AAS CBL life privacy protection rules

About your privacy, why we care about it and protect it

Your privacy

Nowadays, technology is evolving very quickly, facilitating the rapid exchange of information and data, which can affect your privacy. Your privacy is important to us, so we do everything we can to protect it.

Financial security and secrecy of transactions

Our daily routine is to work with confidential and private information - your data, transactions, and other information. You entrust this information to us to receive quality services from us and special care for the security of your data and transactions.

Trust

Your trust is important to us, so we make sure your data is always safe.

Compliance with the law and best practices

We, AAS “CBL Life”, have developed these Privacy Protection Rules to provide you with general information about what data we process, why and how we protect it. You can also find information about data processing in applications, contracts, and other documents when you apply for our services.

If you want to receive information about the processing of your data, we will provide it in accordance with the procedure set out in these rules.

We provide this information in compliance with European Union and Latvian legislation, financial sector and supervisory authority guidelines, and best practices.

Let's get acquainted with the terms

bank - AS “Citadele banka”.

Citadele Group companies - AS "Citadele banka" and all its foreign branches and subsidiaries.

consent - any freely and informed confirmation by which you consent to the processing of your data.

data - any information that concerns or could relate to you, such as your name, surname, personal identification number, address, phone number, email address, your habits.

Data State Inspectorate - an institution that supervises the application of the Regulation in the Republic of Latvia.

EU/EEA - European Union/European Economic Area.

insurer or we - AAS “CBL Life”.

processing - any actions we perform with your personal data, such as collecting, recording, storing, viewing, using, disclosing your personal data by sending, disseminating or otherwise making them available, coordination, deletion or destruction of your personal data, and more.

profiling - an automated method of processing your data to assess your economic, financial situation, personal preferences, interests, reliability, behaviour, etc.

regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

rules - these Privacy Protection Rules.

you - the person whose data we process.

Who processes your data

Your data is processed by AAS “CBL Life”, unified registration No. 40003786859, address: Republikas laukums 2A, Riga, Latvia, LV-1010.

If you have any questions regarding data processing, you can contact us by calling +371 67010129, or by writing to life@cbl.lv or to our Data Protection Officer at gdpr@citadele.lv

For what purposes, what data, on what basis we process, to whom we transfer it and how long we retain it

Identity verification in person and in the electronic environment (authentication)

The insurer must comply with Sections 26 and 27 of the Personal Data Processing Law, Article 44(3) of the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, as well as Article 23 of the regulation, which sets limitations on individuals` rights to access information. These rules apply to the right to request information about data processing, its purposes, recipients, sources, as well as the right to access your data and request its correction, deletion, suspension, or restriction of processing.

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Client identification in person	Client or client representative Name, surname, personal identification number, date of birth, number of identity document, date of issue, country, issuing authority, expiration date, photo, signature.	Statutory obligation Regulation Article 6(1)(c) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines Public interest arising from the law Regulation Article 6(1)(e) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines	Register of invalid documents Cooperation partners who ensure identification when applying for services Information systems maintainers	5 years from the date of termination of business relationship 10 years from the date of termination of the business relationship, if the information has been requested by the law enforcement authorities
Identity verification in the electronic environment (authentication) To use our services, we are obliged to verify your identity. Authentication is most often carried out using tools such as MobileSCAN/Digipass 780, SmartID, eID card or eParaksts Mobile, code card/code calculator. We do not process your biometric data (e.g. face or fingerprint data). This data is processed by companies that offer you authentication services.	Client/any natural person Name, surname, personal identification number, device identifier, information specified in the application.	Conclusion and performance of the contract Regulation Article 6(1)(b) Statutory obligation Regulation Article 6(1)(c) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on the digital operational resilience of the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council regarding regulatory technical standards on secure user authentication and common and secure open communication standards	Authentication service providers – SK ID Solutions AS, SJSC Latvian State Radio and Television Centre Information systems maintainers	5 years from the date of termination of business relationship 18 months for storing online banking audit records.

Purpose of data processing

Types/sets of data (categories) we process

Justification for data processing

Data recipients

Data retention period

Client identification in person

Client or client representative

Name, surname, personal identification number, date of birth, number of identity document, date of issue, country, issuing authority, expiration date, photo, signature.

Statutory obligation

Regulation Article 6(1)(c)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines
Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines

Public interest arising from the law

Regulation Article 6(1)(e)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines

Register of invalid documents
Cooperation partners who ensure identification when applying for services
Information systems maintainers

5 years from the date of termination of business relationship

10 years from the date of termination of the business relationship, if the information has been requested by the law enforcement authorities

Identity verification in the electronic environment (authentication)

To use our services, we are obliged to verify your identity. Authentication is most often carried out using tools such as MobileSCAN/Digipass 780, SmartID, eID card or eParaksts Mobile, code card/code calculator. We do not process your biometric data (e.g. face or fingerprint data).

This data is processed by companies that offer you authentication services.

Client/any natural person

Name, surname, personal identification number, device identifier, information specified in the application.

Conclusion and performance of the contract

Regulation Article 6(1)(b)

Statutory obligation

Regulation Article 6(1)(c)
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on the digital operational resilience of the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011
Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council regarding regulatory technical standards on secure user authentication and common and secure open communication standards

Authentication service providers – SK ID Solutions AS, SJSC Latvian State Radio and Television Centre
Information systems maintainers

5 years from the date of termination of business relationship

18 months for storing online banking audit records.

Know your client (Client due diligence within the framework of anti-money laundering) and sanctions management. What is it?

As part of Know your client, the insurer checks who their client is to make sure they are not involved in illegal activities, such as money laundering. "Money laundering" refers to the process of making money obtained through criminal activities — such as drug trafficking, human smuggling, and other unlawful activities, "dirty" money, is converted into "clean" money to make it look as though it was earned legally. Money laundering poses major threat to insurer.

Countries have strict rules and laws requiring insurer to identify, monitor, and report suspicious transactions to state authorities. Anti-money laundering measures implemented by insurer helps to limit such activities.

As part of sanctions management, the insurer monitors and complies with international and local sanctions. The insurer carefully reviews client transactions to ensure that sanctioned individuals cannot receive services. Sanctions are applied to countries, organizations, or individuals that pose security threats, violate laws, or engage in illegal activities such as terrorism, money laundering, or human rights violations.

How does this affect you?

As part of Know your client, the insurer carefully checks the transactions (contributions) made and cooperate with state authorities. Please note that when providing services, the insurer may request documents and explanations required by law.

As part of sanctions management, when providing a service, the insurer may request additional documents and explanations regarding the transactions (contributions) made.

How does this affect us? If the insurer fails to comply with the rules, it may face significant financial penalties, suffer reputational damage, lose client trust, or even its license.

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Client due diligence before and during business relationships (We clarify the origin of funds, politically exposed persons beneficial owners and persons related to the client to comply with the legal requirements and identify suspicious transactions, as well as to ensure that international or national sanctions are not violated)	Client (status of politically exposed person, beneficial owner (client or their family members or closely related persons)) Name, surname, personal identification number, birth date, place of birth, country, identity document number, issue date, issuing country and authority, expiration date, photo, nationality, address, phone number, email, social status/employer name, position, information related to previous professional activities, occupation, reputation, taxpayer number, tax residence, source of income, incoming payments (contributions) and their origin, amounts paid out, information related to family members, kinship, politically exposed person (PEP) status, account number, relationship with companies, shares, information related to client identification and research, signature.	Statutory obligation Regulation Article 6(1)(c) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and related legislation and other related legal acts, guidelines Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines Public interest arising from the law Regulation Article 6(1)(e) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and related legislation and other related legal acts, guidelines	Public registers: Population register, Lursoft, Enterprise Register, State Revenue Service registers, Register of Invalid Documents Information systems maintainers Citadele Group Companies supervisory and law enforcement authorities	5 years from the date of termination of business relationship 10 years if requested by the supervisory authority or law enforcement authorities
Freezing of funds and execution of the Financial Intelligence Unit's reporting and freezing of funds order	Client Name, surname, personal identification number, date of birth, identity document number, date of issue, country, document issuing authority, expiration date, information about the insurance contract, payment details for freezing funds (payment date, amount, purpose of payment, payer/beneficiary account number), sanctions check results and evidence of compliance with the lists.	Statutory obligation Regulation Article 6(1)(c) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines Public interest arising from the law Regulation Article 6(1)(e) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines	Financial Intelligence Unit Information systems maintainers	5 years from the date of termination of business relationship 10 years if the information has been requested by Financial Intelligence Unit
Reporting suspicious transactions to the Financial Intelligence Unit (including, for violation or attempted violation of sanctions) and the State Revenue Service	Client (status of politically exposed person, beneficial owner (client or family member or person closely related to him)) Name, surname, personal identification number, date of birth, place of birth, country, number of identity document, date of issue, country, issuing authority, expiration date, photo, nationality, address, phone number, email, social status/employer name, position, information related to previous professional activity, occupation, reputation, taxpayer number, tax residence, source of income, incoming payments (contributions) and their origin), expenses incurred, information related to family members, kinship, politically exposed person (PEP) status, account number, relationship with companies, shares, information related to client identification and research, signature. Additionally, under sanctions management, transaction/payment details (date, amount and currency, payer and payee (name, surname, personal identification number, company name, registration number, country of registration), account numbers and credit institution where the account is held, payment details, short description of the nature of the transaction/payment, information, facts and documents indicating sanctions violations or signs thereof, actions taken regarding the payment - refused to execute and returned to the payer, funds frozen, transaction already executed (i.e. in cases where the sanctions violation was detected after payment execution)).	Statutory obligation Regulation Article 6(1)(c) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines 17.08.2021 Republic of Latvia Cabinet Regulation No. 550 Regulations Regarding the Procedures for the Submission of Reports on Suspicious Transaction and the Threshold Declaration and Content Thereof Public interest arising from the law Regulation Article 6(1)(e) Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines	Financial Intelligence Unit State Revenue Service Information systems maintainers	5 years after termination of business relationship 10 years if the information has been requested by supervisory authority, law enforcement authorities

Purpose of data processing

Types/sets of data (categories) we process

Justification for data processing

Data recipients

Data retention period

Client due diligence before and during business relationships

(We clarify the origin of funds, politically exposed persons beneficial owners and persons related to the client to comply with the legal requirements and identify suspicious transactions, as well as to ensure that international or national sanctions are not violated)

Client (status of politically exposed person, beneficial owner (client or their family members or closely related persons))

Name, surname, personal identification number, birth date, place of birth, country, identity document number, issue date, issuing country and authority, expiration date, photo, nationality, address, phone number, email, social status/employer name, position, information related to previous professional activities, occupation, reputation, taxpayer number, tax residence, source of income, incoming payments (contributions) and their origin, amounts paid out, information related to family members, kinship, politically exposed person (PEP) status, account number, relationship with companies, shares, information related to client identification and research, signature.

Statutory obligation

Regulation Article 6(1)(c)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and related legislation and other related legal acts, guidelines
Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines

Public interest arising from the law

Regulation Article 6(1)(e)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and related legislation and other related legal acts, guidelines

Public registers: Population register, Lursoft, Enterprise Register, State Revenue Service registers, Register of Invalid Documents
Information systems maintainers
Citadele Group Companies
supervisory and law enforcement authorities

5 years from the date of termination of business relationship

10 years if requested by the supervisory authority or law enforcement authorities

Freezing of funds and execution of the Financial Intelligence Unit's reporting and freezing of funds order

Client

Name, surname, personal identification number, date of birth, identity document number, date of issue, country, document issuing authority, expiration date, information about the insurance contract, payment details for freezing funds (payment date, amount, purpose of payment, payer/beneficiary account number), sanctions check results and evidence of compliance with the lists.

Statutory obligation

Regulation Article 6(1)(c)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines
Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines

Public interest arising from the law

Regulation Article 6(1)(e)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines

Financial Intelligence Unit
Information systems maintainers

5 years from the date of termination of business relationship

10 years if the information has been requested by Financial Intelligence Unit

Reporting suspicious transactions to the Financial Intelligence Unit (including, for violation or attempted violation of sanctions) and the State Revenue Service

Client (status of politically exposed person, beneficial owner (client or family member or person closely related to him))

Name, surname, personal identification number, date of birth, place of birth, country, number of identity document, date of issue, country, issuing authority, expiration date, photo, nationality, address, phone number, email, social status/employer name, position, information related to previous professional activity, occupation, reputation, taxpayer number, tax residence, source of income, incoming payments (contributions) and their origin), expenses incurred, information related to family members, kinship, politically exposed person (PEP) status, account number, relationship with companies, shares, information related to client identification and research, signature.

Additionally, under sanctions management, transaction/payment details (date, amount and currency, payer and payee (name, surname, personal identification number, company name, registration number, country of registration), account numbers and credit institution where the account is held, payment details, short description of the nature of the transaction/payment, information, facts and documents indicating sanctions violations or signs thereof, actions taken regarding the payment - refused to execute and returned to the payer, funds frozen, transaction already executed (i.e. in cases where the sanctions violation was detected after payment execution)).

Statutory obligation

Regulation Article 6(1)(c)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines
Law on International and National Sanctions of the Republic of Latvia and other sanctions-related legal acts, guidelines
17.08.2021 Republic of Latvia Cabinet Regulation No. 550 Regulations Regarding the Procedures for the Submission of Reports on Suspicious Transaction and the Threshold Declaration and Content Thereof

Public interest arising from the law

Regulation Article 6(1)(e)
Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and other related legal acts, guidelines

Financial Intelligence Unit
State Revenue Service
Information systems maintainers

5 years after termination of business relationship

10 years if the information has been requested by supervisory authority, law enforcement authorities

The insurer must comply with Sections 26 and 27 of the Personal Data Processing Law, Article 44(3) of the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, as well as Article 23 of the regulation, which sets limitations on individuals' rights to access information. These rules apply to the right to request information about data processing, its purposes, recipients, sources, as well as the right to access your data and request its correction, deletion, suspension, or restriction of processing.

Automatic exchange of information on client contributions to contracts

What is it? Automatic exchange of client account information means that the insurer regularly sends information about the contributions made by client to a national tax authority. This helps prevent tax evasion and income hiding abroad.

How does this affect you? If you have made contributions to the contract in another country, the insurer may inform your national tax authority about the amount of contributions made to the contract and the amount of accumulated capital. This practice is implemented to ensure tax payment and prevent financial assets being hidden abroad.

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Collection of financial information on client contributions to contracts and preparation of information for provision to the State Revenue Service within the framework of supervision of automatic exchange of information on client contributions to contracts	Client Name, surname, personal identification number, date of birth (for non-residents), identity document (type, date of issue, period of validity, country of issue), address, place of birth, country, place of tax residence, taxpayer number, nationality, signature (if the application is submitted in person), contributions made to the contract.	Statutory obligation Regulation Article 6(1)(c) Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA Chapter XII of the Law on Taxes and Fees Cabinet of Ministers Regulation No. 134 of 24.03.2015 Procedures by which the Information is provided to the State Revenue Service to Ensure the Compliance with the Requirements Laid Down in the Law on the Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA Cabinet of Ministers Regulation No. 210 Regulations Regarding Automatic Exchange of Information on Reportable Cross-border Arrangements	Data is not transferred	6 years
Provision of information to the State Revenue Service within the framework of supervision of automatic exchange of information on client contributions to contracts	Client Name, surname, personal identification number, date of birth (for non-residents), place of tax residence, taxpayer number, contributions made to the contract.	Statutory obligation Regulation Article 6(1)(c) Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA Chapter XII of the Law on Taxes and Fees Cabinet of Ministers Regulation No. 20 of 05.01.2016, Procedures by which a Financial Institution Implements the Due Diligence Procedures for Financial Accounts and Provides Financial Accounts Information to the State Revenue Service Cabinet of Ministers Regulation No. 134 of 24.03.2015 Procedures by which the Information is provided to the State Revenue Service to Ensure the Compliance with the Requirements Laid Down in the Law On the Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA Cabinet of Ministers Regulation No. 210 Regulations Regarding Automatic Exchange of Information on Reportable Cross-border Arrangements	State Revenue Service	5 years from automatic exchange of information on client contributions to contracts
For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).

Purpose of data processing

Types/sets of data (categories) we process

Justification for data processing

Data recipients

Data retention period

Collection of financial information on client contributions to contracts and preparation of information for provision to the State Revenue Service within the framework of supervision of automatic exchange of information on client contributions to contracts

Client

Name, surname, personal identification number, date of birth (for non-residents), identity document (type, date of issue, period of validity, country of issue), address, place of birth, country, place of tax residence, taxpayer number, nationality, signature (if the application is submitted in person), contributions made to the contract.

Statutory obligation

Regulation Article 6(1)(c)
Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA
Chapter XII of the Law on Taxes and Fees
Cabinet of Ministers Regulation No. 134 of 24.03.2015 Procedures by which the Information is provided to the State Revenue Service to Ensure the Compliance with the Requirements Laid Down in the Law on the Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA
Cabinet of Ministers Regulation No. 210 Regulations Regarding Automatic Exchange of Information on Reportable Cross-border Arrangements

Data is not transferred

6 years

Provision of information to the State Revenue Service within the framework of supervision of automatic exchange of information on client contributions to contracts

Client

Name, surname, personal identification number, date of birth (for non-residents), place of tax residence, taxpayer number, contributions made to the contract.

Statutory obligation

Regulation Article 6(1)(c)
Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA
Chapter XII of the Law on Taxes and Fees
Cabinet of Ministers Regulation No. 20 of 05.01.2016, Procedures by which a Financial Institution Implements the Due Diligence Procedures for Financial Accounts and Provides Financial Accounts Information to the State Revenue Service
Cabinet of Ministers Regulation No. 134 of 24.03.2015 Procedures by which the Information is provided to the State Revenue Service to Ensure the Compliance with the Requirements Laid Down in the Law On the Agreement between the Government of the United States of America and the Government of the Republic of Latvia to Improve International Tax Compliance and to Implement FATCA
Cabinet of Ministers Regulation No. 210 Regulations Regarding Automatic Exchange of Information on Reportable Cross-border Arrangements

State Revenue Service

5 years from automatic exchange of information on client contributions to contracts

For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).

Insurers services

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Provision of life insurance service with/without savings (including identification and clarification of your interests, assessment of risk and potential losses, assessment of state of health, payment management, communication within the framework of the service, as well as transfer of risk to another insurer for security purposes (reinsurance)). These services protect you and your relatives if something unforeseen happens to you, such as a serious illness, inability to work, and loss of life.	Customer/insured person Name, surname, personal identification number, date of birth, gender (for statistics), phone number, email address, information on credit obligations, information on professional activities and related risks, hobbies, state of health, information on the insurance contract, case of payment of insurance compensation, if any, account number, signature. Beneficiary/heir Name, surname, personal identification number, date of birth, phone number, email address, information about the insurance contract, account number of the case of payment of insurance compensation, if any.	Conclusion and performance of the contract Regulation Article 6(1)(b) Statutory obligation Regulation Article 6(1)(c) Insurance Contract Law Consent Regulation Article 9(2)(a) Consent to: the processing of health data for the provision of the service and risk assessment; receipt of information from medical treatment institutions and medical practitioners regarding health (performed examinations and analyses) the transfer of health data to a reinsurer for the purpose of carrying out reinsurance	insurance agents medical treatment institutions and medical practitioners reinsurer postal service providers information system maintainers	3 years from the date of termination of the business relationship
	For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).
Provision of a lifetime pension insurance service (including identification and clarification of your interests, payment management, communication within the framework of the service). This service provides you with regular payment of the 2nd pension pillar for the rest of your life after you have reached retirement age.	Customer Name, surname, personal identity number, date of birth, gender (for statistics), address, phone number, email address, amount of funds accumulated in the 2nd pension pillar, information about the contract, expenses incurred, account number in the bank. Beneficiary Name, surname, personal identification number, date of birth, address, phone number, email address.	Conclusion and performance of the contract Regulation Article 6(1)(b) Statutory obligation Regulation Article 6(1)(c) Insurance Contract Law Law on State Funded Pensions 27.05.2003. Cabinet of Ministers Regulation No. 272, Regulations Regarding the Operation of the State Funded Pension Scheme	insurance agents State Social Insurance Agency postal service providers information system maintainers	3 years from the date of termination of the business relationship
	For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).
Provision of non-life insurance services (including identification and clarification of your interests, payment management, communication within the framework of the service). This service protects you and your relatives if something unforeseen happens to you, such as a serious illness, inability to work, and loss of life.	Customer/insured person Name, surname, personal identification number, date of birth, address, phone number, email address, health information, insurance premium payment per month, sum insured, medical reimbursement paid, kinship. Beneficiary Name, surname, personal identification number, date of birth, phone number, email address.	Conclusion and performance of the contract Regulation Article 6(1)(b) Statutory obligation Regulation Article 6(1)(c) Insurance Contract Law Consent Regulation Article 9(2)(a) Consent to: the processing of health data for the provision of the service and risk assessment; receipt of information from medical treatment institutions and medical practitioners regarding health (performed examinations and analyses) the transfer of health data to a reinsurer for the purpose of carrying out reinsurance	insurance agents information system maintainers	3 years from the date of termination of the business relationship
	For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).
Provision of non-life supplementary insurance service (including identification and clarification of your interests, payment management, communication within the service). This service protects you and your relatives if something unforeseen happens to you, such as a serious illness, inability to work, and loss of life.	Customer/insured person/beneficiary Name, surname, personal identification number, date of birth, phone number, email address, account number, information about the insurance contract (insurance period, amount and payment procedure, coverage, risks, amount, conditions, health data).	Conclusion and performance of the contract Regulation Article 6(1)(b) Statutory obligation Regulation Article 6(1)(c) Insurance Contract Law Consent Regulation Article 9(2) (a) Consent to: the processing of health data for the provision of the service and risk assessment; receipt of information from medical treatment institutions and medical practitioners regarding health (performed examinations and analyses) the transfer of health data to a reinsurer for the purpose of carrying out reinsurance	insurance agents information system maintainers	3 years from the date of termination of the business relationship
	For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).

Organization of the insurer’s activities

Purpose of data processing	Data types/sets (categories) we process	Justification for data processing	Data recipients	Data retention period
Physical security We ensure safety in the premises, territory, and other locations of the insurer to protect employees, clients, and property. Our purpose is to prevent and detect crime, control access, and provide evidence to protect the insurer's interest.	Client, including a minor Video image, name, surname, personal identification number, information indicated in the identity document, information related to violations.	Legitimate interests regarding the protection of the insurer, your security and property protection, prevention and detection of possible crime, control of access to the insurer's premises and collection of evidence in case of disputes or violations. Regulation Article 6 (1)(f)	Cooperation partner providing physical security services	30 days
Sending automated invoice payment reminders to the clients with the online payment option. We provide an opportunity for clients to make online payments conveniently and securely to pay their invoices on time.	Client Email, information about the transaction (invoice amount, payment term, policy number).	Conclusion and performance of the contract Regulation Article 6 (1)(b) Legitimate interest in providing clients with a convenient and secure automated online invoice payment reminder solution to facilitate timely payment of invoices Regulation Article 6 (1)(f)	cooperation partners providing the service information system maintainers	1 year 1 month
Attracting clients for the use of insurers services (promotions, lotteries, raffles, contests)	The amount of data varies depending on the type of event. Client, including minor Name, surname, personal identification number, date of birth, phone number, email, data indicated in the identity document, tax residence, information related to the prizes won, account number, signature.	Consent to receive notifications and offers Regulation Article 6 (1)(a) Conclusion and performance of the contract Regulation Article 6 (1)(b)	Cooperation partners providing the service	5 years
Maintenance and promotion of the insurers' image (in-person and online events, social media and media)	The amount of data varies depending on the type of event. Client, any person Name, surname, phone number, email address, address, addresses of social accounts, audio recording, photograph, video recording, position, profession, type of occupation, length of service, employer, membership in professional associations, education, interests, use of insurance services and compliance with the client's needs. Any other personal data that you have disclosed at the event in written text/audio/photo/video, IP address.	Conclusion and performance of the contract Regulation Article 6 (1)(b) Legitimate interest in creating and maintaining the insurers' image, attracting new clients, ensuring the trust and wellbeing of existing clients. Regulation Article 6 (1)(f)	Cooperation partners providing the service	10 years or, in some cases, longer to provide information on the insurer's history
Receipt and sending of documents (correspondence)	Client/any natural person Name, address, phone number, email address, signature.	Conclusion and performance of the contract Regulation Article 6 (1)(b)	Postal service providers Delivery and courier service providers	10 years
Storage and destruction of paper and electronic documents (Archiving)	Client, any natural person, including a minor Considering the amount of data and information specified in various documents, the following data is processed: Name, surname, personal identification number, date of birth, photograph, type of identity document, number, date of issue, issuing country, issuing authority, signature, phone number, address, email address, password for identification by phone, audio recording of the call, marital status, kinship, number of family members, employer, occupation, education level, nationality, validity and expiration date of residence permit, tax residence, taxpayer number, place of birth, country, nationality, information obtained during communication with the insurer, authorization device, transaction history, information related to client identification and research, politically exposed person status, health data, account number, contributions made, information about financial knowledge	Statutory obligation Regulation Article 6 (1)(c) Archives Law and state - defined document standards Insurance contract law Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing Law on International and National Sanctions and other sanctions - related legal acts Law on Accounting Civil Law and other regulatory acts Archiving in the public interest Regulation Article 9 (2)(j)	Cooperation partner providing the archive service, maintenance of information systems.	Various document retention periods (6 months, 3 years, 5, 10 years)

Receiving information, notifications and offers

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Communication regarding your products and services, and their changes (via phone, email, the bank's online banking, mobile app)	Client Name, surname, personal identification number, audio recording, video recording, phone number, email address, information about insurer products, services you use.	Conclusion and performance of the contract Regulation Article 6 (1)(b) Consent to receive notifications and offers Regulation Article 6 (1)(a)	Cooperation partners providing communication services	5 years from the date of communication
Sending notifications and offers	Detailed information is provided in the Privacy disclaimer for the processing of personal data for receipt of notifications and offers.
Client satisfaction surveys (We regularly conduct surveys to learn the opinions of clients and the public about the insurer`s services and products. Surveys also gather feedback on insurer`s image. This information helps us improve services and ensure high quality of service)	Clients Email address, history of services provided and their rating.	Consent to receive notifications and offers Regulation Article 6 (1)(a)	Cooperation partners providing survey services	Data is deleted after the survey is completed.

Purpose of data processing

Types/sets of data (categories) we process

Justification for data processing

Data recipients

Data retention period

Communication regarding your products and services, and their changes

(via phone, email, the bank's online banking, mobile app)

Client

Name, surname, personal identification number, audio recording, video recording, phone number, email address, information about insurer products, services you use.

Conclusion and performance of the contract

Regulation Article 6 (1)(b)

Consent to receive notifications and offers

Regulation Article 6 (1)(a)

Cooperation partners providing communication services

5 years from the date of communication

Sending notifications and offers

Detailed information is provided in the Privacy disclaimer for the processing of personal data for receipt of notifications and offers.

Client satisfaction surveys

(We regularly conduct surveys to learn the opinions of clients and the public about the insurer`s services and products. Surveys also gather feedback on insurer`s image. This information helps us improve services and ensure high quality of service)

Clients

Email address, history of services provided and their rating.

Consent to receive notifications and offers

Regulation Article 6 (1)(a)

Cooperation partners providing survey services

Data is deleted after the survey is completed.

Handling of requests, claims, applications and complaints

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Handling applications, requests and complaints from individuals	Client Name, surname, personal identification number, date of birth, signature, audio recording, address, email address, phone number, information related to family and children (name, surname, personal identification number, kinship), tax residence, account number, contributions made. Other types of data are determined depending on the scope of information requested in the request, claim, application, or complaint, as well as the information contained in the documents to be issued.	Statutory obligation Regulation Article 6 (1)(c) Insurance contract law Consumer rights protection law Bank of Latvia Regulation No. 358 on the procedure for handling complaints received by financial market participants	Cooperation partners who ensure the processing of applications, requests, complaints within the framework of insurance distribution services	5 years from the date the information is provided
	For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).
Management of data subject requests	Client Name, surname, personal identification number, date of birth, address, email address, phone number, signature. Other types of data are determined depending on the scope of information requested in the request, as well as the information contained in the documents to be issued.	Statutory obligation Regulation Article 6 (1)(c) Personal Data Processing Law	Data is not transferred	5 years from the date of providing the information
Management of data subject requests	For personal data used for identification, please refer to the section Identity verification in person and in the electronic environment (authentication).
Examination of requests from the competent state authorities and their officials	Client Name, surname, personal identification number, date of birth, address, email address, phone number, signature, photograph, type of identity document, number, date of issue, issuing country, issuing authority, information contained in the documents to be issued, information related to family and children (name, surname, personal identification number, kinship), tax payment country, contributions made, debt obligations, taxpayer number, tax residence, place of birth, country, nationality, status of a politically exposed person. Other types of data are determined depending on the amount of information requested in the request, claim or application, as well as on the information contained in the documents to be issued.	Statutory obligation Regulation Article 6 (1)(c) Insurance contract law State Labour Inspection Law and other legal acts	Bank of Latvia Financial Intelligence Unit Courts Criminal Procedure Authorities Police, Prosecutor's Office Bailiffs Notaries Orphan's Courts Data State Inspectorate State Revenue Service Information Technology Security Incident Response Institution Ministry of Finance Consumer Rights Protection Centre Other officials specified by law	5 or 10 years from the date of providing the information, depending on the type of request.
Reporting (whistleblowing) on potential violations in the activities of the insurer and protection of whistleblowers (You can report potential or identified violations, including possible fraud or criminal offences. We ensure proper protection of the whistleblower).	Client/any natural person Name, surname, email address, phone number, social media account addresses and content, video recording, information related to violations.	Statutory obligation Regulation Article 6 (1)(c) Whistleblowing Law	AS Citadele banka	5 years from the date of reporting

Provision of information and reports to supervisory authorities

Purpose of data processing	Types/sets of data (categories) we process	Justification for data processing	Data recipients	Data retention period
Provision of information to the Ministry of Welfare on the contributions made to the Lifetime Pension	Client Name, surname, personal identification number, number of contributions.	Statutory obligations Regulation Article 6 (1)(c) Law on State Funded Pensions	Ministry of Welfare	5 years from the date of providing the information
Provision of information to the State Social Insurance Agency regarding received Lifetime Pension Insurance Applications	Client Name, surname, personal identification number, insurance policy number, amount of 2nd pension pillar savings.	Statutory obligation Regulation Article 6 (1)(c) Regulation No. 272 of the Cabinet of Ministers of 27.05.2003. Regulations Regarding the Operation of the State Funded Pension Scheme	State Social Insurance Agency	5 years from the date of providing the information
Provision of information to the State Revenue Service regarding the amounts disbursed to a natural person	Client Name, surname, personal identification number, amount of insurance indemnity payment.	Statutory obligation Regulation Article 6 (1)(c) Law On Personal Income Tax Regulation No. 610 of the Cabinet of Ministers of 07.09.2021. Regulations Regarding the Information to be Included in the Notification on the Amounts Disbursed to a Natural Person	State Revenue Service	10 years from the date of providing the information
Provision of information to the State Revenue Service regarding life insurance contributions made - distribution of contributions or termination of the contract	Client Name, surname, personal identification number, contribution amount.	Statutory obligation Regulation Article 6 (1)(c) Law On Personal Income Tax Insurance Contract Law Regulation No. 899 of the Cabinet of Ministers of 21.09. 2010 Procedures for the Application of the Norms of the Law on Personal Income Tax	State Revenue Service	10 years from the date of providing the information
Provision of information to the State Revenue Service on income earned by a natural person - non-resident and tax paid in the Republic of Latvia	Client Name, surname, personal identification number, amount of tax withheld from the amount paid.	Statutory obligation Regulation Article 6 (1)(c) Law On Personal Income Tax	State Revenue Service	10 years from the date of providing the information

How we collect your data

We collect your data:

When you give them to us:
- by using our products and services, which you can apply for at bank’s client service centres, bank’s mobile application, websites, bank’s online banking, by filling out applications.
- when establishing a business relationship with the insurer as required by law;
- if you have been designated as the beneficiary in the event of the death of the insured;
- when contacting us via mail, email, mobile application, by phone, in person, by visiting bank’s client service centres;
when third parties give them to us:
- our cooperation partners who provide you with information about us;
- Citadele Group companies;
- maintainers of databases, registers, and media;
- state institutions and law enforcement authorities and their officials.

Your data is available only to our employees and those of our cooperation partners, who need it to perform their work duties and provide you with the necessary services. They process your data for certain purposes, in accordance with requirements of the law and the rules of insurer.

Do we process data in an automated way and perform profiling

We process your data by performing profiling in certain cases. We do not process your data in an automated way.

Profiling

What is it? Profiling is a data processing method where, using various personal data, we create your personal “profile”, within which we assess data such as financial situation, transaction history, interests, demands, and more.
Why do we do this?We perform profiling to:
- assess whether the relevant product or service is suitable for your demands and needs;
- assess risks;
- provide you with advice on insurance services;
- offer products and services tailored to your needs.

Do we transfer your data outside the EU/EEA

We process your data within the European Union and the European Economic Area. However, to provide certain services, data may be transferred to countries outside these territories, for example, if it is necessary for our cooperation partners to provide certain services. If we carry out such transfers, we will inform you. In such cases, we ensure that data is processed in accordance with the requirements of the regulation and is protected at the same level as required by the regulation.

If we transfer your data outside the EU or the EEA, we comply with at least one of the following conditions:

we carry out the transfer to a country that has been recognized by the European Commission as safe for data protection;
we transfer the data to a country or an international organization that guarantees security in accordance with specially adopted rules;
the transfer of data is permitted by the Data State Inspectorate based on agreements between us and third parties (cooperation partners);
you have given your explicit consent to the transfer of data;
the transfer of data is necessary for the performance of a contract between you and the insurer or a contract with our cooperation partner in your interest;
the data is transferred for the purpose of defending or exercising your rights, for example in legal proceedings.

For more information on data transfers outside the EU and EEA, visit the Data State Inspectorate’s website: www.dvi.gov.lv. There you can also find the decision on countries that provide a level of data protection equivalent to Latvia’s data protection level.

How long we retain your data

The length of time we keep your data depends on the purpose for which it is used. When determining retention periods, we consider the following criteria:

Performance of the contract: We retain data for as long as necessary to ensure that the product or service is available to you.
Legal requirements: We must keep data for a period specified by law, for example, 3 years from the moment the service contracts with you are terminated, if we request information from public registers, 5 years to comply with anti-money laundering regulations.
Protection of interests: After the end of our cooperation, we retain data to protect your interests and ours, for example, for 3 years from the termination of service contracts with you.
Legitimate interests: If the deletion of data could harm our, your, or third-party interests, we will retain the data for as long as necessary.
Preservation of evidence: We keep data to demonstrate that previous processing was lawful, for example, your consent to receive notifications and offers.

If the data is processed based on your consent, we retain it for as long as the consent is valid.

We follow insurance industry guidelines when setting retention periods. If several valid periods apply such as those required by law and those necessary to protect our and your interests, we will keep the data for the longer period.

If none of these criteria apply, we will delete or anonymize your data.

What are your rights in relation to the data processing we carry out

When processing data, we ensure the following rights for you, by submitting a written request to us in free form:

Withdraw consent for data processing	If you have given consent, for example, to receive offers and notifications about our products, you can withdraw it at any time. You can withdraw your consent using: online banking, if you are a bank client, mobile application, if you are bank client; email, bank's client service centres by visiting in person. If you withdraw your consent, we will stop processing your data.
Access your data	You have the right to receive from us: confirmation of whether we process your data; detailed information about your data processing to ensure that the data is accurate and processed in accordance with the law. If you wish to access your data, please specify the exact time and the data you would like to receive. You have the right to know what data we hold about you, why we process it, how we obtained it, to whom we have disclosed it, and how long it will be retained. You may also request a copy of your data. To help us fulfil your request faster, please indicate the shortest possible time and describe precisely what data and information you would like to receive. Please note that we cannot be able to provide information if prohibited by law, for example, when providing data to law enforcement authorities (police, prosecutor's office, court, etc.).
Correct data	If you believe that the data we hold is inaccurate or incomplete, please let us know: inform us about corrections needed; we may ask you to provide documents confirming the necessary changes to the data, for example, if you have changed your surname.
Delete data	You can request the deletion of your data if you believe that: it is no longer necessary; it is not being used for the intended purposes. We will delete your data and inform our cooperation partners about the need to delete it, unless the data is required for the purposes for which we process it or the law requires us to retain it longer. Please note that it may not always be possible to fulfil a deletion request, for example, if the data is needed to provide you with a service, comply with legal requirements, or in legal proceedings.
Restrict data processing	You may request to restrict the processing of your data if: you dispute the accuracy of the data (the restriction will apply until the accuracy is verified); you believe the data processing is unlawful, but prefer to restrict rather than delete the data; we no longer need your data, but you need it to defend your rights; you object to data processing based on our legitimate interests. We will reassess whether, considering your objections, we need to continue processing data. If data processing is restricted, we will use the data only for specific purposes, such as defending our rights.
Transfer data	Data you have provided to us based on your consent or under a contract can be transferred. It is also possible to transfer data if we process it in an automated way. You can use this data yourself or, upon your request, we will transfer it to another service provider if there are no obstacles. When transferring data, please note that it may include third-party data, and its transfer must be assessed considering the rights and freedoms of third parties. To help us fulfil your request more quickly, please describe as precisely as possible what data and information you wish to transfer.
Object to data processing	You may object to the processing of your data if we process it based on legitimate interests. We will review your objections and assess the need to continue processing. We will need to continue data processing if it is necessary to comply with the law or to protect our rights. You will not be able to exercise the right to object to the data processing if you have given your consent to the data processing, if data processing is necessary for the performance of a contract, or if we are required to process the data to comply with the law.
Refuse automated individual decision-making, including profiling	We do not process your data in an automated way, including profiling.

How to submit a data processing request and how will we process your request

How can you submit a request?	What is the response time for processing your request?	What will be the fee for processing your request?	How will we provide a response to the request?
In writing, in free form: in person, by visiting the bank's customer service centres, presenting an identity document – a passport or ID card, or a power of attorney if acting on behalf of someone else by email – assigning the request with a secure electronic signature via online banking, if you are a bank client using the mobile application, if you are a bank client Upon receiving your request, we will review it. If necessary, we will ask you to clarify the information and the data processing activities you would like to receive information about.	We will review your request: not later than within 1 month from its receipt; if the request is extensive or complex, we may need an additional 2 months. We will inform you about the period of extension and the reasons for it.	You can receive a response to your request: free of charge; if you submit a repeated request and we conclude that it is unfounded or excessive, we may apply a fee or refuse to fulfil the request. The fee will cover the costs of processing the information and the work of our employees. If payment is required, we will inform you in advance.	You can receive a response to your request: in person, by visiting the bank's customer service centres, presenting an identity document—a passport or ID card, or a power of attorney if acting on behalf of someone else; by email; receiving a password via SMS to access the document; via online banking, if you are a bank client; using the mobile application, if you are a bank client. We will take into account the way you provide us with a response.

What to do if you believe that we have infringed your rights by processing

We process your data in accordance with the regulation, European Union and Latvian laws, best practices in the financial sector, and guidelines and recommendations issued by supervisory authorities. If you believe we have violated your privacy rights, you can submit a complaint to us using the provided contact information. If the response does not meet your expectations, you can file a complaint with the Data State Inspectorate using the contacts provided:

AAS "CBL Life"	Data State Inspectorate
Address: Republikas laukums 2A, Riga, Latvia, LV-1010	Address: Elijas iela 17, Riga, Latvia, LV-1050
Phone: +371 67010129	Phone: +371 67223131
Email address: life@cbl.lv	Email address: pasts@dvi.gov.lv
Data Protection Officer's email: gdpr@citadele.lv	Website: www.dvi.gov.lv

If the response from us or the Data State Inspectorate does not provide the desired solution, you have the right to apply to the court.

How do we keep your data safe

We protect your data against unlawful access, use, disclosure by taking the following measures:

We restrict access to the premises to unauthorised persons by ensuring:

Door locks (electronic doors): We ensure all premises are locked when employees are not present.
Access control: We use access cards (magnetic, chip cards), identity readers, code systems to control who can access the premises.
Selection of personnel: We carefully select reliable employees.

We limit access to technological resources, ensuring protection of:

Technological devices: Computer devices (desktop computers, laptops, tablets, servers), mobile devices (smartphones), communication devices (routers, modems), data storage devices (external hard drives, USB drives, SD cards), and other devices (printers, scanners, monitors);
Information systems, software, and applications;
Communication networks and technologies enabling data transmission and information exchange (internet, VPN, mobile networks, cloud technologies, etc.).

For the protection of technological resources, we provide:

Prevention of environmental threats: We implement safety measures against fires, floods, large temperature changes and other conditions.
Prevention of technical risks: We take care that there is a good power supply, uninterrupted power supplies in case of power failures and that other similar malfunctions do not occur.
Human threats: We do not allow damage or theft.
Secure passwords: We use secure and complex passwords for devices and accounts.
Screen locking: When the device is not in use, we lock the screen.
User roles: We limit access to data and systems, allowing only what is necessary for the relevant user.
Software and security updates: We always install the latest versions to prevent vulnerabilities.
Encryption: We encrypt data so that it cannot be accessed by third parties/unauthorized persons.
Secure connection: We use HTTPS and VPN to ensure security when working online.
Antivirus: We install and update antivirus programs on all devices.
Firewalls: We use a firewall to protect the network from unwanted access.
Attack detection systems: We install programs that monitor and warn about suspicious activity.

We carry out regular inspections and provide updates

Device checks: We regularly check that all devices are in working order and in place.
System updates: We install the latest software updates to address security risks.

We educate employees

Training: We regularly inform employees about safety issues and how to act in suspicious situations.
Threat prevention: We warn you about fraudulent emails and other potential security risks.

We monitor and analyse security

Log files (audit trails): We record access and operations in systems so that they can be monitored and reviewed.
Regular tests: We check the safety of systems to identify and eliminate potential risks.

We are ready for emergencies

Backups: We regularly make backups of data and store them in safe places.
Emergency plan: We prepare a plan for responding to threats to premises or technology.

Why is it important to us and to you?

Protecting technological resources helps protect data, prevent data leaks, theft, and guarantees that we can continue to work and avoid loss of money and reputation. Safety depends on each employee, so it is important to be careful and follow the rules.

Your data can only be accessed by insurer’s employees and cooperation partners who need it to perform their work duties. Before starting cooperation, we carefully evaluate the cooperation partners and inform them about the confidentiality and data protection. We and our cooperation partners ensure the protection and use of your data only for the intended purposes, in accordance with the requirements of the law.

How will we ensure up-to-date information about your data processing

To ensure that you are always informed about how your data is processed, we will regularly review and update these rules. Therefore, we invite you to review the latest version from time to time on our website, in online banking (if you are a bank`s client), mobile application (if you are a bank`s client), at bank’s client service centres or by email. If there are any significant changes, we will notify you one month before they take effect.

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use
2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use 2 On the use of marketing cookies for our loan services

1 Notification on Cookie Use 2 On the use of marketing cookies for our loan services

Digital bank

Cards

Payment methods

Bring a friend!

For daily needs

For car

For home

Obligations

Pension

Short term savings

Long term savings

Finotherapy

For car and machinery

For financial security

For home

For an active lifestyle

Useful

Contact us

Contacts