PRIVACY NOTICE

• Last name, first name, and middle (patronymic) name (in Ukrainian and in English).
• The data from the identification document (ID), and a photocopy of it.
• Tax information regarding the individual (Ukraine’s registration number of the taxpayer’s account card, identification code, Tax ID, TIN).
• Residence address (registration address) in Ukraine.
• Address of the actual place of residence or the address of stay in Ukraine.
• Place of a temporary stay in Ukraine.
• Residence (registration) address in the country of residence (person’s permanent residence address).
• Date and place of birth.
• Citizenship status.
• Education, place of study.
• Place of work, position.
• Social status.
• Contact details (cell, home, work phone numbers).
• Email address.
• Information related to the customer’s status as an individual – entrepreneur.
• Information related to the customer’s status as a self-employed person/person engaged in independent professional activities.
• Person’s affiliation to national, foreign public figures or figures performing public duties in international organizations.
• Affiliation to persons related to public figures or to their family members.
• Marital status, spouse’s last name, first name, and middle (patronymic) name, date of birth, TIN/tax ID, number of children.
• Relations with other banks.
• Information about US citizenship, permanent US resident card, information about long-term stay within the US territory.
• Information about a power of attorney or signature authority on the accounts opened with the JSC CB PrivatBank granted to the person who is a US resident.
• Information on the US tax residency.
• The expected amount of revenues to the account.
• Cash financial transactions which are planned/expected during the first quarter since the account opening.
• Sources of funds/revenues.
• The sum of earnings received at the main place of work.
• The sum of additional regular revenues.
• The description of financial status.
• Affiliation to politically exposed persons or to their affiliates.
• Affiliation to ultimate beneficial owners and controlled legal entities.
• Documents confirming the sources of revenues/funds.

• Identification data of the persons entitled to dispose of the accounts of the customers who are legal entities.
• Information regarding the supporting document which would confirm the powers of the persons entitled to dispose of an account, and upon the basis of which all of these persons are acting (power of attorney, charter, articles, minutes/decision of general assembly/the meeting of a supervisory board/management board, order, etc).
• Last name, first name, middle (patronymic) name of the chairperson or the person entrusted to perform managerial functions and the functions of conducting business activities of the customer who is a legal entity.
• Information regarding governing bodies (executive body and, if available, controlling/supervisory body) and their composition (including last names, first names, and middle (patronymic) names, Ukraine’s registration numbers of the taxpayer’s account cards, and dates of birth).
• Information on the ownership structure of a legal entity (including the supporting documents for the documented system of relations between legal entities and individuals, in order to establish all the present ultimate beneficial owners), also the information on the share which individuals possess in the equity capital and the data related to these individuals.
• Information regarding the ultimate beneficial owner of a legal entity.
• Information related to persons who are authorized to represent the interests of shareholders, members of a legal entity.
• Affiliation of the mentioned persons to politically exposed persons.
• Affiliation to the US residency.
• Information regarding the main counterparties in case they are individuals.
• Data regarding bank cards with signature samples.
• Contact details of the persons authorized to communicate with the Bank.

• Information on what products and services are provided.
• Data from agreements concluded with the Bank (including requisites, data about signatories, and other parties who are specified in agreements, data about the third parties, in favor of whom the agreements were concluded).
• Information on the accounts opened in the Bank (including account numbers, information on the owners and users of the accounts, account balance in foreign currency, securities, or precious metals).
• Data regarding the transactions (including payment details and details of other accounting documents, data about payers and recipients, data of other persons who are mentioned in payment and accounting documents).
• Data on payment instruments (particularly, credit and debit card details, payment systems data, user devices data, tokens data).
• Data on the funds kept in the accounts, including the sources of revenues.
• Data on family members, customer’s spouse, and children in case of legal obligations under the collateral (including pledge and mortgage).
• Data related to customer’s ownership, including the data on the enforcement of legal obligations, data on the mortgagor.
• Data about the purpose of payments made by the customer, particularly the data regarding the goods and services paid for (including via mobile app and POS-terminals), data related to debts on utilities and other services, payments made in favor of the state and local budgets.
• Data regarding the customer, which is additionally obtained when the funds are enrolled in their favor, including the data on their employment (in the event of salary projects), data on social status (in case of pension, student scholarship payment or other social benefits), and other additionally obtained information.
• Data related to children or parents (guardians, custodians) of the customer, in case the services are provided to minors and to other persons without full legal capacity.
• Data related to insurance agreements concluded with the customer or in favor of the customer.
• Data related to the provision of other services, such as safe deposit boxes.
• Data arising in the course of providing informational and advisory services, such as qualified electronic signature, BankID, LiqPay, Paperless, etc.
• Data in the respect of generation, support, use, and cancelation of the qualified electronic signature and electronic document management.
• Data related to participation in contests, raffles, lotteries, and promotions which the Bank holds either independently or by involving partners, including as well announcement of the winners and awarding of the winners.
• Data regarding persons authorized to dispose of the account and/or funds, including the customer’s relatives and heirs.
• An image of the personal signature of an individual.

• Data on the ultimate beneficial owner.
• Data related to business reputation.
• Information about persons exercising direct and/or indirect decisive influence.
• Publicly available information (posted in official sources, public registers, at the official websites of the authoritative publications).
• Information regarding the grounds and reasons for the customer to exercise a comprehensive ownership structure and/or to have a particular state registration (jurisdiction).
• Sources of wealth and/or sources of funds related to financial transactions.
• Information regarding the availability/validity of licenses, permits, supporting data on the customer in the relevant registers.
• Information regarding the purpose and nature to establish business relations.
• Information contained in the open sources regarding criminal proceedings against the customer, its representatives, ultimate beneficial owners.
• Data on customer’s legal and commercial relations established with other customers of the Bank, their essence/role in the group.
• Information on customer’s activities.
• Data from the supporting documents/information related to certain specific financial transactions.
• The information which is obtained during the due diligence of the customer, its business relations, commercial activities, cash flows, accuracy and faithfulness, information appearing in the customer’s social networks.
• Information obtained from the lists of sanctions.
• Other information which the Bank is obliged to obtain due to the legislative requirements for financial monitoring and anti-money laundering.

• Data on the provision of services at the Bank branches.
• Data related to remote services, including the use of the mobile app.
• Information on using ATMs, POS-terminals, other devices for banking services, mobile apps.
• Information about habits, interests, benefits, whether the customer is satisfied or dissatisfied with the services provided.
• Information regarding claims and appeals related to the provision of banking services.
• Data obtained in the course of communication between the Bank and the customer, including correspondence, emails, phone calls (both recorded and unrecorded), and information about the used devices and applied technologies.
• The information which is either intentionally or unintentionally told by the customer while they are being serviced and are related to any other life aspects of the customer or third parties.

• Information about credit agreement and amendments thereto (number and date of the conclusion of the agreement, information on the parties, type of the agreement).
• The sum of the obligation under the concluded credit agreement.
• Type of the currency of the obligation.
• The terms and enforcement procedure for the credit agreement.
• Information about the amount of the repaid sum and about the final obligation sum under the credit agreement.
• The initial date when the obligation under the credit agreement is overdue, its amount, and the stage of repayment.
• Information on the termination of the credit agreement and the way of termination.
• Information confirming the invalidity of the credit agreement and the grounds under which it is recognized as invalid.
• Documented information on an individual taken from the public registers, other publicly available databases.
• Available tax debts and obligatory payments.
• Court decisions related to that origin, execution, and termination of obligations under the concluded credit agreement.
• Court decisions or resolutions made by executive authorities on the property status of an individual’s credit history.
• Other information affecting the individual’s ability, regarding their credit history, to fulfill obligations.
• Data on operations regarding the information containing the details of the credit history.

• Customers’ photographs taken from the documents provided by the customer.
• Photographs made either in the Bank branch and during remote servicing.
• Customer’s photographs taken from publicly available sources in the course of financial monitoring activities.
• Customer’s images taken during video surveillance in the Bank premises, as stipulated by the current legislation.
• Customer’s images taken when they use the Bank’s self-servicing devices and equipment for the purposes of secure payments.
• Videos and photographs taken during video verification in compliance with the legislative requirements.
• Digital casts made from the customer’s photograph, recorded in machine code.

• Recorded conversations with the customer for the purpose of checking the quality of the provided services.
• Digital casts made from the customer’s voice in case when the voice biometrics technology is applied in order to authenticate the customer.

• Information about the open data obtained from public sources and made available pursuant to the legislation on access to public information.
• Information obtained from public sources of other countries.
• The information which is related to the person, in case it is made public by the person.

• Information obtained from ATMs and POS-terminals, including the time and the place when and where a transaction is made.
• Information obtained from third parties in case of preventive anti-fraud and security measures.
• Information processed in the course of relations with law enforcement bodies in the event of the presence of evidence of a crime, an administrative offense, losses, or other damage.

• Information on the debt and its condition.
• Information on the evaluation, condition, and location of collateral under the obligation, including pledged and mortgaged items.
• Information related to other property which belongs to the customer or other parties.
• Information in respect of the customer’s relatives, neighbors, friends, which is obtained during the evaluation procedures, monitoring of a pledged property, foreclosure on the property, debt collection, other taken steps regarding the credit obligations.
• Information related to the third parties, which the customer provides in the manner prescribed by the law on consumer credit.
• Information on the third parties with the rights to pledged and other types of property which belongs to the customer, information on pledgers and mortgagors.
• Data obtained in the course of arbitrary, judicial, and executive proceedings and mediation, data from notaries, state, and local government bodies.
• Data obtained from collection companies.
• Data on the ownership and legal deeds related to ownership (including the rights of intellectual property and corporate rights).

• The information which is received by the Bank and kept in the form of printed and electronic documents.
• Images or photocopies of documents.

• Data about the device (including its type, model, IP address, MAC address, etc) and browser (its type, version, language, etc), which the customer uses.
• Information on the use of our website or mobile app, in particular, regarding actions on a certain website or app if any.
• Information obtained from cookies and other web technologies.
• Information transmitted in the URL heading in the process of accessing our website from other web resources.

• Information related to labor relations if the customer is or was an employee of the Bank.
• Information regarding any commercial or administrative relations between the Bank and another individual, if this individual or their employee is the Bank’s customer at the same time.
• Data provided by third parties under various circumstances and reasons (in particular, when the data provided by other Bank’s customers in order to perform their duties).
• Data obtained in the case of seizure and forced collection of customer’s funds and accounts.

• Customers’ IDs for storing their data in databases.
• Customers’ profiles and evaluations made in the process of scoring their creditworthiness.
• Data regarding the entity’s behavior, interests, or habits which the Bank becomes aware of during the provision of services.
• Any other analytical or statistical data related to the customer.

We usually do not process sensitive categories of personal data, unless you give your consent or in case of having other grounds stipulated by the current legislation, we may process such categories of personal data. Particularly, sensitive data may be processed in the following cases:

• Biometric voice casts of the customer based on consent for the purpose of secure authentication at customer support and in automated channels for carrying out risky operations, including payments, on cards and accounts, and for providing information on the status and movement of funds on cards and accounts.
• Biometric videos and images in order to verify the customer, in the cases stipulated by the regulatory legal acts of the National Bank of Ukraine.
• Biometric facial image to make payments via the FacePay24 service.
• Biometric facial image to authenticate the customer via the FaceID services.
• Biometric facial image to be able to receive services in the Branch of the Future.
• Data related to administrative or criminal prosecution or in the cases of taking measures as part of a pre-trial investigation, violent actions committed against a person in the event where obtaining such data is required by law, and the Bank is a party to such proceedings, or the customer informed the Bank on the matter.
• Information about political, religious, or ideological convictions, membership in political parties, data obtained as a result of financial monitoring activities, and in the case of identification of politically exposed persons.