Compliance Policy Extract - OTP Bank Albania

DECLARATION ON GRANTING CONSENT TO THE PROCESSING OF PERSONAL DATA

In accordance with Law No. 124/2024 “On the Protection of Personal Data” (the “Law”), as well as Instruction No. 4, dated 30.04.2025, of the Information and Data Protection Commissioner (the “Commissioner”), I give my clear and explicit consent to the processing of my personal data by OTP Albania Bank sh.a. (“Bank” or “OBA”) for the purposes set out in this statement and the Information on Privacy and Personal Data Protection and declare as follows:

I declare that all information provided to the Bank by me is accurate and true and I agree that my data will be processed for direct marketing purposes in accordance with the applicable legal and sub-legal framework in force.
I agree and give consent to the Bank to, if applicable, transfer my data to the OTP Bank Plc., Hungary (parent company) for the purposes set out in this declaration and the Information on Privacy and Protection of Personal Data. OBA and OTP Bank Plc. guarantee that all technical and organizational measures have been taken for the secure handling of my data, in accordance with the applicable legal and sub-legal framework in force.
I agree and give consent that when the Bank shall consider contracting third parties to carry out marketing communications, the data will be processed by these companies only in function of the purpose and contractual relationship with the Bank and are subject to appropriate safeguards.
I agree and give consent to the Bank, for direct marketing purposes, to contact me using all forms of electronic and telephone communication such as: SMS, e-mail, telephone, fax, mail, digital channels, etc., at the addresses and contact forms declared by me.
I declare that I have been informed of my rights under the Law (right to information, right to access, right to rectification and erasure, right to be forgotten, right to restriction of processing, right to data portability, right to object, right not to be subject to automated decisions, right to complain, right to compensation for damage) and that I can exercise these rights by contacting the Bank and that I have the right to complain to the Commissioner.
I declare that I have been informed that I can withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to withdrawal. A request for withdrawal can be made by contacting the Bank.
I issue this statement on my own free will and with the intention of personal data processing by the Bank for direct marketing purposes.
I declare that I have been informed about and accept the content of the Information on Privacy and Protection of Personal Data, which can be found here.

INFORMATION ON PRIVACY AND PERSONAL DATA PROTECTION Introduction

OTP Albania Bank sh.a (“Bank/OBA”, “us”, “Controller”) considers personal data protection to be a matter of high importance, from the legal importance point of view and the preserving the privacy and rights of the personal data subject (“data subject”, “you”) point of view. We are committed to protect your personal data and respect your privacy. This document (the “Information”) contains summarized information in relation to the protection of personal data that the Bank collects for direct marketing purposes (“marketing”), including without limitation, the categories of personal data we collect and why we process them, how long we keep them, your rights in relation to personal data and how to exercise them.

Personal data is processed in compliance with the provisions of law no. 124/2024 “On personal data protection” (the “Law”) and the applicable bylaws. Processing is carried out according to the principles of respecting and guaranteeing the fundamental human rights and freedoms and in particular the right to privacy. The Bank has taken all technical and organizational measures to protect personal data and to implement all obligations arising from the legal and sub-legal framework in force.

The legal basis of this Information is the applicable legislation in the field of personal data protection, including without limitation, law no. 124/2024 “On the Protection of Personal Data”, the instructions and decisions of the Information and Data Protection Commissioner (the “Commissioner”), etc.

The purpose of the Information is to provide data subjects with complete information on the processing of their personal data for direct marketing purposes. By clicking “I agree that OTP Bank Albania may process my personal data, and contact or notify me for direct marketing purposes via mail, telephone, email, SMS and/or other digital channels. I confirm that I have read, agree with and accept the provisions of the Declaration on granting consent and the Information on privacy and protection of personal data”, you confirm that you have read, agree with and accept the provisions of this Information. This document may be amended and/or updated in the future, however, in no case will the rights guaranteed by the Law be limited. It is your responsibility to read and be aware of the current version of this document.

1. Information about the controller and the structure responsible for data protection

Controller’s name: Address:

Email: Telephone: Website:

Banka OTP Albania sh.a.
Bulevardi “Bajram Curri”, Godina “Down Town”, kati 8, Tirana, Albania
info@otpbank..al
0800 4848
www.otpbank.al

1.1 If you have any questions regarding the protection or processing of personal data, you can contact the Bank’s Compliance Sector at the email address “compliance@otpbank.al” or at the telephone number 0800 4848.

2. Personal data processing principles

Personal data processing is carried out in accordance with the following principles:

principle of lawfulness, fairness, and transparency,
principle of purpose limitation,
principle of data minimisation,
principle of accuracy,
principle of storage limitation,
principle of integrity and confidentiality,
principle of accountability.

3. What data do we collect and process

For marketing purposes, we collect and process:

identification data:
name
surname
contact information:
telephone number
e-mail

Information about your relationship with the Bank, employment relationship and other existing loans:

if you are an existing customer of the Bank
if you have loans from other banks
if you have loans from other financial institutions
for how many months you have been employed with insurance

4. Why do we process personal data and on what legal basis?

We are committed to processing personal data only on lawful grounds and for the selected purposes: direct marketing. The data subject may or may not be a customer of the Bank.

We process personal data for direct marketing purposes based on the consent of the data subject to the process his personal data (Article 7, point 1, letter a) of the Law) and for legitimate interests of the bank in relation to the performance of its activities for marketing campaigns/notifications (e.g. offers, news, invitations, notifications of draws, complaints, surveys and similar messages via mail, telephone, email, SMS and/or other digital channels) (Article 7, point 1, letter dh) of the Law) for various services/products offered by the Bank and for the development of new products/services and/or improvement of existing ones, increasing customer satisfaction, increasing the customer base and increasing the OTP brand loyal customers base. The data is processed electronically.

The conclusion of a contract or the provision of banking/financial services or products is not conditional on the provision of consent for marketing purposes. Giving consent is voluntary and if you decide not to provide it or later withdraw your consent, this will not in any way reduce your rights arising from your business relationship that you may have with the Bank and will not entail any additional costs for you.

If you withdraw your consent to the processing of your personal data for marketing purposes or if you object to the processing of your personal data for these purposes, the Bank will no longer use your data for direct marketing purposes.

If you wish to withdraw your consent for marketing purposes or object to the processing of your data for this purpose, you may do so at any time by contacting the Bank at one of the contacts and forms provided here.

5. Who are the processors of your personal data?

Personal data provided to the Bank may be processed by its employees and those of the Parent Company’s as well as by employees of the Bank’s contractual partners/processors (e.g. information and communication technology service providers, electronic communications notification service providers, etc.), who are obliged to respect and protect your personal data based on the applicable legislation in the field of employment, personal data protection and data processing contracts and/or confidentiality agreements, in accordance with the legislation on personal data protection and the applicable legal-regulatory framework. Users are subject to the relevant authorizations and access rights.

In certain cases, as determined by the applicable legal-regulatory framework, we may provide your personal data to public authorities, courts or third parties, if necessary for the fulfillment of our legal or contractual obligations (e.g. the Bank of Albania). Provided that these entities have specified the exact purpose/scope of the data, the Bank will disclose personal data to these entities only if and to the extent that it is strictly necessary for the implementation of the purpose of the investigation and when the fulfillment of the request is determined by law.

All users are obligated to respect and protect your personal data in accordance with the Law and the applicable legal-regulatory framework.

6. Data transfer

When data transfer is effectuated, it is done in accordance with the relevant legal provisions, including without limitation those regarding the level of protection of personal data in the country where the data is transferred. The Bank ensures that it will not transfer data without the appropriate legal basis or your consent.

The transfer of data is made if necessary, for the purposes of carrying out the Bank’s activities, according to the provisions of the Law, to OTP Bank Plc., Hungary (parent company).

OBA and OTP Bank Plc. implement technical-organizational measures for data protection in accordance with applicable legislation and the highest security standards. The data subject may request a copy of his/her data from the Bank at any time.

7. How long do we keep your personal data

The Bank stores and protects your personal data in a manner that prevents the unjustified disclosure of your data to unauthorized persons. We store personal data only for as long as is necessary to achieve the purpose for which it was collected. The retention period depends on the basis on which the data is processed and the purpose of the processing.

Data processed on the basis of your consent or for legitimate interests will be stored until your consent withdrawal/request for erasure, or until the purpose for which they were collected has been fulfilled, and in the cases when you are a customer of the Bank for 5 (five) years after the date of termination of the financial relationship with you. Applicable legislation may contain provisions for the extension of these deadlines for legal reasons.

8. Data subject rights

Personal data subjects have all the rights recognized by the Law:

the right to information,
the right to access,
the right to rectification and erasure,
the right to be forgotten,
the right to restriction of processing,
the right to data portability,
the right to object,
the right not to be subject to automated decision-making,
the right to complain,
the right to compensation for damage.These rights are exercised in the form and terms provided by the Law.
8.1 Right to information

Where personal data are collected from the data subject and the data subject does not have the following information, the controller shall provide the data subject with all of the following information:

a) the identity and the contact details of the controller and, where applicable, of thecontroller’s representative and of the controller’s data protection officer;
b) the purposes of the processing for which the personal data are intended as well as the legalbasis for the processing;
c) the existence and logic of automated decision-making and profiling, referred to in the Law and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
d) the period for which the personal data will be stored, or if that is not possible, the criteriaused to determine that period;

e) the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, where the processing is based on the consent and the legitimate interests pursued by the controller or by a third party, where processing is based on legitimate interests;
f) information, whether or not the data subject is obliged to provide the data and whether the provision of personal data is an obligation arising from the legislation in force, contract terms or conditions for entering into a contractual relationship, as well as the possible consequences of not providing this data;
g) the recipients or categories of recipients of the personal data, if any;
h) whether the data will be transferred to a third country and if so, how appropriate protection is guaranteed including information on appropriate safeguards and the means by which toobtain a copy of them or where they have been made available;
i) the exercise of rights under the Law, as well as the right to lodge a complaint with the Commissioner.

8.2 Rights to access

The data subject shall have the right to obtain from the controller, no later than 30 (thirty) days from the date of submission of the request, confirmation as to whether or not personal data concerning him/her are being processed, and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;
b) the existence and logic of automated decision-making and profiling and meaningfulinformation about the logic involved, as well as the significance and the envisaged
consequences of such processing for the data subject;
c) the period for which the personal data will be stored, or if that is not possible, the criteriaused to determine that period;
d) the legal basis for the processing;
e) the categories of personal data concerned, including, where the personal data are notcollected from the data subject, any available information as to their source;
f) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations including where personal data are transferred to a third country and if so, the data subject shall have the right to be informed of the appropriate safeguards;
g) the existence of the rights pursuant to the Law and the right to lodge a complaint with the Commissioner.

The controller shall provide the data subject, free of charge, with a copy of the list of categories of personal data processed, indicating the content of each category, which relates to the data subject and without prejudice to the fundamental rights and freedoms of other persons. For any subsequent copy requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means and has not specified another form in which the response is required, the information shall be provided in the electronic form commonly used.

8.3 The right to rectification and erasure

The data subject has the right to have inaccurate personal data concerning him/her rectified by the controller as soon as possible, but not later than 30 (thirty) days from the date of receipt of the request. In accordance with the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her and the controller shall have the obligation to erase personal data without undue delay but no later than 30 (thirty) days from the date of receipt of the request, where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they werecollected or otherwise processed;
b) the data subject withdraws consent on which the processing is based and where there is noother legal ground for the processing;
c) the data subject objects to the processing pursuant to the Law;
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation of the controller;
f) the personal data have been collected in relation to the online provision of goods or servicesas provided for by law.

Regarding this right, the Law provides for several exceptions in the cases of the processing mentioned therein.

8.4 Right to be forgotten

Where the controller has made the personal data public and is obliged pursuant to the Law to erase the personal data, the controller, taking account of the available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

At the request of the data subject, internet search engines operators are obliged to delete from the results displayed following a search conducted on the basis of the data subject’s name, the information which is no longer up-to-date over time but which, when found, has a significant negative impact on the data subject’s reputation.

8.5 Right to to restriction of processing

The data subject has the right to restriction of data processing by the Controller where one of the following applies:

a) the accuracy of the personal data is contested by the data subject, for a period enabling thecontroller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data andrequests the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the filing of a claim or exercise or defense of legal claims, obligations or interests before a court or public authority; or

d) the data subject has objected to processing pursuant to the Law. The restriction lasts for the period necessary for the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under the above paragraph, such personal data shall, with the exception of storage, only be processed:

a) after receiving the data subject’s consent;
b) for the filing of a claim or exercise or defense of legal claims, obligations or interests beforea court or public authority;
c) for the protection of the rights of another natural or legal person which override the rightsof the data subject; or
d) for reasons of important public interest.

The controller shall notify the data subject before the restriction of processing is lifted. If the controller refuses the request, the data subject may lodge a complaint with the Commissioner and request a preliminary decision on the restriction of processing.

8.6 Right to data portability

Where personal data are provided to a controller by the data subject, with his/her consent or for the performance of a contract, and the processing is carried out by automated means, the data subject shall have the right to receive from the controller the personal data concerning him/her in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

In exercising his/her right to data portability pursuant to the aforementioned paragraph, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of right to data portability shall not prejudice the right to erasure in accordance with the law. The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or where the controller has been granted the right to exercise public functions, tasks or powers by virtue of applicable law. The right to data portability shall not adversely affect the rights and freedoms of others.

8.7 Right to object

The data subject shall have the right to object, on grounds relating to his/her particular situation, at any time to processing of personal data concerning him/her including profiling based on provisions of the Law. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, especially when they concern the filing of a claim or exercise or defense of legal claims, obligations or interests before a court or public authority.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object, at any time and without having to give reasons, to processing of personal data concerning him/her for such marketing, which includes profiling to the extent that it is related to

such direct marketing. Where the data subject objects to processing for direct marketing purposes, the controller shall be obliged to cease processing of the personal data for such purposes.

At the latest at the time of the first communication with the data subject, the controller shall inform the data subject of the right to object clearly and separately from any other information.

8.8 Right not to be subject to automated decision-making

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly significantly affects him/her.

This shall not apply if the decision:

is necessary for entering into, or performance of, a contract between the data subject and adata controller; or
is authorized by a law to which the controller is subject and which also lays down suitablemeasures to safeguard the data subject’s rights and freedoms and legitimate interests; or
is based on the data subject’s consent.In these cases, the controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests and the right to obtain human intervention on the part of the controller, to express his/her point of view and to contest the decision.
8.9 Right to complain

Every person who claims that his/her rights, freedoms and legal interests concerning his/her personal data have been violated shall have the right to complain or to notify the Commissioner and to request his intervention to remedy the infringed right. When the data subject has filed a complaint, the controller shall have no right to make any changes to the personal data until a final decision ruled.

8.10 Right to compensation of the damage

Everyone who has suffered damage due to an unlawful processing of personal data is entitled to compensation, pursuant to the rules defined by the Civil Code.

8.11 Exercise of rights

You may submit a request for a specific right in a manner that allows you to be identified by contacting the Bank in the manner provided herein. Therefore, in order to meet the data security requirements and to protect the rights of the data subject, the Bank must confirm the identity of the data subject or the identity of the person who wishes to exercise any of the rights. The Bank will respond to any request or complaint in accordance with the form and procedure provided for by the Law within 30 (thirty) days from the date of its receipt. This period may be extended up to 60 (sixty) days, where necessary, taking into account the complexity and number of requests received. The Bank shall inform the data subject in a reasoned manner of any extension of the deadline within 30 (thirty) days from the receipt of the request together with the reasons for the delay. The response shall be in writing to the address from which the request or complaint was received and/or in electronic form when the request or complaint was received electronically, unless otherwise requested by the data subject.

The data subject has the unconditional right to object to the processing of his/her data for direct marketing purposes, and the Bank will immediately stop processing such data for this purpose.

Any person who claims that their rights, freedoms and legitimate interests regarding personal data have been violated has the right to complain or notify the Commissioner and request his intervention to remedy the violated right at the following contacts:

Information and Data Protection Commissioner

Adresa: Rr. “Abdi Toptani”, Nd. 5, Kodi postar 1001, Tirana Tel: +355 42 23 7200
Green number: 0800 2050
email: info@idp.al

If the data subject has filed a complaint, the controller shall not have the right to amend the personal data until the final decision has been made.

The data subject may also file a lawsuit in court for alleged violations in the field of personal data protection. The competent court shall be the Court of Tirana.

9. Profiling

The Bank may use a profiling process within the framework of direct marketing, especially when the data subjects are Bank’s customers. The Bank does not implement automated decision-making processes for direct marketing purposes.

The bank may use profiling in the case where the data subject is a customer for personalized marketing campaigns according to users of various banking products.

The Bank implements the legal provisions regarding profiling and guarantees the protection of your rights, freedoms and legitimate interests with appropriate safeguards.

In any case, the data subject has the right to human intervention, to express his or her point of view and to object to a decision based on profiling. Where the data subject exercises the right to object to processing in these circumstances, the Bank is obliged to cease processing the personal data for this purpose.

10. Security of personal data

The IT systems and other data storage facilities of our Bank are located at its registered premises and on the servers leased by the processor. Bank selects and operates the IT tools and applications for the processing of personal data in such a way that the data processed are:

accessible for the authorised persons (availability);
credible and authenticated (authenticity);
verifiably unchanged (data integrity);
protected from unauthorised access (confidentiality).

We take particular care to ensure data security, take all technical and organisational measures and adopt procedural rules required for enforcing the safeguards specified in Law no. 124/2024 “On personal data protection” and the applicable legal-regulatory framework. We take appropriate measures to protect the data from unauthorised access, alteration, transfer, public disclosure, deletion or destruction, as well as damage and accidental loss, and ensure that the data stored cannot be corrupted or rendered inaccessible due to any changes in or modification to the applied technique.

The information systems of Bank and our partners are both protected from computer assisted fraud, computer viruses, hacking and distributed denial-of-service attacks (DdoS). Moreover, Bank ensures security by means of server-level and application-level security procedures. Data are backed up on a daily basis. Bank takes all possible measures to avoid personal data breaches and in the event of a data breach, it takes action immediately to minimise any risks and eliminate any damage, in accordance with our incident management regulations and the applicable legal- regulatory framework.

11. Final provisions

The Bank reserves the right to amend or supplement this Information to ensure compliance with laws and regulations on the protection of personal data and the applicable legal-regulatory framework. The latest valid version of the Information is available at all branches of the Bank and on its website (www.otpbank.al).

Anything not specifically provided for in this Information is subject to the provisions of the applicable legislation.