Personal Data Protection
Data controller details
UniCredit Consumer Financing EAD with UIC 175070632 /the Controller/, with seat and registered address: Sofia, P.O. Box 1303, Serdika quarter, 14 Gyueshevo str., is a personal data controller and processes your personal data lawfully, fairly and in a transparent manner.
Data Protection Officer
The Personal Data Protection Official of UniCredit Consumer Financing EAD is Mr. Anton Todorov. Contact details:
Purposes for the processing of personal data
UniCredit Consumer Financing EAD is a financial institution holding a License for conducting credit activities issued by the BNB with Order No. РД22-2104/ 02.11.2009. In order to provide quality lending and services the Controller processes information in the form of personal data for the following purposes:
- For the purposes of lending and managing relationships with clients of loan services, the Controller processes personal data:
- Upon received preliminary information which is necessary for entering into a contract
- Upon stated wish by clients
- In cases of disputes (commercial, arbitration, litigation, disputes before administrative bodies, etc.) related to the Controller’s activity
- On identifying clients to address their objections, responses to complaints, performing checks, providing opinions and information, etc.
- In case of inquiries/consultations by phone and after-sales activities on a specific loan or other products and services
- For evaluation of your creditworthiness, including in relation to making individual decisions based on: (a) manual processing according to pre-defined criteria; (b) automated processing according to pre-defined criteria; and (c) automated processing (without human intervention), including profiling, and the decisions thus made are used for entering into/refusal to enter into a contract between you and the Controller. When performing profiling information about financial indicators, client behaviour and habits is analyzed to offer a specific product and/or service.
- To assess the reliability and promptness of payments upon approval of loans.
- For promotion and sale of products and services, including by preliminary profiling. When performing profiling, information about preferences, habits, consumer choices is analyzed to improve the quality of customer services and the offering of new products and services.
- To survey the level of your satisfaction with the quality of services and activities performed by the Controller and UniCredit Group companies other than the Controller: UniCredit Bulbank AD, UniCredit Factoring EAD, UniCredit Fleet Management EOOD, UniCredit Leasing EAD, UniCredit Insurance Broker EOOD, as well as for marketing and market research. The activity is performed through interviews, questionnaires and other information channels.
- For selection of suppliers of external services for the Controller. In the process of selecting a supplier information is also processed in the form of personal data under Regulation EU 2016/679 on Personal Data Protection.
- In managing relationships with suppliers of external services for the Controller. Personal data of the supplier’s representatives or the supplier itself is processed during negotiations and administration of concluded contracts, in the cases of legal or tax-related investigations, as well as in the cases of commercial and judicial disputes.
- Management of anti-fraud activities. The Controller processes personal data in performing activities on fraud prevention, detection, investigation and management.
- Security protection of data, information, applications, systems and networks.
Grounds for Personal Data Processing
UniCredit Consumer Financing EAD processes your personal data pursuant to art.6, “а“ of Regulation EU 2016/679 in cases where your freely expressed, specific and informed consent to processing your personal data is required. In the cases when such consent is required and you make an informed decision not to give it, the Controller may not be able to provide the relevant product/service for which the consent is required. When the processing of your personal data for a specific purpose is based on your consent, you may withdraw it at any time and the lawfulness of the processing before the withdrawal will not be affected.
UniCredit Consumer Financing EAD processes your personal data pursuant to art. 6, “b“ of Regulation EU 2016/679 where the processing is required for the implementation of a contract to which you are a party, or for taking steps based on your request for entering into a contract. In the cases when you take steps for entering into a contract with UniCredit Consumer Financing EAD and/or you enter into a contract with UniCredit Consumer Financing EAD it is necessary to provide information in the form of personal data so as to enable the Controller to provide the product or the service you want. Failure to submit your personal data will lead to the controller’s inability to provide the services you request, and for which steps need be taken before entering into a contract.
Pursuant to art. 6, “c” of Regulation EU 2016/679 the Controller processes personal data in order to comply with the legal obligations laid down in the Credit Institutions Act, the Consumer Credit Act, the Anti-Money Laundering Act, the Меаsures Against Financing of Terrorism Act, the Obligations and Contracts Act, the Civil Procedure Code and other applicable laws and regulations regulating the Controller’s activities as a financial institution, as well as the effective financial, tax and accounting legislation in the country.
Your personal data is processed subject to compliance with art. 6, “f” of Regulation EU 2016/679 for the purposes of the legitimate interest of UniCredit Consumer Financing EAD in the cases of activities regarding:
- Anti-fraud
- Audio recording for the purposes of anti-fraud, documentation of communication conducted
- Providing data to third parties: in case of fulfillment of legal or contract obligations of the Controller or on other valid legal grounds
- Providing data to persons related to the Controller, to companies from UniCredit Group for the purposes of complying with and implementing group policies, for reporting, for audit activities and for evaluation of the credit risk
- Research and improvement of the customer service of UniCredit Consumer Financing EAD and the companies from UniCredit Group, as well as for marketing research
Categories of personal data recipients
In accordance with the requirements of Regulation EU 2016/679 UniCredit Consumer Financing EAD may disclose personal data processed by it to the following categories of recipients:
- Public authorities, institutions and establishments, auditors in cases where the Controller has a legal obligation to provide the data. Personal data may be provided also for the purpose of receiving preliminary information which is necessary to enter into a contract and/or for its implementation.
- Third parties, natural and legal persons, public authorities, institutions and establishments, for compliance with legal and contract obligations of the Controller, or on other valid legal grounds.
- Subcontractors of UniCredit Consumer Financing EAD which process personal data. The personal data processors process the data under a concluded contract/ another legal act entered into with the Controller and in accordance with the instructions of the Controller. The Controller uses only personal data processors that provide adequate guarantees for the application of suitable technical and organizational measures to comply with Regulation 2016/679.
- Persons related to the Controller, including companies from UniCredit Group when processing personal data for the purposes of the legitimate interests of UniCredit Consumer Financing EAD in the cases of implementing group policies and contract relationships; for improving the quality of customer service within the companies from UniCredit Group.
- For making inquiries and receiving information from public authorities, institutions, establishments and registers /e.g. NRA, NSSI, BNB CCR, BNB Register of Bank Accounts and Safe Deposit Boxes, DG CRAS, Expirian Bulgaria EAD, etc./, for evaluation of your creditworthiness or for receiving other preliminary information as may be necessary to enter into a contract based on your request.
- Upon entering into contracts by the Controller for assignment (cession) of its receivables under loan agreements to third parties, subject to compliance with the requirements of the effective legislation in the country.
- Partners providing credit intermediation, insurance products and other services in cooperation with UniCredit Consumer Financing EAD, only for the customers who use these services.
Transfers of personal data to a third country or an international organization
Where it is necessary to transfer personal data processed by UniCredit Consumer Financing EAD to third countries or international organisations, the provisions of Regulation EU 2016/679 shall be complied with, including in case of a potential subsequent transfer of personal data by the third country or international organisation to another third country or organisation.
Retention Periods
UniCredit Consumer Financing EAD processes your personal data within the time limits set out in the effective legislation in the country and by the regulatory supervisory authorities. After expiration of the legally/regulatory set time limits UniCredit Consumer Financing EAD will delete your personal data. Personal data which is not subject to explicit requirement for legal/supervisory storage will be deleted after achieving the purposes for which it is collected and processed.
Exercising rights under Regulation (EU) 2016/679
In addition to the information UniCredit Consumer Financing EAD provides you with it also submits the following information about the rights you have as personal data subjects and which you may exercise in compliance with the provisions set out in Regulation EU 2016/679:
Right to request from the Controller access to your processed personal data pursuant to art. 15 of the Regulation.
Right to request correction, change and update of your processed personal data pursuant to art. 16 of the Regulation.
Right to request deletion of your personal data /”The right to be forgotten”/ pursuant to art. 17 of the Regulation in the following cases:
- Absence of legal or contractual reason for its processing
- When the personal data is not necessary any longer for the purposes for which it was collected or processed
- Upon withdrawal of the explicit consent when the personal data is processed only based on the explicit consent of an entity
- In other cases as laid down in Regulation EU 2016/679
Right to request restriction of processing under art. 18 of the Regulation.
Right to object to the processing of personal data under art. 21 of the Regulation in cases where the processing is based on legitimate interest, including profiling, or where data is processed for the purposes of direct marketing, including profiling.
Right of portability of your personal data, which you have provided to the controller under art. 20 of the Regulation.
Right to complain to the Commission for Personal Data Protection.
UniCredit Consumer Financing EAD enables you to exercise your rights under the Regulation in a clear and transparent manner. For your convenience we provide you with a template of a Request for Exercising Rights under Regulation (EU) 2016/679.
If you wish to submit your request/application to UniCredit Consumer Financing EAD in free wording, in order to be duly identified, to receive a correct answer from us and to prevent abuse of your personal data based on requests of persons acting in bad faith, you must indicate the following mandatory requisites in your request/application:
- Your full name
- PIN or FPN
- Date and place of birth /if you are not a Bulgarian national/
- The number of your ID card/ID document for foreigners, the date and body of issue, its term of validity
- Permanent address / mailing address, if different from permanent address
- Email address, if you want to receive an answer to your email address
- Contact phone number, if you would enable us to call you
- In what capacity you wish to exercise your rights under Regulation EU 2016/ 679 – e.g. client/ former client; supplier; employee / former employee; legal representative / beneficial owner/ proxy / related person of a company, the name of the company respectively, BULSTAT/ UIC/ foreign registration number; other capacity: guarantor, co-debtor, etc.
- Description of the request / application to the Controller
- Preferred method of receiving an answer from the Controller - at the email indicated by you in the request; at the mailing address; at an affiliate/UniCredit Bulbank AD centre of your choice indicated by you
If the requisites are incomplete and / or incorrect, we may not be able to fulfill your request in part / in full.
As we are seeking to constantly improve our services, ensure higher level of transparency and information, we offer you the following options for submitting requests under Regulation EU 2016/ 679:
- On the spot in an affiliate / centre of UniCredit Bulbank AD of your choice
- Electronically - via email or email letter which must be signed with an electronic signature, in accordance with the Electronic Document and Electronic Trust Services Act at the following email address: VDGjoHEQSAVojDsfejuHspvq/CH
When submitting your request we recommend you to specify how and by which method you would like to receive an answer to your request:
- On the spot in an affiliate / centre of UniCredit Bulbank AD of your choice
- Electronically - via email
- At your permanent address or at another mailing address specified by you