Data Privacy Notice - Skandinaviska Enskilda Banken AB Luxembourg Branch

Any personal information provided to or collected by us will be processed by us, Skandinaviska Enskilda Banken AB Luxembourg Branch, having our registered  office at 4, rue Peternelchen, L-2370, Howald, and registered with the Trade and Companies Register of Luxembourg under number B39819, a branch of Skandinaviska Enskilda Banken AB (publ), incorporated under Swedish law in Sweden (hereafter “SEB Luxembourg” or “we”), in our capacity of controller or by our subcontractors and service providers as further described in the Privacy Notice in their capacity as processors.

We have appointed a Data Protection Officer (DPO). You can contact our DPO at dpo@sebgroup.lu. You can also contact you regular contact person within SEB Luxembourg in relation to any question regarding processing of your personal data.

We process the data that we receive through our business relationship with you. We receive the data either directly from you, e.g. in the context of opening a bank account or placing an order or through your representative/ attorney/ intermediary who manages your current account or has verified your credentials while opening the bank account, or through a sender’s bank for incoming cash and securities transfers.

In particular, the data we process about you includes:

• identification data (e.g. name, e-mail, postal address, telephone number, country of residence, passport, identity card, driving license, tax identification number, identification credentials to connect to Internet Banking Service);
• electronic identification data (e.g. traffic data);
• personal characteristics (e.g. date of birth, marital status);
• banking and financial data (e.g. financial identification, financial situation, risk profile, investment objectives and preferences);
• employment and occupation e.g. employer, function, title, place of work, specialisation;
• data received in the context of providing the custody and execution of orders services (e.g. securities orders, account positions and transactions, and power of attorneys);
• tax-related data, contract data for SEB Luxembourg-products (e.g. with regard to savings and payout plans);
• communications (e.g. exchange of letters with you);
• images and sound (e.g. copies of identifications documents);
• advertisement and sales data (e.g. potential interesting products for you).

These types of personal data may include special categories of data (e.g. information about memberships and affiliations to political parties or similar groups). 

All of the above mentioned categories of data are hereinafter referred to as “Personal Data” if they are structured and accessible according to specific criteria.

We may collect Personal Data about you directly or from other public or private legitimate sources. Such sources include third party data aggregators (including Worldcheck), public sources, and credit rating agencies. 

Hereinafter, we inform you about the purposes and legal basis of the processing of your Personal Data by us.

3.1.    For the performance of contractual obligations
If you are an individual being our client, we process your Personal Data for the performance of our contracts with you, e.g. for portfolio management and execution of your orders, including the management of your deposits and loans, investments and other banking services, evaluation of your financial needs, monitoring of your financial situation including assessing your creditworthiness and solvency and generally for conducting our business relationship with you. The specific data processing purposes are determined in accordance with the particular product and the underlying contract.

3.2.    For purposes that are in our legitimate interest
We may also process your Personal Data on the basis of a balance of interests to pursue our or a third party’s legitimate interests. This is carried out for the following purposes:

• Client advisory services and sales;
• General management and development of services, systems and products;
• Compliance with our internal requirements and those of the SEB group affiliated companies (SEB Group), including credit and risk management, insurance, audit and management purposes to ensure the sound and responsible management of the bank and of the SEB Group;
• In case of possible mergers or acquisitions or the sale of assets or business lines covering SEB Luxembourg or the SEB Group;
• To ensure the safety and continuity of our IT services
• Effecting the processing on our behalf (e.g. disclosure of your Personal Data to service providers for outsourcing purposes);
• Advertisement and marketing research;
• Establishment, exercise and defence of legal claims;
• Prevention and investigation of crime, as well as risk management and fraud prevention; and
• If Personal Data covers client-related individuals, in our and the client’s legitimate interest for the purpose of the provision of the services to the client.

Our interest for the respective processing of data is based on the respective purposes and is otherwise of economic nature (efficient task fulfilment, sales, and avoidance of legal risks).

As far as possible in respect with the particular purpose, we rely on encryption, pseudonymisation and/or anonymisation to process your Personal Data.

3.3.    With your consent
Insofar you have given us your consent for the processing of Personal Data, such consent will serve as a legal basis for the referred processing.

This includes your potential consent that you may have given for payment processing and to be contacted by phone for offers and promotions (e.g. about products and services of the SEB Group or those of our commercial partners).

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. This also applies to any consent given before the coming into force of the GDPR on 25 May 2018. The withdrawal only affects future processing.

3.4.    For the compliance with a legal obligation
We are subject to various legal obligations in terms of statutory (e.g. laws of the financial sector, anti-money laundering and combating the financing of terrorism laws, tax laws) and regulatory requirements (e.g. European Central Bank, European Banking Regulator, and the Commission de Surveillance du Secteur Financier (CSSF), the Luxembourg Financial Supervisory Authority). 

This covers our processing of your Personal Data for compliance with applicable banking law such as the applicable legislation on markets in financial instruments (MiFID and MiFID II), know-your-Customer (KYC) and anti-money laundering and combating the financing of terrorism (AML/CFT), in the latter case including the processing of special categories of data relating to you, compliance with requests from or requirements of local or foreign regulatory enforcement authorities, tax identification and reporting (where appropriate) notably under Council Directive 2011/16/EU on administrative cooperation in the field of taxation (as amended by Council Directive 2014/107/EU), the OECD’s standard for automatic exchange of financial account information commonly referred to as the Common Reporting Standard or CRS, for Foreign Account Tax and Compliance Act (FATCA) purposes, for the Automatic Exchange of Information (AEI) and any other exchange of information regime to which we may be subject to from time to time. 

Your Personal Data may be shared with Luxembourg tax authorities (or to service providers for the purpose of effecting the reporting on our behalf) and may be forwarded by the latter to foreign tax authorities (failure to provide correct information to us or to respond may result in incorrect or double reporting).

Your Personal Data will only be transferred in compliance with the professional secrecy requirements or if you have waived your bank secrecy rights in our terms and conditions, and this only if there is a legal basis for the transfer.

Within SEB Luxembourg, your Personal Data will only be disclosed to those entities that need to access such to comply with our contractual or legal obligations listed above or to fulfil their respective tasks (e.g. securities account services, AML/CFT laws, sales and marketing).

Beyond that, your Personal Data may be disclosed to the following entities:

• Other departments and/or SEB Group companies that process your Personal Data for credit assessment purposes, for outsourcing purposes, for establishing the business relationship with you and complying with our legal and regulatory obligations;
• Processors (i.e. service providers) appointed by us, that process your Personal Data on our instructions;
• Administrations, public services, local authorities and institutions (e.g. CSSF, FI, European Banking Regulator, European Central Bank, tax authorities) in the case of a statutory or regulatory obligation;
• The respective shareholders, agents, employees, consultants, representatives, authorized representatives, financial intermediaries, auditors, service providers, as well as any affiliates or subsidiaries of SEB Luxembourg (and their respective agents, employees, consultants, representatives, authorized representatives);
• Entities that act on behalf of you or which have a business relation with you such as, payment recipients, beneficiaries, authorized representatives, intermediaries, clearing houses, clearing and settlement systems, companies in which you hold securities (if those securities are kept by the bank for the client), etc.;
• Specialised companies, such as the Society for Worldwide Interbank Financial Telecommunication (SWIFT) and clearing companies that process Personal Data relating to money transactions and that can use for those purposes processing centres that are located within the European Union or abroad (particularly the United States);
• Other financial institutions or credit agencies or bureaus in order to receive or provide credit reports;
• External managers that provide asset management services for the client;
• Introducing intermediaries that introduce or bring contacts to SEB Luxembourg;
• Parties involved in the context of a company restructuring, transfer, divestiture, fusion or acquisition at the level of the bank or the SEB Group;
• Other entities, based on your consent.

As far as necessary, we will keep your Personal Data for the duration of our business relationship, which includes the preparation and signing of a contract.

Personal Data will be retained for ten (10) years after the closing of the end of the financial year to which they relate or any longer period as may be imposed or permitted by law, in consideration of the legal limitation periods (including for litigation purposes). Personal data processed for AML and KYC purposes will be retained for ten (10) years after the end of the contract with the client. 

We transfer your Personal Data to countries outside of the European Economic Area (EEA) insofar as necessary for the execution of your orders (e.g. security orders), for complying with a legal obligation, or where you have given us your consent to do so or where our service providers are located outside of the EEA to countries that may not offer the same level of protection of Personal Data as the one offered in the EEA. In the latter case your Personal Data will be protected by appropriate safeguards such as standard contractual clauses approved by the European Commission and you may obtain a copy of such safeguards by contacting our DPO at dpo@sebgroup.lu.

Pursuant to the GDPR, you have the following rights: 
a)    the right to access Personal Data, free of charge, within reasonable intervals and in a timely manner, as well as all information on the origin of such Personal Data; 
b)    the right to have inaccurate or redundant data rectified or erased; 
c)    the right to request the erasure of Personal Data without undue delay when the use or other processing of such data is no longer necessary for the purposes described above, and notably when consent relating to a specific processing has been withdrawn or where the processing is not or no longer lawful for other reasons; 
d)    in cases where the accuracy of the data is contested, the processing is unlawful, or where you have objected to the processing of your Personal Data, you may ask for the restriction of the processing of such Personal Data. This means that Personal Data will, with the exception of storage, only be processed with or for the establishment, exercise or defence of legal claims of SEB Luxembourg, for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State. In case a processing is restricted, you will be informed before the restriction of processing is lifted;
e)    the right to data portability where the processing is based on the execution of a contract or consent, is performed by automated means and where the data has been provided by you; and

In addition to the rights listed above, should you consider that SEB Luxembourg does not comply with the applicable privacy rules, or have concerns with regard to the protection of their Personal Data, you may file a complaint with the Luxembourg data protection authority (the Commission Nationale pour la Protection des Données – CNPD) or another data protection authority in the European Union (for instance in the Member State in which you reside).

In the context of our business relationship, you only have to provide those Personal Data that are necessary for the formation, performance, and termination of a business relationship or that we are required by law to collect from you. 

Without those Personal Data, we will generally refuse to sign or to perform the contract, or stop performing or, where appropriate, terminate an existing contract. In particular, AML/CFT laws require us, before entering into a business relationship with you, to identify you, for example by demanding your identity card, your name, date of birth, place of birth, nationality, official residence and further documentation, including regarding tax status, as the case may be. In order for us to comply with those legal requirements, you have to provide us, pursuant to AML/CFT laws, with the necessary information and documents and to inform us immediately of any subsequent change. We cannot enter into or maintain the desired business relationship with you, if you do not provide us with the necessary information and documents.

In general, we do not use automated individual decision-making for the formation and performance of the business relationship. If we should rely on such processing in a particular situation, we will inform you separately, insofar we are legally required to do so.

We process your Personal Data partly by automated means in order to evaluate certain personal aspects (so called “profiling”). We use profiling for example in the following cases:

• By virtue of statutory and regulatory requirements, we are obliged to take part in the fight against money laundering and terrorism financing, economic crime and terrorist financing. For that purpose, we also analyse your Personal Data (inter alia your transactions). These measures are also for your own protection.
• We may also analyse your Personal Data to determine your potential interest in our products and services. For this analysis, we rely on statistics combing both your current Personal Data and those of the past. We use the results to offer you a client service tailored to your needs and goals, as well as to support the client advisory services.

(a)    Right to object relating to your particular situation
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your Personal Data, which is based on legitimate interests. This includes profiling used for example for client advisory services and sales.

If you object, we will no longer process your Personal Data, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

(b)    Right to object where your Personal Data are processed for direct marketing purposes 
We may, within the legal limits, process your Personal Data for direct marketing purposes. You have the right to object at any time to processing of your Personal Data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your Personal Data will no longer be processed for such purposes.

Your right to object is not bound to any formalities. Please find our contact details under section 1 above.