1. Who is responsible for your personal data and who can you contact?
Pictet Group Entities (“Pictet”, “us” or “we”) process information and personal data (“Personal Data”) relating to you and/or any Related Person of yours [Related Person(s) and you together: the “Data Subject(s)”]. We do this in connection with our existing and/or prospective business relationships, including your use of our websites and applications (together: the “Business Relationship”). We can do so either as controller or as joint controller (the “Controller”).
A “Related Person” means an individual or entity whose information that you or a third party provides to us and/or information that otherwise comes to our knowledge in connection with our Business Relationship. A Related Person may include, but is not limited to, (i) a director, officer or employee of a company; (ii) a trustee, settlor or protector of a trust; (iii) a nominee or beneficial owner of an account; (iv) a substantial interest owner in an account; (v) a controlling person; (vi) a payee of a designated payment; (vii) a representative or agent (i.e. with a power of attorney, a right to information on an account, an e-banking user); or (viii) an employer or contractor.
We therefore ask you to liaise with all of your Related Persons and to pass this Privacy Notice and the information it contains on to them.
If you have any questions about this Privacy Notice, about your Controller or, more generally, about the processing of your (or your Related Persons’) Personal Data, you can contact your relationship manager or our Data Protection Officer at any of the following addresses:
Data Protection Officer EUROPE (EXCL. SWITZERLAND)
Avenue J.-F. Kennedy 15A
L-1855 Luxembourg
Luxembourg
europe-data-protection@pictet.com
Data Protection Officer ASIA
8-9/F Chater House
8 Connaught Road,
Central Hong Kong
asia-data-protection@pictet.com
Data Protection Officer BAHAMAS
P.O. Box N-4837
Bayside Executive Park, Building No. 1
West Bay Street and Blake Road, Nassau – Bahamas
bahamas-data-protection@pictet.com
Data Protection Officer NORTH AMERICA
1000 de la Gauchetiere West, Suite 3100
Montreal QC H3B 4W5
Canada
north-america-data-protection@pictet.com
Data Protection Officer PICTET ASSET MANAGEMENT (PAM)
Route des Acacias 60
1211 Geneva 73
Switzerland
pam-data-protection@pictet.com
2. How do we handle your Personal Data?
We are subject to certain confidentiality and/or secrecy obligations, e.g. those arising under laws governing data protection, contracts and professional or banking secrecy, whichever may be applicable.
This Privacy Notice deals with the way we process Personal Data. That means how we collect, use, store, transmit or otherwise handle or process, operations collectively defined in this document as “Processing” or “Processing Operations”. This Privacy Notice does not replace, and remains subject to, our applicable contractual terms and conditions.
We may conduct our Processing Operations either directly or indirectly, through other parties that process Personal Data on our behalf (the “Processors”).
Personal Data include any information relating to an identified or identifiable natural person or as defined in the applicable law.
Personal Data of Data Subjects that we process may be based on the following principal legal bases, bearing in mind that they may also rely cumulatively on other legal bases mentioned.
On the legal basis of contract performance, including the pre-contractual steps:
On the legal basis of legal and regulatory obligations:
On the legal basis of our legitimate interest:
On the legal basis of your prior consent:
4. For what purposes and on what legal bases do we process Personal Data?
Purposes for which we process Personal Data (the “Purposes”) may be based on the following principal legal bases, bearing in mind that they may also rely cumulatively on other mentioned legal bases.
We collect and process Personal Data as necessary for pre-contractual steps and performance of a contract to which you are a party and/or a Related Person is related, which encompasses the following Processing Operations:
We also collect and process Personal Data relating to compliance with legal and regulatory obligations to which we are subject, including to:
Furthermore, we may process Personal Data in connection with legitimate interests (including those of other Group entities) we pursue so that we can:
If our Personal Data Processes presuppose that you give your prior consent to doing so, we will seek your consent in due time and you will have the right to withdraw your consent at any time by contacting your relationship manager or our Data Protection Officer (see Section 1 above).
The provision of personal data may be mandatory, e.g. with regard to our compliance with legal and regulatory obligations to which we are subject. Please be aware that failing to provide such information may preclude us from pursuing a Business Relationship with, and/or from rendering our services to, you.
5. Do we rely on profiling or automated decision-making?
We may assess certain characteristics of the Data Subjects on the basis of Personal Data processed automatically (profiling), in particular to provide Data Subjects with personalised offers and advice or information on our products and services or those of our affiliates and business partners. We may also use technologies that allow us to identify the level of risks linked to a Data Subject or to activity on an account.
We generally do not use automated decision-making in connection with our Business Relationship and/or Data Subjects. If we do so, however, we will comply with applicable legal and regulatory requirements.
6. What sources do we use to collect your Personal Data?
To achieve the Purposes, we collect or receive personal data:
We reserve the right to disclose or make accessible the Personal Data to the following recipients, provided this is legally or otherwise authorised or required:
We undertake not to transfer personal data to any third parties other than those listed above, except as disclosed to Data Subjects from time to time or if required by applicable laws and regulations applicable to them or by any order from a court, governmental, supervisory or regulatory body, including tax authorities.
In the course of our Business Relationship, we may disclose, transfer and/or store Personal Data abroad (“International Transfer”): (i) in connection with the conclusion or performance of contracts directly or indirectly related to our Business Relationship, e.g. a contract with you or with third parties in your interest; or (ii) in exceptional cases duly provided for by applicable laws (e.g. disclosures of certain trades made on an exchange to international trade registers).
International Transfers may include the transfer to jurisdictions that: (i) ensure an adequate level of data protection for the rights and freedoms of Data Subjects as regards Processing; (ii) benefit from adequacy decisions as regards their level of data protection (e.g. adequacy decisions from the European Commission or the Swiss Federal Data Protection and Information Commissioner); or (iii) do not benefit from such adequacy decisions and do not offer an adequate level of data protection. In the latter case, we will ensure that appropriate safeguards are provided, e.g. by using standard contractual data protection clauses established by the European Commission.
Specific information for Switzerland: Pictet entities based in Switzerland process your personal data in connection with the conclusion or performance of contracts directly or indirectly related to our Business Relationship in data centres located in Switzerland or the European Union. Pictet entities may transfer your personal data to additional countries in certain circumstances, for example if you opt for servicing by other Pictet entities (a full list of which is available on our website at https://www.pictet.com/ch/en/offices); to comply with your requests, such as for offshore investments or specific mandates; to fulfil banking requirements, which may include tax reporting to your country of domicile; or for purposes related to the execution of your contracts. For Pictet Asset Management clients only, the first names, last names and contact information of clients’ representatives are transferred to the United States of America for client relationship management purposes and in the context of organising marketing events.
Subject to the limitations set forth in this Privacy Notice and/or in applicable local data protection laws, you can exercise the rights below free of charge by contacting the Data Protection Officer (see Section 1 above):
If a Data Subject objects to the Processing of Personal Data, we are nevertheless allowed to continue with the Processing if it is: (i) legally mandatory; (ii) necessary for the performance of a contract to which the Data Subject is a party; or (iii) necessary for the purposes of the legitimate interests we pursue, including the establishment, exercise or defence of legal claims. We will not, however, use the Data Subject’s Personal Data for direct marketing purposes if the Data Subject asks us not to do so.
10. How long are your Personal Data kept or stored?
In principle, we retain Personal Data for as long as we need to do so to achieve the Purposes. We will delete or anonymise Personal Data (or equivalent) once they are no longer necessary to achieve the Purposes, subject however: (i) to any applicable legal or regulatory requirements to store Personal Data for a longer period; or (ii) to establishing, exercising and/or defending actual or potential legal claims, investigations or similar proceedings, including legal holds. We may enforce any or all of the above mentioned under points (i) and (ii) to preserve relevant information.
* * * *
Status as at August 2023