This Privacy Notice (the “Notice”) describes how we use the personal data of individuals whose loans, mortgages or other credits are owned by Iris Hellas Investments Designated Activity Company (DAC) and of any associated guarantors / 3rd parties tied to such loans/ credits e.g. owner of collaterals if not the same person with the debtors, guardian of a minor, legal representatives, and beneficial owners of corporations etc. It explains how Iris Hellas Investments DAC (Iris Hellas Investments DAC, we, us and our) collect and process personal data about you; how we use and protect this data; and the rights you may have in relation to this data.
Iris Hellas Investments DAC is the Data Controller of the processing of all personal data that falls within the scope of this Notice. This Notice indicates what personal data is processed by us and for what purpose, and to which persons or entities the data will or may be provided. We may share your personal data with third parties.
Iris Hellas Investments DAC has assigned QQUANT MASTER SERVICER MONOPROSOPI A.E.D.A.D.P. (QQuant) with the servicing of your credit account and the management of your outstanding debts. We and QQuant are each Independent Controllers of your personal data. To find out more about how QQuant may use your personal data please refer to QQuant’s “Personal Data Protection Policy” at https://www.qquant.gr/en/personal-data-protection-policy .
If you have any questions, feel free to get in touch via one of the methods set out in the ‘Contact us’ section below.
1. WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?
We may collect the following types of personal data about you:
- Identification information: such as name (including name prefix or title), gender, age, date of birth, proof of identification (such as national ID, driving license or passport).
- Contact information: such as email address, residential address or phone number.
- Personal circumstances and financial information: including employment status and details, bank statements, social security number, tax information/tax ID, payment card details, savings, debts such as loans and credit cards, income and expenditure, employer and pension benefits, and other assets.
- Lifestyle and personal circumstance information: including any information you or a co-borrower provides to us regarding your family, lifestyle and other circumstances, as relevant to the administration of your account.
- Interactions with us or our representatives: including notes of any interaction that our servicers have with you in relation to the administration of your loan, mortgage or other financial/credit product.
- Special categories of personal data: such as disclosures by you about health information or criminal background.
- Information from third parties: including credit references.
2. WHY DO WE USE YOUR PERSONAL DATA?
We may use your personal data for the following purposes:
- to collect debts and any related activities
- to identify you and to verify your information as part of our efforts to prevent money laundering, terrorist financing, tax avoidance and/or fraud;
- to assess and respond to your enquiries and requests (if any);
- to assess any application to vary our security or for an alternative repayment arrangement where you find yourself in financial difficulty;
- to assess affordability and suitability for the provision of credit throughout our relationship with you, including analysing your credit data for regulatory reporting
- to administer your account and to manage our business relationship with you;
- to administer your account, including processing payments and managing fees and payment collection;
- to meet contractual obligations that we have to third parties in connection with the administration of your account;
- to prevent imminent and serious harm to a person or property;
- to respond to queries raised by regulatory authorities, law enforcement and/or other government agencies;
- to deliver mandatory communications as required by legislation or regulations;
- to perform aggregated analysis of psedonymised or anonymous data;
- to investigate and resolve complaints; and
- to comply with relevant law, regulation or other requirements.
3. FROM WHICH SOURCES DO WE OBTAIN YOUR DATA?
Where your loan, mortgage or other financial product has been transferred to us from another lender/originator/legal successor, we have obtained your personal data and account data from that lender/originator/legal successor.
Where you have taken a loan, mortgage or other financial product jointly with another person, we may have obtained your personal data from a co-borrower. We also sometimes obtain personal data from the following third parties with whom we work:
- asset managers, servicers, field agents and law or property receivers;
- our solicitors;
- credit reference agencies;
- fraud prevention agencies; and
- law enforcement agencies or state agencies.
In addition, we also may collect data about you from public data sources.
4. ON WHAT LEGAL BASIS DO WE USE YOUR PERSONAL DATA?
We use your personal data on the following basis:
- because it is necessary to manage, perform and fulfil our contract with you;
- for the legitimate business interests of Iris Hellas Investments DAC and others including our affiliates, including:
- to manage our relationship with you;
- to carry out reviews, analysis and reporting activities for the purposes of strategic business decision-making and internal governance compliance;
- to monitor and manage our internal business processes;
- to ensure business continuity and disaster recovery and to respond to incidents and emergencies;
- to undertake systems testing; and
- to analyse complaints for the purposes of preventing errors and process failures;
- to comply with certain legal and regulatory obligations of Iris Hellas Investments DAC; and
- if applicable, because you have consented to the processing of your personal information.
Please note that any failure to provide any personal information we require in order to administer your account you may result in us being unable to meet our contractual obligations, which may jeopardise your loan, mortgage or other financial or credit product.
5. WITH WHOM MAY WE SHARE YOUR PERSONAL DATA?
5.1 Access to your personal data within Iris Hellas Investments DAC and its affiliates.
Iris Hellas Investments DAC’s employees and representatives are authorised to access personal data only to the extent necessary to serve the applicable purpose and to perform their duties.
We may also share your personal data with and, where appropriate, transfer it to our group companies and affiliates and their representatives.
5.2 Access to your personal data by third parties
The following third parties may have access to your personal data, where relevant:
- financial organisations: including finance providers and insurance companies;
- service providers who perform services on our behalf: such as servicers, asset managers, valuers, estate agents, print providers, document storage providers, IT suppliers, providers of analytical services, and fraud prevention agencies;
- professional advisers: including our lawyers, accountants, auditors, receivers and business consultants.
- regulators and law enforcement agencies;
- joint borrowers and guarantors on your account and third parties with whom you have authorised us to communicate;
- prospective and actual purchasers, assignees and other parties with an interest in your loan, mortgage or financial or credit product in the event that Iris Hellas Investments DAC, its assets or an interest in such assets may be or are sold, transferred or assigned in whole or in part, including as part of a securitisation, funding or co-investment arrangement; and
- any other parties Iris Hellas Investments DAC reasonably thinks customary, necessary or advisable for the processing purposes described in this notice and in any other way which does not identify you individually (including as part of an aggregated or anonymised dataset).
When third parties are given access to your personal data, we will take the required contractual, technical and organisational measures to ensure that your personal data is only processed to the extent that such processing is necessary.
6. ANY TRANSFER OF YOUR PERSONAL DATA OUTSIDE EU/EEA?
We may send your personal data to recipients in other countries, whose personal data laws may not be as strong as those of your home country. Where we do so, we will always, as required by law, implement appropriate safeguards, such as EU standard contractual clauses, to ensure that your personal data is protected and that you are able to exercise your rights effectively.
You can find out more about the EU standard contractual clauses at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en .
7. HOW IS YOUR PERSONAL DATA PROTECTED?
We have taken adequate safeguards to ensure the confidentiality and security of your personal data. We have implemented appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access as well as all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further processing. Examples are IT security policies, maintaining confidentiality, staff training and secure servers.
8. HOW LONG WILL WE KEEP YOUR PERSONAL DATA?
We will keep your data for as long as needed as per processing activity/ purpose it is being processed for. For example, where you provide your details in relation to a loan we will keep such data, for as long as necessary to administer your loan and, after that, we will keep the data for a period which enables us to handle or respond to any complaints, queries or concerns and comply with legal and regulatory obligations. We will also keep your personal data where we need to do so in connection with legal action or an investigation involving Iris Hellas Investments DAC.
We will actively review the data we hold and delete it securely, or in some cases anonymise it, when there is no longer a legal or business need for it to be retained.
9. WHAT ARE YOUR RIGHTS?
You have the right to:
- ask us about the processing of your personal data, including to be provided with a copy of your personal data;
- request the correction and/or deletion of your personal data;
- request the restriction of the processing of your personal data;
- object to that processing, based on the legitimate interests of Iris Hellas Investments DAC and others including our affiliates, unless we demonstrate compelling legitimate grounds for that processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims;
- if applicable, withdraw your consent to the processing of your personal data where Iris Hellas Investments DAC is processing your personal data based on your consent. Such withdrawal does not affect the lawfulness of processing based on consent before such withdrawal;
- request receipt or transmission to another organisation, in a structured, commonly-used, machine-readable form, of the personal data that you have provided to us; and
- complain to your local supervisory authority if your privacy rights are violated, or if you have suffered as a result of unlawful processing of your personal data.
All rights are subject to the definition/ prerequisites detailed in the General Data Protection Regulation.
If you would like more data about your rights, or have any concerns about our processing of your personal data, please let us know by getting in touch with us using the details in the ‘Contact us’ section below. We may ask you to verify your identity by providing us with additional documentation such as an up to date proof of identity.
10. CONTACT US
If you have any questions or requests regarding this Notice or the personal information that we hold about you, or need additional information, you may contact us through QQUANT MASTER SERVICER MONOPROSOPI A.E.D.A.D.P., either via the electronic contact form available at https://www.qquant.gr/hubfs/Entypo%20Aitimatos%20Paroxis%20Pliroforion.pdf, or by post by sending a letter to the Data Protection Officer of QQuant, at 66 Kifisias Avenue, 15125 Marousi, Athens, Greece, or by email to dpo@qquant.gr .