Personal data controller and data processing activities

Croatian National Bank, Trg hrvatskih velikana 3 (CNB) processes personal data received in relation to:

• inquiries, complaints and the notifications of complaints lodged by citizens/consumers in the area of consumer protection within the CNB’s competence;
• the issue and revocation of authorisations to credit intermediaries to provide credit intermediation services in relation to consumer housing loans (hereinafter referred to as ‘credit intermediary’);
• requests from natural and legal persons exercising their right of access to information;
• supervision of the operation of credit institutions, credit unions, electronic money institutions, payment institutions and credit intermediaries in the area of consumer protection within the CNB’s competence;

in e-mails (and attachments thereto, if any) sent to zastita.potrosaca@hnb.hr, through the e-form on the CNB’s website and in the documentation sent by mail in hard copy.

Purpose and legal basis of the processing, and the entities from which the CNB receives personal data

In the area of consumer protection within its competence the CNB processes personal data submitted by citizens in their inquiries on consumer protection regulations, in the notifications of complaints or in complaints regarding the actions of credit institutions, credit unions, electronic money institutions, payment institutions and credit intermediaries. In addition, the CNB processes data related to inquiries, the notifications of consumer complaints and consumer complaints submitted by other institutions within their powers (e.g. the Croatian Parliament Petitions and Appeals Committee, Ombudsman, Ombudsman for Children, etc.).

The CNB also processes personal data submitted by credit intermediaries, the Ministry of Justice, Ministry of Finance and State Inspectorate for the purpose of issuing authorisation to provide credit intermediation services to credit intermediaries.

The CNB also processes personal data received within requests for information submitted by natural and legal persons exercising their right of access to information.

The CNB also processes personal data submitted for the purpose of exercising supervision in the area of consumer protection within its competence by credit institutions, credit unions, electronic money institutions, payment institutions and credit intermediaries.

The processing of personal data is necessary for the fulfilment of the CNB's legal obligations and the exercise of its powers, as follows:

• the CNB’s powers in performing consumer protection activities, prescribed in Title XXIII of the Credit Institutions Act^[1] and a number of other regulations ^[2], especially the powers to address consumer complaints in accordance with Article 309 of the Credit Institutions Act, for the purpose of addressing received inquiries, the notifications of complaints and complaints;
• the CNB’s powers in the procedure of issuing and revoking authorisations to credit intermediaries prescribed in Title X of the Act on Consumer Housing Loans and Article 9 of the Decision on the necessary knowledge and competence of staff of credit institutions and credit intermediaries and on the requirements and the procedure for authorisation to provide credit intermediation services^[3], for the purpose of verifying compliance with the prescribed conditions for the issue of authorisations, including those on the necessary knowledge and competence of staff of credit institutions and credit intermediaries, and for the purpose of revoking the decision granting authorisation to provide credit intermediation services;
• the CNB’s legal obligations in the procedure based on the request for information pursuant to the right of access to information, as prescribed in Title V of the Law on the Right of Access to Information^[4]
• the CNB’s legal obligations and powers in the procedure of exercising supervision of the operations of credit institutions, credit unions, electronic money institutions, payment institutions and credit intermediaries, in the part of consumer protection related to the application of Title XXIII of the Credit Institutions Act, Title VII of the Credit Unions Act, Consumer Credit Act, Act on Consumer Housing Loans and Consumer Protection Act as well as the subordinate legislation adopted under these acts, for which the CNB is authorised pursuant to these acts.

Personal data categories

• In order to monitor consumer protection based on inquiries, the notifications of complaints or complaints against the actions of a credit institution, credit union, electronic money institution, payment institution or credit intermediary, the CNB processes the following data categories: name and surname, address, OIB (personal identification number), e-mail address, name of the service provider, number of account/contract.

If the CNB does not receive the name and surname of the consumer, OIB, contact data (e-mail or postal address) and the name of the service provider it will not be able to address the received notification of consumer complaint or consumer complaint.

• For the purpose of replying to inquiries the CNB processes the following data: the name and surname, postal address/e-mail address.

If the CNB does not receive these data, it will not be able to reply to the inquiry.

• For the purpose of issuing/revoking authorisations to credit intermediaries, the CNB processes the following personal data categories: the name and surname, OIB, birth date, address or domicile, contact telephone number, e-mail address, identity card number, name and surname of the father and mother, citizenship, business account number, CPII personal number, data on professional qualifications, employment length and employer as well as data on judgements with final force and effect of criminal offences and misdemeanours in the Republic of Croatia.

If the CNB does not receive any of the stated personal data necessary for the issue of authorisations to provide credit intermediation services in accordance with Title X of the Act on Consumer Housing Loans, it will call upon the credit intermediary to submit the necessary data within 15 days. If the credit intermediary fails to submit the required data, the CNB will adopt a decision on refusing the application for authorisation of the credit intermediary.

• For the purpose of responding to requests pursuant to the Law on the Right of Access to Information, the CNB processes the following data categories: the name and surname, postal address, e-mail address and contact telephone number.

If the CNB does not receive data important for the recognition of the required information and the name, surname and address of the natural person, it will not be able to address the request.

• For the purpose of supervising credit institutions, credit unions, electronic money institutions, payment institutions and credit intermediaries, the CNB processes the following personal data categories: the name and surname, OIB/JMBG, e-mail address, address or domicile, number of the bank or credit union account, number of the credit/deposit contract, number of payment account and contact telephone number.

If the supervised entity does not enable the CNB to process personal data that the CNB requests from the subject within the supervision procedure and, as a consequence, does not enable the CNB’s authorised person to exercise supervision in the manner prescribed by the Credit Institutions Act, Credit Unions Act, Consumer Credit Act, Act on Consumer Housing Loans and Consumer Protection Act, that is, by the subordinate legislation adopted under these acts, for which the CNB is authorised pursuant to these acts, misdemeanour proceedings can be launched against the supervised entity and an appropriate fine can be imposed in accordance with the provisions of relevant acts.

The CNB may revoke the decision on the authorisation to provide credit intermediation services of the credit intermediary that fails to submit the required information upon the CNB’s request regarding the exercise of supervision of operations in accordance with the Act on Consumer Housing Loans.

Recipients of personal data

In the cases when a consumer lodges a complaint with the CNB over the actions of a supervised subject, the CNB discloses part of personal data to the subject of the complaint (e.g. a credit institution) in order for this subject to be able to comment on the statements from the complaint. In most cases this subject already has these personal data because the consumer has already lodged the complaint directly with the subject or the consumer is also a client or former client of the supervised entity. The CNB discloses to the supervised entity only the data that are necessary for the entity to be able to comment on the complaint. The CNB also discloses part of personal data to other institutions participating in the procedure based on the consumer’s complaint pursuant to their legal authority, e.g. to the Ombudsman, Ombudsman for Children and the Croatian Parliament Petitions and Appeals Committee.

In the procedure of issuing and revoking authorisations to credit intermediaries, the CNB forwards part of the personal data received for the purpose of issuing authorisations (the name and surname, domicile/place of residence, OIB, names and surnames of the parents, sex, date and place of birth, citizenship, profession, professional qualifications, employment length and certificates of no criminal record) to the Ministry of Justice, State Inspectorate and Ministry of Finance as supervisory authorities in the cases when the application is submitted by a credit intermediary authorised in accordance with the Consumer Credit Act and for the purpose of obtaining data from the criminal records and misdemeanour records pursuant to Article 31, paragraph (4) of the Act on Consumer Housing Loans.

In the procedure of supervision of the operations of credit institutions, credit unions, electronic money institutions, payment institutions and credit intermediaries in the area of consumer protection, the CNB discloses part of personal data to the supervised entity in order to enable this subject to comment on the statements from the report on examination findings. In most cases this subject already has these personal data because the consumer is also a client or former client of the supervised entity.

Keeping personal data

The CNB keeps data received in connection with:

• • consumer inquiries, notifications and complaints – 10 years;
• applications for authorisations to provide credit intermediation services in relation to consumer housing loans – 10 years;
• the exercise of supervision of the legality of operations of credit institutions (banks, savings banks and housing savings banks), credit unions, electronic money institutions, payment institutions and credit intermediaries in the area of consumer operations – 20 years;

with this period starting on the last day of the year in which the procedure was completed, in accordance with the Act on Archival Materials and Archives[5] and the ordinance governing the protection and processing of archival and registration materials of the CNB.

Your rights

The CNB, in accordance with the provisions of General Data Protection Regulation^[6], ensures the following rights in relation to the processing of your personal data: a) the right to information on the processing and access to personal data, b) the right to rectification, c) the right to erasure ("right to be forgotten") d) the right to restriction of processing and e) the right to object.

More information on this topic and forms required for the exercise of your rights are available at https://www.hnb.hr/zastita-osobnih-podataka.

Data protection officer and supervision

The supervisory authority for the protection of personal data in the Republic of Croatia is the Croatian Personal Data Protection Agency, Zagreb, Selska cesta 136, with which you can lodge a complaint about CNB’s actions regarding the processing of your personal data.

Any additional inquiries on the processing of personal data may be requested by e-mail from the Croatian National Bank data protection officer at: sluzbenik.osobni@hnb.hr.

1. Credit Institutions Act (OG 159/2013, 19/2015, 102/2015, 15/2018, 70/2019, 47/2020, 146/2020 and 151/2022, hereinafter referred to as ‘Credit Institutions Act’) ↑

2. Credit Unions Act (OG 141/2006, 25/2009 and 90/2011, hereinafter referred to as ‘Credit Unions Act’), Consumer Protection Act (OG 19/2022 and 59/2023 (hereinafter referred to as ‘Consumer Protection Act’), Consumer Credit Act (OG 75/2009, 112/2012, 143/2013, 147/2013, 9/2015, 78/2015, 102/2015, 52/2016, 128/2022 and 156/2023, hereinafter referred to as ‘Consumer Credit Act’), Act on Consumer Housing Loans (OG 101/2017, 128/2022 and 156/2023, hereinafter referred to as ‘Act on Consumer Housing Loans’) and the subordinate legislation adopted pursuant to these acts ↑

3. Decision on the necessary knowledge and competence of staff of credit institutions and credit intermediaries and on the requirements and the procedure for authorisation to provide credit intermediation services (OG 107/2017 and 22/2019) ↑

4. Law on the Right of Access to Information (OG 25/2013, 85/2015 and 69/2022, hereinafter referred to as ‘Law on the Right of Access to Information’); ↑

5. Act on Archival Materials and Archives (OG 61/2009, 98/2009, 114/2010 and 36/2024) ↑

6. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC OJ EU L 119, in force since 25 May 2018 ↑