Security Personal Data Protection

THE ORDER AND PROCEDURE FOR THE PERSONAL DATA PROTECTION IN MTB BANK PJSC

PUBLIC JOINT STOCK COMPANY "MTB BANK" (hereinafter - the ‘Bank’), in accordance with the Law of Ukraine "On Personal Data Protection", informs on the rights of personal data subjects, the personal data processing and the procedure for protecting personal data.

The Bank ensures the personal data processing and protection comply with requirements of the Constitution of Ukraine, the Laws of Ukraine "On Personal Data Protection", "On Banks and Banking Activities", "On Prevention and Counteraction to Legalization (Laundering) of the Proceeds of Crime or Terrorist Financing and Financing Proliferation of Weapons of Mass Destruction", other laws and regulations of Ukraine.

The Bank processes the personal data of its customers, counterparties, employees, shareholders, related persons, as well as other individuals whose data the Bank receives when carrying out banking activities, providing financial services and performing other activities in accordance with the Bank's Charter and the legislation of Ukraine.

The personal data subject is an individual whose personal data is processed.

The owner of personal data is the PUBLIC JOINT STOCK COMPANY "MTB BANK", the identification code of the legal entity according to EDRPOU 21650966, location: Ukraine, 68003, Odessa region, city of Chernomorsk, 28, Prospect Mira.

Tel.: 0-800-500-255, for other countries: +38 (0482) 305-905.

Email address: office@mtb.ua

Website: https://mtb.ua

The address for sending requests to access personal data, as well as for other questions regarding the personal data processing in the Bank: Ukraine, 65026, Odessa region, city Odessa, 11, Polskyi spusk, or by e-mail: office@mtb.ua

Confidential information about an individual includes, in particular, data on his/her nationality, education, marital status, religious beliefs, health status, as well as address, date and place of birth.

The list of personal data processed by the Bank:

• last name, first name, patronymic (if any);
• the taxpayer ID registration card number (if available) or data on refusal to receive such a number;
• passport data (including civil and foreign passports, permanent or temporary residence permit and other identity documents);
• citizenship (partiality) or lack of relation to citizenship (partiality);
• residency;
• sample of a personal signature;
• data on the registration of the subject as an individual engaged in the independent professional activity, or an individual entrepreneur;
• data on registration as a payer of taxes and fees, in cases provided for by the current legislation;
• age;

* gender,

• date and place of birth;
• place of permanent residence or temporary stay, period of residence;
• the place of residence / stay and the address of the actual place of residence / stay;
• property status;
• phone number;
• email address;
• details of the document on registration as a payer of taxes and fees in cases provided for by the current legislation;
• details of licenses, certificates, and other permits issued to the personal data subject, except for information that is open in accordance with the current legislation;
• social status;
• marital status;
• family composition and number of dependents, surnames, first names, patronymics (if any) of such persons, their gender, age, date of birth, place of registration and residence, contact details;
• contact persons (surnames, first names, patronymics (if any) of such persons, their date of birth, place of residence / stay and address of actual residence, phone numbers, e-mail address);
• profession, place of employment;
• current positions;
• images (photos, videos) and sound records;
• the amount of income;
• bank account details;
• bank payment card details;
• details of electronic wallets with electronic money;
• valuable property owned (jointly owned) by the subject, its characteristics and registration data;
• deposits and account balances;
• size of the share in the capitals of legal entities, related and affiliated persons, information on the number and details of securities owned by the subject;
• electronic identification data (cookies, IP addresses, parameters and settings of Internet browsers, login and password, etc.);
• other personal data necessary for the implementation of labor and other relationships in accordance with the legislation of Ukraine;
• data required by the legislation in the field of financial monitoring, except for those listed above;
• other information, the purpose of processing of which coincides with the purpose of the personal data processing.

Comply with Article 8 of the Law of Ukraine "On Personal Data Protection", a personal data subject has the right to:

1. know about the sources of collection, location of their personal data, the purpose of their processing, the location or place of residence (stay) of the owner or manager of personal data, or to give an appropriate order to obtain this information to persons authorized by him/her, except in cases established by law;
2. receive information on the conditions for granting access to personal data, in particular, information about third parties to whom his/her personal data is transferred;
3. access to own personal data;
4. receive, no later than thirty calendar days from the date of receiving the request, except in cases provided for by law, a response on whether his/her personal data is being processed, as well as to receive the content of such personal data;
5. submit a reasoned request to the owner of personal data with an objection against the processing of his/her personal data;
6. make a reasoned request to change or destroy his/her personal data to any owners and managers of personal data, if this data is processed illegally or is unreliable;
7. protect his/her personal data from illegal processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision of them, as well as to protect against the provision of information that is unreliable or discrediting the honor, dignity and business reputation of an individual;
8. file complaints about the processing of his/her personal data to the Commissioner of the Verkhovna Rada of Ukraine for Human Rights or to the court;
9. apply legal remedies in case of violation of the legislation on personal data protection;
10. make qualifications on the restriction of the right to process his/her personal data when providing consent;
11. withdraw consent to the personal data processing;
12. know the mechanism of automatic personal data processing;
13. protection against an automated solution that has legal consequences for him/her.

Personal non-property rights to personal data that every individual possesses are inalienable and inviolable.

The personal data subject has the right to receive any information about him/herself from any subject of relations related to personal data, provided that the personal data subject indicates in the submitted request as follows: surname, first name and patronymic, place of residence (location) and details of the document certifying the individual who submits the request, except in cases established by law. The personal data subject's access to personal data is free.