Artemis Credit Bureau Privacy Notice

Personal Data Protection Policy in accordance with Article 14 of Regulation (EU) 2016/679 (General Data Protection Regulation)

This policy provides information on how Artemis Credit Bureau Ltd, as a Credit Bureau, processes, uses and discloses personal data, as well as on the manner of managing and processing personal data in relation to the Credit Scoring system of the ARTEMIS Data Exchange Mechanism. This policy covers the following topics:

Who we are and how you can contact us.
Controllers
Definitions
Purpose of Processing
Categories of Data Subjects whose data are processed
What kind of personal data we process or may process and where we obtain it from
Processing logic and categories of data used for the Credit Score
What is our legal basis for managing personal data?
With whom we share personal data.
Where personal data is stored and to whom it is sent.
Personal data retention period.
Whether your personal data is used in automated decision-making or in the creation of your profile.
Your rights in relation to the personal data we hold about you.
Who you can complain to if you are not satisfied with the use of your personal data.

1. WHO WE ARE AND HOW YOU CAN CONTACT US

We are Artemis Credit Bureau Ltd, a limited liability company registered in Cyprus with registration number HE 240932, and registered office at 77 Strovolou Avenue, Office 501, 5th floor, 2018 Strovolos, Nicosia.

You may contact us regarding matters relating to personal data, including the contents of this Statement, using any of the following methods:

By post: 77 Strovolou Avenue, Office 501, 5th floor, 2018 Strovolos, Nicosia.

Email: [email protected]

Telephone: 22 454777

2. CONTROLLERS

For the purposes of processing personal data, Artemis Credit Bureau acts as joint controller together with the Central Bank of Cyprus.

3. DEFINITIONS

“credit purchaser” means (a) a purchaser, or purchaser of credit facilities, within the meaning given to that term by Article 2 of the Sale of Credit Facilities and for Related Matters Law; and/or (b) a credit purchaser within the meaning given to that term by Article 2 of the Credit Servicers and Credit Purchasers and for Related Matters Law;

“credit score” means the numerical or alphanumeric value assigned to you based on information derived from your data held in the ARTEMIS Data Exchange Mechanism (‘ARTEMIS Mechanism’), for the purpose of classifying you on a creditworthiness rating scale and determining the probability of default on your financial obligations.

“credit facility manager” means (a) a manager, or manager of credit facilities, within the meaning given to that term by Article 2 of the Sale of Credit Facilities and for Related Matters Law; and/or (b) a credit servicer within the meaning given to that term by Article 2 of the Credit Servicers and Credit Purchasers and for Related Matters Law.

“customer's overall profile report” means the report containing your data, as set out in Annexes C1 and C2 of the 2026 Directive on the Determination of the Operation of a System or Mechanism for the Exchange, Collection and Provision of Data (Regulatory Administrative Act 202/2026).

“authorised ARTEMIS user” means a person who is a member of ARTEMIS staff, acting as administrator of the ARTEMIS data exchange mechanism, duly authorised by it to access, use and process data held in the ARTEMIS data exchange mechanism.

“authorised data-recipient user” means (a) a person who is a member of the data recipient's staff, duly authorised by the data recipient to access the ARTEMIS data exchange mechanism for the purpose of processing data held therein, (b) an electronic data-recipient user who accesses the ARTEMIS data exchange mechanism and is supported by all the security safeguards governing access by members of the data recipient's staff.

4. PURPOSE OF PROCESSING

Credit reports and creditworthiness assessment

The purpose of processing your data is to provide credit reference services to banks, credit servicers and leasing companies. The above-mentioned recipients of your personal data use credit reference services to assess your creditworthiness as their customer, or as a connected person, for the more effective management of credit and other related risks.

Credit scoring

The purpose of the scoring is to classify you on a creditworthiness rating scale and to determine the probability of default on your financial obligations within the following twelve months.

The above assessments contribute to (a) reducing the risk of unrecoverable debts, (b) facilitating access to credit, (c) protecting borrowers by preventing lending at levels beyond the borrower's financial capacity, (d) reducing bankruptcies, and (e) safeguarding the stability and sustainability of the country's economy.

5. CATEGORIES OF DATA SUBJECTS WHOSE DATA ARE PROCESSED

Every customer with credit facilities whose personal data are obtained from licensed credit institutions and branches of credit institutions operating in the Republic of Cyprus, from Servicers and Purchasers of credit facilities, from leasing companies, and from servicers of securitised exposures.

Bankrupt persons, whose data are obtained from the Insolvency Department.

Issuers of dishonoured cheques.

6. WHAT KIND OF PERSONAL DATA WE PROCESS OR MAY PROCESS, AND WHERE WE OBTAIN IT FROM

The data of the ARTEMIS Mechanism includes financial-behaviour data, as follows:

For purposes of producing the Credit Score, data from the ARTEMIS Mechanism is processed using specific statistical analysis models to determine the mathematical models for calculating the Credit Score, based on your current financial situation (credit activity), your past transactional behaviour (credit history), and the composition of your credit portfolio (credit portfolio).

The above data is considered relevant because it provides a realistic and balanced picture of whether a DS is likely to repay their debts — that is, it constitutes an indication of the DS's ability to repay their credit facilities.

Specifically, data relating to existing credit facilities, as well as their repayment history, which relate to the DS's past behaviour, are used as an indicator of the DS's likely future behaviour.

It is noted that not all data is used in the mathematical model for the credit score. Data is selected that maximises the ability to determine the probability of default on the DS's financial obligations.

7. PROCESSING LOGIC AND CATEGORIES OF DATA USED FOR THE CREDIT SCORE

Your Credit Score is calculated using a mathematical model into which elements of your current financial situation (credit activity), your past transactional behaviour (credit history) and the composition of your credit portfolio (credit portfolio) are entered. The mathematical model is the result of statistical analysis of the entirety of the information held in the ARTEMIS Mechanism.

The mathematical model estimates the probability of your defaulting on a financial obligation over the following 12 months, based on the information available in the ARTEMIS Mechanism, mapped onto a numerical scale ranging from 1, the lowest value, to 671, the maximum value.

The statistical analysis and the resulting mathematical model are reviewed both by external bodies and by Artemis Credit Bureau itself, in order to ensure they remain fair, effective and unbiased.

Both your Credit Score and your past and current transactional behaviour, as well as the composition of your credit-obligations portfolio on which your Credit Score is based, are presented in your Credit Report so that you have a complete picture of your credit profile.

You can obtain access to your Credit Report by exercising your right of access to your personal data through the Customer Service Office (CSO) of Artemis Credit Bureau.

Your Credit Score is dynamic and may change each time the data concerning you, as presented in the Credit Report, changes.

The Credit Score is generated each time there is a justified search request to the ARTEMIS Mechanism from a Bank, Credit Servicer or Leasing Company, or when you exercise your right of access.

The Credit Score is produced through automated processing, in the sense that your data (the ‘input’) is entered into the credit scoring system, and the system then generates your Credit Score (the ‘output’). The Credit Score may be reviewed by an analyst — that is, there may be human intervention — upon your request. Accordingly, both the input and the output can be reviewed by a natural person, so as to ensure the accuracy of your Credit Score in the event of a review.

For transparency purposes, your Credit Score is accompanied by the three (3) main factors that shaped it, which you can correlate with the data in your Credit Report. Indicative factors that may affect your Credit Score include the following:

High utilisation of credit limit
Frequent delays in loan instalment payments
The existence of one or more accounts subject to debt-restructuring measures
Frequent exceeding of credit limits
A significant number of performing loans

Credit Scoring is not applied to all Data Subjects (“DS”) for whom data is held in the ARTEMIS Mechanism. Specifically, calculation of the Credit Score is not possible in the following cases:

The Data Subject (DS) does not have open funded credit facilities.
The DS is deceased.
The DS has open funded credit facilities as Debtor/Co-debtor only in the last three months.
The DS is only guarantor in credit facilities.
The DS has only non-funded facilities.
The DS has open funded credit facilities as Debtor/Co-debtor with less than 3 months of history.
The DS has only inactive credit facilities as a Debtor or Co-debtor.
The DS has only credit facilities that fall under a combination of two or more of the following categories: (a) credit facilities in which the subject appears as a guarantor; (b) non-funded credit facilities; (c) open funded credit facilities in which the subject appears as a Debtor or Co-debtor and which were opened within the last 3 months; or (d) open funded credit facilities in which the subject appears as a Debtor or Co-debtor and which have less than 3 months of available data.
The DS has at least one open funded credit facility in distress (an account in arrears or terminated).
The DS is a Bankrupt person.
The DS has requested restriction of specific data pending an anticipated investigation into its accuracy.

In these cases, the Credit Report will state the reason for the DS's exclusion from the Credit Score calculation, which reason will be one of those listed above.

8. WHAT IS THE LEGAL BASIS FOR MANAGING PERSONAL DATA

Compliance with a legal obligation

The processing of personal data is necessary for Artemis Credit Bureau's compliance with a legal obligation arising from the legislative framework, as amended from time to time, which includes the Business of Credit Institutions Laws (Law 66(I)/97), the Sale of Credit Facilities and for Related Matters Law (Law 169(I)/2015), the Credit Servicers and Credit Purchasers and for Related Matters Law of 2024 (Law 122(I)/2024), and the 2026 Directives of the Central Bank of Cyprus on the Determination of the Operation of a System or Mechanism for the Exchange, Collection and Provision of Data (hereinafter “the Directive”).

9. WITH WHOM WE SHARE PERSONAL DATA

A) With Banks, Credit Servicers and LeasingCompanies

Recipients of your personal data and of the Credit Score are the above-mentioned institutions, each time there is a request for a specific purpose concerning you through the ARTEMIS Mechanism.

Both the Customer's Credit Report and the Credit Score have a purely supportive role for recipients. The assessment of your data and of the resulting Credit Score is carried out exclusively by the recipient of the data.

Specifically, the Customer's Credit Report and the Credit Score are provided to the above-mentioned recipients for purposes of joint assessment, together with the other data available to them, of the customer's solvency and creditworthiness, as part of the process they follow and on the basis of their internal Risk Management Policy, with the ultimate purpose of reaching a decision on a credit facility.

Artemis Credit Bureau does not make decisions on the granting of credit and is not responsible for the decisions ultimately made by the above-mentioned institutions.

(B) Authorised ARTEMIS personnel

Authorised personnel of ARTEMIS, for purposes of compliance with the GDPR, as well as for the production of the credit scoring report and the production of the customer's overall profile report.

(C) Information Technology Service Provider

Information technology service provider, acting as processor, exclusively for the performance of data processing tasks.

(D) Natural Persons

Every natural person has the right to obtain copies of their personal data that we hold in the ARTEMIS Mechanism. You can find further information in Section 13 below. Where a copy of personal data is obtained, the DS receives information only about themselves and not about any other natural persons.

10. WHERE PERSONAL DATA IS STORED AND TO WHOM IT IS SENT

The data of the ARTEMIS Mechanism is held in Cyprus and is not sent outside Cyprus.

11. RETENTION PERIOD

Data on credit facilities of debtors/co-debtors that have been repaid remain in the customer's credit report for three (3) years from the date of repayment of the facility.

Data of guarantors, limited-liability guarantors and providers of security are included in the customer's credit report for one (1) year from the date of repayment of the facility.

A reference to bankruptcy or discharge by operation of law is included in the content of the customer's credit report for three (3) years from the date of discharge.

Data deleted from the customer's credit report are retained in a separate file exclusively for the purpose of defending legal claims, by such means, manner, type or form as determined by the Commissioner for Personal Data Protection, for a period not shorter than the limitation period applicable to actionable rights, as determined from time to time by the relevant law.

Demographic data remains on the register for as long as there is information concerning the natural or legal person relating to credit facilities granted, Lawsuits/Court Judgments, CIR data, and Bankruptcy data.

12. WHETHER YOUR PERSONAL DATA IS USED IN AUTOMATED DECISION-MAKING OR IN THE CREATION OF YOUR PROFILE

Your data is used in automated decision-making or in the creation of your profile as provided for in the Business of Credit Institutions Laws (Law 66(I)/97).

It is noted that the specific scoring and the profile created through it do not, on each occasion, entail the granting or refusal of a credit facility, since each institution decides on the basis of the additional information it holds as well as its own credit policy.

The envisaged consequences of the Credit Scoring processing are your classification on a creditworthiness scoring scale and the determination of the probability of default on your financial obligations. The credit scorescale runs from 1, the lowest value, to 671.

At the same time, however, the Credit Score also helps you, as a borrower, to have a fuller understanding of your creditworthiness. By knowing your Credit Score and the main factors affecting it, you can take action to improve it, thereby also improving your credit profile. In this way you are better prepared before, for example, applying for a loan or a credit card.

13. YOUR RIGHTS IN RELATION TO THE PERSONAL DATA WE HOLD ABOUT YOU

Right of Access

You may request that we provide you with a copy of your personal data held in our system, as well as access to the outcome of the credit score.

In the event of such a request, you will be given a copy of the data we hold, the numerical outcome of the credit score, and the main reasons that affected your credit score.

Right of Rectification / Contesting the Credit Score

You may request correction of any inaccuracy or error in the data held in the Artemis Mechanism or in your Credit Score, or proceed to dispute your Credit Score.

Where you exercise your right to dispute either your data or your credit score, you may present your grounds for disputing it together with all relevant documents.

As regards your Credit Score, the Rectification/Dipsute request will be examined by Artemis Credit Bureau personnel specialised in Credit Scoring, who will be able to confirm to you whether or not your Credit Score is correct.

If the accuracy of your Credit Score is confirmed, you will be informed in writing. The notification will include a report and correlation of the three (3) main factors that contributed to determining the specific Credit Score with specific credit facilities of yours, as presented in your Credit Report, for purposes of better explaining and understanding your Credit Score.

If the Credit Score is found to be incorrect, the relevant correction will be made and you will also be informed in writing. The notification will include a report and correlation of the three (3) main factors that contributed to determining the specific Credit Score with specific credit facilities of yours, as presented in your Credit Report, for purposes of better explaining and understanding your Credit Score.

Right to Restriction of Processing

You may request restriction of the processing of your data where you have requested rectification of your data and that rectification is pending.

Right to Erasure

The right to erasure is exercised through the request for rectification of personal data.

Right to Data Portability

The right to data portability does not apply, since the processing is necessary for compliance with a legal obligation.

Right to Object

The right to object does not apply, since the processing is necessary for compliance with a legal obligation.

To exercise the above rights, you may contact our Customer Service Office.

Contact with the Customer Service Office of Artemis Credit Bureau

Address: 77 Strovolou Avenue, Office 501, 2018 Strovolos, Nicosia, Cyprus.

Tel.: +357 22 454777

Fax: +357 22 420135

14. WHO YOU CAN COMPLAIN TO IF YOU ARE NOT SATISFIED WITH THE USE OF YOUR PERSONAL DATA

We strive to ensure that we provide the highest level of service, but if you are not satisfied with the quality of our service, you may contact us as follows:

By post, at the address 77 Strovolou Avenue, Office 501, 5th floor, 2018 Strovolos, Nicosia
By email, at [email protected]
By telephone, on +357 22 454777

You can also contact our organisation's Data Protection Officer by email at [email protected]

It is noted that every natural person also has the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection concerning the use of their personal data by Artemis Credit Bureau.