BC “Victoriabank” SA, as the “Controller,” processes your personal data in good faith and securely, having implemented appropriate technical and organizational measures to ensure the integrity and confidentiality of personal data, in accordance with Law No. 195/2024 on the Protection of Personal Data (hereinafter “Law No. 195/2024”).

We process your personal data in your capacity as an existing customer, a potential customer, an individual conducting occasional transactions, authorized representative, co-debtor, legal representative, guarantor, surety, or beneficial owner, as well as users of the Bank’s applications, services, and products, (hereinafter referred to as the “data subject”).

This privacy notice is intended to explain, in a clear and transparent manner, the categories of personal data collected by the Bank in connection with you, as well as how this data is processed.

Depending on the purpose of processing personal data and/or the nature of the contractual relationship with the bank, as well as taking into account the specific nature of the activities carried out, the following categories of personal data may be processed:

• identification data: data included in the identity document, first name, last name, identification number (IDNP), date and place of birth, citizenship, etc.;

• contact information: home or residence address, phone numbers, email addresses, mailing addresses, etc.;

• professional data: profession, public office held, etc.;

• data regarding family status: marital status, family relationships, information about marriage or cohabitation, etc.;

• financial data: income, bank transactions and their history, property owned, etc.;

• banking data: identification codes, IBAN codes, payment card numbers, card expiration dates, as well as other identifying elements of payment instruments, etc.;

• biometric data: data resulting from specific processing techniques relating to the physical, physiological, or behavioral characteristics of a natural person that enable or confirm the unique identification of that person, such as facial images, etc.;

• electronic signature, handwritten signature;

• image: photo (from the provided ID document, as well as the photo taken when using online services) and video (recordings made by video surveillance cameras installed at the bank’s premises);

• voice: recorded during telephone conversations with bank representatives (e.g., call center services, as well as other units involved in discussions with bank customers);

• political affiliation: information related to the status of a politically exposed person, in specific cases, which is processed only in accordance with applicable legislation regarding the prevention and combating of money laundering and terrorist financing;

• other data necessary for business purposes.

Personal data is collected by the Bank, either directly from you or indirectly, in the following situations: upon the initiation or termination of a business relationship with the Bank; when signing a contract or submitting an application for banking services; when filling out the Bank’s forms; during the term of any contract entered into with the Bank; while using the Bank’s products, services, website, or applications, etc.

The personal data listed above are processed by the Bank in connection with the performance of its specific duties and activities, for the purposes of:

• knowing your customer, and detecting and reporting suspicious transactions — legal basis: Art. 6(1)(c) of Law No. 195/2024, for the purpose of fulfilling legal obligations and measures in the public interest, pursuant to Law No. 308/2017 on the prevention and combating of money laundering and terrorist financing.

• credit risk analysis, pursuant to Art. 6( (1)(c) of Law No. 195/2024, namely to fulfill a legal obligation in accordance with Law No. 202/2013 on consumer credit agreements.

• the analysis, initiation, conclusion, and performance of contracts for the provision of financial and banking services entered into with you, pursuant to Article 6( (1)(b) of Law No. 195/2024, namely to perform a contract to which the data subject is a party or to take precontractual steps at the data subject’s request.

• preparing reports or other financial and banking disclosures, pursuant to Article 6( (1)(c) of Law No. 195/2024, namely to fulfill a legal obligation and in accordance with applicable special legislation.

• collection of debts and recovery of receivables owed to the Bank, in accordance with the contracts entered into and based on the legitimate interest of the Bank in recovering the amounts related to the existing contractual relationship with you, pursuant to Art. 6(1)(b) and (f) of Law No. 195/2024.

• conducting audits and internal investigations, preventing conflicts of interest and acts of corruption, as well as preventing/detecting fraud, handling/investigating reports and complaints, pursuant to Article 6(1)(c) and (f) of Law No. 195/2024, respectively to fulfill the Bank’s legal obligations and to pursue its legitimate interest in ensuring the integrity of its activities and the protection of its assets.

• the provision of payment initiation services from accounts held with the Bank and available online, the issuance of card-based payment instrumentsand confirmation of fund availability, if you have contracted any of these services through a third-party payment service provider, in accordance with the provisions of Law No. 114/2012 on payment services and electronic money.

• the development, testing, and use of IT systems, implementation of data security measures pursuant to Art. 5(5)(e) and Art. 30 of Law No. 133/2011, to protect the Bank’s legitimate interests.

• preparation of internal and external reports for monitoring the Bank’s activities and reporting to the banking group to which the Bank belongs, as well as for compliance with legal or statutory requirements, pursuant to Art. 6(1)(f) and Art. 32 of Law No. 195/2024, to protect the Bank’s legitimate interests.

• the legal defense of the Bank’s rights and interests, the resolution of disputes, investigations, or any other petitions/complaints/requests in which the Bank is involved, pursuant to Article 6(1)(c) and (f) of Law No. 195/2024.

• processing data for statistical purposes, pursuant to Article 54 of Law No. 195/2024, for the purpose of analyzing and planning the Bank’s activities, in compliance with data protection principles and data anonymization, where applicable.

• data processing for direct marketing purposes, through the use of communication channels, including email, SMS, or phone calls, for receiving newsletters and other commercial communications regarding the Bank’s products and services (financing, lending, or others), those of the group to which the Bank belongs, and/or those of its partners, pursuant to Article 6(1)(a) of Law No. 195/2024, with your express consent.

• your profiling, for the purpose of providing you with information regarding standard or personalized products and services from the Bank’s portfolio or that of Group entities, pursuant to Art. 6, para. (1), letter a) of Law No. 195/2024, with your express consent.

• contacting you for the purpose of obtaining feedback on the Bank’s services and products, via a telephone call that may be recorded, pursuant to Article 6(1)(a) of Law No. 195/2024, with your express consent.

• recording of phone calls made through the Bank’s customer support centers, for the purpose of improving the services and products offered or to provide the necessary assistance, carried out based on your express consent, pursuant to Article 6(1)(a) of Law No. 195/2024.

video surveillance by recording your image during visits to the Bank’s branches, carried out for the purpose of protecting the Bank’s legitimate interests, as well as to comply with the legal obligation to ensure the security of premises and persons, pursuant to Article 6(1)(f) of Law No. 195/2024.

• the retention, storage, and archiving of documents, including ensuring traceability in the Bank’s IT systems and backup copies of databases, pursuant to Article 6(1)(c) and (f) of Law No. 195/2024, for compliance with legal obligations and the protection of the Bank’s legitimate interests.

• Data processing and storage take place for the duration of the contracts, or 5 years after the termination of the contractual relationship. If no contractual relationship has been established, the data will be processed for 5 years from the date of the last transaction, including for one-time transactions. At the request of the competent authorities, the initial 5-year legal period mentioned above may be extended to a maximum of 10 years from the termination of the business relationship, in accordance with Law No. 308/2017 on the prevention and combating of money laundering and terrorist financing.

• Mandatory accounting records and supporting documents used in financial accounting are retained in accordance with accounting legislation.

• The data of customers who have given their consent to receive advertising messages is processed for this purpose until the consent is withdrawn or, otherwise, until they cease to be customers of BC ”Victoriabank” SA.

• The retention period for video recordings is 30 days from the date they were made, except in situations expressly provided for by law or in duly justified cases.

• Upon expiration of the retention period, if there is no other valid legal basis for retention, the data will be deleted.

Any other personal data processed by the bank for the purposes mentioned in this Privacy Notice will be retained only for as long as necessary to fulfill the purpose for which it was collected. After this period, the data may be retained for a reasonable additional period, determined in accordance with legal obligations or, where applicable, the bank’s internal rules, when this is justified by its legitimate interests.

Your personal data may be disclosed to:

• legal representatives;

• entities within the Bank’s group;

• debt collection/recovery agencies, etc.;

• other contractual partners (lawyers, consultants, auditors), who are bound by confidentiality regarding the data transmitted;

• other entities involved in the contracted services, such as dealers, IT service providers, courier services, or insurance brokers approved by the customer;etc.

• to competent public authorities/courts, etc.

Personal data may be transferred to entities within the EU/EEA (European Economic Area) that are part of the Bank’s financial group, and in the case of transfers to third parties or international organizations outside the EU/EEA, the Bank ensures the application of the safeguards provided by the Republic of Moldova’s data protection legislation and compliance with applicable international standards.

As a data subject, you have the following rights regarding your personal data, in accordance with Law No. 195/2024:

• The right to information (exercised through this document).

• The right to access your data. You have the right to obtain confirmation from the Bank as to whether or not it is processing your personal data and, if so, you may access that data as well as information regarding how it is processed.

• Right to rectification. You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data concerning you. The Bank will update the data based on your request and, where applicable, the supporting documents you provide;

• Right to erasure (“right to be forgotten”). You have the right to request the erasure of your personal data under the conditions provided by law. This right is not absolute and may be limited in situations where the bank has a legal obligation to retain the data or when processing is necessary for the establishment, exercise, or defense of legal claims.

• Right to restriction of processing. You have the right to request that the processing of your personal data be restricted under the circumstances provided by law. In this case, the bank may retain the data but will process it only under the conditions and for the purposes permitted by applicable law.

• Right to data portability. You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, as well as to request that it be transmitted to another controller, under the conditions provided by applicable law.

• Right to Object. You have the right to object to the processing of your personal data, including profiling, when the processing is carried out on the basis of the Bank’s legitimate interest or for the performance of a task carried out in the public interest.

• Right not to be subject to automated decision-making.&You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or significantly affects you, except in cases provided by law or where the processing is carried out with your explicit consent.

• The right to file a complaint with the National Center for the Protection of Personal Data and/or the courts.

If your rights and interests guaranteed by Law No. 195/2024 have been violated, you have the right to file a complaint with the National Center for the Protection of Personal Data and/or a court of law.

Exercising Your Rights
You may exercise the rights mentioned above—with the exception of the right to file a complaint with the National Center for Personal Data Protection or the courts—by:

• submitting a request to any branch of BC “Victoriabank” SA; or

• sending the request electronically to the email address: dcp@vb.md.