Processing order, personal data protection, and the use of cookies at “ASVIO BANK JSC”

In accordance with the provisions of the Law of Ukraine "On Personal Data Protection," ASVIO BANK JSC informs about the procedure for processing, protecting personal data, and using cookie files.

Legislation on personal data protection includes the Constitution of Ukraine, the Law of Ukraine "On Personal Data Protection" (hereinafter referred to as the Law), the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data concerning supervisory authorities and transborder data flows, other regulatory legal acts, international treaties of Ukraine, the binding nature of which is approved by the Verkhovna Rada of Ukraine.

Additional information on the application of special legislation in the field of personal data protection can be found on the official website of the Authorized Verkhovna Rada Commissioner for Human Rights at: www.ombudsman.gov.ua or on the official website of the Ministry of Justice of Ukraine at: www.minjust.gov.ua.

The subjects of relations related to personal data are:

• Data subject - an individual whose personal data is processed;
• Data controller - JOINT STOCK COMPANY "ASVIO BANK", identification code of the legal entity according to the Unified State Register of Enterprises and Organizations of Ukraine (EDRPOU) 09809192, legal address: Ukraine, 14000, Chernihiv, 2 Preobrazhenska Street.

Phone 0 800 30 30 50 (Mon-Fri, 9.00-18.00, toll-free within Ukraine)

Email: [email protected]

Website: https://www.asviobank.ua

• Data controller - an individual or legal entity to whom the owner of the personal data has entrusted the right to process such data on behalf of the owner or as provided by law;
• Third party - any person other than the data subject, the owner or controller of personal data, and the Authorized Verkhovna Rada Commissioner for Human Rights, to whom the owner or controller of personal data transfers personal data.
• Authorized Verkhovna Rada Commissioner for Human Rights (Authorized VRU) - an entity responsible for monitoring compliance with legislation on the protection of personal data: 01008, Kyiv, 2/8 Institutska Street, tel .: 044-299-74-08; 0800-50-17-20.

Personal data - information or a set of information about an identified or identifiable individual. Personal data include objective and subjective information about an individual contained in primary and other sources of information about an individual, in alphabetical, numerical, graphical, or photo formats, in audio/cinema/video recordings on paper or electronic media, for which general or specific processing requirements apply, relating to the individual directly or pursuant to which the individual can be specifically identified by one or more factors inherent in the individual's physical, physiological, mental, economic, cultural, or social identity.

Processing of personal data - any action or set of actions, such as collection, recording, accumulation, storage, adaptation, alteration, retrieval, use, and dissemination (distribution, implementation, transmission), anonymization, destruction of personal data, including the use of information (automated systems).

Purpose of processing personal data:

• Compliance with the requirements of current legislation of Ukraine during the provision of banking and other financial services by the Bank, as well as the conduct of other activities defined by the Bank's Charter, regulatory acts of the NBU, and current legislation of Ukraine;
• Sending offers to individuals regarding services in the Bank, sending informational and advertising messages and materials about the services and products of the Bank and its partners (direct marketing);
• Ensuring the quality and safety of customer service in the Bank;
• Protection of the legitimate rights and interests of the Bank;
• Fulfillment of other powers and obligations of the Bank provided by the current legislation of Ukraine and the internal documents of the Bank, including for the implementation of labor relations and relations in the field of human resource management.
• Implementation of relations in the conclusion and performance of civil and commercial contracts (contracts, agreements) for the supply of goods, performance of works, provision of services, lease (rental), purchase and sale of real estate / movable property, contracts (contracts, agreements) for cooperation, and other needs related to the provision of the Bank's economic activity, external economic contracts (contracts, agreements);
• Organization of competitions and tenders conducted by the Bank regarding its economic activity, informing potential participants, consideration of documents provided by them;
• Organization of verification of the Bank's counterparties (existing and potential) in the conclusion and performance of civil and commercial contracts (contracts, agreements), external economic contracts (contracts, agreements), procurement of goods/works/services without concluding a contract, etc.;
• Other actions related to the Bank's business activities and compliance with the requirements of current legislation of Ukraine.

The legal grounds for processing personal data are:

• Consent of the data subject to the processing of their personal data;
• Permission for the processing of personal data granted to the data controller by law solely for the performance of its duties;
• Conclusion and performance of a legal act, where the data subject is a party or which is concluded for the benefit of the data subject, or for the implementation of measures preceding the conclusion of a legal act at the request of the data subject;
• Protection of vital interests of the data subject;
• Necessity to fulfill the obligations of the data controller prescribed by law.
• Necessity to protect the legitimate interests of the data controller or a third party to whom the personal data are transferred, except where the needs for the protection of the fundamental rights and freedoms of the data subject relating to the processing of their data override such interests.

The content of personal data processed by the Bank corresponds to the information obtained from individuals - the subjects of this personal data, or lawfully obtained from their representatives or third parties, including from the credit register of the National Bank of Ukraine, other state registers, obtained by the Bank from publicly available sources, and includes information that has become known to the Bank in connection with the implementation of contractual and other legal relations with such individuals who are clients, counterparties, or employees of the Bank, or have other relationships with the Bank.

Personal data is transferred to third parties by any means (through access/transmission/distribution/publication, etc.) based on laws or with the consent of the data subject.

As the data controller, the Bank may entrust the processing of personal data to a data processor in accordance with the contract.

The transfer of personal data to foreign subjects involved in personal data relations is carried out only provided that the respective state ensures proper protection of personal data in cases established by law or international treaties of Ukraine.

When a user visits the Bank's website, all logins to the system are recorded. The Bank may collect data on the statistics of visits to the Bank's website. The information may include details about connections, traffic, user's browser, as well as the date, time, duration of internet activity, and presence on the Bank's website (including cookies, IP addresses, parameters and settings of internet browsers, etc.).

The Bank may use the information it collects about users of the Bank's website in accordance with legal requirements for the following purposes:

• Registration of the Bank's client and/or their device in the services of the Bank's website;
• Provision of services or features in the services of the Bank's website that the Bank's client has requested;
• Conducting research on the use of the Bank's services by its clients on the Bank's website to improve service quality;
• Sending offers to the Bank's client, sending them advertising messages, direct marketing;
• Conducting marketing research, market assessment, and analysis of clients, products, and services (including conducting surveys of clients regarding the Bank's services);
• Other purposes related to the Bank's business activities and compliance with the requirements of current legislation of Ukraine.

Subjects of personal data have the right to:

• Know the sources of collection, location of their personal data, the purpose of their processing, the location or residence (stay) of the owner or controller of personal data, or to give appropriate authorization for obtaining this information to their authorized persons, except as provided by law;
• Receive information about the terms of access to personal data, including information about third parties to whom their personal data are transferred;
• Access their personal data;
• Receive a response no later than thirty calendar days from the date of receipt of the request, except as provided by law, regarding whether their personal data are being processed, as well as receive the content of such personal data;
• Make a motivated demand to the owner of personal data to object to the processing of their personal data;
• Make a motivated demand for the change or destruction of their personal data by any owner or controller of personal data if such data are processed illegally or are inaccurate;
• Protect their personal data from illegal processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision, as well as protection from the provision of information that is inaccurate or disgraces the honor, dignity, and business reputation of an individual;
• Lodge complaints about the processing of their personal data to the Authorized Verkhovna Rada Commissioner for Human Rights or to court;
• Use legal remedies in case of violation of legislation on personal data protection;
• Make reservations regarding restricting the right to process their personal data when giving consent;
• Withdraw consent to the processing of personal data;
• Know the mechanism of automatic processing of personal data;
• Be protected from automated decision-making that has legal consequences for them.

Access by the subject of personal data to data about themselves is provided free of charge.

Processing of personal data for direct marketing purposes, including profiling, including the use of social networks, automated audio and video calling systems, sending electronic messages, emails, is carried out in the presence of the Bank's legitimate interest or based on the explicit consent of the subject of personal data for such processing.