NOTICE ON PERSONAL DATA PROCESSING
In its business, B2 KAPITAL d.o.o. headquartered in Zagreb, Radnička cesta 41, PIN: 57509775367 (hereinafter “B2“), whose primary activity is the purchase and collection of outstanding receivables, processes your personal data. The protection of your personal data is important to us and, in order to achieve it, we pay due attention to meeting our obligations to protect your personal data in accordance with the General Data Protection Regulation (GDPR) and the General Data Protection Regulation Implementation Act. This notice on the processing of your personal data reflects our policy of managing your personal data. In other words, based on this notice on personal data protection, we want to help you understand how we collect your personal data, which personal data we process, why we process them, how we use them, how we store them, who we share them with and why.
What are the personal data?
Personal data means
any data relating to an identified or identifiable natural person (‘data
subject’); an identifiable natural person is one who can be identified,
directly or indirectly, in particular by reference to an identifier (e.g. name,
the data controller of your personal data?
B2, as data
controller (determines the purposes and means of the processing of personal
data), processes the personal data of persons with which we are in a
contractual agreement with (e.g. on a basis of an assignment agreement with
financial institutions, based on law, based on the consent of the data subject
or based on a legitimate interest).
Who is a
- The debtor or other natural persons (e.g. co-debtors, guarantors, mortgage debtors, etc.) from which B2 collects receivables under an Assignment agreement or a mandate agreement;
- Third parties that settle debts in the name and for the account of the debtor;
- Employees of B2’s business partners;
- Natural persons/candidates that apply for job offers in B2 or whom B2 contacts or who contact B2 for employment opportunities, to which special notices on the protection of personal data apply;
- Natural persons, legal representatives or company owners in accordance with special regulations (e.g. the Prevention of Money Laundering and Financing of Terrorism Act)
- Employees of B2 or other persons engaged in work in B2 on some other basis on which special notices on the protection of personal data apply.
How we collect
Acting in accordance with the applicable legislation, B2 collects
personal data from:
- Credit institutions and other financial institutions with whom you have concluded a loan agreement and/or a contract that relates to another financial/banking service and that have transferred their receivables to B2;
- Directly from you, or in certain cases, from other persons primarily related to the collection of receivables and the refund of any overpayments;
- Persons authorized to communicate with us in your name and for your account (e.g. your attorneys);
- Public institutions and authorities or other persons or persons who perform a service of public interest (such as a notary public);
- Publications and databases that are publicly available or based on a contractual relationship (external sources), to ensure a permanent update of the data we hold about you or to assess the ability to repay receivables. Under external sources, we mean: public institutions and authorities, public registers, electronic databases, information available on social media and on the Internet
- When you access the B2 website, a record of your visit is automatically created. These records typically include an IP address, load number, a web page from which you are logged in and other data. For more information, see the rules on “cookies” at http://www.b2kapital.hr.
When we collect your
data from other sources, we collect them from sources that are publicly
available or delivered by third parties. We take care of your rights in such
cases as well. Some of these situations are as follows:
- We can not contact you and have to update your information so we can ensure that your personal data is correct;
- We need these data to prevent fraud and/or prevent money laundering, or there are legal requirements for the collection of certain data
We process the following categories of personal data:
- Identification data such as: name and last name, date of birth, citizenship, personal identification number (PIN), place of birth, residence, domicile;
- Contact information such as a postal address, telephone number, e-mail;
- Information on your financial and/or professional status, such as: employment/profession; type of own activity; (e.g. craft trade); the name of the employer; income; type of income; sources of income; bank account; data on real estate and your other property; information on existing debt (e.g. type of debt, amount of debt, interest, currency, costs); information related to collection of receivables (e.g. repayment plan, costs, debt position);
- Video surveillance has taken during visits to our office premises and call center records to the extent specified by applicable law;
- Data on other participants in a legal transaction who are contractual parties in a contract on the basis of which there is a claim from B2 (e.g., guarantors/heirs/spouses);
- Information on administrative or court proceedings in which you are a party to the extent that it relates to the receivables held in B2’s portfolio and/or may affect the collection of receivables (e.g. enforcement proceedings, personal bankruptcy proceedings and other court proceedings initiated to protect our rights in court);
- Information considered to be evidence of every interaction between you and B2 through written and/or oral communication;
To what purpose do we
process your personal data?
B2 processes your data only to the extent that these data relate to and/or may affect the process of collecting receivables and the protection of B2’s rights. In this context, the purpose for the processing of personal data generally encompasses the collection of receivables and includes the following
- Analyzing your financial situation and income sources so we can determine the conditions for the repayment of debt that matches your individual situation;
- Communicating with you and the valid identification of all data subjects whose personal data we process;
- Conducting of legal (court) proceedings for collecting receivables (e.g. enforcement proceedings, personal bankruptcy proceedings, initiating and/or entering into other legal proceedings for the protection of our rights) and finding favorable solutions for all involved parties, which leads to the settlement of debts;
- Processing and answering your questions, complaints and requests;
- Estimating whether we will establish a contractual relationship or conclude a transaction (e.g. risk assessment related to the conclusion of a receivables purchase agreement, submission of bids/participation in an auction procedure) including checks for the purpose of preventing money laundering, financing of terrorism and fraud;
- Statistical analysis to assess the activity of B2 in portfolio management, as well as the need to improve the methodology of collection/repayment of receivables
- Replying to requests of authorities or meeting legal requirements that apply to B2;
- Purpose of legal reporting to competent bodies when defined by accounting and tax regulations.
We want to point out that
B2 can sometimes use your personal data for certain secondary purposes (e.g.
internal reports and internal portfolio management, external audit, archiving –
in physical and/or electronic form, correspondence) that are always in
accordance with the original purpose for which B2 collected the personal data.
What is the legal
basis for the processing of your personal data?
B2 processes your personal data based on one or more of the following
- The processing of
personal data is necessary for the execution of contracts to which the data
subject is a contracting party (in case of exercising rights of B2 from
the loan agreement and other contracts into which it substituted as a creditor
for a financial institution or other seller of receivables, as well as in
case of execution of other contracts in which B2 and data subjects whose
personal data are processed are the contracting parties) or for the
implementation of certain actions at the request of the data subjects prior
to the conclusion of the contract (negotiations for concluding the said
- Processing of personal data for the purpose
of fulfillment of the legal obligations that B2 is subject to – the
keeping of accounting data, the keeping of data necessary for exercising
the rights of employees in relation to employment (records of employees,
working time records, etc.), which appropriately applies to members of the
Board as well, processing of personal data in the context of the fulfillment
of obligations from regulations adopted to prevent money laundering and financing
- Processing is
necessary in order to protect the key interests of data subjects or other
natural persons (when repaying overpaid funds);
- The legitimate interest of B2 (so that B2 can collect on or dispose of the acquired receivables, assess the performance of the receivables’ collection or predict whether the debt can be collected or the appropriate procedures will have to be initiated);
- The explicit consent of data subjects when given to B2 (e.g. in relation to B2 employees and persons applying for employment in B2, which is regulated in B2 by separate internal notices).
How we use your
Processing of personal
data means any operation or set of operations which is performed on personal
data or on sets of personal data, whether or not by automated means, such as
collection, recording, organization, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction in order to meet the abovementioned purposes
of personal data processing.
We use tools that are not fully automated (human intervention is required) in order to determine/execute the evaluation/assessment of the collection of receivables. This evaluation is based on data you have provided us directly or provided by the previous creditor (assignee), as well as information obtained from public sources (Internet/social networks/public databases/publications and official (public) information issued by State bodies/official databases on subjects and persons subject to international sanctions). Thanks to these data, we can draw a conclusion about the optimal method of repayment/settlement of receivables for both parties, in particular, whether it is necessary to initiate an enforcement procedure or to assess whether B2 will conclude a contract for the sale or transfer of receivables
We act in accordance with legal regulations, including obligations of data delivery (reporting) arising from national and/or European regulations (e.g. prevention of money laundering and financing of terrorism, obligations arising from tax or accounting legislation), as well as legal regulations and instructions issued by the competent authorities (e.g. the Ministry of Finance, the National Consumer Protection Authority, the Personal Data Protection Agency, the National Office for Prevention and Suppression of Money Laundering, bodies conducting criminal investigations, etc.). Delivery of personal data for this purpose is necessary for the fulfillment of the legal obligations of B2.
If we cannot contact
you, in order to comply with the accuracy of data principle, we will do
everything to update your personal data based on information obtained from
official sources (e.g. court registry, press releases and official information
issued by public authorities) or from public sources (Internet/social networks/public
We use data about your assets that secure our receivables for the
purpose of collecting receivables
Also, we use your data to conduct internal statistical analyses to
evaluate our effectiveness and improve the methodology for collecting our receivables.
We process and analyze your complaints, requests to exercise your rights
from GDPR and any other requests with which you contact us.
We inform you about the state of your debt (while we process your
personal data), the status of legal proceedings that are in progress and that
are related to your debt, as well as all data and information you are
interested in about the debt collection process.
Are your data
B2 believes that the security of your personal data is very important so,
in that sense, we provide for and conduct periodic reviews of organizational
and technical security measures designed to protect your data from unauthorized
access, alteration, detection or destruction. Access to your personal information
is permitted only to persons authorized by B2, after an appropriate assessment
and who have previously committed to confidentiality.
Who are the recipients
of your personal data?
In the normal course of business, B2 may transfer your data to other
individuals or legal entities to achieve the purposes for which we process
personal data that you have directly submitted or we have received from other
sources. B2 can also use or disclose personal data when there is a legal
obligation to do so or is permitted by law.
We hereby give examples of persons to whom B2 can transfer your personal
- Creditors from which B2 acquired the receivables;
- We can transfer your personal data to other members of the B2Holding Group, of which B2 is part of, headquartered in the countries of the European Economic Area. As an exception, your personal information can also be transferred to B2Holding Group companies which are headquartered in countries that are not members of the European Economic Area and for which a decision on the adequacy of the European Commission has not been made, including Serbia and Bosnia and Herzegovina. Risks associated with the transfer of your personal data to a country that does not provide an adequate level of protection is minimized by B2 by the use of appropriate safeguards in the form of executing a data transfer agreement with standard contractual clauses for transferring personal data to third countries;
- To our contractual partners – Acquirers of receivables – We may transfer your personal information to other natural or legal persons to whom B2 transfers its receivable;
- To supervisory authorities – if it is a legal obligation of B2 or when required by applicable national or European legislation, we may transfer information about your personal data or transactions without the need to inform you about it;
- To other Government bodies: We may submit your personal information to comply with certain legal requirements or third parties that justify the existence of a legitimate interest (e.g. public notaries, courts);
- Data transfer at your request: You may request of us to transfer your information to a representative or an authorized person acting on your behalf and for your account (e.g. financial advisors, lawyers, mediators);
- Service providers that help us improve our services or develop, implement or manage business systems, infrastructure or operational processes (e.g. auditors, consultants, analysts, etc.);
- Suppliers that provide us support in receivables collection, including the promotion and realization of insurance instruments (e.g. Real Estate Agencies, websites where we provide real estate promotion, including online real estate promotion platforms, lawyers, court assessors, consulting companies, cadastral experts)
- Suppliers that provide maintenance and support services in order for us to be able to provide purchase and collection services in optimal and safe conditions. For example suppliers that develop/implement or maintain IT applications and infrastructure, archiving companies, documentation printing companies, delivery/postal service providers, companies that manage security systems that implement measures to ensure confidentiality/integrity and availability of your data, etc.
- Service providers that assist us in conducting legal proceedings, enforcement proceedings, personal bankruptcy proceedings or other receivable collection procedures (e.g. attorneys, appraisers, consulting companies, surveyors, real estate agencies)
How long we store your
B2 will process your personal data for the time required for processing, which may vary depending on the purpose of the data used. Therefore, B2 will process your data during the collection/repayment process and store it for a period of five years from the moment the debt is transferred to another Creditor and/or after a full settlement of the claim, unless otherwise provided by the law. In the event of receivable settlement after the completion of the enforcement procedure and/or any other court procedure, personal data shall be kept for at least 10 years, unless otherwise provided by the law. In case of data processing for accounting purposes, your data will be stored for at least 11 years, in accordance with the regulations governing accounting. The retention period resulting from video recordings is 90 days while the call center telephone records are retained for up to 2 years from recording.
What are your rights
and how can you exercise them?
You can realize the following rights at any time, within the limits
provided by the legislation in force in the field of personal data protection:
Right to be notified – Exercise the right
to be notified and, thus, you can, at any moment, request information and
details relating to how we process your personal data, which we will deliver
orally or in writing using the channel you specified.
Right of access to personal data –
You may at any time request access to your personal data in order for us to
notify you of the processing your personal data, i.e. to confirm whether or not
your personal data are being processed by B2, the purpose of processing, the
legal basis and the terms under which we process personal data.
Right to rectification
– You may at any time
request of us to rectify your personal data, so we can ensure that your data is
up to date and correct at every moment.
Right to object on the processing of personal data – On the grounds relating to your particular situation, you may object to the processing of personal data concerning you which is based on a legitimate interest of B2 and/or data processing is carried out in the public interest, including profiling based on those provisions
Right to restriction of processing – you have the right to request a restriction of processing in the following situations: (i) you have contested the accuracy of the personal data so, for a period enabling to verify the accuracy of the personal data, your data will be processed in a restricted manner; (ii) the processing of your personal data was unlawful and you opposed the erasure of the personal data, request the restriction of their processing instead; (iii) you objected to processing of your personal data so, pending the verification of the grounds of the legal basis of processing, your data will be processed in a restricted manner (iv) even though the period of data storage is over, you explicitly requested for us to keep your data for exercising your rights at court. In the case of restricted processing, your personal data can be processed by storing. Other personal data processing activities will be possible only for (i) exercising the rights of B2 at court; (ii) the protection of rights of other natural or legal persons; (iii) based on your explicit consent or (iv) safeguarding of the public interest. If your request for data protection restriction is approved, we will notify you about it before the removal of the restriction on personal data processing.
Right to erasure of
personal data (‘right to be forgotten’) – You can request of
us to erase your personal data that we process and take all necessary steps to
do it if: (i) the personal data are no existent or the purpose for which they
were collected has been fulfilled; (ii) you withdraw consent on which the
processing is based and where there is no other legal ground for the
continuation of the processing; (iii) you objected to the processing and there
are no overriding legitimate grounds for further processing ; (iv) your personal
data have been processed without a valid legal basis. We also inform you that the
personal data for which you have established the right to erasure can be processed
further in the following situations: (i) for compliance with legal obligations
that are related to processing, (ii) as well as for the exercise/defense of
rights in court proceedings.
Right to data portability
– In case of your
personal data we process automatically, based on your explicit consent or
execution of a contract between you and B2, you have the right to request to
have said data in a structured and machine-readable format that you can transmit
to another controller or you can request of us to send the data directly to
said Controller (to the extent it is technically feasible).
Right to withdraw
consent – in cases when the processing is based on your consent,
it can be withdrawn at any moment. The withdrawal of your consent will have an effect
only for future processing. Processing done before the withdrawal of consent
All of these rights can be met by submitting a written request according to the contact information below, and we will reply within 30 calendar days or, if the request requires a more complex analysis, that deadline may be extended for a further 60 calendar days, in which case we will notify about the reasons for the extension. If you send your request electronically, we will also provide you with information electronically, if possible, or through some other format or channel, you specified. B2 may request additional information to verify your identity before we can share your personal data with you or act regarding the exercise of your aforementioned rights. We also inform you that, in justified cases, the law allows us to refuse to comply with your requests, for example where your requests are excessive, with their recurring or obviously unfounded character. Even in this case, we will give you a written explanation of such a refusal of proceeding.
If you are convinced that the processing of your personal information is unfounded and that the processing of your personal information is not in accordance with legal regulations, you can file an objection to the Personal Data Protection Agency
Agencija za zaštitu osobnih podataka
Selska cesta 136
HR – 10 000 Zagreb
Tel. 00385 (0)1 4609-000
Fax. 00385 (0)1 4609-099
Contact information for personal data protection
If you have any questions or requests in relation to the aforementioned
rights, please contact us:
Address: B2 KAPITAL d.o.o., Radnička cesta 41, 10000 Zagreb, tel: (0)1
5605 540, fax: (0) 1 5605 541
Data Protection Officer: E-mail: firstname.lastname@example.org