Loan application, consent for personal data processing and declaration on awareness of the data subject's rights

 

1. With the signing of this document, I hereby state my wish (request) to apply for and receive an offer for provision of a loan by UniCredit Consumer Financing EAD.

2. I agree that the Data Controller – UniCredit Consumer Financing EAD with UIC 175070632, having its registered seat in the city of Sofia and management address: Vazrazhdane district, postal code: 1303, Serdica quarter, 14 Gyeshevo Street shall process my personal data and use them for credit checks, performed electronically or manually, in relation to my requested loan, and also in case of possible provision of credit services by third parties, including the other entities of the Group of UniCredit Bulgaria, different from the Data Controller: UniCredit Bulbank AD, UniCredit Factoring EAD, UniCredit Fleet Management EOOD, UniCredit Leasing EAD, UniCredit Insurance Broker EOOD, for which I agree my personal data to be included and stored in a database and to be processed for or in relation to an analysis of my debts, collection of receivables from me related to the loan provided to me, anti-money laundering and fraud prevention, and also in relation to the management of the loan provided to me.

3. The consent for processing of my personal data, which is expressly given with my signature at the end of this document, has the purpose to allow the Data Controller to check my creditworthiness and verify my personal data in accordance with the Personal Data Protection Act (PDPA) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as the “Regulation”), by receiving statements from registers of third parties - private and state data controllers located in the country and abroad, such as the Central Credit Register of the BNB, the National Revenue Agency, the National Social Insurance Institute, etc., including information on my paid social security contributions, my employment contracts and my insurable earnings, and also to make inquiries and receive information about my civil registration from the National Population Database, and these data to be processed in accordance with the PDPA and Chapter Five of the Regulation.

4. The consent to the processing of my personal data, expressed in this request, is also intended to allow each of the above-mentioned personal data controllers to use my personal data for the preparation and submission of the aforementioned inquiries/ statements requested by UniCredit Consumer Financing EAD. If necessary, I agree to the Administrator providing for personal credit risk assessment purposes my personal data, including: credit data and history of payments on all opened and closed credit accounts in my name with UniCredit Bulbank AD, in compliance with the requirements of the PDPA, to the following categories of persons on the territory of the Republic of Bulgaria and abroad: other credit institutions and financial institutions, or alternatively: other providers of services for data provision from a database, as well as to persons with whom the controller has concluded contracts for the provision of products and services on their part.

I also declare my awareness that my data can be used for the purposes of market research or for reporting the level of customer satisfaction with the quality of services provided and the activities carried out by the UniCredit Bulgaria Group. I am aware that I may object to such processing at any time.

5. I agree that the results of the check, collected by the data controllers for the purposes of the loan agreement, shall be stored on electronic media and on paper in my credit file for the term of my contractual relationship with the controller, and thereafter, in cases where the controller has a legal obligation to keep the data in accordance with the provisions of the Bulgarian legislation and the laws of the European Union. In case I am not approved for a loan and the controller does not conclude a loan agreement with me, I ask the controller to delete my personal data within the technically necessary period for this, as of the date of its refusal to enter into a loan agreement.

6. In addition, I am informed that the legal basis for the processing of my personal data by the controller is both the current request for processing of my personal data and the grounds referred in Art.6, para. 1. letter b) of the Regulation – the processing is necessary for the performance of an agreement to which I am a party, or for taking steps at my request as a data subject before the conclusion of an agreement. I also understand that UniCredit Consumer Financing EAD has a legal obligation to process my personal data in connection with the company's obligations arising from the anti-money laundering legislation.

7. I am informed that I have the right to: (a) have access to my personal data kept by both the controller and third parties – data controllers; (b) request the rectification, modification and updating of such data; (c) to request restriction of their processing, (d) to request from the controller to erase (delete) my personal data, the processing of which does not meet the requirements of the PDPA. (e) to object to the processing of my personal data (only in cases specified by the law). I am informed that I have the right to data portability, which allows me to receive the personal data that concern me and that I have provided to the controller, in a structured, widely used and machine-readable format and I have the right to transfer this data to another controller, without obstruction on the part of the controller, including the right to request from the controller to make a direct transfer of the data related to me to the other controller indicated by me, if this is technically possible.

The address for receiving access to my personal data is: the city of Sofia, Vazrazhdane district, postal code: 1303, Serdica, 14 Gyueshevo Street. I am informed that at the same address I can also receive information about the data controllers to whom personal data related to me have been disclosed. I am informed that I can exercise the rights under this item by submitting a written request at the specified address or in any branch of UCB, as well as by e-mail, provided that my letter is signed with an electronic signature in accordance with with the Electronic Document and Electronic Certification Services Act.

8. I am informed that the personal data related to me are processed by the controller in connection with making individual decisions based on: (a) manual processing according to predefined criteria; (b) automated processing according to predefined criteria and (c) automated processing (without human intervention), including profiling, where the decisions formed in this way shall be used for concluding/refusing to conclude an agreement between me and the controller. I am aware of the possibility to express my point of view, to object (including to refuse) against decisions concerning me that are based solely on automated processing, including profiling, and to request, when making a decision concerning me, the participation of a person engaged by the controller for this purpose.

9. I confirm that I am aware of the fact that the controller has a legal right and interest in the access to the credit registers in order to protect its interests, the interests of its management bodies and its partners/shareholders, as well as to ensure the legitimacy of its activities, in accordance with the requirements of the law.

10. The controller may request also additional information, including but not limited to recommendations from banks and other credit or financial institutions, to research my credit history and current creditworthiness in all public and private databases, including, but not limited to, databases of credit bureaus, state bodies and banks on the territory of the Republic of Bulgaria and abroad, as well as in the databases of UniCredit Group companies of, personal data controllers (hereinafter referred to as the “Companies”). In this regard, the controller has the right to disclose to the Companies my personal data provided to the controller with this consent.

11. I grant the controller the right to verify all data provided by me through independent sources, asking it to use the data to carry out checks on my creditworthiness, before the provision of any services or products, and at any time since the existence of the potential contractual relationship between me and the controller.

12. In case I am registered as a Sole Trader (ET) or I am a Managing Owner of a Single-member Limited Liability Company (EOOD) and in connection with the preparation for concluding a loan agreement between me and the controller, I ask the controller for the following:

1. If necessary, the controller to request from the National Social Security Institute /NSSI/, including through its information system, as well as to receive, personally or through other legal entities, the available data concerning:

1.1. my income and the social security contributions made in my favor, made by the merchant, of which I am the sole owner, as well as other data, which constitute trade secrecy or personal data within the meaning of the Personal Data Protection Act (PDPA), and I authorize the controller to use the information thus collected for the purposes of my credit assessment, in connection with the granting of a targeted POS loan/cash loan in my name in compliance with the legislation related to personal data protection and any other protected information;

1.2. accrued insurable earnings for persons employed under an employment contract and insured by the merchant (without information about the personal data of these persons themselves), amount of contributions made by funds and other data that could constitute trade or business secrecy.

13. I hereby give this consent out of my free will as a person of full age, and I am aware that it is governed by Chapter Two and Chapter Three of the Regulation, and I have been informed that I have the right to refuse to submit this request, as well as to withdraw it at any time, where in such cases my request for the provision of the service I wish may not be fulfilled.

14. I am informed that the contact details of the data protection officer responsible for UniCredit Consumer Financing EAD are: address: 7, Sveta Nedelya Sq., E-mail: EQPAVojDsfejuHspvq/CH/ I am aware that I can contact this person for assistance regarding my personal data processed by the controller.

15. I am informed that for exercising the rights listed above, I have the right to appeal to the Commission for Personal Data Protection (CPDP) in the event of a dispute between me and the controller regarding the legal compliance of the processing of my data.

16. By signing the present document, I declare that I am aware of and accept the need for the controller to make a copy of my personal ID card in order to fulfill its obligations under the Measures against Money Laundering Act. The copy – electronic or on paper, shall be used and kept only for the needs of the checks related to the approval and granting of a loan provided by the controller. I am aware that the copy will be kept in the file of the loan agreement, as proof of my identification as a borrower or a guarantor.

 

Information about personal data processed by UniCredit Bulbank AD in accordance with Regulation (EU) 2016/679 of the European Parliament and the Council

/General Data Protection Regulation/

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and the Council /Regulation/ in force as of 25.05.2018 we provide you with information regarding the processing of personal data by UniCredit Bulbank AD.

 

I. Data controller details

UniCredit Bulbank AD, UIC: 831919536, registered seat and management address: 1000 Sofia, Vazrazhdane District 7 Sveta Nedelya Sq. Vazrazhdane District, Sofia 1000, is a controller of personal data and processes your personal data lawfully, in good faith and in a transparent fashion.

 

ІІ. Data Protection Officer

The Data Protection Officer of UniCredit Bulbank AD is Mr. Anton Todorov. Contact details:

E-mail: DPO@UniCreditGroup.BG

Address: 7, Sveta Nedelya Sq., 1000, Sofia, Bulgaria.

 

ІІІ. Purposes and grounds for processing of personal data

UniCredit Bulbank AD is a credit institution holding a banking license issued by the Bulgarian National Bank by virtue of Order No. RD22-2249/16.11.2009. In order to provide you with a quality service the Bank processes information that constitutes personal data for the following purposes:

 

• With the purpose of performing banking operations and managing its relations with the customers using its bank services. The Bank processes personal data when:

- Receiving preliminary information necessary for entering into an agreement.

- Performing banking consultation operations for its customers;

Performing operations for a specific banking operation or a transaction, economic movement and/or change in balance sheet with an immediate or deferred enforcement;

- Carrying out audits, evaluations of results and tendencies of bank relations as well as the risks related to them;

- There is willingness on the part of a customer and in cases where special categories of personal data are processed as well as for specific banking services/transactions, requested by customers;

- In case of resolution of disputes before a competent body (court, arbitration court, conciliation commission, administrative bodies, etc.) related to the bank’s activity.

• When the Bank acts as an investment intermediary it processes personal data in providing investment services or carrying out investment activities in accordance with the Law on Markets in Financial Instruments.

• Assessing your creditworthiness, including through profiling so that it can offer you a quality credit service. During profiling, information about financial indicators, consumer behavior and habits is analysed with the aim of offering a specific product and/or service.

• Assessing the reliability and timeliness of payments in granting loans.

• Promoting and selling products and services, including through preliminary profiling. During profiling information about preferences, habits, consumer choices is analyzed in order to improve customer service quality and offer new products and services.

• When customer satisfaction surveys are conducted by the Bank and the companies within UniCredit Group with the purpose of marketing and market research. This is achieved through interviews, questionnaires and other information research channels.

• In case of reported irregularities, objections and complaints handling, carrying out checks and providing a feedback.

• Selecting outsourcing service providers for the Bank. During the selection process for a provider information which constitutes personal data is processed in accordance with Regulation (EU) 2016/679 about personal data protection.

• Managing the Bank’s relations with outsourcing service providers. Personal data of the provider’s representative or of the provider itself is processed in negotiating and administrating agreements, in cases of court or tax investigations as well as in commercial and legal disputes.

• Managing anti-fraud activities. The bank process personal data when it carries out activities related to fraud prevention, discovery, investigation and management.

• Providing security services for areas and facilities and ensure access control. Process information constituting personal data obtained from surveillance systems; while carrying out bank operations at cash desks and offices as well as while managing and controlling visitor flows at entrances and exits, protected by an electronic control systems.

• Protecting data, information, application, system and network security.

 

ІV. Основания за обработване на личните данни

• UniCredit Bulbank AD processes your personal data pursuant to art. 6, letter “a’’ of Regulation (EU) 2016/679 in the cases when your explicit, free, specific and informed consent to have your personal data processed is required. When such consent is necessary for the processing of your personal data and you make an informed decision not to give it, the Bank may be unable to provide you with the respective product/service for which your consent was required. When the processing of your personal data for a specific purpose is contingent upon giving your consent, you can withdraw your consent at any time, without affecting the lawfulness of the processing before the consent was withdrawn.

• UniCredit Bulbank AD processes your personal data pursuant to art. 6, letter “b” of Regulation (EU) 2016/679 when “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”; In the cases when you take steps to enter into an agreement with UniCredit Bulbank AD and/or sign an agreement with UniCredit Bulbank AD, it is necessary to give information which constitutes personal data so that the Bank can take the necessary steps to provide you with the product or service that you would like to receive as part of the agreement. If you do not provide your personal data, it would be impossible for the controller to provide you with the requested services, taking steps before entering into an agreement.

• Pursuant to art. 6, letter “c” of Regulation (EU) 2016/679, the Bank processes personal data in order to comply with legal obligations in its capacity as controller under the Credit Institutions Act, the Consumer Credit Act, Credit Institutions Act, Law on the Real Estate Lending to Consumers, the Law on Payment Services and Payment Systems, the Measures against Money Laundering Act, the Measures Against the Financing of Terrorism Act, the Obligations and Contracts Act, the Civil Procedure Code, any other applicable laws and regulations, regulating the Bank’s activity as well as the effective financial, tax and accounting legislation in the country.

• Your personal data is processed pursuant to art. 6, letter “f” of Regulation (EU) 2016/679 for the purposes of the legitimate interests of UniCredit Bulbank AD in cases where the following is performed:

- Anti-fraud actions;

- Security and access control;

- Audio and video surveillance, audio and video recording for the purposes of security, access control, anti-fraud actions, documenting communication.

Upon providing data to third parties: when the legal or contractual obligations of the controller are fulfilled or on the basis of any other valid legal grounds.

- With regard to entities related to the Bank, the companies within UniCredit Group for the purposes of following and implementing group policies, reporting, audit activities, credit risk evaluation;

- Assessment and improvement of the customer service provided by UniCredit Bulbank AD and the companies within UniCredit Group as well as for the purposes of marketing and market research and analysis.

When the processing of your personal data for specific purposes is based on the legitimate interests of UniCredit Bulbank AD, including profiling, you can object to processing for specific purposes at any time.

 

V. Categories of personal data recipients

In accordance with the requirements of Regulation (EU) 2016/679 UniCredit Bulbank AD has the right to disclose personal data which it processes to the following categories of recipients:

• Public authorities, institutions, establishments and auditors in cases where the Bank has a legal obligation to provide the data. Personal data can be provided with the purpose of receiving preliminary information necessary for entering into an agreement and/or its performance.

• Third parties, individuals, legal entities, public authorities, institutions, establishments, upon fulfillment of legal or contractual obligations or other valid legal grounds.

• Subcontractors of the Bank, in their capacity as processors. Processors carry out processing in accordance with an agreement entered into with the Bank or another legal act in accordance with the controller. The Bank utilizes only those processors which provide sufficient guarantees for the implementation of appropriate technical and organizational measures in compliance with Regulation (EU) 2016/679.

Entities related to the Bank, including the companies within UniCredit Group, when personal data is processed for the purposes of the legitimate interests of UniCredit Bulbank AD; upon implementation of group policies; to improve customer service quality within the companies of UniCredit Group.

• For making inquiries and receiving information from state authorities, institutions, establishments and registers (for example the National Social Security Institute, Central Credit Register, Civil Registration and Administrative Service, Experian Bulgaria EAD, etc.) in order to evaluate your creditworthiness or for the purpose of receiving other types of preliminary information necessary for entering into an agreement at the request of the individual.

• Upon entering into agreements by virtue of which the Bank transfers (assigns) its receivables under loan agreements to third parties in accordance with the requirements of effective legislation in the country.

 

VІ. Transfering personal data to a third country or an international organization

If the necessity arises for UniCredit Bulbank AD to transfer to third countries or international organizations with personal data which it has processed, the provisions of Regulation (EU) 2016/679 shall be complied with, including in case of any possible transfer of personal data by a third country or international organization to another third country or organization.

VІІ. Personal Data Storage Period

UniCredit Bulbank AD processes personal data within the terms stipulated in the effective legislation in the country and by regulatory supervisory authorities. After the expiry of legal/regulatory periods, UniCredit Bulbank AD will erase your personal data. Personal data with regard to which there is no explicit legislative/supervisory obligation to be kept shall be erased after the purpose for which it was collected and processed has been achieved.

 

VІІІ. Exercising of rights under Regulation (EU) 2016/679

In addition to the provided information UniCredit Bulbank AD provides the following information regarding your rights as personal data subjects which you can exercise in compliance with the provisions of Regulation (EU) 2016/679:

• The right to demand access from the controller to your personal data pursuant to art.15 of the Regulation;

• The right to request from the controller rectification of your personal data pursuant to art. 16 of the Regulation;

• The right to request erasure of your personal data (‘right to be forgotten’) pursuant to art. 17 of the Regulation in cases where:

- There are no legal or contractual grounds for such processing;

- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

- The data subject withdraws his/her explicit consent in cases where personal data is processed only on the grounds that the data subject has given his/her explicit consent;

In other cases stipulated in Regulation (EU) 2016/679.

• The right to obtain restriction of processing pursuant to art. 18 of the Regulation;

• The right to object to the processing of personal data pursuant to art. 21 of the Regulation where processing is based on legitimate interests, including profiling or where data is processed for the purposes of direct marketing which includes profiling;

• The right to portability of personal data concerning you which you have provided to the controller under the provisions of art. 20 of the Regulation;

• The right to withdraw your free, specific, informed and unambiguous consent for the processing of personal data. If you withdraw your consent you must be informed that this does not affect the lawfulness of the data processing before the consent was withdrawn.

• The right to lodge a complaint with the Commission for Personal Data Protection.

• UniCredit Bulbank AD provides you with an opportunity to exercise your rights under the Regulation in a clear and accessible way. For your convenience we provide to you a template of

Request for Exercising Rights under Regulation (EU) 2016/679

• In case you would like to submit your request/application to UniCredit Bulbank AD in free wording, it is necessary to give specific mandatory details in your request/application so that you can be identified in a timely and due fashion. With the purpose of your timely and due identification and in order to prevent any unlawful use of your personal data available in requests submitted by third parties acting in bad faith, we recommend that you use a specific set of details when submitting your request to UniCredit Bulbank AD:

- Your full name;

- Your Personal Number or Foreigner's Personal Number;

- Date and place of birth (if you are not a citizen of the Republic of Bulgaria);

- The number of your ID card, date of issue, issuing body, expiry date.

- Permanent address/mailing address if different from the permanent address;

- Email address if you want to receive a response on your email address.

- Phone number if you would like us to contact you;

- In what capacity you want to exercise your rights under Regulation (EU) 2016/679, for example, a customer/former customer; provider; employee/former employee; legal representative/beneficiary owner/proxy/ legal entity related to the company, BULSTAT/ UIC/ foreign reg. number; in another capacity: person who has made a deposit at a cash desk; person who has withdrawn funds from a cash desk; mortgagor, co-debtor; pledgor, etc.

- Description of the request/application sent to the controller;

- Preferred method of receiving a response from the controller: at the email address specified in your request; at a mailing address; at a bank branch/center suitable for you.

If the details are not complete and/or false, we may be unable to satisfy part of/the whole of your request.

 

We are constantly striving to improve the way we service our customers. In this respect, with the purpose of greater transparency and awareness we provide you with the following options for submitting a request under Regulation (EU) 2016/679:

- At a branch/center of UniCredit Bulbank AD suitable for you.

- Electronically: by e-mail and letter signed in accordance with the Electronic Document and Electronic Certification Act.

• When you submit your request we recommend that you specify the means thereby you would like to receive the response to your request:

- At a branch/center of UniCredit Bulbank AD suitable for you. We hereby inform you that in case you have declared that you will exercise your rights under art. 15 and/or art. 20 of Regulation (EU) 2016/679, UniCredit Bulbank AD can provide you with personal data only at a branch/center of UniCredit Bulbank AD suitable for you.

- Electronically: by e-mail.

- At your permanent address or at the specified mailing address.

In case of any dispute or disagreement concerning the processing of your personal data, please, contact the Commission for Personal Data Protection which is the country’s effective supervisory authority responsible for any matters relating to personal data.