Your privacy

Nowadays, technology is evolving very quickly, facilitating the rapid exchange of information and data, which can affect your privacy. Your privacy is important to us, so we do everything we can to protect it.

Financial security and secrecy of transactions

Our daily routine is to work with confidential and private information - your data, transactions, and other information. You entrust this information to us to receive quality services from us and special care for the security of your data and transactions.

Trust

Your trust is important to us, so we make sure your data is always safe.

Compliance with the law and best practices

We, AS “CBL Atklātais pensiju fonds”, have developed these Privacy Protection Rules to provide you with general information about what data we process, why and how we protect it. You can also find information about data processing in applications, contracts, and other documents when you apply for our services.

If you want to receive information about the processing of your data, we will provide it in accordance with the procedure set out in these rules.

We provide this information in compliance with European Union and Latvian legislation, financial sector and supervisory authority guidelines, and best practices.

bank – AS “Citadele banka”.

Citadele Group companies – AS "Citadele banka" and all its foreign branches and subsidiaries.

consent – any freely and informed confirmation by which you consent to the processing of your data.

data – any information that concerns or could relate to you, such as your name, surname, personal identification number, address, phone number, email address, your habits.

Data State Inspectorate – an institution that supervises the application of the Regulation in the Republic of Latvia.

EU/EEA – European Union/European Economic Area.

Pension fund or we – AS “CBL Atklātais pensiju fonds”.

processing – any actions we perform with your personal data, such as collecting, recording, storing, viewing, using, disclosing your personal data by sending, disseminating or otherwise making them available, coordination, deletion or destruction of your personal data, and more.

profiling – an automated method of processing your data to assess your economic, financial situation, personal preferences, interests, reliability, behaviour, etc.

regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

rules – these Privacy Protection Rules.

you – the person whose data we process.

Your data is processed by AS “CBL Atklātais pensiju fonds”, unified registration No. 40003397312, address: Republikas laukums 2A, Riga, Latvia, LV-1010.

If you have any questions regarding data processing, you can contact us by calling +371 67010147, or by writing to pfonds@cbl.lv or to our Data Protection Officer at gdpr@citadele.lv.

We collect your data:

• When you give them to us:
  • by using our products and services, which you can apply for at bank’s client service centres, bank’s mobile application, websites, bank’s online banking, by filling out applications.
  • when establishing a business relationship with the pension fund as required by law;
  • if you have been designated as the beneficiary in the event of the death of the client;
  • when contacting us via mail, email, mobile application, by phone, in person, by visiting bank’s client service centres;
• when third parties give them to us:
  • our cooperation partners who provide you with information about us;
  • Citadele Group companies;
  • maintainers of databases, registers, and media;
  • state institutions and law enforcement authorities and their officials.

Your data is available only to our employees and those of our cooperation partners, who need it to perform their work duties and provide you with the necessary services. They process your data for certain purposes, in accordance with requirements of the law and the rules of pension fund.

We process your data by performing profiling in certain cases. We do not process your data in an automated way.

Profiling

• What is it? Profiling is a data processing method where, using various personal data, we create your personal “profile,” within which we assess data such as financial situation, transaction history, interests, demands, and more.
• Why do we do this? We perform profiling to:
  • assess whether the relevant product or service is suitable for your demands and needs;
  • assess risks;
  • provide you with advice on 3rd pension pillar services;
  • offer products and services tailored to your needs.

We process your data within the European Union and the European Economic Area. However, to provide certain services, data may be transferred to countries outside these territories, for example, if it is necessary for our cooperation partners to provide certain services. If we carry out such transfers, we will inform you. In such cases, we ensure that data is processed in accordance with the requirements of the regulation and is protected at the same level as required by the regulation.

If we transfer your data outside the EU or the EEA, we comply with at least one of the following conditions:

• we carry out the transfer to a country that has been recognized by the European Commission as safe for data protection;
• we transfer the data to a country or an international organization that guarantees security in accordance with specially adopted rules;
• the transfer of data is permitted by the Data State Inspectorate based on agreements between us and third parties (cooperation partners);
• you have given your explicit consent to the transfer of data;
• the transfer of data is necessary for the performance of a contract between you and pension fund or a contract with our cooperation partner in your interest;
• the data is transferred for the purpose of defending or exercising your rights, for example in legal proceedings.

For more information on data transfers outside the EU and EEA, visit the Data State Inspectorate’s website: www.dvi.gov.lv. There you can also find the decision on countries that provide a level of data protection equivalent to Latvia’s data protection level.

The length of time we keep your data depends on the purpose for which it is used. When determining retention periods, we consider the following criteria:

• Performance of the contract: We retain data for as long as necessary to ensure that the product or service is available to you.
• Legal requirements: We must keep data for a period specified by law, for example, 5 years from the moment the service contracts with you are terminated, as well as to comply with anti-money laundering regulations.
• Protection of interests: After the end of our cooperation, we retain data to protect your interests and ours, for example, for 5 years from the termination of service contracts with you.
• Legitimate interests: If the deletion of data could harm our, your, or third party interests, we will retain the data for as long as necessary.
• Preservation of evidence: We keep data to demonstrate that previous processing was lawful, for example, your consent to receive notifications and offers.

If the data is processed based on your consent, we retain it for as long as the consent is valid.

We follow industry guidelines when setting retention periods. If several valid periods apply such as those required by law and those necessary to protect our and your interests, we will keep the data for the longer period.

If none of these criteria apply, we will delete or anonymize your data.

When processing data, we ensure that you have the following rights by submitting a written request to us in free form:

We process your data in accordance with the regulation, European Union and Latvian laws, best practices in the financial sector, and guidelines and recommendations issued by supervisory authorities. If you believe we have violated your privacy rights, you can submit a complaint to us using the provided contact information. If the response does not meet your expectations, you can file a complaint with the Data State Inspectorate using the contacts provided:

If the response from us or the Data State Inspectorate does not provide the desired solution, you have the right to apply to the court.

We protect your data against unlawful access, use, disclosure by taking the following measures:

We restrict access to the premises to unauthorised persons by ensuring:

• Door locks (electronic doors): We ensure all premises are locked when employees are not present.
• Access control: We use access cards (magnetic, chip cards), identity readers, code systems to control who can access the premises.
• Selection of personnel: We carefully select reliable employees.

We limit access to technological resources, ensuring protection of:

• Technological devices: Computer devices (desktop computers, laptops, tablets, servers), mobile devices (smartphones), communication devices (routers, modems), data storage devices (external hard drives, USB drives, SD cards), and other devices (printers, scanners, monitors);
• Information systems, software, and applications;
• Communication networks and technologies enabling data transmission and information exchange (internet, VPN, mobile networks, cloud technologies, etc.).

For the protection of technological resources, we provide:

• Prevention of environmental threats: We implement safety measures against fires, floods, large temperature changes and other conditions.
• Prevention of technical risks: We take care that there is a good power supply, uninterrupted power supplies in case of power failures and that other similar malfunctions do not occur.
• Human threats: We do not allow damage or theft.
• Secure passwords: We use secure and complex passwords for devices and accounts.
• Screen locking: When the device is not in use, we lock the screen.
• User roles: We limit access to data and systems, allowing only what is necessary for the relevant user.
• Software and security updates: We always install the latest versions to prevent vulnerabilities.
• Encryption: We encrypt data so that it cannot be accessed by third parties/unauthorized persons.
• Secure connection: We use HTTPS and VPN to ensure security when working online.
• Antivirus: We install and update antivirus programs on all devices.
• Firewalls: We use a firewall to protect the network from unwanted access.
• Attack detection systems: We install programs that monitor and warn about suspicious activity.

We carry out regular inspections and provide updates

• Device checks: We regularly check that all devices are in working order and in place.
• System updates: We install the latest software updates to address security risks.

We educate employees

• Training: We regularly inform employees about safety issues and how to act in suspicious situations.
• Threat prevention: We warn you about fraudulent emails and other potential security risks.

We monitor and analyse security

• Log files (audit trails): We record access and operations in systems so that they can be monitored and reviewed.
• Regular tests: We check the safety of systems to identify and eliminate potential risks.

We are ready for emergencies

• Backups: We regularly make backups of data and store them in safe places.
• Emergency plan: We prepare a plan for responding to threats to premises or technology.

Why is it important to us and to you?

Protecting technological resources helps protect data, prevent data leaks, theft, and guarantees that we can continue to work and avoid loss of money and reputation. Safety depends on each employee, so it is important to be careful and follow the rules.

Your data can only be accessed by pension funds’ employees and cooperation partners who need it to perform their work duties. Before starting cooperation, we carefully evaluate the cooperation partners and inform them about the confidentiality and data protection. We and our cooperation partners ensure the protection and use of your data only for the intended purposes, in accordance with the requirements of the law.

To ensure that you are always informed about how your data is processed, we will regularly review and update these rules. Therefore, we invite you to review the latest version from time to time on banks and our website, in online banking and mobile application (if you are a bank`s client), or at bank’s client service centres. If there are any significant changes, we will notify you one month before they take effect.