Data Privacy Notice

Last updated: 31 August 2023

GPB (Switzerland) Ltd (hereinafter referred to as “GPBS”, “we”, “us”, “our”) provides this Data Privacy Notice to explain how we process personal data when you visit our website https://www.gpbs.ch/. We use the term “personal data” to mean data about an identified or identifiable individual. This Data Privacy Notice also provides information about rights you may have under applicable privacy laws.

For more information on country and region-specific privacy laws that may apply to you, please refer to the Jurisdiction-Specific Disclosures at the end of this Data Privacy Notice.

What personal data do we collect?

The categories of personal data that we collect from you include:

• Information that you provide to us, such as
  • personal details (e.g. name, gender, address, e-mail);
  • login credentials (when using our e-banking functionality);
  • other information that you provide to us by filling in forms.
• Information that we collect or generate about you when you browse our website:
  • data our server automatically records when you visit our website, e.g. your IP address, the website from which you visit us, the type of browser software used, and the duration of your authentication information;
  • cookies, pixels, unique identifiers and other similar tracking technologies to collect and process information from different channels and devices (please refer to the information on cookies below).

From whom do we collect personal data?

We collect personal data directly from you when you visit our website or through the use of tracking technologies (see the information below on cookies).

For what purposes do we use personal data?

We use the personal data we collect to:

To whom do we disclose personal data?

Your personal data may be disclosed to employees and processors (i.e., service providers) of GPBS that develop, operate and support our website and IT systems. GPBS relies on processors in the European Economic Area and Switzerland to process your personal data.

GPBS may disclose your information to its affiliates and their agents and third-party service providers in Switzerland and EEA to perform services for GPBS and for the purposes stated above. Any such recipients of personal data obtained through our website are obliged to respect your privacy, comply with legal obligations and adhere to contractual safeguards. When transferring personal data internationally we make sure that we comply with applicable laws and regulations, for example, by entering into agreements which will ensure that the recipients of your personal data maintain an adequate level of data protection.

How long do we store personal data?

We store personal data as long as necessary to provide you with the features of our website and any other services that you requested from us. Data stored by cookies and tracking technologies are typically stored for the duration of the session and up to 1 year after your last visit on the website. If we need to keep your information, including personal data, for tax, audit, or legal compliance for a legally prescribed time period thereafter, or if we need it to preserve evidence within statutes of limitation, we will retain the data for such purposes.

How do we protect personal data?

We have taken steps intended to protect the personal data we collect from loss, misuse, and unauthorized processing, including entering into data protection agreements with our service providers and encrypting personal data in transit and at rest. Please note, however, that while we have endeavored to create a secure and reliable online experience for users, the confidentiality or accuracy of any communication or material transmitted to or from us over the Internet cannot be guaranteed. It is your responsibility to safeguard any credentials such as username and password that you use to access our e-banking functionality, and to notify us immediately at the contact information below if you ever suspect that your username or password has been compromised.

Children

We only collect personal data about children with the consent of their parents or legal guardian. You must be at least 18 years of age (subject to locally applicable law) to use our website.

Cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyze web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. We use cookies to allow the website to recognize users when they return to the site and to remember certain information about their preferences. Cookies will stay on your computer until expired or manually deleted.

You can prevent the storage of cookies by selecting the appropriate settings on your browser. However, please note that if you do so, you may not be able to use the full functionality of our website.

As part of its website, GPBS uses the following cookies:

Language Selection Cookie. This cookie stores your language selection in order to show you the website in the selected language on future visits.

Google Analytics. Google Analytics is a web analytics service provided by Google LLC (“Google”). The information generated by this cookie about the use of this website is usually transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymization on this website, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google. For more information, please visit Google’s website.

Google AdWords Remarketing and Conversion Tracking. This cookie can link your visit to the website with advertisements on Google. You can find more information on Google’s website.

Facebook Conversion Tracking. This cookie can connect your visit to the website with the advertisements on Facebook. For more information, please visit Facebook’s website.

Twitter / X Conversion Tracking. This cookie can connect your visit to the website with the advertisements on Twitter / X. For more information, visit the website of Twitter.

Your Rights

You may have rights under applicable privacy laws, which may include to access, review, modify or delete the personal data we hold about you.

To submit a request to exercise any rights you may have under applicable privacy laws, please contact us using the contact details under “Contact Us” below and clearly describe your request. If you have rights under applicable privacy laws and your request complies with the requirements under such laws, we will give effect to your rights and respond within any mandatory timeframes as required by law.

Effect of this Data Privacy Notice; Changes

This Data Privacy Notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us, in particular if beyond visiting our website you receive banking or financial services from us. We may revise this Data Privacy Notice from time to time by making the revised document available on our website https://www.gpbs.ch and updating the “last updated” date on the first page of this Data Privacy Notice. We will also obtain consent from you where required by applicable law before processing your personal information for any purpose incompatible with the purposes set forth in prior versions of this Data Privacy Notice.

Contact Us

If you have any privacy-related inquiries or concerns, please contact us at info@gpbs.ch.

Jurisdiction-Specific Disclosures

In these Jurisdiction-Specific Disclosures, we provide additional (i) information related to rights you may have under the applicable privacy laws of your jurisdiction; and (ii) disclosures required by the privacy laws of particular jurisdictions.

For users in the European Economic Area and Switzerland:

• What laws apply? References to the “GDPR” are references to the General Data Protection Regulation (Regulation (EU) 2016/679) as it applies in the country where you are located. If you are located in the EEA, the EU GDPR applies to the processing of your personal data. If you are located in Switzerland, the provisions of the Swiss Federal Data Protection Act (the “FDPA”) apply to you. References to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA.
• Who is the data controller? GPB (Switzerland) Ltd, Zollikerstrasse 183, 8008 Zurich, Switzerland. You can contact the data controller at info@gpbs.ch. Our representative in the EU is GPB International S.A., info@gazprombank.lu.
• What are the legal bases of processing personal data?
  • The legal bases for processing of your personal data are:
    • The performance of the contract you entered into for the use of receiving banking or financial services (if any), per Article 6(1)(b) GDPR.
    • For marketing contacts including the sending of newsletters, your consent to providing you with such information, per Article 6(1)(a) GDPR.
    • The pursuit of legitimate interests per Article 6(1)(f) GDPR—it is in our legitimate interests to provide good service, ensure the security of our website and services, defend our legal interests, protect against fraudulent, harmful and illegal activity, and analyze how users access and use our website and services so that we can further develop and improve them.
    • Compliance with our legal obligations per Article 6(1)(c) GDPR.
• ·         Where is your personal data processed and on what basis do we transfer personal data across borders?

GPBS operates its website with the assistance of affiliated and unaffiliated service providers in the European Economic Area and Switzerland. All personal data provided by you to GPBS is collected in secure and certified data centers. These data centers are located in Switzerland.

We only transfer your personal data to countries where the European Commission and Switzerland (as applicable) has decided that they have an adequate level of data protection or we take measures to ensure that all recipients provide an adequate level of data protection. We do this for example by entering into appropriate data transfer agreements based on Standard Contractual Clauses and performing data protection assessments of data transfer arrangements as appropriate.

• Your Rights.
  • In the EEA and Switzerland you have the following rights, subject to the conditions under the GDPR and/or local data protection law:

(a) to object, on grounds relating to your particular situation, to the processing of your personal data by us;

(b) to obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to details about how we process your personal data and copies of the personal data;

(c) to obtain from us the rectification of inaccurate personal data concerning you;

(d) to ask us to erase your personal data to the extent it is not required for legally required purposes;

(e) to request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes;

(f) to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us; and

(g) to lodge a complaint with a supervisory authority.

(h) In some jurisdictions such as France and Portugal, you also have the right to provide us with guidelines as to the processing of your personal data after your death.

• You may view a list of supervisory authorities in the EEA and Switzerland and their respective contact information here:

Jurisdiction	Data protection authority’s website
EEA	https://edpb.europa.eu/about-edpb/board/members_en
Switzerland	https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

• You can exercise your rights by contacting us via email at info@gpbs.ch.