Alhambra Bank and Trust Privacy Policy and Disclosures
1. Introduction and Scope
Alhambra Bank and Trust (“ABT”, “we”, “us”, “our”, or the “Bank”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy and Disclosures document (“Policy”) outlines our practices concerning the collection, use, disclosure, and protection of your personal data in accordance with the Cayman Islands Data Protection Act (2021 Revision) (“DPA”), the Cayman Islands Monetary Authority (“CIMA”) regulations, international banking standards, and other applicable laws and regulations.
This Policy applies to all personal data collected, processed, or disclosed by ABT through our website, mobile applications, in person interactions, and any other channels through which we provide our banking and financial services. It covers information about individuals who are customers, potential customers, and visitors to our digital platforms. By using our services or providing us with your personal information, you consent to the practices described in this Policy.
2. Data Controller and Representative
Alhambra Bank and Trust is the data controller for personal data collected through our Services. As required by the DPA, we have appointed a Data Protection Officer (DPO) who serves as our local representative in the Cayman Islands and bears all obligations under the DPA as if it were the data controller
3. Definition
For the purposes of this Polic
- “Personal data” means any information relating to an identified or identifiable living individual.
- “Processing” means any operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
- Data subject” means the individual to whom the personal data relates
- Sensitive personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation.
4. Personal Data We Collect
We collect and process the following categories of personal data:
4.1 Identity and Contact Informatio
• Full name
• Date of birth
• Nationality
• Government-issued identification numbers (e.g., passport number, driver’s license number)
• Residential address
• Email address
• Telephone numbers
• Marital status
4.2 Financial Informatio
• Bank account details
• Transaction history
• Credit history
• Income information
• Tax identification numbers
• Source of funds
4.3 Employment Information
• Occupation
• Employer name and address
• Employment history
• Job titl
4.4 Technical Da
• IP address
• Browser type and version
• Device information
• Operating system
• Login information
• Time zone setting
4.5 Usage Data
• Information about how you use our website, products, and services
• Click-stream data
• Pages visited
• Time spent on pages
• Referring webpage/source
• Non-identifiable request ID
4.6 Marketing and Communications Data
• Your preferences in receiving marketing from us and our third parties
• Your communication preferences
• Contents of emails, letters, or phone calls with our staff
4.7 Sensitive Personal Dat
We may collect and process sensitive personal data, including
• Biometric data for identity verification purposes (e.g., facial recognition data, only collected with explicit consent)
• Information about political exposure (for compliance with anti-money laundering regulations)
• Health information (if relevant to certain financial products or insurance services)
• Information about criminal convictions (for regulatory compliance purpose)
5. Sources of Personal Data
We collect personal data from the following sources
5.1 Direct Interaction
You may provide us with your personal data when you
• Open an account or apply for our products/services
• Fill out forms or correspond with us
• Provide feedback or contact our customer service
• Use our online banking platforms or mobile applications
• Attend our events or complete our surve
5.2 Automated Technologies
As you interact with our website or mobile applications, we may automatically collect technical data about your equipment, browsing actions, and patterns. This includes
• Cookies and similar tracking technologies
• Server logs
• Analytics tools
5.3 Third Parties
We may receive personal data about you from various third parties, including
• Credit reference agencies
• Fraud prevention agencies
• Public databases
• Government and law enforcement agencies
• Other financial institutions (with your consent)
• Government databases for identity verification
6. Purposes and Legal Bases for Processing Personal Data
We process your personal data for the following purposes and on the following legal bases
6.1 Contractual Necessity
• To provide banking and financial services to you
• To process transactions and manage your accounts
• To communicate with you about our service
6.2 Legal Obligation
• To comply with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations
• To verify your identity and conduct due diligence checks
• To report to tax authorities as required by law
• To respond to requests from courts, law enforcement agencies, or other public authorities
• To comply with Know Your Customer (KYC) procedu
6.3 Legitimate Interests
• To detect and prevent fraud and unauthorized transactions
• To manage risk and conduct internal audits
• To improve and develop our products and services
• To ensure network and information security
• To assess credit risk and make lending decisions
6.4 Consent
• To send you marketing communications about our products and services
• To process sensitive personal data, where applicable
• To share your information with third parties for marketing purposes (if you have opted in)
• To collect and process biometric data for identity verification
7. Disclosure of Personal Data
We may disclose your personal data to the following categories of recipients:
7.1 Service Providers
We engage trusted third-party service providers to perform essential functions on our behalf. These providers are contractually bound to use personal data only for the purposes of providing services to us and in compliance with applicable data protection laws. They include
• IT and cybersecurity service providers
• Cloud storage providers
• Payment processors
• Identity verification services
• Customer support services
• Legal and compliance consultants
• Auditors and accountants
7.2 Regulatory and Law Enforcement Authorities
As required by law or regulation, we may disclose personal dat
• Cayman Islands Monetary Authority (CIMA)
• Cayman Islands Tax Information Authority
• Financial Reporting Authority (FRA) for anti-money laundering purposes
• Other relevant regulatory bodies
• Law enforcement agencies, pursuant to valid legal requests
7.3 Financial Institution
To facilitate transactions and banking operations, we may share information with
• Correspondent banks
• Intermediary banks involved in international transfers
• Other financial institutions (with your consent)
7.4 Professional Advisors
We may disclose your information to professional advisors such as lawyers, accountants, and consultants, where necessary and under confidentiality agreements
7.5 Corporate Transactions
In the event of a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity or the entity resulting from the merger.
8. International Transfers of Personal Data
As a Cayman Islands-based institution, we may transfer your personal data to recipients in other jurisdictions. We ensure that such transfers comply with the DPA and other applicable laws by
• Utilizing standard contractual clauses approved by relevant authorities
• Ensuring recipients are in jurisdictions deemed to have adequate data protection laws by the Cayman Islands Ombudsman
• Obtaining your explicit consent where required
• Implementing standard contractual clauses approved by the European Commission (where applicable)
9. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. To determine the appropriate retention period, we consider:
• The amount, nature, and sensitivity of the personal data
• The potential risk of harm from unauthorized use or disclosure
• The purposes for which we process the data
• Whether we can achieve those purposes through other means
• Applicable legal, regulatory, or contractual requirements
Generally, we adhere to the following retention periods
• Account information: 7 years after account closure
• Transaction data: 7 years from the date of the transaction
• Communication records: 5 years from the date of communication
• Marketing data: Until you withdraw consent or 2 years after last interaction
After the retention period expires, we securely delete or anonymize your personal data
10. Data Security
We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include
• Encryption of data in transit and at rest
• Multi-factor authentication for system access
• Regular security assessments and penetration testing
• Employee training on data protection and information security
• Physical security measures for our premises and data centers
• Strict access controls and monitoring of data access
While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.
In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay, in accordance with the DPA.
11. Your Rights as a Data Subject
Under the DPA and other applicable laws, you have the following rights
11.1 Right to be Informed
You have the right to be informed about the collection and use of your personal data.
11.2 Right of Access
You have the right to request a copy of the personal data we hold about you.
11.3 Right to Rectification
You have the right to request that we correct any inaccurate or incomplete personal data
we hold about you
11.4 Right to Erasure
In certain circumstances, you have the right to request that we delete your personal data.
11.5 Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances
11.6 Right to Data Portability
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
11.7 Right to Object
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
11.8 Rights Related to Automated Decision Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
To exercise any of these rights, please contact our Data Protection Officer using the contact details provided at the end of this Policy. We will respond to your request within 30 days, unless the request is complex or numerous, in which case we may extend this period by two additional months.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who
has no right to receive it.
12. Cookies and Tracking Technologie
Our website uses cookies and similar technologies to enhance your browsing experience and analyze website traffic. For detailed information about our use of these technologies, please refer to our separate Cookie Policy, available at www.alhambrabank.ky/cookie- policy.
13. Marketing Communications
We may use your personal data to send you marketing communications about our products and services that may be of interest to you. You have the right to opt-out of receiving such communications at any time by
• Clicking on the “unsubscribe” link in any marketing email we send you
• Contacting our Data Protection Officer using the details provided below
• Adjusting your marketing preferences in your online banking profile
• Contacting our customer service tea
14. Automated Decision-Making and Profiling
We may use automated decision-making processes for certain banking operations, such as credit scoring or transaction monitoring. Where such decisions significantly affect you, we will provide you with information about the logic involved and the significance and envisaged consequences of such processing.
You have the right to request human intervention, express your point of view, and contest any decision based solely on automated processing.
15. Children's Privacy
Our Services are not intended for children under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe we may have collected information about your child, please contact us immediately.
16. Third-Party Link
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these websites. We encourage you to review the privacy policies of any third-party sites you visit.
17. Regulatory Compliance
Alhambra Bank and Trust complies with all applicable Cayman Islands laws and regulations, including
• The Data Protection Act (2021 Revision)
• The Banks and Trust Companies Act
• The Monetary Authority Act
• Anti-Money Laundering Regulations
• Proceeds of Crime Act
We also adhere to international standards set by bodies such as the Financial Action Task Force (FATF) and the Basel Committee on Banking Supervision.
18. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by posting the new Policy on our website and, where appropriate, notifying you by email. We encourage you to review this Policy periodically to stay informed about how we collect, use, and protect your personal data.
19. Complaints
If you have any concerns about how we process your personal data, please contact our Data Protection Officer in the first instance. You also have the right to lodge a complaint with the Cayman Islands Ombudsman, the supervisory authority for data protection issues in the
Cayman Islands:
Office of the Ombudsman
5th Floor, Anderson Square
64 Shedden Road, George Town
Grand Cayman KY1-1204
CAYMAN ISLANDS
Email: info@ombudsman.ky
Tel: +1 345 946 6283
20. Contact Us
If you have any questions about this Policy or our data protection practices, please contact our Data Protection Officer
Data Protection Officer
Alhambra Bank and Trust
64 Earth Close, 2A3 Landmark Square
PO Box 30275
Seven Mile Beach, Grand Cayman KY1-1202
CAYMAN ISLANDS
Email: abt@abt.ky
Tel: +1 345 769 7411
By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your personal data as described herein