Within the KBC Group

For the processing of personal data, KBC Bank NV makes use of processors within the KBC Group based in the European Union, namely KBC Group NV and KBC Global Services NV. Processing is carried out in Brno, Sofia or Varna, for instance, by the Shared Services Centre, branches of KBC Global Services NV in the Czech Republic or Bulgaria.

Some of the data processing performed by KBC Group NV and KBC Global Services NV on behalf of KBC Bank NV relates to oversight and support functions (at group level) such as financial reporting, the compliance function, the internal audit function, the inspection and risk function, anti-money laundering checks, complaints management, marketing support, support for invoicing, money transfers, credit processing and ICT management for the KBC Group.

For ICT management, KBC uses KBC Global Services NV, sometimes in conjunction with other processors within and outside the KBC Group.
KBC also uses the services of 24+ NV (www.24plus.be):

• As a contact centre through which you can get in touch with us;
• As a contact centre to get in touch with you on behalf of KBC for the purpose of making an appointment or conducting a satisfaction survey, to inform you about ‘personalised information’ and to invite you to make a choice;
• To log data into KBC apps;
• For administrative processing on the instructions of KBC;
• To provide information to the tax authorities and the police;
• To conduct an advisory meeting following a death, and to register next of kin, heirs,legal representatives and beneficiaries in the persons database.

KBC works together with Everyone Invested, a subsidiary of KBC Asset Management NV, to analyse the conformity of individual investment portfolios with the KBC Investment Strategy. KBC exchanges anonymised data regarding the investment portfolios with Everyone Invested for this purpose.

KBC Bank NV also processes personal data jointly with other entities of the KBC Group as joint controllers. This means that together with one or more other KBC entities, we determine the purposes and means of processing your personal data. The responsibilities and obligations assumed by each entity in this situation are determined. In this case, we establish our respective privacy responsibilities through this way.

Joint processing responsibility occurs, for example, in the context of the joint distribution activities of KBC Bank, CBC Banque and KBC Insurance as an integrated bancassurance company. This manifests itself in the following processing activities, where the controllers may process personal data of each other if necessary:

• model building;
• common reporting at country-level and associated profiling;
• extra convenience (see KBC Mobile regulations for more information) and associated profiling;
• customer relationship management;
• ‘personalised’ agreement (more information) and related profiling.

You can always exercise your rights as a data subject with any  KBC entity acting as a data controller for your data. Each controller remains responsible for ensuring that the applicable legal obligations are honoured for any processing it is involved in.

If there are legitimate reasons for doing so (for more info see For what purposes does KBC use my data?),  KBC may also make data available to another KBC entity in Belgium or abroad. KBC may also process data if it was lawfully collected from another KBC entity, in Belgium or abroad.