English
Slovak
Czech
Hungarian
Italian
Polish
Slovenian
Privacy Policy
The proper processing of your personal data is as much a priority for our company as the proper provision of investment services and activities. This document will provide you with information on how we handle your personal data, what rights you have in relation to the processing of your personal data, as well as other information regarding the processing of personal data.
Information on the processing and protection of personal data
1. About Us - Data Controller, Responsible Person and How You Can Contact Us
The personal data controller is CAPITAL MARKETS, o.c.p., a.s., company identification number: 36 853 054, with registered office at Slávičie údolie 106, 811 02 Bratislava, registered in the Commercial Register of the Municipal Court of Bratislava III, Section Sa, Insert No. 4295/B (hereinafter referred to as " Company"). If you have any questions regarding the processing of your personal data, including the exercise of your rights as a data subject (please note that a data subject is any natural person whose personal data is processed), you can contact us either directly by phone at +421 2 210 099 86 or in writing by e-mail at [email protected] or at the address of the registered office of the Company in accordance with Business Register of the Slovak Republic.
The responsible person is the employee responsible for the performance of the compliance function. You can contact the responsible person via the contact channels listed above.
2. What Personal Data Do We Process
We only process personal data in order to provide you professional services, and the scope of personal data is determined by generally binding legislation. If we process your data on the basis of your consent, the list or scope of the data is specified directly in the consent.
In particular, we process the following categories of personal data:
Identification and contact data: in particular, name, surname, residential address, correspondence address, personal identification number (if assigned), date of birth, place of birth, nationality, type and number of identity document, validity of identity document, record of restriction of legal capacity, contact phone number, e-mail address, specimen signature, whether the potential client/ client is a politically exposed person/sanctioned person, tax residence, or other personal data, the processing of which is required by specific legal provisions.
If the legal act is performed on the basis of a power of attorney, the Company also processes the personal data of the attorney, to the extent appropriate as in the case of a natural person of the client. The above also applies to the case of representation by a legal representative in the case of legal act of a child, when the personal data of this legal representative is also processed. The purpose of this processing is mainly the identification and verification of the identification of clients and their representatives, the conclusion of contractual relationships and the performance of contracts and obligations in connection with the provision of investment services, investment activities and ancillary services.
For the purposes of prevention and detection of criminal offences, the Company may also process the personal data of the ultimate beneficial owner or the person who is the owner of the funds to be used in the transaction or the person in whose name/on whose account the transaction is executed.
Sociodemographic data: enabling us to offer you financial products and services that meet your needs such as age, education, occupation, marital status, income, and expenses.
Geolocation data: IP addresses
Transaction data: payment information, both one-off and regular, bank account number IBAN
Records of telephone calls, electronic communication, and other interactions with you: records for the purpose of quality improvement as well as records whose retention obligations results from Act No. 566/2001 Coll. on securities and investment services and amending certain laws and Commission Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council (MIFID II) with regard to organizational requirements and operating conditions for investment firms, as well as defined terms of the above-mentioned Directive.
List or the scope of personal data processed by the Company is determined by special regulations, in particular Act No. 566/2001 on securities and investment services as amended (The Securities Act), Act No. 297/2008 Coll. on protection against money laundering and terrorist financing and on the amendment to certain acts, Act No. 186/2009 Coll. on Financial Intermediation and Financial Counselling and on amendment and supplementation of certain regulations (hereinafter referred to as "ZFSFP"), Act No. 595/2003 Coll. Income Tax Act as amended, Act No. 431/2002 Coll. on Accounting, as amended, Act No. 359/2015 Coll. on automatic exchange of financial account information in the field of taxation and on the amendment to certain acts, on the basis of which personal data is processed without the consent of the data subject (e.g. potential client/client).
3. For What Purposes Do We Process Your Personal Data and What Is the Legal Basis for the Processing of Personal Data
We process your personal data in accordance with the principle of data minimisation to the extent necessary, while most processing is justified by the fact that we need this data to provide the requested investment product or investment service.
Legal basis: the Company obtains and processes provided personal data as an operator in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and with article 13 of Act No. 18/2018 Coll. on personal data protection and amending and supplementing certain Acts (in particular article 13(1)(a), (b) (c) and (f)) as well as in accordance with the wording of specific laws.
Processing without the data subject´s consent
Purposes of processing on the basis of the legal basis referred to in section 13 (1) (b) of personal data protection Act
“processing of personal data is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract”
The Company is entitled to process the Client´s personal data without client´s consent if it is necessary for the performance of contract to which the client is a party or in pre-contractual relationship to take measures before concluding the contract based on the request of the data subject. In addition, in connection with the conclusion of a contractual relationship or the execution of a transaction, the Company is entitled to obtain personal data by copying, scanning or otherwise recording from an identity document on the basis of special laws (for example, The Securities Act). Without this data, we would not be able to enter into a contract with you and fulfil our obligations and rights arising from it. We therefore collect your data for the purpose of concluding, recording and administering contracts and transactions, orders.
Refusal to provide personal data in accordance with this legal basis may result in the non-conclusion of a contract and the impossibility of providing a service or product, or other consequences established by law.
Purposes of processing on the basis of the legal basis referred to in section 13 (1) (c ) of personal data protection Act
“processing of personal data is necessary pursuant to a special regulation or international treaty binding upon the Slovak Republic”
As a brokerage company, we have several obligations imposed on us by special regulations. Therefore, we also process your data in cases where we are obliged to do so by specific law, in particular, but not exclusively:
- Act No. 566/2001 Coll. on securities and investment services and on amendments and supplements of certain laws (The Securities Act)
- Act No. 297/2008 Coll. on protection against money laundering and terrorist financing and on the amendment to certain acts
- Act No. 595/2003 Coll. Income Tax Act as amended
- Act No. 359/2015 Coll. on automatic exchange of financial account information in the field of taxation and on the amendment to certain acts
- Act No. 431/2002 Coll. on Accounting as amended
- Act No. 186/2009 on financial intermediation and financial counselling and on amendment and supplementation of certain regulations
- Act No. 395/2002 Coll. on Archives and Registries and on the amendments of certain acts
- Commission delegated regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive
- Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (MiFID II)
- Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments amending Regulation (EU) No 648/2012 (MiFIR)
- The Foreign Account Tax Compliance Act (FATCA)
- measures of the National Bank of Slovakia
The purpose of processing on the basis of special laws is in particular:
(i) account opening and the provision of other services requested by clients (ii) the conclusion, execution and subsequent review of transactions between the Company and Clients, for the purpose of identifying Clients and their representatives, for the purpose of protecting and enforcing the Company's rights against Clients, for the purpose of documenting the Company's activities, for the purpose of exercising supervision and for the performance of the Company's tasks and obligations under the Securities Act in accordance with section 73a and 75 (iii) the exercise of due diligence in relation to the client and for the purpose of detecting an unusual transaction within the meaning of Sections 10 and 19 of Act No. 297/2008 Coll. on protection against money laundering and terrorist financing, (iv) provision of information on financial accounts for the purpose of correct assessment of tax liability within the meaning of section 19 of Act No. 359/2015 Coll on automatic exchange of financial account information in the field of taxation and on the amendment to certain acts, (v) the exchange of information relating to intermediated financial services between the Financial Agent and the Company within the meaning of the ZFSFP.
Our Company may also process personal data based on a directly enforceable legally binding act of the European Union, an international treaty to which the Slovak Republic is bound, on the basis of the provisions of a special law, or on the basis of the consent of the client as a data subject to the processing of his/her personal data.
In order for us to comply with our legal obligations, you are obliged to provide us with the required information and documents as well as to notify us of any changes. Without such information and documents, we are not entitled to provide you with the required investment services.
Purposes of processing on the basis of the legal basis referred to in section 13 (1) (f) of personal data protection Act
“processing of personal data is necessary for the purpose of the legitimate interests of the controller or of a third party, except where such interest are overridden by the interests or rights of the data subject which require protection of personal data”
The legitimate interest of the Company is, for example, to inform you about information related to the provided service, to offer you the Company's services and products, the defence of legal claims, lawsuits and out-of-court debt collection, statistical purposes, internal reporting, etc.
Therefore, the purpose is also marketing activities, i.e. - providing and sending advertising, promotional and marketing materials for the purpose of ascertaining interest in the field of investment, including telephone communication, sending e-mail messages (including short messages).
Prior to processing personal data on this legal basis, the company shall take into account whether its legal interests do not overridde the interests and rights of the data subject or whether they are balanced, whether its purpose is legitimate and whether processing on this legal basis is necessary. Furthermore, the Company shall take into account the reasonable expectations of data subjects as to whether they can expect the Company to process their personal data.
The processing of personal data for this purpose is bound to the duration of the contractual relationship or the period of the expiry of the limitation or prescription periods arising from this contractual relationship.
If there is no contractual relationship between the Company and the Client, the Company shall process the personal data for as long as necessary to meet the legal prerequisites of legitimate interest, or for a maximum of 1 year from the date of processing of the personal data or until the Client exercises its right to object to such processing of the personal data, whichever is earlier.
The Client's consent is not required for processing in accordance with this point. The Client has the right to object to such processing, with the consequence of limiting the processing by the Company, or in the case of marketing, the objection means the termination of the processing of personal data for this purpose.
Processing with the consent of the data subject
Purposes of processing on the basis of the legal basis referred to in section 13 (1) (a) of personal data protection Act
“the data subject has given consent to the processing of his or her personal data for at least on specific purpose”
If the Client's personal data is not processed on the basis of the above-mentioned reasons (or other reasons in accordance with Personal Data Protection Act, e.g. it is necessary to protect the Client's assets), we process personal data only on the basis of your consent, to the extent and for the purpose specified in the consent. The consent granted is voluntary and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of the data processed prior to its withdrawal. The processing period is indicated directly in the consent.
4. The Period for Which We Process Your Personal Data
We store your personal data for the duration of your contract with the Company. After the termination of the contractual relationship and the settlement of all obligations arising from or related to the contract, we store your personal data for the necessary time, for a maximum period of up to 10 years (or for a longer period, if required by the relevant applicable laws). Processing of personal data in case of consent is possible during the period for which the consent was granted.
The retention period of personal data results, in particular, from the laws referred to in point 3 on the basis of the legal basis referred to in Section 13(1)(c) of the Personal Data Protection Act as follows:
- Act No. 566/2001 Coll. on securities and investment services and on amendments and supplements of certain laws as amended – within the meaning of section 73a – at least 10 years from the end of the transaction, withing the meaning of section 75(5) – 5 years and at the request of the National Bank of Slovakia for 7 years and within the meaning of section 75(8) from the beginning of long-term investment saving until the expiry of the period for the expiry of the right to levy tax,
-Act No. 297/2008 on protection against money laundering and terrorist financing and on the amendment to certain acts – within the meaning of section 19(2) for 5 years since the end of the contractual relationship, within the meaning of section 19(3) more than 5 years and if requested by the financial intelligence unit, a further period of 5 years (however max. 10 years)
- Act No. 595/2003 Coll. Income Tax Act – in accordance with the deadlines specified in section 39 and 40 of this Act, depending on tax period
- Act No. 359/2015 on automatic exchange of financial account information in the field of taxation and on the amendment to certain acts – within the meaning of section 19(3) of this Act – 10 years after the end of the calendar year in which the data was reported under the Act or FATCA,
- Act No. 431/2002 Coll. on Accounting as amended and on amendments of some act – in accordance with section 35(3) of this Act – 10 years after the year to which the documentation relates
- Act No 186/2009 Coll. on financial intermediation and financial counselling as amended – financial agent for at least 10 years from the beginning of the contract for the provision of financial services
- Act No. 395/2002 Coll. on Archives and Registries and on the Amendments of Certain Acts – 10 years following the year to which the documents relate, the National Bank of Slovak Republic may determine a longer period (the above also applies to employees of the Company),
- Regulation 2017/565/EU - within the meaning of section 73 for at least the duration of the relationship with the client, within the meaning of section 76(8) - 5 years, at the request of the competent authorities for 7 years,
- Regulation 600/2014/EU - within the meaning of section 25(1) - data on all instructions and transactions for 5 years.
5. From What Sources Are the Personal Data Collected
We obtain personal data directly from you, e.g. data that you provide in the Client Agreement, investment questionnaire, affidavits, power of attorney, from publicly available sources, registers and records, lists or websites (e.g. business register, trade register, professional register, www.zlatestranky.sk, www.zoznam.sk, on the 1811 infoline, etc.).
6. Where Are Your Personal Data Transferred?
We will disclose your personal data to third parties or recipients if we are obliged to do so by a specific law, a directly enforceable legally binding act of the European Union or an international treaty to which the Slovak Republic is bound, or if you have given your consent to such action, or it is our intermediaries. Your personal data may be subject to cross-border transfer to countries within the European Union, see below.
Intermediaries*
In connection with the provision of investment services, activities and ancillary services to financial instruments, our Company uses the services of contractual partners. We have entered into a personal data processing agreement with such entities under which they process your personal data on behalf of the Company and under which there is a material and technical security obligation on their part, including the treatment of personal data protection rules or possible sanctions for their violation. Intermediaries are obliged to informs us without any delay of any breaches in the security of the personal data processed. These are mainly IT companies, law firms, consulting companies, but also financial agents with whom we have concluded a contract on financial intermediation within the meaning of the ZFSFP. The list of intermediaries is regularly updated and is available on the Company´s website www.capitalmarkets.sk/mifid.
Third parties
Your personal data may be disclosed to third parties or recipients if we are obliged to do so by a specific law, a directly enforceable legally binding act of the European Union or an international treaty to which the Slovak Republic is bound, or if you have given your consent to such action.
Third parties are:
• Public administration bodies and state institutions: e.g. Financial Intelligence Unit, state administration bodies, law enforcement authorities, courts, executors, bankruptcy trustees, notaries, liquidators, supervisory authorities – Office for Personal Data Protection, National Bank of Slovakia, Supreme Audit Office of the Slovak Republic, Financial Administration of the Slovak Republic, Ministry of Finance of the Slovak Republic, Social Insurance Institution, etc.
• Institutions providing financial services and credit institutions for the purpose of performance of a contractual relationship with you: e.g. Banks and branches of foreign banks or Custodians, Central Securities Depository, etc.
Cross-border transfer of personal data
Personal data may be subject to cross-border transfers to countries within the European Union (e.g. to countries where we operate on the basis of a cross-border notification through a branch of the Company), as well as to countries that provide an adequate level of protection, in accordance with the provisions of the relevant legislation.
a) The transfer of personal data outside the European Union (to third countries or an international organisation) takes place in the case of:
- if it is necessary for the purpose of fulfilling your instructions, fulfilling the relevant contractual obligations (e.g. payment instructions or instructions to transfer/move financial instruments),
- if it is required by a specific regulation or international treaty, or
- if you have given us your consent
7. What Rights You Have in Relation to the Processing of Personal Data
You can exercise the following rights when processing your personal data:
Information on the processing of personal data
The information contains, in particular, the identity and contact details of the controller, his representative and, where applicable, the person responsible for the protection of personal data, the categories of personal data concerned, the purposes of the processing and the legal basis for the processing, information on the rights of data subjects, the recipient or categories of recipients of the personal data, information on the transfer of personal data, personal data retention period, authorised data controllers, the possibility to contact the Data Protection Authority, the source of the personal data being processed, information on the existence of automated decision-making and profiling.
Request access to personal data
You have the right to request whether or not personal data about you is being processed and, if so, you have the right to obtain access to this personal data as well as information about the purposes of processing, the categories of personal data concerned, recipients or categories of recipients, the period of retention of the personal data or the criteria for determining it, the existence of the right to request from the controller the rectification or erasure of personal data or the restriction of processing or the right to object to such processing, the right to file a complaint with the Data Protection Authority, information on the source of the personal data, information on whether automated decision-making and profiling takes place, information and safeguards in case of transfer of personal data to a third country or international organisation. You have the right to be provided with copies of the personal data processed. We are entitled to charge a reasonable administration fee for any additional copies you request.
Right to rectification
You have the right to have us correct your incorrect or outdated personal data and complete incomplete personal data. Therefore, if you have changed, for example, your contact information, please inform us and we will correct your personal data.
We are also obliged to keep accurate and up to date data about you. Therefore, it is important that you inform us immediately of any changes to your data and document the relevant changes.
Right to erasure (´right to be forgotten´)
We are obliged to erase your personal data at your instruction in certain cases established by law.
In such a case, we are obliged to evaluate whether the conditions required by law for erasure are fulfilled, because in some cases established by law, we are obliged to store and archive your data for the statutory period of time, despite the fact that you would request erasure of the relevant data.
Right to restriction of processing
In the cases established by law, you have the right to request that we restrict the processing of your personal data and process it only for the most necessary legal reasons or you can request that we block the processing of your personal data for a statutory period of time.
Right to data portability
You have the right to request that we transfer your personal data to another controller, another company, as long as it is technically possible. If there are no legal or other significant obstacles preventing us from doing so, we will transfer your personal data in the appropriate format to a third party designated by you.
Right to object to data processing, automated individual decision-making (including profiling)
If you believe that we are processing your personal data in breach of the law, pleas contact us and we will be happy to provide you with an explanation or make the necessary correction. You have the right to object to the processing of your data for direct marketing purposes.
Furthermore, you can also object directly to automated decision-making, including profiling, as long as applicable legislation allows it.
The right to file a complaint
You may at any time address your complaint or complaint regarding the processing of personal data by our Company to the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava 27, i.e. to initiate a procedure pursuant to article 100 of the Personal Data Protection Act.
Contact details for exercising your rights against the Company
You can exercise your rights against the Company regarding the processing of your personal data either directly by calling +421 2 210 099 86 or in writing at the e-mail address [email protected] or at the Company´s registered office address as defined in Business Register of the Slovak Republic. We will provide you with a response as soon as possible, but no later than one month after we receive your request. This period may be extended by another two months if necessary, taking into account the complexity and number of requests. We will inform you of the extension, including the reasons for it.
8. The Right to Withdraw Consent to the Processing of Personal Data
Consent to the processing of personal data is based on the principle of voluntariness and you can revoke it at any time. Withdrawal of consent does not affect the legality of the data processed prior to its withdrawal.
You can withdraw your consent by calling +421 2 210 099 86 or in writing by email to [email protected] or at the Company´s registered office address as defined in the Business register of the Slovak Republic. In the withdrawal of consent please state:
who is filing the withdrawal, in particular, the name, surname, residential address, so that we can identify you.
Only the processing of personal data that the Company processes on the basis of consent may be revoked or restricted, i.e. not if the processing of personal data is a prerequisite for the performance of a contract to which the data subject is a party, or not if the processing of personal data is required of the Company by special laws.
9. Existence of Automated Decision-Making and Profiling
In connection with the conclusion and existence of a business relationship, we generally do not use automated individual decision-making or profiling. If we use such decision-making/profiling in individual cases, we will inform you to the extent that we are required to do so by applicable law. The company is entitled to carry out profiling for the purpose of detecting unusual business transactions in accordance with section 13(1)(c ) of the personal data protection act. Such processing of personal data cannot be legitimately objected to or limited by the client.
10. Legislation
regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR)
Act No. 18/2018 on personal data protection and amending and supplementing certain Acts