Legal information DDS

GDPR -  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC.

Data subject - A natural person whose personal data are being processed. It is a person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, online identifier, or by reference to one or more elements specific to physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Client - A person with whom DDS TB has concluded a business within the scope of the management company's activities, whereby business means the establishment, change or termination of contractual relations between the client and DDS TB. The client is also the person with whom DDS TB negotiated the execution of the transaction, even if this transaction did not take place, the person who ceased to be a client of DDS TB, and the client's representative who concluded the transaction with the management company on behalf of the client or negotiated its conclusion. For the purposes of this document, the Client is also considered to be the end user of the benefits defined by the AML Act.

Processing - An operation or set of operations involving personal data or personal data files, such as obtaining, recording, organizing, structuring, storing, processing or modifying, searching, browsing, exploiting, providing, transmitting, disseminating or otherwise providing, rearranging or combining, restricting, erasure or disposal, whether by automated or non-automated means.

AML - Prevention of money laundering and terrorist financing.

Client information system - An organized set of personal data processed by DDS TB for the purpose of: Concluding the execution and subsequent control of trades with investors and their identification.

Marketing information system - An organized set of personal data processed by  DDS TB for the purpose of: Addressing the offer of services - marketing. Information about products, innovations and services, providing benefits.

Controller  - Anyone who, alone or together with others, determines the purposes and means of the processing of personal data and processes personal data in his own name. For purposes hereof the controller is DDS TB.

Processor  - Anyone who processes personal data on behalf of the controller on the basis of a mandate in accordance with Article 28 of the GDPR.

Act on Supplementary Pension Saving - Law no. 650/2004 Coll. on supplementary pension saving and on amendments to certain laws.

Financial Intermediation Act - Law no. 186/2009 Coll. on financial intermediation and financial advice.

AML Act - Act no. 297/2008 Coll. on protection against money laundering and on terrorist financing.

Accounting Law - Law no. 431/2002 Coll. about accounting

Personal data means any information relating to an identified or identifiable natural person which can be identified directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, online identifier, or by reference to one or more elements which are specific for the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

DDS TB processes only those personal data that are necessary to achieve a specific purpose of processing. Personal data is always processed for a pre-defined and legitimate purpose, and without their processing this purpose would not be possible.
 

In the case of processing personal data on a legal basis, such as processing for the purpose of conducting and subsequently inspecting and identifying trades with investors, the provision of relevant data by you is a legal requirement and it is not possible to carry out the trade without providing them. Failure to provide the relevant data therefore results in a non-transaction.

In the case of processing personal data that is based on the Client's consent, such as in the case of processing within the Marketing Information System, the provision of data by the Client is voluntary. In order to tailor the offer of products and services directly to you, DDS TB evaluates the information it processes about you so that it can provide you with a targeted offer and thus limit the sending of unaddressed marketing offers. Giving consent is voluntary. If you choose not to give consent, DDS TB will not be able to send you any marketing information or offers in this particular case.

Recording of phone calls within the DIALOG Live service - The operator ensures the production of audio recordings of all telephone calls made through the DIALOG Live service. Personal data obtained in this way are processed within the framework of Information systems - Client information system and Marketing information system for the purposes set for these Information systems.

Within the DDS TB activity, different categories of personal data are processed, which differ depending on the purpose of the processing and the nature of the specific processing activity. Such categories of personal data are:

In the case of the Client Information System:

• identification data (eg name, surname, date of birth, birth identification number, data from identity card, nationality, photographers and from identity card, client number, product number),
• contact details (eg permanent / temporary residence address, email address, telephone number),
• data on the products and services used (for example, data on the products and services used, data related to the processing of your complaints),
• socio-demographic data (eg age, sex, marital status, education, number of persons in the household, information on income, type of employment, information on the politically exposed person),
• transaction data (for example, data on transactions carried out in connection with the purchase, transfer of investments and resale of mailing lists),
• data needed to monitor the safe use of products and services (for example, the IP address of the device used, information about the device used, and the browser used),
• audio recordings (for example, recordings of calls made via DIALOG Live),
• copies of completed documents, including identity documents (including photographs from the relevant document),
• data related to the use of our website www.dds.sk and applications (for example cookies),
• other relevant data (for example, data on enforcement proceedings, bankruptcies, personal bankruptcies, data related to the fulfillment of your contractual obligations and obligations,
• data on inclusion in the list of clients subject to international sanctions).

In the case of the Marketing Information System:

• data related to the use of websites and applications (such as cookies),
• relevant data processed about you in the Client Information System.

The above calculation of categories of personal data represents a complete and comprehensive calculation of all categories of personal data that come into consideration within the specific purpose of processing in the provision of the full range of DDS TB products and services in all states of the contractual relationship. The individual calculation of categories of personal data for each client will therefore only be a subset of the aforementioned calculation.

DDS TB always processes your personal data only for a pre-defined and legitimate purpose of processing, and there must always be an appropriate legal basis for such processing. DDS TB would like to assure you that your personal data is never further processed for purposes incompatible with the originally intended purposes of processing.

As part of the DDS TB activity, your personal data may be processed for the following processing purposes (next drop-down list):

The stated purpose mainly includes:

• identification of Clients,
• concluding contractual relations with the Client, including pre-contractual relations,
• management of contractual relations, including the implementation of changes and their termination,
• receiving and handling suggestions and complaints of Clients,
• relationship management,
• protection and enforcement of DDS TB rights against Clients,
• fulfillment of DDS TB obligations in the field of AML,
• activities related to the fulfillment of the tasks and obligations of DDS TB according to the valid legal regulations,
• maintaining special lists of Clients who do not properly and on time fulfill their obligations arising from contractual relations with the supplementary pension company, Clients who have committed actions assessed by the supplementary pension company as an unusual business operation, and Clients who are subject to international sanctions,
• activities related to the fulfillment of archiving obligations.

In this case, your personal data is processed to the extent necessary to meet the legal obligations of DDS TB, while the legal basis for the processing in this case is in particular the following legislation:

• Financial Intermediation Act,
• Act on Supplementary Pension Saving,
• AML Act.

DDS TB may process your personal data in cases where the scope of personal data stipulated by the above-mentioned legal regulations is insufficient to achieve the defined purpose of processing, also on the basis of the following legal bases:

• if necessary for the performance of the contract concluded between you and TAM, including pre-contractual relations within the meaning of Article 6 para. 1 letter b) GDPR,
• if you have given your consent to the processing of your personal data for a specific purpose (s) within the meaning of Article 6 (1). 1 letter a) GDPR,
• if you have given your consent to the processing of your personal data for a specific purpose (s) within the meaning of Article 9 (1). 2 letter a) GDPR,
• if necessary for the purposes of legitimate interests pursued by TAM or a third party within the meaning of Article 6 (1). 1 letter f) GDPR,
• if the processing is necessary for the establishment, exercise or defense of legal claims within the meaning of Article 9 (1). 2 letter f) GDPR.

DDS TB is obliged to proceed with professional care in its activities and in this connection has a legitimate interest in the prevention of crime or other illegal actions that may cause damage or endangered reputation, or any other harm, or before actions that may adversely affect the activities of supplementary pension company or endanger its employees or other persons concerned, and for this purpose it is entitled to keep a list of persons with potential risk, which may result in termination of the business relationship or refusal to carry out the business. 

For the purpose of addressing the offer of services - marketing, information about products, innovations and services providing benefits, DDS TB processes your personal data on the legal basis of your prior voluntary consent or on the basis of the legitimate interests of DDS TB. If you have consented to the processing of your personal data for the above-mentioned purpose by the Raiffeisen Group, your personal data may be processed by (i) persons who have a direct or indirect ownership interest in DDS TB, (ii) persons in whom it has direct or indirect ownership of DDS TB, (iii) persons in which a direct or indirect holding of a person in DDS TB has a direct or indirect holding, (iv) persons holding a direct or indirect holding in a person holding a holding in DDS TB.

For the purposes of this document, these are in particular:
- Tatra banka, a. s. with its registered office at Hodžovo námestie 3, 811 06 Bratislava, Company Identification Number: 00 686 930,
- Tatra Asset Management, správ. spol. a. s., with its registered office at Hodžovo námestie 3, 811 06 Bratislava, Company Identification Number: 35 742 968.

DDS TB has a legitimate interest in taking care of its Clients and developing business relationships with them, and thus in informing them about products, innovations, services and, where applicable, about the offers of various benefits within the Raiffeisen Group. In this context, DDS TB may contact you without your prior consent, and you will be informed and informed of such processing of your personal data about your rights, in particular about the right to object to the processing of your personal data. Of course, this does not apply if you have disagreed with or objected to such an address.

DDS TB may communicate with you for the above purpose via an automated telephone system, telephone, e-mail, SMS or other means of long distance communication.

In order to tailor the offer of products and services directly to you, DDS TB evaluates the information it processes about you so that it can provide you with a targeted offer and thus limit the sending of unaddressed marketing offers.

For the purposes defined in this point, the Client is also considered to be a person with whom DDS TB has negotiated or is interested in negotiating a transaction, even if this transaction did not take place, a person who ceased to be a client of DDS TB, a person providing security and also a client's representative concluded a transaction on behalf of the client or negotiated its conclusion.

DDS TB does not provide your personal data to other entities unless you have given DDS TB's consent, written instructions for such disclosure, or if there is another legal basis for providing your personal data to another entity, for example in fulfilling DDS TB's legal obligation as an controller.

DDS TB in the sense of § 34 par. 14 of the Act on Supplementary Pension Saving is also obliged to provide your personal data to the following entities based on their written request:

• National Bank of Slovakia,
• court,
• law enforcement authority,
• the Criminal Police Service and the Financial Police Service of the Police Force,
• the tax authority or the customs authority.

DDS TB may also provide personal data to other entities without your consent in terms of meeting the legal duties:

• in the area of prevention against money laundering and terrorist financing in accordance with the AML Act,
• in connection with reporting to the law enforcement authorities about suspicion that a crime is being prepared, being committed or was committed,
• in connection with the notification obligation to the competent authority of the Slovak Republic for the purpose of automatic exchange of information on financial accounts for the purposes of tax administration pursuant to a special regulation (FATCA, CRS),
• in connection with the fulfillment of the notification obligation towards the National Security Authority in the field of cyber security according to Act 69/2018 Coll. on cyber security,
• in connection with meeting the reporting duty towards the National Security Authority in the field of cybersecurity pursuant to the Act No. 69/2018 Coll. on Cybersecurity.

We would also like to inform you that DDS TB as well as persons from the Raiffeisen Group have a legitimate interest in the mutual sharing of personal data processed in the Client Information System, within which cross-border data transfer may also take place, within:

• prevention of money laundering and terrorist financing,
• fulfillment of obligations related to the performance of DDS TB activities at the level of the Raiffeisen Group,
• in connection with the assessment of the creditworthiness and credibility of clients.

Tatra banka and its subsidiaries act as a set of entities subject to supervision on a consolidated basis and observe selected legal obligations jointly and in cooperation with each other

In connection with the facts stated herein, we inform you that Tatra banka, as well as Tatra banka´s subsidiaries, have a legitimate interest in the consistency of the data of clients who are clients of Tatra banka and at the same time clients of Tatra banka´s subsidiaries, and also in maintaining the timeliness of the processed personal data, therefore Tatra banka as the operator, which is authorised on the basis of §93a par. 9 of the Act on Banks, even without the consent of the persons concerned, to obtain information recorded in the register of natural persons and information maintained in the register of ID cards, may provide such up-to-date information for the purpose of updating the already processed personal data to other Tatra banka´s subsidiaries.

The Tatra banka´s subsidiaries for this purpose are:

• Doplnková dôchodková spoločnosť Tatra banky, a. s., seated at Hodžovo námestie 3, 811 06 Bratislava, Company ID No: 36291111,
• Tatra Asset Management, správ. spol. a. s., seated at Hodžovo námestie 3, 811 06 Bratislava, Company ID No: 35742968,
• Tatra Leasing, s. r. o., seated at Hodžovo námestie 3, 811 06 Bratislava, Company ID No: 31326552

DDS TB does not publish your personal information.

DDS TB may, in certain cases, also process your personal data through processors. An processors is an entity entrusted by DDS TB with the processing of personal data in accordance with Article 28 of the GDPR. Your consent or other legal basis is not required to authorize the processing of your data through an processors than in the case of providing data to other controllers. In this case, the intermediary processes your personal data on behalf of DDS TB as the controller.  

The processing of personal data through an processor does not adversely affect the exercise and exercise of your rights as a data subject under Chapter III of the GDPR, and the client may exercise the relevant rights in DDS TB as an operator or directly with the specific processor through which your data is processed

DDS TB would like to assure you that it only uses processors providing appropriate technical, organizational and other measures so that the processing meets the requirements of the GDPR and that the rights of the data subject are fully protected.

DDS TB uses the following categories of processors to process your personal data:

• companies that provide or perform financial and related services,
• companies performing financial intermediation,
• companies performing management and administration of client databases,
• companies conducting customer satisfaction surveys,
• companies providing marketing activities,
• companies providing printing and mass correspondence services,
• companies performing the administration of registry records according to special regulations.

Personal data is not the subject of cross-border transfer to third countries that do not provide an adequate level of personal data protection, except in cases specified by applicable law or special situations where the Client must be informed in advance of such transfer.

When processing personal data, cloud solutions are also used in several cases, resp. services of a similar technical nature. The use of such solutions is, for example, in many cases necessary as part of the implementation of state-of-the-art software tools, resp. their use contributes to efficiency and economy. Last but not least, such solutions also contribute to maintaining the integrity of the processed data and contribute to the security of the processing.

Depending on the type of processing activities, in such processing the providers of cloud or similar services act mainly as processors in accordance with Article 28 of the GDPR. In selecting its partners and in the course of the processing activities, DDS TB is very careful to avoid any risk of data security breach or any negative impact on the rights of data subjects. DDS TB also consistently makes sure to select only partners who have demonstrably implemented appropriate technical and organisational measures to ensure the level of security pursuant to point (c) Article 28 par.3 c) and Article 32 of the GDPR, so that the processing is performed in compliance with the valid legal regulations, in particular the GDPR, and to ensure protection of the rights of data subjects.

Such processing does not involve the transfer of personal data to third countries which do not guarantee an adequate level of protection within the meaning of the GDPR.

DDS TB retains your data in a form that allows your identification for no longer than is necessary to achieve the purpose for which the personal data are processed.

If your personal data is processed in fulfillment of the legal obligation of DDS TB, the relevant legal regulations specify the period during which DDS TB is obliged to keep your personal data and related documentation. Such legislation includes in particular:

• Act on Supplementary Pension Saving, which in § 31 par. 3 stipulates the obligation to keep records and other documentation related to the managed supplementary pension funds and the services provided for at least five years from the end of the management of the supplementary pension fund to which the documentation and records relate and also stipulates the obligation to keep documentation related to the participants for at least five years from the date of termination of the participation agreement and benefit recipients.
• The Financial Intermediation Act, which in § 36 stipulates a period of storage of documentation of at least ten years from the beginning of the validity of the agreement on the provision of financial services and a period of at least five years after the termination of the validity of the agreement on the provision of financial advice.
• AML law, under which DDS TB is obliged to keep for five years:
  – from the end of the contractual relationship with the client, the data and written documents obtained in connection with the performance of care in relation to the client and in connection with the detection of an unusual business operation,
  – from the execution of the transaction all data and written documents about the client.
• Law no. 431/2002 Coll. on accounting, on the basis of which DDS TB is obliged to store and protect your personal data and related documents that make up the accounting documentation for ten years following the year to which the accounting documentation relates.

If your personal data is processed on the basis of your consent, DDS TB will, after the withdrawal of consent or the expiration of the validity period of the consent, retain the personal data only for such a period as is necessary to demonstrate, exercise or defend DDS TB's legal claims. The same applies in the case of processing on the basis of a contract or legitimate interest. After the end of the purpose of processing, the part of the purpose of processing with the name: Archiving for the needs of protecting the rights of the Operator and proving, exercising or defending legal claims as well as providing cooperation to the relevant authorities is fulfilled. The legal basis of the processing on which the relevant personal data were obtained remains in that case as well.

Within the scope of the archiving period/retention period, personal data are processed in particular:
- in the manner established by the relevant legal regulation, which imposes such processing on the bank,
- in connection with the bank's communication with public authorities within the framework of the protection of the bank's rights,
- in connection with the protection of the bank's rights and legally protected interests, for example as part of an internal analysis or an internal investigation,
- in connection with submissions and other related communication with the relevant authorities in the context of proving, exercising or defending legal claims,
- in connection with handling cooperation provided by public authorities in accordance with the conditions established by law.

We take appropriate technical and organizational measures to protect your personal data from intentional or negligent deletion, loss or alteration and against unauthorized disclosure of your personal data. DDS TB employees, as well as DDS TB's contractual partners who process personal data on its behalf, are bound by a duty of confidentiality, which continues even after the termination of the contractual relationship.

In connection with the processing of personal data, you have the right to file a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovak Republic.

You have the right to correct incorrect personal data that concerns you or to supplement incomplete personal data. If you find that we are processing incorrect or incomplete data about you, please do not hesitate to contact us.

If your personal data is processed on the basis of consent within the meaning of Article 6 para. 1 GDPR or within the meaning of Article 9 para. 2 GDPR, you have the right to withdraw this consent at any time. However, the withdrawal of consent shall not affect the lawfulness of the processing resulting from the consent prior to its withdrawal.

As the data subject, you have the right to object to the processing of your personal data if the processing takes place on the legal basis of DDS TB's legitimate interests, including an objection to legitimate interest-based profiling. DDS TB may further process your personal data on legitimate interests only if it demonstrates the necessary legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the reasons for proving, asserting or defending legal claims.

You have the right at any time to object to the processing of your personal data for direct marketing purposes, including profiling, to the extent that it relates to such direct marketing, provided that the processing takes place on the legal basis of DDS TB's legitimate interests. In the event of your objection to processing for direct marketing purposes, DDS TB will not further process your personal data for direct marketing purposes.

As the data subject, you have the right to access your personal data. If the conditions defined by the GDPR are met, you can ask us to extract your personal data that we process about you. In certain circumstances, you may request a restriction on processing, the transfer of your personal data and you also have the right to have your personal data deleted.

You can exercise your rights in writing, by telephone via the DIALOG Live service, by e-mail to dpo@tatrabanka.sk or in person at a branch of Tatra banka, a.s. TAM may ask you to provide additional information needed to confirm your identity.

As a data subject, you have the right to object to the processing of your personal data if the processing takes place on the legal basis of legitimate interests of DDS TB, including objection to profiling based on legitimate interests. DDS TB may further process your personal data for legitimate interests only if it demonstrates necessary legitimate reasons for processing that outweigh your interests, rights and freedoms, or reasons for proving, exercising or defending legal claims.