Privacy

Data protection information under the EU General Data Protection Regulation (GDPR)

With these data protection notices, we inform you, according to the EU General Data Protection Regulation (GDPR) applicable from 25 May 2018 on the processing of your personal data by us as well as the rights to which you are entitled. If necessary, these notes will be updated and published at https://www.bantleon.com/en/privacy. There you will also find our privacy policy for visitors to our website.
 

1. Who is responsible for processing your data and who can you contact?

The data controller within the Bantleon Group is the entity to which you maintain a business or contractual relationship or that initiated the data processing measure in question through its business activities:

Bantleon Invest GmbH
Aegidientorplatz 2a
D-30159 Hannover
Telephone: +49 (0) 511 288 798-20
E-Mail: mail@bantleon.com

The company data protection officer can be reached at:

Bantleon Invest GmbH
Data Protection Officer
Aegidientorplatz 2a
D-30159 Hannover
Telephone: +49 (0) 511 288 798-20
E-Mail: datenschutz@bantleon.com


Bantleon AG
Calridenstrasse 35
CH-8002 Zürich
Telephone: +41 (0) 41 728 77-30
E-Mail: fondsverwaltung@bantleon.com

Bantleon AG has a data protection representative in the EU within the meaning of Art. 27 GDPR as a contact point for supervisory authorities and affected persons on all issues related to EU data protection law:

Bantleon Invest GmbH
Data Protection Officer
Aegidientorplatz 2a
D-30159 Hannover
Telephone: +49 (0) 511 288 798-20
E-Mail: datenschutz@bantleon.com

 

2. Which sources and data do we use?

We process personal data that we receive from you in the course of our business relationship. In addition, we process – insofar as necessary for the provision of our services – personal data which we have obtained and are permitted to process from publicly accessible sources (e.g. debtor directories, commercial and association registers, the press, the Internet) or which has been transmitted to us by other companies of the Bantleon Group or other third parties with authorisation (e.g. to execute orders, to fulfill contracts or on the basis of your consent).

Relevant personal data in the prospect process, in the master data setup as well as in the context of fund share transactions can be:

Name, address/other contact details (telephone, e-mail address), date/place of birth, gender, nationality, language, marital status, business ability, occupational group key/type of partner (dependent/self-employed), credentials (eg ID data), authentication data (e.g. signature sample), tax ID, FATCA status.


3. Why do we process your data (purpose of data processing) and what is the legal basis for this?

We process personal data in accordance with the applicable legal and regulatory provisions. As regards data protection law, these include in particular the EU General Data Protection Regulation (GDPR), the German Data Protection Act (BDSG) and the Swiss Data Protection Act (DSG).

a) Fulfilment of contractual obligations (article 6 (1) b) GDPR)

The processing of personal data takes place for the purpose of providing business and services in the course of the performance of our contracts with you or for carrying out pre-contractual measures that are carried out at your request.

The purposes of the data processing are primarily based on the specific product or service in question and may include, among other, asset management and support, advice and the execution of transactions. The details of the purpose of the data processing can be taken from the respective contract documents.


b) Balancing of interests (article 6 (1) f) GDPR)

Where necessary, we process your data above and beyond the actual performance of our contractual obligations in order to safeguard the legitimate interests pursued by us or by a third party. Examples:

  • Evaluating and optimising procedures for demand analysis and for approaching clients directly; incl. client segmentation and calculating the likelihood of closure

  • Asserting legal claims and mounting a defence in the event of litigation

  • Ensuring the bank’s IT security and IT operations of the companies of the Bantleon Group

  • Prevention and investigation of crimes

  • Measures to manage business and further develop services and products

  • Group risk management


​c) On the basis of your consent (article 6 (1) a) GDPR)

Insofar as you have granted us consent to the processing of personal data for specific purposes, the lawfulness of such processing is based on your consent. Any consent granted may be revoked at any time. This also applies to the revocation of declarations of consent that are granted to us prior to the entry into force of the EU General Data Protection Regulation, i.e., prior to 25 May 2018. Please be advised that the revocation shall only have effect for the future. Any processing that was carried out prior to the revocation shall not be affected thereby.


d) Compliance with a legal obligation (article 6 (1) c) GDPR) or in the public interest (article 6 (1) e) GDPR)

The companies of the Bantleon Group are subject to various legal obligations, i.e., statutory requirements, that means legal requirements, (e.g. financial sector laws, money laundering laws, tax laws) as well as supervisory requirements (e.g. Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), Commission de Surveillance du Secteur Financier (CSSF) and/or Eidgenössische Finanzmarktaufsicht (FINMA)). The purposes of processing include, but are not limited to, identity verification, fraud and money laundering prevention, accounting, risk assessment and management, fulfillment of inquiries and requirements of national or foreign regulatory or law enforcement agencies as well as compliance with tax control and reporting requirements.


4. Who receives your data?

Within the Bantleon Group, only companies and agencies will have access to your data who require them for the fulfillment of the contractual and legal obligations or for the fulfillment of their respective tasks.

Service providers and vicarious agents employed by us may also receive data for these purposes if they observe secrecy and our instructions under data protection law. These are mainly companies from the categories listed below. With regard to the transfer of data to recipients outside the Bantleon Group, it must first of all be noted that the Bantleon Invest GmbH (as Management Company) resp. the Bantleon AG (as bank) are under a duty to maintain secrecy about any customer-related facts and evaluations of which they may have knowledge. They may only disclose information about you if they are legally required to do so, if you have given your consent, if we are authorised to provide information and/or if processors commissioned by us guarantee compliance with secrecy and the provisions of the EU General Data Protection Regulation.

Under these conditions, recipients of personal data may be, for example:

  • Public authorities and institutions (e.g. Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), Commission de Surveillance du Secteur Financier (CSSF), Eidgenössische Finanzmarktaufsicht (FINMA), other tax authorities) insofar as a statutory or official obligation exists.

  • Other credit and financial services institutions, comparable institutions and processors to whom we transfer personal data in order to perform the business relationship with you. Specifically: support/maintenance of EDP/IT applications, archiving, compliance services, controlling, data screening for anti-money laundering purposes, data destruction, collection, customer management, marketing, media technology, reporting, research, risk controlling, telephony, website management, investment services, share register, fund management, auditing services.

    ​​

5. How long will your data be stored?

We process and store your personal data as long as it is necessary for the performance of our contractual and statutory obligations. In this regard, it should be noted that our business relationship is a continuing obligation designed to last for several years and also includes the initiation and execution of a contract.

As far as Bantleon Invest GmbH is concerned, this is subject to various requirements for storage and documentation, including the German Commercial Code (HGB), the German Tax Code (AO), the Banking Act (KWG), the Money Laundering Act (GwG) and the German Securities Trading Act (WpHG). The deadlines for storage and documentation are two to ten years. Finally, the storage period is also based on the statutory limitation periods, which according to §§ 195 ff. of the German Civil Code (BGB) can generally amount to three years, in some cases up to thirty years.

As far as Bantleon AG is concerned, this is subject to various requirements for storage and documentation, including the Swiss Code of Obligations, the Value Added Tax Act, the Federal Law on Direct Federal Tax, the Federal Law on the Harmonization of Direct Taxes of the Cantons and Municipalities, the Federal Law on the Stamp Duties and the Withholding Tax Law. The deadlines for storage and documentation specified there are usually ten years. In addition, there are also limitation periods to be observed, which may be longer than the actual (minimum) storage periods.


6. Is data transferred to a third country or to an international organisation?

Personal data processed by Bantleon Invest GmbH are transmitted to the parent company (Bantleon AG) in Switzerland for the purpose of data backup. An appropriate level of data protection was confirmed by the EU Commission (appropriateness decision 2000/518/EC).


7. What data protection rights do you have?

Every data subject has a right of access (article 15 GDPR), a right to rectification (article 16 GDPR), a right to erasure (article 17 GDPR), a right to restriction of processing (article 18 GDPR) and a right to data portability (article 20 GDPR). The right of access and right to erasure are subject to the restrictions under sections 34 and 35 BDSG. Data subjects also have a right to lodge a complaint with a supervisory authority (article 77 GDPR in conjunction with section 19 BDSG).

You may revoke your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent that are granted prior to the entry into force of the EU General Data Protection Regulation, i.e., prior to 25 May 2018. Please be advised that the revocation will only take effect in the future. Any processing that was carried out prior to the revocation shall not be affected thereby.


8. Are you under any obligation to provide data?

Within the scope of our business relationship, you must only provide personal data which is necessary for the initiation, execution and termination of a business relationship or which we are legally obligated to collect. As a rule, we would not be able to enter into any contract or execute the order without these data or we may no longer be able to carry out an existing contract and would have to terminate it.

In particular, provisions of money laundering law require that we verify your identity before entering into the business relationship, for example, by means of your identity card and that we record your name, place of birth, date of birth, nationality and your residential address. In order for us to be able to comply with this statutory obligation, you must provide us with the necessary information and documents in accordance with the money laundering law and notify us without undue delay of any changes that may arise during the course of the business relationship. If you do not provide us with the necessary information and documents, we will not be allowed to enter into your requested business relationship.


9. To what extent is automated decision-making used?

As a rule, we do not make decisions based on automated processing as defined in article 22 GDPR to establish and implement the business relationship. If we use these procedures in individual cases, we will inform you of this separately, provided that this is prescribed by law.


10. Is profiling (scoring) carried out?

In some cases, we process your data automatically with the aim of evaluating certain personal aspects (profiling as defined in article 4 (4) GDPR). For instance, we use profiling in the following cases:

  • Due to legal and regulatory requirements, we are committed to combating money laundering, the financing of terrorism and property-related offenses. Data evaluations are also carried out (in payment transactions, among other things) in this context. These measures also serve to protect you.
  • We can also evaluate your data to determine your potential interest in our products and services. This evaluation is based on statistical methods using current customer data and those from the past. We use the results to be able to address you in a more needs-oriented and targeted way.
 

11. What rights of objection do you have?

a) Ad hoc right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on article 6 (1) e) GDPR (processing in the public interest) and article 6 (1) f) GDPR (processing for the purposes of safeguarding legitimate interests); this also includes any profiling based on those provisions within the meaning of article 4 (4) GDPR.

If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is for the establishment, exercise or defence of legal claims.


b) Right to object to the processing of data for marketing purposes

In certain cases, we may process your personal data for direct marketing purposes. You have the right to object at any time to processing of personal data concerning yourself for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

There are no formal requirements for lodging an objection. Our contact details can be found in section 1.
 

Privacy policy for visitors to our website

Reporting, processing and use of personal data

As a rule, you may browse our website without providing any personal data. However, in the interests of ensuring that the site is working properly, that it is secure and that a connection can be established, our web servers are set by default to store every session and the data automatically sent to them by your browser in log files, which are temporary in nature and automatically deleted when they expire. These log files contain the IP address of the computer from which you accessed the server, the date and time of your query, the name and URL of the file requested, the quantity of data transferred, a note as to whether or not the query was successful, details of the browser and operating system you use, the website from which you accessed the server and the name of your Internet service provider.

Bantleon does not use this website to record personal data of any kind. We only record personal data when you expressly and knowingly provide them. Some sections of our website prompt you to enter personal data. We need these in order to offer you certain services. You are asked to enter personal data in particular when you request documentation on Bantleon mutual funds or wish to contact us using the contact form provided. We only record, process and use your personal data for the purpose of handling your queries and orders and would like to make it clear that we comply with all applicable legal provisions in doing so. Your personal data are only ever used to the extent required for the stated purposes.

Protection of personal data and security

Bantleon undertakes to comply with the general legal provisions on data protection and data security. The data you provide will be kept strictly confidential. Companies within the Bantleon Group and service providers we use will only receive your information when needed to fulfill their contractual and legal obligations or their respective tasks. Personal data are only shared with government institutions and authorities to the extent required by national laws or for the purposes of law enforcement and criminal prosecution in the event of attacks on our network infrastructure. The Bantleon Group employs adequate technical and organisational security measures to protect the personal data you provide against accidental or deliberate manipulation, destruction and unauthorised access.

Data transfer and data flow

Please note that the Internet cannot be regarded in principle as a secure environment and that data transferred via the Internet can be accessible to unauthorised persons, which can result in such data being disclosed or altered or lead to technical disruptions. Data transferred via the Internet can also flow across national borders, even if the sender and recipient are both located in the same country. It is therefore possible for your data to be forwarded to a country in which data protection standards are lower than in your country of domicile. The Bantleon Groups accepts no responsibility or liability for the security of your data while they are being transferred to us via the Internet. We would like to point out that, in cases where you deem it appropriate, you have the option of communicating with us by other means for data protection reasons.

Your consent

In using our website, you consent to the Bantleon Group using your data as described above. You may at any time request information on your personal data held by us. If you have given us your consent to record, process and use your personal data, you may withdraw this consent at any time. Amendments to this information on data protection can become necessary due to improvements to the technology, content or structure of our website. If the Bantleon Group decides to amend this information in the interests of privacy and data protection, the amendments will be published on this page.

External Links

The website of the Bantleon group may also contain links to other providers' websites that are not covered by our data protection information. When we provide links to other sites, we attempt to ensure that these sites subscribe to the same values as we do. As a rule we have no influence over these providers' content and their compliance with data protection provisions and therefore request that you make yourself aware of the guidelines applicable on those sites when visiting them.

Notes on the use of Google Analytics

Our website uses Google Analytics, a web analysis service provided by Google Inc. (»Google«). Google Analytics uses cookies, which are text files stored on your computer that make it possible to analyse how the website is used. The information generated by a cookie on your usage of the website is normally sent to and stored on a Google server in the United States. However, IP anonymisation is activated for this website, so Google shortens your IP address within member states of the European Union or other countries that are contracting parties of the Agreement on the European Economic Area before sending it. The full IP address is only sent to and shortened on a Google server in the US in exceptional cases. For more information, see https://support.google.com/analytics/answer/6004245?hl=en (Google privacy policy). By using this website, you agree to the above. Google uses the information collected on behalf of the website administrator to analyse your usage of the website, compile reports on website activity and provide the administrator with other services connected to the use of the website and the Internet in general. The IP address your browser supplies to Google Analytics is not combined with any other data held by Google.

You can change your browser settings to prevent cookies from being stored on your computer. If you decide to do so, however, your ability to use certain parts of our website may be restricted. You can also prevent Google from collecting and processing the data generated by the cookie concerning your usage of the website (including your IP address) by downloading and installing the Google Analytics Opt-out Browser Add-on: http://tools.google.com/dlpage/gaoptout?hl=en.