Specific Data Protection Notice – Pillar 3 Data Hub – Collection of Contact Points

SPECIFIC DATA PROTECTION NOTICE – Pillar 3 Data Hub – COLLECTION OF CONTACT POINTS 1 Specific Data Protection Notice Pillar 3 data hub – Collection of contact points The European Banking Authority (EBA) processes your personal data based on Regulation (EU) 2018/1725 (EUDPR). The following information is provided in accordance with Articles 15 and 16 of the EUDPR. Who is the controller? The EBA is the controller with regard to the data processing activities described in this data protection notice. The EBA can be contacted through email using info@eba.europa.eu or in writing using the following address: DEFENSE 4 – EUROPLAZA 20 Avenue André Prothin CS 30154 92927 Paris La Défense CEDEX For more information on the EBA, please consult the EBA website https://eba.europa.eu. What personal data do we process, for what purpose, who can access it and how long do we keep them? The collection of data via email is aimed at gathering the initial contact points for the Pillar 3 Data Hub (P3DH) in order to populate the EBA database with the contact details of the submitters of Pillar 3 information. The collection of data via EUCLID is aimed at gathering the contact points nominated by the institution to receive automatic notification once a publication for that institution occurs. The EBA intends to maintain a list of EBA data submitters nominated by each institution to access the submission platform. Contact persons nominated by institutions to receive the automatic notifications upon publication may be bilaterally contacted by the EBA in case of need. The EBA processes the following personal data for these purposes: first name, last name, role in the institution, e-mail address and phone number. Your personal data can be accessed by EBA staff from the Reporting and Transparency Unit, the Statistics Unit and the IT Unit.

SPECIFIC DATA PROTECTION NOTICE – Pillar 3 Data Hub – COLLECTION OF CONTACT POINTS 2 The EBA will keep the personal data for a period that is needed to perform data quality assurance and achieve the purpose for which it was collected, in accordance with data retention policies an applicable legal requirement. The retention period will not exceed 1 year from the submission of the respective template or until a new submission ofthe respective template isreceived. Why do we process your personal data and under what legal basis? The legal basis of the processing is Article 5(1)(a) of EUDPR as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the European Banking Authority (EBA). This specific ad-hoc data collection is launched in the context of the Pillar 3 data hub to be implemented by the EBA following the respective mandate under Article 434 of Regulation (EU) 2024/1623 (CRR 3), amending Regulation (EU) No 575/2013, to publish on its website the Pillar 3 information required to be disclosed by credit institutions. Will the processing of your personal data involve any transfer outside of the EU? Your personal data is processed by the EBA within the EU/EEA. What are your rights regarding your personal data? As a data subject, an individual whose personal data is processed, you have the following rights: Access - You have the right to access your personal data and to relevant information concerning how we use it. Rectification - You have the right to rectify your personal data, where there are inaccuracies or where data is incomplete. Erasure - Under certain conditions, you have the right to ask that we delete your personal data. Objection - You have the right to object to the processing of your personal data on grounds related to your particular situation. If you do so, EBA may only continue processing your personal data where overriding legitimate grounds can be demonstrated or where the processing is necessary for the establishment, exercise or defense of legal claims. Restriction - Under certain conditions, you have the right to ask that we restrict the use of your personal data or momentarily pause the processing conducted on the data. Right to Withdraw Consent – Where the EBA relies on consent asthe legal basis for processing your personal data you have the right to withdraw your consent at any time. For more information on these rights and details of the exceptions that may apply please see Articles 14 to 25 of EUDPR.

SPECIFIC DATA PROTECTION NOTICE – Pillar 3 Data Hub – COLLECTION OF CONTACT POINTS 3 Where you wish to exercise any of your rights, you can send your request by post in a sealed envelope or via email using the contact details provided below. You have the right to lodge a complaint If you have any remarks or complaints regarding the way we process your personal data, we invite you to contact the Data Protection Officer (DPO) of the EBA (see section on contact details below). You have, in any case, the right to lodge a complaint with the European Data Protection Supervisor, our supervisory authority for data protection matters. Contact details for enquiries regarding your personal data Should you wish to contact the EBA with regard to the processing of your personal data, we encourage you to do so by email: P3DH-Contacts@eba.europa.eu by stating in the subject “Data Protection Enquiry”. If you wish to contact the DPOof the EBA personally, you can send an e-mail to dpo@eba.europa.eu or a letter to the postal address of the EBA marked for the attention of the DPO of the EBA. The postal address of the EBA is DEFENSE 4 – EUROPLAZA, 20 Avenue André Prothin, CS 30154, 92927 Paris La Défense CEDEX, France. You can also find contact information on the EBA’s website: https://eba.europa.eu/contacts