-Sliema SLM 1549, phone: +356 2328 7100, e-mail idpc.info@idpc.org.mt or;

– to courts if you believe your rights have been violated.

To exercise your rights, please contact Ferratum’s services or you can make your request to us as well, and we will forward that request to Ferratum as Processing Manager.

Amendments to the principles

In the event that Ferratum’s personal data-processing practices are altered, or when these principles arise in accordance with applicable regulations, case-law or guidelines issued by the competent authorities, Ferratum is entitled to unilaterally change these principles at any time. In this case, Ferratum will notify you by email not later than one month before the changes take effect.

Contact

If you have any questions regarding the processing of your Personal Information, please contact Ferratum at phone number 0800 7707 or via e-mail info@ferratumbank.hr.

Ferratum has appointed a Personal Data Protection Officer, who can also be contacted regarding the aforementioned at: dpo.hr@ferratumbank.hr.