Privacy Policy

In light of the regulations on personal data protection introduced by EU Regulation 679/2016, which forms the legislative basis for the processing and protection of personal data, the protection of your personal data is of paramount importance to us at BEST CREDIT INVEST IFN S.A.

We would therefore like to inform you of the reasons, purposes, retention periods, and manner in which your personal data are processed when you visit our website — bestcreditifn.ro — and apply for a loan. General Regulation No. 679/2016 on the protection of natural persons with regard to the processing of personal data applies throughout the EU, including Romania, from 25 May 2018, and provides you with enhanced data protection rights, to which correspondingly more detailed obligations apply.

This policy explains and governs:

• how and when we collect your personal data and what information we collect;
• how and why we use your personal data;
• your rights to control your personal data.

Please read this policy carefully. By accessing and using our website and services, you confirm that you have had an adequate opportunity to read this Policy, that you understand it, and that you agree to comply with it. If you do not, you must immediately stop using our website and the services we provide.

1. A few terms to help you understand this policy

“Personal data” means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.

2. What personal data do we process?

a) Personal identification data

• Data contained in the identity document, your photograph and that of the identity document or a copy thereof: first name, last name, father’s/mother’s initial, home/residence address, personal identification number, identity document/passport series and number (for non-residents), image.
• Contact details: landline/mobile phone number, email address.
• Family status: civil status data, data about family members.
• Sex, date and place of birth, citizenship.
• Signature.
• Pension file number.
• Profession, place of employment, professional training, educational qualifications.
• Public office held (if applicable).
• Economic and financial situation, source of funds/income, data about assets owned.
• Banking data (e.g., bank account details, credit card number, money transfers, assets, credit history, debts and expenses). If you opt for automatic card debiting, the payment processing service provider collects, uses, and processes your bank card information in accordance with its own privacy policies.
• Geolocation data / traffic data (IP address, cookies).

b) Data resulting from audio/video/electronic recording

Voice, image, video/audio recordings, computer IP address, emails, device ID.

c) Data and information relating to credit, similar, or insurance products

• Positive data: product type, grant period, date of grant, maturity date, amounts granted, amounts owed, account status, account closing date, loan currency, payment frequency, amount paid, monthly installment, employer name and address.
• Negative data: product type, grant period, date of grant, maturity date, loans granted, amounts owed, overdue amounts, number of overdue installments, overdue maturity date, number of days late in repaying the loan, account status.
• Loan repayment history, contract number, data relating to any litigation, data resulting from investigating your situation at ANAF/the Credit Bureau.
• Information relating to guarantor or co-debtor status.

d) Data relating to identified discrepancies

Data and information that are inconsistent and arise from documents presented at the time of the credit application, due to the fault of the credit applicant.

The data we use about you for verification purposes may be provided directly by you or may be obtained from the following sources:

• Publications/databases made available by official authorities (e.g., the Official Gazette, ANAF (Romania’s tax authority), the Credit Risk Central Office).
• Third parties, such as credit bureaus and fraud prevention agencies or data brokers, in accordance with personal data protection legislation.
• Websites/social media pages containing information made public by you (e.g., your own website or social media page).
• Databases published or made available by third parties.

3. For what purposes do we process data?

Data are processed for the following purposes:

• To identify you and assess your creditworthiness and financial-economic behaviour when you apply for a loan offered by BEST CREDIT INVEST IFN S.A. (this may include the use of facial recognition, voice recognition, fingerprints, or other biometric technologies, as well as online identification systems).
• To enter into, administer, and fulfil the credit agreement with BEST CREDIT INVEST IFN S.A. (including by entering into remote credit agreements).
• To prepare credit reports, carry out internal reporting and forecasting of needs, build and develop the risk management system, including self-training of specialised risk assessment software (this also applies in the event that no credit agreement is concluded).
• Processing in Credit Bureau-type systems.
• Debt collection/receivables recovery, insurance and reinsurance services.
• Advertising, marketing, and publicity (including sending letters with advertising and promotional content, SMS and email advertising, including content relating to offers for other financial or combined products).
• Surveillance of private/public premises and/or property.
• Audio recording of telephone calls, for the purpose of improving service quality and to provide evidence of requests/consents/options regarding certain services requested or offered.
• Carrying out the business activities of BEST CREDIT INVEST IFN S.A. (NACE code 6492 — Other credit granting: granting of consumer credit without issuing credit cards). For the purpose of conducting lending activities, we may process and store personal data, including personal identification number, citizenship, address, profession, place of employment, email address, phone number, family status, economic and financial situation, level of education, household income, and operating system, obtained on the basis of forms, statements, and documents submitted, drafted, or completed.
• Statistical analysis.
• Compliance with legal and regulatory obligations (such as prevention of money laundering and terrorist financing, compliance with legislation on sanctions and embargoes).
• Preparation of valuation reports and carrying out other stages in enforcement/insolvency proceedings, physical/electronic archiving of documents, and courier activities.
• For any other legitimate use relevant to our relationship with you.

BEST CREDIT INVEST IFN S.A. will not process personal data that reveal racial or ethnic origin, political opinions, religious beliefs or philosophical convictions, or trade union membership, nor will it process genetic data, biometric data for the unique identification of a natural person, data concerning health, sex life, or sexual orientation, except in the situations provided for by applicable legislation in force.

4. To whom may personal data be disclosed?

In order to fulfil the processing purposes, BEST CREDIT INVEST IFN S.A. may disclose some or all categories of personal data to the following recipients:

• the credit applicant;
• the legal representatives of the credit applicant;
• employees of BEST CREDIT INVEST IFN S.A.;
• shareholders;
• other companies/entities in the same group to which BEST CREDIT INVEST IFN S.A. belongs;
• authorised processors of BEST CREDIT INVEST IFN S.A., other natural or legal persons who process personal data on our behalf;
• debt collection or receivables recovery agencies;
• the employer or prospective employer of the credit applicant;
• public institutions that supervise banking activities (BNR (the National Bank of Romania), the Competition Council);
• public authorities (the Ministry of Finance, ANAF, the National Office for Preventing and Combating Money Laundering);
• entities organised as Credit Bureaus (Biroul de Credit S.A., the Credit Risk Central Office), clearing/settlement companies, or other persons/entities with whom we will conclude personal data processing agreements;
• bailiffs, notaries public, external consultants providing assistance in exercising and defending rights before courts;
• judicial bodies in Romania and other countries (courts of law, arbitral tribunals, prosecutors’ offices);
• financial and banking institutions in Romania and other countries;
• cybersecurity incident investigation and support institutions;
• entities to which BEST CREDIT INVEST IFN S.A. has outsourced financial and banking services;
• service providers: IT services, archiving, courier, audit, accountants, consultants, payment processors, valuers, insurance companies, advertising and analytics providers.

Personal data will not be disclosed to third parties unless the law provides otherwise. Personal data will be processed only by authorised employees of BEST CREDIT INVEST IFN S.A. and by natural and/or legal persons who hold the status of “data controllers” within the meaning of the applicable legal provisions.

5. What happens if you do not wish your data to be processed?

If you refuse to provide personal data, BEST CREDIT INVEST IFN S.A. will be unable to carry out the preliminary creditworthiness check required for the possible conclusion of a credit agreement, and we will be unable to initiate or continue the business relationship.

Processing data for marketing purposes enables us to keep you informed about news and offers from BEST CREDIT INVEST IFN S.A. You may request the cessation of processing for this purpose at any time, without affecting the customer relationship.

6. Can data be transferred abroad?

Data may be transferred abroad to countries within the European Union that ensure an adequate level of data processing. BEST CREDIT INVEST IFN S.A. carries out adequate prior assessment when selecting service providers and imposes appropriate technical and organisational security measures on them to protect personal data.

7. How long are data processed?

BEST CREDIT INVEST IFN S.A. will process the personal data you have provided for the purposes mentioned above, for as long as necessary to achieve those purposes, unless you object, and thereafter in accordance with the legal provisions that govern retention periods for such data (e.g., the legal provisions governing document archiving).

8. What is the legal basis for processing data?

The legal basis for processing your personal data is:

• a) the conclusion and performance of the credit agreement or another service agreement entered into by BEST CREDIT INVEST IFN S.A.;
• b) the legitimate interest of BEST CREDIT INVEST IFN S.A. in providing up-to-date information about its current and future products and services (development and improvement of products and services, ensuring a high level of security in IT systems and at physical locations, etc.);
• c) your express consent — for processing operations where it is required;
• d) compliance with legal obligations — the obligation of BEST CREDIT INVEST IFN S.A. to retain a copy of your identity document, to transmit data to public authorities, and to carry out any statutory form of processing.

9. What are your rights?

In accordance with the provisions of Regulation (EU) 679/2016, you have the following rights:

(a) The right to information

The right to be informed about the identity of the controller, the purpose of the processing, the recipients or categories of recipients of the data, the existence of the rights provided for by the Regulation, and the conditions under which they may be exercised.

(b) The right of access to data

The right to obtain from BEST CREDIT INVEST IFN S.A. confirmation as to whether or not data about you are being processed by us, as well as information about the manner in which such data are processed.

(c) The right to rectification of data

The right to request the correction of data held and processed by BEST CREDIT INVEST IFN S.A. if they are incomplete, inaccurate, or have changed since the date of collection.

(d) The right to erasure or the “right to be forgotten”

The right to request the deletion of personal data if it is no longer necessary for BEST CREDIT INVEST IFN S.A. to retain or use them, or when you wish to withdraw previously given consent, if the data have been processed unlawfully, or if you consider that the legitimate interest for processing is not justified.

(e) The right to restriction of processing

The right to request restriction of the processing of data when you consider that the data are inaccurate, when you consider that the processing is unlawful but do not wish the data to be deleted, for the establishment, exercise, or defence of a right in court, and during the exercise of the right to object to processing.

(f) The right to data portability

The right to have BEST CREDIT INVEST IFN S.A. provide your personal data in a structured, commonly used, machine-readable format that can be transmitted, for example, to another financial institution. This applies on condition that the processing is based on your consent or relates to the conclusion and performance of a credit agreement, and that the processing is carried out by automated means.

(g) The right to object

The right to object to the processing of data on the basis of the legitimate interests of BEST CREDIT INVEST IFN S.A. when you consider that such processing is prejudicial to your interests, rights, and freedoms, or when the purpose of data processing is direct marketing.

(h) The right not to be subject to automated decision-making

The right not to be subject to a decision based solely on automated processing without human intervention, intended to evaluate certain aspects of your personality (professional competence, creditworthiness, behaviour), including profiling for the purposes of fraud prevention, new product offers, and marketing. If you are not satisfied with the decision notified to you, you have the right to request and obtain human intervention, through review of the decision by a credit expert at BEST CREDIT INVEST IFN S.A.

(i) The right to address the supervisory authority or the courts

You may address ANSPDCP (Romania’s National Supervisory Authority for Personal Data Processing) or the courts to defend any rights guaranteed by the Regulation.

Contact details for the supervisory authority:

• Mun. București, Bd. Aviatorilor nr. 72, sector 1
• Phone: 004-021/312.12.75 · Fax: 004-021/314.34.62
• Email: anspdcp@dataprotection.ro
• Website: www.dataprotection.ro

Right to withdraw consent — where processing is based on consent, it may be withdrawn at any time. Withdrawal of consent will only take effect for the future; processing operations carried out prior to the withdrawal on the basis of consent remain valid.

Please note that the rights above may be limited under applicable national data protection legislation.

10. How can you exercise your rights?

You may exercise all rights provided for by Regulation (EU) 679/2016 by means of a written, dated, and signed request submitted to BEST CREDIT INVEST IFN S.A. at Str. Carol I, nr. 14, ground floor, Râmnicu Vâlcea, Vâlcea County, or by email at dpo@bestcreditifn.ro, stating your personal details (including a phone number) and the data in respect of which you are requesting action.