For the purposes of the processing activities mentioned above, the ECB processes data that you provide to us directly or that are observed during interactions with ECB employees (for example, matching the photograph on an identity document with the person present in front of the ECB employee), as well as data that we generate based on these or consult from other sources if necessary, namely: demographic data, client identification code, transaction data (type, value, account and/or card details, transaction location), information resulting from discrepancies reported by any person, KYC/AML scores, as well as data resulting from analyses conducted by our specialists regarding compliance with fraud prevention requirements in the context of initiating or monitoring a business relationship; data obtained from databases accessible to the ECB (databases published by the UN, OFAC and/or EU regarding international sanctions, internal warning lists for fraud prevention, lists of politically exposed persons, requests from public authorities, judicial executors); profiles created internally or by combining data from multiple sources (for example, internal scoring related to the risk profile).

Depending on the banking services used, we may process:

a) Identification data

• first name, last name

• IDNP code

• date and place of birth

• signature

• series and number of identity document

• citizenship

b) Contact data

• phone number

• e-mail

• home/residential address

c) Banking and financial data

• account numbers

• bank transactions

• balances

• credit history

• information regarding income and employer (if relevant), etc.

d) Technical and digital data

• data collected through the website and internet banking

• IP addresses

• online identifiers

• cookies

e) Data necessary for compliance

• AML/KYC data

• data regarding international sanctions, PEPs

• information provided by authorities or reporting institutions, etc.

f) Other data

• CCTV recordings inside bank units

• audio recordings of calls (in case of telephone services), etc.

Refusal to provide personal data may result in the inability to provide banking services and/or to fulfill the other processing purposes by the ECB. The data collected for the purposes mentioned above may be processed for subsequent purposes, insofar as the subsequent purposes are compatible with the initial ones.