Data Protection Declaration

1. General terms
This data protection declaration explains how we process personal data.

“Personal data“ means all details related to a specific or identifiable natural or legal person. „Processing“ means all ways of dealing with personal data, irrespective of the means and procedures used, in particular procuring, storing, using, revising, disclosing, archiving and destroying of personal data.

In connection with specific kinds of data processing, e.g. the entry into contracts, additional provisions might apply. Such provisions are available in the respective contracts.

2. Data security
We undertake to protect your privacy in accordance with the applicable laws, especially the code of conduct and data protection law. For this reason, we take a number of precautions, such as implementing technical and organizational security measures (e.g. access restrictions, firewalls, personal passwords such as encryption and authentication technologies, staff training).

3. Categories of personal data
We can process the following categories of personal data while limiting the processing to the necessary minimum.

Client data such as:

• Master data and data on holdings (e.g. name, address, nationality, date of birth, information about accounts, custody accounts, concluded transactions and contracts, information about third parties who are also affected by the data processing, such as spouses, authorized representatives and advisors).
• Transaction data, order data, and risk management data (e.g. data regarding beneficiaries of payments, the beneficiary’s bank, the amount of payments, data on risk and investment profiles, investment products).
• Technical data (e.g. business numbers, IP addresses, internal and external identifiers, records of access).
• Marketing data (e.g. preferences, needs).

Data of interested parties and visitors (i.e. our visitors or visitors of our website) such as:

• Master data and data on holdings (e.g. name, address, date of birth).
• Technical data (e.g. IP addresses, internal and external identifiers, records of access).
• Marketing data (e.g. preferences, needs).

Supplier data such as:

• Master data and data on holdings (e.g. name, address, date of birth, concluded transactions and contracts).
• Technical data (e.g. IP addresses, internal and external identifiers, records of access).

4. Origin of personal data
For the purposes of section 5, we can collect personal data from the following sources:

• Personal data given to us, e.g. for the entering into a business relationship, the execution of contracts, or our products and services.
• Personal data necessary for the use of products or services and transmitted to us via the technical infrastructure or complex processes.
• Personal data from third parties, e.g. authorities or UNO/EU sanction lists.

5. Purposes of data processing
We can process personal data for the provision of own services and for own or legally prescribed purposes. In particular, the purposes of our data processing are the following:

• Entering into and executing of contracts, processing and managing products and services (e.g. payments, investments).
• Monitoring and managing risks (e.g. investment profiles, combating of money laundering, limits, market risks).
• Planning, business decisions (e.g. developing of new or assessing of existing services and products).
• Marketing, communication, information about and review of the range of services (e.g. advertisements in print and online; events for clients and interested parties as well as other events, determination of future client needs).
• Compliance with legal or regulatory disclosure, notification or reporting obligations to courts and authorities, fulfilment of official orders (e.g. reporting obligations towards FINMA and foreign supervisory authorities, orders of prosecution departments in connection with money laundering and terrorist financing).
• Protecting our interests and securing our rights in case of claims against us or own claims against third parties.