KBC Brussels needs to use data to function as a company 

Use of personal data in banking services is mandatory in accordance with specific legislation, such as the MiFID II Directive and PSD2 regulations. For instance, you can choose to view accounts held with other banks in KBC Brussels Mobile or check your KBC Brussels account in another bank’s app. KBC Brussels has to share data with the bank concerned to enable this.   

KBC Brussels also shares personal data of individuals associated with a legal entity (UBO and legal representative) with, and receives such data from, other financial institutions in Belgium over the Kube platform. The purpose of this data sharing is to accelerate the legally required Know Your Customer data collection during the onboarding process for new corporate clients at a Belgian financial institution. It also encompasses the sharing of this personal data should this data be updated during the recurring KYC update processes. Information is shared only with financial institutions that need this data and is limited to what is required under anti-money laundering legislation.    

KBC Brussels may be legally required to notify the authorities, for example in the case of personal data breaches, and in this context communicate your personal data. KBC can also receive requests about information from authorities or public bodies (more information).  

KBC Brussels must comply with various national and international laws and regulations. Therefore, we report operations, transactions, orders or other requested personal data to competent local and foreign authorities regularly or when requested, depending on the circumstances. These authorities include financial, tax, administrative, criminal or legal bodies.     

For example, KBC Brussels is required by law to share certain information with the Central Point of Contact of the National Bank of Belgium.    

KBC Brussels uses personal data to prepare internal reports, for example in the context of complaints management to prevent the recurrence of complaints, or to measure the effective use of certain functionalities in KBC Brussels Mobile. KBC Brussels does this based on a legitimate interest.  

KBC Brussels processes personal data based on legitimate interest. This is done to comply with internal and regulatory reporting and internal control and communicate as a company. This includes:   

• Organising the administration, (risk) management and oversight, such as the legal department, the risk management department and inspections  
• Following up on the collaboration with partners acting as referrers/intermediaries for KBC Brussels or because KBC Brussels has referred you to them, and calculating any commission. For this purpose, KBC Brussels also uses data that these partners make available to KBC Brussels regarding your use of their services and the link with KBC Brussels’s services   
• Determining, exercising, defending and preserving the rights of KBC Brussels or persons whom it might represent (e.g., in disputes) KBC Brussels will also process personal data related to a dispute, even if it is not a direct party to the dispute. KBC Brussels will retain this personal data for as long as necessary for the dispute     
• Increasing efficiency or producing other benefits for its organisation and processes    
• Promoting sustainability and addressing environmental, social and governance (ESG) risks in its loan portfolio   
• Contacting and evaluating future retailers   

KBC Brussels processes personal data based on legitimate interest. This is done to support ICT systems and software, improve processes, coach staff and improve services. This includes: 

• Developing and testing infrastructure, software and process development, artificial intelligence, models, etc.  
• Investigating, monitoring and restoring incidents and infrastructure 
• Using modern technologies, including artificial intelligence (for example, to consult certain customer data) or using Optical Character Recognition to read and extract information from documents   

If a credit claim is mobilised from a credit agreement, we may disclose the obligations and, based on legitimate interest, the necessary details of the borrower and guarantor concerned to the transferee for the management of the claim. Mobilisation of credit claims is effected among other things in the form of securitisation, assignment of receivables and in the context of covered bonds. The recipient guarantees the confidentiality of the data.  

KBC Brussels may information about the credit agreements and the in which they are executed to: 

• All third parties with a legitimate interest (such as the National Bank of Belgium or third parties to whom the credit agreement may be transferred or assigned); 
• Parties that assign a rating to relevant securitisation transactions; 

To improve the operation of market forces when credit agreements are converted into securities, the European Central Bank and the EU authorities reporting requirements. These reports are not by named individual but by contract detail (such as number of borrowers, term and due date of the credit, outstanding credit amount, payment arrears, characteristics of the mortgaged pledge). This information must be made available to investors in these instruments (often as asset-backed securities or residential mortgage-backed securities). You will find on this on the website of the European Central Bank: www.ecb.int keyword: loan-level).