AL
flag AL
OTP Bank

Website Privacy Policy

PRIVACY POLICY OF OTP BANK ALBANIA SH.A. WEBSITE

Last updated: October 2025

Dear Visitor,

Thank you for visiting our website. OTP Bank Albania sh.a. (the “Bank”, “OBA”, “we”, “our”, “us”, “Controller”) is committed to protecting the personal data and respecting the privacy of the visitors of the website www.otpbank.al (“visitor/s”, “you”, “your”, “data subject”). This document constitutes the privacy policy (the “Privacy Policy”/“Policy”) of this website. Its scope is the recognition by the visitors of the Website of the privacy policy provisions, and of general provisions on personal data processing. Personal data processing through the Website happens only when visitors send such data to Bank on their free will. This Website (the “Website”) is governed by the Albanian law.

This Privacy Policy explains:

  • what data (if any) we collect when you use our website otpbank.al and/or interact with us digitally (e.g. sending a compliant, inquiry, applying for a vacant position);
  • how we collect, use, share and safeguard your information;
  • your rights under the Law no. 124/2024 “On personal data protection” (the “Law”);
  • how you can contact us with questions or concerns.

Personal data is processed in compliance with the provisions of the Law and relevant bylaws in force. Processing is carried out according to the principles of respecting and guaranteeing the fundamental human rights and freedoms and in particular the right to privacy. The Bank has taken the appropriate technical and organizational measures for the protection of personal data and to implement legal and regulatory obligations.

By using this Website and/or contacting us, you confirm that you have read, agreed with and accept the provisions of this Privacy Policy. This document may be amended and/or updated in the future, however, in no case will the rights guaranteed by the Law be limited. It is your responsibility to read and be aware of the current version of this document.

  1. WHO ARE WE

Bank is a financial institution licensed by the Bank of Albania.

  • Address: Bulevardi “Bajram Curri”, Godina “Down Town”, kati 8, Tirana, Albania
  • Contact: 0800 4848 info@otpbank.al
  • Data Protection Officer: Elton Rroji, rroji@otpbank.al, +35544538226

If you have any questions regarding the protection or processing of personal data, you can contact the Bank’s Compliance Sector at the email address “compliance.sector@otpbank.al” or at the telephone number 0800 4848.

  1. GENERAL INFORMATION

The Website that you are visiting provides information on OTP Bank Albania sh.a., including without limitation, information on its products and services, general policies, corporate governance, job vacancies, how to contact the Bank, etc.

The Visitors of the Website remain anonymous. The Website does not collect personal data, thus it does not collect information for the personal identification of your individual (except when you send this information on your free will).

You can send your specific data if you contact us through the contact forms/email/s made available herein. This information will be used only in accordance with the purpose for which it has been sent. By contacting us, the visitors shall be considered to have given their clear and expressed consent for the processing of their personal data sent from them. This consent can be revoked at any time.

Visitors acknowledge and agree that Bank may contact them, in the contact details provided by them, in order to address their queries/applications.

The legal basis of this Policy is the applicable legislation in the field of personal data protection, including without limitation Law no. 124/2024 “On personal data protection” and the instructions and decisions of the Information and Data Protection Commissioner (the “Commissioner”).

  • PERSONAL DATA PROCESSING PRINCIPLES

Personal data processing is carried out in accordance with the following principles:

  • principle of lawfulness, fairness, and transparency: processing is carried out lawfully, fairly and in a transparent manner in relation to the data subject.
  • principle of purpose limitation: personal data are collected for specified, explicit and legitimate purposes, clearly determined at the moment of collection, and not further processed in a manner that is incompatible with those purposes.
  • principle of data minimisation: personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
  • principle of accuracy: personal data are accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate or incomplete, having regard to the purposes for which they are processed, are erased or rectified without delay.
  • principle of storage limitation: personal data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
  • principle of integrity and confidentiality: personal data are processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
  • principle of accountability: the controller shall be responsible for and be able to demonstrate compliance with these principles.
  1. WHAT DATA WE COLLECT

We collect personal information that you voluntarily provide to us when you interact with us by completing forms on the Website and/or otherwise when you contact us. Personal information depends on the context of your interaction with us and may include:

  • Identification data: name, surname.
  • Contact details: email, phone number.
  • Messages, inquiries and/or client support requests: you may willingly provide us with information (e.g. financial) when you contact us.
  • Curriculum Vitae information: by sending us your CV, you may share with us information contained in it such as date of birth, education and employment history, etc.

No information is collected regarding any Website visitor identification. Provision of personal data included in the electronic forms contained in the Website and/or emails sent to us is not obligatory. It should be noted however that failure to provide such information may make it impossible for us to fufill the request or accept a job application.

By contacting us, Visitors shall be considered to have given their clear and expressed consent for the processing of the personal data they choose to send. The veracity and accuracy of such data is responsibility of the Visitor.

  1. HOW WE USE YOUR INFORMATION

We process your data to:

  • Provide and operate our website, improve website performance and user experience.
  • Communicate with you (answer to your complaints/requests).
  • Provide you with the possibility to apply for a work position with us.
  • Comply with legal and regulatory obligations.
  • If applicable, improve products/services and send products/services-related communications (we will seek consent for marketing messages).

Bank does not use profiling or automated decision making for the purposes of this Policy.

  1. LEGAL BASIS FOR PROCESSING

We process your data under the following legal grounds (Article 7 of the Law):

  • Performance of a contract: when you’re a client, to provide you support for our products and services.
  • Legitimate interest: to give information on Bank and the products/services it provides, to improve our products/services, to find potential candidates for employment, to generate leads (increase customer satisfaction, clients’ number, etc.), prevent fraud, to manage clients’ requests, etc.
  • Legal obligations: where applicable, to fulfill legal obligations to which Bank is subject.
  • Consent: for marketing, applying with us for vacancies and optional services. You can get information on marketing consent and information on privacy here.
  • SHARING YOUR DATA

We may share your personal data with:

  • Regulatory authorities, law enforcement or courts (where legally required).
  • Parent company (OTP Bank Hungary Plc.) and/or service providers engaged by the Bank during the course of its activities, under data protection agreements.

We will never sell your data to third parties.

  • WHO ARE THE PROCESSORS OF YOUR PERSONAL DATA?

Personal data provided to the Bank may be processed by its employees and those of the Parent  company’s as well as by employees of the Bank’s contractual partners/processors (e.g. information  and communication technology service providers, electronic communications notification service  providers, etc.), who are obliged to respect and protect your personal data based on the applicable  legislation in the field of employment, personal data protection and data processing contracts  and/or confidentiality agreements, in accordance with the legislation on personal data protection  and the applicable legal-regulatory framework.

Users are subject to the relevant authorizations and access rights. All users are obligated to respect and protect your personal data in accordance with the Law and the applicable legal-regulatory framework.

  1. INTERNATIONAL DATA TRANSFERS

If your data is transferred outside the European Economic Area (EEA), we ensure adequate protection through EU-approved safeguards (e.g., Standard Contractual Clauses, that transfer is done in accordance with the relevant legal provisions). The Bank ensures that it will not transfer data without the appropriate legal basis or your consent.

The transfer of data is made, if necessary, for the purposes of carrying out the Bank’s activities, according to the provisions of the Law, to OTP Bank Plc., Hungary (parent company). OBA and OTP Bank Plc. implement technical-organizational measures for data protection in accordance with applicable legislation and the highest security standards. The data subject may request a copy of his/her data from the Bank at any time.

  1. HOW LONG WE KEEP YOUR DATA

The Bank stores and protects your personal data in a manner that prevents the unjustified disclosure of your data to unauthorized persons. We store personal data only for as long as is necessary to achieve the purpose for which it was collected. The retention period depends on the basis on which the data is processed and the purpose of the processing. After this period, your data will be securely deleted or anonymized.

Data processed on the basis of your consent or for legitimate interests will be stored until your consent withdrawal/request for erasure, or until the purpose for which they were collected has been  fulfilled, and in the cases when you are a customer of the Bank for 5 (five) years after the date of  termination of the financial relationship with you. Applicable legislation may contain provisions for the extension of these deadlines for legal reasons.

  1. YOUR RIGHTS

You have the right to:

  • the right to information,
  • the right to access,
  • the right to rectification and erasure,
  • the right to be forgotten,
  • the right to restriction of processing,
  • the right to data portability,
  • the right to object,
  • the right not to be subject to automated decision-making,
  • the right to complain,
  • the right to compensation for damage.

These rights are exercised in the form and terms provided by the Law.

IX.1 Right to information 

Where personal data are collected from the data subject and the data subject does not have the following information, the controller shall provide the data subject with all of the following information:

  1. the identity and the contact details of the controller and, where applicable, of the controller’s representative and of the controller’s data protection officer;
  2. the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
  3. the existence and logic of automated decision-making and profiling, referred to in the Law and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
  4. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
  5. the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, where the processing is based on the consent and the legitimate interests pursued by the controller or by a third party, where processing is based on legitimate interests;
  6. information, whether or not the data subject is obliged to provide the data and whether the provision of personal data is an obligation arising from the legislation in force, contract terms or conditions for entering into a contractual relationship, as well as the possible consequences of not providing this data;
  7. the recipients or categories of recipients of the personal data, if any;
  8. whether the data will be transferred to a third country and if so, how appropriate protection is guaranteed including information on appropriate safeguards and the means by which to obtain a copy of them or where they have been made available;
  9. the exercise of rights under the Law, as well as the right to lodge a complaint with the Commissioner.

IX.2 Right to access

The data subject shall have the right to obtain from the controller, no later than 30 (thirty) days from the date of submission of the request, confirmation as to whether or not personal data concerning him/her are being processed, and, where that is the case, access to the personal data and the following information:

  1. the purposes of the processing;
  2. the existence and logic of automated decision-making and profiling and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
  3. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
  4. the legal basis for the processing;
  5. the categories of personal data concerned, including, where the personal data are not collected from the data subject, any available information as to their source;
  6. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations including where personal data are transferred to a third country and if so, the data subject shall have the right to be informed of the appropriate safeguards;
  7. the existence of the rights pursuant to the Law and the right to lodge a complaint with the Commissioner.

The controller shall provide the data subject, free of charge, with a copy of the list of categories of personal data processed, indicating the content of each category, which relates to the data subject and without prejudice to the fundamental rights and freedoms of other persons. For any subsequent copy requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means and has not specified another form in which the response is required, the information shall be provided in the electronic form commonly used.

IX.3 The right to rectification and erasure

The data subject has the right to have inaccurate personal data concerning him/her rectified by the controller as soon as possible, but not later than 30 (thirty) days from the date of receipt of the request. In accordance with the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her and the controller shall have the obligation to erase personal data without undue delay but no later than 30 (thirty) days from the date of receipt of the request, where one of the following grounds applies:

  1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  2. the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
  3. the data subject objects to the processing pursuant to the Law;
  4. the personal data have been unlawfully processed;
  5. the personal data have to be erased for compliance with a legal obligation of the controller;
  6. the personal data have been collected in relation to the online provision of goods or services as provided for by law.

Regarding this right, the Law provides for several exceptions in the cases of the processing mentioned therein.

IX.4 Right to be forgotten

Where the controller has made the personal data public and is obliged pursuant to the Law to erase  the personal data, the controller, taking account of the available technology and the cost of  implementation, shall take reasonable steps, including technical measures, to inform controllers  which are processing the personal data that the data subject has requested the erasure by such  controllers of any links to, or copy or replication of, those personal data.

At the request of the data subject, internet search engines operators are obliged to delete from the results displayed following a search conducted on the basis of the data subject’s name, the information which is no longer up-to-date over time but which, when found, has a significant negative impact on the data subject’s reputation.

IX.5 Right to restriction of processing

The data subject has the right to restriction of data processing by the Controller where one of the following applies:

  1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the filing of a claim or exercise or defense of legal claims, obligations or interests before a court or public authority; or
  4. the data subject has objected to processing pursuant to the Law. The restriction lasts for the period necessary for the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under the above paragraph, such personal data shall, with the exception of storage, only be processed:

  1. after receiving the data subject’s consent;
  2. for the filing of a claim or exercise or defense of legal claims, obligations or interests before a court or public authority;
  3. for the protection of the rights of another natural or legal person which override the rights of the data subject; or
  4. for reasons of important public interest.

The controller shall notify the data subject before the restriction of processing is lifted. If the controller refuses the request, the data subject may lodge a complaint with the Commissioner and request a preliminary decision on the restriction of processing.

IX.6 Right to data portability

Where personal data are provided to a controller by the data subject, with his/her consent or for  the performance of a contract, and the processing is carried out by automated means, the data  subject shall have the right to receive from the controller the personal data concerning him/her in  a structured, commonly used and machine-readable format and have the right to transmit those  data to another controller without hindrance from the controller to which the personal data have  been provided.

In exercising his/her right to data portability pursuant to the aforementioned paragraph, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of right to data portability shall not prejudice the right to erasure in accordance with the law. The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or where the controller has been granted the right to exercise public functions, tasks or powers by virtue of applicable law. The right to data portability shall not adversely affect the rights and freedoms of others.

IX.7 Right to object

The data subject shall have the right to object, on grounds relating to his/her particular situation, at any time to processing of personal data concerning him/her including profiling based on provisions of the Law. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, especially when they concern the filing of a claim or exercise or defense of legal claims, obligations or interests before a court or public authority.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object, at any time and without having to give reasons, to processing of personal data concerning him/her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the controller shall be obliged to cease processing of the personal data for such purposes.

At the latest at the time of the first communication with the data subject, the controller shall inform the data subject of the right to object clearly and separately from any other information.

IX.8 Right not to be subject to automated decision-making 

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly significantly affects him/her.

This shall not apply if the decision:

  • is necessary for entering into, or performance of, a contract between the data subject and a data controller; or
  • is authorized by a law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or – is based on the data subject’s consent.

In these cases, the controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests and the right to obtain human intervention on the part of the controller, to express his/her point of view and to contest the decision.

IX.9 Right to complain

Every person who claims that his/her rights, freedoms and legal interests concerning his/her personal data have been violated shall have the right to complain or to notify the Commissioner and to request his intervention to remedy the infringed right. When the data subject has filed a complaint, the controller shall have no right to make any changes to the personal data until a final decision ruled.

IX.10 Right to compensation of the damage

Everyone who has suffered damage due to an unlawful processing of personal data is entitled to compensation, pursuant to the rules defined by the Civil Code.

IX.11 Exercise of rights

You may submit a request for a specific right in a manner that allows you to be identified by contacting the Bank in the manner provided herein. Therefore, in order to meet the data security requirements and to protect the rights of the data subject, the Bank must confirm the identity of the data subject or the identity of the person who wishes to exercise any of the rights. The Bank will respond to any request or complaint in accordance with the form and procedure provided for by the Law within 30 (thirty) days from the date of its receipt. This period may be extended up to 60 (sixty) days, where necessary, taking into account the complexity and number of requests received. The Bank shall inform the data subject in a reasoned manner of any extension of the deadline within 30 (thirty) days from the receipt of the request together with the reasons for the delay. The response shall be in writing to the address from which the request or complaint was received and/or in electronic form when the request or complaint was received electronically, unless otherwise requested by the data subject.

The data subject has the unconditional right to object to the processing of his/her data for direct marketing purposes, and the Bank will immediately stop processing such data for this purpose.

Any person who claims that their rights, freedoms and legitimate interests regarding personal data have been violated has the right to complain or notify the Commissioner and request his intervention to remedy the violated right at the following contacts:

Information and Data Protection Commissioner 

Adresa: Rr. “Abdi Toptani”, Nd. 5, Kodi postar 1001, Tirana

Tel: +355 42 23 7200

Green number: 0800 2050

email: info@idp.al

If the data subject has filed a complaint, the controller shall not have the right to amend the personal data until the final decision has been made.

The data subject may also file a lawsuit in court for alleged violations in the field of personal data protection. The competent court shall be the Court of Tirana.

  • PROCESSING METHODS AND SECURITY MEASURES

The personal data are processed with automated and non-automated instruments, only for the time strictly necessary to achieve the purposes for which they have been collected. We use advanced technical and organizational measures to protect your data and to prevent loss of data, illegal or incorrect uses and unauthorized access, including:

  • Encrypted communication
  • Continuous monitoring of website usage.
  • Access controls and staff training on confidentiality.
  • Regular security monitoring
  • Employee confidentiality agreements

The IT systems and other data storage facilities of our Bank are located at its registered premises and on the servers leased by the processor. Bank selects and operates the IT tools and applications for the processing of personal data in such a way that the data processed are:

  • accessible for the authorised persons (availability);
  • credible and authenticated (authenticity);
  • verifiably unchanged (data integrity);
  • protected from unauthorised access (confidentiality).

We take particular care to ensure data security, take all technical and organisational measures and adopt procedural rules required for enforcing the safeguards specified in Law no. 124/2024 “On personal data protection” and the applicable legal-regulatory framework. We take appropriate measures to protect the data from unauthorised access, alteration, transfer, public disclosure, deletion or destruction, as well as damage and accidental loss, and ensure that the data stored cannot be corrupted or rendered inaccessible due to any changes in or modification to the applied technique.

The information systems of Bank and our partners are both protected from computer assisted fraud, computer viruses, hacking and distributed denial-of-service attacks (DdoS). Moreover, Bank ensures security by means of server-level and application-level security procedures. Data are backed up on a daily basis. Bank takes all possible measures to avoid personal data breaches and in the event of a data breach, it takes action immediately to minimise any risks and eliminate any damage, in accordance with our incident management regulations and the applicable legal regulatory framework.

  • THIRD-PARTIES LINKS

Our website may contain links to third-party sites. We are not responsible for their privacy practices. We encourage you to review their privacy policies.

  • UPDATES TO THIS POLICY

The Bank reserves the right to amend or supplement this Policy to ensure compliance with laws and regulations on the protection of personal data and the applicable legal-regulatory framework, changes in technology or products/services. The latest valid version of the Policy is available on its website (www.otpbank.al) with a revised “Last Updated” date.