DATA PROTECTION POLICY
OTP Bank Albania (hereinafter OBA) as part of OTP Bank Plc., as the leading financial institution, is committed to developing, operating and applying such a regulatory, executive and control system which ensures the safekeeping and protection of bank secrets, securities secrets as well as personal data in accordance with the criteria specified in relevant legal acts and its fundamental business interests.
The personal data processed by OBA include in particular data required for identifying and liaising with customers, data required for the provision of a given service and/or data generated and processed in the course of the provision of the given service (including data related to debt collection), the data of the communication – performed on any communication channel – between OBA and the data subject.
OTP Group is committed to the adequate protection of the personal data processed in compliance with the requirements of the General Data Protection Regulation (GDPR).
As Albania is not an EU country, GDPR is not applicable yet in Albania but our bank has the obligation to implement and enforce the requirements of our local laws on data protection and consumer protection. OBA has the obligation to implement and enforce the requirements of Law No. 124/2024 “On the protection of personal” data which aligns with EU Regulation no. 679/2016, of European Parliament and EU Council dated 27 April 2016 and EU Directive no. 680/2016, European Parliament and EU Council dated 27 April 2016.
When processing personal data and transferring it to third parties, OBA respects fundamental rights and fully ensures the principles of data protection all the time. Accordingly, it ensures
- that personal data shall be processed lawfully, fairly and in a transparent manner for data subjects;
- that personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- that personal data processed shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- that personal data processed shall be accurate and, where necessary, kept up to date and OBA takes every reasonable step to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified;
- that personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
- that personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
OBA as data controller requires 3rd parties (joint controllers, data processors, independent controllers) with whom the data is shared to comply with the principles laid down in the legislation and the supervisory requirements.
The detailed rules of data processing are contained in OBA’s relevant Regulation relating to certain business services (including ancillary business services) and investment services (including ancillary investment services) of business divisions as well as the related information brochures on data processing in force at any time
These documents contain details on the following:
- data subjects concerned by the given services of OBA (customers, potential customers and other data subjects concerned);
- data kept in records of data subjects in relation to the given service,
- purpose(s) of data processing;
- legal ground(s) for data processing;
- retention period of data processed;
- cases where personal data is processed using the automated decision-making method and used for profiling by OBA;
- the recipients of the transfer of the personal data processed and the legal ground for data transfer;
- data processors used during the data processing;
- the data subject’s rights are foreseen in the Law No. 124/2024 in particular,– according to its provisions the data subject has the right to request from OBA, as data controller, access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability.
OBA as part of the OTP group concerned process data, facts and information which are personal data, bank, securities and fund secrets, which they receive, ensuring high level of protection.
Data subjects may request information with regard to the processing of their personal data and may submit their requests and complaints as well at the following contact details:
Blv “Bajram Curri” Downtown Building, 8th Floor, Tirana, Albania .
E-mail address: ankesa@otpbank.al
Phone number: 08004848 / +355 68 (69) 40 12 121
Whistleblowing requests can be submitted in the following contact details:
E-mail address: oba.whistleblowing@otpbank.al
Send an official letter at the following address Banka OTP Albania sh.a,
Blv “Bajram Curri” Downtown Building, 8th Floor, Tirana, Albania
Further, the data subject may as well submit a complaint at the Office of the Commissioner for the Right of Information and Data Protection (address: Rr. “Abdi Toptani”, Nd.5, Kodi postar 1001, Tiranë; Phone: +355 42 23 7200; green number 08002050, E-mail: info@idp.al).