## PRIVACY AND DATA PROTECTION NOTICE FOR IDENTIFICATION OF NATURAL PERSONS WHEN ESTABLISHING A BUSINESS RELATIONSHIP WITH THE BANK, OF AUTHORISED PERSONS, PROXIES AND LEGAL REPRESENTATIVES OF NATURAL PERSONS AND NATURAL PERSONS EXECUTING CASH PAYMENTS VALUE OF WHICH IS EUR 15,000 AND MORE OR EXCHANGE OPERATIONS IN THE AMOUNT OF EUR 5,000 AND MORE

- 1. Groups of data subjects

Pursuant to Article 23 of the Law on Personal Data Protection of the Republic of Serbia (hereinafter referred to as: “Law”) and other regulations, OTP banka Srbija a.d. Novi Sad, as Data Controller (hereinafter referred to as: “Bank”) shall provide to natural persons when establishing a business relationship with the bank, authorized persons, proxies and legal representatives of natural persons and natural persons executing cash payments value of which is EUR 15,000 and more or exchange operations in the amount of EUR 5,000 and more (hereinafter referred to as: “Data Subject“) information on the collection and processing of their personal data, as well as on their rights in connection with processing.

- 2. Groups of data to be processed

The Bank processes the following main groups of a natural person’s personal data when establishing a business relationship with the Bank:

- 1) Personal data - data from identification document;

2) Contact data - e-mail, telephone number, residence address;

- 3) Data on residence;
- 4) Taxpayer status in the USA;
- 5) Special data type – status of an official.

The Bank processes the following main groups of personal data of an authorized person, proxy with disposal right, legal representative of natural person:

- 1) Personal data - data from identification document;

2) Contact data - e-mail, telephone number, residence address;

- 3) Data on residence;
- 4) Taxpayer status in the USA;
- 5) Special data type – status of an official.

The Bank processes the following main groups of proxy’s personal data without the right of disposal:

- 1) Personal data - data from identification document;

2) Contact data - e-mail, telephone number, residence address;

- 3) Data on residence.

The Bank processes the following main groups of natural person’s personal data executing a cash payment, amount of which is EUR 15,000 or more or exchange operations in the amount of EUR 5,000 or more;

- 1) Personal data - data from identification document;

2) Contact data - e-mail, telephone number, residence address;

- 3) Data on residence;
- 4) Taxpayer status in the USA;
- 5) Special data type – status of an official.
- 3. Purpose of Data Processing

The Bank shall process Data Subject’s personal data for the purpose of determining identity of a person with whom the Bank is entering into a business relationship:

- 4. Legal basis of data processing and transfer

Legal grounds for collecting and processing Data Subject’s personal data are the Law on Prevention of Money Laundering and Terrorism Financing, Law on Exchange Operations, Law on Ratification of the Agreement between the Government of the Republic of Serbia and the Government of the United States of America with the Aim of Improving the Compliance of Tax Regulations at the International Level and the Implementation of FATCA Regulations, and other by-laws of the National Bank of Serbia.

The Bank may forward the data collected on a Data Subject to the National Bank of Serbia, state authorities of the Republic of Serbia upon request, to the Parent Bank and external audit companies.

- 5. Period of data retention

The Bank stores the Data Subject’s personal data for a period of 10 years upon termination of business relationship in accordance with Bank’s internal acts and relevant regulations.