Data protection policy

Information on the conditions for processing of personal data in Národná banka Slovenska

Národná banka Slovenska (“NBS”) takes the protection of your personal data particularly seriously. The institution sets great store by informing you in detail how the personal data that you provide to us are treated, why we collect personal data and what all this means for you. This document is presented in line with our obligations under the General Data Protection Regulation (“GDPR”) which entered into force on 25 May 2018. From this date, the GDPR, together with Act No 18/2018 Coll. on Personal Data Protection, regulates the protection of personal data and contributes to increasing accountability and transparency of all entities in using personal data.

This document presents information on the purposes for which we process personal data, the conditions for personal data collection, personal data provision and transfers, recipients of personal data, as well as information on the rights of data subjects (natural persons whose personal data are processed in NBS’s information systems). We recommend that you read the information carefully.

Information on the conditions of personal data processing

offers an overview of how NBS collects and processes personal data and informs of data subjects’ rights under the General Data Protection Regulation;
is intended for natural persons who are or will be NBS clients, financial consumers, NBS visitors, NBS suppliers, natural persons representing or acting on behalf of legal entities, participants at events organised by NBS, applicants for a job with NBS, contractual partners or persons having written communication with NBS;
includes information on cases when personal data is shared with other entities (recipients), for example with our service providers, suppliers or intermediaries.

What is personal data?
For the purposes of this document ‘personal data’ means all information about you which identify or can identify you as a specific person. The data may include your name, surname, address or personal identification number, or camera records.

1. Data controller

NBS processes personal data in its information systems as a controller under the provisions of Article 4(7) of the General Data Protection Regulation (“GDPR”). In the processing of your personal data, NBS complies with the principles of lawfulness, fairness and transparency, the principle of limitation of purposes, the principles of data minimisation and data storage minimisation, as well as the principle of accuracy of data.

2. Data protection officer

The data protection officer is the person who performs tasks under the General Data Protection Regulation in NBS. The data protection officer can answer your questions regarding information included in this document. The data protection officer’s contact details are:
E-mail: dpo@nbs.sk
Address for written enquiries: Ochrana osobných údajov, odbor ochrany a bezpečnosti, Národná banka Slovenska, Imricha Karvaša 1, 813 25 Bratislava.

3. What do we use your personal data for?

NBS processes your personal data only as necessary for the purposes of their processing.

The purposes of personal data processing include
- a) Performance of NBS’s tasks under other legislation, for example identification and identity verification of persons presenting money in exchanging or taking money, in providing NBS authorisations to process banknotes and coins, registration and analysis of counterfeit or damaged means of payment;
- b) Performance of supervision of the financial market, supervision of banking, capital market, insurance and pension funds, protection of financial consumers and other clients on the financial market;
- c) Prevention of money laundering and terrorism financing;
- d) Authorisations to operate payment systems;
- e) Preparing, concluding and performing banking transactions with clients or their representatives, asserting the rights and performing NBS’s tasks resulting from concluded transactions, or related relationships between NBS and the data subjects;
- f) Open competitions for vacant posts in NBS, secondary school internships;
- g) Performance of public tenders;
- h) Preparing, concluding and performing contracts, asserting the rights and performing NBS’s tasks resulting from concluded contracts;
- i) Book-keeping;
- j) Dealing with complaints and requests/applications;
- k) Protection of public policy and public security, detection of criminal offences, protection of property and health;
- l) Administration of NBS property;
- m) Archiving of documents, files and records resulting from NBS’s activities.
Personal data may be processed for other purposes resulting from particular contracts between NBS and data subjects, for example contracts with authors, licensing contracts and purchase contracts.
NBS may also process personal data on the basis of the data subject’s consent; in such cases the purpose of processing must be stated directly in the consent.

4. Legitimate interests of NBS

In addition to the above purposes, NBS may also process your personal data where such processing is carried out for a legitimate interest pursued by NBS. These cases of legitimate interest include:

Obtaining contact details of a data subject, such as name, surname, address, e-mail address or telephone number to enable mail and telephone communication;
Implementation of monetary policy related to NBS’s membership of the Eurosystem;
Providing access to the NBS information systems;
Verifying the identity of persons authorised by clients to conduct over-the-counter transactions;
Registering holders of electronic certificates to access TARGET2;
Detecting, verifying and checking identification of data subjects;
Identification of the NBS visitors, protection of the NBS property.

Personal data may be provided to NBS in documents, forms, letters and notifications, or in telephone calls and electronic communication between NBS and the data subjects. The legitimate interest of NBS cannot outweigh your interests, fundamental rights and freedoms.

5. Where do your personal data go?

NBS has the right to delegate personal data processing to a processor. Where NBS delegates acquiring or other processing of personal data to a processor, the activity must be based on a written contract with the processor in accordance with Article 28 of the General Data Protection Regulation. NBS exercises due care in the selection of its contractual partners, evaluates their reliability and ensures compliance with personal data protection rules by means of contracts.
NBS may be obliged to transfer personal data to other entities under separate regulations, for example to supervisory authorities of other countries, the European Central Bank, Financial Intelligence Unit, Social Insurance Agency, or to the police.
NBS is obliged to have its financial accounts audited and therefore some personal data may be available to the auditors, Deloitte Audit, s. r. o., Digital Park 2, Einsteinova 23, Bratislava.
Mail delivery services for NBS are provided by Slovenská pošta and courier services.

6. Transfer of personal data to third countries

NBS transfers personal data to third countries (outside the EU and the EEA) only in cases when personal data are provided to supervisory authorities, in the implementation of a contractual relationship with a client, or when the transfer is necessary for other reasons of public interest.

7. How long are your personal data stored?

NBS adheres to the principle of personal data storage minimization. At the same time, our activities must comply with regulations which set periods for which certain types of documents must be stored (for example, 10 years in the case of accounting documents).
Under a separate law, NBS is a registry owner and is obliged to prepare a registry plan and submit it to the central state archives for approval. The periods for which some documents are stored in NBS are therefore governed by the approved registry plan.
Personal data of applicants for a job with NBS are deleted after the selection process is over, except in cases when the job applicant gives NBS permission to store their personal data for up to 6 months.
NBS stores camera records from publicly accessible NBS premises (premises for clients and cash handling) for a maximum of 13 months, camera records from other publicly accessible premises (for example surroundings of the NBS headquarters building, other NBS buildings, premises of the Museum of Coins and Medals in Kremnica) are stored for a maximum of 30 days. The personal data of persons making a single visit to NBS premises are stored for a maximum of 2 years.

8. What are your rights?

Data subjects have the following rights:

The right to obtain information from NBS on whether it processes their personal data, and the right to have access to the personal data concerning them;
The right to request NBS to rectify or erase their personal data without undue delay;
The right to request NBS to restrict the processing of their personal data;
The right to object to the processing of their personal data on account of their particular situation;
The right to data portability, where NBS processes their personal data on the basis of a contract or consent.

9. The right to withdraw consent

Where NBS processes your personal data on the basis of consent, you have the right to withdraw your consent at any time.

10. The right to lodge a complaint with a supervisory authority

If you have exercised some or all of your rights and you still feel that your concerns about the processing of your personal data have not been resolved, you have the right to initiate proceedings for protection of personal data with the Office for Personal Data Protection (Úrad na ochranu osobných údajov), Hraničná 12, 820 07, Bratislava 27.

11. Information on the obligation to provide personal data

Where NBS processes your personal data on the basis of a separate law, you are obliged to provide your personal data. Where your personal data are necessary for the fulfilment of a contract to which you are a party, NBS may process your personal data even without your consent. Furthermore, refusing to provide your personal data may result in NBS’s refusal to conclude the contract with you. NBS may also refuse to inquire into your claim based on separate laws if you did not fulfil your legal obligation to provide your personal data for this purpose.

12. Automated decision-making including profiling

NBS performs automated individual decision-making, based on a separate law, in which clients and the business transactions they perform are evaluated to detect money laundering and terrorism financing. Under a separate law, NBS is obliged to apply due diligence in relation to clients to the extent and in the manner prescribed in that separate law. The acquired personal (identification) data are recorded in the IS and have no direct effect on you as a data subject.

13. Updates

All changes in the conditions for the processing of personal data will be published on this website in the form of updates to this document. In this way we ensure that you always have access to up-to-date information on the conditions for the processing of your personal data.