Privacy policy

1.1. This Privacy Policy (hereinafter referred to as the “Policy”) governs key principles of personal data processing at Finora Bank UAB (hereinafter referred to as the “Bank” or “we”), lists the rights of Customers and explains, how these rights may be enforced and exercised, as well as explains what measures are applied to maintain security of personal data.

1.2. We will apply this Policy when a customer relationship is established between us (hereinafter referred to as the “Customer”, or “you”), or when you use, have used or intend to use our Services, use our Website, our Digital Channels or visit our Office.

1.3. Your personal data shall be processed in accordance with the EU General Data Protection Regulation (GDPR), the Law on the Legal Protection of Personal Data of the Republic of Lithuania and other legal acts governing the legal protection of personal data, the activities of financial institutions and the services they provide.

1.4. This Policy applies when a Customer:

1.4.1. uses, has used or has expressed an intention to use or interest in using the services or products of the Bank;

1.4.2. visits our Website;

1.4.3. is a principal, founder, partner, management official, ultimate beneficial owner, shareholder, member of the board of directors or other management body;

1.4.4. Is a proxy or representative of the Customer (whether corporate or private);

1.4.5. is indirectly related to our services (e.g. is the Customer’s spouse, collateral provider, guarantor, seller of the leased object (property), the data was provided by the Customer, etc.);

1.4.6. is an agent of any third party who is engaged in the legal relationships with the Bank (by way of example, an agent of a company that provides services or sells goods to the Bank);

1.4.7. has provided his/her Personal Data or the Bank has received Personal Data for other legitimate reasons (for example, Personal Data of third parties in documents submitted to the Bank by the Customer, etc.).

1.5. For the purposes of this Policy, the following definitions shall apply:

1.5.1. Personal Data means any information that allows direct or indirect identification of the Customer.

1.5.2. Bank’s website (homepage) – https://finorabank.eu/en/.

1.5.3. Data Protection Legislation means any legislation on the protection of Personal Data applicable to the Bank, including Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation (GDPR)) and national legislation implementing and supplementing this Regulation.

1.5.4. DPO means Data Protection Officer.

1.5.5. Customer means any natural person who uses, has used, has expressed an intention to use or is otherwise related to the services provided by the Bank, the users of these services or the business relationship with the Bank (hereinafter referred to as the Customer).

1.5.6. Finora Bank, or Bank, or Data Controller means Finora Bank, UAB, a private limited liability Finora Bank, which is a licensed financial institution, holding specialised bank licences issued by the ECB, established and operating under the laws of the Republic of Lithuania, code: 305156796, address: Žalgirio str. 90, LT-09303 Vilnius, the Republic of Lithuania, including its Estonian branch.

1.5.7. Group means Finora global group of companies, consisting of Finora Bank UAB, Finora Bank UAB Estonian branch, AS Finora Group.

1.5.8. Services mean any service, advice, product of the Bank provided or rendered at Bank’s office, on the Bank’s website, using the Bank’s internet banking, telephone, video transmission or other means.

1.5.9. Applicable Laws mean the laws and regulations applicable to the Bank, including, but not limited to, laws governing anti-money laundering and anti-terrorist financing activities, bank secrecy, taxation, accounting, payment services and the provision of payment services, lending and other financial activities.

1.5.10. All other terms used in the Policy shall be understood as defined in the GDPR and the Law on the Legal Protection of Personal Data of the Republic of Lithuania, Personal Data Protection Act of the Republic of Estonia and other Applicable laws.

2.1. When processing your Personal Data the Bank shall comply with the following principles:

1. 2.1.1. The Personal Data shall be processed lawfully, legally, reasonably, transparently and fairly.

1. 2.1.2. Personal Data shall be collected and processed only for specified, explicit and legitimate purposes.

1. 2.1.3. Minimisation of Personal Data processed.

1. 2.1.4. Accuracy and relevance of Personal Data.

1. 2.1.5. Limited retention of Personal Data.

2.1.6. Personal Data Safety and Security.

3.1. The Bank collects and processes the following categories of Personal Data:

3.3. The Bank collects data on minors only if the minors use the Bank’s Services or if the data on minors is provided to the Bank by the Customer on legitimate grounds when using any of the Bank’s Services.

3.2. The Bank usually does not process Special Categories of Data (i.e. data relating to the health, ethnic origin, religious, political or philosophical beliefs, trade union membership, data concerning sex life or sexual orientation of Customers), except where required by Applicable Law or in special cases, for example, where the Customer discloses such data himself/herself in the course of using the Bank’s services (by specifying it in a payment order or similar).

4.1. Onboarding of the Customers for the Services of the Bank

4.2. Provision of the Services

4.2.1. The main purpose of the processing of Personal Data by the Bank is to prepare, draft, execute and exercise the conduct under the agreements with the Customers who use or intend to use the services of the Bank. For this purpose, Personal Data shall be processed on the following grounds, for the following purposes and to the following extent:

4.3. Debt collection, recovery and management

4.4. Marketing

4.5. IT security and communications

4.6. Accounting, tax administration, other

4.7. Transfer of Bank’s business or getting funding for its activities

4.8. Statistics, analytics, Customer behaviour research

4.8.1. In order to monitor, evaluate, analyse, improve and further the quality of Services provision, Website, offer new Services or new quality Services, increase the availability of Services, improve the security of use of the Services, improve user experience when using the Services, we analyse various statistical data. 

4.8.2. We use automated data analysis tools based on the latest scientific achievements to conduct these data research, introduce and use data analysis and processing modules and methods.

4.8.3. Data analysis actions, performed for the purposes described in this chapter, do not have any legal or comparable significant effect on you.

4.9. Recruitment

4.10.2. The Bank is also obliged to fulfil other legal obligations, for example, processing of the list of shareholders of the Bank, processing of data related to the management members, processing of the data related to the Finora Group companies and their management members, during which it receives and processes Personal Data such as the name, surname, personal identification number, residential address and the number of shares held by the shareholder and other related information.

4.9.1. Without the submission of candidate’s personal data, the Bank will not be able to assess candidate’s suitability for vacant position.

4.9.2. Candidates are advised not to provide excessive information to comply with personal data protection requirements.

4.9.3. The Bank may contact candidate’s former employers that were indicated for their recommendations and may ask them about candidate’s professional skills and qualifications. The Bank may request this information from the current employer of the candidate only after receiving candidate’s separate consent.

4.9.4. In fulfilment of the legal obligation stipulated in the Law on Banks of the Republic of Lithuania, the Bank may ask the selected candidates to provide information related to their criminal record.

4.10. Other cases when the Bank may be processing Personal Data

4.10.1. The Bank also processes Personal Data where it is necessary to protect the vital interests of the Customer or another natural person. On these grounds, Personal Data may be processed, for example, in the event of acute health problems or accidents, for health security and safety at work, occupation and professional risk management, monitoring and alerting purposes, for the prevention or control of communicable diseases and other serious health threats.

6.1. The Bank’s Personal Data processing activities also include the disclosure of Personal Data to Data Recipients such as public authorities, service providers, vendors and suppliers of the Bank, payment service providers and business partners. The Bank shall not disclose more Personal Data than is necessary for the purpose for which the Personal Data is provided and only in accordance with the requirements of the Applicable Laws and the legislation governing the protection of Personal Data.

1. 6.2. The Data Recipients may process Personal Data in their capacity as Data Processors and/or Data Controllers. Where the Data Recipient processes Personal Data in its capacity as Data Controller, the Data Recipient shall be responsible for informing Customers of such processing of Personal Data by it.

1. 6.3. The Bank has involved various service providers (e.g. providers of server hosting, data centres, cloud computing, support, IT, payment, identity verification, document validity verification, intermediation, payments, audit, accounting, legal, tax advisory services, administration of damages, debt collection, analytics, direct marketing, e-mail, SMS messaging, customer service, call centre and other services).  Data processors can process your personal data only according to our instructions. Besides, they must ensure security of your data in accordance with applicable legal acts and agreements concluded with us.

1. 6.4. The Bank shall provide Personal Data to Data Recipients, which act as independent data controllers, such as:
   1. 6.4.1. Public bodies and institutions, and other persons performing the functions assigned to them by law (for example, law enforcement authorities, tax administration, supervisory authorities of the Bank, institutions carrying out financial crime investigation activities);
   1. 6.4.2. Finora Group companies;
   1. 6.4.3. Partners engaged by the Bank for the provision of its Services;
   1. 6.4.4. Other payment service providers in the event that the Bank is obliged to grant access to the Personal Data of the Customer to such payment service provider;
   1. 6.4.5. Credit and financial institutions, correspondent banks, custodians, insurance providers and financial intermediaries;
   1. 6.4.6. Persons providing financial and legal advice, auditing the Bank or providing other services to the Bank;
   1. 6.4.7. Third parties who maintain registers (including, but not limited to, databases of financial obligations, the State Enterprise Centre of Registers, the Population Register, the Register of Legal Entities, the Register of Contracts and Foreclosures, the securities registers, the Joint Debtors’ Files, or any other registers in which Personal Data is processed) or who act as intermediaries in the provision of Personal Data from such registers, persons and companies involved in debt collection, administration of insolvency proceedings, bailiffs, notaries;
   1. 6.4.8. Participants and/or parties involved in national, European and international payment systems;
   1. 6.4.9. Persons who ensure the proper performance of the customer’s obligations to the Bank, such as guarantors, guarantors, collateral providers;
   1. 6.4.10. potential purchasers of claim rights and collection service providers;
   1. 6.4.11. Other persons involved in the provision of the Services, such as providers of Customer remote identification services, providers of video surveillance, information technology, telecommunications, hosting, archiving, postal services, providers of services provided to the Customer, for the services provided by which the Customer orders electronic billing;
   1. 6.4.12. To any person if the Customer has given consent to the disclosure of his data.

1. 6.5. If necessary and legally justified, we also provide your data to service providers that are separate data controllers, also to competent authorities, institutions, organisations, also other data controllers who are entitled to receive information in accordance with applicable legal acts and/or our legitimate interests (Article 6(1)(b) of the GDPR, Article 6(1)(c) of the GDPR, Article 6(1)(e) of the GDPR, Article 6(1)(f) of the GDPR).

6.6. The Bank shall have the right to provide the Personal Data of the debtors to the Data Controllers, which manage the data files of the debtors. The Bank shall provide the Personal Data of debtors if the Bank has issued a written reminder to the Customer about the default and the outstanding debt has not been settled within 30 calendar days from the date on which the Bank sent (provided) the reminder to the Customer.

7.1. Personal Data is generally processed within the EU/EEA, but in certain cases it may be transferred and processed outside the EU/EEA. Data processors we use are usually located in the Member States of the European Union or store data entrusted to them by the Bank in the European Union. Only a few carefully selected data processors process data outside the European Union. In addition, when we manage our social media accounts, we receive and provide data to social network platform operators , which may also operate outside the European Union, e.g. in the USA. We closely follow practices of data protection supervisory authorities and the guidelines on the transfer of data outside the European Union, and we diligently consider conditions, under which data are transferred and may be subsequently processed and stored after the transfer outside the European Union. To ensure an adequate level of security of data and to guarantee legitimate transfer of data, we conclude Standard Contractual Clauses approved by the European Commission for data transfer outside the European Economic Area (EEA) or follow other grounds and conditions set out in the GDPR.

7.2. Personal Data may be transferred and processed outside the EU/EEA where there is a legal basis for such transfer of Personal Data and where appropriate safeguards are in place. Examples of appropriate safeguards include:

7.3. an agreement has been concluded containing standard terms and conditions approved by the European Commission, or the transfer is carried out in accordance with other accepted terms and conditions, such as codes of conduct, certificates, etc., which are approved under the General Data Protection Regulation;

7.4. the non-EU/EEA country in which the recipient of the Personal Data is located ensures an adequate level of protection of Personal Data as decided by the European Commission.

7.5. More information regarding the transfer of Personal Data outside the EU/EEA may be provided upon request using contact details indicated in Section 11 of this Policy.