Personal Data Protection Policy
JSC Micro Bank “MBC” is a micro bank registered and licensed in accordance with the legislation of Georgia (Identification No: 404967078; legal address: Tbilisi, Isani District, 68 Ketevan Dedofali Avenue, Floor 1, Office Space No. 2; website: https://mbcbank.ge) (hereinafter referred to as the “Micro Bank”) and, for the purposes of this Policy, acts as the data controller.
The purpose of this Personal Data Protection Policy (hereinafter referred to as the “Policy”) is to inform you about what personal data the Micro Bank processes about you, how your data is processed and used, how long your data is retained, and what rights you have.
The Policy applies not only to the Micro Bank’s customers, but also to persons interested in our products/services.
The Micro Bank is authorized to amend this Policy in order to ensure compliance with legislative and/or regulatory requirements. The updated version of the Policy will be published immediately on the Micro Bank’s website: https://mbcbank.ge/
When Your Personal Data Is Collected
In order to establish a relationship with you, the Micro Bank initially collects your personal data. We collect your data when you:
complete an application to use our product/service, including online;
use our product/service and become our customer;
use our website and/or online consultation functionality;
contact us remotely or communicate with us directly;
carry out transactions;
when, for the purpose of improving our products/services, we conduct research/analysis.
How We Process Your Personal Data
To protect the confidentiality, integrity, and security of your data, physical, technical, and organizational data protection and security measures are implemented at all stages of data processing, in accordance with internal policies and procedures, regulatory requirements, international standards, and advanced best practices.
The Processing of Your Personal Data Fully Complies With
The requirements established by the Law of Georgia on Personal Data Protection. In accordance with the law, the Micro Bank processes your data on a specific legal basis and for the achievement of a predetermined legitimate purpose.
Legal Basis | Legitimate Purpose |
|---|---|
Your consent to the processing of data | Establishing a contractual (business) relationship with you |
Reviewing your application (for the purpose of providing services to you) | Managing and improving the quality of our products/services |
Entering into a transaction with you and/or performing obligations undertaken under a transaction | Fulfillment and management of your obligations under the transaction, including debt collection in the event of non-performance of your obligations |
Data processing is provided for by law | Automated decision-making |
Data processing is necessary for the performance of an obligation imposed on us by law | Planning and carrying out marketing activities |
The data is publicly available in accordance with the law or has been made publicly available by you | Offering promotions to you |
Data processing is necessary to protect an important public interest | Testing systems for the purpose of improving/developing software |
Data processing is necessary to protect an important public interest, including, but not limited to, preventing crime, administering justice, protecting public safety, and ensuring information and cybersecurity | Detection, investigation, reporting, and prevention of financial crime |
Protection of our and/or third parties’ legitimate interests, except where there is an overriding interest in protecting your rights | Compliance with regulatory requirements imposed on us by law |
Comprehensive investigation of and decision-making regarding your complaint/claim | |
Planning our financial position and business opportunities, managing communications, corporate governance, and audits | |
Improving our products/services and tailoring them to your needs | |
Other purposes provided for by law |
What Types of Personal Data We Collect
To achieve the legitimate purposes described above, we collect and process the following categories of personal data:
Category of Personal Data | Description |
|---|---|
Identification data | First name, last name, date of birth, personal identification number, information contained in an identity and/or citizenship document, gender, citizenship, place of birth, address (registered and actual), photograph, signature specimen, and other information |
Financial data | Your financial status, status, financial activity history, and information about your income |
Contact information | Legal and actual address and contact information (email address, telephone number, and other contact details) |
Socio-demographic data | Detailed information about your place of employment or profession; as well as information about your citizenship, education, and membership in a social or economic category |
Transaction-related data | Detailed information about payments/transfers carried out by you |
Contractual data | Detailed information about the products and services provided to you by us |
Location data | Data concerning your location, which the Micro Bank may obtain through a mobile phone, from the address used to connect a computer to the Internet, or from the location of the facility where you conduct banking operations using your card |
Behavioral data | Data created by us as a result of analyzing information about you and your behavioral characteristics, including detailed information on how you use our products, services, etc. |
Technological data | Information about the devices and technology used by you (IP address, location information, and other information) |
Recordings | Video and audio recordings |
Communication data | Information obtained by the Micro Bank about you from letters, emails, and any other means of communication between the customer and the Micro Bank |
Social relationship data | Information about your family members (marital status, children), contact persons, and other related information |
Documentary data | Information about you contained in documents of various formats and copies thereof. Such documents include identification documents, birth certificates, driving licences, extracts from the Register of Entrepreneurs and Non-Entrepreneurial (Non-Commercial) Legal Entities of the National Agency of Public Registry, and other identification documents provided for by law |
Special Categories of Personal Data | In accordance with the Law of Georgia on Personal Data Protection, the processing of special categories of personal data is permitted only on the basis of your consent or in cases strictly regulated by law. The special categories of personal data that we process/may process include data relating to your: · health; · status as an accused, convicted person, acquitted person, or victim in criminal proceedings; · conviction, criminal record, diversion, recognition as a victim of human trafficking (trafficking) or as a victim of a crime in accordance with the Law of Georgia on the Elimination of Violence against Women and/or Domestic Violence, Protection and Assistance to Victims of Violence, detention, and enforcement of a sentence against you; · biometric data processed for the purpose of uniquely identifying a natural person (during identification/verification processes). |
How Long We Retain Your Personal Data
We retain your personal data throughout the entire period of your service relationship and for 15 years following the termination of the service relationship. The reason for retaining personal data for this period is to fulfill obligations imposed on us by law, as well as to comprehensively investigate and make decisions regarding any future claim/action brought by you.
We retain your data processed for direct marketing purposes until you withdraw your consent, which serves the purpose of providing you with information about offers tailored to you.
Throughout the entire retention period, the Microbank ensures the confidentiality, integrity, and security of your data.
Your Rights
Right | Descripiron |
|---|---|
Right to Receive Information About the Processing of Data | You may request, at any time and free of charge, and receive within no later than 10 business days from the date of your request, information about the legal basis and purpose of the processing of your data, the source of its collection/obtaining, the retention period, and other information concerning the processing of personal data as provided for by law, in accordance with the procedure established by law. |
Right to Access and Obtain a Copy of Data | You may, in accordance with the procedure and conditions established by law, access the personal data held about you and receive a copy thereof free of charge. |
Right to Correct, Update, and Complete Data | You may, at any time and in accordance with the procedure and conditions established by law, request the correction, updating, and/or completion of inaccurate, incorrect, and/or incomplete data concerning you. The Micro Bank will ensure the correction, updating, and/or completion of the data within no later than 10 business days from receipt of your request and will notify you accordingly. |
Right to Cease Processing, Delete, or Destroy Data | You may request the cessation of processing of your data, including profiling, as well as the deletion or destruction of your data. Within 10 business days from receipt of your request, the Micro Bank will notify you of the cessation of processing, deletion, or destruction of the data, or provide a reasoned refusal to cease processing, delete, or destroy the data, together with an explanation of the procedure for appealing such decision. |
Right to Block Data | You may request the blocking of your data if any of the following circumstances apply: · the authenticity or accuracy of the data is disputed; · the data is being processed unlawfully, but you do not wish the data to be deleted and instead request its blocking; · the data is no longer necessary to achieve the purpose of processing, but you need it for filing a complaint or claim, including for use as evidence. Within 3 business days from receipt of your request, the Micro Bank will notify you of the blocking of the data or provide a reasoned refusal to block it. Where data is blocked, in addition to its storage, the data may be processed in the following cases: · with your consent; · to substantiate a legal claim or defense; · to protect the interests of the Micro Bank or a third party; · to protect a public interest in accordance with the law. |
Right to Data Portability | You may request to receive the data provided by you in a structured, machine-readable format (on a CD or in electronic form). |
The above-mentioned rights may be restricted in cases expressly provided for by the legislation of Georgia, where exercising your rights poses a threat to:
national security, information security and cybersecurity, and/or defense interests;
public security interests;
crime prevention, investigation of crime, criminal prosecution, or administration of justice;
important financial or economic interests of the country, including monetary, budgetary, and tax interests, as well as public health and social protection interests;
the exercise of functions and powers of state bodies;
detection of violations of professional, including regulated professional, ethical standards and imposing liability for such violations;
your rights and freedoms or those of other persons;
protection of state, commercial, professional, and other secrets protected by law;
substantiation of a legal claim or defense.
If you believe that your rights are being violated, you may contact our Personal Data Protection Officer, the State Audit Office of Georgia, and/or a court.
Direct Marketing
On the basis of your consent, the Micro Bank processes your contact information (first name, last name, telephone number) for direct marketing purposes, which includes providing you with information about advertisements/offers tailored to you, products/services, and current promotions by means of short text messages and/or telephone calls.
You may withdraw your consent to the processing of your data for direct marketing purposes at any time by sending a notification via email to nopm@mbc.com.ge, calling the hotline at (+995 32) 2 50 50 02, contacting us through the online chat, or contacting any service center.
You may also use the opt-out mechanism (NOSMS) when receiving a specific advertisement/offer at your telephone number or email address.
In such a case, the Micro Bank will cease processing your data for direct marketing purposes no later than 7 business days from receipt of your request.
Receiving Personal Data from Third Parties
For the purpose of providing credit products, the Micro Bank, on the basis of your consent, receives information from:
1. Credit Information Bureau:
credit history;
credit rating.
2. Electronic Database of the LEPL Public Service Development Agency:
information and photograph contained in a passport, identity card, and residence permit issued by the LEPL Public Service Development Agency.
Transfer of Personal Data to Third Parties
In order to enter into a transaction with you and/or fulfill obligations imposed on us by law, we may need to transfer your personal data to third parties.
Third Party | Legal Basis | Legitimate Purpose |
|---|---|---|
Law enforcement authorities | Obligation imposed on us by law | Crime prevention; enforcement of sentences |
Audit company | Obligation imposed on us by law | Conducting an audit |
National Bank of Georgia | Obligation imposed on us by law | Fulfillment of obligations imposed by legislation and obligations imposed by the supervisory authority |
Whenever your data is shared with a third party, we take all necessary measures to ensure its security and protection.
Cookies
When you visit the Website, the Micro Bank uses cookies. Cookies store information about actions performed by you on the Website, allowing us to monitor your actions and tailor the Website as much as possible to your needs, making its use more convenient, accessible, and personalized.
We collect information about your actions on the Website through the following types of cookies:
Necessary cookies: ensure the uninterrupted functioning of the Website and store information such as information about your visit to the Website, IP address, and navigation on the Website, as well as other information necessary for the use and improvement of the Website’s basic functions;
Analytical cookies: used to identify the number of visitors to the Website and analyze their behavior in order to improve the Website’s functionality. Analytical cookies store data such as the frequency of your visits to the Website and the duration of your visits;
Marketing cookies: used to create personalized offers and advertisements, for which we may use third-party analytics platforms (e.g., Google Analytics, Facebook Pixel, and others).
When visiting the Website, you may accept or reject the use of cookies or choose which cookies will be used.
You may delete cookies from your device at any time through your web browser settings. In such a case, when you visit the Website again, we will request your consent to the use of cookies again.
Withdrawal of Consent
Where your consent constitutes the legal basis for processing your personal data, you may withdraw such consent at any time, provided that this does not conflict with legal requirements.
If you withdraw your consent, you may not receive full services from us.
Contact
For the exercise of your rights concerning the processing of personal data and for any questions, you may contact us:
at any service center convenient for you, Monday to Friday from 10:00 to 18:00 and Saturday from 10:00 to 14:00;
by calling our hotline Monday to Friday from 09:30 to 18:30 and Saturday from 10:00 to 14:00: (+995 32) 2 50 50 02;
by email: info@mbc.com.ge.
You may also contact the Personal Data Protection Officer: Natia Alania
Tel.: 598 775 189
Email: PersonalOfficer@mbc.com.ge