ARAB BANK - SUPPLIER PRIVACY NOTICE

At Arab Bank plc Jordan (hereinafter referred to as "the Bank," "we," "us," or "our"), we respect the privacy of individuals representing our suppliers, vendor, and service providers (hereinafter referred to as “Suppliers” in their interactions with Arab Bank).  In essence, this Supplier Privacy Notice explains how we collect, use, store, share, and protect Personal Data of individuals who are officers, directors, contractors, agents, or representatives of our current, prospective, and former Suppliers (hereinafter referred to as “Individuals Associated with our Suppliers”) whose Personal Data has been shared with us. Personal Data is any information relating to an identified / identifiable individual, whether it relates to his or her private or professional life such as the Identification Document number, mobile number or address. Processing is any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The Bank ensures Personal Data is processed in accordance with Jordanian Law Number 24 of 2023 - Personal Data Protection Law and Central Bank of Jordan (CBJ) Decision on Data Processing for entities under its control and supervision, hereafter referred to as the “Personal Data Protection Regulatory Requirements”.

I. WHAT INFORMATION DO WE COLLECT 

We collect Personal Data that is necessary for the establishment, management, and termination of our business relationship with our Suppliers. Types of Personal Data we may collect and process on Individuals representing our suppliers include:

• Basic personal and contact information: e.g. name, email address, mobile number, identification document number, signature).
• Professional Information: e.g. corporate roles and responsibilities, and
• Technical Information: e.g. login credentials, IP addresses, and activity logs where our Suppliers are required to access our systems.

II.LEGAL BASIS FOR PROCESSING

Our legal bases for processing Personal Data of Individuals Associated with our Suppliers include:

• Entering into a contract with our Supplier or to take necessary steps before entering into such a contract including as it relates to fulfilling due diligence requirements 
• Comply with a legal or regulatory obligation to which the Bank is subject.
• Fulfil a lawful legitimate interest in compliance with related laws and regulations. Our lawful legitimate interests include managing our Supplier relationships effectively, ensuring compliance, and preventing fraud. Please refer to Section III below.
• Consent: Where non of the above basis apply, we shall process you Personal Data based on your consent.

III. HOW DO WE USE PERSONAL DATA

We use Personal Data of Individuals Associated with our Suppliers for the following purposes:

• Supplier Relationship Management: To establish, maintain, and manage our relationship with our Suppliers including contract negotiation, performance, and termination,
• Procurement and Sourcing: To conduct sourcing from our Suppliers including payment and invoicing, issue purchase orders, and manage service delivery,
• Compliance with Legal and Regulatory Obligations: To comply with applicable laws, regulations, industry standards, and internal policies, including sanctions screening and anti-fraud measures,
• Risk Management: To assess and manage risks associated with our Supplier relationship,
• Security: To protect the security and integrity of our systems, data, and premises,
• Communication: To communicate with our Suppliers regarding our business relationship, updates, and other relevant information,
• Dispute Resolution: To resolve disputes and enforce our legal rights, and
• Internal Audit and Reporting: For internal auditing, reporting, and business analysis.

IV. HOW DO WE SHARE PERSONAL DATA / INTERNATIONAL DATA TRANSFERS

Personal Data of Individuals Associated with our Suppliers may be transferred to and processed by service providers including service providers located outside Jordan. Essentially, the Bank utilizes a cloud management software for sourcing and procurement. When we share Personal Data with a service provider /transfer Personal Data internationally, we implement appropriate safeguards to ensure Personal Data is protected. This includes via contractual clauses and other legally recognized mechanisms and safeguards that ensure data security.

V. DATA SECURITY

We implement appropriate technical and organizational measures to protect Personal Data from unauthorized access, use, disclosure, alteration, and destruction. Our measures are aligned with international best practices and standards and applicable personal data protection laws. Breaches of Personal Data of Individuals Associated with our Suppliers shall be reported to those individuals as and when required under Personal Data Protection Regulatory Requirements.

VI. DATA RETENTION

We retain Personal Data for as long as necessary to fulfill the purposes for which it was collected, including for the duration of our business relationship with our Suppliers, to comply with legal and regulatory obligations, to resolve disputes, and for the establishment or defense of legal claims. In essence, our retention periods are determined based on legal, regulatory, and business requirements.

VII. DATA OWNERS’ RIGHTS

Individuals Associated with our Suppliers are granted rights vis a vis their Personal Data under the Jordanian Law Number 24 of 2023 - Personal Data Protection Law. In essence, you (as an individual associated with our Suppliers) can request to exercise the following rights under the Law:

• Right to access your Personal Data within the custody of the Bank.
• Right to be notified of Processing.
• Right to withdraw prior consent you have provided for the Processing of your Personal Data where Processing is based on consent.
• Right to rectify, modify, or update your Personal Data.
• Right to limit Processing for a specified purpose.
• Right to erase your Personal Data or to restrict the Processing of your Personal Data.
• Right to object to Processing and Profiling (if applicable) if they are not necessary to achieve or outweigh the purposes for which the Personal Data was collected, or if they are discriminatory, unfair, or violate the law.
• Right to Personal Data portability. You can ask us to transmit your Personal Data (in a structured, commonly used, and machine-readable format) directly to another company if technically feasible.
• Right to be notified of inaccurate disclosure and breaches of your Personal Data. Note that in the event of a breach of your Personal Data security and safety that could cause significant harm to you, the Bank shall notify you within (24) hours from the discovery of the breach and provide you with necessary measures to avoid any consequences resulting from the breach. This is in compliance with the Personal Data Protection Regulatory Requirements.

To submit a request to exercise any of these rights, please send an email to our Data Protection Officer (DPO) at Privacy.Office@Arabbank.com.jo.  We have appointed a designated DPO – also referred to under the Personal Data Protection Law 24/2023 as the Data Protection Supervisor - who is responsible for overseeing inquiries related to this Privacy Notice. The DPO undertakes responsibilities to verify compliance with the Personal Data Protection controls, requirements, procedures and rules across the Bank. The DPO is also registered with the Central Bank of Jordan as the Data Protection Supervisor per regulatory requirements.

Handling Requests

Please note the Bank shall act promptly on received requests while noting per Personal Data Protection Regulatory Requirements, replies are to be provided within (15) Business days from the date of receipt.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Upon receiving a valid request, we will:

• Verify the requester’s identity
• Record and track the request

If you exercise your right to erasure, rectification or limit of Processing, we will communicate this with the applicable Personal Data recipients to ensure your requests are executed as applicable.

Please note that our fulfillment to your requests may be subject to limitations, in certain circumstances, in accordance with the Law.

For example, a request to erase your Personal Data in the custody of the Bank may not apply where we are required to retain this data under regulatory requirements on data retention.

In essence, we may not be able to fully or partially fulfill certain requests when doing so would conflict with applicable laws or regulatory requirements or would conflict with Know Your Supplier requirements, which are due diligence obligations the Bank undertakes to verify and assess the integrity of its supplier relationships.

If we are unable to take action in response to your requests to exercise your rights, we will inform you along with the reasons for our inability to take action.

We may update this Notice from time to time to reflect changes in our practices or applicable laws. Any material changes will be communicated through appropriate channels.

For More Information

Should you want to learn more about our security practices, please read our Security Statement posted on the website (https://www.arabbank.com/footer-navigation/security-statement)

Should you have any questions regarding this Notice please contact us at: Privacy.Office@Arabbank.com.jo