FUND CONNECT PRIVACY NOTICE
This privacy notice (“Privacy Notice”) applies to the various features of the Fund Connect services (“Services”) made available through this website or any other application or platform you utilise to access the Services (this “Platform”) and is applicable to any users of the Fund Connect Platform globally. This Privacy Notice applies to any personal data (“personal data”) we may collect from you through this Platform, independent of the device (i.e., mobile, computer) used to access this Platform. We may also collect information that tells us what you do on the Platform or the Service, such as functions utilised, the time of day you access the Service, in each case, without telling us who you are. Any information collected about you may be associated with other identifying information that we have about you or that is publicly available from other sources. If the information collected could identify you or relates to you, or is combined with such information, State Street (as defined below) will treat it as personal data.
When you visit our Platform we want you to feel confident that we are committed to maintaining the privacy of your personal data. This Privacy Notice explains how we collect, use, process, and disclose your information across the Platform.
By accessing this Platform, you agree to the terms of this Privacy Notice as they may be amended from time to time, and to State Street’s collection, use, processing and disclosure of your information as described below. State Street may change this Privacy Notice at any time without prior notice to you. Any changes or updates will be effective immediately upon posting to the Platform. The effective date of this Privacy Notice is indicated in the final paragraph hereof.
Where you are permitted to make the Platform, or the technology underpinning the Platform (for instance under “white label” arrangements) available to your underlying clients, please bring this Privacy Notice to the attention of each person who is permitted to access or use the Services in any jurisdiction in the European Economic Area (“EEA”).
When this Privacy Notice mentions “State Street” “operator” “we,” “us,” or “our,” it refers the State Street company that is responsible for your information under this Privacy Notice.
State Street Bank International GmbH with a principal place of business at Brienner Straße 59, 80333 Munich and State Street Bank International GmbH, London Branch with a registered office at 20 Churchill Place, Canary Wharf, London E14 5HJ provide the Fund Connect Omnibus Services to users in the EEA and Singapore.
State Street Global Markets, LLC with a principal place of business at 1 Lincoln Street, Boston Massachusetts 02111 provides the Services to users in the United States and Mexico and acts as the data controller for your information.
State Street Global Markets Canada, Inc with a principal place of business at 30 Adelaide Street East Suite 1100, Toronto, Ontario M5C 3G6 provides the Services to users in Canada and acts as the data controller for your information.
State Street Global Markets International Limited with a principal place of business at 20 Churchill Place, Canary Wharf, London E14 5HJ] provides the Services to users in all other jurisdictions and acts as the data controller for your information.
We collect and use your personal data to enable us to manage our relationship with you effectively, lawfully and appropriately, during the course of providing you the Services both during and after the contractual period. This includes using information to enable us to comply with the contract, to comply with any legal requirements, pursue the legitimate interests of State Street and protect our legal position in the event of legal proceedings.
Information you provide for your use of the Services/Platform
We collect information you share with us when you sign up to the Services, access the Platform or use certain features of the Services available via the Platform, including:
- Account Information. When you sign up to the Services we require certain information such as your name, job title, work phone number, email address, and, potentially, your national client identifier.
- Profile Information. To use certain features within the Platform and identify the best Service features for your needs, we may also ask you to complete a profile, which may include your address, phone number, and email address.
- Employment Information. We collect your information in relation to your employment/trading status (including your office location) when accessing the Platform Services to process and report trades.
- Other Information. You may otherwise choose to provide us information (including contained in hyperlinks to any Funds’ constituent documents) when you update or add information to your platform profile, enter into transactions, or use other features of Fund Connect.
- Know Your Customer (“KYC”) information. We collect information such as your name, date of birth, residential address, nationality, job title, passport or other identification documents which may contain your photograph. We collect this type of information when we are required to do so to comply with applicable laws or regulations or State Street’s internal policy requirements. Examples of when this would be the case are if you are a “controlling party” (such as a CEO, director, trustee, investment adviser, partner or agent) or beneficial owner of a client or prospect of State Street. When we collect information for KYC purposes, we may also collect certain special categories of personal data about you such as your political opinions or affiliations or trade union memberships. We will only process such special categories of your personal data to the extent permitted by applicable law or regulation
Information we may automatically collect from your use of the Platform
- Usage Information. The pages or other content you view, your searches, trades you have made, and other actions on the Platform.
- Location Information. When you use certain features we may collect different types of information about your general location (e.g. IP address).
- IP address/Unique Identifiers. We collect your IP address and information regarding the computer or mobile device used to access this Platform, such as its operating system, unique identifier and model name, as well as its user configurations and settings to help diagnose any problems with our servers and to administer, operate and develop our Platform as well as to help facilitate communications which you have elected to receive from us.
- Log Data. We may automatically collect log information when you use the named platform, even if you have not or logged in (e.g. when orders are still processing). That information includes, among other things: details about how you have accessed the platform, IP address, access times, hardware and software information, and the page you have engaged with.
- Strictly necessary cookies. These cookies are essential in order to enable you to move around a site and use its features, such as accessing secure areas of a site. Without these cookies, services you have asked for cannot be provided.
- Performance Cookies. These cookies collect information about how visitors use a site, for instance which pages visitors go to most often, and if they get error messages from web pages. These cookies don't collect information that identifies a visitor. All information these cookies collect is anonymous and is only used to improve how a site works.
- Functionality cookies. These cookies allow a site to remember choices you make (such as your user name, language or the region you are in) and provide enhanced, more personal features. For instance, a site may be able to provide you with local information by storing in a cookie the region in which you are currently located. These cookies can also be used to remember changes you have made to text size, font and other parts of web pages that you can customise. They may also be used to provide services you have asked for such as watching a video or commenting on a blog.
These cookies cannot track your browsing activity on other websites. They don’t gather any information about you that could be used for online advertising on other sites or remembering where you’ve been on the Internet outside of a site.
- Targeting cookies. These cookies are used to deliver online advertisements on other websites that are more relevant to you and your interests. They are also used to limit the number of times you see such advertisements as well as help measure the effectiveness of the advertising campaign. They are usually placed by advertising networks with a site operator’s permission. They remember that you have visited a site and this information is shared with other organisations such as advertisers. Quite often they will be linked to site functionality provided by the other organisation.
‘Do not track’ disclosure
Do Not Track (“DNT”) is a technology standard that is currently under development that will allow you to restrict tracking when browsing from site to site on the internet. When you choose to turn on the DNT setting in browsers that support this feature, the browser sends an automated browser signal to the web sites and other web services (such as analytics services, advertising networks, and social platforms) you encounter while browsing to prohibit tracking. At this time, the Platform does not recognise automated browser signals regarding tracking mechanisms, such as “do not track” requests.
Sensitive personal data
State Street recognises that certain jurisdictions have enacted laws that require higher protection of certain sensitive personal data. "Sensitive personal data" includes categories of personal data identified by EEA and other privacy laws as requiring special treatment. This may include personal identity numbers, racial or ethnic origin, political opinions, religious, philosophical or other similar beliefs, membership of a trade union or profession or trade association, physical or mental health, biometric or genetic data, sexual life or criminal record (including suspected criminal activities). Other than as specified herein, as a general rule, State Street does not require such sensitive personal data from you.
HOW WE USE INFORMATION WE COLLECT
We use, store, and process information about you to provide, understand, improve, and develop the Platform, and to maintain a secure environment. We use the information we collect for the following purposes:
- verify or authenticate information or identifications provided by you;
- verify that you qualify for use of the Service;
- inform you about changes to the Service;
- determine usage trends in order to make improvements to the Service;
- conduct checks against databases and other information sources (including for profiling and screening purposes, as set down below);
- detect and prevent fraud, spam, abuse, security incidents, and other harmful activity;
- conduct investigations and risk assessments;
- operate our business in a prudent manner in accordance with industry standards and applicable law including compliance with our legal and regulatory obligations; and
- resolve any disputes with any of our users and enforce our agreements with third parties.
We also may use this information on an aggregated level to perform statistical analyses and to maintain a database of our users.
Profiling and screening
In order to comply with applicable financial crime related laws and regulations and sanctions regimes, State Street engages in PEP, negative news and financial sanctions screening programmes, including those defined by the European Union, the United Nations, Her Majesty’s Treasury and the Office of Foreign Assets Control. Depending on the nature of your relationship with State Street, these activities may involve State Street processing your personal data and/or conducting screening on you. These activities may also involve State Street processing certain special categories of your personal data, such as your political opinions or trade union memberships. Such processing is considered lawful on the grounds of substantial public interest.
SHARING & DISCLOSURE
We will share your profile information and the information provided by you to the following organisations and relevant regulatory bodies as per your subscriber agreement.
We use a variety of third party service providers to help us provide services related to the Platform. Service providers may be located inside or outside of the EEA. For example, service providers may help us: (i) verify or authenticate your identification, (ii) check information against public databases, (iii) assist us with background checks, fraud prevention, and risk assessment, or (iv) provide technical or maintenance services to State Street. These providers have limited access to your information to perform these tasks on our behalf, and are contractually obligated to use it in a manner consistent with this Privacy Notice.
Regulatory and Legal
We will attempt to notify users about these requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be ineffective, create or increase a risk of fraud upon State Street, its employees the Platform or its other users (collectively, “Risk Scenarios”). In instances where we comply with legal requests without notice for these reasons, we will attempt to notify that user about the request after the fact if we determine in good faith that we are no longer legally prohibited from doing so and that no Risk Scenarios apply.
Corporate affiliates /Operating globally
To help us provide and maintain the Platform, we may share your information within our corporate family of companies that are related by common ownership or control. These related entities are covered under this Privacy Notice.
Personal data we collect may be transferred internationally throughout the world, based on business need or to comply with applicable laws, to countries which may not have the same data protection laws as the country in which you reside. This is based on (a) where it is held, received or stored by you or us, (b) from where it is accessed by you or us, or (c) through which it passes. When such transfers take place, State Street group takes measures and has in place internal policies and procedures in place to provide an appropriate level of privacy and data protection.
By providing your information to State Street in the course of your access and use of the Platform, you consent and authorise us to transfer, store, and process your information within the EEA and outside of the EEA for the purposes described in this Privacy Notice.
In addition, we may share personal data and other data collected through the Service with a successor entity in the event of a merger, acquisition or similar transaction.
INFORMATION RETENTION AND DELETION
State Street generally maintains centralised servers and systems in the United States and may maintain servers and systems elsewhere including countries other than your country of residence. These servers and systems are managed by or on behalf of State Street Bank and Trust Company or State Street affiliates in or outside the United States.
State Street retains your information while your account remains active, unless you request deactivation or deletion of your information or account. However, State Street will retain certain information about you as required by law, including without limitation State Street’s record keeping obligations, or other purposes as described within your subscriber agreement even if you request deactivation or deletion of your account.
OTHER IMPORTANT INFORMATION
We are continuously implementing and updating administrative, technical, and physical security measures to help protect your information against unauthorised access, loss, destruction, or alteration. We use security measures, in compliance with applicable laws, to protect personal data from unauthorised access or use. Yet you should understand that the open nature of the internet is such that information and personal data may flow, without security measures, over networks connecting you to our systems and may be accessed and used by people other than those for whom the data is intended.
To safeguard against unauthorised access to personal data by third parties, all electronic personal data held by State Street is maintained on systems protected by secure network architectures that contain firewalls and intrusion detection devices. The servers holding personal data are “backed up” (i.e., recorded) on a regular basis in an effort to avoid any inadvertent erasure or destruction of such personal data and are stored in facilities with appropriate security and fire detection and response systems.
Analysing your communications
We may review, scan, or analyse your communications on the platform for fraud prevention, risk assessment, regulatory compliance, investigation, product development, research, and customer support purposes. In some cases, we may also scan, review, or analyse messages to debug, improve the platform. We use automated methods where reasonably possible. However, occasionally we may need to manually review some communications, such as for fraud investigations and user support, or to assess and improve the functionality of these automated tools.
As a person who provides State Street with personal data, you may enquire as to the nature of the personal data stored at and/or processed by State Street. You will be provided reasonable access to your personal data held by State Street and, where appropriate, with the ability to review and correct inaccuracies. State Street will cooperate in providing such access. All such requests for access may be made by sending a request in writing to email@example.com.
To help protect your privacy and provide security, State Street takes reasonable steps to verify your identity before granting access to information. State Street shall respond to such reasonable requests made by you within such time period as required under applicable law after your identity has been confirmed and you have clarified the specific personal data that you require. If you demonstrate that the purpose for which the personal data is being processed is no longer legal or appropriate, the personal data will be deleted, unless the law or applicable data retention requirements require otherwise.
If you have questions, comments or complaints about this Privacy Notice, or about how your data is processed, or otherwise want to exercise any other right you have specified in this policy or under applicable law please contact please contact firstname.lastname@example.org or you have the right at any time to make a complaint to the relevant data protection authority.
EFFECTIVE DATE: 23 May 2018