Notification to clients and prospects

1. Introduction

EFG entities are committed to protecting your personal information by complying with confidentiality and data protection laws and regulations.

In this Privacy Notice ‘we’ refers (as applicable) to each and all entities of EFG Group, as defined below. A list of the EFG Group entities and their contact details can be found here: https://www.efginternational.com/contact.

This Privacy Notice applies to our clients and prospective clients (“you”). This Privacy Notice covers personal information that is held electronically and also applies to paper-based filing systems.

For the purposes of this Privacy Notice, EFG Group means the group of companies composed of EFG International AG and its worldwide affiliates (where an “affiliate” of, or a person “affiliated” with, a person is a person that directly, or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with, the person specified and “control,” including the terms “controlling,” “controlled by” and “under common control with,” means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a person, whether through the ownership of voting shares, by contract, or otherwise).

2. Types of personal information collected

In the course of examining a prospective banking relationship with you and/ or providing services to you, we may process personal information. This typically includes the following information relating to you:

(a) Information received from you, including:

• Personal contact details such as name, title, addresses, telephone numbers and personal email addresses;
• Date of birth and place of birth;
• Gender;
• Marital status, dependents (name and age) and relations;
• Copies of identification documents, such as national identity cards or passports;
• National insurance number, social security number or other national/ tax identifier;
• Information relating to criminal convictions or offences;
• Nationality, tax residence and country of residence;
• Employment details, income and source of wealth;
• Details of investments, assets owned and liabilities;
• Knowledge of and experience in investment matters; and
• Where applicable, personal details of any agent or attorney.

(b) Information received from third parties, including:

• The above categories;
• Credit references;
• Publicly available information on business, personal associates and assets owned; and
• Other information from third-party sources, such as wealth screening services, fraud prevention agencies, intermediaries.

(c) Information specific to our services, including:

• Account numbers;
• Balances;
• Investment holdings;
• Transaction data;
• Records of phone calls or video captures;
• Information automatically recorded when you access our websites, including date and time of the access and IP address;
• Reports and statements; and

(d) Special category personal information

In some cases (where and under the modalities permitted by law), special categories of personal information, such as your political opinions or affiliations, health information, racial or ethnic origin, religious or philosophical beliefs.

(e) Other

In relation to the evaluation of your application and/ or the services we provide to you, you may provide us with information about other persons (your additional card holders or account holders, business partners – including other shareholders or beneficial owners, dependents or family members, representatives, agents etc). Before providing us with such information, you should provide a copy of this notice to those persons and acquire, to the extent necessary, their prior consent for the relevant transfer of their data to us and the processing of their data by us.

3. Sources of personal information

We collect your personal information:

• Directly from you, e.g. in application forms and through information provided during the onboarding process, including background and reference checks;
• When it is provided to us by a third party, e.g. public registers, credit reference agencies, fraud prevention agencies, providers of enhanced due diligence reports and financial intermediaries, other EFG Group entities; and
• When information is created as a result of generally providing services to you.

4. How we use personal information

 (a) Legal basis for using your personal information

We will only use your Personal Data when the law allows us to. Most commonly and depending on the situation in which we will use your Personal Data (see paragraph (b) below) and on applicable legislation, we may use your Personal Data in the following circumstances:

• Where we need to perform the contract we have entered into with you or in order to take steps at your request prior to entering into any such contract;
• Where we need to comply with a legal obligation; and
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g. assuring high level standards across EFG Group, ensuring compliance with our policies and procedures);
• Where it is needed in the public interest;
• Where necessary for the establishment, exercise and defense of legal claims;
• Where we need to protect your interests (or someone else’s interests); and
• In limited circumstances, where you have given your consent.

(b) Situations in which we may use your personal information

The situations in which we may process your personal information are listed below.

• To confirm and verify your identity and credit status in relation to your application or account and, where applicable, to conduct an appropriateness assessment;
• To open, administer and operate your account and manage our relationship with you and to provide products or services to you (including carrying out or facilitating any transactions) as well as to improve the quality of our services;
• To monitor and analyze the contract for your accounts and relationship with us, to ensure compliance with our internal policies and/ or procedures and to be able to monitor risks and report them;
• To carry out business, operational and administrative activities, including record keeping and audits;
• To assess any credit limit or other credit decision (as well as the interest rate, fees and other changers to be applied to your account);
• To carry out statistical and other analysis, including profiling based on the products or services that you use for us or in which you might be interested, how you like to be contacted, etc;
• To conduct a survey;
• To comply with any applicable laws and regulations and/or any voluntary code or industry best practice we reasonably decide to adopt;
• To comply with the request or requirement of any court of any relevant jurisdiction or any relevant tribunal, mediator, arbitrator, ombudsman, taxation authority or regulatory or governmental authority;
• To carry out the detection, investigation and prevention of fraud, tax evasion, money laundering, bribery, corruption, terrorist financing and other crime or malpractice and oversee and report on such detection, investigation and prevention activities;
• For use in connection with any legal proceedings or regulatory action (including prospective legal proceedings/ regulatory action) and for obtaining legal advice or for establishing, exercising or defending legal rights; and
• To give you information and marketing materials (by post, telephone, email or other medium using the provided contact details) about events, products and services offered by us which may be of interest to you.

(b) If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to enter into a contract with you/ perform the contract we have entered into with you. Please note that we may still process any available personal information.

5. Recipients of your personal information

We (and those parties to whom personal information is disclosed) may disclose personal information in the situations described below:

• To any other companies which are at the time of disclosure in the EFG Group; in particular, several EFG Group entities may act as controllers of your data, i.e. determine the purposes and means of the processing of your data and may share them amongst each other. The resulting transfers may be based on one or more of the legal bases listed in section 4 (a) above, including the performance of the contract executed with you or taking steps at your request prior to entering into any such contract and/ or our legitimate interests and/ or the public interest. Processing may occur in one or more of the situations listed in section 4 (b) above, including the confirmation of your status in relation to your application or account and/ or the improvement of the quality of our services and/ or the monitoring of the compliance with internal policies and procedures, as well as the applicable legislation.
• To third parties/ processors of your personal information (including other EFG Group entities) who provide services to us or that act as our agents (or prospective third party service providers or prospective agents);
• To third parties in connection with a reorganization (including investment), amalgamation, merger or transfer or sale of all or part of our business, including to any insurers and professional advisors, and any third parties to whom we assign, transfer or charge our interest in any financial product or service provided to you;
• To any court of any relevant jurisdiction or any relevant tribunal, mediator, arbitrator, ombudsman, taxation authority or regulatory or governmental authority;
• To public authorities, regulators or governmental bodies, when required by law or regulations.
• To other financial institutions or organizations, payment recipients, clearing houses, clearing and settlement systems, stock exchanges, credit card associations etc, as the case might be;
• To any guarantor, where your account is backed by a guarantee;
• To our auditors and professional advisors (and those agents, auditors, service providers and professional advisors of other companies in the EFG Group);
• To insurers and information providers; or
• Otherwise if you consent to such disclosure.

In certain instances, such data sharing may be conducted through a cloud-based infrastructure.

6. Overseas transfers

We may transfer the personal information we collect about you to countries other than the country of our incorporation or the country in which the information originally was collected. Those countries may not have the same privacy laws as the country in which you initially provided the information.

When we transfer your personal information to other countries, we will protect that information as described in this Privacy Notice and in accordance with applicable law. If necessary, we require the recipients referred to in section 5 above to comply with appropriate safeguards designed to protect personal information.

A list of the countries in which EFG Group operates (inside and outside the European Economic Area) can be found here: https://www.efginternational.com/contact.html.

7. How to contact us

If you have a query regarding the processing of your personal information or if you would like to exercise your rights under the applicable legislation, please contact us at [email protected].

8. EEA Addendum

If you are in the European Economic Area (Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden, the "EEA"), the following additional EEA-specific provisions apply to our processing of your personal information.

A. Controller – EU Representative

The EFG Group’s entity that supports you is the controller of your personal information. A list of the EFG Group entities and their contact details can be found here: https://www.efginternational.com/contact. The EU Representative is EFG Bank (Luxembourg) S.A. (https://www.efginternational.com/lu).

B. Your duties and your European Privacy Rights

(a) Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

(b) Your rights in connection with personal information

Under certain circumstances, and subject to applicable law, you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes by writing to your Client Relationship Officer or using any opt-out facility specified by us in the relevant marketing communication.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Where your data is processed by automated means and:

• where we process your personal information on the basis of your consent, or
• where such processing is necessary for entering into or performing our obligations under a contract with you,

request the transfer of your personal information to you or to another party (also known as “data portability”).

• Where we process your personal information on the basis of your consent, withdraw that consent at any time. Please also note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• In certain circumstances, request not to be subject to automated decision-making, including profiling.

Certain of these rights are not absolute under the applicable legislation (as sometimes there may be overriding interests that require the processing to continue, for example); nonetheless we will consider your request and respond to you. Moreover, the exercise of some of these rights may result in non-examining/ rejecting your application or no longer being able to provide a product or service to you.

If you want to exercise your rights, as per above, please contact your Client Relationship Officer and/ or contact the Data Protection Officer/ the Privacy Officer of the EFG entity that supports you.

Finally, you have the right to lodge a complaint with the supervisory authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen.

(c) No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee depending on the nature of the request and applicable law/ regulations.

(d) What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

(e) Queries relating to the processing of your personal information

If you have a query regarding the processing of your personal information, please contact your Client Relationship Officer and/ or the Data Protection Officer/ the Privacy Officer of the EFG entity that supports you.

C. Retention of personal information

We will retain personal information for as long as necessary to fulfill the purpose for which it was collected or to comply with legal, regulatory, accounting, reporting or internal policy requirements. To determine the appropriate retention period for personal information, we consider the applicable legal requirements, as well as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means.

Further information on the retention periods of personal information can be requested from your Client Relationship Officer and/ or the Data Protection Officer/ the Privacy Officer of the EFG entity that supports you.

D. How to contact us

If you would like to exercise any of your rights in connection with your personal information or receive a copy of the safeguards designed to protect personal information in the case of transfer of your personal information outside the EEA or obtain further information on the retention periods of personal information, please contact us at [email protected].

9. Swiss Addendum

The additional provisions below apply to the processing of personal information which is subject to the Swiss Federal Data Protection Act.

A. Controller

The Swiss EFG Group’s entity that supports you (“Swiss EFG Entity”), is the controller of your personal information.

B. Overseas transfers

Your personal information may be transferred (including made accessible from) by the Swiss EFG entity to the following countries:

• Countries within the EEA;
• Other countries recognized by Switzerland as providing adequate privacy protection (for a list of these countries, please see https://www.fedlex.admin.ch/eli/cc/2022/568/fr#annex_1);
• Countries where other EFG Group entities / branches are established (for a complete list, see https://www.efginternational.com/ch/about/locations.html); certain service providers of the Swiss EFG Entity might be also established in these countries; and
• Countries whose national authorities oversee the activities of the Swiss EFG Entity.

Please note that your personal information may be communicated to other countries in which you hold financial investments (e.g., in securities, currencies or financial instruments, including derivatives or collective investment vehicles) and/or in which you perform transactions (e.g., payments, securities transactions or other transactions) in connection with services rendered to you by the Swiss EFG Entity. Such transfers of personal information (i) depend upon the instructions that the account holder (or an authorized representative) gives to the Swiss EFG Entity or (ii) may be required for specific needs triggered by the services you request from the Swiss EFG Entity. For example, in the context of a payment instruction in a currency other than CHF, the Swiss EFG Entity must communicate personal information pertaining to the instructing party to the corresponding bank located outside of Switzerland. Likewise, certain personal information pertaining to the investor may have to be communicated outside of Switzerland in the context of investments in certain collective investment schemes.

Some of the countries referred to above do not benefit from data protection regulations that have been recognized as being "adequate" (i.e., comparable standard) from a Swiss data protection perspective. When we transfer your personal information to such countries, we will implement appropriate safeguards in accordance with applicable law, (e.g. implementation of standard contractual clauses).

Finally, by way of derogation, please note that your personal information may be communicated to other countries in the context of (i) a transfer you have consented to, (ii) the execution or performance of your contract with the Swiss EFG Entity or a contract executed by the Swiss EFG Entity with a third party in your interest (iii) the safeguard of an overriding public interest, (iv) the establishment, exercise or defense of legal claims before a court or competent foreign authority or (v) the protection of a vital interest of yours or a third party’s when the data subject is not capable of giving consent.

10. Changes to this Privacy Notice

We reserve the right to update this Privacy Notice at any time, and we will notify you either in writing or by updating this Privacy Notice on our website at: https://www.efginternational.com/data-privacy.html. We may also notify you in other ways from time to time about the processing of your personal information.