Processing of personal data in the Evli Group

Information is obtained, for example, from the data subject, from the data subject's representative and from third-party sources such as registers maintained by public authorities. With the data subject's consent, information may also be obtained from other parties, such as an asset manager or an employer. Personal data may also be collected from the entity on whose behalf the data subject acts vis-à-vis Evli. Confidentiality obligations restrict the disclosure of information held by the Evli Group to outsiders other than with the consent of the person to whom the information relates, or in cases required by law, for example to public authorities.

Examples of third-party sources of information:

• registers maintained by public authorities (for example population information registers, and registers of the Tax Administration)
• lists of economic sanctions (for example registers maintained by international organisations, such as those of the European Union and the United Nations, as well as national registers, such as the lists maintained by the Office of Foreign Assets Control (OFAC) and the lists of the Finnish National Bureau of Investigation)
• other publicly available sources, including commercial sources.

Evli's offices are equipped with surveillance cameras for security reasons and in order to prevent criminal activities. The areas subject to camera surveillance are indicated by signs at our offices. We carry out camera surveillance as part of our security system. Recorded material may be shared with public authorities if such sharing is necessary for a criminal investigation.

Contract

Evli collects personal data before the preparation or conclusion of an agreement or the execution of an order. Evli processes data in order to document and fulfil its contractual obligations towards the client, to offer the client certain products and services, and to give effect to the agreement.

Examples of processing activities in which Evli relies on this ground for processing:

• establishing the client's background information for the purposes of investment advice and the provision of services and products
• managing the client relationship and client communications
• administering and monitoring orders, transactions, payments, charges, transfers and withdrawals
• monitoring compliance with Evli's terms of use and intervening in misuse
• administering credits granted
• verifying identity and identifying the client in order to provide the client with a digital online service
• cooperating with third parties in order to fulfil contractual obligations.

Legal obligation

Various laws, regulations and decisions of public authorities require Evli to process clients' personal data.

Examples of processing activities in which Evli relies on this ground for processing:

• customer due diligence
• preventing money laundering and terrorist financing
• client profiling in order to prevent fraud and to support activities aimed at preventing money laundering and terrorism
• sanctions screening
• client categorisation in accordance with securities markets regulation
• carrying out appropriateness and suitability assessments for the client
• recording calls with clients
• reporting to public authorities (for example the tax authority, the police, and enforcement and supervisory authorities)
• meeting risk management obligations
• carrying out accounting activities
• audits, such as financial and internal audits
• complying with service- and product-specific legislation (regulation and reporting relating to securities, funds and other instruments)
• handling and monitoring client complaints
• using data in the positive credit register maintained by the Finnish Tax Administration to check the creditworthiness of a private individual.

Consent

If electronic direct marketing is not based on a legitimate interest, Evli requests a separate consent from the client for the processing of personal data. The request for consent states the purpose of the processing, the personal data to be processed and the right to withdraw consent. The client may withdraw their consent at any time.

Examples of processing activities in which Evli relies on this ground for processing:

• the processing of special categories of personal data, for example dietary information collected for events
• various voluntary surveys, competitions and prize draws, for example as part of brand research
• cookies and similar technologies.

Legitimate interest

Where necessary, Evli may rely on legitimate interest, provided that the client's fundamental rights and freedoms do not override those interests.

Examples of processing activities in which Evli relies on this ground for processing:

• various analyses, such as marketing, client and product analyses
• marketing activities, including the targeting and planning of direct marketing, and the development and testing of processes and business operations
• analysing the use of social media in order to target our marketing and communications and to provide user support
• optimising services and the product range to suit the client and to improve our product range
• client profiling for analyses carried out for marketing purposes
• handling legal claims, such as debt collection proceedings, and preparing, presenting or defending against legal claims.

Evli retains the data necessary for the client relationship at least for its duration. After the client relationship has ended, the retention period depends on the purposes for which the data is used. Evli complies with its statutory obligations when retaining data.

Evli retains personal data for as long as is necessary in order to fulfil the purposes defined in this privacy notice, unless other legislation requires personal data to be retained for a longer period.

Retention obligations may differ within the Evli Group because of national legislation in different countries. As a rule, Evli retains client data for ten (10) years after the end of the client relationship in order to prepare, present and defend legal claims, to collect debts or receivables and to comply with the obligations imposed by regulation. The retention period for personal data nevertheless depends on the purpose of the processing of the data in each individual case. The retention period may be extended if the personal data is needed for court proceedings or other legal proceedings. Evli will provide more detailed information on request.

Examples of retention periods applied by Evli:

• material relating to client agreements is retained for ten (10) years from the end of the client relationship due to statutory and contractual obligations and liabilities
• the personal data of the representative of an entity is retained for as long as the data subject acts as the entity's representative vis-à-vis Evli. We delete the personal data within a reasonable time after that role has ended or after the entity has notified a new representative, unless the personal data relates to agreements or contractual material or unless the personal data must be retained in order to comply with statutory obligations.
• for the purposes of electronic direct marketing we retain the necessary personal data until further notice, unless the recipient withdraws the consent given to electronic direct marketing or prohibits electronic direct marketing
• personal data relating to events (training sessions and client events) is retained, as a rule, for one year after the event, unless the personal data is used for an event organised later or for marketing. As regards dietary information, the data is deleted within one month of the event.
• data collected for a voluntary survey, competition or prize draw is retained until the survey, competition or prize draw has ended. Any audio or video recordings used for visibility and publicity purposes are processed for a maximum of five years.
• consents and prohibitions given in respect of the processing of personal data are retained for their period of validity, in most cases until further notice.

Evli has the right to disclose personal data to third parties to the extent permitted by applicable legislation in order to provide products and services and to comply with contractual obligations. Such cases include, for example, identification solutions and the transfer of data between different parties, such as central banks, partner banks, recipients of account transfers and clearing houses. In addition, Evli has entered into cooperation agreements with third-party service providers and suppliers concerning, for example, software development, maintenance, server and IT support services, which may require personal data to be disclosed to a third party. Evli also discloses personal data to public authorities as required by law, for example to the Finnish Financial Supervisory Authority (FIN-FSA), the Tax Administration, the police and the enforcement authority.

Evli processes personal data primarily within the European Economic Area (the “EEA”), but it may also be processed outside the EEA in third countries. When data is transferred outside the European Union or the European Economic Area, Evli ensures an adequate level of protection for the personal data by agreeing on matters relating to the processing of personal data in the manner required by applicable data protection legislation. Where necessary, we also rely on safeguards such as the standard contractual clauses approved by the European Commission, the EU–US Data Privacy Framework and other supplementary measures. We will provide further information on request.

Evli has appropriate administrative, technical and organisational security procedures in place. These procedures protect the information held by Evli, for example against unauthorised use, destruction and loss of data.

The data subject has the rights provided for in applicable data protection legislation. How these rights apply in practice depends on the purpose and the circumstances of the processing of personal data in each individual case. The data subject cannot exercise all rights in all situations. For example, regulation specific to the financial sector may constitute an obstacle to the full realisation of the data subject's rights.

To exercise the rights described in this notice, please contact:

1. Evli Plc, postal address of Investor Services: Evli Plc c/o Investor Services, P.O. Box 1081, FI-00101 Helsinki, Finland
2. Evli Plc, email address of Investor Services: info@evli.com
3. Evli Plc, client service number of Investor Services: +358 9 4766 9701

We also remind you that you have the right to lodge a complaint with the competent data protection authority if you consider that your personal data has been processed unlawfully. We nevertheless recommend that you first contact Evli directly in order to resolve the matter concerning the processing of personal data.

Under the EU General Data Protection Regulation, the data subject has the following rights:
 

The right to be informed about the processing of personal data and to access that data:

The data subject has the right to be informed of the collection and processing of their personal data at Evli. The data subject has the right to obtain confirmation as to whether their data is processed at Evli and, if the data is processed, the right to access the data and to obtain a copy of the data being processed. In addition, Evli's clients can also check and retrieve their data themselves in the My Evli online service. Clients and potential clients can review and manage the data collected for direct marketing purposes, and the consents they have given, in our self-service channel.

The right to rectification and erasure of personal data:

If the data subject's data is processed at Evli, the data subject has the right to have incorrect data rectified or inaccurate data corrected. The data subject has the right to request the erasure of their data (the right to be forgotten). However, statutory obligations may prevent a request for the erasure of data from being completed fully at the data subject’s request.

The right to restriction of processing:

The data subject has the right to request the restriction of the processing of their personal data. Processing will be restricted for the period that Evli needs in order to verify the accuracy of the data. This applies where personal data is suspected of being incorrect, or is contested, and cannot be corrected or erased, or where a request for erasure is unclear in some other respect.

The right to data portability:

In situations meeting the conditions set out in applicable data protection legislation, the data subject has the right to require that their data be transferred to another controller. This right concerns personal data provided to the controller in a structured, commonly used and machine-readable format, where the processing is based on the consent given by the data subject or on a contract and is carried out automatically. The data subject has the right to have the data transmitted directly from one controller to another where this is technically feasible.

The right to object to processing:

In accordance with the conditions set out in applicable data protection legislation, the data subject has the right to object to the processing of personal data and to profiling based on legitimate interests. Evli may refuse the data subject's request if the processing is necessary in order to pursue the compelling and legitimate interests of Evli or of a third party. Notwithstanding this, the data subject always has the right to object to the processing of their personal data for direct marketing purposes and to profiling related to direct marketing.

The right to withdraw consent:

In situations where the processing of the data subject's personal data is based on the consent given by the data subject, the data subject has the right to withdraw their consent at any time free of charge. The withdrawal does not affect the processing of personal data carried out before the withdrawal. In addition, the data subject has the right to withdraw the consent given to electronic direct marketing, for example the sending of newsletters, or to prohibit electronic direct marketing. Data subjects can manage their own data in the direct marketing register. A direct marketing prohibition is recorded in the client register on the basis of the client's notification. More information on direct marketing

The right not to be subject to automated decision-making:

The data subject has the right not to be subject to a decision based solely on automated processing, such as profiling, which produces legal effects concerning them or which similarly significantly affects them. Evli does not take such decisions based solely on automated processing without the data subject's explicit consent. The existence of automated decision-making is notified in connection with the service. In situations involving automated decision-making, the data subject has the right to have the matter handled by a natural person, the right to express their own point of view and the right to contest the decision.

Evli complies with applicable data protection legislation and has appointed a Data Protection Officer. The general task of the Data Protection Officer is to monitor compliance with applicable data protection legislation at Evli.

Contact details of the Data Protection Officer of Evli Plc:
Data Protection Officer, tietosuoja@evli.com
Evli Plc c/o Data Protection Officer, P.O. Box 1081, FI-00101 Helsinki, Finland.

The data subject has the right to lodge a complaint with the competent data protection authority. In Finland, the competent authority for handling complaints based on data protection legislation is the Data Protection Ombudsman. The Data Protection Ombudsman guides, supervises and provides advice on the processing of personal data.

Contact details of the Data Protection Ombudsman:
Office of the Data Protection Ombudsman, P.O. Box 800, FI-00521 Helsinki, Finland. tietosuoja.fi/en/home