Processing of personal data
CNCB – Czech Non-Banking Credit Bureau, z.s.p.o. operates the Non-Bank Client Information Register (NBCIR), where personal data of clients of non-banking creditors, which mainly includes non-banking consumer credit providers licensed by the Czech National Bank, including leasing companies, is processed. These personal data are provided to the NBCIR by non-bank creditors and processed by CNCB as the controller in the NBCIR in accordance with the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”). The GDPR imposes a number of obligations on both controllers and processors when processing personal data, including the obligation to ensure the fulfilment of the rights of data subjects. The rights and obligations of controllers, processors and data subjects under the GDPR can be found in more detail in the General Regulation Basic Guide. The primary right of data subjects (clients of non-bank creditors) is the right to information on the processing of personal data and data protection, which can be found together with the list of non-bank creditors – users of the NBCIR in the CNCB Information Memorandum.
Data subjects have the following rights under the GDPR in relation to the processing of their personal data:
- First of all, you have the right to obtain information about whether the controller processes your personal data and, if so, information about what data it processes about you in the form of a Personal Data File. You will receive this copy upon request within 30 days of your request.
- It is an important right of yours, and of interest to non-bank creditors and CNCB, that the personal data processed is up to date. You therefore have the right to request the rectification of the personal data processed when irregularities are detected and the associated right to restrict the processing of incorrect or outdated data until the rectification is carried out.
- Under the GDPR, the data subject has the right to erasure of the personal data processed in specified cases. In NBCIR, personal data are processed for the purpose of fulfilling the legal obligation of non-bank creditors as NBCIR users to carry out an assessment of the consumer’s creditworthiness before granting or modifying consumer credit using credit databases pursuant to Act No. 257/2016 Coll., on consumer credit. For business loans, the purpose of the processing is the legitimate interest of NBCIR users to grant loans only to creditworthy and trustworthy clients. Of the cases defined in the GDPR for erasure, for consumer credit, erasure could occur if the personal data processed is not necessary for the stated purpose, e.g. the processing period would exceed 4 years from the end of the credit in question, where this period is generally considered necessary. In the case of business loans, erasure could occur if we are unable to demonstrate, on the basis of your objection, that the legitimate interests of NBCIR users outweigh your interests, rights or freedoms.
- The right to object to the processing of your personal data only applies where the purpose of the processing is a legitimate interest of the controller or in the public interest, i.e. only to the processing of NRKI data relating to business loans. The CNCB, together with the users of the NBCIR, has developed a Balancing Test, the conclusions of which show the predominance of the legitimate interest of non-bank lenders in the provision of credit over the interests and privacy rights of their clients, and therefore the legitimacy of the processing of clients’ personal data in the NBCIR.
You can exercise your above-mentioned rights at the Client Center operated by CRIF – Czech Credit Bureau, a.s., which has been entrusted with this activity by CNCB as the administrator. For more information on the contact details of the Client Center, how to apply for the exercise of rights and application forms, please click here. The processing of applications for the exercise of rights is free of charge. If the requests are manifestly unfounded or unreasonable, in particular because they are repetitive, a fee corresponding to the administrative costs may be charged.
If you believe that the processing of your personal data by NBCIR has violated the law or your rights, or if you are unable to resolve your matter with the Client Center, you have the option of contacting the DATA PROTECTION OFFICER electronically at firstname.lastname@example.org.