The Bank processes your personal data on the following legal grounds:
(In certain cases, processing may be based on more than one ground)
A. Performance of a contract
In the performance of an existing contract between you and the Bank, as well as in taking pre- contractual steps. Processing is done in order to provide you with the product or service you have applied for, as well as for their use during the term of the contract. This includes:
- Performing transactions, provision of the requested products and services in accordance with the applicable terms;
- Performing analyses;
- Notifications on the performance;
- Notifications on important changes in the transactions or terms of use of the product/service.
B. Legal obligation
Compliance with our legal obligations such as:
- identifying you, as well as verifying your identification in accordance with the Law on Measures against Money Laundering;
- performing automatic exchange of financial information under the Tax and Social Insurance Procedure Code;
- providing information to state bodies and institutions such as the Bulgarian National Bank (BNB), National Social Security Institute (NSSI), National Revenue Agency, courts, prosecution, State Agency for National Security and others, in compliance with the relevant legal procedures;
- performing creditworthiness assessment, and risk assessment and management in the Bank and the Group of First Investment Bank AD.
As a credit institution, we comply with a number of regulations that, in addition to the above, include laws such as the Law on Credit Institutions, the Markets in Financial Instruments Act, the Law on Consumer Credit, the Law on Consumer Real Estate Loans, the Payment Services and Payment Systems Act, the Law on Measures Against Terrorist Financing and Proliferation of Weapons of Mass Destruction, the Law on Obligations and Contracts, the Civil Procedure Code, the tax and accounting legislation, as well as the regulations related to the supervision of the Bank’s activity, e.g. by the BNB and Financial Supervision Commission.
C. Legitimate interest
We process your personal data for the purposes of the legitimate interests pursued by the Bank or by a third party, for example in cases such as:
- review and optimization of analytical needs and procedures for direct customer access – e.g. testing the achieved goals and ways to improve products in line with customer requirements, improving customer service;
- market research, advertising and polls conducted when you have not objected to the use of your data;
- video surveillance to collect evidence of criminal acts, or to provide proof of transactions (for example ATM transactions) and to protect customers and employees;
- phone records (e.g. of alerts, notifications of lost payment instruments, provision of information, contact center inquiries);
- sending communications about the products and services used through SMS, letters, emails, telephone calls and others, not related to marketing purposes;
- measures related to business management, improvement of services and products and customer retention;
- measures to protect employees, customers and the property of the Bank (such as the Bank's access regime);
- prevention and investigation of fraud and criminal acts;
- ensuring the IT security and IT operations of the Bank;
- complaints and claims, disputes, including in court proceedings;
- risk Management in First Investment Bank AD (e.g. management of operational risk in carrying out transactions, credit risk in determining total exposures, etc.).
D. Task carried out in the public interest
In case we carry out tasks in the public interest or in the exercise of official authority vested in the controller. In such situations, the Bank may assist a public authority by sharing personal data for the purpose of preventing or detecting a criminal offence.
E. Your consent
In cases where we process your data based on your consent, processing shall be within the scope and for the purposes set forth in your consent. Any given consent may be revoked at any time under the terms of the document “Procedure for the exercise of rights related to personal data” (Appendix 1).
The Bank processes personal data after you have given consent, for instance, in cases of electronic signing of documents through a specialized device in the Bank’s office (biometric data – behavioral characteristics), in cases of remote identification, e.g. video identification, including performed by external qualified trust services provider (biometric data – facial characteristics). After consent, we process your data (incl. list of names and telephone numbers) from your contacts list (Contacts) in your mobile device for the purpose of executing Blink P2P transfers by mobile number.
For bank cards without the “Click to Pay” feature automatically enabled by the issuer, its activation and the provision of the necessary personal data to third parties participating in “Click to Pay” (name, email address, mobile phone number, address, card details) are carried out based on your consent given through the “My Fibank” mobile application, in the “Click to Pay” menu
