DATA PROTECTION POLICY

NOTICE ON PERSONAL DATA PROCESSING

In its business, B2 KAPITAL d.o.o. headquartered in Ljubljana, Verovškova ulica 64A, Registration number: 6653057000 (hereinafter “B2“), whose primary activity is the purchase and collection of outstanding receivables, processes your personal data. The protection of your personal data is important to us and, in order to achieve it, we pay due attention to meeting our obligations to protect your personal data in accordance with the General Data Protection Regulation (GDPR) and the General Data Protection Regulation Implementation Act. This notice on the processing of your personal data reflects our policy of managing your personal data. In other words, based on this notice on personal data protection, we want to help you understand how we collect your personal data, which personal data we process, why we process them, how we use them, how we store them, who we share them with and why.

What are the personal data?

Personal data means any data relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (e.g. name, identification number).

Who is the data controller of your personal data?

B2, as data controller (determines the purposes and means of the processing of personal data), processes the personal data of persons with which we are in a contractual agreement with (e.g. on a basis of an assignment agreement with financial institutions, based on law, based on the consent of the data subject or based on a legitimate interest).

Who is a data subject?

1. Debtor or other natural persons (e.g. co-debtors, guarantors, mortgage debtors, etc.) from which B2 collects receivables under an Assignment agreement or a mandate agreement;
2. Third parties that settle debts in the name and for the account of the debtor;
3. Employees of B2’s business partners;
4. Natural persons/candidates that apply for job offers in B2 or whom B2 contacts or who contact B2 for employment opportunities, to which special notices on the protection of personal data apply;
5. Natural persons, legal representatives or company owners in accordance with special regulations (e.g. the Prevention of Money Laundering and Financing of Terrorism Act)
6. Employees of B2 or other persons engaged in work in B2 on some other basis on which special notices on the protection of personal data apply.

How we collect personal data?

Acting in accordance with the applicable legislation, B2 collects personal data from:

• Credit institutions and other financial institutions with whom you have concluded a loan agreement and/or a contract that relates to another financial/banking service and that have transferred their receivables to B2;
• Directly from you, or in certain cases, from other persons primarily related to the collection of receivables and the refund of any overpayments;
• Persons authorized to communicate with us in your name and for your account (e.g. your attorneys);
• Public institutions and authorities or other persons or persons who perform a service of public interest (such as a notary public);
• Publications and databases that are publicly available or based on a contractual relationship (external sources), to ensure a permanent update of the data we hold about you or to assess the ability to repay receivables. Under external sources, we mean: public institutions and authorities, public registers, electronic databases, information available on social media and on the Internet
• When you access the B2 website, a record of your visit is automatically created. These records typically include an IP address, load number, a web page from which you are logged in and other data. For more information, see the rules on “cookies”.

When we collect your data from other sources, we collect them from sources that are publicly available or delivered by third parties. We take care of your rights in such cases as well. Some of these situations are as follows:

• We cannot contact you and have to update your information so we can ensure that your personal data is correct;
• We need these data to prevent fraud and/or prevent money laundering, or there are legal requirements for the collection of certain data

We process the following categories of personal data:

• Identification data such as: name and last name, date of birth, citizenship, personal identification number (EMŠO), place of birth, residence, domicile;
• Contact information such as a postal address, telephone number, e-mail;
• Information on your financial and/or professional status, such as: employment/profession; type of own activity; (e.g. craft trade); the name of the employer; income; type of income; sources of income; bank account; data on real estate and your other property; information on existing debt (e.g. type of debt, amount of debt, interest, currency, costs); information related to collection of receivables (e.g. repayment plan, costs, debt position);
• Signature;
• Call canter records to the extent specified by applicable law;
• Data on other participants in a legal transaction who are contractual parties in a contract on the basis of which there is a claim from B2 (e.g., guarantors/heirs/spouses);
• Information on administrative or court proceedings in which you are a party to the extent that it relates to the receivables held in B2’s portfolio and/or may affect the collection of receivables (e.g. enforcement proceedings, personal bankruptcy proceedings and other court proceedings initiated to protect our rights in court);
• Information considered to be evidence of every interaction between you and B2 through written and/or oral communication;

To what purpose do we process your personal data?

B2 processes your data only to the extent that these data relate to and/or may affect the process of collecting receivables and the protection of B2’s rights. In this context, the purpose for the processing of personal data generally encompasses the collection of receivables and includes the following

• Analyzing your financial situation and income sources so we can determine the conditions for the repayment of debt that matches your individual situation;
• Communicating with you and the valid identification of all data subjects whose personal data we process;
• Conducting of legal (court) proceedings for collecting receivables (e.g. enforcement proceedings, personal bankruptcy proceedings, initiating and/or entering into other legal proceedings for the protection of our rights) and finding favorable solutions for all involved parties, which leads to the settlement of debts;
• Processing and answering your questions, complaints, and requests;
• Estimating whether we will establish a contractual relationship or conclude a transaction (e.g. risk assessment related to the conclusion of a receivables purchase agreement, submission of bids/participation in an auction procedure) including checks for the purpose of preventing money laundering, financing of terrorism and fraud;
• Statistical analysis to assess the activity of B2 in portfolio management, as well as the need to improve the methodology of collection/repayment of receivables
• Replying to requests of authorities or meeting legal requirements that apply to B2;
• Purpose of legal reporting to competent bodies when defined by accounting and tax regulations.

We want to point out that B2 can sometimes use your personal data for certain secondary purposes (e.g. internal reports and internal portfolio management, external audit, archiving – in physical and/or electronic form, correspondence) that are always in accordance with the original purpose for which B2 collected the personal data.

What is the legal basis for the processing of your personal data?

B2 processes your personal data based on one or more of the following legal bases:

• The processing of personal data is necessary for the execution of contracts to which the data subject is a contracting party (in case of exercising rights of B2 from the loan agreement and other contracts into which it substituted as a creditor for a financial institution or other seller of receivables, as well as in case of execution of other contracts in which B2 and data subjects whose personal data are processed are the contracting parties) or for the implementation of certain actions at the request of the data subjects prior to the conclusion of the contract (negotiations for concluding the said contracts)
• Processing of personal data for the purpose of fulfilment of the legal obligations that B2 is subject to – the keeping of accounting data, the keeping of data necessary for exercising the rights of employees in relation to employment (records of employees, working time records, etc.), which appropriately applies to members of the Board as well, processing of personal data in the context of the fulfilment of obligations from regulations adopted to prevent money laundering and financing of terrorism;
• Processing is necessary in order to protect the key interests of data subjects or other natural persons (when repaying overpaid funds);

• The legitimate interest of B2 (so that B2 can collect on or dispose of the acquired receivables, assess the performance of the receivables’ collection or predict whether the debt can be collected or the appropriate procedures will have to be initiated);
• The explicit consent of data subjects when given to B2 (e.g. in relation to B2 employees and persons applying for employment in B2, which is regulated in B2 by separate internal notices).

How we use your personal data?

Processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction in order to meet the abovementioned purposes of personal data processing.

We use tools that are not fully automated (human intervention is required) in order to determine/execute the evaluation/assessment of the collection of receivables. This evaluation is based on data you have provided us directly or provided by the previous creditor (assignee), as well as information obtained from public sources (Internet/social networks/public databases/publications and official (public) information issued by State bodies/official databases on subjects and persons subject to international sanctions). Thanks to these data, we can draw a conclusion about the optimal method of repayment/settlement of receivables for both parties, in particular, whether it is necessary to initiate an enforcement procedure or to assess whether B2 will conclude a contract for the sale or transfer of receivables

We act in accordance with legal regulations, including obligations of data delivery (reporting) arising from national and/or European regulations (e.g. prevention of money laundering and financing of terrorism, obligations arising from tax or accounting legislation), as well as legal regulations and instructions issued by the competent authorities (e.g. the Ministry of Finance, bodies conducting criminal investigations etc.). Delivery of personal data for this purpose is necessary for the fulfillment of the legal obligations of B2.

If we cannot contact you, in order to comply with the accuracy of data principle, we will do everything to update your personal data based on information obtained from official sources (e.g. court registry, press releases and official information issued by public authorities) or from public sources (Internet/social networks/public databases)

We use data about your assets that secure our receivables for the purpose of collecting receivables

Also, we use your data to conduct internal statistical analyses to evaluate our effectiveness and improve the methodology for collecting our receivables.

We process and analyze your complaints, requests to exercise your rights from GDPR and any other requests with which you contact us.

We inform you about the state of your debt (while we process your personal data), the status of legal proceedings that are in progress and that are related to your debt, as well as all data and information you are interested in about the debt collection process.

Are your data protected?

B2 believes that the security of your personal data is very important so, in that sense, we provide for and conduct periodic reviews of organizational and technical security measures designed to protect your data from unauthorized access, alteration, detection or destruction. Access to your personal information is permitted only to persons authorized by B2, after an appropriate assessment and who have previously committed to confidentiality.

Who are the recipients of your personal data?

In the normal course of business, B2 may transfer your data to other individuals or legal entities to achieve the purposes for which we process personal data that you have directly submitted or we have received from other sources. B2 can also use or disclose personal data when there is a legal obligation to do so or is permitted by law.

We hereby give examples of persons to whom B2 can transfer your personal data:

• Creditors from which B2 acquired the receivables;
• We can transfer your personal data to other members of the B2Holding Group, of which B2 is part of, headquartered in the countries of the European Economic Area. As an exception, your personal information can also be transferred to B2Holding Group companies which are headquartered in countries that are not members of the European Economic Area and for which a decision on the adequacy of the European Commission has not been made, including Serbia and Bosnia and Herzegovina. Risks associated with the transfer of your personal data to a country that does not provide an adequate level of protection is minimized by B2 by the use of appropriate safeguards in the form of executing a data transfer agreement with standard contractual clauses for transferring personal data to third countries;
• To our contractual partners – Acquirers of receivables – We may transfer your personal information to other natural or legal persons to whom B2 transfers its receivable;
• To supervisory authorities – if it is a legal obligation of B2 or when required by applicable national or European legislation, we may transfer information about your personal data or transactions without the need to inform you about it;
• To other Government bodies: We may submit your personal information to comply with certain legal requirements or third parties that justify the existence of a legitimate interest (e.g. public notaries, courts);
• Data transfer at your request: You may request of us to transfer your information to a representative or an authorized person acting on your behalf and for your account (e.g. financial advisors, lawyers, mediators);
• Service providers that help us improve our services or develop, implement or manage business systems, infrastructure or operational processes (e.g. auditors, consultants, analysts, etc.);
• Suppliers that provide us support in receivables collection, including the promotion and realization of insurance instruments (e.g. Real Estate Agencies, websites where we provide real estate promotion, including online real estate promotion platforms, lawyers, court assessors, consulting companies, cadastral experts)
• Suppliers that provide maintenance and support services in order for us to be able to provide purchase and collection services in optimal and safe conditions. For example, suppliers that develop/implement or maintain IT applications and infrastructure, archiving companies, documentation printing companies, delivery/postal service providers, companies that manage security systems that implement measures to ensure confidentiality/integrity and availability of your data, etc.
• Service providers that assist us in conducting legal proceedings, enforcement proceedings, personal bankruptcy proceedings or other receivable collection procedures (e.g. attorneys, appraisers, consulting companies, surveyors, real estate agencies)

How long we store your personal data?

B2 will process your personal data for the time required for processing, which may vary depending on the purpose of the data used. Therefore, B2 will process your personal data relating to the pre-trial procedure during the collection/repayment process and store it for a period of 5 (five) years from the moment the debt is transferred to another Creditor and/or after a full settlement of the claim unless otherwise provided by the law. In the event of receivable settlement after the completion of the enforcement procedure and/or any other court procedure, personal data shall be kept for at least 10 years, unless otherwise provided by the law. In the case of data processing for accounting purposes, your data will be stored for at least 10 years, in accordance with the regulations governing accounting. The period of data storage while telephone call records are stored for up to 2 years.

What are your rights and how can you exercise them?

You can realize the following rights at any time, within the limits provided by the legislation in force in the field of personal data protection:

Right to be notified – Exercise the right to be notified and, thus, you can, at any moment, request information and details relating to how we process your personal data, which we will deliver orally or in writing using the channel you specified.

Right of access to personal data – You may at any time request access to your personal data in order for us to notify you of the processing your personal data, i.e. to confirm whether or not your personal data are being processed by B2, the purpose of processing, the legal basis and the terms under which we process personal data.

Right to rectification – You may at any time request of us to rectify your personal data, so we can ensure that your data is up to date and correct at every moment.

Right to object on the processing of personal data – On the grounds relating to your particular situation, you may object to the processing of personal data concerning you which is based on a legitimate interest of B2 and/or data processing is carried out in the public interest, including profiling based on those provisions

Right to restriction of processing – you have the right to request a restriction of processing in the following situations: (i) you have contested the accuracy of the personal data so, for a period enabling to verify the accuracy of the personal data, your data will be processed in a restricted manner; (ii) the processing of your personal data was unlawful and you opposed the erasure of the personal data, requesting the restriction of their processing instead; (iii) you objected to processing of your personal data so, pending the verification of the grounds of the legal basis of processing, your data will be processed in a restricted manner (iv) even though the period of data storage is over, you explicitly requested for us to keep your data for exercising your rights at court. In case of restricted processing, your personal data can be processed by storing. Other personal data processing activities will be possible only for (i) exercising the rights of B2 at court; (ii) the protection of rights of other natural or legal persons; (iii) based on your explicit consent or (iv) safeguarding of the public interest. If your request for data protection restriction is approved, we will notify you about it before the removal of the restriction on personal data processing.

Right to erasure of personal data (‘right to be forgotten’) – You can request of us to erase your personal data that we process and take all necessary steps to do it if: (i) the personal data are no existent or the purpose for which they were collected has been fulfilled; (ii) you withdraw consent on which the processing is based and where there is no other legal ground for the continuation of the processing; (iii) you objected to the processing and there are no overriding legitimate grounds for further processing ; (iv) your personal data have been processed without a valid legal basis. We also inform you that the personal data for which you have established the right to erasure can be processed further in the following situations: (i) for compliance with legal obligations that are related to processing, (ii) as well as for the exercise/defence of rights in court proceedings.

Right to data portability – In case of your personal data we process automatically, based on your explicit consent or execution of a contract between you and B2, you have the right to request to have said data in a structured and machine-readable format that you can transmit to another controller or you can request of us to send the data directly to said Controller (to the extent it is technically feasible).

Right to withdraw consent – in cases when the processing is based on your consent, it can be withdrawn at any moment. The withdrawal of your consent will have an effect only for future processing. Processing done before the withdrawal of consent remains valid.

All of these rights can be met by submitting a written request according to the contact information below, and we will reply within 30 calendar days or, if the request requires a more complex analysis, that deadline may be extended for a further 60 calendar days, in which case we will notify about the reasons for the extension. If you send your request electronically, we will also provide you with information electronically, if possible, or through some other format or channel you specified. B2 may request additional information to verify your identity before we can share your personal data with you or act regarding the exercise of your aforementioned rights. We also inform you that, in justified cases, the law allows us to refuse to comply with your requests, for example where your requests are excessive, with their recurring or obviously unfounded character. Even in this case, we will give you a written explanation of such a refusal of proceeding.

If you are convinced that the processing of your personal information is unfounded and that the processing of your personal information is not in accordance with legal regulations, you can file an objection to the competent Information Commissioner at: Dunajska cesta 22, 1000 Ljubljana, tel: +386 (1) 4609-000.

e-mail: gp.ip(at)ip-rs.si  

Contact information for personal data protection

If you have any questions or requests in relation to the aforementioned rights, please contact us:

Address:
B2 KAPITAL d.o.o.,
Verovškova ulica 64A,
1000 Ljubljana,
tel: + 386 (0) 590 81 720  

Data Protection Officer:
MD SVETOVANJE d.o.o.
dr. Miha Dvojmoč
e-mail: miha.dvojmoc@infocenter.si
tel.: +386 31 692 524