SEB Privacy Policy

SEB Privacy Policy (PDF)

Contents

General principles
Definitions
Types and sources of personal data processed
Purposes of and legal bases for the processing of personal data
Profiling and automated decision-making
Transfer of personal data
Transfer of personal data outside the European Union or the European Economic Area
Use of cookies
Retention of data
Data Subject’s rights

SEB Privacy Policy The data controller¹ of the personal data is a company or a branch of a company registered in Estonia and belonging to the SEB Group: AS SEB Pank, AS SEB Liising, SEB Life and Pension Baltic SE, AS SEB Varahaldus, MTÜ SEB Heategevusfond, and AS Rentacar (hereinafter ‘SEB’).

The greatest value of SEB is a trust-filled relationship with all data subjects, especially (potential) clients, persons wishing to establish a client relationship, and persons wishing to establish an employment relationship with SEB. We process your personal data in accordance with legislation to provide a better service and to properly fulfil all contractual and legal requirements. We handle the information you have entrusted to SEB carefully and responsibly. The processing of personal data at SEB is governed by the General Data Protection Regulation (EU 2016/679) (‘GDPR’) of the European Union (EU), the Personal Data Protection Act, and other applicable EU and national legislation. This document provides an overview of how SEB processes your data and for what purposes, as well as your rights and how you can exercise them.

The Privacy Policy (before “Terms and conditions for processing personal data at SEB”) is valid from 15.02.2025.

General principles

1. This Privacy Policy describes how SEB processes your personal data. The Privacy Policy applies to you if you are a client or have applied to use the services of SEB, visit our website, are a third party in relation to our clients or services.
2. The Privacy Policy may be included in other documents and forms, including agreements concluded with you.
3. Within the SEB Group, the processing of personal data is governed by personal data processing agreements between the companies of SEB Group, which define the purposes, scope, means, and responsibilities for processing personal data.
4. SEB ensures the security of the processing of personal data by implementing best practices and international standards for the provision of information technology services and information security. SEB also requires its partners and other companies belonging to the SEB Group to whom it transfers personal data in accordance with the Privacy Policy to implement the necessary organisational, physical, and IT safeguards.
5. The contact address of the Data Protection Officer of SEB is dpo@seb.ee. Other contact details of SEB can be found at www.seb.ee.

Definitions

Personal data (hereinafter also referred to as ‘data’) means any information relating to a natural person which makes it possible to identify, characterise, distinguish, connect or derive that individual, directly or indirectly. Directly, for example, by name or personal identification code; indirectly, for example, by location data, an online identifier, or physiological, genetic, mental, economic, cultural, or social factors.²

Special categories of personal data means personal data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, biometric data (e.g. image of the iris, facial image, fingerprint) used to uniquely identify a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

Data subject means a natural person, for example, a person who has expressed a wish to use a service of the Bank (e.g. has submitted an application for the conclusion of an agreement) or who uses or has used a service of the Bank (client), or a third party who is otherwise connected with the services or activities provided by the Bank (e.g. legal representatives, authorised persons, contact persons, transaction partners, insured persons or beneficiaries in an insurance agreement, persons related to clients who are legal persons (members of the management board, beneficial owners, shareholders, partners, founders, members of the supervisory board, authorised company representatives, employees), members of apartment associations, guarantors, recipients of payments or payment initiators who are clients of another payment institution, successors). Third parties are, for example, users of ATMs, passersby in front of surveillance cameras, visitors to the branch offices, persons associated with the client, and payment recipients.

A decision based on automated processing is made by IT tools without human intervention.

Profiling means the automatic processing of personal data, during which SEB assesses the circumstances relating to you to make a forecast about you even if no decision is made.

SEB Group is Skandinaviska Enskilda Banken AB (publ) and all its subsidiaries.

Service means any service provided or offered by SEB and its selected partner, which is provided or mediated by SEB to the client in the branch office, via the mobile application, on the website, via telephone, video, or other channels.

Processing means any operation which is performed on personal data, whether or not by automated means (e.g. collection, recording, storage, use, transmission, and erasure), irrespective of the manner in which the operations are performed or the tools used.

Types and sources of personal data processed

1. SEB mainly processes the following personal data in its activities (the list is not exhaustive):

   data on the right of representation, e.g. information on the legal or authorised representative (e.g. parent, guardian, or member of the management board of a legal person) and the represented person (child or ward), the relationship with the successor or bequeather;

   audio, video, and audiovisual data, such as surveillance camera recordings; ATM camera recordings; photo and video recordings made for identification purposes during the establishment of the initial client relationship via video meetings; video recordings made during video meetings for the purpose of concluding agreements; photographs and video recordings made at client events; recordings of calls made to employees of the client service units of SEB;

   biometric data are processed to verify identity and liveness, they are not processed by way of technical processing for the purpose of unique identification of a natural person;

   data related to the state guarantee of loans by the Estonian Business and Innovation Agency (Kredex until 2022);

   financial data, such as wages, other income, assets, liabilities, investment objectives, risk tolerance, past payment behaviour and payment defaults, transactions on the account, information on the performance of agreements concluded;

   data relating to education and experience, e.g. school education, insurance experience, investment knowledge and experience;

   personal identification data, e.g. first and last name, personal identification code, date of birth, nationality, data on the identity document, photograph, Internet Bank login details;

   contact details, e.g. phone number, address, email address, preferred communication channel, language of communication;

   account information and payment initiation data (API), e.g. IBAN details in another bank, currency, balance, account statement, IP address, browser, payment amount, name, personal identification code and telephone number of the payer and payee of the payment;

   payment default data, e.g. the amount of the debt, the duration of the debt, past and present debts with SEB and other financial institutions, information on the underlying agreement concluded, date of occurrence the payment default and its end;

   payment transaction data, such as the name, personal identification code, telephone number of the payer and payee of the payment, account number, account balance, transaction amount, transaction limits, details of the payment (which may include special categories of personal data regarding yourself or a third party if the originator of the payment has indicated them in the details of the payment), card payment and ATM transaction data, payment-related inquiries, chargebacks;

   data on tax residency, e.g. country of residence, taxpayer identification number; data on family, e.g. marital status, number of dependents, data on the partner, data on children, the right to represent a minor;

   data on written communication, data about exchanges of information with you, including, for example, correspondence/ documents forwarded, virtual adviser;

   data on offences, e.g. information on economic, property, professional, and other offences for the commission of which financial services are used or may be used (e.g. money laundering, terrorist financing, violation of sanctions), court judgements made in criminal cases with justifications, pending offences;

   data related to the use of services or visiting the SEB website, e.g. data about your Internet Bank and mobile application activities, activity logs, login information, cookies and IP address, location, web browser information, information about the services used, service usage activity, preferences, satisfaction, requests and complaints submitted;

   data relating to activities and the origin of assets, e.g. studies, place of employment, occupation, business information (self-employed), information on payment practices, establishment and termination of business relationships, and occasional transactions;

   your relationship with legal persons, e.g. shareholder, partner, beneficial owner, member of the management or supervisory board, transaction partner;

   data of persons related to you, including authorised users of your accounts, users of your bank cards, beneficiaries of your insurance agreement, guarantor, beneficiary of the guarantee/credit, successors, persons indicated on the vehicle registration certificate in the case of a leasing agreement;

   data related to securities and pension schemes, e.g. quantity and currency, volumes and values of transactions, and other information that the register of securities or the pension registry may request in accordance with legislation.

   health data, e.g. medical history, test results, diagnoses, prescribed treatments, which are special categories of personal data, are processed by SEB Life and Pension Baltic SE in its core business as an insurance service provider. Health data may also be processed by other SEB companies if you or the persons related to you disclose this data when using a service (for example, when applying for a grace period due to health reasons. In such a situation, the processing of health data is necessary because our decision is based on information provided by you or your representative).

2. SEB receives your personal data mainly in the following ways:

   from you when you submit requests, applications, and other obligatory forms related to the service agreement for the preparation and/or conclusion and/or performance of agreements. If necessary (for example, to prevent money laundering and terrorist financing, to comply with international sanctions, to assess your creditworthiness or insurance risk, for claims handling), SEB will ask you to provide additional information;

   when providing a service when you use a service provided by SEB (e.g. making transfers and card payments, forwarding securities orders, and making other service-related transactions), when you communicate with SEB in the course of client communications (e.g. recordings of telephone calls, email communications, data and documents provided during communications), or in the cases where you are otherwise connected with a service provided by SEB (e.g. insured person/beneficiary under an insurance agreement, guarantor, secured party, co-borrower, beneficiary of a guarantee/credit; representative of a legal person, signatory on an account, beneficial owner, etc.).

   from other sources, such as:

• other financial institutions, e.g. correspondent banks, payment service providers, securities intermediaries, insurers;
• companies of SEB Group;
• healthcare providers;
• public and private registers (e.g. the business register, registers administered by the Tax and Customs Board, the population register, the land register, the securities register, registers administered by the Police and Border Guard Board, credit or payment default register, the e-Arrest system, the Criminal Records Database),
• registry of notarised acts, notaries;
• public sources (Ametlikud Teadaanded or Internet search engines);
• our clients or potential clients if you are connected to them, e.g. if you are a member of the management board, shareholder, partner, member of the supervisory board, beneficial owner, or authorised representative of the company.

Purposes of and legal bases for the processing of personal data

SEB will only process your data if we have a clear purpose, the processing is justified, and there is a legal basis for it. We collect and process your data to the extent necessary for the purposes for which it is collected. We process your data on the following legal grounds and for the following main purposes (the list of purposes is not exhaustive):

1. for the performance of an agreement – the need to prepare an agreement concluded with you or in your interest (e.g. to identify a person, process an application, prepare a credit decision, etc.), to perform the agreement concluded (e.g. to make payments, exchange information relating to the agreement), and to manage the agreement (e.g. to administer, deposit, archive, etc. the agreement in the banking system);
2. to comply with legal obligations – SEB has various obligations to process the data of clients and related persons to comply with legal obligations, such as those arising from various acts of Estonian and European Union legislation, as well as from the instructions of the supervisory authority. For example, SEB must comply with the requirements of the Money Laundering and Terrorist Financing Prevention Act, the International Sanctions Act or EU sanctions regulations, and the Law of Obligations Act, the principle of responsible lending under the Credit Institutions Act, as well as requirements under the Securities Market Act, Payment Institutions and E-money Institutions Act, Insurance Activities Act, Funded Pensions Act, and the Credit Institutions Act in the provision of payment and financial services.
3. on the basis of consent – in some cases, SEB may also process your personal data on the basis of your freely given consent (e.g. to send direct marketing communications). The content, scope, and purposes of the processing are described in the consent, which you can withdraw at any time. The withdrawal of consent does not affect the processing of data that has already taken place, but SEB will not continue to process your data, unless there is another legal basis for doing so.
4. on the basis of legitimate interest – processing of personal data is necessary for the purposes of the legitimate interest pursued by SEB or the business of a third party, provided that in no case shall the legitimate interest pursued by SEB or a third party override your fundamental rights and freedoms. Legitimate interests may include, for example, ensuring security (implementing safeguards to protect the interests of the client and the employees of SEB), researching the consumption patterns of clients to improve the service experience, as well as provide appropriate services and secure remote channel solutions (including the improvement and development of the website, the Internet Bank, the mobile application, etc. of SEB), preparing statistics, recording phone calls to analyse and improve the quality of service, and in proving and defending the claims of SEB in court or out of court.
5. for the performance of a function in public interets – for the performance of the obligations set forth in legislation, primarily in the Money Laundering and Terrorist Financing Prevention Act.

The table below sets out the general cases of processing of personal data – the main purposes of the processing, a list of categories of personal data, and the legal basis for the processing.