Republic Bank Data Privacy Statement

Introduction
The safekeeping of your personal information is important to Republic Bank Limited a company registered under the laws of Trinidad and Tobago, situate at 9-17 Park Street, Port-of-Spain, (hereinafter referred to as “we” or “the Bank” and includes its successors and assigns). We are committed to doing what is required within the legal and regulatory framework in which we operate to keep your data secure and confidential. By your information “data” means any data and information about you that you and/or third parties provide to us. This privacy policy explains how the Bank may collect, share, use, and protect information when you visit or use any service offered by the Bank.

Questions, comments and requests regarding this privacy policy should be addressed to email@rfhl.com subject heading Privacy Policy.

Controlling and processing information: We are the controller of all personal information used in our business for our own commercial purposes.

Personal information: In this policy, when we use the term “personal information” we mean personal information as defined in the Data Protection Act Chapter 22:04 (“the DPA”) i.e. information about an identifiable individual that is recorded in any form including those listed in the DPA.

Sensitive personal information: In this policy, when we use the term “sensitive personal information” we mean special categories of personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, physical or mental health, sexual orientation or sexual life or criminal or financial record.

Our website may, from time to time, contain links to and from the websites of partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies or the security of these websites. Please check the relevant policy before you submit any personal information to these websites.

WHAT – Information we hold about you

Personal Information
The personal information we collect will often be shared with us by you directly (e.g. when you apply for a new service or product) this includes but is not limited to the following information:

• Personal details (e.g. name, date of birth, passport information or other identification information);
• Contact details (e.g. phone number, email address, postal address or mobile number);
• Biometric information (e.g. voice recognition when you call our call centres, as well as facial recognition for certain products);
• Transactional details (e.g. payments you make and receive); and
• Information about any other Republic Bank products and services you currently have, you have applied for, or you have previously held.

Sensitive personal information
We may also collect, store and use the following sensitive personal information:

• Financial information (e.g. bank account number, credit or debit card numbers, financial history in order to process applications and other general banking requirements);
• Details about your health and lifestyle (to facilitate requirements related to obtaining insurance for certain types of financing.

If you do not provide personal information that we tell you is mandatory, it may mean that we are unable to provide you with the services and/or perform all of our obligations under our agreement with you.

We will also hold information we collect about you from other sources, this will include:

• The way you are using our branches, telephone services, websites or mobile applications;
• Your interactions with us, for example, through social media or other channels;
• Your digital devices where we perform various checks designed to ascertain and verify your residency. These checks include identifying the IP address your device connects from and the collection of information about your use of the website or mobile app (including device type, operating system, screen resolution, and the way you interact with us);
• The way you use your accounts, including information about payments you make or receive such as the date, amount, currency and the details of the payee or payer (for example, retailers or other individuals);
• Our own records about any other accounts or products you have with us or other providers;
• Publicly available information about you which is available online or otherwise;
• Employers;
• Joint account holders;
• People appointed to act on your behalf;
• Credit reference agencies (who may check the information against other databases – public or private – to which they have access);
• Fraud prevention agencies.

If you give us personal information about other people (such as dependents or joint account holders) which we will use to provide services, or if you ask us to share that information with third parties, for example to provide payment initiation or account information services, then you confirm that you know that they are aware of the information in this notice about how we will use their personal information.

USE – How we use the information we hold
We use the information discussed above in a number of ways:

• Processing applications and transactions;
• In order to provide you with products / services and perform our contract with you, if any, e.g. to make and receive payments;
• Verifying your identity (such as when you access your account information);
• To determine your eligibility for products and services that the Bank offers;
• To help the Bank better understand the current and future needs of our customers;
• To communicate to you any benefit, feature and other information about products and services you have with the Bank;
• To improve the efficiency of the Electronic Banking Services;
• Responding to your requests and communicating with you;
• Managing your preferences;
• Performing analytics concerning your use of our Electronic Banking Services, including your responses to our emails and the pages and advertisements you view;
• Providing you tailored content and marketing messages;
• Operating, evaluating and improving our business (including developing new products and services; improving existing products and services; performing data analytics; and performing accounting, auditing and other internal functions);
• Complying with and enforcing applicable legal requirements, relevant industry standards, contractual obligations and our policies for example, obtaining proof of identity to enable us to meet our anti-money laundering obligations; and
• For any other purposes that we may specifically disclose at the time you provide or we collect your information.

We may process the following sensitive personal information about an individual in the following circumstances:

• Financial information records for opening deposit accounts and credit facilities (to meet our regulatory obligations, including responsible lending e.g. bank account number, credit or debit card numbers, financial history, source of funds).
• Details about your health and lifestyle (to facilitate requirements related to obtaining insurance for certain types of financing.

Direct Marketing and Data Mapping
If you have visited our website and/or social media pages, we may sometimes use the personal information you have provided to assess usage patterns and provide you with advertising we believe may be of interest to you.

Other issues about how we use personal information:

• Please note that we may process your personal information for more than one lawful basis depending on the specific purpose for which we are using your data.
• We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
• Please note that we may process your personal information without your knowledge or consent where required or permitted by law.
• We may collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal information but is not considered “personal information” in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this privacy policy.

SHARE – Who we share this information with
The information about you collected by Republic Bank shall not be disclosed for purposes other than those stated above without your prior consent PROVIDED HOWEVER that we may share information in the following circumstances:

• Republic Bank Limited is owned by Republic Financial Holdings Limited (RFHL), so we work closely with other businesses and companies that fall under the RFHL Group family. We may share certain information with other RFHL Group companies for example, to provide you with products or services, for marketing purposes, for internal reporting and where those companies provide services to us. Related to this we may also make this information available to the Bank’s employees, agents and service providers and others who are required to maintain the confidentiality of this information.
• Independent third-party service providers who you (or a third party properly authorised to give instructions on your account) ask us to share information with, for example, payment initiation or account information services. If such information is shared with these third parties, we will have no control over how that information is used. You (or the person(s) with authority over your account) will need to agree the scope of such use directly with the third party.
• With other financial institutions (e.g. correspondent banks) or persons with whom you have or may have financial and other business dealings, wherever located;
• With credit reporting agencies;
• Upon your request and with your consent, the Bank may give this information to other persons;
• With regulatory bodies and public authorities to the extent required by law.

We may also disclose personal information we hold to third parties if we are under a duty to disclose or share an individual’s personal information in order to comply with any legal obligation, or in order to enforce or apply any contract with that individual or other agreements; or to protect our rights, property, or safety of our employees, customers or others. This includes exchanging personal information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Safeguards: If we use a third party data processor to process personal information on our behalf, we will obtain contractual commitments to safeguard the security of the personal information to ensure that the third party only acts on our instructions when using that personal information and that the third party has in place appropriate technical and organisational security measures to safeguard the personal information.

Direct Marketing
As indicated above, we may use your personal information to provide you with information about services that may be of interest to you and we may contact you about these by email, text message, post or telephone call. This is known as direct marketing.
Examples of direct marketing may include:

• sending promotional emails about new products, special offers, customer events or other information which we think you may find useful or interesting using the email address which you have provided;
• contacting you for market research purposes (by email, text message, post or telephone call).

We may also disclose your information to third parties (including our subsidiaries, our ultimate holding company and its subsidiaries) for required reporting throughout the Group, marketing and any other purpose which would enable us to serve better serve your needs.

Your Rights
You have certain rights regarding your personal information, subject to applicable legislation. These include the following rights to:

• Request that we supply you (or a nominated third party) with an electronic copy of the personal information that you have provided us with (Note that this right only applies to automated information which you initially provided consent for us to use);
• Inform us of a correction to your personal information;
• Object to particular ways in which we are using your personal information (subject to certain rights we may have to override this request).

Your ability to exercise these rights will depend on a number of factors and in some instances, we will not be able to comply with your request e.g. because we have legitimate grounds for not doing so or where the right doesn’t apply to the particular data we hold on you. Please contact us to update or correct your information if it changes or if the personal information, we hold about you is inaccurate. We may modify or update this privacy notice from time to time.

Retention of Data
We will keep your personal information for as long as we have a relationship with you and/or as long as we are legally required to do so. We will only retain information that enables us to:

• Maintain business records for analysis and/or audit purposes;
• Comply with record retention requirements under the law (for example, as required under banking legislation and/or legislation concerning the prevention, detection and investigation of money laundering and terrorist financing);
• Defend or bring any existing or potential legal claims;
• Maintain records of anyone who does not want to receive marketing from us;
• Deal with any future complaints regarding the services we have delivered;
• Assist with fraud monitoring; or
• Assess the effectiveness of marketing that we may have sent you.

We will take all reasonable steps to destroy, or erase from our systems, all data which is no longer required. To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of personal information, the purposes for which we process information and whether we can achieve those purposes through other means, and the applicable legal requirements.

The retention period is guided by governing regulations, and the Bank’s retention period is set as seven (7) years, following the end of the business relationship or, in the case of a one-off transaction, from the date of completion of that transaction. We will retain your personal information after this time if we are required to do so to comply with the law, if there are outstanding claims or complaints that will reasonably require your personal information to be retained, or for regulatory or technical reasons. If we do, we will continue to maintain privacy of same.

We may sometimes anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further reference or notice to you.

Changes to the privacy notice

• A copy of this privacy notice can be accessed on our website, www.republictt.com. We may modify or update this privacy notice from time to time.
• Where changes to this privacy notice will have anything other than a minor impact on the nature of the processing, or otherwise substantially affect you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights.

Cookies
Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and allows us to improve our website.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer or device if you agree. Cookies contain information that is transferred to your computer or device. We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and any advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you block cookies you may not be able to access all or parts of our website.