Privacy Statement

Personal data are data that directly or indirectly provide information about you.
Examples of this include your name, address or income. Details about a sole proprietorship, general partnership or professional partnership can be considered personal data as well. This does not apply to details of a legal entity, such as a private company with limited liability (BV) or public limited liability company (NV). Details of individuals such as a representative of a legal entity, however, are personal data.

Anything that can be done with your personal data is considered processing it.
This includes collecting, inspecting, adapting, and providing personal data, and passing it on, retaining it, and deleting it.

Coöperatieve Rabobank U.A. is responsible for that. Rabobank’s registered office is in Amsterdam. Our head office is located at Croeselaan 18, 3521 CB in Utrecht. We are listed in the Commercial Register under number 30046259. This Privacy Statement pertains to the processing of personal data by Coöperatieve Rabobank U.A. in the Netherlands, and the processing of personal data by the following Group entities:

To whom does this privacy statement not apply?
It does not apply to large corporate customers that come under Wholesale Banking. There are separate privacy statements that apply to them. Information on Rabobank Wholesale Banking’s processing of personal data in the Netherlands can be found at Rabobank.com/privacy. It also contains information on Rabobank’s processing of personal data outside of the Netherlands. Other subsidiaries and associates of Rabobank Group have separate privacy statements in place. In addition, there is a separate privacy statement for employees and applicants of Rabobank in the Netherlands. The same applies to members of Rabobank’s local supervisory boards.

Cookies and information documents for other services
We make use of cookies. Our website contains information on how we use cookies and similar techniques. Sometimes, there is a separate privacy statement for a certain service, or a separate information document. In such case, this applies in addition to this Privacy Statement. If we collaborate with another company or organization, that other company or organization sometimes provides information on the processing of personal data as well.

We do not retain your data for longer than is necessary for the purposes for which we collected it or for which we reuse it. In most cases, it is retained for seven years after termination of the agreement or the ending of your business relationship with Rabobank. In some cases, it needs to be retained for longer, for example at the request of a regulator, the police, or the Public Prosecution Service. Sometimes, the retention periods are shorter. Details such as those relating to a payment order are usually retained for only two years, We usually retain conversation recordings for six months, chat conversations for fourteen months, and camera images for four weeks. However, sometimes we have to retain these for longer, for example in the case of investment services or based on the Anti-Money Laundering Regulation, which will come into effect over the course of 2027. This regulation provides for a 5-year retention period for some data.

In special situations, we may retain data for longer. This may be the case if – for example – judicial authorities request camera images, in which case we will keep the images for longer than four weeks, or if you have submitted a complaint in connection with which the underlying data have to be retained for longer.

If we no longer need the data for the purposes described in Chapter 8, we may still retain the data for archiving purposes. In such case, the data can be used in legal proceedings, and for historical or scientific research or statistical purposes.

If you have shown an interest in Rabobank products or services, but eventually decided against purchasing a product or service, we may still retain your data for some time.

Automatic decisions are decisions about you made by computers instead of humans. If a decision adversely affects you, we are not allowed to make an automated decision about you, except if this is necessary as part of an agreement of the bank, if it is permitted by law, or if you have consented to it. In those situations, you have the right to consult with someone at the bank, and you have the right to object. You can also ask us to stop having the decision made by computers.

These are examples of fully automated decisions that have consequences for you, which may include negative consequences:

a. Within Rabobank Group
Your personal data may be exchanged between entities of the Rabobank Group.

We may do so because – for example – you have asked us to, or because you also purchase a product from another Rabobank entity. Data that establishes your identity may also be used by another Rabobank entity with which you want to do business. We may also exchange your data within the framework of fraud prevention, the prevention of money laundering, for risk management and internal administration purposes, to improve the provision of our services to you, and within the framework of the duty of care. Entities of the Rabobank Group are sometimes located in countries outside the European Union where less stringent privacy rules apply. If we share your data with entities of Rabobank Group in which Rabobank has a controlling interest, In such case, Rabobank’s so called binding company rules apply. These are also referred to as the ‘Binding Corporate Rules’. More information on this can be found on our website.

b. Outside Rabobank Group
Your data are also passed on to other parties outside Rabobank if we are legally obliged to do so, need to do so in the performance of our agreement with you, or because we have engaged another service provider. If we pass your data on to another party that is responsible for the processing of such personal data itself, that party will be under the supervision of its own regulator in the field of data protection.
This may be a Dutch regulator, but may also be a foreign one.

Competent public authorities and other authorities
We transfer your personal data to third parties if we are required to do so, for example to national or European regulators, such as the Dutch Authority for the Financial Markets [Autoriteit Financiële Markten – AFM], the Dutch Data Protection Authority [Autoriteit Persoonsgegevens], Nederlandsche Bank, the European Central Bank, the Netherlands Authority for Consumers and Markets [Autoriteit Consument en Markt – ACM], the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), the Dutch Tax Administration. In addition, we transfer your data to the Foundation for Banking Ethics Enforcement [Stichting Tuchtrecht Banken], Financial Services Complaints Tribunal [Kifid], the BKR, and the Dutch Data Protection Authority.

As part of the Code of Conduct for the Dutch banking sector, we sometimes have to provide personal data to the Foundation for Banking Ethics Enforcement [Stichting Tuchtrecht Banken]. If you submit a complaint to Kifid, a court or the Dutch Data Protection Authority, your personal data may have to be provided as well, for example to defend ourselves against your complaint. The same applies if you object directly to the BKR. Sometimes, a court determines that we must share certain personal data about you with someone else.

The Dutch Tax Administration, the police and the Public Prosecutor’s Office may request data from us based on a legal duty or authorization, as may – for example – intelligence services and benefit agencies (such as the UWV). In such case, we are required to cooperate in investigations and/or pass on data about you. Sometimes, we also pass on data to Safe at Home [Veilig Thuis].

In certain cases, we also have to pass on data to the BKR if we provide you with a credit facility or give you a loan, such as the amount of the credit facility or loan, or if you fail to make a payment on time.

The law may also stipulate that we provide access to your data to another person, at the relevant person’s request.

We may provide access to another person, another company or another organization. It goes without saying that the applicable statutory requirements must be met. We may – for example – be required to provide information pursuant to Section 194 of the Dutch Code of Civil Procedure, or in connection with pending legal proceedings in which Rabobank is asked to provide information and we decide to actually provide the requested information.

Other service providers
We also transfer data if this is necessary in order to comply with our arrangements with you, for example because other companies or organizations are involved in making payments possible, such as Swift, Mastercard, Visa, iDEAL, and EPI, the company behind Wero. In addition, the recipient of the payment, such as a web store, may have engaged a payment service provider.

Some international transfers involve not only the beneficiary’s bank, but one or more correspondent banks as well. In such case, all these banks process your personal data. If you make a payment to an account with another bank, or make a payment via another bank within or outside Europe, that other bank may request that we pass on data on you. This allows this other bank to comply with its legal and other obligations. In such case we may, in addition to the usual data we provide along with the payment, also pass on your date and place of birth. We may also provide data to other financial service providers of other types of service providers if this is necessary to comply with arrangements made between Rabobank and these service providers – e.g., if a payment requires further investigation.

Your personal data is sometimes transferred when making payments to or from countries outside the European Union to other parties in countries that do not have the same level of personal data protection as the European Union.

If your personal data is processed in a country with a different level of protection, this may – for example – result in your personal data being used in investigations by competent national authorities in the countries where such data is located, or your personal data may be used for other purposes that are not allowed in the Netherlands.

We also provide your information to other parties we use as part of our services or in our business operations. This includes parties such as bailiffs, accountants, appraisers, collection agencies, administration offices, consultants, and lawyers.

If you have a legal representative, such as an adult’s administrator or conservator, we may provide your data to your administrator or curator. Also, your administrator or conservator can usually access your information through Rabo Online Banking.

If you make use of a digital card via e.g., Apple Pay, Google Pay or Garmin Pay, of leave your debit card details or credit card details with an online retailer, data will also be processed by the party that makes the wallet available. Please refer to the privacy statement of that other company or organization if you want to know how they handle your personal data.

Sometimes, we can pass on your data ourselves, or have these passed on to another company or another organization, or pass these data on at your request.

Examples include:

Intermediaries
If we act as an intermediary, we will exchange personal data. And if you engage an intermediary, we will exchange personal data as well.

For example, if you take out an insurance policy with an insurer through us, we will share personal data with that insurer. We may also receive data about you from this insurer. We also act as an intermediary for FREO, a lender.

If you take out a mortgage with us through an intermediary, we will receive data about you through your intermediary. You can also make use of apps through which you share data via your intermediary, and share data with us in this way. Examples of such data sharing apps are Ockto and Datakeeper. In such case, we provide your data to this intermediary. We can share information with the intermediary both upon entry into and during the term of the agreement, for example by informing the intermediary that the end of the fixed-interest period of the mortgage has been reached.

Sharing your data with other parties
If you agree to that, we may share your information with other parties.

This includes – for example – a provider of non-financial services whose products are shown in the Rabo App, a debt counselor or an energy consultant.

Business partners and our service providers
Sometimes, we engage other companies and organizations. These other companies process personal data on our instruction. In doing so, these companies act as a processor for Rabobank. We only engage other companies and organizations if we find these parties sufficiently reliable. We can only engage other companies and organizations if this is in line with the purpose for which we process your personal data.

In addition, they must:

For example, we engage a printing company that produces customer mailings for us. Such companies print your name and address details on envelopes. We also engage parties that place advertisements in apps or on websites on our behalf, or parties that perform market research or store data on our behalf.

These third parties may also be IT suppliers. We may also store your data online (in a cloud) via a third party. In addition, we may engage other parties as processors to improve our compliance with our own legal obligations. For example, Rabobank engages a processor to make a better estimate of the number of homes you own. We have to know this in connection with legislation to prevent money laundering and terrorism financing.

If we transfer your data to other parties outside of the European Union (EU)/European Economic Area (EEA) that we have engaged ourselves, we will take additional measures to protect your data. In some countries outside of the European Union, the rules for protecting your data differ from those that apply within Europe. If we engage third parties located outside of the EU/EER, we will determine, to the best of our ability, whether it is safe to do so.

For some countries, the European Commission has determined that there is an ‘adequate’ level of personal data protection. This applies to, for example, the United Kingdom. For other countries, we use the contractual arrangement approved by the European Commission.

In addition, we take additional safety measures if necessary.

On rabobank.nl/en/privacy/your-rights, you can find a description of how to exercise the various rights. Sometimes, you can exercise your rights directly. For example, you can exercise the right to object to direct marketing in the Rabo App or Rabo Online Banking. If this is not possible, you can submit a request using the online form.

If you make a request, we will respond to your request within one month of receiving it. In very specific cases, we may extend the period in which we will respond to a maximum of three months. We will keep you informed of the progress made on your request.
Sometimes, we will ask that you clarify your request, e.g., if you ask for access to the recording of the conversation. In such case, we can ask that you provide characteristics of the conversation, such as the time it took place, and the number used to make the call. We use these characteristics to find the conversation, so that we can play it back to you at a Rabobank branch.

We may ask you to come to the bank to identify yourself when you submit a request to us, for example to provide you access to your data. This is because we want to ensure that we are providing your data to the right person. If we are not sure whether we can safely send the data to you, we may also ask that you visit the bank to collect your data.

Sometimes, we reject your request.

We may do so because, for example:

In such case, we will let you know if that is allowed. If we amend your data or delete your data at your request, we will inform you of that

If you have a general question or a complaint about the processing of personal data, please contact Rabobank. You can also submit a complaint online at https://www.rabobank.nl/en/personal/feedback.