Legal information

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC.

Data subject - A natural person whose personal data are being processed. It is a person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, online identifier, or by reference to one or more elements specific to physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Client - A person with whom TAM has concluded a business within the scope of the management company's activities, whereby business means the establishment, change or termination of contractual relations between the client and TAM. The client is also the person with whom TAM negotiated the execution of the transaction, even if this transaction did not take place, the person who ceased to be a client of TAM, and the client's representative who concluded the transaction with the management company on behalf of the client or negotiated its conclusion. For the purposes of this document, the Client is also considered to be the end user of the benefits defined by the AML Act.

Processing - An operation or set of operations involving personal data or personal data files, such as obtaining, recording, organizing, structuring, storing, processing or modifying, searching, browsing, exploiting, providing, transmitting, disseminating or otherwise providing, rearranging or combining, restricting, erasure or disposal, whether by automated or non-automated means.

AML - Prevention of money laundering and terrorist financing.

Client information system - An organized set of personal data processed by TAM for the purpose of: Concluding the execution and subsequent control of trades with investors and their identification.

Marketing information system - An organized set of personal data processed by TAM for the purpose of: Addressing the offer of services - marketing. Information about products, innovations and services, providing benefits.

Operator - Anyone who, alone or together with others, determines the purposes and means of the processing of personal data and processes personal data in his own name. For the purposes of this document, the Operator means TAM.

Intermediary - Anyone who processes personal data on behalf of the Operator on the basis of a mandate in accordance with Article 28 of the GDPR.

AML Act - Act no. 297/2008 Coll. on protection against money laundering and on terrorist financing.

Securities Act - Act no. 566/2001 Coll. on securities and investment services.

Collective Investment Act - Act no. 203/2011 Coll. on collective investment.

Within the TAM activity, different categories of personal data are processed, which differ depending on the purpose of the processing and the nature of the specific processing activity. Such categories of personal data are:

In the case of the Client Information System:

• identification data (eg name, surname, date of birth, birth number, data from identity card, nationality, photographers and from identity card, client number, product number),
• contact details (eg permanent / temporary residence address, email address, telephone number),
• data on the products and services used (for example, data on the products and services used, data related to the processing of your complaints),
• socio-demographic data (eg age, sex, marital status, education, number of persons in the household, information on income, type of employment, information on the politically exposed person),
• transaction data (for example, data on transactions carried out in connection with the purchase, transfer of investments and resale of mailing lists),
• geolocation data (for example, data on the place of execution of the transaction, data identifying the device through which the transaction was performed, data on the place where the payment card was used),
• data needed to monitor the safe use of products and services (for example, the IP address of the device used, information about the device used, and the browser used),
  audio recordings (for example, recordings of calls made via DIALOG Live),
• copies of completed documents, including identity documents (including photographs from the relevant document),
• data related to the use of our website www.tam.sk and applications (for example cookies),
• other relevant data (for example, data on enforcement proceedings, bankruptcies, personal bankruptcies, data related to the fulfillment of your contractual obligations and obligations,
• data on inclusion in the list of clients subject to international sanctions).

In the case of the Marketing Information System:

• data related to the use of websites and applications (such as cookies),
• relevant data processed about you in the Client Information System.

The above calculation of personal data categories represents a complete and comprehensive calculation of all categories of personal data that come into consideration within the specific purpose of processing in providing the full range of banking products and services in all states of the contractual relationship. The individual calculation of personal data categories for an individual client will therefore only be a subset of that calculation.

Personal data means any information relating to an identified or identifiable natural person which can be identified directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, online identifier, or by reference to one or more elements which are specific for the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

TAM processes only those personal data that are necessary to achieve a specific purpose of processing. Personal data is always processed for a pre-defined and legitimate purpose, and without their processing this purpose would not be possible.

In the case of processing personal data on a legal basis, such as processing for the purpose of conducting and subsequently inspecting and identifying trades with investors, the provision of relevant data by you is a legal requirement and it is not possible to carry out the trade without providing them. Failure to provide the relevant data therefore results in a non-transaction.

In the case of processing personal data that is based on the Client's consent, such as in the case of processing within the Marketing Information System, the provision of data by the Client is voluntary. In order to tailor the offer of products and services directly to you, TAM evaluates the information it processes about you so that it can provide you with a targeted offer and thus limit the sending of unaddressed marketing offers. Giving consent is voluntary. If you choose not to give consent, TAM will not be able to send you any marketing information or offers in this particular case.

TAM always processes your personal data only for a pre-defined and legitimate purpose of processing, and there must always be an appropriate legal basis for such processing. TAM would like to assure you that your personal data is never further processed for purposes incompatible with the originally intended purposes of processing.

As part of the TAM activity, your personal data may be processed for the following processing purposes (next drop-down list):

That purpose includes in particular:

• identification of Clients,
• concluding contractual relations with the Client, including pre-contractual relations,
• management of contractual relations, including the implementation of changes and their termination,
• receiving and handling suggestions and complaints of Clients,
• relationship management,
• protection and enforcement of TAM rights against Clients,
• fulfillment of TAM obligations in the field of AML,
• activities related to the fulfillment of the tasks and obligations of TAM according to the valid legal regulations,
• keeping special lists of Clients who do not properly and timely fulfill their obligations arising from contractual relations with the Management Company, Clients who have committed conduct assessed by the Management Company as an unusual business operation, and Clients subject to international sanctions,
• activities related to the fulfillment of archiving obligations.

In this case, your personal data is processed to the extent necessary to meet the legal obligations of TAM, while the legal basis for the processing in this case is in particular the following legislation:

• AML Act,
• Securities Act,
• Collective Investment Act.

TAM may process your personal data in cases where the scope of personal data stipulated by the above-mentioned legal regulations is insufficient to achieve the defined purpose of processing, also on the basis of the following legal bases:

• if necessary for the performance of the contract concluded between you and TAM, including pre-contractual relations within the meaning of Article 6 para. 1 letter b) GDPR,
• if you have given your consent to the processing of your personal data for a specific purpose (s) within the meaning of Article 6 (1). 1 letter a) GDPR,
• if you have given your consent to the processing of your personal data for a specific purpose (s) within the meaning of Article 9 (1). 2 letter a) GDPR,
• if necessary for the purposes of legitimate interests pursued by TAM or a third party within the meaning of Article 6 (1). 1 letter f) GDPR,
• if the processing is necessary for the establishment, exercise or defense of legal claims within the meaning of Article 9 (1). 2 letter f) GDPR.

TAM is obliged to proceed with professional care in its activities and in this connection has a legitimate interest in the prevention of crime or other illegal actions that may cause damage or endangered reputation, or any other harm, or before actions that may adversely affect the activities of TAM or endanger its employees or other persons concerned, and for this purpose it is entitled to keep a list of persons with potential risk, which may result in termination of the business relationship or refusal to carry out the business.

For the purpose of addressing the offer of services - marketing, information about products, innovations and services providing benefits, TAM processes your personal data on the legal basis of your prior voluntary consent or on the basis of the legitimate interests of TAM. If you have consented to the processing of your personal data for the above-mentioned purpose by the Raiffeisen Group, your personal data may be processed by (i) persons who have a direct or indirect ownership interest in TAM, (ii) persons in whom it has direct or indirect ownership of TAM, (iii) persons in which a direct or indirect holding of a person in TAM has a direct or indirect holding, (iv) persons holding a direct or indirect holding in a person holding a holding in TAM.

For the purposes of this document, these are in particular:
- Tatra banka, a.s. with its registered office at Hodžovo námestie 3, 811 06 Bratislava, Company Identification Number: 00 686 930,
- Supplementary pension company Tatra banka, a. s., with its registered office at Hodžovo námestie 3, 811 06 Bratislava, ID number: 36 291 111

TAM has a legitimate interest in taking care of its Clients and developing business relationships with them, and thus in informing them about products, innovations, services and, where applicable, about the offers of various benefits within the Raiffeisen Group. In this context, TAM may contact you without your prior consent, and you will be informed and informed of such processing of your personal data about your rights, in particular about the right to object to the processing of your personal data. Of course, this does not apply if you have disagreed with or objected to such an address.

TAM may communicate with you for the above purpose via an automated telephone system, telephone, e-mail, SMS or other means of long distance communication.

In order to tailor the offer of products and services directly to you, TAM evaluates the information it processes about you so that it can provide you with a targeted offer and thus limit the sending of unaddressed marketing offers.

For the purposes defined in this point, the Client is also considered to be a person with whom TAM has negotiated or is interested in negotiating a transaction, even if this transaction did not take place, a person who ceased to be a client of TAM, a person providing security and also a client's representative. concluded a transaction on behalf of the client or negotiated its conclusion.

TAM does not provide your personal data to other entities unless you have given TAM's consent, written instructions for such disclosure, or if there is another legal basis for providing your personal data to another entity, for example in fulfilling TAM's legal obligation as an operator.

TAM pursuant to § 162 par. 3 of the Collective Investment Scheme is also obliged to provide your personal data to the following entities:

• the persons entrusted with the supervision of the management company,
• court, including a notary as judicial commissioner,
• law enforcement authority,
• National Bank of Slovakia,
• the Criminal Police Service, the Judicial Police Service and the Financial Police Service of the Police Force,
• the tax authority or the customs authority,
• a state administration body for the purposes of enforcing a decision pursuant to a special regulation (Administrative Procedure Code),
• Slovak Information Service,
• the managing authority and the audit authority when carrying out the control or audit of financial instruments.

TAM may also, without your consent, provide personal data to other entities in the performance of legal obligations:

• in the field of prevention against money laundering and terrorist financing in accordance with the AML Act,
• in connection with the notification to law enforcement authorities of a suspicion that he is preparing to commit, or that a criminal offense has been committed,
• in connection with the notification obligation to the competent authority of the Slovak Republic for the purpose of automatic exchange of information on financial accounts for the
• purposes of tax administration pursuant to a special regulation (FATCA, CRS),
• in connection with the fulfillment of the notification obligation towards the National Security Office in the field of cyber
• security according to Act 69/2018 Coll. on cyber security.

We would also like to inform you that TAM as well as persons from the Raiffeisen Group have a legitimate interest in the mutual sharing of personal data processed in the Client Information System, within which cross-border data transfer may also take place, within:

• prevention of money laundering and terrorist financing,
• fulfillment of obligations related to the performance of TAM activities at the level of the Raiffeisen Group,
• in connection with the assessment of the creditworthiness and credibility of clients.

TAM does not publish your personal information.

TAM may, in certain cases, also process your personal data through intermediaries. An intermediary is an entity entrusted by TAM with the processing of personal data in accordance with Article 28 of the GDPR. Your consent or other legal basis is not required to authorize the processing of your data through an intermediary than in the case of providing data to other controllers. In this case, the intermediary processes your personal data on behalf of TAM as the operator.

The processing of personal data through an intermediary does not adversely affect the exercise and exercise of your rights as a data subject under Chapter III of the GDPR, and the client may exercise the relevant rights in TAM as an operator or directly with the specific intermediary through which your data is processed.

TAM would like to assure you that it only uses intermediaries providing appropriate technical, organizational and other measures so that the processing meets the requirements of the GDPR and that the rights of the data subject are fully protected. TAM uses the following categories of intermediaries to process your personal data:

• companies that provide or perform financial and related services,
• companies performing management and administration of client databases,
• companies conducting customer satisfaction surveys,
• companies providing marketing activities,
• companies providing printing and mass correspondence services,
• companies performing the administration of registry records according to special regulations.

Personal data is not the subject of cross-border transfer to third countries that do not provide an adequate level of personal data protection, except in cases specified by applicable law or special situations where the Client must be informed in advance of such transfer.

When processing personal data, cloud solutions are also used in several cases, resp. services of a similar technical nature. The use of such solutions is, for example, in many cases necessary as part of the implementation of state-of-the-art software tools, resp. their use contributes to efficiency and economy. Last but not least, such solutions also contribute to maintaining the integrity of the processed data and contribute to the security of the processing.

In such processing, providers of cloud, resp. similar services depending on the type of processing activity, in particular as intermediaries in accordance with Article 28 of the GDPR, with TAM taking close care in the selection of the relevant partner as well as during processing to avoid increasing the risk of data breaches or adverse rights persons concerned. TAM shall also ensure that the relevant partner has demonstrably taken appropriate technical and organizational measures to ensure the level of security within the meaning of Article 28 (2). 3 letter (c) and Article 32 of the GDPR so that the processing complies with the requirements of the applicable legislation, in particular the GDPR, and so as to ensure that the rights of the persons concerned are protected.

Such processing does not involve the transfer of personal data to third countries which do not guarantee an adequate level of protection within the meaning of the GDPR.

TAM retains your data in a form that allows your identification for no longer than is necessary to achieve the purpose for which the personal data are processed.

If your personal data is processed on the basis of your consent, TAM will only retain personal data after the consent has been revoked or after the expiration of the consent for as long as is necessary to prove, assert or defend TAM's legal claims. The same applies to contract processing.

If your personal data is processed in fulfillment of the legal obligation of TAM, the relevant legal regulations specify the period during which TAM is obliged to keep your personal data and related documentation. Such legislation includes in particular:

• AML law, under which TAM is obliged to keep for five years:
  - from the end of the contractual relationship with the client, the data and written documents obtained in connection with the performance of care in relation to the client and in connection with the detection of an unusual business operation,
  - from the execution of the transaction all data and written documents about the client.
• The Act on Collective Investment, which in § 55 par. 5 stipulates the obligation to keep identification data or copies of documents proving the identity of investors and clients and documents proving the ownership of funds used by investors and clients to carry out a transaction for at least ten years from the end of the transaction.
• The Securities Act, which in § 73 par. 6 stipulates the obligation to store and protect against damage, alteration, destruction, loss, theft, disclosure, misuse and unauthorized disclosure of data and copies of documents proving the client's identity and evidence of ownership of funds used by clients to perform business and contracts and other documents at least ten years after the end of the transaction.

We take appropriate technical and organizational measures to protect your personal data from intentional or negligent deletion, loss or alteration and against unauthorized disclosure of your personal data. TAM employees, as well as TAM's contractual partners who process personal data on its behalf, are bound by a duty of confidentiality, which continues even after the termination of the contractual relationship.

In connection with the processing of personal data, you have the right to file a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, Slovak Republic.

You have the right to correct incorrect personal data that concerns you or to supplement incomplete personal data. If you find that we are processing incorrect or incomplete data about you, please do not hesitate to contact us.

If your personal data is processed on the basis of consent within the meaning of Article 6 para. 1 GDPR or within the meaning of Article 9 para. 2 GDPR, you have the right to withdraw this consent at any time. However, the withdrawal of consent shall not affect the lawfulness of the processing resulting from the consent prior to its withdrawal.

As the data subject, you have the right to object to the processing of your personal data if the processing takes place on the legal basis of TAM's legitimate interests, including an objection to legitimate interest-based profiling. TAM may further process your personal data on legitimate interests only if it demonstrates the necessary legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the reasons for proving, asserting or defending legal claims.

You have the right at any time to object to the processing of your personal data for direct marketing purposes, including profiling, to the extent that it relates to such direct marketing, provided that the processing takes place on the legal basis of TAM's legitimate interests. In the event of your objection to processing for direct marketing purposes, TAM will not further process your personal data for direct marketing purposes.

As the data subject, you have the right to access your personal data. If the conditions defined by the GDPR are met, you can ask us to extract your personal data that we process about you. In certain circumstances, you may request a restriction on processing, the transfer of your personal data and you also have the right to have your personal data deleted.

You can exercise your rights in writing, by telephone via the DIALOG Live service, by e-mail to dpo@tatrabanka.sk or in person at a branch of Tatra banka, a.s. TAM may ask you to provide additional information needed to confirm your identity.