Your privacy

Today, technologies are evolving rapidly, enabling swift exchange of information and data that may affect your privacy. Your privacy is important to us, and we do everything we can to protect it.

Financial security and secrecy of transactions

Our daily work involves handling confidential and private information — your data, your transactions, and other information. You entrust us with this information so that you can receive high-quality services from us and so that we can take special care to ensure the security of your data and transactions.

Trust

Your trust is important to us, so we make sure your data is always safe.

Compliance with the law and best practices

We, SIA “Citadele Leasing”, have developed these Privacy Protection Rules to provide you with general information on what data we process, why we process it, and how we protect it. You can also obtain information about data processing in applications, agreements, and other documents if you have applied for our products and services.

If you wish to receive information about the processing of your data, we will provide it in accordance with your request and in the manner specified in these rules.

We provide this information in accordance with the laws and regulations of the European Union and the Republic of Latvia, as well as the recommendations of the financial sector and supervisory authorities, and best practices.

These Privacy Protection Rules explain the processing of your data if you are a lessee, renter, borrower, joint lessee, guarantor, pledgor or provider of security, buyer, seller, sub‑lessee, holder or user.

processing – any actions we perform with your personal data, such as collecting, recording, storing, viewing, using, disclosing your personal data by sending, disseminating or otherwise making them available, coordination, deletion or destruction of your personal data, and more.

bank – AS "Citadele banka", unified registration No. 40103303559.

Citadele Group companies – AS "Citadele banka" and all its foreign branches and subsidiaries, including us.

Data State Inspectorate – an institution that supervises the application of the Regulation in the Republic of Latvia.

EU/EEA – European Union/European Economic Area.

you or customer – the person whose data we process.

we – SIA “Citadele Leasing”, unified registration No. 40003423085.

rules – these Privacy Protection Rules.

data – any information that concerns or could relate to you, such as your name, surname, personal identification number, address, telephone number, e-mail address, your habits.

consent – any freely and informed confirmation by which you consent to the processing of your data.

profiling – an automated method of processing your data to assess your economic, financial situation, personal preferences, interests, reliability, behavior, etc.

Regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

Your data is processed by SIA “Citadele Leasing”, unified registration No. 40003423085, address: Republikas laukums 2A, Riga, Latvia, LV-1010.

If you have any questions regarding the processing of your data, you may contact us by calling +371 67010000 or by writing to lizings@citadele.lv, or by contacting our data protection officer at privacy@citadele.lv.

We obtain your data:

• when you provide them to us:
  • when using our products and services, which you may apply for through our partners, on Citadele Group website, in the Leasing Portal, or by completing an application form. We obtain information about how you use these services, as well as data from your devices (computer or mobile phone) through the use of cookies;
  • upon our request, in the manner prescribed by law, when establishing a business relationship with us;
  • as a lessee, renter, borrower, joint lessee, joint renter, guarantor, pledgor or security provider, buyer, seller, sub‑lessee, holder or user;
  • when you contact us by post, e-mail, via the Leasing Portal, the mobile application, by telephone, in person, or when visiting our customer service centers.
• when they are provided to us by third parties:
  • our cooperation partners who provide you with information about us, conduct market research, or provide services;
  • other companies within the Citadele Group;
  • databases and registers holders;
  • state institutions and law enforcement authorities and their officials.

Your data are accessible only to our employees and the employees of our cooperation partners and bank who require access for the performance of their work duties and for the provision of the services you need. They process your data for specific purposes, in accordance with legal requirements and our terms of transactions.

We may, in certain cases, carry out automated Processing of your data and perform profiling.

Profiling

• What is it? Profiling is a method of data processing in which, using various personal data, we create your personal “profile”, within which we assess data such as your financial situation, purchase or service usage history, liability history, interests, preferences, and similar information.
• Why do we carry out profiling? We perform profiling in order to assess whether:
  • the respective product or service is suitable for your specific needs and preferences;
  • to assess risks;
  • to provide you with advice related to our services;
  • to offer products and services that correspond to your needs.
• How does this affect you? For example, in order to determine an appropriate financing limit for you, our system automatically receives information from public registers regarding your liability history, analyses account statements and data on your use of our services, and, as a result, makes a decision on granting a financing limit. If you do not agree with the decision, you may request our employees to review it.

We process your data in the European Union and the European Economic Area. However, to provide certain services, data may be transferred to countries outside these territories, for example, if it is necessary for our cooperation partners to provide certain services. We provide you with information about this in section 4 of these rules. In such cases, we ensure that the data is processed in accordance with the requirements of the Regulation and is protected at the same level as required by the Regulation.

If we transfer your data outside the EU or the EEA, we comply with at least one of the following conditions:

• the transfer is carried out to a country recognized by the European Commission as safe and providing an adequate level of data protection;
• the transfer is carried out on the basis of the Standard Contractual Clauses approved by the European Commission for data transfers outside the EU or EEA.

When processing your data, we ensure that you have the following rights, which you may exercise by submitting a written request in free form:

We process your data in accordance with the regulation, European Union and Latvian laws, financial industry best practice, guidelines and recommendations issued by supervisory authorities. If you believe that we have violated your privacy rights, you can submit a complaint to us using the contacts listed below. If the response provided does not meet your expectations, you can submit a complaint to the Data State Inspectorate using the contacts listed below:

If our response or the response from the Data State Inspectorate does not provide you with the desired solution, you have the possibility to bring the matter before a court.

We ensure the protection of your data against unlawful access, use, disclosure by taking the following measures:

We restrict access to the premises to unauthorised persons by ensuring:

• Door locks (electronic doors): We make sure that all premises are locked if there are no employees in them.
• Access control: We use access cards (magnetic, chip cards), identity readers, code systems to control who can access the premises.
• Video surveillance, alarms, sensors: We install video surveillance cameras to monitor important premises and places.
• Selection of personnel: We select reliable employees.

We limit access to technological resources, ensuring:

• protection of technological devices (computer devices (desktop computers, laptops, tablets, servers), mobile devices (smartphones), communication devices (routers, modems), data storage devices (external hard drives, flash drives, SD cards), other devices (printers, scanners, monitors, video cameras, POS terminals);
• protection of information systems, software, applications, mobile applications;
• the protection of communication networks and technologies enabling data transmission and information exchange (internet, VPNs, mobile networks, cloud technologies, etc.).

For the protection of technological resources, we provide:

• Prevention of environmental hazards: We implement safety measures against fires, floods, large temperature changes and other conditions.
• Prevention of technical risks: We take care that there is a good power supply, uninterrupted power supplies in case of power failures and that other similar malfunctions do not occur.
• Man-made hazards: We do not allow damage or theft.
• Secure passwords: We use secure and complex passwords for devices and accounts.
• Multi-factor authentication: We add an additional layer of security.
• Screen lock: When the device is not in use, we lock the screen.
• User roles: We limit access to data and systems, allowing only what is necessary for the relevant user.
• Software and security updates: We always install the latest versions to prevent vulnerabilities.
• Encryption: We encrypt data so that it cannot be accessed by third parties/unauthorized persons.
• Secure connection: We use HTTPS and VPN to ensure security when working online.
• Antivirus: We install and update antivirus programs on all devices.
• Firewalls: We use a firewall to protect the network from unwanted access.
• Attack detection systems: We install programs that monitor and warn about suspicious activity.

We carry out regular inspections and provide updates

• Equipment inspection: We regularly check that all devices are in working order and in place.
• System updates: We install the latest software updates to address security risks.

We educate employees

• Training: We regularly inform employees about safety issues and how to act in suspicious situations.
• Threat prevention: We warn you about fraudulent emails and other potential security risks.

We monitor and analyse security

• Log files (audit trails): We record access and operations in systems so that they can be monitored and reviewed.
• Regular tests: We check the safety of systems to identify and eliminate potential risks.

We are ready for emergencies

• Backups: We regularly make backups of data and store them in safe places.
• Emergency plan: We prepare a plan for what to do in case of a threat to premises or technology.

Why is it important to us and to you?

Protecting technological resources helps protect data, prevent data leaks, theft, and guarantees that we can continue to work and avoid loss of money and reputation. Safety depends on each employee, so it is important to be careful and follow the rules.

Your data can only be accessed by us, Citadele Group employees and cooperation partners who need it to perform their work duties. Before starting cooperation, we carefully evaluate the cooperation partners and inform them about the confidentiality and protection of data. We, Citadele Group companies and our cooperation partners ensure the protection and use of your data only for the intended purposes, in accordance with the requirements of the law.

To ensure that you are always informed about how your data is processed, we will regularly review and update these rules. Therefore, we invite you to review the latest rules from time to time on our website, customer service centres or by e-mail. If there are any significant changes, we will notify them one month before they come into effect.