DNB will use your personal data to meet its obligations when executing orders for you and according to service agreements with you, and in connection with customer administration and invoicing. When entering into agreements with you and during the term of such agreements, DNB will register information about you and other persons involved in the contractual relationship, e.g. authorised users. DNB will also register information about individuals with whom it has declined to enter into agreements as a basis for informing the individuals that their application was declined and to be able to document the circumstances later on, if necessary.
In order to safeguard our contractual rights and help our customers to fulfill their obligations under the agreement, it will be necessary to process personal data to send them payment reminders as well as suggesting a solution to the case, cf. GDPR Art. 6 (1) (b).
In some cases, we may consider it necessary to transfer contact information and information about the claim to a debt collection agency. It is in DNBs legitimate interest under GDPR Art. 6 (1) (f), to safeguard the bank's financial rights by agreement with the customer, and that the customer fulfills its obligations under the agreement. The debt collection agencies are independently responsible for processing when they process personal data in their ordinary debt collection activities.
In cases where defaults have ended in loss on DNBs hand, it will store financial information, identification information, debt collection history and information on the cause of losses and use this in future credit assessments to both safeguard the legitimate interest in avoiding new losses, and to comply with the duty to reject a loan under the Norwegian financial contracts act § 47.
We have a legitimate interest under the GDPR Art. 6 (1) (f), cf. Art. 9 (2) (f) to store information related to terminated agreements and default cases for up to 13 years in order to determine, enforce or preserve legal claims.
In customer relationships, we process identification information, contact information, financial information, relation information and digital behavioral information for marketing purpose on the DNB Group's financial products and services.
You have the right at any time to object against the processing of your personal information for marketing purpose. Please find below the information necessary to use your right to object in the chapter «What are your rights / Object against treatment and purpose
Below you will find specific information about scoring as a method for determining the relevant message to our customers. We also provide information about customer matching as a method of marketing directly on our customers' user profile in social platforms.
About the prediction scoring (profiling)
We believe our communication and marketing is best when it is made relevant to customer. It is in our legitimate interest to use our analysis models to support the decision making to our customer communication. (Please find spesific information about the model development under the chapter Analysis and development of new services) The selection is made by comparing selected features of the customer with our statistical models.
The selected features consist of the customer's age, age group and postcode, information about the customer's existing accounts, loans, credit cards, savings agreements, funds and personal insurance, information about the customer's use of the products, including information about size range on balance, deposits and withdrawals, frequency of use, as well as information about the customer is or has co-debtors, guardians or guarantors, information about the customer's frequency for logins in DNBs online banking and apps. When the outcome of the comparison with the model gives a high number code for a scenario, it indicates relevance to the customer. Low scores give an indication to the contrary. Scoring takes place on a continuous, basic basis, and is renewed daily. The score is considered fresh and does not provide a basis for registering a permanent profile of the customer.
We promote products from the entire group and DNB Bank ASA is in charge of and acountabble for the processing. If the customer has not agreed that the DNB group's companies can internally share, store and use information about customer relationships in DNB to provide more customized advice and offers, the bank will only collect and process neutral information about the customer's possible pension and insurance conditions, but not be entitled to process information about the customer's securities that are accounted for in the bank with DNB Markets, or funds that are managed with DNB Asset Management AS. In any case, the bank does not disclose personal information back to the group's companies in connection with this processing activity. Customers are given the right of access in scores until it is deleted. The customer can object against this scoring, or marketing entirety. See more about the right of access and the right to object and make reservations, below under chapter What are your rights?
About matching customer with user profile on social platform
As an alternative to marketing directly to the customers´ email address or mobile number, it is in our legitimate interest to use thirdparties´ advertising services to reach out with our promotion, directly to customers' user profile in social media. We use a link service at both Schibsted and Facebook to publish our ad on the users profile When the same contact information as our customer is found in the profile, we have a match. Schibsted and Facebook are data processors for DNB. After the search service is completed, the data processor deletes the encrypted contact list. The user profile of the customer on the social platform remains unknown to DNB as it is not obtained.
The customer may protest against this processing. See spesific chapter below for information on What are your rights? / Object against processing and purpose
In DNB we define profiling as automated processing of data to analyze or to make predictions about customers; for example, assessing or classifying customers based on characteristics related to their financial situation, their personal preferences or transactional behavior.
We use profiling in connection with the preparation and implementation of marketing campaigns, for customer follow-up purposes and in the preparation of product offers. DNB has a legitimate interest in using profiling, for example when we perform customer analysis for marketing purposes or transaction monitoring to detect fraud. Please find the information about Prediction scoring (Profiling) under the chapter on Marketing, and the information about the right to protest against this processing under the chapter What are your rights? / Object against process and purpose.
The DNB Group has a shared customer register. The data in the register is used to manage customer relationships and coordinate offers of services and advice from the different companies in the Group.
The group-wide customer register will contain neutral information about you like your name, date of birth, address and other contact information, as well as information about the companies in the Group you are a customer of, and the services and products for which you have entered into agreements. Your national identity number may be shared and registered in a group-wide customer register when the purpose is administration of the customer relationship.
DNB has implemented technical and organisational security measures to protect your personal data. DNB continuously seeks to ensure that your personal data is protected against loss, destruction, corruption or unauthorised access. Our security framework is updated regularly in line with technological developments. In addition, DNB is permitted to process personal data to pursue the legitimate interest of securing the Group’s assets, for instance in connection with logons to servers, the operation of infrastructure, firewalls, access controls and video surveillance.
DNB will process credit information and other personal data in accordance with the provisions of the Norwegian Financial Institutions Act and Securities Trading Act. This processing takes place in connection with the establishment of your customer relationship, determining which products and services are suitable for you and the use of systems to calculate capital adequacy requirements for credit risk. The internal measurement systems include DNB’s models, work and decision-making processes for approving and managing credit, control mechanisms, IT systems and internal guidelines for classifying and quantifying the Group’s credit risk and other relevant risk. The personal data used for this purpose is obtained from credit agencies.
DNB will process personal data in models that are used to assess how much risk the bank assumes. The models produce a set of key figures (PD, LGD and EAD), which are necessary to be able to determine how much risk capital the bank must hold at any given time. The key figures are estimated for each individual agreement the customer has in the bank. The key figures can later also be used in the bank's risk reporting or in the bank's processing of applications from the customer for, for example, credit. The information is collected on an ongoing basis, as it is necessary for DNB to continuously update the risk picture. As the data controller, DNB Bank ASA will be responsible for all stages of the processing. DNB has a statutory obligation to process your personal data for this purpose. For our PD and LGD models, we are required by law to store personal information for a minimum of 5 and 7 years, respectively. The personal information used in the model calculations can be stored for up to 50 years.
DNB is permitted to process personal data for the purpose of preventing, detecting, investigating and handling fraud and other criminal acts. In such cases, DNB may need to gather information and disclose it to other banks and financial institutions, the police and other public authorities. The collected information may be stored for up to ten years after it is registered. DNB will process personal data to fulfil its obligation to investigate and report suspicious transactions in accordance with the Norwegian Money Laundering Act. DNB has a statutory obligation to report suspicious information and transactions to the Financial Investigation Unit in ØKOKRIM (the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime). According to the Norwegian Personal Data Act and the Money Laundering Act, you are not entitled to inspect certain information registered by DNB in this connection as long as an investigation is still ongoing.
DNB will otherwise process personal data to the extent this is required or permitted by law or when you have given your consent. In addition, DNB is permitted to process personal data for the purpose of preventing and detecting criminal acts if this is necessary to protect a legitimate interest that overrides the right to protection of your personal privacy.
When you use DNB’s electronic services, DNB is permitted to register your user behaviour and user environment and any deviations from these, identify the computer or mobile device you use to carry out the banking service, the state of the computer/unit etc. DNB will use this data to make sure that the right person is using the service in question. DNB may also use the data in a risk assessment to adjust the authentication method that you have to use for the service.
DNB may choose to reuse collected customer information to analyze how customers use the services to the improvement of existing products and services or to the development of new. This includes identifying potential demand for products and services, as well as performing tests related to the development.
It is in our legitimate interests to develop, build, improve and put in place business models, systems, products and services, and to produce and provide reports for our benefit, and provide a high standard of service. The developing, maintaining and validating of data models, are based on pseudonymous information in predefined data sets with information for conducting strategic, insight-based business. To ensure that the model provides a representative picture of customer portfolio, the pseudonymous data set consists of age, age group and postcode, existing accounts, loans, credit cards, savings agreements, funds and personal insurance, use of products, occurrence of roles as co-debtors, guardians or guarantors. as well as logins in DNBs´ online banking and apps. Model development is due to a constant process to ensure decisions in business development. This processing activity does not involve concrete scoring or profiling, and has no direct significance for the customers. However, if the models are to be used for specific scoring of customers in connection with marketing purposes, it will have a direct impact on the customer. We recommend that you read more about this in the chapter What purposes is personal data used for? / Marketing. See also the chapter What are your rights? / Object against processing and purpose
In some cases, we can use automated decisions when this is permitted by law and you have explicitly consented to this, or if it is necessary for the performance of an agreement, e.g. automated credit decisions in our online channels. You may, at any time, request manual processing instead, state your opinion or contest a decision that is exclusively based on automated processing, including profiling, if such a decision could have legal or other significant consequences for you.
When we use automated decision-making processes, we will give you additional information about the underlying logic that is used and the consequences it can have for you.
At DNB Bank, we process personal data to provide statistics to public and private companies. The statistics we share are never personal information only non identifiable. The companies may use the statistics to improve goods, services, communications and offers to their consumers. Our legal basis of processing for this purpose is legitimate interest. The statistics we create are based on demographic information, product information and transaction information. In some cases, we also use additional information from public registers, such as from the Mapping Authority (Kartverket). Examples of statistics can be groups of residents who travel collectively, which age groups most often go to the cinema, how many customers live in detached houses, the time of day that most people in the grocery store, or what average people in a municipality pay in electricity, telephone subscriptions, food consumption, etc. You have the right to object to including your personal data in the statistics. You can do so in the online banking, through the menu Settings.
We process personal data for the purpose to execute customer and market surveys. In order to get feedback from our customers about what they expect of DNB, their experiences or what input they have for improvements it is necessary to conduct surveys. It is voluntary to participate. Our analysis agencies receive the contact information to conduct customer surveys on behalf of DNB. The analysis agency is DNB`s data processor and subject to a data processor agreement. As controller for the processing DNB is responsible for all stages of the survey. DNB has a legitimate interest in processing your contact information and answers for this purpose. By participating in the survey, you agree that we may process your information. The analysis agency deletes the customer lists automatically after 6 months. Exceptionally, the files are stored for 24 months for follow-up examinations that take more than 2 years.
