A. What does "processing your data" mean, and who is the controller?

"Processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by means of transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of personal data.


BNP Paribas Fortis SA/NV, with its head office at Montagne du Parc/Warandeberg 3, 1000 Brussels is responsible for processing the personal data it deems necessary to process.


We are therefore the party whom you, as well as the supervisory authorities (for example the Privacy Commission), should contact for any questions you may have relating to the way our bank uses your data.


For some services, we rely on specialised partners which, when necessary, act as processors. They therefore have to follow our instructions and adhere to our policy on personal data protection. In some other cases, these partners may also act as joint controllers for processing data and must comply with their own legal obligations in this area.


We ensure that our partners receive only the data that are strictly necessary to perform their contractual duties.


Examples of usual partners in the financial sector:

  • Swift (global messaging system) ;
  • VISA, MasterCard and Atos Worldline ;
  • (sub)-custodians of financial instruments;
  • clearing houses.


We also act as a processor for other entities which may or may not belong to the BNP Paribas Group. In this case, those entities act as controllers for processing personal data. We are thus only following their instructions.


B. To whom is it addressed?

Those affected by this notice are:

  • all present customers and prospects of BNP Paribas Fortis who are natural persons;
  • all other natural persons who are involved in any transaction with our bank as guarantors or representatives of our customers, whether private individuals or legal entities (for example company directors, agents, legal representatives, other contact persons).


This notice does not affect:

  • legal entities.


C. What data are covered by this notice?

The data covered by this notice are personal data of natural persons, which means any data that directly or indirectly enable the person to be identified.


Whenever you interact with BNP Paribas Fortis, we may collect various personal data:

  • identification data: your name, address, date and place of birth, picture, account number, phone number, e-mail address, IP address[1], profession, household composition, etc.;
  • the data needed to execute a contract: your salary, the value of your real estate, etc.;
  • transactional data: data relating to your banking transactions, comprising account names and numbers, communication, and more generally, any data about a deposit, transfer or withdrawal, etc. which took place on your bank accounts;
  • data relating to your behaviour and habits when using our channels: our branches, our internet websites, our apps for tablet and smartphone, etc.;
  • data relating to your preferences and interests, which you directly or indirectly provide to us, for example by taking part in competitions or events that we organise, your real estate projects, your hobbies etc.;
  • data from third parties;
  • data from your interactions on our social media pages.


In accordance with the law, we will not process any sensitive data, namely those relating to

  • racial or ethnic origins;
  • political opinions;
  • religion or beliefs;
  • trade union membership;
  • genetic features;
  • health;
  • sex life;
  • criminal convictions or related security measures;
  • biometric data.


If we had to process this type of data, we would always request your prior consent.


D. Which legislation applies in Belgium?

The protection of your personal data is covered by the law of 8 December 1992 (known as "The Privacy Law") and its implementing royal decrees. We undertake to comply with our obligations and respect your rights whenever we process your data. If you wish to learn more about this subject, we advise you to visit the Privacy Commission's website.

[1] IP address is the number that identifies each computer when it is connected to the Internet