Data Privacy Notice

on the duties of disclosure upon

the collection and processing of personal data

for customers subject to GDPR rights

Page 1 of 7

Table of contents

Who is responsible for data processing and how can I contact them? ..................................... 2

What data is used by Habib Metropolitan Bank? .......................................................................... 2

For what purpose and on what legal basis does Habib Metropolitan Bank use your data?.... 3

3.1

For the fulfilment of contractual obligations ....................................................................................... 3

3.2

For the safeguarding of Habib Metropolitan Bank

’s and third party interests .................................... 3

3.3

On the basis of your consent ............................................................................................................. 3

3.4

On the basis of statutory requirements or in the public interest ......................................................... 3

Who can access your data? ............................................................................................................ 4

4.1

Habib Metropolitan Bank Group ......................................................................................................... 4

4.2

External recipients of data .................................................................................................................. 4

4.3

Service providers and agents ............................................................................................................. 4

Does Habib Metropolitan Bank transfer data across borders? ................................................... 4

How long will your data be stored? ................................................................................................ 5

What are your rights? ...................................................................................................................... 5

What data are you asked to supply? .............................................................................................. 6

Is the decision-making automated? ............................................................................................... 6

Will cookies be collected? .............................................................................................................. 6

10.1

What are cookies? .............................................................................................................................. 6

10.2

Why do we use them? ........................................................................................................................ 6

10.3

Type of cookies used ......................................................................................................................... 6

10.4

How should I manage my settings with respect to cookies?.............................................................. 7

Will your data be automatically processed? ................................................................................. 7

Will biometric data be used? .......................................................................................................... 7

Where can you find the current privacy notices? ......................................................................... 7

How can you contact Habib Metropolitan Bank ............................................................................ 7

Data Privacy Notice

Page 2 of 7

The following information is intended to provide you with an overview of how your data is processed by Habib
Metropolitan Bank Limited and your rights extended to customers subject to GDPR. The details of what data
will be processed and which method will be used depend significantly on the services applied for or agreed
upon. We therefore ask you to familiarize yourself with this Data Privacy Notice.

Who is responsible for data processing and how can I contact
them?

The legal entity responsible is:

Habib Metropolitan Bank Limited

Spencer’s Building

I.I. Chundrigar Road

Karachi, Pakistan

Our Privacy Officer can be reached at:

Email:

dataprivacy@habibmetro.com

What data is used by Habib Metropolitan Bank?

Habib Metropolitan Bank processes data that it receives from its clients and that it generates as part of the
business relationship with its clients. In order to facilitate, enable and / or maintain our business relationship,
Habib Metropolitan Bank collects and otherwise processes personal data relating to clients and any other
person(s) involved in the business relationship, as the case may be, such as authorized representative(s),
person(s) holding a power of attorney and beneficial owners, if different from the client (collec

tively, an ‘Au-

thorized Person’).

Personal data is the personal information of a client or an Authorized Person, identification data and authenti-
cation data. Furthermore, this can also be order data, data from the fulfilment of our contractual obligations,
information about a client’s or Authorized Person’s financial situation, marketing data, sales data and / or
documentation data.

In addition to data that Habib Metropolitan Bank receives directly from its clients, it also obtains and processes
data on its clients that is available in the public domain or from other entities within the Habib Bank Group of
companies (the ‘Habib Bank Group’).

In summary, personal data processed by Habib Metropolitan Bank may include the following:



personal details (e.g. name, address and other contact data, date and place of birth, as well as
nationality)



identification data (e.g. identification documentation data)



authentication data (e.g. specimen signature)



order data (e.g. payment orders)



data arising from the fulfilment of obligations (e.g. data required for payment transactions)



information regarding a client’s financial situation (e.g. credit reports, scoring / rating data, origin of
assets)

Data Privacy Notice

Page 3 of 7



record-keeping data (e.g. minutes of consultation)



data available from the public domain (e.g. internet, social media, debtor directories, land register,
trade association registers, media, etc.)



other comparable data in line with the criteria outlined above.

For what purpose and on what legal basis does Habib Metropolitan
Bank use your data?

3.1

For the fulfilment of contractual obligations

The processing of your data allows Habib Metropolitan Bank to provide you with the contractually agreed
services or to carry out pre-contractual measures that occur as part of a request from an interested party. The
purposes of data processing are primarily in compliance with specific banking products (e.g. accounts, loans,
securities, deposits, brokerage services). Your data will be used, among other purposes, for the analysis of
any potential needs, the provision of advice, wealth management, and to support the execution of transactions.

Further details can be found in your contract documents or in the General Terms & Conditions.

3.2

For the safeguarding of Habib Metropolitan Bank

’s and third party interests

Where required, we process your data beyond the actual fulfilment of the contract for the purposes of the
legitimate interests pursued by us or a third party. For example:



Consulting with credit rating agencies to investigate creditworthiness and credit risks.



Reviewing and optimizing procedures for needs assessment for the purpose of direct client discus-
sions.



Obtaining personal data from publicly available sources for client acquisition purposes.



Testing and optimization of processes for requirement analysis or client contact.



Measures for business management and further development of services and products.



Risk control at Habib Metropolitan Bank and Habib Bank Group.



Asserting legal claims and a defense in legal disputes.



Guarantee of Habib Metropolitan Bank and

Habib Bank Group’s IT security and IT operations.



Prevention and investigation of crimes.



Video surveillance and measures to protect the rights of an owner of premises to keep out trespass-
ers and to provide security (e.g. access controls).

3.3

On the basis of your consent

As long as you have granted us consent to process your personal data for certain purposes (e.g. analysis of
trading activities for marketing purposes), this processing is legal on the basis of your consent. Consent can
be withdrawn at any time.

Withdrawal of consent does not affect the legality of data processed prior to withdrawal.

3.4

On the basis of statutory requirements or in the public interest

We are subject to various legal obligations, meaning statutory requirements (e.g. Banking Companies Ordi-
nance 1962, Anti-Money Laundering Act 2010, State Bank of Pakistan (SBP) Regulations including Anti-
Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing

Data Privacy Notice

Page 4 of 7

(AML/CFT/CPC) Regulations and, Income Tax Ordinance, 2001 as amended from time to time etc.) and Habib
Metropolitan Bank has to fulfil requirements outlined by banking specific regulation. The processing of data is
used, among others, for the verification of creditworthiness as well as identity and age, the prevention of fraud
and money laundering, the fulfilment of tax-related monitoring and reporting obligations as well as the assess-
ment and management of risks of Habib Metropolitan Bank and the Habib Bank Group.

Who can access your data?

4.1

Habib Bank Group

We may share your data with other entities in the Habib Bank Group where required to fulfil our contractual
and legal obligations. We may transfer your personal data to other members of the Habib Bank Group for risk
control purposes in connection with statutory / regulatory obligations. We may also share information with other
members of the Habib Bank Group in connection with services that we believe may be of interest to you.

4.2

External recipients of data

We will transfer personal data about you in the course of conducting our usual business or if legal, regulatory
or market practice requirements demand it to the following external recipients, or if you have given consent
(e.g. to process a financial transaction you have ordered us to fulfil) for the following purposes:



to public entities and institutions (e.g. financial authorities, State Bank of Pakistan, law enforcement
authorities)



to other credit and financial services institutions or similar institutions to which Habib Bank transfers
personal data within the context of its business relationship with you (e.g. correspondent banks,
custodian banks, brokers, stock exchanges, information agencies)



to third parties (for example correspondent banks, brokers, exchanges, trade repositories, pro-
cessing units and third party custodians issuers, authorities and their representatives) for the purpose
of ensuring that we can meet the requirements of applicable law, contractual provisions, market
practices and compliance standards in connection with transactions you enter into and the services
that we provide you with, or



to a natural or legal person, public authority, agency or body for which you have given us your con-
sent to transfer personal data to or for which you have released us from banking confidentiality.

4.3

Service providers and agents

We will transfer your personal data to service providers and agents appointed by us for the purposes given,
subject to maintaining banking confidentiality. These are companies in the categories of banking services, IT
services, logistics, printing services, telecommunications, collection, advice and consulting and sales and mar-
keting.

Habib Metropolitan Bank will implement appropriate organizational and technical safeguards to protect the
personal data for which it acts as data controller at all times.

Does Habib Metropolitan Bank transfer data across borders?

Data transfer to legal entities in countries outside of Pakistan takes place so long as:



it is necessary for the purpose of carrying out your orders (e.g. payment and securities orders)



it is required by law (e.g. reporting obligations under financial regulation), or

Data Privacy Notice

Page 5 of 7



if you have given your consent.

These data transfers are secured through corresponding guarantees of the recipients to ensure an appropriate
level of data protection.

How long will your data be stored?

We will process and store your information as long as it is necessary in order to fulfil our contractual, regulatory
and statutory obligations. It should be noted here that our business relationship is a long-term obligation, which
is set up on the basis of periods of years.

We will assess and respond to requests to delete data. We will delete data provided that the data is no longer
required in order to fulfil contractual, regulatory or statutory obligations, or the fulfilment of any obligations to
preserve records according to commercial and tax law.

We will normally retain your records for a minimum of ten years after closure of the account to comply with
regulatory and contractual requirements unless there is a particular reason to hold records for longer, including
legal hold requirements, which require us to keep records for an undefined period of time.

What are your rights?

Your data protection rights include the following:



Right of access: requesting that information on your personal data that Habib Metropolitan Bank
holds on record be shared with you.



Right to rectification: demanding that the information be rectified should it be incorrect.



Right to erasure: asking that your data be deleted if Habib Metropolitan Bank is not permitted or is
not legally obliged to retain your data.



Right to restrict processing: demanding that the processing of your data be restricted if:



you have disputed the accuracy of your data stored by Habib Bank and it has not yet com-
pleted its assessment



you object to the deletion of your data although Habib Metropolitan Bank is obligated to delete
it, or



you have objected to the processing of your data but it has not yet been established whether
this outweighs Habib Bank’s reasons for processing your data.



Right to object: objecting to the processing of your data by Habib Bank if it processes your data on
the basis of its legitimate interest (it will cease this processing unless it is outweighed by compelling
and legitimate grounds).



Right to data portability: demanding that your personal data that you have provided to Habib Met-
ropolitan Bank be transferred in a generally useable, machine-readable and standardized format.

You also have the right of appeal (as far as this affects you) to your respective Data Protection Supervisory
Authority.

A legal hold period is a process that an organisation uses to preserve all forms of relevant information when

litigation is reasonably
anticipated.

Data Privacy Notice

Page 6 of 7

What data are you asked to supply?

In the context of your relationship with Habib Metropolitan Bank, you must provide all personal data that



is required for accepting and carrying out a business relationship and fulfilling the accompanying con-
tractual obligations, and



Habib Metropolitan Bank is legally required to collect.

Without this data, Habib Metropolitan Bank will most likely be unable to enter into a contractual relationship
with you.

Under  the  regulations  on  combatting  money  laundering  and  the  financing  of  terrorism,  Habib  Metropolitan
Bank is obligated to verify your identity on the basis of your identification documents and, in this context, to
collect and store your address, nationality, name, date and place of birth, tax residency and tax identification
number, and identification data prior to the commencement of a business relationship. In order for Habib Met-
ropolitan Bank to comply with these regulations, you are required to supply it with the necessary information.
If  this  information  changes  during  the  course  of  the  business  relationship,  you  are  obliged  to  notify  Habib
Metropolitan Bank without delay. If you do not provide Habib Metropolitan Bank with the necessary information,
it will not be able to commence or continue a business relationship with you.

Is the decision-making automated?

No. Habib Bank does not use automated decision-making.

Will cookies be collected?

Yes. Habib Metropolitan Bank does collect cookies.

10.1

What are cookies?

Cookies are information packages sent by a web server (in this case this website) to your internet browser,
saved on your computer and checked by the server on each subsequent visit to the site. To gain full benefit
from this website, we recommend that you configure your browsers to accept cookies.

10.2

Why do we use them?

Cookies are used to facilitate navigation within the website and correct use. They also serve a statistical pur-
pose, making it possible to establish which areas of the site have been visited, and to improve and update
user procedures.

10.3

Type of cookies used

For further information about the types of cookies

used please refer to our “Cookies Notice” on our website.

Data Privacy Notice

Page 7 of 7

10.4

How should I manage my settings with respect to cookies?

To optimise your use of our website, we recommend that you accept the cookies. Most internet browsers are
initially set to accept cookies. You can at any time set your browser to accept all cookies, just some cookies
or no cookies. In the latter case, you would disable use of part of the sites. Additionally, you can set your
preferences in the browser so that you will be notified whenever a cookie is saved on your device. Please note
that if you disable the cookies, you may not have optimum use of the site.

Will your data be automatically processed?

We process some of your data automatically, with the goal of assessing certain personal aspects (profiling).
For example we may use profiling in the following ways:



In order to combat money laundering, the financing of terrorism, and criminal acts, Habib Metropoli-
tan Bank also conducts data assessments (among others in payment transactions). The aim of these
measures is to protect you.



Habib Metropolitan Bank uses assessment tools to provide clients with relevant and appropriate
information on its products and services. These allow communications and marketing to be tailored,
as needed, including market and opinion research.



Habib Metropolitan Bank uses assessment tools in order to be able to specifically notify you and
advise you regarding products. These allow communications and marketing to be tailored as needed,
including market and opinion research.

Will biometric data be used?

Yes. Habib Metropolitan Bank verifies

a customer’s biometric data at account opening/dormant account reac-

tivation as per regulatory requirements.

Where can you find the current privacy notices?

This Data Privacy Notice can be adapted at any time in accordance with corresponding regulations. You can
find the applicable version at

https://www.habibmetro.com/wp-content/uploads/2021/06/Privacy_Data_Notice.pdf

How can you contact Habib Metropolitan Bank

Should you have any questions about the treatment of your data, please contact your Relationship Manager
or Habib Metropolitan Bank

’s Privacy Officer, who will be happy to assist you.

* * *