Personal Data Processing

Personal data is any information on any medium that may help to identify a person. In performing its duties specified in legislation, ensuring the provision of services to customers, pursuing various types of legitimate interests, and attending to the quality of customer service, Industra Bank processes various types of personal data. Here are some examples of the personal data we process:

• name, surname, date of birth, personal identity number, passport or identity card data, citizenship, tax residence of a person;
• contact information (phone number, e-mail, address, language used for communication);
• financial data of a person - income, financial liabilities, source of income, borrowings, turnover of financial assets, other financial information;
• information required for making and processing payments, such as current account number of a person in the bank, payment card information, payment history;
• information about the person's work experience, education (managing information about existing and potential bank's employees);
• information about users of the Industra Bank's website (cookies, IP address);
• information about family members, associated persons;
• person's visual appearance (video surveillance).

Industra Bank processes various types of personal data, the volume and nature of which varies due to the diverse nature of data processing purposes. Industra Bank does not process information that is not required for achieving a concrete, specifically set legal purpose.

Personal data can be obtained by Industra Bank in various ways, for example, when:

• conducting a potential customer identification and due diligence;
• entering into contractual relations with a customer and performing contractual obligations;
• providing one-time service to a person who is not a customer of the bank;
• reviewing applications in response to job advertisements, when recruiting new employees;
• consulting a person over the phone or at customer service centers; 
• receiving a letter or an e-mail message from a person;
• a person using the bank’s website, internet banking, or the bank’s accounts in social media; 
• conducting video surveillance at Industra Bank's premises or outside its premises;
• using information about a person from Internet resources, requesting information about a Person from various registers, and from other publicly available sources.

Industra Bank may initiate processing of personal data only if the processing has a specific purpose (for example, conclusion of a contract, the provision of a specific service, performance of the statutory obligations, etc.) and if the processing has an appropriate legal basis.

A legal basis for processing of personal data may be as follows:

1. Establishment and performance of contractual obligations

In the event of this legal basis, Industra Bank processes the data required for concluding and performing the contract. Examples of data processing in conjunction with this legal basis:

• Industra Bank requests all information necessary for concluding a contract (the legal basis also applies if the contract is not concluded for some reason);  
• The bank transfers information to other parties of the envisaged agreement (for example, by entering into a tripartite agreement);
• Industra Bank sends information to international payment card organizations (Mastercard, VISA, etc.) to ensure execution of payment card transactions (if it is provided for in the agreement concluded between the bank and the customer);
• The bank transfers information to correspondent banks to ensure execution of payments (if it is provided for in the agreement concluded between Industra Bank and the customer).

2. Compliance with a legal obligation

This legal basis applies to the data processing when Industra Bank has no free choice of action - the relevant activity is governed by the provisions of applicable regulatory enactments of the EU or Latvia.

For example, provision of information to the Financial and Capital Market Commission or to the State Revenue Service in line with the legal acts, requesting information from a potential customer for identification purposes, etc.

3. Protection of the vital interests of a person (Data Subject) or of a third party

This legal basis is used in exceptional cases, when data processing is carried out, for example, with an effort to protect life or health of a person.

4. Observance of public interest or exercise of official powers

This legal basis is rarely used and is similar to the compliance with a legal obligation, since the public interest or official powers of Industra Bank must be specified in legal acts, unlike as with a legal obligation, the bank can have a free (or a partially free) choice of action.

5. The legitimate interests of Industra Bank or of a third party

A frequently used legal basis. It is applied, for example:

• when indicating third party-related information that is essential for the use of Industra Bank’s products (guarantors, pledgers, parties involved in transactions in case of opening of an escrow account, etc.) in the application;
• when recording telephone conversations for the purposes of service quality control, etc.

Prior to performing data processing in accordance with this legal basis, the bank shall evaluate the effect on the data subject, perform an interest balancing test.

6. The consent of a Person (Data Subject)

The consent of a person is used as a legal basis, for example, in marketing purposes, when a person applies for a lottery or receipt of informative materials.

A person has a free choice – to give his/her consent to data processing or not, and a person has the right to withdraw his/her consent at any time, terminating the data processing.

Industra Bank does not process, more information than it is necessary to achieve certain goals, thus observing the so-called principle of data minimization. 

The bank continuously develops information technologies to ensure the protection of personal data.

Industra Bank ensures that only those employees who need it for the performance of their job duties have access to personal data. 

The bank takes efforts to ensure that it is processing only correct and accurate data. If Industra Bank has doubts about the applicablity or accuracy of the information submitted by a person, the bank contacts the person to clarify the information processed. In addition, each customer is obligated to report to the bank in the event of changes in the information submitted to the bank (for example, telephone number, residence address, etc.).

Personal data is processed for no longer than is necessary to achieve a certain purpose.

The bank respects the rights of a person, allowing the Person to control and monitor their data processing.

Industra Bank carries out, on a regular basis, training of employees, incl. on personal data processing, protection, as well as on confidentiality and ethical standards.

When performing the processing of personal data, Industra Bank uses automated systems, but does not take individual decisions without participation of specialists of the bank.

The bank uses automated systems, e.g. for payment control, customer due diligence, detection of suspicious transactions, sanctions risk management in accordance with the current legislation of Latvia.

When processing personal data, it is the priority of Industra Bank to keep the information confidential. Information may only be transferred to third parties to the extent and in cases stipulated by the applicable regulatory enactments of Latvia and of the EU, as well as to ensure the provision of high-quality and efficient services, or, when it is necessary for the performance of contractual obligations to the customer.
Personal data may be transferred to:

• The Financial and Capital Market Commission, the State Revenue Service, the State Data Inspectorate, the Bank of Latvia and other state institutions, the Financial Intelligence sworn bailiffs and investigating authorities - in accordance with the regulatory enactments;
• Holders of different registries (e.g. Credit registers Commercial register, etc.);
• External auditor of Industra Bank;
• Subsidiary of Industra Bank;
• Persons who are guarantors for obligations of Industra Bank’s customer (guarantors, pledgers);
• Beneficiary of a payment or transaction;
• Insurance companies;
• Industra Bank's business partners, incl. those who provide the following services to the Bank: telecommunication service, information technologies, payment company services, etc.;
• Business partners that provide customer and employee loyalty programs and privileges;
• Other credit institutions, financial institutions, payment card companies, financial services intermediaries, etc.

Before transferring data to a third person, Industra Bank shall conclude an agreement detailing the procedure in accordance with which the business partner will process and protect the personal data. During the cooperation, only information required for a stipulated purpose will be transferred to the partner, and if there is such a possibility, Industra Bank transfers anonymized information, so that the business partner is not able to identify the person. The bank may not enter a contract with a third party only in cases where the transfer of the relevant data is regulated by the applicable regulatory enactments of Latvia and/or the EU.

Personal data of a person may be transferred to outside the EU/EEA, when doing so is necessary for ensuring the provision of a specific service, in the event when the business partner of Industra Bank is located outside the EU/EEA. When transferring the personal data outside the EU/EEA, the Bank ensures a data protection level compliant with General Data Protection Regulation.

Persons have the following rights regarding the processing of his or her information:

• to receive information on the type, purpose and legal basis of their data processing;
• to access their data and obtain confirmation of their data processing. By using Industra Bank Internetbank, a customer can acquaint oneself with the information on the concluded agreements with the bank, balances of the accounts, his/her personal data submitted to Industra Bank, payment history, etc. Upon receipt of a customer’s request for information on personal data processing.  
• to rectify their data if it is incorrect or inaccurate;
• to delete their data or "to be forgotten", for example, if the data is no longer necessary for the purposes for which it was collected or if the person has withdrawn his/her consent on which the data processing is based;
• restrict the data processing, for example, if the accuracy of the personal data is contested by the person, or if the bank no longer needs the data for the stipulated purposes, but the person objects to deletion of the data, with the aim of implementing or defending legal claims, etc.;
• to object to processing of data (on grounds relating to the person’s situation) if processing is based on Industra Bank's legitimate interests or public interest. The right to object may not be realized if the legal basis for processing is the consent given by the person, the establishment and performance of contractual relations, fulfilment of a legal obligation, protection of vital interests of the data subject or of third parties;
• right to data portability or movement, to store or to enable the reuse of data, for example, by transferring to another service provider. The right may be not realized for absolutely all information. Rights may be realized in respect of the data submitted by the person, for example by filling in forms and applications, applying for the use of Industra Bank's products and services, as well as in respect of the data processed by automated means (other than paper documents) and the legal basis thereof is either consent given by the Person or the establishment and performance of contractual relationships;
• the right to submit a complaint regarding violations of personal data processing to the State Data Inspectorate:
  • by filling in an application regarding possible illegal processing of personal data or
  • by sending electronically, signed with a secure electronic signature to the e-mail address info(abols)dvi.gov or
  • sending by post to the address Elijas iela 17, Rīga, LV-1050.

Industra Bank accepts requests without undue delay and, in any case, informs the person about the actions undertaken within a month. The bank may extend the period of consideration of the claims for another two months on a reasonable basis (for example, large number of requests or complexity of requests).

The bank replies to the requests of a person, as well as carries out any other activities related to the fulfilment of the requests of persons, free of charge (if the request is manifestly unfounded, excessive, or depending on what resources are required for handling the request, the bank may charge a reasonable fee, considering the administrative costs of providing the information or communication, or performing the requested action, or refusing to comply with the request).