For informational purposes only: The Chatbot is designed to provide general information about products, services, branch/ATM locations, and frequently asked questions (FAQs).

Not financial advice: Information generated by the Chatbot does not constitute legal, financial, or investment advice. For important financial decisions, you should always consult an authorized advisor or banker at a branch.

Accuracy assurance: Although the Bank aims for the virtual assistant to provide accurate and up-to-date information, it is based on automated models. The Bank is not responsible for any temporary inaccuracies or misunderstandings of messages.

Do not share important, confidential, or sensitive information: For your security, never enter your passwords, PIN codes, full credit/debit card numbers, or E-Banking credentials during a conversation with the Chatbot.

Data collection: The Bank retains conversation history for the purposes of service improvement, complaint resolution, and audit security. All personal data is processed in full compliance with the Personal Data Protection Law and the Bank's Privacy Policy.

Conversation content (user messages and assistant responses): Before a conversation is stored, if users enter personal data, the following information is automatically masked: card numbers, IBANs, account/reference numbers, telephone numbers, ID/NIPT numbers, and email addresses.

Browser identifier: The widget stores a random anonymous identifier in your browser solely to maintain conversation continuity (not for advertising purposes).

The user undertakes not to misuse the Chatbot service. The following are strictly prohibited:

• Using offensive, aggressive, or threatening language toward the system or the staff monitoring the service.

• Attempting to manipulate the system (prompt injection), introduce viruses, or test the security of the Bank's network for vulnerabilities.

• Using the Chatbot to carry out fraudulent or illegal activities.

• The Chatbot does not have access to banking systems (core banking), does not identify customers, and cannot view accounts or transactions.

• Data processing is carried out by authorized personnel at Credins Bank and the data processing entity “TRIBAL”.

• Hosting: Hetzner, in an ISO 27001-certified data center in Germany (EU).

• The database is dedicated to Credins and is not accessible from the internet (no public port).

• AI processing: Microsoft Azure OpenAI, in the EU Data Zone (the resource is located in Sweden Central).

• No data is transferred outside the European Union.

• Conversations and logs are automatically deleted after 90 days.

• Backups are created daily, encrypted, stored in the EU, and retained for 7 days, after which they are automatically deleted.

• Microsoft may retain requests for up to 30 days solely for abuse monitoring.

• At the Bank's request, we can immediately delete all data associated with a session. Users may request the deletion of a conversation through the Data Protection Officer by providing the approximate date/time and its content.

The Bank reserves the right to modify, suspend, or discontinue the Chatbot service at any time, without prior notice, for reasons of technical maintenance or security updates.

These terms may be updated periodically. Continued use of the service following any changes constitutes acceptance of the new terms.

The Bank is not responsible for decisions made on the basis of information generated by the Chatbot. The user is responsible for verifying the information and making decisions.

If you have additional questions regarding the protection of personal data, you may contact the Data Protection Officer by email at dpo@bankacredins.com or by post at Rruga “Vaso Pasha”, Tirana, Albania.