Taking care of our own and other people's health, we urge our clients to use the bank’s services remotely

Personal Data Processing

Industra Bank takes care of the security of personal data of its customers – in the Bank the personal data of natural persons is being handled with due respect for their interests to preserve their privacy. The principles of personal data processing and protection are being complied with in all data processing processes. The Bank maintains a high level of confidentiality of personal data and implements data protection measures, ensuring lawful, fair, and transparent data processing.

In the Bank we have a Data Protection Officer to whom you can send questions by writing to the e-mail address: or by sending a letter, marked "Attn: Data Protection Officer", to the address: Elizabetes iela 57, Rīga, Latvija, LV-1772 (the contacts in Lithuania – , Kęstučio g.51, Vilnius, Lietuva, LT-08124). Should you not be satisfied with the response provided by the Data Protection Officer, you may  contact the Data State Inspectorate (in Lithuania – the State Data Protection Inspectorate).

What is personal data?

Personal data is any information on any medium that may help to identify a Person, directly or indirectly. In performing its duties specified in legislation, ensuring the provision of services to customers, pursuing various types of legitimate interests, and attending to the quality of customer service, Industra Bank processes various types of personal data. Examples of Personal Data processed by the Bank:

  • name, surname, date of birth, personal identity number, passport or identity card data, citizenship, tax residence of a Person;
  • contact information (phone number, e-mail, address, language used for communication);
  • financial data of a Person - income, financial liabilities, source of income, borrowings, turnover of financial assets, other financial information;
  • information required for making and processing of payments, such as current account number of a Person in the bank, payment card information, payment history;
  • information about Person's work experience, education (managing information about existing and new employees);
  • information about users of the Industra Bank's website (cookies, IP address);
  • information about family members, associated persons;
  • Person's visual appearance (video surveillance).

In what cases the bank requests or obtains personal data?

Industra Bank processes various types of Personal Data, the volume and nature of which varies due to the diverse nature of data processing purposes. The Bank does not process information that is not required for achieving a concrete, specifically set legal purpose.

Personal Data can be obtained by the Bank in various ways, for example, when:

  • conducting a potential Customer identification and due diligence;
  • entering into contractual relations with a Customer and performing contractual obligations;
  • providing one-time service to a Person who is not Customer of the Bank;
  • reviewing applications in response to job advertisements, when recruiting new employees;
  • consulting a Person over the phone or at Customer service centres of the Bank; 
  • receiving a letter or an e-mail message from a Person;
  • the Bank’s website, internet banking, or the Bank’s accounts in social media are being used by a Person; 
  • conducting video surveillance at the Bank premises or outside the Bank;
  • using information about a Person from Internet resources, requesting information about a Person from various registers, and from other publicly available sources.

Possible legal basis for processing of personal data

Industra Bank may initiate processing of Personal Data only if the processing has a specific purpose (for example, conclusion of a contract, the provision of a specific service, performance of the statutory obligations, etc.) and if the processing has an appropriate legal basis.

A legal basis for processing of Personal Data may be as follows:

1. Establishment and performance of contractual obligations

In the event of this legal basis, the Bank processes the data required for concluding and performing the contract. Examples of data processing in conjunction with this legal basis:

  • The Bank requests all information necessary for concluding a contract (the legal basis also applies if the contract is not concluded for some reason);  
  • The Bank transfers information to other parties of the envisaged agreement (for example, by entering into a tripartite agreement);
  • The Bank sends information to international payment card organizations (MasterCard, VISA, etc.) to ensure execution of payment card transactions (if it is provided for in the agreement concluded between the Bank and the Customer);
  • The Bank transfers information to correspondent banks in order to ensure execution of payments (if it is provided for in the agreement concluded between the Bank and the Customer).

2. Compliance with a legal obligation

This legal basis applies to the data processing when the Bank has no free choice of action - the relevant activity is governed by the provisions of applicable regulatory enactments of the EU or Latvia/Lithuania.

For example, provision of information to the State Revenue Service (in Lithuania – State Tax Inspectorate) or to the The Financial and Capital Market Commission (in Lithuania – the Bank of Lithuania) in line with the legal acts, requesting information from a potential customer for identification purposes, etc.

3. Protection of the vital interests of a Person (Data Subject) or of a third party

This legal basis is used in exceptional cases, when data processing is carried out, for example, with an effort to protect life or health of a Person.

4. Observance of public interest or exercise of official powers

This legal basis is rarely used and is similar to the compliance with a legal obligation, since the public interest or official powers of the Bank must be specified in legal acts, unlike as with a legal obligation, the Bank can have a free (or a partially free) choice of action 

5. The legitimate interests of the Bank or of a third party

A frequently used legal basis. It is applied, for example:

  • when indicating third party-related information that is essential for the use of the Bank’s products (guarantors, pledgers, parties involved in transactions in case of opening of an escrow account, etc.) in the application;
  • when recording telephone conversations for the purposes of service quality control, etc.
  • Prior to performing data processing in accordance with this legal basis, the Bank shall evaluate the effect on the Data subject, perform an interest balancing test.

6. The consent of a Person (Data Subject)

The consent of a Person is used as a legal basis, for example, in marketing purposes, when a Person applies for a lottery or receipt of informative materials.

A person has a free choice – to give his/her consent to data processing or not, and a Person has the right to withdraw his/her consent at any time, thus terminating the processing.

For example, if, on the basis of the consent of a Person, the Bank sends informative material about the Bank and its products to a Person, the Bank shall stop sending the information as soon as the Person has withdrawn the consent.

How personal data is processed and protected?

Industra Bank does not process, more information than it is necessary to achieve certain goals, thus observing the so-called principle of data minimization

The Bank continuously develops information technologies in order to ensure the protection of Personal Data.

The Bank ensures that only those employees who need it for the performance of their job duties have access to Personal Data. 

The Bank takes efforts to ensure that it is processing only correct and accurate data. If the Bank has doubts about the applicablity or accuracy of the information submitted by a Person, the Bank shall contact the Person to clarify the information processed. In addition, each  Customer is obligated to report to the Bank in the event of changes in the information submitted to the Bank (for example, telephone number, residence address, etc.).

Personal data is processed for no longer than is necessary to achieve a certain purpose.

The Bank respects the rights of a Person, allowing the Person to control and monitor their Data Processing.

The Bank carries out, on a regular basis, training of employees, incl. on Personal Data Processing, protection, as well as on confidentiality and ethical standards.

Automated decision making

When performing the processing of Personal Data, Industra Bank uses automated systems, but does not take individual decisions without participation of specialists of the Bank.

The Bank uses automated systems, e.g. for payment control, Customer due diligence, detection of suspicious transactions, sanctions risk management in accordance with the current legislation of Latvia and Lithuania.     

In what cases and for what purposes personal data may be transferred to third parties?

When processing Personal Data, it is the priority of the Bank to keep the information confidential. Information may be transferred to third parties to the extent and in cases stipulated by the applicable regulatory enactments of Latvia/ Lithuania and of the EU, as well as in order to ensure the provision of high-quality and efficient services, or, when it is necessary for the performance of contractual obligations to the Customer.
Personal data may be transferred to:

  • FCMC, SRS, DSI, the Bank of Latvia and other state institutions, control services, sworn bailiffs and investigating authorities - in accordance with the regulatory enactments;
  • Holders of different registries (e.g. credit registers, commercial register, etc.);
  • External auditor of the Bank;
  • Subsidiary of the Bank;
  • Persons who are guarantors for obligations of the Bank’s Customer (guarantors, pledgers);
  • Beneficiary of a payment or transaction;
  • Insurance companies;
  • Bank's business partners, incl. those who provide the following services to the Bank: telecommunication service, information technologies, payment company services, etc.;
  • Business partners that provide Customer and Employee loyalty programs and privileges;
  • Other credit institutions, financial institutions, payment card companies, financial services intermediaries, etc.

Before transferring data to a third person, the Bank shall conclude an agreement detailing the procedure in accordance with which the business partner will process and protect the Personal Data. During the cooperation, only information required for a stipulated purpose will be transferred to the partner, and if there is such a possibility, the Bank transfers anonymized information, so that the business partner is not able to identify the particular Person. The Bank may not enter into a contract with a third party only in cases where the transfer of the relevant data is regulated by the applicable regulatory enactments of Latvia and of the EU.

Whether personal data may be transferred to outside the EU/EEA?

Personal data of a person may be transferred to outside the EU/EEA, when doing so is necessary for ensuring the provision of a specific service, in the event when the business partner of the Bank is located outside the EU/EEA. When transferring the personal data outside the EU/EEA, the Bank ensures a data protection level compliant with General Data Protection Regulation.

Personal rights of a person

Persons have the following rights regarding the processing of his or her information:

  1. to receive information on the type, purpose and legal basis of their data processing;
  2. to access their data and obtain confirmation of their data processing. By using Industra Bank MultiNet Internetbank, a Customer is able to acquaint oneself with the information on the concluded agreements with the Bank, balances of the accounts, his/her Personal data submitted to the Bank, payment history, etc. Upon receipt of a Customer’s request for information on personal data processing, the Bank may require the Customer to specify in more detail to which information and to which data processing activities the request relates.  
  3. to rectify their data if it is incorrect or inaccurate;
  4. to delete their data or "to be forgotten", for example, if the data is no longer necessary for the purposes for which it was collected or if the Person has withdrawn his/her consent on which the data processing is based;
  5. restrict the data processing, for example, if the accuracy of the personal data is contested by the Person, or if the Bank no longer needs the data for the stipulated purposes, but the Person objects to deletion of the data, with the aim of implementing or defending legal claims, etc.;
  6. to object to processing of data (on grounds relating to the Person’s particular situation) if processing is based on the Bank's legitimate interests or public interest. The right to object may not be realized if the legal basis for processing is the consent given by the Person, the establishment and performance of contractual relations, fulfilment of a legal obligation, protection of vital interests of the data subject or of third parties;
  7. right to data portability or movement, in order to store or to enable the reuse of data, for example, by transferring to another service provider. The right may be not realized for absolutely all information. Rights may be realized in respect of the data submitted by the  Person, for example by filling in forms and applications, applying for the use of the Bank's products and services, as well as in respect of the data processed by automated means (other than paper documents) and the legal basis thereof is either consent given by the Person or the establishment and performance of contractual relationships.   

Industra Bank shall consider the Persons’ requests without undue delay and, in any case, inform the Person about the actions undertaken within a month. The Bank may extend the period of consideration of the claims for another two months on a reasonable basis (for example, large number of requests or complexity of requests).

The Bank replies to the requests of a Person, as well as carries out any other activities related to the fulfilment of the requests of Persons, free of charge (except in cases where the request is manifestly unfounded, excessive, or depending on what resources are required for handling the request). When providing a reply to a request or fulfilling a request, the Bank may charge a reasonable fee for additional costs incurred.

Open an account and apply for a payment card !