Re: currency exchange transactions in cashless form
To: Acting Governor of National Bank of Ukraine, Mr Yakiv Smolii
If you have found a spelling error, please, notify us by selecting that text and pressing Ctrl+Enter.
When you create a personal cabinet, we process your personal data in accordance with the EBA's Privacy Policy, which is set out below. Therefore, we need your consent to the processing of personal data and confirmation that you have read our Privacy Policy.
European Business Association ("EBA") respects your data privacy. This Privacy Policy ("Policy") covers issues regarding the collection, use, disclosure, transfer and storing of your personal information.
Please make sure that you are familiar with our privacy practices and contact us if you have any questions.
1) Definitions
To ensure that you understand the issues of data processing, we will firstly explain the terms used in this Policy:
2) What data do we collect?
When you communicate with us by any means of communication including, but not limited to e-mail, fax, phone, social networks, online application form, send us different files, CV’s, use a personal electronic cabinet on the EBA website, conclude agreements with us, or participate in events organized or co-organized by us, we may collect your personal data, including:
We may also collect data that contains information about the domain name or IP address, date and length of time spent by the Internet user on the EBA website. Such data is collected automatically when the Internet user visits the EBA website. In conjunction with other data, this information helps us determine the most attractive content for our visitors. In addition, such data helps us to detect any destabilization of our facilities.
The EBA may also receive personal data from third parties (e.g., partners) who are the controllers of the respective personal data. Such third parties shall ensure the legality of the respective transfers and, if necessary, obtain voluntary informed consent for the transfer from the data subjects. In some cases, the EBA may act as a data processor and process the received data in accordance with the provided instructions and exclusively for the purposes for which they were transferred to the EBA. If such an obligation is applicable, the EBA will notify the data subjects of receiving their personal data within a reasonable period.
3) Cookies policy
The EBA website uses cookies – small text files that are placed on your device for storing data and that can be read by the web server in the domain that hosted them. We use cookies for enabling you to sign-in, analyzing how our website performs, keeping track of activity on our website, collecting traffic data and fulfilling other legitimate purposes.
Most web browsers automatically use cookies, while allowing users to control the process by blocking or deleting them. Instructions for blocking or deleting cookies can be found in each browser's privacy settings or reference documentation.
4) How do we use your data?
The purposes of data processing by the EBA depend on the character of our relations with you:
If you are an employee of the EBA Member, our general purpose for collection and processing of your data is to enable your possibility to get access to the benefits that are related to membership in the EBA of your employer. Therefore, processing your personal data is conducted for such purposes:
If you are a participant in the events organized (co-organized) by the EBA, we will collect and/or process your personal data for reaching the following purposes:
If you are a representative of the EBA potential member, we collect and process your personal data for reaching the following purposes:
If you are a representative of a company which is not an EBA Member but has access to some of the EBA benefits, we will collect and process your personal data to reach the following purposes:
If you are an employee or representative of a supplier with which the EBA has (or intends to have, or had in the past) contractual relations, we will collect and/or process your personal data for the purposes of performance of contractual relations (if they are ongoing) and fulfilment of our legal obligations (e.g., to store accounting documents during the period established by legislation). This might also involve storing, updating, and analyzing data in our corporate software.
If you are a candidate for employment in the EBA, we will collect and process your personal data for reaching the purposes of your possible employment in our organization and fulfilling our legal obligations if such are applicable. In relation to this purpose, your data might be stored, updated, and analyzed in our corporate software. Please, be aware that the candidates for employment in the EBA are not subject to automated individual decision-making.
It is important to mention that apart from the purposes listed above, we may also process your personal data to provide law enforcement authorities with the information necessary for criminal proceedings or if such processing is necessary for another legal obligation to which we are subject, in order to protect your vital interest as a data subject or the interest of another natural person or for the purpose of any other legitimate interest pursued by the EBA or a third party that does not violate your fundamental rights and freedoms as a data subject.
Legitimate interest means the interest of the EBA in terms of conducting its statutory activity. When we process your personal information for the purposes of our legitimate interests, we balance any potential impact on you and your rights. Our legitimate interests do not automatically override your interests.
We process personal data for particular legitimate purposes, which include but are not limited to:
We also may collect data in a form that does not, on its own, permit direct association with any specific individual (non-personal data). We may collect, use, transfer, and disclose non-personal data for any purpose. If we do combine non-personal data with personal data, the combined data will be treated as personal data as long as it remains combined.
5) How long do we store your data?
We try to make it easy for you to keep your personal information accurate, complete, and up to date. We will retain your personal information for the period necessary to fulfil the purposes outlined in this Policy. When assessing these periods, we carefully examine our necessity to collect personal information at all and if we establish such necessity, we only retain it for the period required to realize the purpose of collection (for instance, the term of your employment in EBA Member, etc.) unless a longer retention period is required by law.
We anticipate that the EBA Member will inform us if an employee leaves a company and that will give us an understanding that the data of the person can no longer be used for the purposes related to the membership in the EBA of his former employer.
6) With whom do we share your data?
We do not share your personal data with companies, organizations, or individuals outside of the EBA except in the following cases:
Only names, surnames, emails, photos and positions of participants of EBA events or participants of events in which the EBA acts as co-organizer, members of EBA governing bodies, and EBA Members’ employees may be published on the EBA website (websites).
The EBA publishes on its website the names, surnames, and photos of representatives of the EBA Members, who represent them in the EBA governing bodies (e.g., in the EBA Board), in the management of the EBA working bodies (industrial and open committees, temporary and permanent working groups, etc.) and the EBA regional offices (the regional offices’ coordination councils, if they are established).
7) How do we protect your personal data?
The EBA treats the security of your personal data very seriously. We protect your personal data by various means in order to maintain its confidentiality and integrity and prevent the unauthorized use or disclosure of your personal data and to protect your personal data from loss, misuse and unauthorized access, disclosure, alteration or destruction.
Firstly, the EBA has corporate procedures that define how employees should leave their working space when they leave the office (clear desk policy). Moreover, each EBA employee has a unique password in order to access the website’s back office as well as passwords to access the local database that also include necessity to undergo two-factor verification in order to obtain respective access.
Hosting providers and cloud service providers guarantee protection by means of encryption. Some types of data that are stored on cloud services may be restricted for a certain group of users. For instance, employees from one department cannot access data from other departments.
The premises with laptops and local servers are equipped with an alarm system and are under the security provided by the lessor of the premises where the EBA office is located. Access to such premises with laptops can be obtained only with passes to the location, which are unique for each EBA employee.
8) How can you control your personal data?
You have the right to access, rectify or have your personal data erased or restricted from processing or to object to the processing of your personal data. If processing is based on your consent, you have the right to withdraw your consent at any time.
To exercise these rights, please contact us: [email protected].
9) Data transfer
Information we collect may be transferred to, stored and processed in any country where one or more EBA Member or third party service provider are located or maintain their facilities. Third parties may be located outside Ukraine or the European Economic Area ("EEA"), so their processing of your personal data will involve a transfer of data outside Ukraine and the EEA, respectively.
In particular, we may share personal data of EBA Members’ employees with our mailing service provider – The Rocket Science Group LLC registered in the USA, in order to dispatch newsletters, invitations, offers, etc.
We also may share personal data with the operator of our cloud service – Microsoft Corporation registered in the USA, in order to provide the storage of information.
Data may also be transferred to Google LLC by the use of cookies by Google Analytics. In this case, Google LLC serves as the processor of such data.
Additionally, the data may be transferred to companies-providers of video conference services Zoom (Zoom Video Communications, Inc.), Microsoft Teams (Microsoft Corporation), and Google Meet (Google LLC), registered in the USA, to ensure the possibility of joining video conferences organized or co-organized by the EBA.
While such territories may not have the same standards of data protection as those within your home country, we will continue to protect the personal information we transfer in accordance with this Policy.
