Principles for Processing and Protecting Personal Data

1. Our commitment

This document reflects our commitment to (i) communicate in a transparent manner which personal data we process and under what conditions we do so; (ii) ensure the security of personal data and the privacy of data subjects; (iii) provide appropriate mechanisms for the exercise of the rights of personal data subjects; (iv) comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 - General Data Protection Regulation ("GDPR") - and other applicable legislation, including national legislation complementing the GDPR ("Law 58/2019 of August 8"); and (v) comply with the confidentiality duties arising from the Legal Framework for Credit Institutions and Financial Companies approved by Decree-Law no. No. 298/92, of December 31, 1992, in its current version.

To learn how ActivoBank processes your personal data, we recommend that you read this document, consult the site page dedicated to the privacy and protection of personal data, available at https://www.activobank.pt/principios-de-tratamento-protecao-de-dados-pessoais and read the Terms and Conditions of our products and/or services.

The information provided in this policy, on the processing of personal data, may be complemented with specific information on products and/or services provided by ActivoBank.

2. Who we are

References in this document to "ActivoBank", "Bank", "we" and "our" mean ActivoBank S.A., with registered office at Rua Augusta, 84, in Lisboa, registered at the Commercial Registry Office of Lisbon with the single commercial registration and TIN 500 734 305.

ActivoBank is the Controller of the personal data of different categories of data subjects, namely its Customers and employees and who, in this context, decides which data is collected, the means of processing and the purposes for which the data is processed ("Data Controller").

Contact information:

ActivoBank
Postal mail address: Av. Prof. Dr. Cavaco Silva (Tagus Park) Edf. 1, nº 32
2740-256 Porto Salvo
+351 210 03 07 00 (call to national landline network), with Personal Assistance working days from 8.00 a.m. to 10 p.m., Saturdays from 10 a.m. to 8 p.m.; Sundays and holidays from 12 a.m. to 8 p.m.

The communications cost will depend on the pricing agreed with your telecommunications operator

Email address: secretariado.sociedade@millenniumbcp.pt

ActivoBank has a Data Protection Officer who (i) monitors data processing compliance with the applicable regulations, (ii) is one of its contacts for clarifying questions related to data processing, (iii) cooperates with the National Data Protection Committee (NDPC), in its capacity as a supervisory authority, and (iv) provides information and advises ActivoBank or the processors on their obligations within the scope of privacy and data protection. (“Data Protection Officer”).

Contact information of the Data Protection Officer:

ActivoBank
Av. Prof. Dr. Cavaco Silva (Tagus Park) Edif. 1, nº 32, 2740-56 Porto Salvo
Email address: protecao.dados.pessoais@activobank.pt

3. Which data we collect and process

Essentially, a personal data is any information that (regardless of its nature or support), directly or in combination with other data, may identify or be associated with a natural person ("Personal Data").

ActivoBank only collects personal data in accordance with applicable legislation.

We may collect your personal data from different sources and this Data may relate to any of the products and/or services that you have engaged, own or have owned in the past, or result from interactions you have had with us, for example, when you visit our websites or mobile applications, or when you contact us by telephone about any of our products and/or services.

We may collect some personal data directly from you or from third parties who are your intermediaries or which relate to the products and/or services you have subscribed to or from other publicly available sources.

The following table presents the main categories of personal data that we process regarding our Customers:

Personal data categories Examples
Identification and contact information Name, identification document number, tax identification number, photography, facial biometric pattern signature, address, phone number or e-mail address.
Biographical data Date of birth, gender, nationality, place of birth, marital status, household information, education or professional data.
Financial Data Financial assets, responsabilities in the financial sector, or monthly salary.
Products and/or Services Account number, account balance, debit/credit card number, and other information concerning products and/or services acquired or subscribed and respective conditions (e.g. term and interest rate of a consumer loan).
Transactions Banking operations date, time, description and value (e.g. Deposits, withdrawals, transfers and payments), NACE and establishment's location.
Segments and profiles Commercial segment, profile or credit risk level, investor profile or willingness to purchase financial products.
Opinions and preferences Comments on the Bank's media presence on social networks or replies to satisfaction surveys.
Contents Information contained in written communications between the data subject and the Bank, recorded (video and/or audio) call (e.g. stock exchange orders conveyed by telephone).
Images Images recalled through video surveillance cameras placed in our premises.
Access accounts User account, user authentication credentials or multichannel code.
Use of websites and applications Visited pages, or information on used devices (e.g. IP address, geographic location, browser used, cookies).

ActivoBank collects these personal data through the following means for collection (or production) of data:

Means of collection Examples
Data supplied by the data subjects Data or content provided directly by the data subjects (i) in the process of subscribing or acquiring products and/or services, (ii) in interactions with the branch network or the contact centre and Visits to our premises, (iii) in letters or e-mail messages sent, (iv) in participating in the Bank’s promotional actions, or (v) in replies to satisfaction surveys
Data collected when data subjects use products and/or services by the data subjects Data related to banking operations and transactions ordered by the data subjects to the Bank (e.g. Deposits, withdrawals, transfers, payments, credit contracts, collateralisation).
Profiling Data produced by the Bank through analytical models using data subject’s data and data regarding the subjects’ use of the Bank’s products and/or services.
Persistent Cookies Data regarding the use of Bank websites and applications (e.g. visited pages, user preferences), collected from cookies sent by the Bank or third parties. You can find more information on the type of cookies used by the Bank and on the data collected in the cookie policy available on the Bank’s website www.activobank.pt/en.
Data collected by third-parties Data collected by the Bank from third parties with whom it works, including (i) Banco de Portugal, (ii) public authorities, (iii) agents working on behalf of the Bank, or (iv) the Bank's partners related to loyalty programmes, disclosed in the documents associated with the corresponding programmes.

Obligation to provide personal data

Within the scope of business and contractual relationships, it is mandatory to provide and collect personal data from Customers, potential Customers and other data subjects (e.g. guarantors, representatives, beneficial owners) necessary for compliance with pre-contractual and contractual obligations and diligences, or those arising from the regulations in force. As a general rule, without such data, ActivoBank will be forced to refuse entering into an agreement or executing an order, or even terminate the agreement. For instance, pursuant to the legal provisions deriving from the regime for preventing money laundering, it is necessary to identify the data subject before and during a business relation, usually trough an identification document, collecting the information therein, otherwise the instruction or request must be refused.

4. How we process personal data

Data processing means any operations performed on personal data manually or by automated means, including collection, storage, use, copy and transmission. At ActivoBank, personal data are processed lawfully, fairly and in a transparent manner and for specific purposes. The following sections describe and illustrate the main purposes of data processing at ActivoBank, within the corresponding legal bases:

Performance of a contract

ActivoBank processes data necessary for entering into, performing and managing contracts to which the data subject is party or for pre-contractual measures at the data subject’s request.

Processing purpose Examples
Account opening and management Collection and storage of data pertaining to the data subject and representatives, opening current accounts, altering account holders and respective data or issuing bank statements.
Subscription and management of financial products and/or services Subscription, production and sending means of payment (e.g. debit, pre-paid and credit cards), simulation, formalization and management of savings and investment products, or provision of information on products and/or services purchased or subscribed.
Credit granting and management Simulation, registration, decision and formalization of credit operations and respective collaterals, or collection and settlement of instalments.
Management of bank operations Processing deposits in cash or cheques, direct debits, withdrawals, top-ups, payments, domestic and international transfers, collection of bank fees, or execution of orders (e.g. securities purchase and sale).
Subscription and management of services related to electronic channels Subscription of electronic channels (e.g. online banking, mobile banking, call centre), management of access credentials, channels customization, or activation and deactivation of related services.
Insurance mediation Data collection and analysis of data for the subscription of insurance products, where the Bank assumes the role of mediator, acting on behalf of the insurance company.

Compliance with a legal or regulatory obligation

ActivoBank processes data as necessary to comply with the different legal requirements - Portuguese and European - that bind it, including (i) the Legal Framework for Credit Institutions and Financial Companies, (ii) legislation regarding the prevention and fight against money laundering and terrorism financing, (iii) legislation regarding financial intermediation activities, securities trading and taxation, (iv) provisions regarding the supervision of banking activities, (v) the EU Capital Requirements Regulation, (vi) legislation on Personal Data protection and (vii) the requirements concerning the compulsory adoption of security measures at the premises and other regulatory obligations to which it is also subject, issued namely by Banco de Portugal, the European Central Bank, the European Banking Authority, the Portuguese Securities and Market Commission, the European Market Supervisory Authority and the Competition Authority.

Processing purpose Examples
Risk management Credit risk analysis, or verification of a data subject's identity and age, knowledge and experience, risk profile, and investment objectives - ActivoBank assesses the creditworthiness of borrowers and guarantors when granting credit, mitigating the risk of fraud and monitoring the risk of default. For this purpose, it may use techniques that combine different personal data you have provided us (e.g., age, address) with other personal data resulting from your interaction with the Bank (data on the financial products subscribed, transactional data and default history, risk profiling) and data collected from third parties (e.g., Central de Risco de Crédito do Banco de Portugal, Câmara de Penhoras, Citius, LUR – Listagem de utilizadores de cheques que oferecem risco), corresponding to compliance with legal or regulatory standards to which it is bound. In addition to complying with other rules and principles of personal data protection, we continually seek to mitigate the risks associated with the use of algorithms, namely the risk of discrimination.
Fraud prevention Detection, analysis, and answer to potential fraud attempts, particularly in what regards remote operations (e.g. transactions with debit or credit cards, online banking).
Prevention of crimes related to money laundering and terrorism financing Verification of lists of persons and entities subject to financial or trade sanctions, or identification and reporting of suspicious transactions, among other measures provided for in anti-money laundering legislation.
Provision of information and replies to requests made by the Public Authorities Provision of mandatory information (prudential and other) as and a reply to various requests made by the sector regulators (e.g. Banco de Portugal, European Central Bank, Portuguese Securities and Market Commission), public authorities (e.g. Courts, Polices, Tax Authority), external auditors, or under The Foreign Account Tax Compliance Act, 2010 (“FATCA”) or the Common Reporting Standard (“CRS”).
Accounting and Financial Reporting Accounting records, production and disclosure of the Bank’s financial statements.
Management of document archive Collection, categorization and storage of physical documentation with personal data in the document archive, consisting of mandatory evidence within the context of the Bank's activity.
Video-surveillance Video surveillance of the Bank’s physical facilities, aiming at protecting people and assets and preventing crimes, allowing the collection of evidence. As prescribed in Law 34/2013 of May 16, as amended by Law 46/2019 of July 8, the cameras installed guarantee the identification of people and coverage of public attending areas, deposited and kept values, safes, cash dispensers or automatic tellers, as well as control of access and permanence in the respective areas.
Contact and claims management Receiving, analysing and answering information requests and claims from data subjects.

Legitimate interests

ActivoBank makes the necessary data processing in order to safeguard its legitimate interests or those from third parties.

Whenever ActivoBank processes Data based on legitimate interests, it carries out a prior processing analysis, in order to ensure that the rights and interests of the data subjects are not overriding such legitimate interests.

Processing purpose Legitimate Interest Examples
Provision ofInformation Ensure that data subjects are properly informed about the products and/or services to which they subscribe and/or which they wish to subscribe. Convey to the data subjects relevant information (related to such products and/or services). Send different informative material (e.g. information security, financial market trends), or in the context of the purchase of products or services.
Direct Marketing Provide relevant information on products and/or services proposed by the Bank that might interest data subjects. Provide information or carrying out campaigns, by phone, SMS, email or social networks, to encourage the use or promote the purchase or subscription of financial products and/or services, which may be the result of profiling or events generated by real-time analysis of transactions with the Bank.
Segmentation Improve the adequacy and optimise the supply of products and/or services to Customers, according to their features. Customers characterisation and segmentation, to better address and adjust the Bank’s commercial offer of products and services to their specific features.
Profiling for commercial purposes Analysis of the products and/or services acquired by Customers to understand their preferences and interests, in order to better adjust communications directed at them. Process Customers' personal data, whether objective personal data (e.g. age, gender, address, Customer type, income) or personal data generated by the use of the Bank's products and/or services (e.g. data on products hired or on financial transactions carried out with means of payment made available by the Bank), in order to assess Customers' profiles and build up consumption patterns based on their transactions through any of the Bank's channels, thus determining Customers' propensity towards such products and/or services - and also towards other products and/or services of a similar nature - with the aim of personalising the offers communicated to them according to their preferences. Customers have the right to request clarification of the criteria used for profiling and to object at any time to profiling activities solely designed for commercial purposes.
Assess the satisfaction with products and/or services Ensure the improvement of products and/or services provided by the Bank, as well as adequate levels of its Customer satisfaction. Carrying out surveys to assess Customers’ satisfaction with the Bank's products and/or services and the quality of the services provided or sending proposals to change the conditions of products and/or services purchased or subscribed to (e.g. proposal to increase the credit card limit).
Development of products and/or services Develop and improve products and/or services provided by the Bank. Collect and analyse data for the development or adaptation of new Bank products and/or services, with the aim of better serving Customers’ specific needs.
Litigation management Efficient management of cases and litigation in general. Exercise of contractual or legal rights or of defence in case of litigations in and out of court emerging, namely, from situations of default or non-compliance with duties of any nature whatsoever, of the data subject before ActivoBank.
Credit recovery and Collections Recovery of default loans Defaulting credit recovery activities, including the search for assets that may answer for the debts owed to the Bank, both by its Customers and by potential parties, in cases where there is suspicion of assets dissipation or other acts that, by transferring assets to third parties, aim to frustrate the guarantees or the enforceability of the Bank's credits. Heritage research is carried out according to objectively established criteria.
Credit assignment Management of the Bank's credit portfolio Collection and analysis of data and provision of information to third parties in the context of credit securitisation operations.
Management control Sound and prudent management of the Bank Production of control and management information of the Bank
Internal Audit Carrying out internal audits to assess compliance with legal standards and internal regulations Collection and analysis of information within an internal audit on the Bank’s processes and operations.
Management and security of the information systems and premises Protection of the Bank's information systems and also of the people and assets on its premises. Processes for the management and monitoring of the information systems and technological infrastructures, record of accesses and use of systems, processes of detection, analysis and response to potential information security incidents, control on identities and accesses to the Bank information systems, or control on the physical access to the premises.

Consent of the data subject

ActivoBank may make other types of data processing after getting the prior consent, expressed, in writing, verbally or through a clear affirmative act, informed, freely given and for specific purposes of the data subject.

Processing purpose Examples
Evidence of information or instructions transmitted by phone Recording of call/video calls as a mean to prove information or instructions transmitted within the context of a pre-contractual relation (e.g. proof of the data subject’s identity) or instructions transmitted within the context of a contractual relation (e.g. Stock exchange orders).
Monitoring of the service quality Recording of calls to exercise a direct monitoring of the quality of the service provided.
Market studies Collection and analysis of personal data within the context of market studies or research.
Customize the experience on the Bank’s websites and Apps. Use of persistent cookies to record the activity and preferences of clients on the Bank’s websites.
Direct Marketing Promotional actions of products or services for non-customers, or of non-financial products aimed at our customer base.

ActivoBank only processes personal data with due grounds of lawfulness, and subject to prior information to the respective data subjects. Eventual processing of additional secondary data shall only be carried out if (i) they are compatible with the purposes authorized and communicated to then data subjects or (ii) they are object of a specific and explicit consent from the data subject.

5. How long can data be stored and processed

ActivoBank stores and processes personal data for the time necessary and while the legitimate purposes, according to which the data are processed, are in effect, for compliance with contractual, legal and regulatory duties or for the protection of the legitimate interests of the Bank and of third Parties.

Reason for storage Storage Period
Compliance with a contract Period while the contract is in effect. ActivoBank may store personal data for periods exceeding the duration of the contractual relation, to ensure rights or duties related to the contract, based on legitimate interests that ground it, namely the defence the Bank in legal proceedings or yet based on the consent provided by the data subject.
Legal, tax or regulatory obligation Legal limitation deadlines associated to legal, tax or regulatory duties or deadlines foreseen in special legislation (for example, 7 years after the end of the contractual relation foreseen within the scope of the law for the prevention of money laundering and terrorism financing), the longer one.
Preservation of calls recording for contractual proof Contract term, plus the 10-year prescription and expiry period.
Preservation of calls recording for the Contact Centre (requests for clarification, complaints and support) 10 years
Preservation of calls recording for monitoring service quality 30 days
Preservation of video-surveillance images 30 days
Asset research for Credit Recovery Elimination, within 30 days, of data that do not confirm suspicions of dissipation or transfer of assets of the Bank's debtors. In all other cases, conservation of the underlying obligations for the prescription legal period.

6. Which are your rights as a personal data subject

ActivoBank ensures the exercise of the rights of the data subject in relation to the respective processing.

Right of the data subject Description
Access Without prejudice to the protection of the rights of third parties, data subjects have the right to have access to personal data concerning them, as well as to obtain information on the respective treatment conditions.
Rectification Data subjects are entitled to request the rectification of their personal data which are inaccurate or incomplete (e.g. address, e-mail address, phone numbers).
Opposition Data subjects are entitled to oppose to data processing based on the legitimate interest of ActivoBank.
Withdrawal of consent Data subjects are entitled to withdraw the consent they gave for the processing of data based on that consent.
Erasure Data subjects are entitled to obtain the erasure of their personal data held by ActivoBank, provided that there are no valid reasons for its retention (e.g. compliance with a legal obligation, defence of the Bank or of third parties in legal proceedings).
Limitation Data subjects are entitled to request the limitation of data processing when (i) they have contested the accuracy of the personal data and during a period allowing ActivoBank to verify its accuracy, (ii) the processing is unlawful and they oppose the erasure of the personal data; (iii) ActivoBank no longer needs the personal data, but such data is required by the data subjects for the purposes of the establishment, exercise or defence of a right in a legal proceeding; (iv) they oppose the processing and during the assessment period of the request by ActivoBank
Portability Data subjects are entitled to receive the personal data they supplied to ActivoBank, in a structured, commonly used, and with an automatic readable format, and the right to transmit this data to another Controller.
Not being subject to exclusively automated decisions Data subjects are entitled to require human intervention or to object to decisions based on fully automated processing of personal data that could produce significant effects in their legal or private sphere, unless the processing is i) for compliance with a legal obligation (e.g. prevention of money laundering), ii) for the performance of a contract and the information is necessary for its performance, iii) where the subject has given his/her explicit consent. ActivoBank has mechanisms to ensure the human intervention in data processing based on automated decisions enabling the data subject to express his/her point of view and object to the automated decision.
Lodging a Claim with NDPC Data subjects are entitled to lodge claims with NDPC regarding issues connected with the exercise of their rights and the protection of their personal data.

You may exercise your rights, in data protection, through a letter or e-mail sent to the contacts of ActivoBank or of the Data Protection Officer. ActivoBank will reply to the requests within 30 days, with the exception of particularly complex requests. In these cases, ActivoBank will inform the data subjects (i) of the need to extend the period for reply, for a maximum additional period of 60 days, (ii) of the corresponding justification.

Whenever the Bank deems that it is not possible to respond to the requests, the data subjects shall be informed of the Bank’s reasons, within the deadlines set forth above.

The exercise of the rights is free of charge, except when situations deemed excessive, irregular and/or bad faith. In these situations, ActivoBank will previously inform the data subjects of the fees that will be charged and respective justification.

ActivoBank has the appropriate mechanisms to verify and confirm the identity of the data subjects that wish to exercise the rights, being accepted only those made by the data subject whose identity can be confirmed and through a channel that allows the Bank to keep evidence of the request and of the respective answer.

7. Sharing personal data

ActivoBank Employees who need access to personal data to perform their functions, namely in the scope of contractual, pre-contractual and legal diligences or obligations of the Bank, have access to it. In addition, personal data may be provided to third parties - entities that are separate of ActivoBank:

Third-parties Examples
Group Companies Group companies or complementary groupings of companies incorporated by the Group, within the scope of measures to prevent money laundering, terrorist financing and fraud, or for administrative and financial management purposes at Group level.
Government entities and supervision authorities Banco de Portugal, European Banking Authority, European Central Bank, Portuguese Securities and Market Commission and tax authorities, whenever there is a legal or regulatory obligation to do so, for instance reporting information (i) to the Accounts Database, Central Credit Register and the List of Cheques’ Users that offer Risk (“LUR”) under the terms of the applicable legislation, (ii) during investigations, claim or proceedings, to Public Entities, Courts and Law Enforcement entity responsible for the matter, or (iii) to official authorities or entities of other countries located within or outside the European Union, for purposes of fighting terrorism financing, serious forms of organized crime and preventing money laundering.
Other credit and financial services institutions Entities to which ActivoBank transfers personal data for the performance of the agreement entered into with the Client or for the provision of additional benefits and/or benefits resulting from the product or service subscribed, under the terms of the respective agreements, namely without limitation (i) to entities that process discounts and loyalty programmers, (ii) to insurance companies within the scope of the insurance policies associated to loans, cards or accounts, (iii) to financial entities users of the Worldwide Interbank Financial Telecommunication (SWIFT) system, (iv) to entities of the same industry or with the same legal obligations in what regards the prevention of fraud and money laundering, or (v) to entities that acquire loans or assets, part of operations to assign or dispose of loans or assets, and joint-venture entities (ACE).
Processors Processors and service providers that act on behalf of ActivoBank or pursuant to its instructions (e.g. document management and archive service providers; IT service providers).

ActivoBank is subject to bank secrecy duty pursuant to the General Framework for Credit Institutions and Financial Companies, therefore personal data are only sent to third-parties when such is authorized within the banking relationship and/or when the processors engaged by ActivoBank also ensure compliance with bank secrecy, as well as with all other data protection regulations and legislation.

Transfers of personal data to third countries or international organizations

The data transmission to countries outside the European Union only occurs when such is necessary (i) to execute orders or requests (for example, payment transfers to other countries), (ii) due to legal requirements, or, in specific cases (iii) when expressly authorized by the data subject.

Among data transmission outside the European Union, interbank transfers carried out through the SWIFT ("Society for Worldwide Interbank Financial Telecommunication" or "Society for Worldwide Interbank Financial Communication") communication system stand out, insofar as the MBCP is part of the SWIFT system, which it uses to carry out bank transfers at its Customers request. For more information on SWIFT and on the processing of personal data in the system, we suggest you consult www.swift.com.

Be aware that the transmission of data outside the European Union may entail additional risks for the protection of personal data, namely because destination countries may offer less legal guarantees for the protection of your personal data.

Should it be necessary to use service providers from third countries, ActivoBank will contractually ensure that these entities comply with all legal obligations in matters of data protection, namely by resorting to the so-called standard data protection clauses and additional mitigation measures, as provided for in Article 46 of the General Data Protection Regulation. These entities will process the personal data according to the prior and documented instructions of ActivoBank and exclusively for the purposes indicated to them by the latter.

8. Find out how we protect your data

The protection of confidentiality and data integrity has long been considered by ActivoBank as a fundamental pillar for building a relation of trust with our Customers, employees, regulators and business partners.

ActivoBank as implemented organizational measures, security processes and systems that are appropriate to protect personal data in its care from destruction, alteration and unauthorized access, including: (i) mechanisms to control access to information systems and data; (ii) specialised security systems (e.g. firewalls, antivirus, intrusion detection systems); (iii) mechanisms to record actions of employees and other users of information systems (e.g. access, alteration, deletion of personal data); (iv) mechanisms for data encryption and pseudonymisation and anonymisation of data; (v) encryption measures applicable to mobile devices; (vi) physical security measures to protect the premises (e.g. physical access control, surveillance, various alarms); (vii) a programme to train and raise awareness of the employees of ActivoBank regarding information security and personal data protection.

9. Changes to the privacy policy

ActivoBank reserves the right to, at all times, alter this document to update it and adjust it to the best market practices or to future legal and regulatory amendments. The updated version is permanently available at any ActivoBank branch or on the website www.activobank.pt.

Whenever there are substantial and relevant amendments, the Bank shall undertake the adequate and reasonable efforts to inform Clients, using the regular channels and mechanisms.