Privacy Notices

First Issued: 18 May 2018
Revised Version: 19 June 2026

National Bank of Kuwait (International) PLC "we", "us", and "ours" or "NBKI" or “NBK UK”) is a company registered in England & Wales with Company Number 02773743 and registered with the UK Information Commissioner’s Office (ICO) with registration number Z6471287.

This Privacy Notice is prepared for customers of NBKI and explains who we are, how we collect, share and use customers' personal information, and how you can exercise your privacy rights. If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Privacy Notice.

What does NBKI do?

This section is divided into three parts: 1. Information you provide directly, 2. Information collected automatically, and 3. Information obtained from third parties.

NBKI is a bank incorporated in the UK which mainly services clients of its Kuwaiti parent company when those clients want banking services in the UK. Corporate clients will generally have some nexus with the MENA region. NBKI is headquartered in the United Kingdom, but its parent, National Bank of Kuwait S.A.K.P., has branches, subsidiaries and representative offices in a number of countries, including most of the Gulf Cooperation Council (GCC) countries. View the list of our current group companies. Our banking services include current and deposit accounts, FX services, property finance, trade finance and letters of credit and guarantees for corporate customers. Our Treasury department is also active in institutional banking, including accepting and making institutional deposits.

What personal information does NBKI collect and why?

NBKI is the ‘data controller’ of your personal information it collects and processes as set out in this Privacy Notice. This means we are responsible for how we hold and use your personal information about you. We are required to notify you of the information in this Privacy Notice and why we process your data.

The personal information that we may collect about you broadly falls into the following categories:

1. Information that you provide directly

In addition to the above, as a bank we are legally required to process all or some of information above to comply with any anti-money laundering regulations. If we ask you to provide any other personal information not described above, then the personal information we will ask you to provide, and the reasons why we ask you to provide it, will be made clear to you at the point we collect your personal information for example in application forms or an agreement.

2. Information that we collect automatically

If you use our Website or use electronic devices to access our products and services, we may also collect certain information automatically from your device, though we do this in a very limited way. More detail about how we collect information on our Website is set out in our Website Privacy Notice.

Mobile App Data Collection
When you use the NBK - UK Mobile Banking App, we may collect certain information automatically from your device, including device type and location data. This is used for security and fraud prevention purposes.

Push Notifications and Preferences

The NBK - UK Mobile Banking App may send notifications via email, SMS, WhatsApp, or in-app messaging. You can manage your notification preferences within the app settings.

The NBK UK Mobile Banking App processes certain additional technical information (such as device type and location) to protect against fraud and unauthorised access. We apply strict security controls, including encryption and restricted access protocols, to ensure this information is protected. Personal data shared with third party messaging service providers is limited to what is strictly necessary for delivery of notifications.

Lawful Basis

We process this data under our legitimate interests to ensure secure and effective communication and service delivery.

Device and location data collected through the NBK‑UK Mobile Banking App is processed under our legitimate interests in maintaining secure account access, detecting fraud and ensuring the integrity of our systems.
Push notifications may be sent under legitimate interests where necessary for service‑related communications (e.g., security alerts, transaction confirmations).

For optional notifications, we rely on your consent, which you can withdraw through the in‑app notification settings at any time.

Some of this information may be collected online using cookies and similar tracking technology, as explained further in our Cookies Notice, which you can access in the same location as our Website Privacy Notice described above.

3. Information that we obtain from third-party sources

From time to time, we may receive personal information about you from third-party sources. These include credit reference agencies, World Checking services, other data bases of Politically Exposed Persons, open internet searches to see if there is adverse information in the public domain, information provided by external intelligence suppliers, Syntectics Solutions Limited immigration searches, searches of the Home Office immigration database and other banks who provide references on you. These third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us. 

We also collect personal information about you which is available in the public domain for example in press reports. 

The types of information we collect from third parties includes:

How will we use your personal information?

In accordance with the UK Data Protection laws, we must ensure that we use your personal information as described in this Privacy Notice or for purposes that we explain to you at the time we collect your personal information. We will use your personal information upon one or more of the following conditions such as processing an application, providing a service or payment transaction.

• Providing services under a contract: we use your personal information to the extent necessary for us to provide the products and services to you on the terms agreed between us. This also covers anything you ask us to do prior to providing a product or service, such as processing an application or payment transaction.
• Meeting a legal obligation: we use your personal information where necessary to comply with any legal obligation imposed upon us. For example, processing your personal information for “know your customer” checks or for tax reporting.
• Legitimate interests: for any other reasons described in this Privacy Notice, we use your personal information on the basis of legitimate interests (eg. Ensuring secure communication or improving customer experience). This means that, on balance, we consider that it is necessary to use your data in the described way for a legitimate reason. We are required to balance your interests, rights, and freedoms as an individual against the legitimate interest we are trying to pursue. If we can achieve the same result without processing your personal information, we will adopt that approach. It is our intention to give full and proper consideration to your interests when relying upon this condition to process your personal information.
• Consent: In limited circumstances, we may use your personal information where you have provided your consent for us to do so. Where you are asked to provide consent, we will provide further details of the reason and use of your personal information when requesting such consent.

If you fail to provide a personal information when requested, we may not be able to provide the service to you or perform the contract with you. We may also be prevented from performing our legal obligation such as know your customer checks. These circumstances may prevent us from being able to offer, or continue to offer, you the services or product.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading below.

Joint Account Data Handling

Where accounts are held jointly, NBKI may retain and continue to process the personal data of all account holders, including those who have been removed from the account, for as long as the account remains open. This is necessary to fulfil contractual obligations, maintain accurate records, and comply with legal and regulatory requirements, including anti-money laundering and audit obligations.
Access to personal data within NBKI systems, including Equation, is restricted to authorised personnel and is governed by strict access controls. Personal data of removed account holders may remain visible to staff with a legitimate business need, but will not be used for any new or unrelated purposes.

All joint account holders retain their rights under applicable Data Protection laws, including the right to access, rectify, or object to the processing of their personal data

Who does NBKI share my personal information with?

We may disclose your personal information to the following categories of recipients:

• to our group companies. View the list of our current group companies.
  We benefit from a centralised IT system, provided by our parent company, based in Kuwait. It allows us to access larger, more sophisticated systems to process your personal information. In order to protect your personal information in accordance with the UK's Data Protection laws we have put in place an agreement with our parent company through a set of standard contractual clauses. In respect of corporate customers, Group will have access to the personal details of individuals associated with the corporate, to enable relationship officers in Kuwait to access a consolidated view of the customer. It is not for used for marketing purpose. Access is restricted and can only be viewed if the corporate customer has an account with Group
• to third-party services providers and partners who provide data processing services to us, or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information. This may include IT providers, credit check providers, and payment companies. For example, where you have a Visa card with us, we share your personal information with Visa Europe Limited to allow payment transactions or ATM withdrawals to take place. We may share your personal data with carefully selected third-party service providers who support the delivery of our services, such as IT providers, payment processors and credit reference agencies. We ensure that all such providers are subject to appropriate contractual and security obligations to protect your personal data.
• Messaging and notification service providers, who facilitate delivery of app notifications via email, SMS, WhatsApp or in‑app messaging.
• to any competent law enforcement body, regulatory, government agency, court or other third-party where we believe disclosure is necessary (i) as a matter of applicable law or regulation including anti-bribery and corruption regulations and anti-money laundering laws, (ii) to exercise, establish or defend our legal rights, (iii) for fraud prevention purposes (iv) to protect your vital interests or those of any other person.
• to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice.
• to any other person with your consent to the disclosure.

How does NBKI keep my personal information secure?

We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include:

• physical access control systems
• a physical security presence
• logical access controls (such as passwords)
• perimeter security systems (such as firewalls)
• vulnerability management

International data transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have Data Protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our servers are located in the UK, and our group companies and third-party service providers and partners operate around the world. This means that when we collect your personal information we may process it in any of these countries.

However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing the Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process in accordance with UK Data Protection law. These clauses are regularly reviewed to ensure they meet current legal requirements.

We have implemented similar appropriate safeguards with our third-party service providers and partners.

Where our messaging service provider processes data outside the UK, we ensure that appropriate safeguards (such as Standard Contractual Clauses) are in place.

Data retention

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). This includes our specific obligations under the FCA rules.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. 

We will keep transaction records for a minimum of seven years from the date of the relevant transaction, other information may be held for at least five years after the termination of our services.

Automated decision-making

Automated decisions are decisions concerning you which are made automatically on the basis of a computer determination (using software algorithms), without human review. We do not use automated decision-making.

Your Data Protection rights

• Access your personal data - Request a copy of the personal data we hold about you.
• Request correction - Ask us to correct any inaccurate or incomplete personal data.
• Request deletion - Ask us to delete your personal data where there is no valid reason for us to continue processing it.
• Object to processing - Object to the processing of your personal data where we are relying on legitimate interests as our legal basis, or for direct marketing (if applicable).
• Restrict processing - Ask us to suspend the processing of your personal data in certain circumstances.
• Data portability - Request that we transfer your personal data to you or to a third party, where technically feasible.
• Withdraw consent - Where we rely on your consent to process your personal data, you may withdraw that consent at any time.

You can exercise any of these rights by contacting us using the details set out below. 

How to complain about how we use your personal data

If you are unhappy with how we use your personal data, or how we have handled a request you have made (including a request to access your personal data), you have the right to make a complaint to us.

You can raise a complaint by contacting our Data Protection Officer using the contact details provided below.

We will:

• Acknowledge your complaint within 30 days, and
• Investigate and respond without undue delay, typically within three months.

We take all data protection complaints seriously and will seek to resolve them fairly and promptly.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. This may be by posting a notice on the Website or notifying you. We encourage you to review this Notice to be informed of how NBKI is processing your personal information.

You can see when this Privacy Notice was last updated by checking the date displayed at the top of this Privacy Notice.

Escalating your complaint

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

You can contact the ICO's website.

How to contact us

If you have any questions or concerns about our use of your personal information, please contact our Data Protection Officer ("DPO") using the following details: DataProtection@nbki.com. OR

National Bank of Kuwait (International) PLC
13 George Street
London W1U 3QJ

First Issued: 18 May 2018
Revised Version: 19 June 2026

National Bank of Kuwait (International) PLC "we", "us", and "ours" or "NBKI") respects your right to privacy. NBKI is a company registered in England & Wales with Company Number 02773743 and registered with the UK Information Commissioner’s Office (ICO) with registration number Z6471287. 

This Privacy Notice explains who we are, how we collect, share and use personal information about you, and how you can exercise your privacy rights. This Privacy Notice only applies to personal information that we collect through the UK pages on the Website www.NBK.com ("Website”) Please see our other Privacy Notices how we process personal information that we collect when you use our services or interact with us through other means. These other notices are all contained in the section headed “Privacy Notices” which is located at the foot of the UK web pages.

NBKI is the controller of information that we process for the purposes described in this Privacy Notice.

If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the end of this Privacy Notice.

Quick links

We recommend that you read this Privacy Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link below to jump to that section.

> What does NBKI do?
> What personal information does NBKI collect and why?
> Who does NBKI share my personal information with?
> Legal basis for processing personal information
> How does NBKI keep my personal information secure?
> International data transfers
> Data retention
> Your Data Protection rights
> Updates to this Privacy Notice
> How to contact us

What does NBKI do?

NBKI is a bank incorporated in the UK which predominantly services clients of its Kuwaiti parent company when those clients want banking services in the UK or France. Corporate clients will generally have some nexus with the MENA region. NBKI is headquartered in the United Kingdom, but its parent, National Bank of Kuwait S.A.K.P., has branches, subsidiaries and representative offices in a number of countries, including most of the Gulf Cooperation Council (GCC) countries. Our banking services include current and deposit accounts, FX services, property finance, trade finance and letters of credit and guarantees for corporate customers. 

If you have any questions, concerns, or wish to raise a complaint about our use of your personal information, please contact us using the details provided at the end of this Privacy Notice.

What personal information does NBKI collect and why?

The personal information that we may collect about you broadly falls into the following categories:

Information that you provide voluntarily

Generally, our Website is not designed to collect information from customers and other visitors. It is designed to communicate information about our services and for customers to obtain key information they need to know, for example about our charges, the deposit protection scheme, the terms and conditions of accounts etc. For this reason, we will not in most circumstances be asking you to input information or to register with us. The exceptions to this are:

• Where you wish to sign up as a new user using the new user registration form for online banking
• If you contact us through any email addresses on our Website and provide us with any personal information we will process that information

Information that we collect automatically

When you visit our Website, we may collect certain information automatically from your device. In some countries, including the United Kingdom and countries in the European Economic Area, this information may be considered personal information under applicable Data Protection laws.

Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked. 

Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

Some of this information may be collected using cookies and similar tracking technology, as explained further in our Cookies Notice, which is also on this Website in the section headed "Privacy Notices".

Information that we obtain from third-party sources

We do not receive information about you from third parties via our Website.

Who does NBKI share my personal information with?

We may disclose your personal information to the following categories of recipients:

• to our group companies, third-party services providers and partners who provide data processing services to us (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Website), or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information. View the list of our current group companies. We may share your personal data with carefully selected third-party service providers and partners who support the delivery, functionality and security of our Website. We ensure that all such third parties are subject to appropriate contractual and security obligations to protect your personal data.
• to any competent law enforcement body, regulatory, government agency, court or other third-party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person
• to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice
• to any other person with your consent to the disclosure

Legal basis for processing personal information 

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

Our Cookie Notice is also on this Website and describes what cookies we use and why. When you first access the UK section of the Website, you will be presented with a pop-up banner directing you to the Cookie Notice. 

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the "How to contact us".

How does NBKI keep my personal information secure?

We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

International data transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have Data Protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our servers are located in the UK, and our group companies and third-party service providers and partners operate around the world. This means that when we collect your personal information, we may process it in any of these countries.

However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing the Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process in accordance with UK Data Protection law.

We have implemented similar appropriate safeguards with our third-party service providers.

Data retention

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. The only exception to not processing backup archives may be where it becomes necessary to retrieve that archived information. 

Your Data Protection rights

You have the following Data Protection rights:

• Access your personal data - Request a copy of the personal data we hold about you
• Request correction - Ask us to correct any inaccurate or incomplete personal data
• Request deletion - Ask us to delete your personal data where there is no valid reason for us to continue processing it
• Object to processing - Object to the processing of your personal data where we are relying on legitimate interests as our legal basis, or for direct marketing (if applicable)
• Restrict processing - Ask us to suspend the processing of your personal data in certain circumstances
• Data portability - Request that we transfer your personal data to you or to a third party, where technically feasible
• Withdraw consent - Where we rely on your consent to process your personal data, you may withdraw that consent at any time

You can exercise any of these rights by contacting us using the details set out below.

How to complain about how we use your personal data

If you are unhappy with how we use your personal data, or how we have handled a request you have made (including a request to access your personal data), you have the right to make a complaint to us.

You can raise a complaint by contacting our Data Protection Officer using the contact details provided below.

We will:

• Acknowledge your complaint within 30 days, and
• Investigate and respond without undue delay, typically within three months

We take all data protection complaints seriously and will seek to resolve them fairly and promptly.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. This may be by posting a notice on the Website or notifying you. We encourage you to review this Notice to be informed of how NBKI is processing your personal information.

You can see when this Privacy Notice was last updated by checking the date displayed at the top of this Privacy Notice.

Escalating your complaint

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

You can contact the ICO's website.

How to contact us

If you have any questions or concerns about our use of your personal information, please contact our Data Protection Officer (“DPO”) sing the following details: DataProtection@nbki.com OR

National Bank of Kuwait (International) PLC
13 George Street
London, W1U 3QJ

First Issued: 18 May 2018
Revised Version: 19 June 2026

This Notice explains how National Bank of Kuwait (International) PLC ("we", "us", and "ours" or "NBKI") is a company registered in England & Wales with Company Number 02773743 and registered with the UK Information Commissioner’s Office (ICO) with registration number Z6471287.

NBKI uses a limited number of cookies when you visit the UK sections of our Website at www.NBK.com (“Website”). It explains what these cookies are and why we use them. Although this Notice relates generally to the Website of National Bank of Kuwait S.A.K.P. it is only intended to meet the legal obligation to inform visitors of cookies that are used on the UK pages of the Website.

What are cookies?

Cookies are small data files that are placed on your computer or mobile device when you visit a Website. Cookies are widely used by Website owners in order to make their Websites work, or to work more efficiently, as well as to provide reporting information. 

Cookies set by the Website owner (in this case, National Bank of Kuwait S.A.K.P.) are called "first party cookies". Cookies set by parties other than the Website owner are called "third-party cookies". Third-party cookies enable third-party features or functionality to be provided on or through the Website (e.g. advertising, interactive content and analytics). The parties that set these third-party cookies can recognise your computer both when it visits the Website in question and also when it visits certain other Websites. 

Why do we use cookies?

We use a limited number of cookies for several reasons. Some cookies are required for technical reasons in order for our Website to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to provide Website functionality, or to track the use of our Website. This is described in more detail in the table below. 

Detailed List of Cookies Used on Our Website

Below is a detailed list of the cookies we use on our website. This table includes information about the name of each cookie, its purpose, and description.

How to Refuse Cookies

To refuse these cookies, please follow the instructions below under the heading "How can I control cookies?".

What about other tracking technologies, like web beacons?

Cookies are not the only way to recognise or track visitors to a Website. Some Websites use similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are tiny graphics files that contain a unique identifier that enable Website owners to recognise when someone has visited their Website or opened an e-mail sent to them. This allows Website owners, for example, to monitor the traffic patterns of users from one page to another within the Website, to deliver or communicate with cookies. We do not use web beacons or other tracking technologies

Do you use Flash cookies or Local Shared Objects?

"Flash Cookies" (also known as Local Shared Objects or "LSOs") are used by some Website owners to, among other things, collect and store information about your use of services, fraud prevention and for other site operations. We do not use Flash cookies or Local Shared Objects.

Do you use social networking cookies?

These cookies are used to enable you to share pages and content that you find interesting on our Website through third-party social networking and other Websites. We do not use these sort of cookies.

Do your cookies serve targeted advertising?

We do not engage in targeted marketing and we do not use cookies that would enable us to engage in such activities.

Links to other Websites

Our Website contains links to other Websites. If you access those other Websites they may use cookies. Please read any Cookie Notices on those Websites if you wish to know what cookies are being used.

How can I control cookies?

You have the right to decide whether to accept or reject cookies and you can set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our Website though your access to some functionality and areas of our Website may be restricted. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information.

How often will you update this Cookie Notice?

We may update this Cookie Notice from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal or regulatory reasons. Please therefore re-visit this Cookie Notice regularly to stay informed about our use of cookies and related technologies. 

The date at the top of this Cookie Notice indicates when it was last updated. 

Where can I get further information?

If you are unhappy with how we use your personal data, or how we have handled a request you have made (including a request to access your personal data), you have the right to make a complaint to us at any time.

You can raise a complaint by contacting our Data Protection Officer using the contact details set out below.

We will acknowledge your complaint within 30 days and investigate and respond without undue delay, typically within three months.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

If you have any questions, concerns, or wish to raise a complaint about our use of cookies or personal data, please contact our Data Protection Officer using the details below.

You also have the right to complain to the Information Commissioner’s Office (ICO).

For further information on how to raise a complaint, please see our Privacy Notice.

Data Protection Officer (“DPO”) at DataProtection@nbki.com OR

National Bank of Kuwait (International) PLC
13 George Street
London, W1U 3QJ

Date: 1 March 2021
Last Updated: 19 June 2026

National Bank of Kuwait (International) PLC ("we", “us”, and "our" or "NBKI") respects your right to privacy. This Privacy Notice explains who we are, how we collect, share and use personal information about our contacts, and how our contacts can exercise their privacy rights. If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the end of this Privacy Notice.

NBKI is the controller of information that we process for the purposes described in this Privacy Notice.

What does NBKI do?

NBKI is a bank incorporated in the UK which mainly services clients of its Kuwaiti parent company when those clients want banking services in the UK. Corporate clients will generally have some nexus with the MENA region. NBKI is headquartered in the United Kingdom, but its parent, National Bank of Kuwait S.A.K.P., has branches, subsidiaries and representative offices in a number of countries, including most of the Gulf Cooperation Council (GCC) countries. View the list of our current group companies. Our banking services include current and deposit accounts, FX services, property finance, trade finance and letters of credit and guarantees for corporate customers. Our Treasury department is also active in institutional banking, including accepting and making institutional deposits.

What personal information does NBKI collect and why?

The personal information that we may collect about you broadly falls into the following categories:

Information that you provide

You may provide us information directly which may include:

In addition correspondence with you may contain certain personal information that we exchange in the ordinary course of business such as to schedule meetings and calls and manage services we provide to you (or your employer) or you (or your employer) provide to us.

If we ask you to provide any other personal information not described above, then the personal information we will ask you to provide, and the reasons why we ask you to provide it, will be made clear to you at the point we collect your personal information.

Information that we obtain from third-party sources

From time to time, we may receive personal information about you from third-party sources (including from your employer and on occasion other suppliers and partners), but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

Who does NBKI share my personal information with?

We may disclose your personal information to the following categories of recipients:

• to our group companies, third-party services providers and partners who provide data processing services to us, or who otherwise process personal information for purposes that are described in this Privacy Notice or notified to you when we collect your personal information.We may share your personal data with carefully selected third-party service providers and partners who support the delivery of our services. These may include IT providers and other professional advisers. We ensure that all such third parties are subject to appropriate contractual and security obligations to protect your personal data.. 
• to any competent law enforcement body, regulatory, government agency, court or other third-party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
• to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Notice;
• to any other person with your consent to the disclosure.

Legal basis for processing personal information

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your Data Protection interests or fundamental rights and freedoms.

In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

Mostly, however, we process contacts information for our legitimate business interests in the context of providing or receiving services to customer or from our service providers or in the case of partners, for the purpose of the collaboration or partnership.

If we collect and use your personal information in reliance on anything other than our legitimate interests, we will make clear to you at the relevant time. For example, if we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading at the end of this Notice.

How does NBKI keep my personal information secure?

We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

International data transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have Data Protection laws that are different to the laws of your country.

NBKI's group companies are based outside of the UK and the EEA.

We benefit from a centralised IT systems, provided by our parent company, based in Kuwait. It allows us to access larger, more sophisticated systems to process your personal information. In order to protect your personal information in accordance with the UK's Data Protection laws we have put in place an agreement with our parent company through a set of standard contractual clauses for personal data transfers.

We may also use third parties or partners who are based outside the UK. As with our group companies, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice. These include implementing standard contractual clauses for personal data transfers with these parties.

We have implemented similar appropriate safeguards with our third-party service providers and partners.

Data retention

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to receive services from you (or your employer), to provide services to our customers, to collaborate with our partners or to comply with applicable legal, tax or accounting requirements). 

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Automated decision-making

Automated decisions are decisions concerning you which are made automatically on the basis of a computer determination (using software algorithms), without human review. We do not use automated decision-making.

Your Data Protection rights

• Access your personal data - Request a copy of the personal data we hold about you.
• Request correction - Ask us to correct any inaccurate or incomplete personal data.
• Request deletion - Ask us to delete your personal data where there is no valid reason for us to continue processing it.
• Object to processing - Object to the processing of your personal data where we are relying on legitimate interests as our legal basis, or for direct marketing (if applicable).
• Restrict processing - Ask us to suspend the processing of your personal data in certain circumstances.
• Data portability - Request that we transfer your personal data to you or to a third party, where technically feasible.
• Withdraw consent - Where we rely on your consent to process your personal data, you may withdraw that consent at any time.

You can exercise any of these rights by contacting us using the details set out below.

How to complain about how we use your personal data
If you are unhappy with how we use your personal data, or how we have handled a request you have made (including a request to access your personal data), you have the right to make a complaint to us.
You can raise a complaint by contacting our Data Protection Officer using the contact details provided below.
We will:

• Acknowledge your complaint within 30 days, and
• Investigate and respond without undue delay, typically within three months.

We take all data protection complaints seriously and will seek to resolve them fairly and promptly.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. This may be by posting a notice on the Website or notifying you. We encourage you to review this Notice to be informed of how NBKI is processing your personal information.

You can see when this Privacy Notice was last updated by checking the date displayed at the top of this Privacy Notice.

Escalating your complaint

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

You can contact the ICO's website.

How to contact us

If you have any questions or concerns about our use of your personal information, please contact our Data Protection Officer (“DPO”) using the following details: DataProtection@nbki.com. OR

National Bank of Kuwait (International) PLC
13 George Street
London, W1U 3QJ.