Data privacy notice from BCV Group companies (“BCV Group”), and in particular Banque Cantonale Vaudoise (“BCV”).
Data privacy notice from BCV Group companies (“BCV Group”), and in particular Banque Cantonale Vaudoise (“BCV”).
BCV Group is firmly committed to protecting its customers’ personal data and to collecting and processing such data transparently and in compliance with the Swiss Federal Act on Data Protection (the “Act”). This notice describes customers’ data-protection rights and informs data subjects of the types of personal data processed by BCV and how BCV uses them, as well as the legal basis for its policy. This notice supplements both the contractual documentation governing the relationship between BCV and its customers (including Articles 17 to 19 of BCV’s General Conditions on outsourcing, data protection, and banking confidentiality) and the specific terms and conditions applicable to BCV’s various digital products and channels (particularly websites and mobile applications).
The term “personal data” refers to all information relating to an identified person (e.g., through their first and last name) or identifiable person (e.g., through a name or passport number). In the course of its business, BCV must collect and process personal data on the customer and related persons (hereinafter referred to collectively as the “data subject”), such as the representative of a legal entity, a trustee, a beneficial owner, the recipient of a payment order, or the holder of a power of attorney over one of the customer’s accounts. BCV asks the customer to provide any such related persons with the information contained in this document.
Depending on the product or service provided, BCV may be required to process the following types of personal data:
This information may be collected by BCV directly from each data subject or, in some cases, from public sources (such as a telephone directory or the United Nations sanctions list) or third parties (such as an intermediary or wealth screening services).
BCV processes data subjects’ personal data on the following legal grounds:
In keeping with the legal grounds set out in section 2.1 above, BCV processes personal data mainly for the following purposes:
BCV may process personal data when evaluating certain aspects of data subjects through automated data processing (“profiling”), in particular to provide tailored offers and advice or to provide information on BCV’s products and services, or aspects of affiliated entities or business partners. If BCV makes individual decisions based on automated data processing in its business relationships with customers, it will comply with applicable legal and regulatory requirements.
In order to provide its products and services, BCV may disclose personal data to:
In accordance with Article 17 of its General Conditions, BCV contractually requires its service providers to protect and maintain the confidentiality of the personal data that they process. Personal data may be disclosed to public, judicial, or administrative authorities or to regulatory or governmental bodies (such as supervisory authorities), upon their request. Personal data may also be disclosed to these entities so that BCV can determine facts, exercise its rights or defend itself from a current or future claim, or respond to an investigation carried out by a public authority in Switzerland or abroad.
Personal data may also be disclosed outside of Switzerland to the individuals mentioned in sections 3.1 above, as long as it complies with Swiss law. If personal data is disclosed to a State that cannot guarantee adequate protection as set out in the Act, BCV will put in place adequate technical, organizational, and legal measures to protect the personal data, including binding contractual commitments with the personal data recipient. With regard to the disclosure of personal data to authorities outside Switzerland within the meaning of section 3.2 above, BCV complies with the applicable legal provisions on international judicial assistance and with FINMA’s provisions on the direct transmission of non-public information to foreign authorities and entities.
The length of time personal data are stored depends on the applicable legal and regulatory storage period as well as the purpose for which they are processed. BCV generally stores personal data for 10 years after the business relationship ends. A longer storage period may be justified to enable BCV to determine facts, exercise its rights or defend itself from a current or future claim, or to respond to an investigation carried out by a public authority in Switzerland or abroad.
Data subjects have the following rights with regard to their personal data, subject to the applicable regulations, particularly in the event of a legal restriction, the overriding interest of a third party, or an unjustifiable request:
To exercise the rights set out in this section, data subjects must inform BCV in writing by sending a letter to the address below together with a copy of their valid ID card or passport.
Banque Cantonale Vaudoise
Legal Department
PO Box 300
1001 Lausanne
SwitzerlandThis notice was published on 1st October 2021; any updates will be published on BCV’s website (www.bcv.ch/en/Legal-information).