Privacy Policy
At Yapi Kredi Bank Nederland N.V., (YKNV) we understand that your personal data is important to you. That's why, YKNV is committed to upholding the highest standards of personal data protection to protect the fundamental privacy rights of YKNV's clients, employees, and any people with whom YKNV has contact. This privacy policy explains how YKNV handles your personal data. The following aspects will be addressed:
1. For whom is this privacy policy intended?
This privacy policy applies to our customers or potential customers who are interested in our product, e.g. by making an enquiry or visiting our website. In such cases, we use the personal data of those customers or potential customers. In addition, this may concern persons who are not YKNV customers. Think of persons who transfer money to a YKNV account or persons to whom money is transferred to from a YKNV account. We also record personal data of contact persons of companies to whom we provide services, such as shareholders of these companies, the ultimate beneficial owners (UBOs) of these companies, representatives, or persons acting as guarantors for our clients.
2. What is personal data?
Personal data is any data that can be linked to a natural person or used to identify a natural person. Examples of this include your name, address, e-mail address, age, date of birth, nationality, and signature as well as your marital status or whether you have children, to name a few. Your bank account, telephone number, IP address and your Citizen Service Number (BSN number) are also personal data. In addition, we may record conversations with employees in the office due to legal obligations. This data can tell us something about you as a person or about your behaviour.
3. Who is responsible for processing personal data?
The responsibility for compliance with data protection standards lies primarily with the YKNV Executive Board. The Executive Board, as part of its responsibility, has appointed a Data Protection Officer who manages an effective personal data protection programme. The contact details of the Data Protection Officer are:
Yapi Kredi Bank Nederland N.V.
Data Protection Officer
Postbus 94042
1090 GA, Amsterdam
The Netherlands
dataprotectionofficer@yapikredi.nl
4. What are the purposes and legal bases of the processing?
YKNV cannot arbitrarily request or use your data. YKNV processes personal data in accordance with the provisions of the General Data Protection Regulation (GDPR). The GDPR states that this is only allowed if there is a 'basis for the processing'. We may use your personal data for one or more of the following reasons:
a) For the performance of an agreement
We may use your personal data for the conclusion and performance of an agreement, e.g. to open an account with us, to assess and accept clients or prospective clients, and to complete payments for clients.
b) Legal obligation
As a bank, we have to comply with various obligations set out by laws. These laws state that we must record your personal data and sometimes provide it to others. For example, the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft, Wet ter voorkoming van witwassen en financiering van terrorisme) requires us to take measures to prevent fraud, tax evasion, financing of terrorism, and money laundering. Furthermore, the Dutch Financial Supervision Act (WFT, Wet op het financieel toezicht) requires us to ensure the safety and integrity of YKNV and the financial sector, including the prevention, investigation, and combating of criminal conduct.
Other organizations may sometimes request data from banks. Think of the Tax Authorities, judicial authorities (financial fraud) and the Intelligence Services (terrorism). Furthermore, banks sometimes have to share personal data with supervisory authorities, such as the Netherlands Authority for the Financial Markets (AFM), De Nederlandsche Bank (DNB), and the Dutch Data Protection Authority (Dutch DPA). If the law or regulator indicates that we must record or provide data, we are obliged to do so.
c) Legitimate interest of the bank or of others
We may use your personal data if we have a legitimate interest in doing so. We must then be able to demonstrate that our interest in using your personal data outweighs your right to privacy. This includes the prevention of fraud, swindling, or other unlawful behaviour. We also sometimes have to fulfil duties of care to employees and/or clients or protect property belonging to us, you, or other clients. In order to provide you good service as our customer, we also process personal data for targeted marketing activities. We may inform you about our products and services by telephone or e-mail.
d) Explicit consent
We may process certain special categories of personal data when you have given us your explicit consent to do so. Specifically, we process biometric facial data when you choose the secure the access to your account using facial recognition. The use of facial recognition is optional – you may always withdraw your consent or refuse to use facial recognition. In those cases, you will secure your account with a password.
5. Who will process my personal data?
Any YKNV employee who needs your personal data in order to perform his or her duties can access your personal data. In addition, service providers appointed by YKNV may also have access to your personal data for the agreed purposes. Examples of such service providers are companies in the following categories: financial services, IT services, legal services, and sales and marketing services. Your personal data will not be passed on to third parties unless this is considered necessary, e.g. for the processing of transactions or if it is required by a legal provision. Your personal data may also be processed by:
a) Other financial institutions in order to maintain a relationship with you, for example: correspondent banks, custodian banks, and brokers.
b) Government bodies on official grounds, for example: financial supervisors, the Dutch Financial Intelligence Unit, and the Dutch Public Prosecutor's Office.
YKNV is committed to the secure processing of personal data. In order to prevent unauthorized access or disclosure, YKNV has implemented adequate technical and organizational measures to protect and secure your personal data. All YKNV employees and any third parties employed by YKNV are obliged (contractually or otherwise) to respect the confidentiality of your data.
6. Will my personal data be transferred to third countries or international organizations?
In principle, YKNV only cooperates with contracted partners who process personal data on our behalf within the European Economic Area (EU countries, Norway, Iceland and Liechtenstein). The same level of privacy protection applies within these countries. YKNV may sometimes transfer personal data to countries outside the European Economic Area (EEA). This usually follows from orders to be executed, such as payment and investment orders. Even then, we guarantee an appropriate level of privacy protection. For example, we conclude contracts on the basis of EU Model Contracts.
7. How were the retention periods determined?
Your personal data will not be kept longer than necessary for the fulfilment of our contractual, legal, and regulatory obligations. This means that your data will be deleted as soon as it is no longer needed to fulfil the aforementioned obligations. The main obligations regarding data retention are laid down in the Decision on prudential rules concerning financial companies (Besluit prudentiële regels financiële ondernemingen) and the Money Laundering and Terrorist Financing (Prevention) Act (Wwft, Wet ter voorkoming van witwassen en financiering van terrorisme).
8. Which privacy rights can I exercise?
If your data is processed, you have privacy rights. If you exercise your right, we will endeavour to respond to your request as quickly as possible. This may take up to a month. If we need more time, we will let you know as soon as possible and inform you of the reason for the delay. You have the following rights:
Right to access
You have the right to ask us for an overview of the personal data relating to you that we have and process. The purpose of this right is to enable you to check that your data is correct and complete.
Right to rectification and right to erasure
If your details are not correct, you can ask us to modify or supplement them. You may also request that we delete your data. Sometimes we cannot do this, for example if we have to keep your data due to a legal obligation.
Right to restrict processing
If you believe that your data is incorrect or has been processed unlawfully, you can ask us to restrict the use of your personal data. You can also do so if we no longer need your data, but you want us to keep it for use in legal proceedings or if you have objected to the use of your data for our legitimate interests.
Right to object
If we use your personal data on the basis of a ‘legitimate interest’, you have the right to object. You also have the right to object to direct marketing. If you submit an objection, your data will no longer be processed for these purposes.
Right to data portability
You have the right to transfer data. You can transfer data to yourself or to another organization. This only concerns the digital data that we process with your consent or to execute an agreement with you. In individual cases, YKNV processes your personal data:
a) based on your consent. In such cases, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.
b) for marketing purposes. You have the right to object to this at any time.
9. How do I exercise my rights?
Click here to download Data Subjects Rights form. You can send this to us together with a copy of your identity document.
10. How can I submit a complaint about the processing of personal data?
If you have a general question or complaint about the processing of personal data, then you can register this via our complaints procedure on our website. If you are dissatisfied with our response to your complaint, then you can appeal to the YKNV Data Protection Officer. You are also entitled to file a complaint with the Dutch DPA.
11. How does YKNV acquire my personal data?
YKNV obtains personal data mainly from yourself, for example when you fill in an online form or sign a contract with us. Where necessary to provide services, YKNV also obtains personal data from publicly available sources, including trade registers or government agencies.
12. To what extent does automated decision-making take place within YKNV?
When establishing and conducting a business relationship, YKNV generally does not make decisions based solely on automated processing (including profiling) that has legal consequences for you. When YKNV uses this procedure in individual cases, YKNV will inform you separately.