Privacy disclaimer of video surveillance

General information

Effective July 1, 2025

We, AS “Citadele banka”, have developed this privacy notice to inform you about the data we process, why we process it, and how we protect it as part of video surveillance.

This information is provided in accordance with the European Parliament and Council Regulation (EU) 2016/679 (April 27, 2016) on the protection of natural persons concerning personal data processing and the free movement of such data (hereinafter referred to as the Regulation), as well as in compliance with the European Union and Latvian laws, supervisory authority recommendations, guidelines, and best practice of financial sector.

Who processes your personal data

Your data is processed by AS “Citadele banka”, registration No. 40103303559, address: Republikas laukums 2A, Riga, Latvia, LV-1010, at the following locations where video surveillance is carried out:

in the premises at Republikas laukums 2A, Riga,
in the premises of branches and customer service centers, as well as ATMs throughout Latvia according to their location. Information is available at www.citadele.lv in the section Private persons → Customer support → Branches and ATMs.

If you have any questions about data processing, you can contact us by calling +371 67010000, writing to the e-mail address info@citadele.lv or gdpr@citadele.lv reaching out our appointed data protection officer

For what purposes, what data, on what basis do we process, to whom do we transfer it, and how long do we store it

Your data will be processed for the above purposes by authorized AS “Citadele banka” and its cooperation partner (security service provider`s) employees.

We do not transfer data outside the European Union or the European Economic Area.

After the expiration of the storage period of the video recordings, we will ensure the deletion of the data, unless the storage of the video recording is necessary for investigations or legal proceedings, or obligation to store data is required by law.

Purpose of data processing	Types/categories of data we process	Legal basis for data processing	Data Recipients	Data storage period
Prevention or detection of criminal offenses related to personal safety and property protection	Video image, photograph, date, time, and location, behavior when you were in the area covered by video surveillance.	Article 6(1)(f) of the Regulation Legitimate interest concerning personal safety, property protection, access control, infrastructure control, and the prevention/detection of related criminal offenses.	Investigation authorities, persons performing criminal investigations, courts, or other entities entitled by law to receive such data.	Video recordings from surveillance cameras will be stored for 30 (thirty) days. Video recordings from surveillance cameras located in critical infrastructure premises and ATMs and in premises where ATMs are located - will be stored for 90 (ninety) days The video recording will be stored longer if necessary for providing evidence, investigation, or litigation.
Protection of legal interests	Name, surname, personal ID number, date of birth, video image, photograph, date, time, and location, behavior when you were in the area covered by video surveillance.	Article 6(1)(f) of the Regulation Legitimate interest concerning personal safety, property protection, access control, infrastructure control, and the prevention/detection of related criminal offenses.	Investigation authorities, operational entities, courts, and or other entities entitled by law to receive such data.	Video recordings from surveillance cameras will be stored for 30 (thirty) days. Video recordings from surveillance cameras of ATMs and in premises where ATMs are located will be stored for 90 (ninety) days. The video recording will be stored longer if necessary for providing evidence, investigation, or litigation. Data, collected during video surveillance and required to process a customer complaint regarding payment card transactions will be stored for 10 (ten) years.
Fulfillment of requests from state institutions and officials	Name, surname, personal ID number, date of birth, video image, photograph, date, time, and location, behavior when you were in the area covered by video surveillance.	Article 6 (1) (c) of the Regulation Fulfillment of the obligations specified by law.	Investigation authorities, operational entities, courts, or other entities entitled by law to receive such data.	Video recordings from surveillance cameras will be stored for 30 (thirty) days. Video recordings from surveillance cameras in ATMs and in premises where ATMs are located will be stored for 90 (ninety) days. The video recording will be stored longer if necessary for providing evidence, investigation, or litigation. Data, collected during video surveillance and required to process requests of state institutions and officials will be stored for 10 (ten) years.
Fulfillment of your requests	Name, surname, personal ID number, date of birth, video image, photograph, date, time and location, behavior when you were in the area covered by video surveillance, telephone number, email address, residential address, signature.	Article 6(1)(c) of the Regulation – Fulfillment of the obligations specified by law, Articles 12, 15–22 of the Regulation.	Data is not transferred	Video recordings from surveillance cameras will be stored for 30 (thirty) days. Video recordings from surveillance cameras in ATMs, and in premises where ATMs are located will be stored for 90 (ninety) days. The video surveillance recording will be stored longer if it is necessary for providing evidence, investigation, or litigation. Data collected during video surveillance and required to process your requests will be stored for 5 (five) years.

What are your rights regarding the data processing we perform

When processing your data, we assure you the following rights which you can exercise by submitting a written request in free form:

Access your data	You have the right to receive from us: confirmation of whether we process your data, detailed information about your data processing to ensure that the data is accurate and processed in accordance with the law. If you wish to access your data, please specify the time and the data you would like to receive. You have the right to know what data we hold about you, why we process it, how we obtain it, to whom it has been transferred, and how long it will be stored. You may also request a copy of your data. To help us process your request more quickly, please specify the shortest possible time and describe precisely what data and information you would like to obtain. If you would like to receive a video surveillance recording, we will need to know the specific date, time, place, and a description of your appearance. Please note that other individuals will be masked in the video surveillance recording. Also, please note that we may not be able to provide information if it is prohibited by law, for example, when data is shared with law enforcement authorities (police, prosecutor's office, court, etc.).
Correct data	If you believe that the data we hold is inaccurate or incomplete, please let us know: inform us about the corrections needed, we may request documents that confirm the necessity of making changes to the data.
Delete data	You may request the deletion of your data if you believe that: it is no longer necessary, it is not being used for its intended purposes. We will delete the data and inform our cooperation partners on the need to delete it. Your data will not be deleted in case it is necessary for the purposes for which it was processed or if the law requires a longer retention period. Please note that fulfilling a deletion request may not always be possible, for example if the data is needed to comply with legal requirements or for proceedings.
Restrict data processing	You may request to restrict the processing of your data if: you dispute the accuracy of the data (the restriction will apply until the accuracy is verified), you believe the data processing is unlawful, but prefer to restrict rather than delete the data, we no longer need your data, but you need it to defend your rights, you object to data processing carried out based on our legitimate interests. We will reassess whether, considering your objections, we need to continue processing data. If data processing is restricted, we will use the data only for specific purposes, such as defending our rights.
Transfer data	The data provided by you, either with your consent or under a contract, may be transferred. Data processed automatically can also be transferred. You can use this data personally, or, upon your request, we will transfer it to another service provider, if there are no obstacles. When transferring data, it is important to consider that it may include data about third parties and in such cases, we must consider and assess the rights and freedoms of those third parties. To help us fulfill your request more quickly, please describe as precisely as possible what data and information you wish to transfer.
Object to data processing	You may object to the processing of your data if it is conducted based on legitimate interests. We will review your objections and assess the necessity of continuing the data processing. We will need to continue processing your data if it is necessary to comply with the law or to protect our legal rights. You will not be able to exercise the right to object to the processing of your data if you have given your consent to the data processing, if data processing is necessary for the performance of a contract, or if we are required to process the data to comply with the law.

How to Submit a Data Processing Request and How Will We Process Your Request

How can you submit a request?	What is the response time for processing your request?	What will be the fee for processing your request?	How will we provide a response to the request?
In writing, in free form: in person, by visiting the bank and presenting an identity document – a passport or ID card, or a power of attorney if acting on behalf of someone else, by email – by sending a request signed with a secure electronic signature, via online banking, using the mobile app.	We will review your request: no later than within 1 month from its receipt, if the request is very extensive or complex, we may need an additional 2 months. In case of prolongation, the response will be sent to you within 3 months from the date of receipt of the request. We will inform you about the period of extension and the reasons for it.	You can receive a response to your request: free of charge, if you submit a repeated request and we determine whether it is unfounded or excessive, we may charge a fee or refuse to fulfill the request. The fee will cover the costs of processing the information and the work of our employees. If payment is required, we will inform you in advance.	You can receive a response to your request: in person, by visiting the bank and presenting an identity document— a passport or ID card, or a power of attorney if acting on behalf of someone else, by email, receiving a password via SMS to access the document, via online banking, using the mobile app.

What should you do if you believe your rights have been violated during data processing

We process your data in accordance with the Regulation, European Union and Latvian laws, financial industry best practice, guidelines and recommendations issued by supervisory authorities. If you believe that we have violated your privacy rights, you have the right to submit a complaint with us by using the contacts listed below. If you are not satisfied with our response, you have the right to file a complaint with the Latvian Data State Inspectorate by using contacts listed below:

AS “Citadele banka”
Address: Republikas laukums 2A,
Riga, Latvia, LV-1010
Phone: +371 67010000
Email: info@citadele.lv
Data Protection Officer`s email: gdpr@citadele.lv

Data State Inspectorate
Address: Elijas iela 17,
Riga, Latvia, LV-1050
Email: pasts@dvi.gov.lv
Phone: +371 67223131
Website:: www.dvi.gov.lv

If the response from the bank or the Data State Inspectorate does not provide you with a satisfactory solution, you have the right to apply to the court.

How do we ensure up-to-date information about your data processing

To ensure you are always informed about how your data is being processed, we regularly review and update this privacy notice. Therefore, we encourage you to periodically check the latest privacy notice on our website. If there are significant changes, we will notify you one month before they take effect.

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use 2 On the use of marketing cookies for our loan services

Digital bank

Cards

Payment methods

Bring a friend!

For daily needs

For car

For home

Obligations

Pension

Short term savings

Long term savings

Finotherapy

For car and machinery

For financial security

For home

For an active lifestyle

Useful

Contact us

Contacts

1 Notification on Cookie Use 2 On the use of marketing cookies for our loan services

For the processing of personal data within the framework of video surveillance

General information

Who processes your personal data

For what purposes, what data, on what basis do we process, to whom do we transfer it, and how long do we store it

What are your rights regarding the data processing we perform

How to Submit a Data Processing Request and How Will We Process Your Request

What should you do if you believe your rights have been violated during data processing

How do we ensure up-to-date information about your data processing

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services