A) Personal Data:

Personal data includes information that we collect and process about you depending on the products or services you obtain or receive. Typically, we process the following categories of information provided by you about yourself:

• Personal details: title, name, previous names, nationality, photograph, business details, gender, sexual orientation, medical records, history, date and place of birth.
• Contact: email address, residential or business address and contact telephone number.
• Identity: KYC documents which includes passport, PAN, Aadhaar number and similar documentation.
• Identity verification data: for our electronic services we require at least 2(two) forms of evidence to verify your identity which may include: your registered mobile number, registered email address, facial recognition, fingerprint, recording of your voice and a video call.
• Financial information: your bank account number, statement of account, credit or debit card numbers, financial history, credit score and authentication-related information.
• Economic, financial and residency information: income and other revenues, the value of your assets and your country of residence.
• Education and Employment related data: level of education, employment - employer’s name and remuneration.
• Transactions: details about payments to and from your accounts including repayments of any loan or credit facilities, beneficiary names, account numbers, addresses and transaction details.
• Log-in: information in connection with our account sign-in facilities, including your log-in, username and encrypted password details.
• Correspondence: information you give to us by filling in any of our forms or by communicating with us, whether face-to-face, by phone, email, online or otherwise.
• Marketing: details of any marketing preferences we receive from you.
• Video protection (including CCTV): surveillance of our premises and ATMs for security reasons.
• Other information: information about how you use and interact with our sites and apps, survey responses, responses to advertisements on the sites where we advertise, log information like your search and voice to text queries in the websites.
• Sensitive information: for certain products and services, we may collect your racial/ethnic origin, religious beliefs, biometric data, health data and information about criminal convictions and offences.
  • Biometric data may include: fingerprints, voice patterns or facial recognition which can be used for identification and security purposes.
  • Health data may be required and held by us in relation to some insurance contracts.

You must keep your personal data up-to-date. Please tell us promptly about any changes, for example, if you have a new address.

B) Technical Data:

We automatically collect the following when you use our website or apps:

• Technical information, such as your IP address and device ID, network and computer performance, browser type, language and operating system.
• Information about your visit, such as your URL and website interaction.
• Location data, with your approval, used to show you the location of the nearest branch or ATM based on your IP address, coordinates or a unique device code.
• Networks and connections, when you interact with us and the people and groups that you are connected to (for example, through social media).

We also collect information about you from the following sources:

• Other Emirates NBD Group entities and Emirates NBD India Entity;
• Credit Information Agencies and fraud prevention agencies;
• People appointed to act on your behalf;
• Third party providers and partners to help us improve the personal data we hold and to provide more relevant and interesting products and services to you;
• Joint account holders;
• Our co-branded financial services product partners for example, if you are an existing member of a rewards or loyalty program of one of our partners;
• Criminal record checks from organisations authorised to provide this data;
• Debt recovery agents;
• Advertisers and social media partners may share technical information and information about your visits with them including your experiences or interactions with them;
• Databases made available by official authorities and government authorised sources to update/verify your documents; and
• Publicly available sources.

WHY DO WE COLLECT THIS DATA?

We collect this data to facilitate your relationship with us and provide the requested services . If we do not receive the information that we request, we may not be able to provide the requested services. Unless otherwise indicated, it is necessary for Emirates NBD India Entity to collect, use, store, transfer and otherwise process personal data to achieve the purposes.

CONFIDENTIALITY OF PERSONAL DATA

When we collect personal data, we provide a safe, secure and confidential environment in all of our delivery Channels to ensure that your personal data remains private and used for the purposes for which it is held.We have a legal obligation to keep your data confidential, except:

• in circumstances where the disclosure of your data is imposed by a legal authority, statutory or governmental authority or a regulator or central banks, trade data repositories, or approved reporting mechanisms which may be outside your country or courts, litigation counterparties and others, pursuant to subpoena or other court order or process or otherwise as reasonably necessary, including in the context of litigation, arbitration and similar proceedings to enforce our terms and conditions, and as reasonably necessary to prepare for or conduct any litigation, arbitration and/or similar proceedings;
• in circumstances where the disclosure is made with your express consent or through a representative nominated by you;
• to protect our rights, privacy, safety or property, and that of you or others; or
• to disclose to or share with or make available to, our head office and any of our branch, related company, associate agent or our representative, any information concerning the customer, the names of its directors including financial position as also the details of account relationship with us.

In addition, we may use, disclose or transfer personal data to a third party

• in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings) and/or
• to third parties, as requested by you or your representatives.

Please note that personal data we collect in order to meet our legal and regulatory obligations related to the prevention of money laundering and terrorist financing is processed only for those purposes, unless otherwise permitted or agreed.

We collect data directly from you as our customer or prospective customer. Our agents, affiliates, subsidiaries, and service providers collect personal data in a number of ways, which include:

• Via services: Collecting personal data through providing services.
• Other than via services: We may collect personal data about you other than through the services, such as when you meet us ahead of transactions, request pitches or proposals from us, or participate in a transaction or contractual arrangement, are referred to in a working party list provided by you or third parties, or in information obtained from deal-related data rooms or from other sources, such as public databases, employers, the entity we provide the services to and from other third parties.

In certain circumstances we may collect information from you about individuals who do not have a direct relationship with us. This may happen in case of such individuals who are connected to you for instances shareholders or directors or guarantors etc : When you provide us with third party personal data (included but not limited to those listed above) you are responsible for ensuring that such third party has received this Privacy Notice and understands how we will use their personal data.

IS IT OBLIGATORY OR VOLUNTARY FOR ME TO PROVIDE MY PERSONAL DATA?

We need your personal data to provide you with the services or products requested by you.

After you submit an application form with us or become our customer, we have certain legal obligations to process your data. If you do not provide us with the requested personal data, we will be unable to comply with the legal or regulatory obligations and will not be able to offer our services to you.

It is voluntary for you to provide us your data or consent for sales or marketing purposes.

We make it clear on our application forms what data is required to be provided by you by marking the mandatory fields with the asterisk symbol (*).

You can object to further marketing at any time by:

• Calling our customer call centre on +91 22 6153 2393;
• changing your marketing preferences in your account; or
• sending us an email at indiahelpdesk@emiratesnbd.com.

Further details of how we will use your information can be found below.

Automated processing

The way we analyse personal data relating to our services may involve profiling or other automated methods to make decisions about you that relate to the following:

• Credit and affordability checks (including credit limits) – we will consider a number of factors including information about your income, expenses and how well you have kept up on payments in the past.
• Anti-money laundering and sanctions checks and screening 'politically exposed' people.
• Monitoring your account for fraud and other financial crime – we will assess your transactions to identify any that are unusual.
• Assessments required by regulators and appropriate authorities – certain details in your information may suggest that you are likely to become financially vulnerable and we may need to help you.

You may have a right to certain information about how we make these decisions. You may also have a right to request human intervention and to challenge the decision.

We may share your personal data with:

• companies within the Emirates NBD Group who may support us in any of the purposes set out in this Privacy Notice;
• any joint account holders, guarantors, trustees or beneficiaries;
• anyone who provides instructions or operates any of your accounts on your behalf including advisers (such as solicitors and accountants), intermediaries and those under power of attorney;
• people you make payments to and receive payments from;
• providers of payment-processing services and other businesses that help us process your payments;
• government-authorised Credit Information Agencies and fraud prevention agencies to comply with our legal and regulatory obligations;

Please be advised about the possible limitations of accessing future financial products and/or services based on your records provided to these agencies.

• any fund managers who provide asset management services to you and any brokers who introduce you to us or deal with us for you;
• independent third-party service providers and agents (including their sub-contractors) such as collection agents or providers who may deliver a gift or provide a gesture of goodwill;
• insurance providers, including underwriters, brokers and associated parties;
• analytics providers that assist us in the optimisation of our website including by measuring the performance of our online campaigns and analysing visitor activity;
• social media companies so they can display messages to you about our products and services or make sure you do not get irrelevant messages;
• any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition or takeover including the transfer of any of our rights or duties under our agreement with you;
• law enforcement authorities, government bodies (including Credit Bureau), courts, dispute resolution bodies, regulators, auditors and any party appointed by our regulators to carry out investigations or audits of our activities; and
• where required to do so by court order or where we are under a duty to disclose or share your information in order to comply with (and/or where we believe we are under a duty to comply with) any legal obligation.

The disclosure of personal data to these parties is done with the utmost care and due diligence to ensure that the protection and privacy of your data is maintained.

USES AND DISCLOSURES OF OTHER INFORMATION

We may not use and disclose other information for any purpose, except where we are required to do otherwise under applicable law. In some instances, we may combine other information with personal data. If we do, we will treat the combined information as personal data as long as it is combined.

COOKIE STATEMENT

Emirates NBD India Entity’s digital platforms use various third-party analytical tools. These tools use cookies which are downloaded to your device when you visit a website in order to provide a personalized browsing experience. Cookies are used for lots of tasks like remembering your preferences & settings, provide personalized browsing experience and analyze site operations. These cookies collect information about how users use a website, for instance, how often user has visited pages. All information collected by third party cookies is aggregated and anonymous. By using our website user/s agree that these types of cookies can be placed on his/her device. User/s is free to disable/delete these cookies by changing his/her device/browser settings. Emirates NBD India Entity is not responsible for cookies placed in the device of user/s by any other website and information collected thereto.

CONSENT

When you use our website or otherwise access our services, you are expressly agreeing to and consenting to the terms of this Privacy Notice and by any use of our website you will deemed to have given your consent for the processing of your personal data as set out in this Privacy Notice.

We are headquartered in Dubai in the United Arab Emirates (UAE). We may transfer your personal data to other countries where we (or other companies within the Emirates NBD Group/Emirates NBD India Entity) or our service providers maintain operations.

When we do this, we'll ensure it has an appropriate level of protection and that the transfer is in accordance with contractual terms, applicable laws, and our instructions. This includes relying on adequacy decisions issued by the relevant data protection authority and using standard contractual clauses for transfers of personal data. You can obtain more details of the protection given to your information when it is transferred by contacting us using the details below.

The security and confidentiality of your personal data is important to us!

We use a range of measures to keep your personal data secure and protected against unlawful processing, accidental loss, destruction and damage.

When we use external service providers, we require them to provide the same standards of data protection as we do.

Please contact our Customer Service Helpdesk on +912261532393 in case you receive fraudulent emails or require any assistance using our online banking services.

MINOR’S DATA

Protecting the safety of minor when they use the internet is important to us. Our websites are intended for use only by individuals who are at least 18 (eighteen) years of age. If you are under the age of 18, your parent or guardian must consent on your behalf where we ask for consent in relation to the use of your data and information.

External Links

Our website may, from time to time, contain links to external sites. If you follow a link to any of these websites, please note that these websites have their own privacy policies. Please check these policies before you submit any personal data to these websites. We are not responsible for the privacy policies or the content of such sites.

We do not keep your personal data for any period longer than is necessary for the purpose for which your personal data was collected, processed, required by law or where we may need it for our legitimate purposes such as maintaining records for analysis or audit purposes, responding to queries or complaints, monitoring fraud, defending or taking legal action and responding to requests from regulators.

The criteria used to determine our retention periods include:

• the length of time we have an ongoing relationship with you and provide the services;
• whether there is a legal obligation to which we are subject; and
• whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

If you opt out from receiving marketing communications or object to any other processing of your personal data, we may keep a record of your objection to ensure that we continue to respect your wishes and do not contact you further.

Your choices and rights

In certain circumstances, you have the right to:

• ask for a copy of the personal data we hold about you and obtain information about how we process it;
• ask us to give you (or a third party chosen by you) an electronic copy of the personal data you have given us;
• ask us to correct personal data we hold;
• ask us to restrict how we use your personal data
• ask us to delete your personal data
• object to particular ways we are using your personal data, including objections to marketing;
• contact us with any enquiries or complaints in respect of your personal data; and
• withdraw consent to the following at any time:
  • the processing of your personal data by us except where your personal data is required for business operation in relation to the product or service you obtain from us; and
  • sharing your personal data with third parties for purposes such as but not limited to marketing or sales.

Please note that a withdrawal of consent by you will not affect the lawfulness of data processing based on the prior consent. Your withdrawal of consent will take effect within 30 calendar days from the day you request us to do so.

If you wish to exercise any of these rights in relation to the personal data, we hold about you or wish to change your preferences at any time, please contact us, using the details below.

We will ask you to verify your identity before allowing you to access your personal data.

Your choices and rights

In certain circumstances, you have the right to:

• ask for a copy of the personal data we hold about you and obtain information about how we process it;
• ask us to give you (or a third party chosen by you) an electronic copy of the personal data you have given us;
• ask us to correct personal data we hold;
• ask us to restrict how we use your personal data
• ask us to delete your personal data
• object to particular ways we are using your personal data, including objections to marketing;
• contact us with any enquiries or complaints in respect of your personal data; and
• withdraw consent to the following at any time:
  • the processing of your personal data by us except where your personal data is required for business operation in relation to the product or service you obtain from us; and
  • sharing your personal data with third parties for purposes such as but not limited to marketing or sales.

Please note that a withdrawal of consent by you will not affect the lawfulness of data processing based on the prior consent. Your withdrawal of consent will take effect within 30 calendar days from the day you request us to do so.

If you wish to exercise any of these rights in relation to the personal data, we hold about you or wish to change your preferences at any time, please contact us, using the details below.

We will ask you to verify your identity before allowing you to access your personal data.

If have any questions about this Privacy Notice, please contact us:

• By email at: IndiaDPO@emiratesnbd.com;indiahelpdesk@emiratesnbd.com
• By writing to us:
  India Data Protection Officer
  Emirates NBD Bank (P.J.S.C)
  First Floor, 5 North Avenue,
  Maker Maxity, Bandra Kurla Complex,
  Bandra (East), Mumbai – 400051
• By phoning our Customer Service Helpdesk: +91 22 6153 2300
• By contacting our Nodal Officer for grievances:
  Name of the Officer: Mr. Sathappan Sethuraman
  Designation: Chief Operating Officer
  Email: ssathappan@emiratesnbd.com