GDPR – “Customer Information on Data Protection”
for SIX Exchange Regulation Ltd
Who does this information on data protection apply to?
This data protection information (the "Information") from SIX Exchange Regulation Ltd is aimed at existing and new issuers, participants, sponsoring securities dealers, guarantors, traders and recognised representatives, as well as their employees and any third parties commissioned by them and other contracting partners or individuals entering into contact with SIX Exchange Regulation Ltd, as a result of its activity as a self-regulating body of the SIX Group Ltd trading venues ("Customers").
What is the aim of the Information?
This Information is aimed to notify customers about:
- which personal data ("Data") made available by Customers is being processed by SIX Exchange Regulation Ltd,
- for what purpose and on what basis SIX Exchange Regulation Ltd is doing this,
- what happens to the Data and how long it is processed for,
- what data protection rights Customers have vis-a-vis SIX Exchange Regulation Ltd, and
- the unit responsible for the Data processing within SIX Exchange Regulation Ltd and whom Customers can contact in case of questions.
What data is processed by SIX Exchange Regulation Ltd?
SIX Exchange Regulation Ltd processes Data that is transferred or made available to it by the Customer for the purpose of contract fulfilment within the framework of business relationships. This applies in particular to details about contact persons such as their names, e-mail addresses or business telephone numbers.
SIX Exchange Regulation Ltd also processes data as a result of statutory or regulatory requirements (legitimate interests). If need be, it may use this Data in investigations and sanctions proceedings. It may also disclose this Data to third parties (e.g. to the Swiss Financial Market Supervisory Authority FINMA, the prosecution authorities, or the courts).
On the grounds of statutory or regulatory requirements (legitimate interests), SIX Exchange Regulation Ltd may record the content of telephone conversations and the names and contact details of the other party to the call in writing and use the same in investigations and sanctions proceedings if necessary. This Data may also be disclosed to third parties (e.g. to the Swiss Financial Market Supervisory Authority FINMA, the prosecution authorities, or the courts).
By disclosing the above Data to SIX Exchange Regulation Ltd, in which case they will be responsible for the lawful disclosure thereof in compliance with any laws applicable to them, the issuers, participants, sponsoring securities dealers, guarantors, recognised representatives and other contracting partners hereby confirm that they have notified the natural persons in question (employee, agent, etc.), whose data they are disclosing to SIX Exchange Regulation Ltd, about the disclosure of Data to SIX Exchange Regulation Ltd, in advance and in accordance with the statutory requirements.
For what purpose does SIX Exchange Regulation Ltd process the Data?
The Data is processed by SIX Exchange Regulation Ltd for the purpose of executing contracts with Customers. The specific use of the Data depends on the contract concluded between the Customer and SIX Exchange Regulation Ltd. SIX Exchange Regulation Ltd particularly requires the Data for:
- generally maintaining the customer relationship;
- sending products and information that they are contractually obliged to provide;
- billing purposes;
- processing objections or complaints made by the customer;
- providing the customer with information about changes and developments of products and services.
SIX Exchange Regulation Ltd may also process the Data on the grounds of statutory or regulatory requirements (legitimate interests), use it in investigations and sanctions proceedings, and disclose it to third parties (e.g. to the Swiss Financial Market Supervisory Authority FINMA, the prosecution authorities, or the courts).
In general, SIX Exchange Regulation Ltd does not process Data outside its contractual relationships with Customers.
In exceptional cases however, SIX Exchange Regulation Ltd may process Data outside contractual relationships as well on the grounds of statutory or regulatory requirements (e.g. while logging telephone conversations).
What justification does SIX Exchange Regulation Ltd pro-vide for its processing of the Data?
SIX Exchange Regulation Ltd processes the Data primarily in its own legitimate interests, particularly to ensure proper performance of the contractually stipulated services and compliance with its statutory obligations or regulatory duties (legitimate interests).
Is the Data also passed onto third parties?
SIX Exchange Regulation Ltd is a subsidiary of SIX Group Ltd. SIX Companies can outsource all or some of the processing of the Data and other services to SIX Group or other SIX Group companies (including other SIX companies) and to external third parties in Switzerland and abroad.
If Data is transmitted to SIX Group, subsidiaries of SIX Group Ltd or external third parties as part of such outsourcing, the outsourcing SIX Company obligates the recipient in advance to wholly guarantee compliance with the existing confidentiality and data protection obligations of the outsourcing SIX Company.
Each SIX Company reserves the right to disclose personal Data to the authorities and/or third parties in Switzerland or abroad if the SIX Company is obliged to make such disclosure by the applicable legal provisions.
Do SIX Companies also transfer Data to countries outside the EU, EEA or Switzerland?
As part of the execution of their contracts with customers, SIX Companies may cooperate with third parties (e.g. suppliers) that provide some of their services or produce some of their products outside the EU, EEA or Switzerland.
If such third parties could obtain access to Data as part of the execution of the contract, a respective SIX Company and the third party provider will enter into a written agreement ensuring data protection equivalent to the data protection level required by EU and Swiss data protection regulation.
Upon request, customers may view contractual arrangements (excerpts) a SIX Company has implemented with third parties that actually process such customer’s Data.
How long is the Data processed or stored by SIX Companies?
SIX Exchange Regulation Ltd has its registered office in Switzerland. Data is normally stored in Switzerland for ten years beyond the end of a contractual relationship with the Customer.
SIX Exchange Regulation Ltd stores Data processed as part of an investigation or sanctions proceeding for 10 years following the end of said investigation or sanctions proceeding.
What rights do affected natural persons (“Data Subjects”) have whose Data are being processed by SIX Companies as part of their business relationship with customers?
Data Subjects are entitled to the following rights concerning Data about the Data Subject:
- to receive information on whether and which Data a SIX Company may save or store (categories of Data, recipients or categories of recipients, storage duration, or criteria governing such duration);
- to obtain a copy of Data processed;
- to request the rectification of Data if it is incorrect;
- to request the deletion of Data;
- to request restrictions on the processing of Data;
- to receive Data in a structured, accessible and machine-readable format;
- to submit an objection to processing of Data, especially for the purpose of direct advertising.
The rights specified above may be denied or restricted if the interests, rights and freedoms of third parties prevail or if processing of Data is necessary to establish, exercise or defend any legal claims of SIX Companies.
SIX Exchange Regulation Ltd may also refuse or limit the rights set out above where the Data has been processed within the framework of activities required by it under law or regulations (legitimate interest).
Do the SIX Companies have data protection officers?
Yes. All questions relating to data protection and the rights of Data Subjects can be directed to the Data Protection Officer (DPO) of SIX Group at the following contact address:
Who is responsible for the processing of Data at SIX Exchange Regulation Ltd?
The following office is responsible for the processing of Data for SIX Exchange Regulation Ltd:
- SIX Exchange Regulation Ltd