The following information is intended to provide you with an overview of how your data is processed by HBZ Bank Ltd (‘HBZ Bank’) and your rights under data privacy laws. The specifics of what data will be processed and which methods will be used depend significantly on the services applied for or agreed upon. We therefore ask you to familiarise yourself with this Data Privacy Notice.

Who is Responsible for Data Processing and How Can I Contact Them?

The legal entity responsible is:
HBZ Bank Ltd
Umhlanga Arch, Level 4 1 Ncondo Place,
Umhlanga Ridge, 4320
Kwa-Zulu Natal, South Africa

Our Information Officer can be reached at:
Phone: +27 31 269 4528
Email: compliance@hbzbank.co.za

What Data Does HBZ Bank Limited Use?

HBZ Bank Limited processes data that it receives from its clients and generates as part of its business relationships. To facilitate, enable, and/or maintain these relationships, HBZ Bank Limited collects and processes personal data relating to clients and any other persons involved in the business relationships, such as authorised representatives, persons holding powers of attorney, and beneficial owners, if different from the client (collectively, an ‘Authorised Person’).

Personal data refers to the personal information of clients or Authorised Persons, including identification and authentication data. This can also encompass order data, data from the fulfilment of contractual obligations, information about the financial situations of clients or Authorised Persons, marketing data, sales data, and/or documentation data.

In addition to data received directly from clients, HBZ Bank Limited also obtains and processes data on its clients available in the public domain or from other entities within the Habib Bank AG Zurich Group of companies (the ‘Habib Bank Group’).

In summary, personal data processed by HBZ Bank may include the following:

• Personal details (e.g., name, address, contact details, date and place of birth, nationality)
• Identification data (e.g., identification documentation)
• Authentication data (e.g., specimen signature)
• Order data (e.g., payment orders)
• Data arising from the fulfilment of obligations (e.g., data required for payment transactions)
• Information regarding clients’ financial situations (e.g., credit reports, scoring/rating data, origin of assets)
• Record-keeping data (e.g., minutes of consultation)
• Data available from the public domain (e.g., internet, social media, debtor directories, land registers, trade association registers, media, etc.)
• Other comparable data in line with the criteria outlined above

For What Purpose, and on What Legal Basis, Does Habib Bank Use Your Data?

For the Fulfilment of Contractual Obligations

The processing of your data allows HBZ Bank Limited to provide the contractually agreed services or carry out pre-contractual measures that arise from a request by an interested party. The purposes of data processing are linked to specific banking products (e.g., accounts, loans, securities, deposits). Your data will be used, among other things, for the analysis of potential needs, providing advice, and supporting the execution of transactions.

Further details can be found in your contract documents or the General Terms & Conditions.

For the Safeguarding of HBZ Bank Limited’s and Third-Party Interests

Where required, we process your data beyond the fulfilment of the contract to pursue the legitimate interests of HBZ Bank Limited or a third party. For example:

• Consulting with credit rating agencies to assess creditworthiness and risks
• Reviewing and optimising procedures for needs assessment to facilitate direct client discussions
• Obtaining personal data from publicly available sources for client acquisition purposes
• Testing and optimising processes for requirement analysis or client contact
• Measures for business management and the further development of services and products
• Risk control at HBZ Bank Limited and Habib Bank Group
• Asserting legal claims and defending in legal disputes
• Ensuring IT security and IT operations for the Habib Bank Group
• Prevention and investigation of crimes
• Video surveillance and measures to protect the rights of an owner of premises to keep out trespassers and to provide security (e.g. access controls)

On the Basis of Your Consent

If you have granted us consent to process your personal data for specific purposes (e.g., analysis of trading activities for marketing purposes), this processing is based on your consent. Consent may be withdrawn at any time.

Withdrawal of consent does not affect the legality of data processed before the withdrawal.

On the Basis of Statutory Requirements or in the Public Interest

HBZ Bank Limited is subject to various legal obligations, meaning statutory requirements. We process data to fulfil requirements outlined by specific banking regulations, including the verification of creditworthiness, identity and age, prevention of fraud and money laundering, fulfilment of tax-related monitoring and reporting obligations, and risk assessment for HBZ Bank Limited and the Habib Bank Group.

Who Can Access Your Data?

Habib Bank Group

We may share your data with other entities in the Habib Bank Group where required to fulfil our contractual and legal obligations. We may transfer your personal data to other members of the Habib Bank Group for risk control purposes in connection with statutory / regulatory obligations. We may also share information with other members of the Habib Bank Group in connection with services that we believe may be of interest to you.

External Recipients Of Data

We may transfer personal data to external recipients in the course of conducting our usual business or where legal, regulatory, or market practice requirements demand it. This includes:

• Public entities and institutions (e.g., financial authorities, law enforcement agencies)
• Other credit and financial services institutions (e.g., correspondent banks, brokers)
• Third parties (e.g., correspondent banks, exchanges, trade repositories) to comply with legal requirements, contractual provisions, and market practices
• Entities for which you have granted consent to transfer personal data or where you have released us from banking confidentiality

Service Providers And Agents

We may transfer your personal data to service providers and agents for the purposes specified, subject to maintaining banking confidentiality. These include companies in banking services, IT, logistics, printing, telecommunications, collection, advice and consulting, and marketing.

HBZ Bank Limited will implement appropriate organisational and technical safeguards to protect personal data at all times.

Does HBZ Bank Limited Transfer Data Across Borders?

Data transfer to legal entities outside of South Africa occurs when necessary to manage the working relationship, where there is a legitimate interest, if required by law (e.g., reporting obligations under financial regulations), or if you have given your consent.

We may also share your personal information with other entities in the Habib Bank Group:

• As part of our regular reporting activities
• In the context of a business reorganisation or Group restructuring
• For system maintenance support
• For data hosting purposes

These data transfers are secured through corresponding guarantees to ensure an appropriate level of data protection.

How Long Will Your Data Be Stored?

We generally retain your records for a minimum of ten years to comply with regulatory and contractual requirements, unless there is a reason to keep records for longer, such as legal hold requirements.

We process and store your information for as long as necessary to fulfil our contractual, regulatory, and statutory obligations. Please note that our business relationship is long-term and typically spans several years.

We will assess requests to delete data and delete it when no longer required to fulfil contractual, regulatory, or statutory obligations.

What Are Your Rights?

Your data protection rights include the following:

• Right of Access: Requesting information on the personal data HBZ Bank Limited holds on record
• Right to Rectification: Requesting the correction of incorrect data
• Right to Deletion/Erasure: Asking for data to be deleted if HBZ Bank Limited is not legally obliged to retain it
• Right to Restrict Processing: Requesting restricted processing if the data is disputed or if you object to processing
• Right to Object: Objecting to data processing based on legitimate interests
• Right to Data Portability: Requesting the transfer of personal data to another organisation in a machine-readable format

You also have the right of appeal to the relevant Data Protection Supervisory Authority.

What Data are You Asked to Supply?

In the context of your relationship with HBZ Bank Limited, you must provide all personal data required for:

• Accepting and carrying out a business relationship and fulfilling accompanying contractual obligations
• Data required by law to be collected by HBZ Bank Limited

Without this data, HBZ Bank Limited will likely be unable to enter into a contractual relationship with you.

Under anti-money laundering regulations, HBZ Bank Limited is obligated to verify your identity using identification documents and collect specific information (e.g., name, address, nationality, etc.) before commencing a business relationship. If any of this information changes, you must notify HBZ Bank Limited without delay.

Is The Decision-Making Automated?

No. HBZ Bank Limited does not use automated decision-making.

Will Cookies Be Collected?

Yes. HBZ Bank Limited does collect cookies.

What Are Cookies?

Cookies are information packages sent by a web server (in this case this website) to your internet browser, saved on your computer and checked by the server on each subsequent visit to the website. To gain full benefit from this website, we recommend that you configure your browsers to accept cookies.

Why Do We Use Them?

Cookies are used to facilitate navigation within the website and ensure correct usage of the website. They also serve a statistical purpose, making it possible to establish which areas of the website have been visited, and to improve and update user procedures.

Type Of Cookies Used

For further information about the types of cookies used please refer to “Cookies Notice” on our website.

How Should I Manage My Settings with Respect to Cookies?

TTo optimally use our website, we recommend that you accept the cookies. Most internet browsers are initially set to accept cookies. You can at any time set your browser to accept all cookies, just some cookies or no cookies. In the latter case, you would disable use of part of the websites. Additionally, you can set your preferences in the browser so that you will be notified whenever a cookie is saved on your device. Please note that if you disable the cookies, you may not be able to use the website optimally.

Will Your Data Be Automatically Processed?

We process some of your data automatically, with the goal of assessing certain personal aspects (profiling). For example, we may use profiling in the following ways:

• In order to combat money laundering, the financing of terrorism, and criminal acts, HBZ Bank Limited also conducts data assessments (among others in payment transactions). The aim of these measures is to protect you
• HBZ Bank Limited uses assessment tools to provide clients with relevant and appropriate information on its products and services. These allow communications and marketing to be tailored, as needed, including market and opinion research
• HBZ Bank Limited uses assessment tools in order to be able to specifically notify you and advise you regarding products. These allow communications and marketing to be tailored as needed, including market and opinion research

Will Biometric Data Be Used?

No. HBZ Bank Limited does not collect biometric data..

Where Can You Find The Current Privacy Notices?

This Data Privacy Notice can be adapted at any time in accordance with corresponding regulations. You can find the applicable version at www.hbzbank.co.za

How Can You Contact Habib Bank?

Should you have any questions about the treatment of your data, please contact your Branch Manager or HBZ Bank Limited’s Privacy Officer under the email- address provided in this notice, and they will be happy to assist you.