Data Protection and Privacy

We may ask for your consent to process personal data through various channels, including the cookie banner on our website, when you're filling out applications for our services or products, or via email.

Consent is always requested for specific purposes, and the types of personal data involved are clearly explained.

You have the right to withdraw your consent at any time. You can do this by getting in touch with a BBE employee who requested your consent or by reaching out to BBE's Data Protection Officer. It's important to note that withdrawing your consent won't affect the legality of any processing that took place before the consent was withdrawn.

Before BBE enters into a contract with you to provide a service or product, we are required to process personal data. This helps us assess whether the contract can be finalized and, if so, what terms and conditions will apply.

Becoming a BBE customer involves certain mandatory administrative and accounting procedures. Examples of data processing related to contract fulfillment include managing accounts, handling payments, deposits, lending, credit monitoring, and financial instrument transactions.

It's important to note that if you don't provide the necessary personal data required to finalize the contract, we won't be able to provide you with the requested service or product.

As a financial institution, BBE must adhere to a wide range of legal obligations that involve collecting and using your data. The list of third parties with whom your information is shared includes other financial institutions, regulatory banking authorities, local tax authorities, judicial bodies, and external auditors.

Anti-Money Laundering and preventing the financing of terrorist activities

Banks must do everything they can to prevent, uncover and/or report instances of money laundering and financing of terrorism to the authorities. Given it is a matter of public interest, we must take the necessary steps to assist in combating crime.

In particular, BBE has to:

• Identify you as a customer;
• Verify your identity;
• Determine your profile (in relation to the risk of money laundering), which involves collating various personal and business data, such as whether you’re a politically exposed person;
• Check your actions and transactions, prevent certain transactions, and report them.

For this sake, we can use both personal data provided by you and personal data coming from other channels such as Internet search engines, social media or the Internet in general. We might also exchange personal data with corresponding banks and relevant public authorities.

Mandatory disclosure and reporting to the authorities

Banks have a duty to respond appropriately when you exercise your data subject rights. They also have to communicate with the Data Protection Authority, for instance in case a complaint is submitted.

Moreover, banks must report to the authorities and bodies with supervisory duties such as the Financial Services and Markets Authority, the National Bank of Belgium, the European Central Bank, the Financial Conduct Authority, the Prudential Regulation Authority and “Autorité de contrôle prudentiel et de resolution”. BBE must also respond to their questions even if these questions involve providing your personal data to those bodies.

Banks also have to respond to enquiries of the tax authorities, courts’ administration (covering law enforcement right from the police, through investigating judges and prosecutors to trial courts) and especially concerning matters falling under the police statutes and court procedure in general.

Furthermore, in order for BBE London to comply with the UK immigration law, we may provide information to the Home Office (https://www.gov.uk/government/organisations/home-office) in accordance with the 2014 and 2016 Immigration Act provisions and other relevant legislation.

BBE is a business with valid interests that serve as the basis for processing personal data. We require these processes to operate as a business and safeguard our rights, privacy, safety, security, and property.

In this regard, BBE takes measures to minimize the impact on your privacy. We ensure that, in all cases, our legitimate interests are in proportion to their impact on your rights and interests.

In situations where the legal basis for processing is legitimate interests, you have the right to object. BBE will honor your objections unless we have compelling reasons not to do so.

• Risk management, security and fraud prevention measures;
• Use of personal data for organisational purposes (e.g., administration, internal reporting);
• Linked to the provision of certain services (e.g., IT).

If you want to access personal data about you that is processed by BBE or detailed information about the processing activity itself, please let us know either by reaching out to the employee who collected your personal data or BBE Data Protection Officer.

Here is the list of information that you can request:

• The purposes of the processing;
• The categories of personal data concerned;
• The (categories of) recipients to whom personal data have been or will be provided;
• The envisaged period for which personal data will be stored if we already know this period. If it is not possible to determine yet, the criteria used to determine that period;
• The right to change or erase your personal data, to restrict or object processing if there are legitimate grounds for that;
• The right to file a complaint with a supervisory authority;
• (When we collect your data from other sources other than yourself) any available information about the source;
• The existence of automated decision-making, including profiling, and as much meaningful information about the logic involved as it is possible to provide, as well as any significance and envisaged consequences this automated decision-making might create for you.

Please be aware that, at present, we do not base decisions solely on automated decision-making, including profiling.

If you exercise your right of access, BBE will provide you with as much information about your personal data as possible. However, some personal data, such as those in backup files or stored/archived records, may not be part of the ongoing processing and therefore may not be immediately accessible. Retrieving this personal data may take additional time.

In certain situations, anti-money laundering laws prevent BBE from granting you access. For instance, we cannot provide access to personal data related to an ongoing anti-money laundering investigation. The law restricts this to prevent compromising the investigation. Nevertheless, you can always request further information.

BBE may request additional information from you or take reasonable steps to confirm your identity. This is essential to ensure that access is granted to the right person.

Normally, you should be able to exercise your right within one month. We might extend this period to two months if the request is complicated or if there is a significant number of requests.

Providing this information is free of charge for you. However, please note that if you request additional copies of the provided information, BBE may charge a reasonable fee based on administrative costs.

It may happen that certain information that BBE has about you is not correct or is no longer accurate. You can request to correct or complete inaccurate personal data at any time.

You can ask BBE to completely erase your personal data in case:

• Personal data that we have is obsolete or no longer necessary for the purposes for which they were collected or otherwise processed;
• You want to take back your consent and there is no other legal ground for processing;
• You object to processing and there are no overriding legitimate grounds for the processing, or, if your personal data are used for marketing, your objection would be enough to erase them;
• Your personal data have been unlawfully processed;
• We must comply with a legal obligation.

Moreover, if we no longer have an overriding ground for processing your personal data, we will erase it. Please note that some legal obligations can prevent us from erasure.

If you have reservations about how BBE uses its legitimate interests or general public interests to process specific personal data, you have the right to object to such usage. We will consider your objections, unless there are compelling reasons not to, such as when we process personal data for the purpose of combating fraud, money laundering, or terrorism.

For personal data used in marketing purposes, your objection is unconditional and must be honored at all times.

If you choose not to provide specific reasons for your objection, BBE will interpret your request broadly.

In some cases, you may ask BBE to restrict the processing of your data. There are several grounds for that:

• During the period when BBE verifies the accuracy of your personal data, if you challenge the accuracy of these data;
• When processing is unlawful but you do not want personal data to be erased;
• When BBE no longer has a purpose for processing, but still needs your personal data in connection with a legal claim;
• Pending BBE’s reply to whether BBE’s legitimate interest gains more importance than your interest, rights, and freedoms when you have exercised your right to object.

The right to data portability grants you the ability to receive your personal data in a structured, commonly used, and machine-readable format. It also empowers you to request that BBE transfers this data directly to another data controller.

This right to data portability is applicable under the following conditions:

• Lawful basis for processing this information is consent or for the performance of a contract;
• The processing is carried out by automated means (i.e., excluding paper files); and
• The data was provided by you to BBE.

When submitting a request to exercise your rights, please provide as much detail as possible. We can only effectively address inquiries that are sufficiently detailed.

• Recruitment and Selection: we use your personal information to assess your qualifications and suitability for employment with BBE. This includes evaluating your skills, experience, and qualifications against job vacancies.
• Communication: we may use your contact details to communicate with you throughout the recruitment process, including scheduling interviews, providing updates, and notifying you of the status of your application.
• Background Checks: we may conduct background checks as permitted by law to verify the information you provide and assess your eligibility for the position.

• Authentication and Verification: we verify your identity in order to give you the authorisation to engage with our systems or services.
• Access Management: we process your personal data when managing access permissions for employees of third-party entities who interact with our systems or services based on their roles and responsibilities.
• Vendor Management: we process your personal data to ensure effective vendor management, including procurement, payments, and coordination.
• Performance Evaluation: we might process your personal data during the evaluation of the performance and effectiveness of with third-party entities to ensure successful outcomes.
• Contract Management: during the process of contract management, we process your personal data.

• Visitor Registration: when accessing the bank's premise, we collect and record your personal data at the reception for security and record-keeping purposes.
• Access Management: we manage access permissions based on your registration information, ensuring only authorised accesses.
• Emergency Response: we might use your personal data to facilitate emergency response procedures and evacuation plans, ensuring the safety of all individuals on-site.
• Camera Monitoring for Security: we use camera surveillance for security purposes, ensuring a safe environment within the bank's premises.
• Call Recording: we might record calls made by members of the public, with prior warning to callers, for record-keeping and security.