Bank of Baroda: Privacy Notice
(Effective from and including 28 February 2022)
Our contact details
Bank of Baroda is a company incorporated under the Banking Regulation Act 1969 of India and located at our Head Office, Mandvi, Baroda 390 006, India. We have a branch in the United Kingdom (UK) under establishment number BR002014 (“BOB UK”, “Us” or “We”). Our branch address is 32 City Road, London, EC1Y 2BD.
You can reach our Data Protection Officer (DPO) using the contact details below:
Mr Theyagarajan Natarajan, Data Protection Officer, Bank of Baroda (Wholesale Banking), 32 City Road, London, United Kingdom, EC1Y 2BD
Phone: +44 (0) 20 7448 1528
The Data Protection Act 2018 (“DPA”) which is the UK's implementation of the General Data Protection Regulation (GDPR) mainly applies to personal data about individuals and not data about companies or any other legal entities.
However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable, and the information relates to them as an individual may constitute personal data.
BOB UK takes protecting personal data seriously. We may collect some personal data to help deliver our services and to communicate with you our client.
This Privacy Notice provides anyone whose personal data we may collect with important information such as:
- confirming that BOB UK acts as a data controller;
- how to contact our DPO; and
- the purposes for which BOB UK collect, use, share and retain your personal data defined under the DPA as any information relating to an identifiable natural person.
We will inform you in this Privacy Notice of:
- why we process any personal data;
- what purpose we are processing it for;
- how long we store it for;
- other recipients; and
- any transfer of personal data to another country.
We are committed to protecting and keeping any personal data private - whether we receive it from our client’s directly or from third parties - and we will take all reasonable steps to ensure its security.
We keep this privacy notice up to date, so if there are any changes to the way in which personal data is used this privacy notice will be updated and we will notify our clients of the changes.
Employees of BOB UK should read the relevant Privacy Notice for Employees.
Personal data only relates to natural persons who:
- can be identified or who are identifiable, directly from the information in question; or
- who can be indirectly identified from that information in combination with other information.
Special category data is a type of personal data that needs more protection because it is sensitive.
We may collect special category data where we or your company has identified someone as vulnerable.
We may collect personal data from various sources including:
- during our relationship with you; or
- from other third parties when we carry out due diligence checks or ongoing monitoring – if we do this, we will inform you of the exact checks that are carried out.
Table 1. categories of information we may collect about individuals in the course of our relationship with you our client (not exhaustive):
|We may collect the following information directly from you|
|Title, First, Middle and Last Names of individuals|
|Contact information for individuals|
|Geographical location data as it relates to identifiable individuals|
|An individual’s position in a company|
|An individual’s language preferences|
|Personal data related to ultimate beneficial ownership (UBO) or beneficial ownership (BO) information provided under Know Your Business (KYB) processes|
|Details of public position held if by any identified Politically Exposed Person (PEP)|
|Details of any identified Sanctioned individual.|
|We may collect the following information from third parties|
|Persons of significant control information|
|For internal administration purposes|
|For quality, business analysis, training, and related purposes in order to improve our service delivery, as well as for promotional purposes|
|For protecting or defending our assets and interests, as well as the interests and assets of our affiliates, including in the context of the establishment, exercise or defence of a legal claim.|
|For complying with our legal and regulatory and contractual obligations for example tax information reporting, money laundering and terrorist financing laws and sanctions screening.|
We will ensure we have a lawful basis for relying on processing any personal data. For example, where we must:
- process personal data in relation to the performance of our contractual obligations with you;
- process personal data in compliance with our legal obligations; and
- process personal data for our legitimate interests. For example to ensure the proper administration and management of our products and services.
BOB UK is a Data controller in the UK which is a legal term under the DPA.
We are registered with the Information Commissioner’s Office (“ICO”) in the United Kingdom (“UK”) as a data controller under registration number: Z4631489.
As a data controller we will:
- decides how and why any personal data is collected and processed;
- decides what the purpose or outcome of any processing is;
- decides what personal data should be collected;
- decides which individuals we collect personal data about (for example UBOs); and
- make decisions about our clients as part of or as a result of any processing of personal data.
We exercise professional judgement in the processing of any personal data and as a data controller we have complete autonomy as to how any relevant personal data is processed.
If for any reason we require special category data during our relationship with you as our client, and for any reason we require explicit consent in relation to special category data then we will contact your representatives.
We have in place appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of any personal data. We are responsible for preventing unauthorised processing or unauthorised interference with the systems used in connection with it.
We also ensure that any systems used in connection with the processing of your personal data functions properly and may, in the case of interruption, be restored.
As a general rule we may keep personal data for the duration of our relationship with our clients.
Where we have statutory obligations to keep personal data for a longer period or where we may need personal data for a longer period in case of a legal claim, then the retention period may be longer.
Money Laundering and Data Protection laws:
The Fifth Money Laundering Directive (5MLD) came into force in the UK on 10th January 2020. The 5MLD, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (together, the MLRs) require us to collect and retain significant amounts of personal data for example in relation to performing KYB checks.
We will retain any related personal data for as long as necessary under the UK's MLRs which for in the majority of cases will be for a period of 5 years from the end of a client relationship.
After we are no longer required to store personal data as it relates to our relationship with you our client then it will be destroyed using permanent erasure solutions such as overwriting or degaussing.
We need some personal data so that we can comply with our legal and regulatory obligations.
Example: we may need some personal data from you so that we can comply with our legal and regulatory requirements to carry out KYB checks or sanction screening before we can offer our products and services.
We may share personal data with:
- Bank of Baroda Corporate Office, Mumbai, India; and
- our Parent, Bank of Baroda, Head Office, Mandvi, Baroda 390 006, India.
We may share personal data with the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) when we have a duty to do so.
We may share personal data with UK law enforcement authorities (known under data protection law as “competent authorities”) who are discharging their statutory law enforcement functions. We must be satisfied that sharing personal data with a law enforcement authority is lawful. This means we must have a lawful basis under Article 6 of the UK GDPR before we share any personal data as it relates to our relationship with you.
In some circumstances we may have legal obligations to report suspected criminal activities to relevant authorities. This includes where we suspect money laundering or other criminal activities.
We will disclose personal data when it is necessary to do so to protect the Bank's interests or to pursue a legal claim.
There might be a legitimate interest to share the personal data of an individual working for one of our clients if they are suspected of an offence. This is to ensure a law enforcement authority has all the necessary information for a proper and fair investigation.
We may share any relevant personal data with fraud prevention agencies. If you provide us with false or inaccurate information and fraud is identified, we will pass details of the fraud to prevention agencies.
If we sell any part of our business and/or integrate it with another organisation any relevant personal data may be disclosed to our advisers and to prospective purchasers or joint venture partners and their advisers. If this occurs the new owners of the business will only be permitted to use any relevant personal data in the same or similar way as set out in this privacy notice.
Where we share any relevant personal data with third parties, we ensure that we have appropriate measures in place to safeguard personal data and to ensure that it is solely used for legitimate purposes.
When personal data is transferred to countries outside of the UK those countries may not offer an equivalent level of protection for personal data to the laws in the UK.
UK DPA provides for safeguards for when we transfer any personal dataabroad or make it available to persons overseas. If the recipient is in the EEA or a country deemed to be “adequate” then no further safeguards will be needed.
We rely on Standard Contractual Clauses (SCCs) when transferring personal data outside the UK to India. The UK Government have ruled that SCCs are acceptable methods to transfer your data out of the UK.
Under the UK’s DPA individuals have certain rights that may include:
- Right of access: the right to ask us for copies of personal data we retain;
- Right to rectification: the right to ask us to rectify personal data an individual thinks is inaccurate. Includes the right to ask us to complete data an individual thinks is incomplete.
- Right to erasure: an individual has the right to ask us to erase personal data in certain circumstances;
- Right to restriction of processing: an individual may have the right to ask us to restrict the processing of personal data in certain circumstances;
- Right to object to processing: an individual may have the right to object to the processing of personal data in certain circumstances; and
- Right to data portability: you have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances:
Individuals are not required to pay any charge for exercising their rights under law. If an individual makes a request, we have one month to respond.
An exemption can apply if we process personal data in connection with a corporate finance service that we are permitted to provide (as set out in the Financial Services and Markets Act 2000).
It exempts an individual from the UK GDPR’s provisions on:
- the right to be informed;
- the right of access; and
- all the principles, but only so far as they relate to the right to be informed and the right of access.
The exemption only applies to the extent that complying with the provisions above would:
- be likely to affect the price of an instrument; or
- have a prejudicial effect on the orderly functioning of financial markets (or the efficient allocation
capital within the economy), and we reasonably believe that complying with the provisions above could
affect someone’s decision whether to:
- deal in, subscribe for or issue a financial instrument, or
- act in a way likely to have an effect on a business activity (e.g. an effect on an the legal or beneficial ownership of a business or asset or a person’s industrial strategy).
Individuals may have the right to ask us whether or not we are using or storing personal data. If this right does apply them, please ask us for copies of personal data held and process either verbally or in writing.
SARs are useful if you wish to find out:
- what personal data we hold about you;
- how we are using it;
- who we are sharing it with; and
- where we got your data from.
The UK Information Commissioner's Office (ICO) recommends that you put a SAR in writing if possible because this gives you a record of your request.
Please call us or email us with the following information prepared beforehand:
- title, first, middle and last names (including any aliases, if relevant);
- the company you work for;
- up to date contact details for you such as email and best contact number;
- a comprehensive list of what personal data you want to access, based on what you need (for example if you require data relating to a specific period then please state this clearly);
- any details, relevant dates, or search criteria that will help us identify what you want; and
- how you would like to receive the information (e.g., by email or printed out).
Please avoid: (1) including other information such as a corporate complaint (2) threatening or offensive language.
Please email us at: firstname.lastname@example.org. Important: please place the following in the subject line of your email - Subject Access Request alongside your first and last name and the date of your request (DD/MM/YYYY).
We will respond to our SAR within one calendar month.
If you have any complaints about how we use your personal data, please contact us using the contact details provided within this Privacy Notice.
If we cannot resolve your complaint, you have the right to complain to the Information Commissioner’s Officer (ICO) in the United Kingdom.
The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk