Data Protection

Information pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR) on the processing of personal data

We hereby inform you about the processing of your personal data and the data protection claims and rights to which you are entitled. The content and scope of the data processing depends largely on the products and services you have requested or which are agreed with you.

Who is responsible for data processing and whom can you contact?

Responsible for data processing:
Raiffeisen Bank International AG (hereinafter referred to as "Bank" or "RBI")
Am Stadtpark 9
1030 Vienna
Telephone +43 1 71707-0
E-Mail: datenschutz@rbinternational.com

Contact data of the Data Protection Officer of the Bank:

Daniela Bollmann
Phone +43 1 71707-8603

E-Mail: datenschutzbeauftragter@rbinternational.com

 

Which data are processed and from which sources do they come?

We process the personal data that we receive from you as part of our business relationship. In addition, we process data that we have legitimately received from credit bureaus (CRIF GmbH), debtor directories (Kreditschutzverband von 1870) and from publicly available sources (eg business register, association register, land register or media) or that are provided legitimately by other companies affiliated with the bank.

Personal information includes your personal details and contact information (e.g., name, address, date and place of birth, nationality, etc.) or identity and travel document information (such as signature sample, ID information). In addition, this may include payment and clearing data (eg payment orders, turnover data in payment transactions), credit data (eg type and amount of income, recurring payment obligations for children's education costs, loan repayments, rents), data on marketing and distribution, credit transactions, image and / or sound recordings (eg video and telephone recordings), electronic log and identification data (apps, cookies, etc.), financial identification data (data from credit, debit, prepaid cards) or AML (anti-money laundering) and compliance data and other data comparable to the above categories.

For which purposes and on which legal basis are data being processed?

We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Austrian Data Protection Act 2018.

to fulfill contractual obligations (Article 6 (1) (b) GDPR)

The processing of personal data (Art 4 No. 2 GDPR) is carried out for the provision and brokering of banking, financial services and insurance, leasing and real estate transactions, in particular for the performance of our contracts with you and the execution of your orders as well as for carrying out pre-contractual measures.

The purposes of the data processing are based primarily on the specific product (for example, account, credit, building society savings, securities, deposits, brokerage, debit and credit cards) and may, among others, contain analysis of your financial needs, consulting, asset management , and execution of transactions.

Such data processing takes place, for example, in connection with debit cards (also called "ATM cards"), which RBI makes available to you and with which you are in particular able to execute payment transactions with merchants at POS terminals ("ATM cash registers") and on the internet ( E-commerce payments in the online shop), to withdraw cash at designated ATMs (also called "Bankomat"), and to perform transactions between debit cards ("ZOIN"). Such transactions must be assignable to the banks of the cardholder and the payee in order to enable the settlement of the transactions among each other. Almost all institutions operating in Austria have concluded a contract with the PSA Payment Services Austria GmbH (PSA) for this purpose (PSA contract). The purpose of such PSA contract is to regulate the mutual rights and obligations between each institution and PSA. Moreover in the PSA contract the institutions agree on the conditions under which transactions (eg withdrawals) of foreign bank customers in their own cash dispensers or payment transactions at POS terminals are accepted. PSA is responsible for the technical handling of transactions with usable cards with the institutes. In addition, PSA also operates its own ATMs. In order to process transactions and settle accounts between institutions, institutions must process data of their own clients. The legal basis of the data processing are a variety of laws, such as the Banking Act, the Payment Services Act, the Financial Market Money Laundering Act, etc., to which the contracting parties of the PSA contract are committed and the contract between the institution and its customers (eg current account agreement, card agreement). To exercise your rights in connection with the data processing referred to in this paragraph, please contact RBI.

For credit cards, the exchange of personal data, especially with merchants and account-holding banks is necessary for the execution of the credit card transaction.

Specific details for the purpose of the data processing mentioned herein can be found in the respective contractual documents and terms and conditions.

to fulfill legal obligations (Article 6 (1) (c) GDPR)

The processing of personal data shall only be carried out for the purpose of fulfilling various legal obligations (such as the Banking Act, Financial Market Money Laundering Act, Securities Supervision Act, Stock Exchange Act, etc.) as well as due to regulatory requirements (eg the European Central Bank, the European Banking Authority, the Austrian Financial Market Authority, etc.). which the Bank is subject to as an Austrian credit institution. Examples of such cases are:

• Reports to the Money Laundering Reporting Office in certain suspicious cases (§ 16 FM-GwG, Financial Market Anti-Money-Laundering Act)
• Providing information to the FMA according to the WAG (Securities Act) and the BörseG (Stock Exchange Act), eg to monitor compliance with the rules on market abuse of insider information
• Provision of information to financial penal authorities in the context of financial criminal proceedings for an intentional financial offense
• Provision of information to federal tax authorities acc. to § 8 of the Kontenregister und Konteneinschaugesetz (Account Register and Account Inspection Act )
• Assess and manage risks
• Credit check (credit scoring) on lending
  Credit scoring uses statistical peer groups to assess default risk among loan applicants. The calculated "score value" is intended to enable a prognosis with which probability a requested loan is likely to be repaid. This score will be calculated using your master data (marital status, number of children, length of employment, employer), general financial information (income, assets, monthly expenses, amount of liabilities, collateral, etc.) and payment history (proper loan repayments, Reminders, data from credit bureaus). If the default risk is too high, the loan application will be rejected.

as part of your consent (Article 6 (1) (a) GDPR

If you have given us your consent to the processing of your personal data for specific purposes (eg, disclosure of data to recipients named in the consent, notifications via the ELBA mailbox, lotteries), processing will only take place in accordance with the scope and for the purpose as set out in and agreed in the consent form. A given consent may be withdrawn at any time with effect for the future.

Examples of such cases are the evaluation of your data (such as name, age, account turnover data and the like) and the query of external credit databases (Kreditschutzverband von 1870, CRIF GmbH), in order to anticipate your credit rating for credit offers that  RBI provides to you.

to safeguard legitimate interests (Article 6 (1) (f) GDPR) in general

If necessary, data processing may be carried out to protect legitimate interests of the Bank or third parties. In the following cases, data processing takes place to safeguard legitimate interests. Examples of such cases are:

• Consultation and exchange of data with credit bureaus (for example Österreichischer Kreditschutzverband 1870) for the determination of creditworthiness or default risks
• Review and optimization of needs analysis and direct customer approach procedures
• General infomails and newsletters on service, products and related market information
• Video surveillance to collect evidence in case of crime or to prove transactions and deposits  (such as ATMs) - especially to protect customers and employees
• Certain phone records (for quality assurance or complaint cases)
• Measures for business management and further development of services and products
• Measures to protect customers and employees as well as to secure the property of Raiffeisen Bank International and to prevent, contain and investigate criminally relevant conduct.
• Bank areas that are publicly accessible are monitored (in particular cash desks, safe rooms, foyers, corridors, staircases, elevator areas, interior / exterior entrance areas, facades, garage) as well as automated cash dispensers (also outside the bank building)
• Certain phone records (for quality assurance or complaint cases)
• Measures for controlling business and further development of services and products
• Measures to protect customers and employees as well as the property of the Bank
• Measures in Fraud Transaction Monitoring, against anti-money laundering, terrorist financing and offending crime. At the same time, data evaluations (among others in payment transactions) are carried out. These measures also serve for your protection.
• Data processing for law enforcement purposes
• Asserting legal claims and defense in legal disputes
• Ensuring the IT security and IT operations of the Bank
• Prevention and investigation of criminal offenses

to safeguard legitimate interests (Article 6 (1) (f) GDPR) in the marketing of our services

The evaluation of your data processed at RBI for the purpose of

• providing you with individual information and offers from RBI and the companies listed below, whose products and services RBI arranges or provides;
• developing services and products that are tailored to your interest and life situation, as well
• further improving the usability of our service facilities such as My ELBA, apps, self-service devices and others
• is based on our legitimate interest for the marketing of our services. The evaluation of the data for this purpose takes place only as long as you have not objected to this.

The following data, which either RBI itself has collected itself or which you have transmitted to RBI, will be evaluated:

• Personal data / master data
  Gender, title, name, date of birth, country of birth, citizenship, family status, tax status, education, occupation, employer, credentials such as driving license data, income data, address and other contact information such as telephone number or e-mail address and postal address, geographical location information, securities risk class according to investor profile, housing situation such as rent or property and kind of real estate, family relationships (excluding personal data of these persons), number of persons in the household, data disclosed during consultations such as hobbies and interests or planned acquisitions and car, household bills, internal ratings, such as the assessment of the revenue and expenditure situation and the asset and liability situation by RBI.
   
• Product and service data of RBI
  Data on the services of RBI which you use including
  • means of payment used by you, such as debit and credit cards,
  • debits and credits and arrears on accounts and loans
  • interest rates and charges or charges charged in connection with these services, - payment behavior, including the options you can use to place your order (for example My ELBA),
  • payment transactions incoming and outgoing, recipients and senders, payment orders transmitting intermediaries, amount, purpose and payment references, payer references,
  • the frequency and type of tansfers, in cashless payments, the data of the traders or service providers receiving the payments and information on transactions concluded with them,
  • Data from My ELBA (these are usage and content data from My ELBA, the My ELBA Financial Planner and the My ELBA Mailbox),
  • Savings and securities transactions and custody accounts, including details of securities held
     
• Device and contact center data (telephone service incl. voice-control- computer)
  Frequency, dates and locations of use of self-service devices and contact centers (telephone service including voice control computers) or telephone services of RBI, and audio and video recordings conducted in connection with the use of these services by reference to the respective legal basis (eg within the framework of the participation agreement to My ELBA).
   
• Data from services, website and communication
  Data relating to the use of electronic services and websites, functions of the websites and apps as well as e-mail messages between you and RBI, information about viewed websites or content and links accessed, including external websites, content response time or download errors, and the usage period of websites and information on the use and subscriptions of newsletters of RBI. This information is collected by way of using automated technologies, such as cookies or web beacons (counting pixels used to register e-mails or websites), or web-tracking (recording and analysis of surfing behavior) on the website or My ELBA and using external service providers or software (for example Google Analytics).
   
• Online queried account and custody account data
  Data on information about accounts and depots requested online via service providers, data of these service providers, content and purpose and frequency of queries and content of the given information.
   
• Technical data of end-user-devices
  Information about devices and systems used for accessing websites or portals and apps or other means of communication, such as internet protocol addresses or types and versions of operating systems and web browsers, and additional device identifications and advertising identifications or location information and other comparable data on devices and systems.
   
• Data on user-generated content
  Information uploaded on RBI websites or apps, such as comments or personal messages and photos or videos and the like.
   
• Product and service data of mediated companies
  Data of the products and services provided by RBI to companies affiliated with RBI: Raiffeisen Bausparkasse Gesellschaft mbH, UNIQA Österreich Versicherung AG, Raiffeisen Kapitalanlage-Gesellschaft mbH, Raiffeisen-Leasing GmbH, Raiffeisen Reisebüro Ges.mbH, Valida Holding AG, Raiffeisen Immobilien Vermittlung GmbH, Raiffeisen Centrobank AG, Raiffeisen Vorsorgewohnungserrichtungs Ges.m.b.H., Raiffeisen Factor Bank AG, Card Complete Service Bank AG, Raiffeisen Analytik Ges.mbH, Raiffeisen Beratung Direkt Ges.mbH, Raiffeisen Club and Zentrale Raiffeisen Werbung.

These data include the personal data and the detailed data of the products, such as the item of transactions, terms, interest, charges, debits, credits and arrears.

If the products brokered are payment instruments, the analysed data also includes: payment behavior, incoming and outgoing payment transactions, recipients and senders, payment service providers, amounts, purpose, payment references, originator references, frequencies and types of money movements, cashless payments, data of the dealers or service providers and information about these closed deals.

Who receives my data?

Within the Bank, those units or employees, subsidiaries receive your data, as required by them to fulfill their contractual, legal and / or regulatory obligations and legitimate interests. In addition, contractors (especially IT and back-office service providers) will receive your data as long and to the extent as they need the data to perform their respective service. All processors are contractually obliged to treat your data confidentially and to process the data for the provision of the respected services.

If there is a legal or regulatory obligation, public authorities and institutions (European Banking Authority, European Central Bank, Austrian National Bank, Austrian Financial Market Supervisory Authority, tax authorities, etc.) as well as our Bank and auditors may be the recipients of your personal data. With regard to a data transfer to other third parties, we would like to point out that RBI as an Austrian bank is obliged to observe banking secrecy in accordance with § 38 BWG and therefore is obliged to keep confidentiality regarding to all customer-related information and facts that have been entrusted to us or made available due to the business relationship. RBI may only disclose such personal information, if you have exempted us in writing and expressly from banking secrecy, or if the Bank is legally obliged by law to such a disclosure. The recipients of personal data in this context may be other credit and financial institutions or similar entities. We disclose to such recipients only those data as we need in order to conduct the business relationship with you. Depending on the respective contract, these recipients may be eg correspondent banks, stock exchanges, custodian banks, credit bureaus or other companies affiliated with the Bank (due to regulatory or legal obligation).

Data from the video surveillance of RBI can be used on a case by case basis by competent authorities or the court (for evidence in criminal matters), security services (for security purposes), courts (to secure evidence in civil cases), employees, witnesses, victims (under the enforcement of their claims), insurance (exclusively for the settlement of insurance claims), lawyers and other bodies for the purpose of law enforcement.

Is there a data transfer to a third country or to an international organization?

A transfer of data to third countries (outside the European Economic Area - EEA) will only take place if this will be necessary for the execution of your orders (eg payment and securities orders), or if so required by law or if you have given us your explicit consent.

In addition, data may be transferred to RBI's subsidiaries or processors in third countries or subcontractors of RBI's processors in third countries. These are obliged to comply with European data protection and security standards. Information about this can be obtained from us.

Payments and cash withdrawals with debit and credit cards can lead to the necessary involvement of international card organizations and thus possibly to data processing by these card organizations in third countries. For example, the data protection measures taken by MasterCard ("Binding Corporate Rules") are available at
www.mastercard.us/resources/mccom/en-us/documents/mastercard-bcrs-february-2017.pdf.

If so required by law, we will separately provide you with further details.

 

How long will my data be stored?

We process your personal data, as far as necessary, for the whole duration of the entire business relationship (beginning with the conclusion of a contract, its execution and ending with its termination) as well as in accordance with the mandatory storage and documentation obligation as required by law, in particular pursuant to the following Austrian legal provisions: the Companies Code (Unternehmensgesetzbuch, UGB), the Federal Fiscal Code (Bundesabgabenordnung, BAO), the Banking Act (Bankwesengesetz BWG), the Financial Market Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) and the Securities Supervision Act (Wertpapieraufsichtsgesetz, WAG).

Moreover,  the data storage is also subject to the statutory limitation periods, eg under the Austrian General Civil Code (Allgemeines Bürgerliches Gesetzbuch, ABGB) and may in certain cases last up to 30 years (the most relevant limitation period in practice is 3 years).
Data from the video-surveillance of the Bank will be deleted in principle after 15 days if no longer required for the purposes of video surveillance.

Which data protection rights do I have?

You have the right to access, rectification, erasure or restriction of the processing of your stored data, a right to object to processing and a right to data portability in accordance with the requirements of data protection law. Complaints can be addressed to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria, www.dsb.gv.at.

Am I obliged to providing data?

As part of the business relationship, you must provide us with all personal information that is necessary to enter into and to maintain the business relationship with you, and also those data that we are required by law to collect. If you do not provide us with these data, we will generally decline either to conclude or to complete the contract, or we will be unable to execute an existing contract or we would be forced to terminate such contract. However, you are not obliged to give your consent to the processing of data if such data is not necessary for the performance of a contract or is not required by law or regulation.

Is there automated decision-making?

In general, we do not use fully automated decision-making within the meaning of Article 22 GDPR in order to establish and/or to conduct a business relationship. If we should use such procedures on a case-by-case basis, we will inform you accordingly by separate notice as so provided for by law.

 

COOKIES

Technically required cookies

These cookies are necessary for the basic functions of the website and are used to store your user settings and preferences (e.g. saving your input in form fields to protect against unwanted loss) as well as to enable and secure authentication or ELBA sessions. These cookies assign a randomly generated ID to your browser. The data processing is based on our legitimate interest in the secure design and convenient use of our contents and generally in the provision of our services on the specific website visited. No information about you is collected which is used for marketing and statistical purposes. Furthermore, we may use information for fraud prevention and to ward off service overloading requests (denial of service attacks). This category of cookies cannot be deactivated.

Anonymous statistics

This information is anonymized immediately after the cookie is set respectively the website is visited and enables us to gain knowledge about the use, functionality and user-friendliness of websites and apps, to advertise our content, to place it in a targeted manner and to improve it continuously. We carry out range and performance measurement: We obtain information about the number of website visitors, page views and the usage habits of visitors to a website or app. 

You can object to this processing at any time with effect for the future by using this selection option, your browser settings or plug-ins (e.g. http://tools.google.com/dlpage/gaoptout?hl=de). Processing will be carried out until you object to it.

Personalization cookies

We use personal cookies, pixels and scripts as a way to evaluate the effectiveness and success of our marketing tools and to better align them. These tools are used to draw conclusions on your interests and needs based on the analysis of your behavior, as well as to segment users with the same or similar interests and needs so that we can offer you advertising or content that is target-oriented and tailored to your needs and interests. The processing is carried out for a maximum period of three years or until withdrawal. Withdrawal of consent does not affect the lawfulness of the processing that took place until withdrawal.

This declaration of consent applies to the controller named in the imprint and companies associated with this controller, which are linked in the introduction above.

 

Record on the web server

Every time a user accesses our website and every time a file is retrieved or attempted to be retrieved from the server, data about this process is stored in a log file. For us it is not directly recognizable, which user called upon which data. We also do not try to collect this information. This would only be possible in legally regulated cases and with the help of third parties (e.g. Internet service providers). In detail, the following data record is stored for each retrieval: The IP address, the name of the downloaded file, the date and time of the download, the amount of data transferred, the message as to whether the download was successful and the message as to why a download may have failed, the name of your Internet service provider, if applicable the operating system, the browser software of your computer and the website from which you are visiting us.

The legal basis for the processing of personal data is our legitimate interest (in accordance with Art 6 (1) (f) GDPR). This is to detect, prevent and investigate attacks on our website.

In addition, we process your personal data in special cases on the basis of the legitimate interests of us or legitimated third parties for legal proceedings or on behalf of legally authorized authorities or courts.

We generally store data for a period of three months to guarantee the security of our homepage. A longer storage only takes place as far as this is necessary to investigate determined attacks on our website or to pursue legal claims.

For the above-mentioned purposes, we have your personal data processed by the following service providers: Raiffeisen Informatik GmbH, GRZ IT Center GmbH, Raiffeisen Informatik Center Steiermark GmbH.

 

Raiffeisen Web Analytics

This website uses the "Raiffeisen Web Analytics" software for anonymous analysis of website usage. Your IP address will be made anonymous for analysis purposes by deleting the last 8 bits immediately when a website is accessed. For this purpose Cookies are used which enable an analysis of the website usage by users. Through the evaluation of this data valuable knowledge about the needs of these users can be gained. This knowledge contributes to further improving the quality of our offer. You can prevent this by setting up your browser in a manner that no Cookies are saved.

Upon others we collect the following data: visited websites, date and time of the visit, length of stay, browser version, screen resolution, operating system, the country and the referrer, this is the previously visited page from which a page was accessed.

GRZ IT Center GmbH acts as IT service provider for us, processing your data only within the scope of the provision of services.

 

Google Maps

On our website we use the service Google Maps API. This service is a service of Google, Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. By integrating the service on our website, at least the following data are transmitted to Google, Inc.: IP address, time of visit of the website, screen resolution of the visitor, URL of the website (referrer), the identification of the browser (user agent) and search terms. The data transfer is independent of whether you have a Google account that you are logged in or whether you do not have a Google user account. If you are logged in, the data will be assigned with your account. If you do not wish assignment to your profile, you must log out before activating the button. Google, Inc. stores this data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. You have the right to object to the creation of these user profiles, whereby you must contact Google Inc. to exercise this right. For more information about the purpose and scope of data collection and processing by Google, Inc., please contact www.google.at/intl/de/policies/privacy/. We do not process the affected data.

 

26.03.2020