1.1 In order to service our clients BrokerCreditServiceEU (hereinafter “BrokerCreditServiceEU” “we” or “us”) needs to collect personal data from our clients and/or potential clients and employees. Considering the above, BrokerCreditServiceEU wants to ensure a high level of data protection as privacy is a cornerstone in gaining and maintaining the trust of our clients, employees and suppliers and thus, ensuring BrokerCreditServiceEU Markets business in the future. The protection of personal data requires that appropriate technical and organizational measures are taken to demonstrate a high level of data protection. BrokerCreditServiceEU has adopted a number of internal and external data protection policies, which must be adhered to by employees of BrokerCreditServiceEU. Additionally, BrokerCreditServiceEU will monitor, audit and document internal compliance with the data protection policies and applicable statutory data protection requirements, including the General Data Protection Regulation (“GDPR”). BrokerCreditServiceEU will also take the necessary steps in order to enhance data protection compliance within the organization. These steps include the assignment of responsibilities, raising awareness and training of staff involved in processing operations. Please note that this Privacy Policy will be reviewed from time to time to take into account any new obligations and that any personal data we hold will be governed by our most recent policy. This Privacy Policy, along with guidelines for processing of personal data, constitutes the overall framework for processing of personal data within BrokerCreditServiceEU.
1.2 “Personal data” is any information which may be related to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, location data, phone number, age, gender, an employee, a job applicant, clients, suppliers and other business partners. This also includes special categories of personal data (sensitive personal data) and confidential information such as health information, account number, identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
1.3 Although, information regarding companies/businesses is not as such, personal data, please note that information relating to contacts within such companies/ businesses, e.g., name, title, work email, work phone number, etc. is considered personal data.
1.4 BrokerCreditServiceEU collects and uses personal data for a variety of legitimate business purposes, including establishment and management of customer and supplier relationships, completion of purchase orders, recruitment and management of all aspects of terms and conditions of employment, communication, fulfilment of legal obligations or requirements, performance of contracts, providing services to clients, etc.
1.5 Personal data shall always be:
1.6 BrokerCreditServiceEU shall be responsible for and be able to demonstrate compliance with the above as part of BCS Global Markets accountability.
2.1 Processing of personal data requires a legal basis. The most predominant legal basis for processing personal data within BrokerCreditServiceEU are:
2.2 Consent
2.2.1 If the collection, registration and further processing of personal data on clients, suppliers, other business relations and employees are based on such a person’s consent to the processing of personal data for one or more specific purposes, BrokerCreditServiceEU shall be able to demonstrate that the data subject has consented to processing of such personal data.
2.2.2 Consent shall be freely given, specific, informed and unambiguous. The data subject must actively consent to the processing of personal data by a statement or by a clear affirmative action, to him/her.
2.2.3 A request for consent shall be presented in a manner, which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.
2.2.4 To process special categories of personal data (sensitive personal data) the consent shall also be explicit.
2.2.5 The data subject is entitled to withdraw his/her consent at any time and upon such withdrawal, we will stop collecting or processing personal data about that person unless we are obligated or entitled to do so based on another legal basis.
2.3 Necessary for the performance of a contract:
2.3.1 It will be legitimate to collect and process personal data relevant to the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. This applies to all contractual obligations and agreements signed with BrokerCreditServiceEU, including the pre-contractual phase irrespective of the success of the contract negotiation or not.
2.4 Comply with a legal obligation
2.4.1 BrokerCreditServiceEU has to comply with various legal obligations and requirements, which have basis in Union or Member State law. Such legal obligation, to which BrokerCreditServiceEU is subject, may be sufficient as a legitimate basis for processing of personal data.
2.4.2 Such legal obligations include obligations to collect, register and/or make available certain types of information relating to employees, clients, etc. Such legal requirements will then form the legal basis for us to process the personal data, however, it is important to note whether the provisions allowing or requiring BrokerCreditServiceEU Markets to process certain personal data also set out requirements in relation to storage, disclosure and deletion.
2.5 Legitimate interests
2.5.1 Data will only be processed where it is necessary for the purposes of the legitimate interests pursued by BCS Global Markets, and these interests or fundamental rights are not overridden by the interests of the data subject. BCS Global Markets will, when deciding to process data ensures that the legitimate interests override the rights and freedoms of the individual and that the processing would not cause unwarranted harm. For instance, it is a legitimate interest of BrokerCreditServiceEU to process personal data on potential client in order to expand the business and develop new business relations. The data subject must be given information on the specific legitimate interest if a processing is based on this provision, cf. section 4.1 below.
3.1 BrokerCreditServiceEU as Data Controller
3.1.1 BrokerCreditServiceEU will be considered a data controller to the extent that we decide by which means the data subject’s personal data shall be processed e.g., when a data subject signs an agreement with BrokerCreditServiceEU Markets.
3.2 Use of data processors
3.2.1 An external data processor is a company, which processes personal data on behalf of BrokerCreditServiceEU and in accordance with BrokerCreditServiceEU instructions, e.g., in relation to HR systems, third party IT providers, etc. When BrokerCreditServiceEU outsources the processing of personal data to data processors, BrokerCreditServiceEU ensures that said company as a minimum applies the same degree of data protection as BrokerCreditServiceEU. If this cannot be guaranteed, BCS Global Markets will choose another data processor.
3.3 Data processing agreements
3.3.1 Prior to transfer of personal data to the data processor, BrokerCreditServiceEU shall enter into a written data processing agreement with the data processor. The data processing agreement ensures that BrokerCreditServiceEU controls the processing of personal data, which takes place outside BrokerCreditServiceEU for which BrokerCreditServiceEU is responsible.
3.3.2 If the data processor/sub-data processor is located outside the EU/EEA, the conditions of clause 3.4.4 below will apply.
3.4 Disclosure of personal data
3.4.1 Before disclosing personal data to others, it is the responsibility of BrokerCreditServiceEU to consider whether the recipient is employed by us or not. Furthermore, we may only share Personal data within BrokerCreditServiceEU, if we have a legitimate business purpose in the disclosure.
3.4.2 It is BrokerCreditServiceEU responsibility to ensure that the recipient has a legitimate purpose for receiving the personal data and to ensure that sharing of personal data is restricted and kept to a minimum. This may include third parties carrying out identity checks to verify your identity on our behalf.
3.4.3 BrokerCreditServiceEU must show caution before sharing personal data with persons, data subjects or entities outside of BrokerCreditServiceEU. Personal data shall only be disclosed to third parties acting as individual data controllers if a legitimate purpose for such transfer exists. If the recipient is acting as a data processor, please refer to clause 3.2 above.
3.4.4 If the third-party recipient is located outside the EU/EEA in a country not ensuring an adequate level of data protection, the transfer can only be completed if a transfer agreement has been entered into between BCS Global Markets and the third party. The transfer agreement shall be based on the EU Standard Contractual Clauses.
4.1 Duty of information
4.1.1 When BrokerCreditServiceEU collects and registers personal data on data subjects BrokerCreditServiceEU is obligated to inform such persons about:
This information will in most cases be provided via a privacy notice on BrokerCreditServiceEU home page.
4.2 Right to access
4.2.1 Any person whose personal data BrokerCreditServiceEU is processing, including, but not limited to, BCS Global Markets employees, job applicants, external suppliers, clients, potential clients, business partners, etc. has the right to request access to the personal data which BrokerCreditServiceEU processes or stores about him/her.
4.2.2 If BrokerCreditServiceEU processes or stores personal data about the data subject, the data subject shall have the right to access the personal data and the reasons for the data to be processed in relation to the criteria set out in 4.1.1.
4.3 The data subject shall have the right to obtain from BrokerCreditServiceEU without undue delay the rectification of inaccurate personal data concerning him or her.
4.4 The data subject shall have the right to obtain from BrokerCreditServiceEU the erasure of personal data concerning him or her and BrokerCreditServiceEU shall have the obligation to erase personal data without undue delay, unless required by law to retain any information for a prescribed period of time, for example, by financial regulators or tax authorities.
4.5 The data subject shall have the right to obtain from BrokerCreditServiceEU restriction of processing, if applicable.
4.6 The data subject shall have the right to receive the personal data registered in a structured and commonly used and machine-readable format, if applicable.
4.7 The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on a balancing of interests, including profiling.
4.8 Any requests received from a data subject to exercise the rights in this clause will be answered as soon as reasonably possible, and no later than 30 days from receipt. Requests shall be forwarded without delay to BrokerCreditServiceEU Markets Service Center. The Service Center will be supported by the BrokerCreditServiceEU Data Protection Officer to process the request to meet the reply deadline.
5.1 New products, services, technical solutions, etc. must be developed so that they meet the principles of data protection by design and data protection by default.
5.1.1 Data protection by design means that when designing new products or services due consideration to data protection is taken.
5.1.2 Data protection by default requires that relevant data minimization techniques are implemented.
6.1 BrokerCreditServiceEU shall as data controller maintain records of processing activities under BrokerCreditServiceEU Markets responsibility. The records shall contain the following information:
6.1.1 BrokerCreditServiceEU shall make the records available to relevant data protection authorities upon request.
7.1 Personal data shall be deleted when BrokerCreditServiceEU no longer has a legitimate purpose for the continuous processing or storage of the personal data, or when it is no longer required to store the personal data in accordance with applicable legal requirements.
7.2 Detailed retention periods with respect to various categories of personal data are specified in BCS Global Markets Data Retention and Information Sharing policy.
8.1 If BrokerCreditServiceEU processes personal data that is likely to result in a high risk for the persons whose personal data is being processed, a Data Protection Impact Assessment (“DPIA”) shall be carried out.
8.1.1 A DPIA implies that BrokerCreditServiceEU will, taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with data protection requirements.
8.2 The technical and organizational measures shall be reviewed and updated where necessary and no later than every 6 months.
8.2.1 Adherence to approved codes of conduct or approved certification mechanisms may be used as an element by which to demonstrate compliance with the appropriate technical and organizational measures pursuant to this clause.
9.1 BrokerCreditServiceEU shall comply with both the GDPR and national data protection legislation.
9.2 If applicable national legislation requires a higher level of protection for personal data than such policies/guidelines, such stricter requirements are to be complied with. If BrokerCreditServiceEU policies/guidelines are stricter than the local legislation, our policies/guidelines must be complied with.
10.1 If you have any questions regarding the content of this policy, please contact BrokerCreditServiceEU Data Protection officer at [email protected]
10.2 If you would like to file a complaint about BrokerCreditServiceEU processing of personal data, please contact the Information Commissioner’s Office.
Vashiotis Kalande offices, Mesa Geitonia, 4004, Limassol, Cyprus.
99 Bishopsgate,Floor 1/7, London, EC2M3XD
(+1) 705-996-5193
