1. Personal data and electronic communications

The law of 8 December 1992 on the protection of privacy with regard to the processing of personal data applies to the processing and storage by ECDB of the user's personal data in the context of the instant conversation service (declared surname and/or first name(s) of the user, content of the conversation).

For any questions relating to cookies or the protection of privacy, you have the right to lodge a complaint with the supervisory authority ( www.autoriteprotectiondonnees.be).

Any person who uses an ECDB service involving the use of electronic means of communication (telephone, e-mail, internet, online chat, etc.) agrees to the recording and processing of related electronic communications, including their content and related traffic data, for the purpose of monitoring the activities of the ECDB, the quality of its services and the improvement of its existing or developing products and services. Electronic communications data and content may be retained until the end of the period during which the underlying transaction is in progress with a maximum of two years after the last recorded activity of the visitor.

2. Cookies

ECDB is responsible for cookies and is responsible for the processing of personal data collected by means of cookies.

3. Privacy Statement

ECDB provides you with detailed information about the protection of your personal data by European Climate DB. ("we" or "us").

We are responsible, for our various brands, for the processing of your personal data in the context of our activities. The purpose of this Privacy Statement is to inform you what personal data (hereinafter referred to as "personal data") we use, why we use and share it, how long we keep it and how you can exercise your rights in relation to it. Additional information will be communicated to you if necessary when you subscribe to a particular product or service.

4. What personal data do we process?

We only collect and use personal data that is necessary for our activities and that enables us to offer you high-quality, personalised products and services.

We collect various categories of personal data from you, including :

• Identifying data (e.g. name, ID card and passport numbers, nationality, place and date of birth, photo, IP address)
• Contact data (e.g. postal and e-mail address, telephone number)
• Training and employment information (e.g. employment, name of employer, remuneration)
• Banking, financial and transactional data (e.g. bank details, credit card number, transfer data including communications, value of your assets, investor profile, credit history, expenses and receivables)
• Data relating to your habits and preferences :
  • Data related to the use of our products and services
  • Data relating to the interactions you have with us through our agencies (contact reports), websites, applications, social network pages, telephone interviews, chats, emails, interviews
• Video surveillance data and geolocation data (e.g. your workplace)
• Data provided by official authorities (e.g. to verify your data, we can also access public or semi-public data

The data we use may be collected directly from you or obtained from the following sources, in order to verify or enrich our databases :

• Publications/databases made accessible by official authorities (e.g. the Moniteur Belge)
• Our client companies or our service providers
• Third parties such as credit reference agencies, anti-fraud agencies or data brokers
• Website/social network pages containing information that you have made public (e.g. your website or social network)
• Databases made public by third parties

We never process data relating to your racial or ethnic origins, political opinions, religion, philosophical beliefs or trade union membership, genetic data, sex life or sexual orientation unless we are required to do so by law or as a result of your performance of our products and services (e.g. you mention this type of information in your transfers).

5. Why and on what basis do we use your personal data?

A. Legal

We use your personal data to fulfil various legal and regulatory obligations, including :

• The fight against money laundering and the financing of terrorism
• Compliance with applicable legislation on international sanctions and embargoes
• The fight against tax fraud, compliance with tax audit and reporting obligations
• Responses to official requests from duly authorised public or judicial authorities

To perform a contract concluded with you or to carry out pre-contractual measures at your request

We use your personal data to conclude and execute our contracts, including for :

• Provide you with information about our products and services
• Assist you and respond to your requests
• Evaluate the terms on which we may offer you a product or service
• Provide products or services to our business customers of which you are an employee

C. To serve our legitimate interests

We use your personal data to implement and develop our products or services, optimise our risk management and defend our interests in legal proceedings, including for the purposes of :

• Proof of transactions
• Fraud prevention
• IT management including infrastructure management (e.g. trading platforms), business continuity and IT security
• Creating statistical models, based on the analysis of your transactions, for example to define your level of credit risk; we also carefully aggregate your personal data so that we are no longer able to link it to you, in order to create observations (e.g. aggregated consumption patterns based on transactional data) that we can offer to the market
• To create aggregated statistics, tests and models for research and development
• Training our staff by, for example, recording your calls to our call center
• Customising our commercial offers and those of other entities of the European Climate DB Group:
  • By improving the quality of banking, financial and insurance products or services
  • By offering you products or services corresponding to your situation and profile

This can be achieved through :

• Segmentation of prospects and customers
• The analysis of your habits and preferences resulting from the use you make of our products and services or from your interactions with us through our various channels (visits to our branches, e-mails, visits to our website, etc.)
• Sharing your data with another company of the BNP Paribas Group, in particular if you are - or are likely to become - a customer of this other company
• To adapt the range of products or services you already hold or use and the data we hold (e.g. we may offer you family protection insurance if we have identified that you have children but do not yet have such a product)
• Monitoring transactions to identify those that do not appear to be in line with your normal business activity (e.g. a large amount deposited to your bank account)

D. To respect your choice when we ask for your consent for a particular processing operation

In some cases your consent is required for us to process your data. This will be the case in particular :

• When a processing operation described above gives rise to automated decision-making that produces legal effects concerning you or similarly affects you significantly. On this occasion, we will inform you of the underlying reason and the importance and intended consequences of this processing
• Where we carry out processing for purposes other than those described in this Section 3, we will inform you and seek your consent if necessary

E. To process electronic communications data

In addition to records of electronic communications permitted or required by law or to which you have consented, we may record electronic communications to which you are a party, including traffic data, in the course of lawful business transactions in order to :

• Train and monitor our employees and improve the quality of our services
• Provide evidence of business transactions or exchanges that have taken place in the course of such electronic communications, including the content of such communications (including the notices we provide)

We retain records of electronic communications for as long as required or permitted by law, including for the period during which litigation relating to such communications may arise.

This applies to both telephone conversations and electronic communications (such as e-mails, SMS, instant messaging or similar technology) that you have with our call centre, (independent) agents, private banking and business centres, trading rooms or one of our representatives.

6. With whom do we share your personal data?

In order to fulfil the above-mentioned purposes, we disclose your personal data only to :

• Entities of the European Climate DB Group (e.g. you can benefit from our full range of products and services)
• Service providers performing services on our behalf
• Independent agents, intermediaries or brokers
• Financial authorities, judicial authorities or state agencies, public bodies, upon request and to the extent permitted by law
• Certain regulated professions such as lawyers, notaries or auditors

7. Transfer of data outside the European Economic Area ("EEA")")

In the event of international transfers from the EEA to a third country for which the European Commission has issued an adequacy decision recognising a level of protection for personal data equivalent to that provided by EEA law, your personal data will be transferred on that basis.

For transfers to countries outside the EEA for which the European Commission has not issued an adequacy decision, we rely either on a derogation applicable to the situation (e.g. in the case of international payments, the transfer is necessary for the performance of the contract), or on the implementation of one of the appropriate safeguards to ensure the protection of your personal data :

• Standard contractual clauses approved by the European Commission
• Binding corporate rules

To obtain a copy of these texts or to know how to access them, you can send a written request via the contact form.

8. How long do we keep your personal data?

We keep your personal data for as long as is necessary to comply with the applicable legal and regulatory provisions or for another period of time taking into account operational constraints such as proper account maintenance, effective customer relationship management and responses to legal or regulatory requests.

With regard to customers, the majority of information is retained for the duration of the contractual relationship and for 10 years after the end of the contractual relationship.

In the case of prospects, information is retained for a maximum of 2 years.

9. What are your rights and how can you exercise them?

In accordance with the applicable regulations, you have various rights, namely :

• Right of access: you can obtain information concerning the processing of your personal data as well as a copy of these personal data
• Right of rectification: if you consider that your personal data is inaccurate or incomplete, you may demand that such personal data be amended accordingly
• Right of deletion: you can demand the deletion of your personal data
• Right to limitation of processing: You may request limitation of the processing of your personal data
• Right to object: you may object to the processing of your personal data on grounds relating to your particular circumstances. You have the absolute right to object to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing
• Right to withdraw your consent: if you have given your consent to the processing of your personal data, you have the right to withdraw this consent at any time
• Right to portability of your data: where this right applies, you have the right to have the personal data you have provided us with returned to you or, where technically possible, to transfer it to a third party

You may exercise the rights listed above :

• Via our electronic form (please bring your identity card)
• In the settings of your App (for the rights of access, rectification, consent and portability)
• In one of our branches

You can also make your request by sending us (please include a copy or scan of your identity card) :

• A letter to European Climate DB, Square Joséphine Charlotte 6 B-1200 Brussels
• In accordance with the applicable regulations, you are entitled to lodge a complaint with the competent supervisory authority