In the context of conducting its business activities, the Bank ensures that the processing of your personal data is effected in compliance with the following general principles:

• Your data have been collected in an ethical and lawful manner, with your consent where appropriate, for a specific, explicit and legitimate purpose, and are fairly and lawfully processed in line with the said purpose,
• The collected data are relevant to the purpose of the processing, and are sufficient for, and not in excess of, what is required in the context of the purpose of said processing,
• The data are reviewed for accuracy and are regularly updated in line with legally established procedures,
• The data are kept in a form that enables us to determine your identity for the length of time required in respect of the purposes of said processing,
• Adequate security measures are in place to protect your data against risks such as loss, unauthorized access, destruction, unlawful use or disclosure,
• Before the processing of your personal data, you are duly informed and you provide your consent, where required, actively and on a voluntary basis. Your consent can be withdrawn at any time, without of course affecting the lawfulness of processing based on consent before its withdrawal.

Your consent is not required in the following cases:

a) for the performance of a contract you have entered into with NBG;

b) in order to take steps regarding a request you submitted prior to the conclusion of the contract;

c) for compliance with a legal obligation to which NBG as Controller is subject;

d) for the protection of your vital interests;

e) for the performance of a task carried out in the public interest or in the exercise of official authority;

f) when the processing is necessary for the purposes of the legitimate interests pursued by NBG, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. 

NBG collects, maintains and processes the personal data you disclose or have already disclosed to the Bank as potential and/or existing customers and, in general, as persons carrying out businesses with NBG in whatever capacity at all stages of your business relationship in the context of the products /services provided by the Bank or through it, as well as data arising from your bank account statements and/or from previous loans from the banking system. It is noted that the Bank processes only the personal data that are necessary for the purpose, at any given time, of such processing. In particular, NBG may process the following personal data:

Personal data that you provide to us, such as:

• Identification and legalization data (full name, date and place of birth, ID or passport details, national health insurance number (AMKA),
• Demographic data (gender, nationality, family status), contact details (postal address, landline or mobile phone number, email address),
• Financial data (information concerning your salary and property status, tax residence),
• Access data for e-applications (e.g. i-bank login) and electronic identification data (e.g. e-signature),
• Geographical location data, if disclosed through you device (smartphone or tablet), •
• In exceptional cases, data related to your health and standard of living (e.g. in compliance with its obligations for responsible lending).

Note that you are obliged to promptly inform the Bank of any change in the above data. 

Personal data collected by NBG, such as:

• In the context of due diligence, sanctions monitoring and anti-money laundering,
• In the context of monitoring and evaluating your creditworthiness, risk management of the Bank and, in general, serving and supporting your contractual or business relationship with NBG,
• In compliance with the applicable legislative and regulatory framework for the submission of data to the supervisory authorities
• In the context of your correspondence and general communication with the Bank,
• Economic data that provide an estimate of your investment and financial status and behavior,
• Cookies and associated technologies that enable access and use of specific pages and/or website pages for statistical reasons,
• Information supplied by supervisory, judicial and other public and independent authorities, related to criminal convictions, offences, enforcement of measures to protect the public interest, seizures, confiscations, commitments,
• If there are dues in arrears, data of the Bank’s recorded phone communications in order to provide its debtors with information in accordance with the provisions of Law 3758/2009, as amended; when communication of this kind occurs, other persons who are notdebtors may happen to answer the respective calls, but in such cases the Bank does not disclose to them any personal data regarding the debtors.
• Data that concern you and which are publicly accessible online or otherwise.

NBG may process your said personal data, which are collected either upon commencing the business relationship or at a subsequent time, for the following purposes:

A) In the context of the performance of a contract or before its signing, in particular:

i. To confirm the identity of, and verify, your data,

ii. To communicate with you, either in the pre-contractual stage, or about issues related to your business relationship with NBG,

iii. To draw up, conclude and, in general, manage the contract and the fulfilment of the Bank’s obligations towards you, and to service, manage, monitor and process your transactions and, in general, provide effectively the requested product/ service,

iv. To service any kind of transaction via e-banking services (transactions effected through alternative networks),

v. To evaluate the potential for offering a product or service and in particular to assess suitability and compatibility when providing investment and ancillary services, and to provide you with relevant information, to oversee governance and monitoring of investment products, and include you, if possible, in the designated customer target market for such products,

vi. to inform you about any amounts due under Law 3758/2009, as amended.

B) As part of NBG’s compliance with the obligations established by the applicable legislative and regulatory framework, in particular:

i. To prevent and suppress money laundering and terrorism financing, and avert fraud against the Bank and/or its customers, and any other illegal action,

ii. To evaluate your creditworthiness, where required for the ongoing conduct of our business relationship,

iii. To assess compatibility and any other appraisal or categorization of the customer, as appropriate, when setting up or offering a financial instrument or service,

iv. To record and file all the customers’ orders for the performance of transactions on financial instruments, including the obligation to record orders given by phone,

v. To record and keep records of the Bank’s communications by phone carried out in the context of informing its debtors of their overdue debts, as per the provisions of Law 3758/2009, as amended, and in order to monitor the proper implementation of the said Law on behalf of the Bank.

vi. To document your request (such as, for example, a request for debt restructuring by reason of inability to repay the debt for health reasons) and its assessment by the Bank,

vii. To enable the Bank to comply in general with its obligations arising from the legislative and regulatory framework each time applicable (including implementation of current legislation on State aid and tax legislation, as well as the provisions on the automatic exchange of information for tax purposes), and with the decisions of supervisory or judicial authorities,

viii. To disclose and transmit information to the competent supervisory, independent, police, judicial and public authorities, in general, as well as duly authorized third-party legal persons, whenever required in accordance with the applicable legislation,

ix To identify you in the Bank’s capacity as a Registration Authority in order to submit an application to a Qualified Trust Service Provider for the issuance of a qualified certificate, according to Regulation (EU) 910/2014 (eIDAS).

C) In the context of NBG’s lawful and normal operations and the safeguarding of its rights and legal interests, in particular:

i. To develop and/or improve NBG’s products and services in respect of your preferences and general transaction activity,

ii. To resolve any requests/complaints you may file,

iii. To assess, manage and prevent risks in the context of NBG’s operations, including geographical location measures, to prevent and combat money laundering and terrorism financing, in the context of the procedure for remote account opening through the i-bank mobile banking app,

iv. To prevent crimes and identify and collect data on unlawful activities, for the physical security of individuals and property (including the video surveillance system),

v. To transfer, concede (either directly or as collateral) and/or securitize any or all liens, claims, guarantees, privileges, securities under any agreement of the client with NBG, towards any third party(ies),

vii. To pursue its legal claims before judicial authorities or other bodies of out-ofcourt/alternative dispute resolution, and assess and optimize security procedures and IT systems etc.

D) Having obtained your consent as regards the processing of your personal data for one or more purposes, such as:

i. To send you information about new products and/or services offered by NBG and its Group companies, as well as other companies, which are marketed by the Bank and match your interests and preferences. In this case, we inform you that you are entitled to revoke your consent at any time, without of course this affecting the legality of any processing that may have taken place on the basis of the consent prior to its being revoked.

ii. To better understand the way you use and interact with the content of our website, by using cookies.

iii. To improvethe services we provide via our website, so as to better meet your personal needs and choices.

iv. To improve and measure the effectiveness and impact of our advertising displayed on third-party websites.

Note regarding automated decision making, including profile creation:

For the aforesaid purposes, processing of your personal data may also be carried out through automated procedures resulting in decisions based on statistical analyses of those parameters that are deemed necessary for each purpose.

For example, the Bank processes information concerning the services you use and/or the banking transactions that you usually carry out (e.g. tax payment using a credit card) in order to present you with products, services or offers that meet your needs more effectively. In such a case, the Bank requests your explicit consent. In addition, there are cases where automated processing becomes necessary for the purpose of signing or performing the contract, such as for example, setting up a profile so as to be able to monitor and prevent fraud and tax evasion, or ascertaining credit scores based on personal data received directly from you or by means of research in the economic data base of TIRESIAS S.A. and regarding which the criteria taken into consideration shall be the data subject’s income, financial obligations, profession, compliance with his contractual obligations in the context of any previous credit facilities received by him from the Bank or another institution.

Recipients of the data that NBG is obliged or entitled to disclose, by law or regulation or court order or in the context of lawful operation of your contractual relationship with it, may be third parties, whether individuals or legal entities, public authorities, services or other bodies, including:

(a) NBG Group companies, such as, for example: (i) NBG Securities, (ii) NBG Factors, (iii) Ethniki Hellenic General Insurance S.A., (iv) NBG Asset Management, (v) Ethniki Leasing S.A. (vi) PAEGAE, as well as any persons (individuals or legal entities) cooperating with NBG in any form, acting in the name and on behalf of NBG for the purpose of processing the contract (such as Advisors or Associates, subsidiaries or overseas NBG branches),

(b) third parties, individuals or legal entities, acting by order and for the account of the Bank, including the following:

i. Companies notifying debtors and/or guarantors of their debts prior to or after termination and/or the preparatory actions required for out-of-court and judicial pursuit of collection by NBG of their overdue debts in accordance with the provisions of Law 3758/2009, as in force,

ii. Credit servicing firms under Law 4354/2015, as in force

iii. Record keeping and destruction companies,

iv. Contact center services companies,

v. IT supplies and support companies,

vi. Market analysis and research and product marketing companies,

vii. Safekeeping and security companies,

viii. Custodianship Services Companies, ix. Advisory firms,

x. Data reporting providers, xi. Insurance companies and insurance intermediaries in the context of the provision of insurance products,

xii. Property valuers xiii. Data storage providers

(c) Companies to which NBG 's claims are transferred, such as Special Purpose Vehicles, in the context of securitization of receivables and Credit Acquisition Firms under Law 4354/2015, as in force.

(d) National or European institutions in the context of acting alongside NBG for the purpose of provision of credit to those carrying out transactions with NBG.

(e) "Interbanking Systems S.A." ("DIAS SA") for the servicing of interbank transactions, "TIRESIAS SA" for the protection of credit and financial transactions, the Hellenic Deposit and Investment Guarantee Fund, the Hellenic Bank Association, Hellenic Exchanges S.A., and banks and financial institutions in Greece and abroad,

(f) Social security bodies, public institutions, chambers of commerce and public companies,

(g) Credit institutions, payment institutions, electronic money institutions, investment services providers, mutual fund management companies, execution and trading venues, clearing and settlement companies and systems, trade repositories,

(h) Qualified Trust Service Providers in accordance with Regulation (EU) 910/2014 (eIDAS) and any subcontractors thereto (i.e. providers of information support systems and video-identification platforms), in the context of digital customer onboarding through the i-bank mobile banking app or when issuing a qualified certificate through the Bank as a Registration Authority,

(i) Supervisory, judicial, independent and other authorities at national and European level to meet NBG’s obligations under law or regulatory requirement or court judgment, such as: the Bank of Greece, the European Central Bank, the European Commission for Competition, the Hellenic Capital Market Commission, the Hellenic Competition Commission, the US Securities & Exchange Commission (SEC), the Financial and Economic Crime Unit (SDOE), the Financial Police, public authorities in Greece and abroad, courts, public prosecutors, investigators, notaries-public, court bailiffs, mortgage registries, Greek and foreign attorneys-at-law,

(j) Certified Accountants and Auditing Firms,

(k) Cloud Service Providers,

(l) Real estate management or real estate investment companies.

It should be noted that NBG will inform you of any forwarding of your data to the aforesaid recipients, provided that this is required under applicable legislation.

NBG may disclose your personal data to competent supervisory authorities, independent, law enforcement, judicial and other public authorities, where required by the applicable legislative and regulatory framework, on a regular or exceptional basis, upon request or if it is required to report the said data without such prior notification.

It should be noted that when NBG entrusts the processing of personal data to third parties acting in the name and on behalf of NBG, they are under obligation to fully comply with NBG's instructions, while said compliance is ensured by specific provisions in the relevant contractual texts for outsourcing, and in the observance of other relevant procedures.