Privacy statement

Who is responsible for your data?

The Bank is responsible for your data. The Bank’s full details are: ABN AMRO Bank N.V., a public limited company incorporated under Dutch law with its registered office at Gustav Mahlerlaan 10, 1082 PP Amsterdam, Netherlands, registered under number 34334259 in the Commercial Register at the Amsterdam Chamber of Commerce, and with a Belgian branch at Post X, Borsbeeksebrug 30, 2600 Antwerp, Belgium, registered with the Belgian Crossroads Bank for Enterprises under number (VAT BE) 0819.210.332.

Data Protection Officer
Our company's Data Protection Officer or DPO is based at Gustav Mahlerlaan 10, 1082 PP Amsterdam, the Netherlands. This officer acts for the entire ABN AMRO Group. In Belgium they are represented by the Local Privacy Officer (be.compliance@be.abnamro.com).

What is personal data?

This Privacy Statement is about the Bank's use of your personal data. But what exactly is personal data? The most common examples of personal data are name, address, age and date of birth. Business email addresses, phone numbers and your national registration number are also personal data. So-called special category personal data is a specific type of personal data . This data is so sensitive that its use could seriously affect an individual’s privacy. It includes information about your health, sexual orientation, cultural background and trade union membership. Biometric data is also considered special category personal data. Biometrics are a collection of techniques to measure and identify an individual’s body characteristics, such as fingerprints (to grant access to secured areas, for instance). The privacy legislation imposes strict requirements on the use of such special category personal data. The bank may only process this type of personal data if the law permits or requires it or with your express consent.

Origin of personal data

Most of the personal data the Bank processes about you was obtained from you. Some of the Bank's data about you may have been obtained from another source. Here are some examples of other sources: 

• A temping or recruitment agency
• Public sources such as search engines and public areas of social media.
• You will be screened before you join the bank. In that case, the bank will receive personal data about you from the agency conducting the screening. Read more about this type of screening below in 'Pre-employment screening'.  

On what basis does the bank process your data?

The Bank uses your data for one or more of the following reasons:

Laws and regulations  

The Bank also processes your data because it is required to do so under various laws and regulations. Banks are subject to many rules. The Bank must conduct its business with integrity in order to manage the integrity risks and to ensure the integrity of the Bank and of the financial sector as a whole. Conducting its business with integrity also means selecting its employees with integrity.

Legitimate interest

The Bank may also use your data if it has a 'legitimate interest' to do so. The Bank’s interest in using your data does have to outweigh your right to privacy. The Bank therefore weighs up all interests in this process. Examples of the Bank's legitimate interest to use your data in the recruitment and selection process are: 

• To recruit and select suitable and competent employees 
• To protect the Bank’s property and data
• To protect the security of the bank and its employees

What does the Bank use your data for?

The Bank uses your data for the following purposes.

Recruitment and selection of suitable and competent employees  

The Bank uses your personal data to assess your suitability for the position in question. If an employment contract is concluded, the Bank shall use your personal data to draw up the contract. Protection of integrity and securityThe Bank also uses data to optimally protect the Bank, its property, its data and its employees against all kinds of breaches and damage.

• One example of that is the installation of security cameras in and around the Bank’s buildings.
• The Bank also performs pre-employment screening. Find out more about this type of screening below. 

HR management

The Bank uses candidates' personal data to implement a responsible, effective and efficient HR policy.

• One example is people analytics research. These statistical analyses examine the impact of the implemented HR strategy. The results of the surveys and the associated advice can never be traced back to individuals.
• Other example isAlso remember the Bank’s diversity policy. The Bank aims to reflect the growing diversity in society across its organisation. It therefore wants to monitor the diversity of its candidates in the recruitment and selection process. The Bank uses gender and age data for this at an aggregated level. 'Aggregated' means that the data can't be traced back to an individual person.  

Laws and regulations

Finally, the Bank uses employee data to comply with the applicable laws and regulations. The Bank must conduct its business with integrity under the regulations in force. Conducting its business with integrity also means selecting its employees with integrity.

Pre-employment screening

The Bank considers it important to ensure the reliability, professionalism and security of its organisation. This means that the final stage of the application process consists of pre-employment screening. Data from public sources may also be used for this purpose. In Belgium, the Bank's pre-employment screening always consists of the following components:

• Identity verification
• Qualifications check
• Employment certificate
• Criminal record extract*
• Banker's oath (for banking service providers)**

*In line with the European privacy directives, the criminal record extract is not kept in the personnel file.** The Bank is required to draw up a list of banking service providers working at its institution or acting on its behalf, and provide this list and any updates to the Belgian Financial Services and Markets Authority (FSMA) (in accordance with Article 4, Section 1, third paragraph, of the LawAct of 22 April 2019 introducing a bankers' oath and disciplinary regimesystem for the banking sector). More information on how the FSMA processes the personal data it receives from banking service providers is available in the Privacy policy for banking service providers, which is available on the FSMA website under the Privacy & Cookies section. 

Does the Bank also share your data with others?

The Bank may share your data with companies that help us to select candidates, such as recruitment and selection agencies and temping agencies. 

The Bank may also share your data with assessment providers to perform a personality test, for instance. 

The Bank makes clear arrangements on how they handle your data in a contract. The Bank remains responsible when using the services of another company.

Security of your personal data

The Bank does its utmost to protect your data as much as possible. The Bank invests heavily in its people, systems and procedures to achieve this. Its approach is always adapted to the sensitivity of the data. Employees are trained to handle the data securely.

It is precisely because of your security that we can't go into detail about the exact data security measures we take. Examples of the Bank's measures to protect employee data are provided under point 2 of “Why does the Bank use your data?”.

Is your data also processed outside of Europe?

The Bank and the companies in its group may share personal data with each other at times, even if the group's companies are located outside of Europe. For example, if you apply for a position at the Bank’s Sydney branch, the Bank will pass on your details to that branch. The Bank must comply with local regulations in this respect. 

The Bank shares personal data with the group's companies outside of Europe in accordance with its global internal policy, the Binding Corporate Rules (BCRs). The Data Protection Authority has approved this policy. 

The Bank may also use IT suppliers based outside of Europe or IT suppliers who also offer services from countries outside Europe. If this is the case, the Bank shall ensure that this transfer meets the privacy legislation.

How does the bank determine how long your data is stored?

The basic principle to determine different personal data retention periods is that the data is always retained for as long as necessary to achieve the purpose for which it was obtained. 

The privacy legislation does not mention any specific retention periods for personal data. However, other laws may stipulate minimum retention periods. This means that the data must be stored for as long as stated in those laws. 

In principle, the Bank stores the personal data of rejected candidates for one year from the moment of rejection. If you have been rejected and you would like to have your personal data erased, you can send your request to hrm@be.abnamro.com. If you are hired as an employee, the Bank shall keep your personal data just as long as the data of its other employees. We apply a retention period of seven years from the end of your employment for most employee data.

What rights do you have?

Access, rectification, erasure and limitation 

You have the right to access your personal data processed by the Bank. You can also ask the Bank to correct your details if they are incorrect. You can submit your request to hrm@be.abnamro.com.

In some cases, you can also ask the Bank to erase your data. The Bank does not always have to comply with a request to erase your data. One example of this is when the law requires the Bank to keep your data for a longer period. 

You can also ask the Bank to temporarily limit the use of your personal data. This is possible in the following cases:

• You believe that your personal data is incorrect.
• The Bank is using your personal data incorrectly.
• The Bank wants to erase your personal data (for example after the retention period), but you still need it.
• You can also submit a request for data erasure or limitation to hrm@be.abnamro.com. Always clearly state the reason for your request.

You can exercise your rights by sending a letter with a legible copy of both sides of your identity document to ABN AMRO Bank N.V., Privacy Officer, Borsbeeksebrug 30, 2600 Antwerp, Belgium.

Right to data portability

The Bank can give you the data that you provided to the Bank and that is stored automatically. This only applies if they process your data based on consent or based on the agreement they concluded with you. This is called data portability. You can exercise your rights by sending a letter with a legible copy of both sides of your identity document to ABN AMRO Bank N.V., Privacy Officer, Borsbeeksebrug 30, 2600 Antwerp, Belgium.

Make sure you keep your data secure. Check that the party you wish to disclose your data to is trustworthy and handles your data as securely as the Bank. If you want to receive your data yourself, make sure that your own equipment is sufficiently secure and can't be hacked, for example.