PRIVACY NOTICE REGARDING PERSONAL DATA
PROCESSING & PROTECTION
While conducting its
business, B2Kapital Portfolio Management S.R.L.(“B2KPM”), processes
personal data that concern you.
Controller: B2Kapital Portfolio Management S.R.L.
– B2KPM – receivables recovery entity registered in the register of
the debt recovery entities evidenced by the National Authority for Consumer
Protection
Registered office: Vasile Alecsandri Street, nr. 4 and
Constatin Daniel no. 11, Corp C, floor 2, District 1 Bucharest, Romania
Trade Register: J40/2666/2016
TIN code: 35698810
Web Page: http://www.b2kapital.ro
Email: B2romania@b2kapital.ro
Phone: +40 374 810 666
Fax: +40 374 810 668
Protecting your
personal data is very important to us. To do this, we undertake to provide all
due diligence to ensure compliance with the legal requirements for the
protection of personal data, in particular the requirements provided by EU
Regulation 2016/679 – General Data Protection Regulation (“GDPR”).
Based on this privacy notice, we help you to understand how we collect your
personal data, what kind of personal data we process, why are we processing
them, how we use and store them, whom we disclose them and why, as well as the
rights that you have and how you can exercise them.
Privacy notice regarding personal data processing in call center activities
Form for Complaints / Notifications / Rights Exercise
What is personal data?
Personal data is any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. A person can be identified if additional information can be obtained without excessive effort to perform the identification.
Who owns the personal data we process?
B2KPM processes the personal data of the
persons having/or who are about to enter in a contractual relationship with us,
directly or indirectly, including as a result of direct/amiable sale or public
auction of the assets registered to secure the claims, as well as the data of
those persons who visit the B2KPM website or locations. These categories of
people can include debtors, buyers, bidders, external suppliers and employees.
B2KPM also processes personal data regarding the legal and / or conventional
representatives of the persons with whom they are or are about to enter into a
contractual relationship. By way of exception, B2KPM may also process
information relating to persons whose personal data is provided by persons with
whom a contractual relationship is established, and in this case, the steps to
inform those concerned about the content of this notice regarding processing of
personal data, must be made by the person who provided the information.
How we
collect your personal data?
B2KPM may collect your data from:
- Financial-banking institutions with which you signed loan agreements, and which sold their claim rights to B2KPM or empower B2KPM to carry out in their behalf the recovery activity and to manage their claims.
- Directly from you, or in certain cases from other persons justifying a legitimate interest in connection to the agreement related to which we conduct the recovery activity.
- Persons empowered to communicate with us on your behalf, or persons submitting payments in your name.
- Public institutions and authorities or other persons or entities which perform a service of public interest (such as: bailiffs, public notaries).
- Publications and databases that are publicly available or based on a contractual relationship (external sources), in order to ensure the permanent updating of the data we hold about you, or for being able to assess your reimbursement capacity.
For example, external sources mean: public institutions and authorities, public registers and public electronic databases, information available in social media and the internet, or authorized third-party, such as, but not limited to: Directorate for Persons Evidence and Database Administration, the National Trade Register Office, the portal of courts in Romania administered by the Ministry of Justice, National Agency for Fiscal Administration, Cadastre and Real Estate Register Offices, third-party authorized to maintain databases of persons accused of terrorism or politically exposed, etc. - B2KPM contractual partners to which you have provided your data in order to conclude a contract with us or to perform the acquisition of assets registered to secure the claims under our management (for example real estate agencies or various sites promoting real estate properties that are collaterals for the claims we are managing).
- When you access the B2KPM website, records of your visit are automatically created. These records usually include the IP address, the number of hits, the web page from which you are logged in, and other data. For more information, please consult the “cookie” policy: http://www.b2kapital.ro
What personal data we process?
Your personal data that we are processing may include:
- Identification data such as: name, birthday, nationality,
personal identification number (PIN/TIN), data registered within ID documents,
place of birth, domicile address, residence.
- Contact information such as: correspondence address; phone
number; email address.
- Data regarding your financial and/or professional status, such
as: job/profession; the nature of your activity; any public function held;
employer name; income; nature of income; source / sources of income; bank
account; data on real estate and other assets you own; information regarding
existing debts (e.g., type of debit, value, interest, lender, currency, costs);
information on the debt collection situation (e.g. payment plan, costs, records
of balances).
- Signature, ID photograph and / or other documents
- Data resulting from video recording, in case you visit the B2KPM
locations, to the extent of the applicable legal provisions;
- Data regarding other data subjects who are party(s) of the
agreement representing the source of the claim managed by B2KPM (e.g.
guarantors / heirs / spouse or husband)
- Data on administrative or judicial proceedings in which you are
involved, to the extent that they are related to the claims owned or managed by
B2KPM and/or may influence the recovery conditions of such claims,
- the terms for auctioning of the assets registered to secure the
claims (e.g. enforcement, judicial liquidation, bankruptcy, reorganization,
other judicial procedures, the establishment or defence of our rights in
court); such data may include: official information regarding fraudulent /
potentially fraudulent activity, official data regarding criminal charges
and/or criminal convictions related to, for example, corruption, bribery,
financial crime, other frauds, money laundering and terrorism financing.
- Data related to the evidence of all interactions that take place
between you and B2KPM through correspondence or communication, so that we can
fulfil the legal obligation set forth in our duty by Emergency
Ordinance 52/2016 on credit agreements offered to consumers for real
estate properties (based on which we are authorized by the National Authority
for Consumer Protection).
- Personal data that you have provided us so that we can deliver
to you, debt repayment solutions that take into account your individual circumstances,
your interests and rights and your ability to repay and, as well, to comply
with legal obligations established in our charge by Emergency Ordinance
52/2016.
- Other personal data mentioned or included in the initial
contract or in the documentation related to debt or guarantees that are the
subject of the receivables we manage (such as the documentation in the legal
enforcement file, documentation from the credit file provided by the assignor,
documentation from evaluation reports, etc).
- Any other information derived from the processing of personal
data by B2KPM which are necessary to conduct the business for the purposes
mentioned below, for example the segmentation of the receivable portfolio; the
unique identifier assigned at B2KPM level for each individual debtor.
Why (for what purposes) are we processing your personal data?
B2KPM
is processing your data only to the extent that this data is related and/or may
influence the claim recovery process and in connection to the establishment,
exercise or defense of B2KPM’s rights in court or the rights of the creditors
that we represent.
In this context, the purposes for the personal data processing mainly cover the
debt collection and recovery including the following:
- Analysing your financial status and the income sources, in order
to identify repayment conditions for the debts, which fit your individual
situation.
- Conducting communication with you and proper identification of
the data subjects
- Performing the necessary legal and judicial procedures for the
debt’s recovery (e.g. legal enforcement, judicial liquidation, bankruptcy,
reorganization, intervention in other judicial proceedings, establishment or
defence of our rights in court), as well as identifying the favourable
solutions for all involved parties leading to close of outstanding financial
obligations;
- Providing the answers, you have requested by means of direct
questions, requests or complaints.
- Assessment of the opportunity to enter into a contractual
relationship or to close a transaction (e.g. analysing the exposure to the risk
involved when concluding a sale or purchase agreement, an assignment agreement,
closing an extrajudicial transaction, acceptance of an offer to buy a
collateral or participation to an auction etc.), including checks to identify,
prevent and combat money laundering, terrorism financing and fraud.
- Statistical analysis to assess the company’s activity and the
managed claim portfolios, as well as the necessity to improve the collection
and recovery methodology.
- In order to answer the requests of public authorities or to
fulfil legal requirements applicable to B2KPM;
- Reporting purposes to competent authorities, according to
regulatory provisions, as well as financial & accounting purposes,
economical/ financial and administrative purposes within B2KPM.
- For any other purposes you have authorized us, after we have
clearly presented these purposes (e.g. concluding a sale promotion agreement to
sell a real estate that you own).
We
mention that your personal data may sometimes be used by B2KPM for certain
secondary purposes (for example internal reporting and internal management,
internal / external audit, risk or quality controls, archiving – in physical
form and / or electronically, performing registration activities for company
correspondence) that are always consistent with the main purposes for which the
data was originally collected by B2KPM.
Which is the legal ground for your personal data processing?
- Meeting the legal obligations applicable to B2KPM or public
interest (e.g. consumer protection law, civil law, tax and accounting laws,
legislation on prevention and combating money laundering and terrorism
financing, legislation on the guarding of objectives, goods, values and
protection of individuals).
- Execution of the agreement in which you are a signatory, which
is the source of the claim in respect of which B2KPM holds the status of
creditor or representative of the creditor.
- Make the necessary steps and diligence, at your request, with
the purpose of concluding a sale or purchase agreement or assignment agreement
with B2KPM.
- The legitimate interest of B2KPM, its affiliated companies or of
the creditors on behalf of which B2KPM provides debt collection or recovery
services, which may concern:
- Managing the company’s activity in terms of efficiency,
profitability and safety for all interested parties and assessing the
opportunity to enter a contractual relationship (for example: centralizing
operations and managing the claim portfolios by maintaining a database,
performing statistical analysis on the portfolio of receivables and on the
efficiency of the activity, analysing and mitigating the risks to which the
company may be exposed – financial risks and / or reputation risk, planning and
development of the business strategy, development and improvement of collection
and recovery methodologies.
- Preventing fraud, potential conflicts of interest and
safeguarding the assets of the company, as well as ensuring a high level of
security both at the level of computer systems and applications, as well as
physical security;
- Establishing and/or defending company rights in court.
- Your consent, in some situations when it has been granted to us.
- In absolutely exceptional situations, in case of emergencies,
forcible cases or force majeure, your personal data can be processed to protect
your best interests or the interests of other individuals.
How we use (process) your personal data?
Data
will be processed and stored in secure environments, both on paper and
electronically, in receivables management systems and computer systems
(including e-mail), all used at company level.
In order to fulfil the above-mentioned purposes:
- We use tools that are not fully automated (human intervention is
required) to establish the reimbursement profile / evaluation / forecast. This
profiling is based on the information you provided us directly or provided to
us by the initial creditor as well as on the information obtained from free
public sources (Internet / social networking / public databases / publications
and official public information issued by public authorities / official
databases on entities and persons that are subject to international sanctions).
Thanks to these profiles, we can decide the optimal way for both parties to
recover the debt, especially if it is necessary to initiate legal enforcement
procedures or to assess the opportunity for the company to conclude a sale or
assigning contract.
- We comply with legal obligations, including the reporting
obligations, arising from national and European regulations (e.g. prevention of
money laundering and terrorist financing, obligations that arise from tax or
accounting legislation), as well as from legal regulations and instructions
issued by to the Supervisory and Control Authorities (e.g. Ministry of Finance,
National Authority for Consumer Protection, National Supervisory Authority for
Personal Data Processing, National Office for Preventing and Combating Money
Laundering, Criminal Investigation Authorities, etc.). The provision of
personal data for these purposes is mandatory.
- We use applications and computer systems on the basis of which
we can ensure the efficient administration of receivables, payment and
accounting management, as well as legal reporting
- We use internal mechanism and procedures to help prevent and
properly manage conflicts of interest, and in order to comply with the data
accuracy principle, we undertake all due diligence steps in order to
permanently update your personal data and to verify and confirm the data you we
hold you on the basis of information obtained from official sources (e.g. court
bailiffs, the Trade Registry, the portal of the courts, publications and
official information of public interest issued by public authorities) or from
free or private public sources (internet / social networks / public data /
databases provided by contractual partners of the company);
- We use your data to carry out functional activities with the
purpose of promoting and performing asset recovery related to the properties
registered as collateral in relation to our claims or the claims of the
creditor in whose name we perform the debt recovery services.
- We also use your data to carry out internal statistical analysis
to evaluate the efficiency and improvement of debt collection and recovery methodologies.
- We analyse and process your complaints, requests for exercising
your privacy rights and any other requests you address to us.
- We inform you about the current situation of your debts, the
status of the legal proceedings in progress that are related to your debts, as
well as about any data and information of interest to you regarding the debt
recovery process.
- We identify opportunities to improve our services, so that we
can provide you with better services and solutions to meet your individual needs
and situation.
Are your
data safe at B2KPM?
B2KPM
believes that the security of your personal data is very important and, in this
regard, ensures the implementation and periodic review of organizational and
technical security measures designed to protect your data against unauthorized
access, modification, disclosure or destruction. Access to your personal data
is only allowed to persons authorized by B2KPM, following an appropriate
assessment, according to specific attributions and responsibilities, and who
have previously accepted their confidentiality obligations.
If you choose to communicate with us and provide your personal
information by electronic means (e-mail), we inform you that B2KPM has taken
all necessary precaution measures to ensure the security of electronic mail by
securing its own systems.
However, please be aware that the way of communicating the
information requested by electronic mail using public networks is not fully
secure, and by choosing this option, you assume the risks related to the
electronic communication of the information (interception, modification, loss,
destruction, delays in data receival, etc.)
B2KPM implements specific
precaution measures and procedures for the proper prevention, identification
and management of potential personal data breaches, including measures
regarding your notification and the National Supervisory Authority for Personal
Data Processing, under the conditions set forth by the legal provisions in
force
Who are the recipients of your personal data?
In
the normal course of business, B2KPM may transfer your data to other
individuals or entities to achieve the processing purposes already mentioned.
This is necessary in order to take steps to execute or conclude a contract /
agreement / transaction; to solve your requests; to fulfil our legal
obligations and to achieve legitimate professional and operational interests
permitted by law.
Here
are several examples of situations when B2KPM may transfer your personal data:
- We can provide data to the creditors on behalf of which B2KPM provides recovery and debt collection services or to the creditors from whom B2KPM has acquired the claims.
- Within B2Holding Group, of which B2KPM is a subsidiary, we can transfer your personal data to other subsidiaries or companies, registered in Romania or in countries that are part of the European Economic Area.
- B2KPM will allow the access or transfer of personal data to individuals or entities outside of the European Economic Area only based on adequate safeguards and to the countries recognized by the European Commission as having an adequate level of data protection.
- Our contractual partners – we can transfer some of your personal data to our partners with the aim to improve the debt collection and recovery services.
- Underwriters of claim rights – We may transfer your personal data to other natural or legal persons to whom B2KPM or the creditors we represent are assigning their claims.
- Supervisory authorities – if required by a legal mandate, or for the application of a national or European law, we can communicate details of your personal data or transactions without the need to inform you; these communications are intended to protect your rights and freedoms or other data subjects.
- Other public authorities – we may provide your personal data to respond certain legal requirements or to third parties justifying a legitimate interest (e.g. bailiffs, public notary, courts of law).
- Transferring upon your request – we may encounter situations in which you require us to transfer your data to a Representative or Empowered person acting in your name and on your behalf (for example, financial consultants, lawyers, mediators, executors, company directors).
- We may disclose or transfer your personal data in the event of a reorganization, merger, sale, assignment, or other transfer of the company.
- Transferring to other third parties – we may transfer your personal data to other entities outside our Group, that are not public entities, such as:
- Our suppliers who offer us support in managing the receivables recovery services we provide, including in terms of promoting and capitalizing on collateral (e.g. real estate agencies, sites where we ensure the promotion of real estate for optimal use, including online property promotion platforms, lawyers, valuation experts, consulting firms, cadastral experts, accountants).;
- Providers that help us improve our services, or develop, implement or manage our business systems, infrastructure, or operational processes (for example, auditors, consultants, analysts, accounting service providers, etc.)
- Suppliers that provide us with maintenance and support, in order to operate for you the recovery services in optimal and safe conditions. For example: email service providers (e.g. Microsoft), vendors who develop / implement or manage IT applications and infrastructure, companies that provide archiving services, courier / postal service providers delivering various notifications, companies that manage the security systems implemented to ensure confidentiality / integrity and availability of your data, etc.
- Suppliers who provide us with assistance in carrying out required procedures for the legal enforcement, insolvency or other debt recovery procedures (e.g. lawyers, appraisal experts, consultancy firms, cadastral experts, accountants, real estate agencies, sites that ensure the promotion of the real estate to optimize the value of the collateral related to the managed receivables).
We
also inform you that mechanisms and procedures are put in place to ensure that
our suppliers and our contractual partners that have access to your personal
data comply with the applicable legal requirements regarding the processing and
protection of personal data.
How long we
process and store your personal data?
Your
personal data will be processed by B2KPM for a period of time absolutely
necessary for the purposes of processing, which may vary depending on the purpose
for which the data is being used.
Thus,
B2KPM will process your data throughout the claim recovery process and store it
for a period of 5 years from the time the debt is transferred to another
underwriter and / or after the full recovery of the claim and / or the
completion of the legal enforcement, unless the law stipulates otherwise.
In
the case of data processed for accounting purposes, your data will be stored
for a maximum of 5 years and 10 years respectively, in accordance with
statutory accounting regulations.
For
video recordings, in case you visit B2KPM locations, the data storage period is
up to 30 days from the date when the recording has taken place, with the
possibility of prolongation in case of official requests submitted by competent
public authorities.
Personal
data that is processed in order to respond to requests for a period of 3 years
from the last communication, according to the general prescription term
provided by the Civil Code, with the purpose of ensuring the establishment,
exercise or defense of certain rights in court.
What are your rights and how can you exercise them?
You
can exercise at any time the following rights, within the limits and conditions
set forth by the applicable legislation in the field of personal data
protection:
- Right to be informed –
you may request at any time information and details on how we process your
personal data, which will be provided to you verbally or in writing
through the specifically requested channel.
- Right of access to your data – You may at any time request the access to your
personal data held by B2KPM through by which we will inform you on the
processing of your personal data, i.e. the confirmation that your personal
data is processed or not by B2KPM, the purposes, the grounds and the
conditions of the processing.
- Right to data rectification – You can request anytime to correct your
personal data, including by filling in a complementary statement, so that
we can ensure that, at all times, your data is actual, accurate and precise.
- Right to object to data processing – for reasons related to your particular
situation, you may oppose the processing of your personal data based on
the legitimate interest of B2KPM and / or other persons we represent, or
of the processing carried out in the public interest. In this case, B2KPM
will still be able to process your personal data only if there are
legitimate and compelling reasons that justify processing and prevail over
your interests, rights and freedoms as the data subject, or if the purpose
is to establish, exercise or defense of a right in court.
- Right to data restriction – You have the right to request the restriction
of processing in the following situations: (i) you have challenged the
accuracy of your personal data that we process, so that, for the period
necessary to verify their accuracy, your data will be restricted from
processing;(ii) the processing of your personal data was considered
illegitimate and you opposed the deletion of the data, requesting instead
the restriction of the processing; (iii) you opposed the processing of
your personal data, so that during the verification of the validity of the
processing grounds, your data will be restricted; (iv) although the data
retention period has expired, you have expressly requested us to retain
your data for establishing, exercising or defending a right in court. In
the case of restriction, your personal data may be processed by storage.
Other processing operations will be possible only for: (i) establishing,
exercising or defending a right of the B2KPM in court; (ii) to protect the
rights of another natural or legal person; (iii) based on your express
consent or (iv) to protect a public interest. If your request for data
restriction has been complied with, we will inform you accordingly, before
removing the processing restriction.
- Right to data erasure –
You may ask us to delete your personal data that we process, and we will
undertake all the necessary steps to do so if: (i) it is no longer
necessary to meet the purposes for which it was collected; (ii) you
withdraw your consent and the processing was done on the basis of this
consent, and there is no other legal basis for continuing the processing;
(iii) you opposed the processing of the data and there are no legitimate
reasons for further processing; (iv) your personal data has been processed
without a valid legal basis for doing so. We also inform you that personal
data for which you exercised the right to erase, may still be processed in
the following situations: (i) for the fulfilment of legal obligations
stipulating the processing, (ii) as well as for establishing, exercising
or defending a right in court.
- Right to data portability – In the case of your personal data that we are
processing by automatic means, based on your express consent or for the
execution of a contract between you and B2KPM, you may request us to
provide you such data in a structured, and automatically readable format,
which you may send to another operator, or you may request us to send the
data directly to that operator (concerned to the extent that this is
technically possible).
- Right to withdraw your consent – in cases where processing is based on your
consent, it can be withdrawn at any time. Withdrawal of your consent will
have effects only for the future processing. The processing performed
before the withdrawal of consent, remains valid.
All these rights can be exercised by submitting to us a official
written request in this regard, to the contact details listed below and we will
respond you within 30 days or, if the request requires a more complex analysis,
this deadline may be extended by another 60 days, in this case you will be
informed accordingly, the reason for extension will also be provided.
If you are addressing your request electronically, the requested
information will be provided electronically, if possible, or through another
format or channel requested by you.
B2KPM may request additional information to confirm your
identity before we can share your personal data or act in connection with the
exercise of the above rights.
We also inform you that, in justified cases, the law allows us
to refuse to act according to your requests, for example if the purposes for
which we process your data have not been fulfilled, and the processing is not
based on your express consent, or where your claims are excessive, by their
repetitive or obviously unfounded character. Even in this case, we will give
you a written explanation of such a refusal.
If you are convinced that your personal data is being processed
incorrectly and does not comply with the legal requirements, you may file a
complaint with the National Supervisory Authority for Personal Data Processing
at:
No. 28-30, Gheorghe Magheru Avenue, county 1, postal code 010336, Bucharest,
Romania, phone: +40318059211;
e-mail: anspdcp@dataprotection.ro or the web page: Data Protection
RO
Contact details of B2KPM regarding personal data
If
you have any questions or requests regarding your rights described above,
please contact us:
- Address: Bucharest, no. 4 Vasile Alecsandri street, Building C, 2nd floor, 1st county, Romania,
- Email: B2romania@b2kapital.ro
- Data Protection Officer:
- Email: privacy@b2kapital.ro
- Telefon: +40 374885637
- Fax: +40 374810668
