The General Data Protection Regulation, GDPR for short, has been in force throughout the European Union since May 25, 2018. It contains regulations regarding the processing and the protection of your personal data.

This document provides you with the essential information regarding data protection in a summarized form.

1. Who is the data controller?

Intermarket Bank AG
Am Belvedere 1, 1100 Vienna
https://www.intermarket.at/en/legal-notice

Contact for requests related to data protection:
Intermarket Bank AG
Am Belvedere 1, 1100 Vienna
Email: datenschutz@intermarket.at

2. Who is the data protection officer?

Mag. Aaron Marquart
Intermarket Bank AG
Am Belvedere 1, 1100 Vienna
Email: datenschutz@intermarket.at

3.  Which items of personal data are processed and where do they come from?

We process the following personal data:

3.1. You are our customer

Most of the personal data we process about you were provided by you, for example at the start of our business relationship, upon scheduling an appointment, when submitting a request through a form or on our website, etc.

• Master data and authentication information, e.g. name, address, date of birth, telephone number, email address, tax status, identification data, a copy of your ID, etc.
• Product, service and contract data, e.g. type of product, disposition options, account movements and transactions, use of digital banking and portals (cookies), etc.
• Information about your economic situation, e.g. creditworthiness/balance sheet data, scoring or rating data, etc.
• Processing results to fulfil contracts and declarations of consent
• Data to satisfy legal and regulatory requirements
• Image and sound data, e.g. video recordings, recordings of telephone calls and your photo (if you have given consent to your photo being recorded), etc.

In addition, data may also come from the following sources:

• Publicly available sources, e.g. companies register, land register, insolvency database, register of associations, etc.
• Creditor protection associations, credit bureaus, rating agencies, e.g. KSV1870 Information GmbH, etc.
• Third parties involved in our business dealings, e.g. insurance companies, cooperation partners, etc.
• Other institutions affiliated in the network of Erste Group Bank AG, Erste Bank and Sparkassen for the purpose of risk control and consolidation in the affiliation of credit institutions in accordance with the Banking Act (Bankwesengesetz, BWG) and the Capital Requirements Regulation (EU) No 575/2013

We may also receive data from government authorities or from persons acting under government mandate such as criminal courts, public prosecutors, court commissioners.

3.2.  You are a contact person in our business relationship (e.g. board member / managing director, holder of a commercial power of attorney, accountant)

Most of the personal data we process about you were provided by our customer or by you, for example at the start of our business relationship, upon scheduling an appointment, when submitting a request through a form or on our website, etc.

• Master data and authentication information, e.g. name, address, date of birth, telephone number, email address, tax status, identification data, a copy of your ID, etc.
• Data to satisfy legal and regulatory requirements
• Image and sound data, e.g. video recordings, recordings of telephone calls and your photo (if you have given consent to your photo being recorded), etc.

In addition, data may also come from the following sources:

• Publicly available sources, e.g. companies register, land register, insolvency database, register of associations, etc.
• Other institutions affiliated in the network of Erste Group Bank AG, Erste Bank and Sparkassen for the purpose of risk control and consolidation in the affiliation of credit institutions in accordance with the Banking Act (Bankwesengesetz, BWG) and the Capital Requirements Regulation (EU) No 575/2013

We may also receive data from government authorities or from persons acting under government mandate such as criminal courts, public prosecutors, court commissioners.

3.3. You have provided collateral for our business relationship

Most of the personal data we process about you were provided by our customer or by you, for example at the start of our business relationship, upon scheduling an appointment, when submitting a request through a form or on our website, etc.

• Master data and authentication information, e.g. name, address, date of birth, telephone number, email address, tax status, identification data, a copy of your ID, etc.
• IInformation about your financial situation, e.g. creditworthiness/balance sheet data, scoring or rating data, etc.
• Processing results to fulfil contracts and declarations of consent
• Data to satisfy legal and regulatory requirements
• Image and sound data, e.g. video recordings, recordings of telephone calls and your photo (if you have given consent to your photo being recorded), etc.

In addition, data may also come from the following sources:

• Publicly available sources, e.g. companies register, land register, insolvency database, register of associations, etc.
• Creditor protection associations, credit bureaus, rating agencies, e.g. KSV1870 Information GmbH, etc.
• Other institutions affiliated in the network of Erste Group Bank AG, Erste Bank and Sparkassen for the purpose of risk control and consolidation in the affiliation of credit institutions in accordance with the Banking Act (Bankwesengesetz, BWG) and the Capital Requirements Regulation (EU) No 575/2013

3.4. You are a debtor (= party liable to pay) for our factoring customer’s accounts receivable

We may process the following personal data about your company or other representatives/contact persons:

• Master data and authentication information, e.g. name, address, date of birth, telephone number, email address, tax status, identification data, a copy of your ID, etc.
• Transaction data, e.g. terms of delivery and payment, invoice data, payment information, etc.
• Information about your financial situation, e.g. creditworthiness/balance sheet data, scoring or rating data, etc.
• Processing results to fulfil contracts and declarations of consent
• Data to satisfy legal and regulatory requirements
• Image and sound data, e.g. video recordings, recordings of telephone calls and your photo (if you have given consent to your photo being recorded), etc.

The personal data we process about you may come from the following sources:

• Our customer, e.g. transmission of receivables ledger files, invoices, etc.
• Disclosure by you (e.g. correspondence, telephone call)
• Publicly available sources, e.g. companies register, land register, insolvency database, register of associations, etc.
• Creditor protection associations, credit bureaus, rating agencies, e.g. KSV1870 Information GmbH, etc.
• Third parties involved in our business dealings, e.g. insurance companies, etc.
• Other institutions affiliated in the network of Erste Group Bank AG, Erste Bank and Sparkassen for the purpose of risk control and consolidation in the affiliation of credit institutions in accordance with the Banking Act (Bankwesengesetz, BWG) and the Capital Requirements Regulation (EU) No 575/2013

We may also receive data from government authorities or from persons acting under government mandate such as criminal courts, public prosecutors, court commissioners.

3.5. You have no direct business relationship with us (and have given consent to data processing)

Most of the personal data we process about you were provided by you, for example when submitting a request through a form or on our website, as a recipient of our newsletter or event invitations, etc.

• Master data, e.g. name (company/individual), address, telephone number, email address, etc.
• Image and sound data, e.g. video recordings, recordings of telephone calls and your photo (if you have given consent to your photo being recorded), etc.

4. For what purposes and on what legal basis are my personal data processed?

We are a credit institution pursuant to section 1 (1) of the Banking Act (Bankwesengesetz, BWG) and a financial institution pursuant to point (26) of Article 4 (1) of Regulation (EU) No 575/2013. We process your personal data within the scope of these activities. Specifically, this means:

Processing for the performance of a contract
Depending on the type of contract concluded with our partners, we are allowed to provide certain services to them. The contract in question may be, for example, a factoring agreement, an e-discounting agreement, a cooperation agreement, etc.

The purposes of data processing depend mainly on the specific product and may include, among other things, needs assessment, consulting and the execution of transactions. For more details, please refer to your contract documents and our terms and conditions.

Processing for compliance with a legal obligation
We are also required to process your personal data to comply with legal regulations and to fulfil legal purposes, such as:

• Credit risk management: Banking Act (Bankwesengesetz, BWG), Capital Requirements Directive (EU) No 575/2013
• Monitoring of insider dealing, conflicts of interest and market manipulation: Securities Supervision Act 2018 (Wertpapieraufsichtsgesetz, WAG), Stock Exchange Act (Börsegesetz, BörseG), Market Abuse Regulation (EU) No 596/2014
• Identification, transaction monitoring, suspicious activity reports: Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) and Funds Transfer Regulation (EU) No 847/2015
• Provision of information to public prosecutor’s offices and courts in criminal proceedings and to financial crime authorities in connection with wilful financial crimes:
  Banking Act, Code of Criminal Procedure (Strafprozessordnung, StPO), Financial Crime Act (Finanzstrafgesetz, FinStrG)

Processing based on legitimate interests

We or third parties have a legitimate interest in the processing of data in the following cases:

• Enquiries and data exchange with credit bureaus, such as KSV1870, to determine credit risks and default risksEnquiries and data exchange with credit bureaus, such as KSV1870, to determine credit risks and default risks
• Measures to prevent and combat fraud, fraud transaction monitoring
• Data processing for prosecution purposes
• Recordings of telephone conversations, e.g. in the case of complaints
• The processing of personal data for direct marketing purposes may also be a legitimate interest.

Processing based on consent

If there is neither a contract nor a legal obligation nor a legitimate interest, the processing of data may still be legitimate in cases where you have given your consent or approval to processing.

The scope and content of such data processing always depend on the specific consent given. Please note that you can withdraw your consent at any time.

However, the withdrawal of consent does not affect the lawfulness of processing based on such consent before its withdrawal. Generally speaking, this means that withdrawal does not have any effect on the past.