Privacy Notice

Brantone Veylor Entities (“Brantone Veylor”, “us” or “we”) process information and personal data (“Personal Data”) relating to you and/or any Related Person of yours [Related Person(s) and you together: the “Data Subject(s)”]. We do this in connection with our existing and/or prospective business relationships, including your use of our websites and applications (together: the “Business Relationship”). We can do so either as controller or as joint controller (the “Controller”).

A “Related Person” means an individual or entity whose information that you or a third party provides to us and/or information that otherwise comes to our knowledge in connection with our Business Relationship. A Related Person may include, but is not limited to, (i) a director, officer or employee of a company; (ii) a trustee, settlor or protector of a trust; (iii) a nominee or beneficial owner of an account; (iv) a substantial interest owner in an account; (v) a controlling person; (vi) a payee of a designated payment; (vii) a representative or agent (i.e. with a power of attorney, a right to information on an account, an e-banking user); or (viii) an employer or contractor.

We therefore ask you to liaise with all of your Related Persons and to pass this Privacy Notice and the information it contains on to them.

If you have any questions about this Privacy Notice, about your Controller or, more generally, about the processing of your (or your Related Persons’) Personal Data, you can contact your relationship manager or our Data Protection Officer at any of the following addresses:

We are subject to certain confidentiality and/or secrecy obligations, e.g. those arising under laws governing data protection, contracts and professional or banking secrecy, whichever may be applicable.

This Privacy Notice deals with the way we process Personal Data. That means how we collect, use, store, transmit or otherwise handle or process, operations collectively defined in this document as “Processing” or “Processing Operations”. This Privacy Notice does not replace, and remains subject to, our applicable contractual terms and conditions.

We may conduct our Processing Operations either directly or indirectly, through other parties that process Personal Data on our behalf (the “Processors”).

Personal Data include any information relating to an identified or identifiable natural person or as defined in the applicable law.

Personal Data of Data Subjects that we process may be based on the following principal legal bases, bearing in mind that they may also rely cumulatively on other legal bases mentioned.

On the legal basis of contract performance, including the pre-contractual steps:

• identification data, e.g. names, addresses, telephone numbers, email addresses, business contact information;
• personal characteristics, e.g. date of birth, country of birth;
• work-related information, e.g. employment and job history, title, professional skills, powers of attorney;
• financial information, e.g. financial and credit history information, bank details, records from the debt collection enforcement office;
• transaction/investment data, e.g. current and past investments, investment profile, investment preferences and invested amount, number and value of shares held, role in a transaction (seller/acquirer of shares), transaction details.

On the legal basis of legal and regulatory obligations:

• identifiers issued by public bodies, e.g. passport, identification card, tax identification number, national insurance number, social security number, work permit;
• reputation checks and background checks;
• voice recording, e.g. the recording of phone calls made by or to the Controller’s representatives.

On the legal basis of our legitimate interest:

• management and security data, e.g. records of presence on our premises;
• visual and video surveillance media, e.g. video surveillance on our premises for security purposes.

On the legal basis of your prior consent:

• certain cookie information, e.g. cookies and similar technologies on websites and in emails (see our Cookies policy).

Purposes for which we process Personal Data (the “Purposes”) may be based on the following principal legal bases, bearing in mind that they may also rely cumulatively on other mentioned legal bases.

We collect and process Personal Data as necessary for pre-contractual steps and performance of a contract to which you are a party and/or a Related Person is related, which encompasses the following Processing Operations:

• the opening and management of your and/or a Related Person’s account or Business Relationship with us, including all related operations for your identification
• any other related services provided by any service provider of the Controller(s) and Processors in connection with our Business Relationship;
• management, administration and distribution of investment funds, including any ancillary services related to these activities, or the processing of subscription, conversion and redemption requests in investment funds, as well as for maintaining the ongoing relationship with respect to holdings in such investment funds;
• management of requests for proposals and/or due diligence, the provision of services (including the invoicing and payment of fees) and management of the Business Relationship and related communication with you.

We also collect and process Personal Data relating to compliance with legal and regulatory obligations to which we are subject, including to:

• provide offering documentation to Data Subjects about products and services;
• comply with legal obligations relating to accounting, compliance with legislation on markets in financial instruments, outsourcing, foreign activity and qualified participation;
• conduct audits and/or regular reviews on you or your Related Person;
• carry out any other form of cooperation with, or reporting to, competent administrations, supervising authorities, law enforcement authorities and other public authorities [e.g. in the field of anti-money laundering and combating terrorism financing (AML-CTF)], for the prevention and detection of crime under tax law [e.g. reporting of name, address, date of birth, tax identification number (TIN), account number and account balance to tax authorities under the Common Reporting Standard (CRS) or Foreign Account Tax Compliance Act (FATCA) or other tax legislation to prevent tax evasion and fraud as applicable];
• prevent fraud, bribery, corruption and the provision of financial and other services to persons subject to economic or trade sanctions on an ongoing basis in accordance with our AML-CTF procedures, as well as to retain AML-CTF and other required records for screening purposes;
• deal with active intra-Group risk management pursuant to which risks in terms of markets, credit, default, processes, liquidity and image as well as operational and legal risks must be identified, limited and monitored;
• record conversations with Data Subjects on a cloud-based solution (such as telephone and electronic communications), in particular to document and verify instructions, detect potential or actual frauds and other offences.

Furthermore, we may process Personal Data in connection with legitimate interests (including those of other Group entities) we pursue so that we can:

• assess certain characteristics of the Data Subjects on the basis of personal data processed automatically (profiling) (see also Section 5 below);
• develop our Business Relationship with you;
• improve the quality of our services and our internal business organisation and operations, including for risk assessment and to take risk management-related business decisions;
• use this information in Brantone Veylor entities for market studies or advertising purposes, unless Data Subjects have objected to use of their personal data for marketing;
• communicate personal data to other Brantone Veylor entities, in particular to guarantee an efficient and harmonised service and inform Data Subjects about services offered by Brantone Veylor entities;
• establish, exercise and/or defend actual or potential legal claims, investigations or similar proceedings;
• record images (e.g. video surveillance) for ensuring the security of individuals, assets, property, buildings, as well as the Brantone Veylor’s critical infrastructure and IT systems.

If our Personal Data Processes presuppose that you give your prior consent to doing so, we will seek your consent in due time and you will have the right to withdraw your consent at any time by contacting your relationship manager or our Data Protection Officer (see Section 1 above).

The provision of personal data may be mandatory, e.g. with regard to our compliance with legal and regulatory obligations to which we are subject. Please be aware that failing to provide such information may preclude us from pursuing a Business Relationship with, and/or from rendering our services to, you.

We may assess certain characteristics of the Data Subjects on the basis of Personal Data processed automatically (profiling), in particular to provide Data Subjects with personalised offers and advice or information on our products and services or those of our affiliates and business partners. We may also use technologies that allow us to identify the level of risks linked to a Data Subject or to activity on an account.

We generally do not use automated decision-making in connection with our Business Relationship and/or Data Subjects. If we do so, however, we will comply with applicable legal and regulatory requirements.