Personal Data Sending to a Third Country
and the Applied Guarantees of Data Protection

The Bank sends Personal Data to a Third Country if adequate safety measures have been ensured. The Bank assumes that Data sending to a Third Country is lawful where one of the following measures is ensured:

1. a decision was made by the European Commission that the certain Third Country’s territory ensures adequate level of protection;
2. a cooperation agreement is concluded between the Bank and a Third Party located in a Third Country with the application of standard clauses on Data protection developed by the European Commission;
3. other activities have been conducted, which, in accordance with the requirements of the normative acts, are considered as adequate safety measures (for example, application of other approved regulations, codes of conduct, certifications, etc.).

Where none of the safety measures mentioned in the normative acts exist, Personal Data sending to a Third Country may be implemented only if one of exceptional legal bases specified in the normative acts is applied, for example, but not limited to, a Data Subject has provided its Consent, or Personal Data sending to a Third Country is required for execution of agreements between the Data Subject and the Bank (for example, Data sending to a correspondent bank located in a Third Country is required for payment execution performed by the Data Subject).