DATA PROTECTION POLICY

NOTICE ON PERSONAL DATA PROCESSING

As part of its business, B2 HOLDING KAPITAL d.o.o. Beograd-Novi Beograd, headquartered in Belgrade, Vladimira Popovića 6, company number 21037052 (hereinafter: “B2”), whose principal activity is labeled Activities of collection agencies and credit bureaus, processes your personal data. The protection of your personal data is very important to us, and in order to achieve it, we pay due attention to the fulfillment of our obligations to protect your personal data in accordance with the Personal Data Protection Act. This Personal Data Processing Notice outlines our policy regarding the management of your personal data. In other words, with this Notice, we wish to help you understand how we collect your personal data, what personal data we process, why we process it, how we use it, how we store it, who we share it with and why.

What is personal data?

Personal data is any data relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural and social identity of that natural person.

Who is the controller of your personal data?

B2, as a controller (determines the purpose and method of personal data processing), processes the personal data of the persons we have a contractual relationship with (e.g. under an assignment agreement with financial institutions, by law, based on the consent of the data subject or based on legitimate interest).

Who is the data subject?

The debtor or other natural person (e.g. co-debtors, guarantors, pledgors, etc.) from whom B2 collects a claim under the Assignment Agreement or Guarantee Agreement;
Third parties settling debts in the name and on behalf of the debtor; Employees of B2’s business partners;
Individuals/candidates applying for B2 job vacancies, those contacted by B2 or contacting B2 for employment opportunities subject to special personal data protection notices;
Individuals, legal representatives or company owners in accordance with specific regulations (e.g. Prevention of Money Laundering and Financing of Terrorism Act);
B2 employees or other persons otherwise working for B2, subject to special personal data protection notices.

How we collect personal data

By complying with the legislation in force, B2 collects personal data from:

Credit institutions and other financial institutions which made a loan agreement with you and/or an agreement relating to another financial/banking service, and have assigned your claim to B2;
Directly from you or, in certain cases, from others, primarily in connection with the collection of claims or refund of any overpayments;
Persons authorized to communicate with us in your name and on your behalf (e.g. your proxies);
Government authorities, regional and local governments, public enterprises, institutions and other public services, organizations and other legal and natural persons exercising public powers (e.g. notaries, bailiffs);
Publications and databases publicly available or made available through a contractual relationship (external sources), to ensure regular updates of the data we hold about you, or in order for us to evaluate the ability to repay the debt. External sources mean: public institutions and government authorities, public registers, electronic databases, information available on social media and on the internet;
When you visit B2’s website, records of your visit are automatically created. These records typically include IP address, upload number, the webpage you are logging from, and other details. For more information, see our cookie policy here.

When we collect your data from other sources, we do so from sources that are publicly available or provided by third parties. We take due care of your rights in these cases as well. Some of these situations are the following:

We cannot contact you, and we need to update your details to ensure the accuracy of your personal data;

We need personal data to prevent fraud and/or money laundering, or there are legal grounds to collect certain data.

We process the following categories of personal data:

Identity details such as first and last name, date of birth, citizenship, personal identification number, place of birth, permanent residence, temporary residence;
Contact information such as: postal address; phone number; e-mail;
Details of your financial and/or professional status, such as: employment/profession; the name of the principal activity (e.g. for sole traders); the name of employer; income; type of income; sources of income; bank account; details of your real estate and other property; details of the existing debt (e.g. type of debt, amount of debt, interest, currency, costs); details related to the collection of claims (e.g. repayment plan, costs, debt balance);
Signature;
Surveillance videos made during visits to offices and audio recordings to the extent governed by the regulations in force;
Information about other participants in the transaction which are parties to the agreement under which B2 makes a claim (e.g. guarantors/successors/spouses);
Information about administrative or legal proceedings to which you are a party, to the extent they are related to claims in B2’s portfolio and/or may affect the collection of claims (e.g. enforcement procedures, litigations, bankruptcy procedures and other court and administrative proceedings initiated to protect our rights in court); information deemed to be evidence of any interaction between you and B2 through written and/or verbal communication;

Why we process your personal data

B2 processes your data only to the extent that such data refers to and/or may affect the claim collection process and the protection of B2’s rights. In this context, the purpose of personal data processing mainly involves the collection of claims, and includes the following:

An analysis of your financial situation and source of income in order for us to determine the terms of your debt repayment appropriate to your individual situation;
Communication with you and proper identification of all persons whose personal data we process;
Legal (court) action to collect claims (e.g. enforcement, litigation, initiation and/or participation in other proceedings to protect our rights) and the finding of favorable solutions for all parties involved, leading to debt settlement;
Processing and answering your questions, complaints and requests;
Evaluation of whether we will enter into a contractual relationship or make an agreement (e.g. assessment of risk related to the execution of an assignment agreement, submission of tenders/participation in a public tender) including checks aimed to prevent money laundering, terrorist financing and fraud;
Statistical analysis to evaluate B2’s portfolio management activity as well as the need to improve the collection/repayment of debt methodology;
Responses to requests from government authorities or fulfillment of legal obligations applying to B2;
Statutory reporting to competent authorities when so defined by accounting and tax regulations.

Please note that B2 may sometimes use your personal data for certain secondary purposes (e.g. internal reports and internal portfolio management, external audit, archiving – in physical and/or electronic form, correspondence), which are always consistent with the primary purpose for which B2 collected the personal data in the first place.

What are the legal grounds for processing your personal data?

B2 processes your personal information on one or more of the following legal grounds:

Personal data processing is necessary for the performance of an agreement to which the data subject is a party (in the case of exercise of B2’s rights referred to in the loan agreement and other agreements which B2 made as creditor instead of the financial institution (bank) or other seller of claims, as well as in the case of performance of other agreements to which B2 and the persons whose personal data are processed are parties) or in order to take steps at the request of the data subject prior to entering into an agreement (negotiations prior to agreement);
Personal data processing is necessary for compliance with legal obligations to which B2 is subject: maintenance of bookkeeping data, keeping of data necessary for the exercise of employees’ employment-related rights (employee records, records of working hours, etc.), which, appropriately, also applies to the Director, personal data processing as part of the fulfillment of obligations under the regulations aimed to prevent money laundering and terrorist financing);
The processing is necessary to protect the key interests of the data subject or other natural persons (when refunding overpayments);
B2’s legitimate interest (in order for B2 to collect or dispose of the acquired claims, evaluate the successfulness of collection of claims, or predict the successfulness of collection in terms of whether appropriate procedures should be initiated);
The explicit consent of the data subject in cases when such has been given to B2 (e.g. with respect to B2 employees and B2 job applicants; B2 handles this by special internal notices).

How we use your personal data

Personal data processing is any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, grouping, or structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or delivery, reproduction, dissemination or otherwise making available, comparison, limitation, erasure or destruction, in order to fulfill the above purposes of personal data processing.

We use tools which are not fully automated (human intervention required) to determine/carry out a debt collection evaluation/assessment. This evaluation is carried out for the data directly provided to us by you or by your previous creditor (assignor), as well as for the information obtained from public sources (internet/social networks/public databases/publications and official (public) information released by the government authorities/official databases of entities and persons subject to international sanctions). Thanks to this information, we can decide the optimal method of repayment/settlement of claims for both parties, and in particular, whether it is necessary to initiate enforcement or other procedure or evaluate whether B2 will make an assignment agreement.

We comply with legal requirements, including reporting obligations arising from national and/or European regulations (e.g. prevention of money laundering and terrorist financing, obligations arising from tax or accounting legislation), as well as regulations and recommendations issued by the competent authorities (e.g. National Bank of Serbia, Ministry of Finance, Commissioner for Information of Public Importance and Protection of Personal Data, Money Laundering Prevention Administration, criminal investigation authorities, etc.). The submission of personal data for these purposes is necessary to fulfill B2’s legal obligations.

In case we are unable to contact you, in order to comply with the principles of data accuracy, we will do our best to update your personal data based on information obtained from official sources (e.g. court register, press releases and official information issued by government authorities) or from public sources (internet/social networks/public databases).

We use information about your collaterals for the purpose of collecting claims.
We also use your data to conduct internal statistical analyses to evaluate the effectiveness and improve the methodology for the collection of our receivables.
We process and analyze your complaints, requests for the exercise of your rights under the Personal Data Protection Act, and any other requests that you address to us.
We keep you informed of the status of your debt (while processing your personal data), the status of active legal processes related to your debt, as well as any data and information you are interested in regarding the process of your debt collection.

Is your data secure?

B2 believes the security of your personal data is very important, and we, therefore, ensure and periodically review organizational and technical security measures designed to protect your data from unauthorized access, alteration, disclosure or destruction. Access to your personal data is only allowed to persons authorized by B2, who have undergone proper assessment and have previously committed themselves to maintain confidentiality.

Who are the recipients of your personal data?

In the ordinary course of its business, B2 may transfer your data to other natural or legal persons in order to achieve the purposes for which we process the personal data which you provided to us directly or which we received from other sources. B2 may also use or disclose personal data when it is legally obligated or permitted by law to do so.

Here are some examples of those to whom B2 can transfer your personal data:

Creditors from which B2 has acquired the claims;
We may transfer your personal data to other members of the B2Holding Group which B2 belongs to, headquartered in the EU countries. Exceptionally, your personal data may also be transferred to B2Holding Group members headquartered in non-EU countries, for which no adequacy decision has been made by the European Commission, including Bosnia and Herzegovina. B2 minimizes the risks associated with the transfer of your personal data to a country not providing an adequate level of security by applying appropriate safeguards in the form of executing data transfer agreements with standard contractual clauses governing the transfer of personal data to third countries;
Our contractual partners (assignees) – We may transfer your personal data to other natural or legal persons to whom B2 assigns its claims;
Our contractual partners (assignees) – We may transfer your personal data to other natural or legal persons to whom B2 assigns its claims;
Supervisory authorities – if B2 has a legal obligation or when this is required by the national or European legislation in force, we may transfer information about your personal data or transactions without having to notify you;
Other public authorities: we may supply your personal data to satisfy certain legal obligations or third parties justifying the existence of a legitimate interest (e.g. notaries, courts);
Transfer of data at your request: You may request us to transfer your data to a proxy or authorized person acting in your name and on your behalf (e.g. financial advisors, proxies, brokers);
Service providers who help us improve our services or develop, implement, or manage business systems, infrastructure, or operating processes (e.g., auditors, consultants, analysts, etc.);
Providers who support us in the collection of claims, including the promotion and redemption of security instruments (e.g. real estate agencies, websites where we provide real estate promotion, including in-house real estate promotion platforms, lawyers, appraisers, consulting companies, cadastral experts);
Providers offering maintenance and support services so that we can provide claims acquisition and collection services in optimal and safe conditions. For example: vendors developing/implementing or maintaining IT applications and infrastructure, archival companies, documentation companies, postal service providers, security systems management companies which implement measures to ensure the confidentiality/integrity and availability of your data, etc.;
Service providers who assist us with legal, enforcement, civil, bankruptcy, or other claims collection procedures (e.g. attorneys, appraisers, consulting firms, surveyors, real estate agencies).

How long we keep your personal data

B2 will process your personal data for the period necessary for processing purposes, which may vary depending on the purpose of the data used. This means B2 will process your data during the collection/repayment of the claim and store it for a period of five years from the moment of debt assignment to another creditor and/or after the settlement of the claim in full, unless otherwise provided by law. In the event of claim settlement after completion of the enforcement proceedings and/or other court proceedings, personal data will be kept for at least 10 years, unless otherwise provided by law. In the case of data processing for accounting purposes, your data will be stored in accordance with accounting regulations. The retention period of data obtained from video recordings is 90 days, while the phone records are stored for up to 2 years.

What are your rights and how can you exercise them?

You may exercise the following rights at any time, within the limits provided by the applicable personal data protection legislation:

Right to be informed – Use your right to be informed so that you can request at any time the information and details about how we process your personal data, and we will provide the same to you either verbally or in writing through your requested channel.

Right of access to personal data – You may at any time request access to your personal data in terms of a notification of the processing of your personal data, i.e. ask us to confirm whether your personal data is processed by B2 or not, what purposes it is processed for, the legal grounds of processing as well as the terms under which we process personal data.

Right to rectification and supplementation – You may ask us at any time to rectify your personal data in order for us to ensure that your information is up-to-date and accurate at all times.

Right to discontinue processing (objection to the processing of personal data) – For reasons relating to your individual situation, you may object to the processing of your personal data based on B2’s legitimate interest and/or the processing of data carried out in the public interest, including profiling based on those provisions.

Right to restriction of processing – You may request a processing restriction in the following situations: (1) you contest the accuracy of your personal data processed by us, and therefore, during the period required to verify its accuracy, the processing of your data will be limited; (2) the processing of your personal data was unlawful, and you opposed the erasure of the data, requesting instead restricted data processing; (3) you have objected to the processing of your personal data, and therefore, while the legal grounds of the processing of your data are being verified, the processing will be limited; (4) even though the retention period has expired, you have expressly requested that we retain your data in order for you to exercise your rights in court. In the case of limited processing, your personal data may be processed by storage. Other processing of personal data will only be possible for: (a) the exercise of B2’s rights in court; (b) the protection of the rights of other natural or legal persons; (c) upon your express consent or (d) protection of public interest. If your request for the restriction of data processing is granted, we will notify you before removing the personal data processing restriction.

Right to erasure (“right to be forgotten”) – You may request that we erase your personal data we process and you may take all necessary steps in order for us to do so if: (1) the purpose of the collection no longer exists or has been fulfilled; (2) you have withdrawn your consent, in case the processing was performed based on consent, and there are no other legal grounds to continue the processing; (3) you have opposed the processing of the data and there are no other legitimate reasons for further processing; (4) your personal data has been processed without valid legal grounds. Please also be informed that the personal data for which you have obtained the right of deletion may be further processed in the following situations: (a) to meet legal obligations governing the processing; (b) to exercise/protect rights in court.

Right to data portability – In case of your personal data which we process automatically, based on your explicit consent or the performance of an agreement between you and B2, you may request that the data be structured and sent to you in a machine-readable format, which you can transmit to another controller or ask us to transmit the data directly to that controller (to the extent technically feasible).

Right to withdraw consent to personal data processing – In cases where the processing is done based on your consent, the consent can be withdrawn at any time. Withdrawal of your consent will only have effect on future processing. The pre-withdrawal processing will remain valid.

All the above rights may be exercised by submitting a written request using the contact details below, and we will reply within 30 calendar days or, in case the request requires a more complex analysis, this deadline may be extended by a further 60 calendar days, in which case we will inform you of the reasons for the extension. If you make your request electronically, we will also provide you with information in electronic form, if possible, or through another format or channel requested by you. B2 may ask for additional information to verify your identity before we share your personal data with you or before we act on the exercise of your rights listed above. We also inform you that, in justified cases, the law allows us to refuse to act on your requests, for example, when your requests are excessive, repetitive or obviously unfounded. However, we will provide you with a written explanation for such refusal nevertheless.

If you believe that your personal data is being processed improperly and that the processing of your personal data is not in accordance with regulations, you can file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, as well as file a lawsuit with the court.

Contact details for personal data protection

If you have any questions or requests regarding the above rights, please contact us at:

Address:
B2 HOLDING KAPITAL d.o.o.
Vladimira Popovića 6, 11070 Belgrade
Phone: +381 11 44 09 601

Contact person for personal data protection:
E-mail: zastita-podataka-o-licnosti@b2kapital.rs