Privacy Policy

 

1.0 Purpose of this Privacy Policy

1.1 PROVEN Bank (Saint Lucia) Limited (“PBSL”, “we”, “us”, “our”), together with its affiliated companies, significantly values your trust in us. We truly understand our duty to protect and responsibly collect, use, store and disclose the personal information that you share with us, and we pledge our commitment to fulfilling that responsibility.

1.2 This Privacy Policy describes how PBSL collects and uses personal data and information about you in accordance with the applicable data protection legislation.

1.3 Proven Bank recognises the importance of this data and the risks related to its possession of such data. Proven Bank is committed to protecting the privacy and security of your personal information.

1.4 PBSL is a “data controller” for the purpose of the Data Protection Act Cap 8.18 of the Laws of Saint Lucia. This means that we are responsible for deciding how we hold and use personal data and information about you. To comply with data protection legislation and best practice we are required to notify you of the information contained in this Privacy Policy.

1.5 This Privacy Policy sets out your rights under applicable data protection laws as well as our commitment to you regarding how we treat your data. We may update this Privacy Policy at any time. Where material changes are made, an updated version will be made available.

1.6 It is important that you read this Privacy Policy, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

2.0 About PBSL

2.1 PBSL forms part of the PROVEN Bank group of companies. You will be informed which Proven entity you have a relationship with, and that entity will be responsible for controlling your personal information. More details on PBSL are available at PROVEN Bank – Saint Lucia.

2.2 PROVEN Bank has appointed a PBSL Local Information Officer and/or Data Protection Officer responsible for overseeing compliance with this Privacy Policy, the data protection obligations under the Saint Lucia Data Protection Act and group standards.

2.3 If you have questions or concerns regarding the processing of your personal data and information or wish to request access to, correction of, or updates to your personal data, you may contact us through any of the following channels:

  • In Branch – Visit any PBSL branch and speak with a customer service representative for further information
  • Contact PBSL’s Local Information Officer – via mail, email or telephone:

PROVEN Bank (Saint Lucia) Limited
PROVEN House, Rodney Bay Marina
P.O. Box RB 2385, Gros Islet, Saint Lucia
Tel: +1 246 467 7577
Email: sluinfo@weareproven.com

  • Contact PROVEN Bank’s Data Protection Officer – via email: info@wereproven.com
  • Online Banking Portal – Submit a request through the secure messaging centre – PROVEN Connect

3.0 Data Protection Principles

3.1 PBSL complies with the data protection principles set out in the Data Protection Act of Saint Lucia. This means that personal data or personal information we hold about you will be:

  • Processed or used lawfully, fairly and transparently;
  • Collected only for valid and legitimate purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
  • Relevant and limited to what is necessary;
  • Accurate and, where necessary, kept up to date;
  • Kept only for as long as necessary for lawful purposes; and
  • Processed in a manner that ensures appropriate security and confidentiality.

4.0 The types of information we collect

4.1 “Personal data”, or personal information, means any information about an individual (recorded in any form) from which that individual can be identified. It does not include data where the identity has been removed (anonymous data).

4.2 The types of personal information we may collect (directly from you or third parties) depend on the nature of the relationship that you have with PBSL. Regardless of the source, we only collect information relevant for the specific purposes described below and on recognised lawful bases (see “Lawful Bases for processing of personal data and information” Clause 6), except where required by law, to protect the interests of PBSL or in the discharge of public duty. Data will be maintained in accordance with timelines directed by the necessary policies and applicable laws.

4.3 We may collect, store, process and use the following categories of personal information:

  • Personal contact details such as name (including former names and aliases), title, addresses, email addresses, telephone numbers;
  • Date and place of birth;
  • Marital status and dependents;
  • National identification numbers, passport or driver’s license details (including copies of identification documentation, photographic identification and/or fingerprints);
  • Banking, account, payment and transactional details and history, and credit information;
  • Education, medical, criminal or employment history, business, professional and tax‑related information;
  • Investment preferences, risk profile and financial objectives;
  • Correspondence with you of a private or confidential nature;
  • Referrals, references, views or opinions of any other person/entity about you;
  • Telematics data, website and digital usage information, including cookies and similar technologies;

4.4 Special categories of personal information or “sensitive personal data” may be collected and stored incidentally or where required by law, including information relating to racial or ethnic origins, political opinions, religious beliefs or other beliefs of a similar nature, health, sexual orientation or sexual life, criminal record and/or financial records. These special categories of personal information require a higher level of protection as detailed below (see “Sensitive personal data and information” Clause 10).

5.0 How are your personal data and information collected and updated?

5.1 We may collect personal data and information about you:

  • Directly from you during onboarding as a PBSL or PROVEN Bank customer/client and throughout our relationship;
  • From intermediaries or introducers;
  • From transactions conducted with us;
  • From regulators, credit reference agencies, fraud prevention agencies, background check agencies, consumer reporting agencies and other lawful sources; and
  • Through our websites, mobile applications and online portals.

5.2 We take reasonable steps to ensure that personal data processed is accurate, complete, and, where necessary, kept up to date, having regard to the purposes for which the data is processed. Personal data shall, wherever practicable, be collected directly from you or from reliable and authorised sources. At the point of onboarding or engagement, we shall apply appropriate verification measures to confirm the accuracy of core identification and contact information. (See the “Your Duties and Rights” Clause 15). Where personal data is obtained from group entities or third-party service providers, we shall take reasonable steps to ensure that such data is reliable, relevant, and kept up to date, including through contractual obligations and periodic reviews where appropriate. We implement procedures to periodically review personal data to ensure continued accuracy and relevance. We maintain technical and organisational measures designed to reduce the risk of inaccurate or outdated data, including access controls, audit trails, and change-management procedures within its information systems and maintain appropriate records of material data updates, corrections, and accuracy-related requests, in order to demonstrate compliance with applicable data protection obligations.

5.3 We collect two types of information about users of our websites and/or mobile applications:

  • Information that users provide through optional, voluntary submissions. These are voluntary submissions from disclosures regarding customers’ profile and participation in polls, surveys, completion of online forms and subscriptions for services.
  • Information that we gather through aggregated usage tracking and information derived mainly by tallying page views throughout our sites and telematics data. Although we track user traffic patterns throughout all our sites, we do not correlate this information with data about individual users. We break down overall usage statistics according to a user’s domain name, browser type, and MIME (Multipurpose Internet Mail Extension) type by reading this information from the browser string (information contained in every user’s browser). This information allows us to better tailor our content to user’s needs and to better understand the demographics of our audience. Compiling such aggregated demographic data is essential to keeping our service up to date for our users.

6.0 Lawful bases for processing personal data and information

6.1 PBSL will only process your personal data and information where required and/or permitted by law, or when you have provided, consent where consent is required by law.

6.2 We will only process your personal data and information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

  • Where we need to perform the contract we have entered into with you;
  • In order to take steps required by you prior to entering into a contract;
  • Where we need to comply with a legal or regulatory obligation;
  • For the administration of justice;
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;

6.3 We may also process your personal data and information in the following situations, which are likely to be rare:

  • Where we need to protect your vital interests (or someone else’s interests);
  • Where it is needed in the public interest or for official purposes.

6.4 Do we need your consent? – We do not need your consent if we use your personal data and information in order to carry out our contractual or legal obligations or exercise specific rights under the law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

7.0 Purposes for which we use your personal data and information

7.1 We use your personal information primarily to:

  • Provide and administer banking, investment, lending, insurance and/or related financial services;
  • Meet legal, regulatory, and reporting obligations;
  • Manage risk, prevent fraud and ensure security;
  • Communicate with you regarding your accounts and services;
  • Improve our products, services and digital platforms; and
  • Conduct legitimate business operations.

7.2 In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

7.3 We may use your information provided through analytics to enhance your experience on our website, whether to provide interactive or personalized elements on the website; to better prepare future content based on your  interests or to develop new leads for potential sales.

7.4 Some of these purposes may overlap, and more than one lawful basis for processing your personal data and information may apply.

8.0 Failure to provide personal data and information

8.1 If you fail to provide certain information when requested and/or required by law and/or contract, we may be unable to provide our products or services and/or perform the contract we may have entered into with you (such as processing a transaction on your behalf), or we may be prevented from complying with our legal obligations (such as to ensure that you are properly identified for the purposes of anti-money laundering legislation).  Persistent failures to provide certain information may lead us to take measures which may include asking you to close your account and terminate your relationship with us.

9.0 Change of purpose

9.1 We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Where required by law, we will notify you of any such change and the applicable lawful basis which allows us to do so.

9.2 Please note that we may process your personal data and information without your knowledge or consent where this is required and/or permitted by law.

10.0 Sensitive personal data and information

10.1 PBSL will only process special categories of personal information or sensitive data where you have given your explicit consent to processing or have published the personal data, or where permitted by law, including:

  • Where processing is necessary in situations provided for above (see “Lawful Bases for processing of personal data and information” Clause 6);
  • Where we need it to carry out our legal obligations;
  • Where processing is provided for in regulations having regard to the public interest; or
  • Where it is needed to protect your vital interests (or someone else’s vital interests) and you cannot give your consent and/or we cannot reasonably be expected to obtain your consent and/or you unreasonably withhold consent.

11.0 Automated Decision‑Making

11.1 PBSL does not currently engage in decision making based solely on automatic processing of personal data and information. Should this change, you will be notified and appropriate safeguards will be implemented in accordance with applicable law.

12.0 Data Sharing and Intended Recipients of Personal Data

12.1 We will disclose/share your personal data and information with third parties where permitted and/or required by law and/or in accordance with the Clauses above (see “Lawful Bases for processing of personal data and information” and “Purposes for which we use your personal data and information” Clauses 6 and 7), where it is necessary to administer the working relationship with you and/or where we have another legitimate interest in doing so.

12.2 We may share your personal data and information with:

  • Other PROVEN group entities and other service providers;
  • Third‑party service providers such as those who help us work with your accounts and operate our business and/or professional advisers;
  • Revenue and Customs agencies; regulators, law enforcement agencies and other authorities;
  • Credit reference and fraud prevention agencies;
  • Entities you ask us to share your personal data with;
  • Other lenders who lend to you;
  • Credit card companies and direct debit operators; and
  • Other parties where required or permitted by law.

12.3 If the make-up of the PROVEN Bank changes or such changes are proposed we may share your data with third parties to allow us to sell, merge or transfer aspects of our business or acquire or merge into other businesses. We will only do this if they agree to keep your data to the same standards we have set for holding your data. Following such a change other parties may use your data in line with these standards.

12.4 All third parties with whom we share your personal data/information are required to protect your personal data and information and process it for specified purposes in accordance with our instructions/policies and/or applicable law.

12.5 Your personal information may be transferred outside Saint Lucia, including within the PROVEN group. Where this occurs, PBSL ensures that appropriate safeguards are in place to provide an equivalent level of protection, including contractual and organizational measures.

12.6 Transferring information outside the European Union (EU) – In order to perform our contract with you, we will transfer the personal data and information we collect about you to the following countries outside the EU:

  • Cayman Islands
  • Jamaica

There is no an adequacy decision by the European Commission in respect of all of those countries. This means that the countries to which we transfer your data are not deemed to provide an adequate level of protection for your personal information.

12.7 However, to ensure that your personal information does receive an adequate level of protection we have put in place internal policies and contractual clauses in line with international standards to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the applicable laws on data protection.

12.8 If you require further information about these protective measures, you can request it from your Local Information Officer (see “About PBSL” Clause 2).

13.0 Data Security

13.1 PBSL maintains administrative, technical and physical safeguards designed to protect personal data and information against accidental, unlawful or unauthorised access, loss, alteration or disclosure. Access is restricted to authorised personnel on a need‑to‑know basis. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

13.2 We operate secure data networks which comply with the industry standards for information systems security. Our security and privacy policies are periodically reviewed and enhanced as necessary and only authorized individuals have access to the information provided by users.

13.3 Our employees receive training, are bound by a Code of Conduct requiring that all information be kept in strict confidence, and they are subject to disciplinary action for violation of the Code. We restrict access to information about you to only those employees who need to know that information to perform their job. We maintain physical, electronic, and procedural safeguards, which comply with local laws and regulations to guard your information.

13.4 We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

14.0 Data Retention

14.1 We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, reporting and Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) requirements. Retention periods are determined having regard to:

  • The nature and sensitivity of the data;
  • Legal and regulatory minimum retention periods, for instance, the Money Laundering (Prevention) Act Cap 20.20 of Saint Lucia provides for a seven-year retention period of all transaction records, account opening records including verification documentation and banking records of the like which may comprise of your personal data and/or sensitive personal data;
  • Ongoing business or litigation requirements.

14.2 In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

14.3 Where the purpose for retaining your personal data has lapsed, we shall destroy your personal data and render it inaccessible as soon as reasonably practicable.

14.4 When we destroy your personal data, we will use safeguards to prevent unauthorized parties from gaining access to your personal data and information during the process.

15.0 Your Duties and Rights

15.1 You have a duty to inform us of changes to your personal data. It is important that the personal data and information we hold about you is accurate and current. Please keep us informed if your personal data and information changes during your relationship with us.

15.2 Subject to the Data Protection Act of Saint Lucia, you have the right to:

  • Request access to your personal data and information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
  • Request correction of inaccurate or incomplete information, as it is important that the personal data we retain about you is accurate, complete and up-to-date to meet our data quality standards and responsibilities;
  • Request erasure or destruction of personal data and information, where permitted by law;
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request data transfer, where applicable; and
  • Withdraw your consent where processing is based on your consent – In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact your Local Information Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

15.3 Requests under this clause should be made in writing using the contact details above (see “About PBSL” Clause 2). We may require proof of identity before processing requests, to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

15.4 You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

16.0 Marketing

16.1 We may use your personal data and information to inform you about products and services that may be of interest to you. Before doing so we may use your personal information to better understand what services or products you are likely to need or have use for. You may opt out of marketing communications at any time.

17.0 Cookies

17.1 We use “cookies” on our website. These are small pieces of data that allow us to track which computers visit our website and how. We may place a text file called a “cookie” in the browser files of your computer. The cookie itself does not contain personal information although it will enable us to relate your use of this site to information that you have specifically and knowingly provided. However, the only personal information a cookie can contain is information that you supply yourself. A cookie cannot read data off your computer or read cookie files created by other sites. When visiting one of our sites for the first time, you will be prompted with a pop-up box to accept or decline our use of cookies. Should you decline to allow cookies, some features of our sites may be unavailable to you. Should you consent to our use of cookies, the cookie will be deleted once you end your session by closing your browser. If you have set your browser to warn you before accepting cookies, you will receive the warning message with each cookie. You do not need to have cookies turned on to use this site. However, you do need cookies to participate actively in features such as but not limited to online message boards, forums, polling and surveys.

18.0 Changes to this Privacy Policy

18.1 We reserve the right to update and/or change this Privacy Policy at any time. Updated versions will be made available and, where appropriate, notified to you.

19.0 Questions and Complaints

19.1 If you have any questions, concerns or complaints regarding this Privacy Policy or the processing of your personal information, please contact us using the contact details above (see “About PBSL” Clause 2).

 

If you have questions or concerns regarding the processing of your personal information, you may contact us at: sluinfo@weareproven.com

This Website uses cookies to improve the user experience. By using our site, you’re agreeing to our use of cookies.
For more information please click here. close