Privacy notice

PRELIMINARY SECTION: MAIN AMENDMENTS

As a trusted companion, the protection of your personal data is important to the BNP Paribas Group. We have enhanced this 
Privacy Notice by being more transparent on the following information on:

• processing activities relating to commercial prospection
• processing activities relating to anti-money laundering and countering the financing of terrorism, and international 
  sanctions (freezing of assets)

INTRODUCTION

Protecting your personal data is at the heart of what we do. The BNP Paribas Group has adopted strong principles in its Personal Data Privacy Notice, which is available at the following address: BNP Paribas - Personal Data Privacy Notice (group.bnpparibas). 

BNP Paribas Fortis SA/NV ("We"), as data controller, through our brands (BNP Paribas Fortis, Fintro and Hello bank!), is responsible for collecting and processing your personal data for its business operations.
Our job is to help all of our customers – private individuals, entrepreneurs, Very Small Enterprises (VSEs), Small and Medium-Sized Enterprises (SMEs), large enterprises and institutional investors – in their daily banking activities, as well as to achieve their aspirations with our financing, investment, savings and insurance solutions.
 
As a member of an integrated banking and insurance group in collaboration with the various Group entities, we provide our customers with a comprehensive range of financial and insurance products and services.

The purpose of this Privacy Notice is to explain how we process your personal data and how you can control and manage them.

Where applicable, additional information may be provided to you when we collect your personal data.

1. DOES THIS PRIVACY NOTICE APPLY TO YOU?

This Privacy Notice applies to you ("You") if you are:

• One of our customers or are in a contractual relationship with us (for example, as a guarantor or a joint borrower)
• A member of our customer's family and/or household. Our customers may sometimes be required to share information about their family with us when this is necessary in order to provide them with a product or service or to learn more about them
• Someone who is interested in our products or services when you provide us with your personal data (in branch, on our websites and apps, or during events or sponsorship activities)
• A payer or beneficiary of payment transactions involving our customer or us
• A (legal) representative of our customer
• A beneficial owner of our customer
• A debtor (for example, if our customer goes bankrupt)
• A shareholder of our customer
• An employee of our customer
• A contact person named by our customer
• An owner of a property occupied by our customer
• A customer of one of our customers
• An heir of a deceased customer;
• An individual reporting the death of one of our customers to us
• A former customer.

When you provide us with personal data relating to other individuals, do not forget to inform them that their data have been shared and ask them to read this Privacy Notice. We will do the same when we can (i.e. when we have the contact details of relevant individuals).

2. 2. HOW CAN YOU CONTROL THE PROCESSING THAT WE CARRY OUT ON YOUR PERSONAL DATA?

You have rights that enable you to exercise significant control over your personal data and how we process them. Please note that these rights may be restricted when stipulated by law. This occurs under anti-money laundering and anti-terrorism financing regulations, which prohibit us from letting you exercise your various rights relating to your personal data processed for this purpose.

If you would like to exercise the rights outlined below, please send us a request by post to BNP Paribas Fortis SA/NV - Data Privacy Office - 1CA2H, Montagne du Parc/Warandeberg 3, B-1000 Brussels, or on Easy Banking Web or App¹, along with a scan/copy of your identity document. You can also call the Easy Banking Centre or visit one of our branches.

If you have any questions about how your personal data are used under this Privacy Notice, please contact our Data Protection Officer at BNP Paribas Fortis SA/NV - Data Privacy Office - 1CA2H, Montagne du Parc/Warandeberg 3, 1000 Brussels, or by sending an e-mail to mailto:privacy@bnpparibasfortis.com.

2.1. You can request access to your personal data

You can access some data directly in your customer area on our Easy Banking Web or via Easy Banking App. 

If you would like to access your personal data, we will provide you with a copy of the personal data relating to your request and information about processing them.

2.2. You can ask for your personal data to be rectified

If you think that your personal data are inaccurate or incomplete, you can ask for them to be amended or completed. In some cases, you may be asked to provide supporting documents.

2.3. You can ask for your personal data to be erased

If you so wish, you can ask for your personal data to be erased, to the extent permitted by law.

2.4. You can object to the processing of your personal data based on legitimate interest

If you do not agree to your data being processed based on a legitimate interest, you can object to it for reasons relating to your specific situation, by telling us about the processing in detail and outlining the specific reasons for your objection. We will stop processing your personal data provided that there are no compelling legitimate grounds for processing them or unless the data are needed for establishing, exercising or defending legal claims.

2.5. You can object to your personal data being processed for marketing purposes

You have the right to object at any time to your personal data being processed for marketing purposes, including profiling, to the extent that it is related to such marketing.

2.6. You may suspend the use of your personal data 

If you dispute the accuracy of the data that we are using or object to your data being processed, we will review or verify your request. During the period that your request is under review, you have the option of asking us to suspend the use of your data.

 2.7. You have rights relating to automated decisions

In principle, you have the right not to be subject to a fully automated decision, based on profiling or not, which has a legal effect or significantly affects you. However, we may automate this type of decision if it is necessary for entering into/performing a contract with us, it is authorised by regulations, or you have given your consent. See Appendix 2 about the automated decisions that we make.

In any event, you have the option of disputing the decision, expressing your point of view and requesting the involvement of a human to review the decision.

2.8. You can withdraw your consent

If you have consented to your personal data being processed, you can withdraw this consent at any time.

2.9. You can request portability of some of your personal data

You can ask to be given a copy of the personal data that you have provided to us in a structured, commonly used and machine-readable format. When technically possible, you can ask us to send this copy to a third party.

2.10. How can you lodge a complaint with the Data Protection Authority?

In addition to the above-mentioned rights, you may lodge a complaint with the competent supervisory authority, which is usually the supervisory authority of your place of residence. In Belgium, it is the Belgian Data Protection Authority.

3. WHY AND ON WHAT LEGAL BASIS DO WE USE YOUR PERSONAL DATA?

The purpose of this section is to explain why we process your personal data and our legal basis for doing so.

3.1. We process your personal data in order to comply with our various legal obligations

Your personal data are processed when necessary to enable us to comply with the regulations applying to us, including banking and financial regulations. 

3.1.1. We use your personal data in order to:

• Monitor operations and transactions and to identify any unusual ones (for example, when you withdraw a large amount of money in a country other than the country of your place of residence)
• Monitor your transactions in order to manage, prevent and detect fraud
• Manage and report risks (including financial, credit, legal, compliance and reputational) that the BNP Paribas Group may encounter in its business operations
• Record, in accordance with the Markets in Financial Instruments Directive (MiFID II & MAR), communications in any form whatsoever in relation to, as a minimum, transactions completed for proprietary trading and for providing services relating to customer orders in terms of receiving, sending and executing customer orders
• Assess the suitability and appropriateness of each customer for providing investment services in accordance with the Markets in Financial Instruments (MiFID II) regulations
• Fulfil our duty, as an insurance intermediary, to provide advice under the Insurance Distribution Directive (IDD)
• Contribute to combatting tax fraud and fulfil our tax reporting and monitoring obligations
• Assess your level of credit risk and your ability to repay when you borrow
• Prevent payment arrears
• Record transactions for accounting purposes
• Prevent, detect and report Corporate Social Responsibility and sustainable development risks
• Detect and prevent corruption
• Comply with the provisions of the eIDAS regulations on electronic signatures
• Exchange and report various operations, transactions or requests, or respond to an official request from a duly authorised local or foreign judicial, criminal, administrative, tax or financial authority; an arbitrator or mediator; law enforcement authorities; or government or public bodies
• Ensure that payment services are executed securely, in particular, detecting and preventing fraud by authenticating the payer under the Revised Payment Services Directive (PSD2);
• Provide payment service providers acting on your request with information about your accounts, transactions and their respective beneficiaries or payers. These include, for example, payment service initiators and account-information service providers, also known as ‘account aggregators’
• Perform our reporting and consultation obligations with the National Bank of Belgium: consultation, registration and deregistration with the Central Individual Credit Register (CCP) and the Corporate Credit Register (CCR) via the National Bank of Belgium's BECRIS (Belgian Credit Risk Information System) information platform
• Identify and manage dormant accounts and safes for the purpose of querying the National Register of Natural Persons
• Respond to your requests around exercising your rights when you send them to us as per section 2

3.1.2. We also process your personal data in order to combat money laundering and terrorism financing

We belong to a banking group which must have a robust anti-money laundering and counter-terrorism financing (AML/CFT) system at entity level, which is directed centrally, as well as a system for applying local, European and international sanction decisions. 

With this in mind, we are joint data controllers with the other entities of the BNP Paribas Group. 

The processing undertaken in order to meet these legal obligations is outlined in Annex 1. 

3.2. Your personal data are processed for the performance of a contract to which you are a party or for precontractual measures taken at your request:

Your personal data are processed if it is necessary for entering into or performing a contract in order to:

• Establish your credit risk score and your ability to repay
• Assess (for example, based on your credit risk score) whether we can offer you a product or service and under which conditions (for example, price)
• Provide you with the products and services taken out in accordance with the applicable contract;
• Manage existing debts (identifying customers in default)
• Respond to your requests and assist you with your activities
• Support you in managing your budget by automatically categorising your transaction data and suggesting actions or points of concern. In order to categorise your transaction data, we perform profiling, taking into account the type of transaction (bank card, money transfer and direct debit), the debit or credit transaction amount, the date, the transaction name, the merchant’s name and industry, and the account type (personal/professional)
• Take into account your registration for games and competitions which we run or in which we are partners, manage your involvement and send your prizes to you, where applicable
• Take out (including through a contract arranged over the telephone, electronic authentication or electronic signature) our products and services that we distribute or promote, including, but not limited to, insurance products, remote surveillance and property rental products, provided that the insurer or service provider, as applicable, is still the data controller for the processing necessary for implementing the insurance and providing the service

3.3. Your personal data are processed because it is in our legitimate interest or in the legitimate interest of a third party to do so 

When we base processing on legitimate interest, we weigh up that interest against your interests or fundamental rights and freedoms so that we feel sure that there is a fair balance between them. If you would like more information about the legitimate interest pursued by processing your data, please contact us using the contact details provided in section 2 HOW CAN YOU CONTROL HOW WE PROCESS YOUR PERSONAL DATA? above.

3.3.1. As part of our banking and insurance operations, we use your personal data in order to:

• Manage the risks to which we are exposed:
  
  • we keep proof of operations or transactions, including in electronic format
  • we collect debt
  • we process legal claims and defence aspects during any litigation
  • we develop individual statistical models in order to help to establish your borrowing capacity and risk profile
  • we manage our environmental, social and governance risks
  • we detect, manage, prevent and investigate allegations and proven cases of misconduct among our employees and partners in line with the applicable rules
• Improve cybersecurity, manage our platforms and websites, and ensure business continuity
• Detect and prevent corruption and fraud, beyond legal requirements
• Prevent personal injury and harm to individuals and property through CCTV
• Assist other institutions where you are a customer in collecting data required to fulfil their legal obligations relating to combatting money laundering and terrorism financing (AML/CFT), as per the data-sharing rules set out in Belgian legislation
• Improve the automation and efficiency of our operational processes and customer services (e.g. performing technical, functional and operations tests, automatic complaint handling, tracking your requests and improving your satisfaction based on the data collected during our interactions with you, such as telephone recordings, e-mails or chats, using these interactions to train our staff and improve our chat tools)
• Enrich the transaction data of our customers when making payments to you in connection with your merchant activity
• Carry out financial transactions such as the sale of debt portfolios, securitisations, financing or refinancing of the BNP Paribas Group
• Perform statistical analyses and develop predictive and descriptive models (which may be done by artificial intelligence, in compliance with the regulations and guidelines of the competent authorities) for the following purposes:
  
  • Commercial purposes: in order to identify the products and services that we may offer you in order to best meet your needs; create new offerings or identify new trends among our customers, as well as similarities in behaviour; develop our business policy taking into account our customers' preferences (including adapting the distribution, content and pricing of our products and services based on our customers' profile); and glean insights (such as aggregate consumption patterns) that we can offer on the market
  • Scientific and related purposes: in order to contribute to university projects as well as private and public projects including micro- or macro-economic analyses for the Company's benefit
  • Security purposes: in order to prevent potential incidents and improve security management
  • compliance (such as combatting money laundering and terrorism financing) and risk management purposes
  • Combatting fraud
• Organise competitions, lotteries, promotional activities and events, and conduct customer opinion and satisfaction surveys
• Undertake sponsorship activities (including allowing a customer to invite their contacts to take advantage of our offerings and services, or to sign up for our sites and apps)
• Analyse social media and the website via keywords in order to assess BNP Paribas Fortis' reputation, follow discussions on specific topics and identify trending topics; analyse issues relating to specific social media posts and act accordingly; respond to posts or comments from social media users; detect and report false accounts and false posts or investigate serious allegations or claims
• Enable charities which have received donations from you to issue tax receipts
• Enable you to receive money transfers without an IBAN being entered (Wero), if you have not taken out these services
• Provide products or services to our corporate customers of which you are an employee or customer (such as cash management products)
• Deliver on our sustainable-development commitments
• Ensure the settlement of your estate
• Learn more about your family background based on the products that you have in common with members of your family and/or household, your own filings or the filings of a member of your family and/or your household
• Follow up on our agreements with external partners when you contact them directly and they inform us subsequently

3.3.2. We use your personal data to send you commercial offers by email, post and telephone

As a BNP Paribas Group entity, we want to be able to offer you access to our full range of products and services that best meet your needs.

As soon as you are a customer and, unless you object, we may send you these offers for our products and services and the products and services of the Group by e-mail when they are similar to those that you have already taken out. 

We make sure that these commercial offers cover products or services that are related to your needs and that they complement products or services that you already have, in order to ensure the right balance between our respective interests.

Unless you object, we may also send you offers relating to our products and services as well as products and services of the Group and of our trusted partners by telephone, banner, personal message and post.

3.3.3. We analyse your personal data to perform standard profiling in order to customise our products and offerings

In order to improve your experience and satisfaction levels, we need to determine to which group of customers you belong. In order to do this, we create a standard profile based on the relevant data that we select from information:

• • that you have provided directly to us during our interactions with you or when take out a product or service
  • resulting from your use of our products or services, such as products or services linked to your accounts, such as account balances, regular or unusual movements, use of your card abroad and the automatic categorisation of your transaction data, i.e. the breakdown of your expenses and income by category as it appears in your customer area
  • resulting from your use of our various channels: our sites, apps and social-media platforms (for example, if you are digitally minded, or if you prefer a customer journey to take out to a product or service with more autonomy (selfcare)
    Unless you object, we will customise our products and offerings for you based on standard profiling. If you consent, we will be able to go further in better meeting your needs, by customising our products and offerings as set out in section 3.4.

Unless you object, we will customise our products and offerings for you based on standard profiling. If you consent, we will be able to go further in better meeting your needs, by customising our products and offerings as set out in section 3.4.

3.3.4. We record electronic-communication data

In addition to the recordings of electronic communications authorised or required by law or to which you have consented, we and our Bpost contact centre are required to record electronic communications involving you, including traffic data, in connection with lawful business transactions in order to:

• Train and monitor our employees and improve the quality of our services
• Be able to provide evidence of business transactions or exchanges that have occurred during such electronic communications, including the content of these communications (including any opinions that we give)

We keep records of electronic communications for as long as required or permitted by law, including during the period when litigation relating to such communications could arise.

This applies to both telephone conversations and electronic communications (such as e-mails, SMS, instant messengers or similar technology) that you have with our call centre, our chatbots, our (independent) agents, private banking and business centres, dealing rooms or one of our representatives.

3.4. Your personal data will be processed if you have given your consent for us to do so

For some personal data processing, we will give you specific information and will ask for your consent. Please keep in mind that you can withdraw your consent at any time.

In particular, we shall request your consent for:

• Customising our offers and products or services based on more sophisticated profiling (gleaned from your current behaviour, expertise and preferences) that helps to anticipate your needs and behaviour;
• Any electronic offer for products and services that are not similar to products and services which you have taken out, and for products and services of our trusted partners; 
• Using your browsing data (cookies) for commercial purposes or deepening our understanding of your profile.

You may be asked to provide further consent for processing your personal data when necessary. 

4. WHICH TYPES OF PERSONAL DATA DO WE COLLECT?

We collect and use your personal data, i.e. any information that identifies you or enables you to be identified.

Depending on the type of product or service that we provide to you and on our interactions with you, we collect various types of personal data about you, including:

• Identification data: for example, full name, gender, place and date of birth, nationality, ID card number, national register number (observing the related provisions) passport number, driving licence number, vehicle registration number, photo, signature, woman's married name, artist pseudonym, and previous name if changed
• Contact information: (personal or professional) postal address, e-mail address and telephone number
• Information about your socio-demographic situation, assets and family life: for example, gender, marital status, matrimonial regime, number of children and age, your or your children's study or employment situation, household composition, death (of children, parents or spouse) and the date that it occurs and any property that you own: flat, house or other
• Important moments in your life: for example, you have just got married, divorced, started living as a couple, had children or lost a close relative
• Lifestyle: hobbies and interests, travel and your environment (nomad or sedentary)
• Economic, financial and tax information: for example, tax identification number, tax status, country of residence, salary and other income, and value of your assets
• Education and employment information: for example, level of education, employment, employer’s name and remuneration
• Banking and financial information relating to your products and services: for example, bank details, products and services held and used (credit, insurance, savings and investments, leasing and home protection), card number, transfers of funds, assets, declared investor profile, credit history and payment incidents
• Transaction data: account movements and balances, transactions and the data relating to beneficiaries and payers, including full names, addresses and contact details as well as details of bank transactions (such as transaction currency, name and merchant category), amount, date, time and type of transaction (bank card, money transfer, cheque and direct debit) and transaction categorisation
• Data about your habits and preferences relating to the use of our products and services
• Data collected as part of our interactions with you: your comments, suggestions and needs collected during our face-to-face interactions with you in our Branches (reports) and online during telephone communications (conversations); your voice and image during video calls; discussions by e-mail, chat, chatbot, exchanges and comments on our social media pages and your most recent claims/complaints; your login and tracking data collected through cookies, pixels and other trackers on our websites, online services, apps, our social media pages and electronic communications
• Data from the video protection system (including CCTV cameras) and geolocation: for example, locations of withdrawals or payments for security purposes, or to determine the location of the branch or service provider closest to you
• Data about your devices (such as a mobile phone, computer or tablet): IP address, technical specifications and unique identification data
• Personalised login details or security devices used to log in to the BNP Paribas website and applications, or to execute a payment service

We may collect sensitive data such as health data, biometric data or data on criminal offences, subject to the strict conditions defined by data protection regulations.

5. FROM WHOM DO WE COLLECT PERSONAL DATA?

We collect personal data directly from you. However, we may also collect personal data from other sources.

We sometimes collect data from public sources:

• Publications/databases provided by official authorities or third parties (for example, the Belgian state Gazette, the Crossroads Bank for Enterprises and databases managed by the financial-sector supervisory authorities)
• Websites/social media pages of legal entities or professional customers containing information made public by you (for example, your own website or your page on a social-media platform)
• Public information, such as information published in the press

 We also collect personal data from third parties:

• Other BNP Paribas Group entities
• Our customers (companies or private individuals)
• Our business partners
• Other credit institutions (for example, for executing a payment or delivering banking mobility)
• Payment initiation service providers and account aggregators (account information service providers)
• Third parties, such as credit reference agencies and fraud prevention agencies
• Data brokers who are responsible for ensuring that they lawfully gather relevant information
• Beneficiaries and filers for an estate
• Specific regulated professions, such as lawyers or notaries, where specific circumstances so require (such as litigation and estates)

6. WHO DO WE SHARE YOUR PERSONAL DATA WITH AND WHY?

6.1. With BNP Paribas Group entities

As a member company of the BNP Paribas Group, we work closely with other group companies worldwide. Therefore, your personal data may be shared between BNP Paribas Group entities, when necessary, in order to:

• Comply with our various legal and regulatory obligations set out above
• Meet our legitimate interests and the legitimate interests of BNP Paribas Group entities, which are to:
  
  • Manage, prevent and detect fraud
  • Perform statistical analyses and develop predictive and descriptive models for marketing, security, compliance, risk management and anti-fraud purposes
  • Improve the reliability of specific data about you held by other Group entities
  • Offer you access to all of the Group’s products and services that best meet your wishes and needs
  • Customise the content and prices of products and services
  • Optimise the management of common customers and the customer experience
  • Provide mutual assistance in fulfilling our legal, regulatory and contractual obligations relating to undertaking our activities

6.2. With recipients, third parties to the BNP Paribas group and processors

In order to fulfil some of the purposes set out in this Privacy Notice, we may, when necessary or required by our services, share your personal data with:

• Processors who perform services on our behalf, such as IT, printing, telecommunication, debt-collection, advisory, distribution, event-organisation and marketing services
• Banking and commercial partners, independent agents, intermediaries or brokers, financial institutions, counterparties, public services, trade repositories with which we have links if such a transfer is necessary in order to provide you with services or products or to meet our contractual obligations or to perform transactions (for example, banks, correspondent banks, custodians, security issuers, paying agents, exchange platforms, insurance companies, payment system operators, payment card issuers or intermediaries, and mutual guarantee or financial guarantee institutions, and trustworthy service providers)
• Local or foreign financial, tax, administrative, criminal or judicial authorities, arbitrators or mediators, and public authorities or institutions (such as the National Bank of Belgium, the FSMA and the Caisse des Dépôts et des Consignations), to which we or any member of the BNP Paribas Group are required to disclose data:
  
  • At their request
  • In connection with our defence, an action or procedure
• In order to comply with any regulation or recommendation issued by a competent authority to us or to any member of the BNP Paribas GroupThird-party payment service providers (information about your bank accounts), for the purposes of providing a payment initiation service or an information service on accounts which you have taken out with them
• Specific regulated professions, such as lawyers, notaries or auditors, where specific circumstances so require (such as litigation and audits) as well as our insurers or any buyer, whether actual or potential, of companies or activities of the BNP Paribas Group
• Public and/or private universities and scientific institutions
• Independent researchers and research institutions. As far as possible, we provide these data in aggregated form in order to ensure that the research findings remain anonymous

A list of our main partners and third-party service providers who will receive your personal data is available in Appendix 4.

7. INTERNATIONAL TRANSFERS OF PERSONAL DATA

For international transfers from the European Economic Area (EEA) to a country outside the EEA, your personal data may be transferred on the basis of a decision issued by the European Commission, when the Commission has recognised that the country to which your data will be transferred ensures an adequate level of protection. If your data are transferred to a country where the level of data protection has not been recognised as adequate by the European Commission, we will either rely on a derogation applying to the specific situation (for example, if the transfer is necessary in order to perform an agreement with you, such as when making an international payment) or we will take one of the following measures to ensure that your personal data are protected

• Standard contractual clauses approved by the European Commission
• Binding corporate rules

In order to obtain a copy of these measures designed to ensure that your data are protected or to receive details about where they can be accessed, you can send us a request using the contact details provided in section 2 "HOW CAN YOU CONTROL THE PROCESSING THAT WE CARRY OUT ON YOUR PERSONAL DATA?".

8. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

For more information on retention periods, please see Appendix 3.

9. HOW CAN YOU KEEP TRACK OF ANY CHANGES MADE TO THIS PRIVACY NOTICE?

In a world where technology is constantly evolving, we regularly review this Privacy Notice and update it if necessary.

Please review the latest version of this document online. We will inform you of any significant changes through our website or through our usual communication channels.

Appendix 1: Processing personal data to combat money laundering and terrorism financing

We belong to a banking Group that must have a robust anti-money laundering and counter-terrorism financing (AML/CFT) system at entity level, which is directed centrally, a system for combatting corruption and a system for enforcing international sanctions (this means all economic or trade sanctions, including all laws, regulations, restrictions, embargoes or asset freezes, decreed, administered, imposed or enforced by the French Republic, the European Union, the US Treasury’s Office of Foreign Asset Control and any competent authority in the territory where we are established). 

With this in mind, we act as joint controllers together with BNP Paribas Group entities (the term “we” used in this section therefore also includes BNP Paribas Group entities). For the purposes of AML/CFT and compliance with international sanctions, we carry out the processing listed below in order to satisfy our legal obligations: 

• A Know Your Customer (KYC) system reasonably designed to identify, update and confirm the identity of our customers, including the identity of their beneficial owners and their representatives, where applicable
• Enhanced identification and verification measures for high-risk customers, and Politically Exposed Persons (PEPs are individuals designated by the regulations who, due to their role or position (political, judicial or administrative), are more exposed to these risks), as well as high-risk situations
• Written policies and procedures, and checks reasonably designed to ensure that the Bank does not enter into – nor maintain – relationships with shell banks
• A policy, based on an assessment of the risks and the economic situation, which generally involves not performing or engaging in a business activity or relationship, irrespective of the currency:
  
  • For, on behalf of or for the benefit of any individual, entity or organisation subject to sanctions by the French Republic, the European Union, the United States, the United Nations, or, in some cases, other local sanctions in the territories where the Group operates; 
  • Involving, directly or indirectly, sanctioned territories, including Crimea/Sevastopol, Cuba, Iran, North Korea and Syria;
  • Involving financial institutions or territories that could be linked to, or controlled by, terrorist organisations, recognised as such by the competent authorities in France, the European Union, the United States or the UN.
• Screening of our customer bases and transactions, reasonably designed to ensure compliance with applicable laws
• Systems and processes for detecting suspicious activity and for reporting suspicions to the relevant authorities
• A compliance programme reasonably designed to prevent and detect corruption and influence peddling in accordance with the "Sapin II" Act, the US FCPA and the UK Bribery Act

With this in mind, we are required to make use of: 

• Services provided by external providers such as Dow Jones Factiva (provided by Dow Jones & Company, Inc.) and the World-Check service (provided by REFINITIV, REFINITIV US LLC and London Bank of Exchanges) which keep up-to-date PEP lists

Information publicly available in the press on charges relating to money laundering, terrorism financing and corruption

• Knowledge of risky behaviour or situations (existence of a suspicious activity report or equivalent) that can be identified at BNP Paribas Group level

We may be required to process special categories of data or criminal data as the purpose is to combat money laundering and terrorism financing.

We carry out these checks when entering into a relationship, but also throughout our relationship with you, on you and on the transactions that you carry out. At the end of the relationship, if there has been an alert about you, this information will be retained in order to identify you and adapt our monitoring if you re-enter into a relationship with a BNP Paribas Group entity, or as part of a transaction to which you are a party.  

In order to comply with our legal obligations, we share information collected for the purposes of AML/CFT, combatting corruption or applying international sanctions, with BNP Paribas Group entities. When your data are shared with countries outside the European Economic Area that do not have an adequate level of protection, the transfers are governed by the European Commission’s standard contractual clauses. If, in order to comply with regulations of non-EU countries, additional data are collected and shared, this processing is necessary to enable the BNP Paribas Group and its entities to comply with both their legal obligations and to avoid sanctions locally, which is our legitimate interest.

Appendix 2: Automated decisions, including profiling

Some of our personal data processing is based exclusively on automated processes and may result in decisions that produce legal effects for you or have a significant impact on your situation, without any human involvement. When this happens, we always inform you before you get started with a fully automated process on our digital channels and outline the underlying rationale behind the automated decision and its consequences.

This appendix outlines processing involving automated decisions about you. We will add more information if additional automated decisions are involved in our processing. 

1.    Online application for a credit card 

Description of the automated decision and its rationale:

You can apply for a credit card (provided that you do not already have one) via Easy Banking App or Easy Banking Web, and, in some cases, the decision to grant this card may be fully automated. You will then receive an immediate response for your application. The system automatically determines whether the credit requested suits your needs and whether you have the appropriate repayment capacity to meet your obligations. 

An automated system will determine whether BNP Paribas Fortis will grant you credit and the conditions under which it will be granted to you. BNP Paribas Fortis assesses your eligibility for a credit card based on the information that you have included in your application (such as the amount, the term and your income and expenses), as well as other data available within the bank in connection with our existing banking relationship, such as data on the management of your accounts and your credit contracts or your risk profile (established by our partner Alpha Credit).Publicly available information is also taken into account, as well as data that credit institutions must consult, such as the data in the Central Individual Credit Register of the National Bank of Belgium. 

We ensure that the data that we use are as recent as possible.

Consequences (and option to appeal against the decision to a human): 

The automated decision-making system will generate one of the two following responses: 

• Either your application will be processed automatically and immediately. You will then receive a firm credit offer from BNP Paribas Fortis, which you will be able to accept by signing the contract. 
• Or your application cannot be processed automatically (for example, if it exceeds the permitted limits for an online application or you are not deemed to be sufficiently creditworthy in the automated process). Should this occur, you can still contact the Easy Banking Centre or your branch in order to ask for a human to review your application (which does not necessarily mean that the application will be accepted).
  

2.    Online application for a professional loan 

Description of the automated decision and its rationale : 

Our professional customers who fulfil specific criteria (such as being in work, being the only borrower and already having an active loan) can get a loan quickly and easily, fully automatically and online, through Easy Banking Business or Easy Banking Web, while providing only the minimum information strictly needed. The system automatically determines whether the credit requested suits your needs and whether you have the appropriate repayment capacity to meet your obligations. 

The assessment models which provide the basis for the decision are based on a combination of your solvency and your repayment capacity, as well as your risk profile as determined by BNP Paribas Fortis (in particular, based on statistical analysis tools that take into account past payment defaults, for example). The models are adapted to the customer profile and the purpose of the loan, and are regularly monitored. 

If you provide your consent, an automated system will determine whether BNP Paribas Fortis will grant you a professional loan and the conditions under which it will be granted to you. BNP Paribas Fortis' automated decision will be based on the data that you have included in your application (such as the purpose of the loan, the amount requested and the desired term), as well as other data available within the bank in connection with our existing banking relationship, such as data relating to your credit history with the Bank, the management of your accounts and the collateral that you have provided to the Bank. Publicly available information (such as ONSS and VAT) is also taken into account, as well as data that credit institutions must consult, such as the data in the Corporate Credit Register of the National Bank of Belgium. 

We ensure that the data that we use are as recent as possible. 

Consequences (and option to appeal against the decision to a human): 

The automated decision-making system will generate one of the two following responses: 

• Either your application will be processed automatically and immediately. You will then receive a firm loan offer from BNP Paribas Fortis, which you will be able to accept by signing the contract. 
• Or your application cannot be processed automatically (for example, if it exceeds the permitted limits for an online application or you are not deemed to be sufficiently creditworthy in the automated process). Should this occur, you can still contact your adviser in order to ask for a human to review your application (which does not necessarily mean that the application will be accepted). 
  

3.    Automatic granting of a mortgage loan 

Description of the automated decision and its rationale : 

If you consent, an automated system will determine whether BNP Paribas Fortis will grant you a mortgage loan and the conditions under which it will be granted to you. The system automatically determines whether the mortgage loan requested suits your needs and whether you have the appropriate repayment capacity to meet your obligations.

The assessment models which provide the basis for the decision are based on a combination of your solvency and your repayment capacity, as well as your risk profile as determined by BNP Paribas Fortis (in particular, based on statistical analysis tools that take into account past payment defaults, for example). The models are adapted to the customer profile and the purpose of the loan, and are regularly monitored. 
In order to make this decision automatically, BNP Paribas Fortis uses the data that you have included in your application (such as the purpose of the loan, the amount, the term and your income and expenses), as well as other data available within the bank in connection with our existing banking relationship and, in particular, data on the management of your accounts and credit contracts, as well as any collateral provided. Publicly available information is also taken into account, as well as data that credit institutions must consult, such as the data in the Central Individual Credit Register of the National Bank of Belgium.

We ensure that the data that we use are as recent as possible. 

Consequences (and option to appeal against the decision to a human): 

The automated decision-making system will generate one of the two following responses: 

• Either your application will be processed automatically and immediately. You will then receive a firm loan offer from BNP Paribas Fortis, which you will be able to accept by signing the contract. 
• Or your application cannot be processed automatically (for example, if it exceeds the permitted limits for an online application or you are not deemed to be sufficiently creditworthy in the automated process). Should this occur, you can still contact your adviser in order to ask for a human to review your application (which does not necessarily mean that the application will be accepted). 
  

4.    Opening an account online 

Description of the automated decision and its rationale : 

If you make an application to open an account via Easy Banking Web/Easy Banking App, the decision around your eligibility is fully automated within BNP Paribas Fortis. In this case, you will receive an immediate response for your application. The account-opening process involves automatically assessing your risk profile, based on your personal characteristics (such as your legal age and legal capacity) and our data in connection with our existing banking relationship. 
  
If you would like to open a joint account with a joint holder, the same checks will also be performed on the joint holder. 

Consequences (and option to appeal against the decision to a human): 

The automated decision-making system will generate one of the two following responses: 

• Either your application will be processed automatically and immediately. Your application to open an account will then be accepted immediately. 
• Or your application cannot be processed automatically (for example, if you are not a Belgian resident). Should this occur, you can still contact your adviser in order to ask for a human to review your application (which does not necessarily mean that the application will be accepted). 

5.    Direct debit on a mortgage loan 

Description of the automated decision and its rationale : 

In some cases, when signing your mortgage loan, a specific financial package may be provided in order to finance works. In such circumstances, the funds are only released when supporting invoices are presented.

If you request the release of your funds via Easy Banking Web, you will need to provide the invoice information and upload the supporting documents. The invoice information will be automatically verified against the information recorded in the bank’s systems. 

This automated decision also applies when you present your invoice at a branch, with the only difference being that the information will be entered by one of our employees. 

Consequences (and option to appeal against the decision to a human): 

The automated decision-making system will generate one of the two following responses: 

• If the information matches, the release of your funds will be approved automatically
• If the information does not match, the funds will not be released and we will review your application manually in order to ensure the accuracy and security of the transaction

As stated in section 2.7 of the Privacy Notice, if an automated decision is made about you, you have – in addition to the rights mentioned in section 2 of this notice – specific rights: you can dispute this decision, express your point of view and request the involvement of a human to review the decision in question.

Appendix 3: Retention periods

LEGAL BASIS: COMPLIANCE WITH OUR LEGAL OBLIGATIONS

LEGAL BASIS: PERFORMANCE OF A CONTRACT OR PRE-CONTRACTUAL MEASURES

LEGAL BASIS: FULFIL OUR OR A THIRD PARTY’S LEGITIMATE INTEREST

Appendix 4: Main data recipients

Your data are processed confidentially and are only shared with third parties in accordance with the content of section 6 “Who do we share your personal data with and why?” of this Privacy Notice. These third parties are set out below: 

1.    Recipients within the BNP Paribas Group

We work closely with the other group companies worldwide. As a result, your personal data may be shared between BNP Paribas Group entities, when necessary, in order to comply with our various legal obligations or to meet our legitimate interests and the legitimate interests of BNP Paribas Group entities. 

The entities of the BNP Paribas Group with which we may share your personal data include: BNP Paribas SA, Alpha Credit SA,  Axepta BNP Paribas SA, Leasing solutions, BNP Paribas Partners for Innovation (BP2I), BNPP Fortis Factor SA,  Arval BELGIUM SA, BNP Paribas Cardif and BNP Paribas Fortis Credit brokers.

Contractual agreements have been established with other group entities in order to ensure that your personal data are processed only for specific and legitimate purposes, and that adequate technical and organisational measures are in place in order to protect your rights. 

Transfers to a country outside the European Economic Area (EEA) are made in compliance with the applicable personal data protection standards. More information about International Transfers of Personal Data is available in section 7 of our Privacy Notice. 

2.    Public entities 

The main public entities with which we may share your data are as follows: 

• Judicial or administrative authorities in Belgium or abroad (such as the Financial Information Processing Unit (CTIF))
• Out-of-court mediation service (in particular, Ombudsfin)
• Tax authorities in Belgium or abroad
• the Financial Services and Markets Authority (FSMA) in Belgium or its equivalent abroad
• supervisory authorities (such as the National Bank of Belgium (NBB) and the European Central Bank (ECB))
• the Data Protection Authority (APD)
• Public authorities or bodies involved in combatting fraud (such as the Pensions Office, the National Social Security Office, FPS Social Security and FPS Finances)

3.    Other recipients 

3.1 Banking and financial sector service providers

In the course of providing banking services to our customers, we work with third parties from the financial sector who may process your personal data. This applies for the following services in particular:  

• We use the following in particular for providing cards and card payments: Thales, Giesecke & Devrient, MasterCard Europe and VISA Europe Limited
• For card payments and transactions: equensWorldline Belgium
• In order to make smartphone payments easier, we work with Bancontact Payconiq Company and the European Payment Initiative (Wero)
• For the secure exchange of messages and sending of financial instructions on the global financial market, we use the SWIFT system
• For the management of cash machines and updates to electronic identity cards, we use Batopin's services. 
• In order to serve you at post offices, we work with Bpost SA/NV
• For some of our Customer Service Centre activities, we work with Accenture
• For the provision and use of trusted services (itsme®), we work with Belgian Mobile ID

3.2    Specific service providers for other products

In addition to providing basic banking services, the Bank also offers other services and products. To do this, we use other service providers, depending on your product types and your needs. 

• In order to execute orders and securities transactions on the market, we work with Euroclear SA/NV in particular
• We use the KUBE platform of Isabel SA/NV and its affiliated members, which incorporates one identical process for identifying legal entities across different banks   
• We distribute insurance products offered by the insurance firm AG Insurance  
• We use Abbove to provide the PaxFamilia information-centralisation and asset-management tool
  
  

3.3.    Other private service providers 

We also work with other private service providers who help us to provide our services and manage our business operations. We share your personal data with these service providers only to the extent necessary for them to provide their services to our company. The main services are:

• Surveying and improving customer satisfaction through the Profacts and Medallia tools
• Managing invitations to our events with InviteDesk
• Creating and monitoring marketing campaigns with Adobe Campaign
• Market research with the aim of establishing credit ratings through Moody’s and Standard & Poor’s, in particular
• Providing postal services and managing postal correspondence with our partners SPEOS SA/NV and Bpost SA/NV
• Providing an electronic-signature management tool, thanks to Docusign's services
• Computer and digital service providers, such as Microsoft, Oracle and Fujitsu Technology Solutions
• Providers of ancillary services which you can access directly via Easy Banking App, such as Pluxee or Joyn, provided that you have taken out these services directly in the app
• Lawyers, or bailiffs and debt collection agencies
• Independent monitoring bodies, such as audit firms, in order to ensure independent oversight over our internal functioning and to ensure a suitable level of service quality.

Printable versions

• Printable versions Privacy Statement (30 October 2026)
• Privacy Statement (until 29 October 2026)
• Privacy Statement (until 24 January 2022)
• Privacy Statement (until 24 May 2018)

(last updated on 30 October 2026)

Privacy Notice Private Equity

• Privacy Notice Private Equity Management
• Privacy Notice Private Equity Expansion
• Privacy Notice Private Equity Belgium