Information for the clients and the potential clients on the personal data processing

1. Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”) in conjunction with Act No. 18/2018 Coll. on personal data protection and on amendments to certain acts, as amended, International Investment Platform, o.c.p., a.s., as the controller of the personal data of its clients to whom it provides investment or ancillary services (the “Investment Service”) in the performance of the activity of a securities Broker pursuant to Act No. 566/2001 Coll. on securities and investment services and on amendments to certain acts, as amended, is obliged to fulfil its information obligationto the client or a potential client as the data subject (the “Data Subject or client”).

2. Controller

International Investment Platform, o.c.p., a.s., Einsteinova 24, 851 01 Bratislava, Slovak Republic, Company ID No.: 35 771 801, registered in the Business Register of the Bratislava I District Court, Section: Sa, File No. 4532/B (the “Broker”)

3. Data Protection Officer 

Data Protection Officer (the “DPO”) is the person entrusted with the supervision of personal data protection at the Broker. The Data Subject may exercise their personal data protection rights, file complaints and/or questions concerning the personal data processing or other related questions with the DPO in the following ways:

  1. in writing by email sent to: dpo@iiplt.com,
  2. in writing to the address of the Broker’s registered office,
  3. in person, orally in the minutes, from which it must be clear who exercised the right, what is claimed and when and by whom the minutes were recorded, the person’s signature and your signature, with a copy of the minutes handed over to you.

 4. Purpose, Legal Basis and Storage Period of Personal Data

Purpose of personal data processingLegal basis for personal data processing Storage period
Provision and performance of the Investment Service under the licence of the National Bank of SlovakiaThe legal basis for the processing of your personal data is Article 6(1)(b) and (c) of the GDPR, Act No. 566/2001 Coll. on securities and investment services and on amendments to certain acts, as amended, and other relevant legislation. Personal data processing for this purpose does not require the consent of the Data Subject.For the term of the contract and at least 10 years thereafter  
Internal administrative purposesThe legal basis for the processing of your personal data is Article 6(1)(f) of the GDPR and special legislation. Personal data processing for this purpose does not require the consent of the Data Subject.For the term of the contract and at least 10 years thereafter  
Compliance with our legal obligations – e.g. bookkeeping, registry management, providing cooperation to public authorities, FATCA, CRSThe legal basis for the processing of your personal data is Article 6(1)(c) of the GDPR and special legislation. Personal data processing for this purpose does not require the consent of the Data Subject.Personal data storage period is stipulated by special regulations
Handling of complaintsThe legal basis for the processing of your personal data is Article 6(1)(b) and (c) of the GDPR. Personal data processing for this purpose does not require the consent of the Data Subject.For the term of the contract and at least 10 years thereafter  
Prevention and detection of money laundering and terrorist financingThe legal basis for the processing of your personal data is Article 6(1)(c) of the GDPR, Act No. 297/2008 Coll. on protection against money laundering and terrorist financing and on amendments to certain acts, as amended. Personal data processing for this purpose does not require the consent of the Data Subject.5 years after the end of the contractual relationship or after trade
Protection and enforcement of the Broker’s rightsThe legal basis for the processing of your personal data is Article 6(1)(c) and (f) of the GDPR and Act No. 566/2001 Coll. on securities and investment services and on amendments to certain acts, as amended. Personal data processing for this purpose does not require the consent of the Data Subject.For the term of the contract and at least 10 years thereafter  
Recording and storage of client communicationThe legal basis for the processing of your personal data is Article 6(1)(c) of the GDPR and Act No. 566/2001 Coll. on securities and investment services and on amendments to certain acts, as amended. Personal data processing for this purpose does not require the consent of the Data Subject.  5 years, or 7 years at the request of NBS
Direct marketing – providing our existing clients with information about updates concerning their contracts and our products and services which they use or which relate to such products or services.The legal basis for the processing of your personal data is Article 6(1)(f) of the GDPR (legitimate interest), and this processing is carried out in order to improve and personalise the services provided to you. You have the right to object to such processing at any time.For the term of the contract, or until you object to such processing.  
MarketingThe legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR (consent). The consent is provided voluntarily and is not the requirement for providing the service.Until the expiry of the period specified in the consent or until withdrawal of the consent
Ensuring the functionality of web services (cookies)The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPRSession cookies – deleted after leaving the website

5. The Broker collects your personal data mainly from you, especially in the process of concluding a contract and during its term. We may also collect your personal data from others, where necessary to fulfil our obligations. Pursuant to the Securities Act, the client is obliged to provide us with and allow us to obtain personal data as well as other data requested by us by copying, scanning or other recording and is also obliged to provide information about any personal data updates or to complete the missing data.

6. Recipients and Categories of Recipients of Personal Data

Your personal data may be provided in particular to:

6.1 Deja Group members:

– SFM Group International S.A., Grand Duchy of Luxembourg

– Cornhill Management Honk Kong Limited, Hong Kong, China

6.2 Other entities:

  • financial agents in the capital market sector,
  • AML agents ensuring compliance with anti-money laundering and terrorist financing obligations,
  • companies acting for and on behalf of the Broker in connection with the exercise of rights, including companies providing judicial and extrajudicial debt recovery,
  • consultancy and audit firms,
  • information technology service providers,
  • companies providing document storage, archiving and destruction services,
  • companies providing press services, processing and sending of correspondence between our company and Data Subjects,
  • call centre service companies,
  • recipients providing the Broker with services related to the execution of payments under a special regulation.

Public authorities and other entities to which personal data are provided in accordance with a legal obligation are not considered recipients under the GDPR.

During the processing of personal data there may be a change in the categories of recipients or companies listed above, and the Broker is entitled to amend the above list. The updated list of recipients shall always be published here.

7. Rights of Data Subjects

a)   The right to obtain confirmation as to whether your personal data are being processed, and where that is the case, to access such personal data and the related information as defined herein;
b)   The right to rectify inaccurate personal data or to complete incomplete personal data;
c)   The right to erasure (right to be forgotten) of your personal data under the conditions set out in the GDPR, if:

  • personal data are not necessary for the given purpose,
  • the Data Subject withdraws their consent,
  • the Data Subject objects to the processing of personal data and the controller’s legitimate interests do not override the legitimate interests of the Data Subject or the Data Subject objects to the processing for direct marketing purposes,
  • personal data are processed unlawfully,
  • a legal obligation has been fulfilled;

d) The right to the restriction of personal data processing, if:

  • the accuracy of personal data is contested by the Data Subject, for a period enabling verification of their accuracy,
  • the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead,
  • Broker no longer needs the personal data for the purposes of processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims,
  • the Data Subject objects to the processing of personal data, pending the verification whether the legitimate grounds of the controller override those of the Data Subject;

e) The right to receive the personal data concerning the Data Subject, which they have provided and the right to transmit those data to another controller, where technically feasible;

f)    The right to object to personal data processing;

g)   The right to object to the processing of personal data for direct marketing purposes;

h)   The right to object to and not to comply with our decision, which would have legal effects or a significant impact on you, if such a decision is based solely on automated processing of personal data. You have the right to ask us to review a decision issued by means other than automated processing, and we are obliged to comply with such a request with the decisive role in the review of the decision played by our employees. We will notify you of the method of review and the outcome within 30 days of the receipt of your request.

i)    The right to request proof of identity of the person entrusted with the collection of personal data;

j)       Where personal data were not obtained from the Data Subject, the Data Subject has the right to obtain information from which source the personal data originate, and, if applicable, whether they came from publicly accessible sources.

k)      The right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic.

If the Data Subject does not have full legal capacity, their legal representative may exercise the rights of the Data Subject. If the Data Subject is not alive, their rights under the personal data protection regulations may be exercised by a person close to them.

8. The Broker uses automated tools for personal data processing (profiling). Profiling means any form of automated processing of personal data consisting of the use of these personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects of the client’s economic situation, personal preferences, interests, reliability, behaviour, location or movements, in particular to notify the client of the Broker’s current product portfolio, so that the products meet the client’s individual financial, social and other needs, and to identify potential fraud and issues regarding FATCA, CRS and protection against money laundering and terrorist financing. If a decision is based solely on automated processing of personal data, including profiling, you have the rights as specified in section 7(h) hereof.

9. Personal data will not be disclosed.

10. Transfer of Personal Data

The Broker expects to transfer your personal data to the above recipients of personal data in European Union Member States, countries that are parties to the Agreement on the European Economic Area and Switzerland (parties listed in section 6 hereof). We will only transfer personal data to third countries, if the European Commission has decided that these countries ensure an adequate level of protection or, in the absence of such a decision, if the controller or processor has provided appropriate safeguards, and, at the same time, enforceable Data Subject rights and effective legal remedies are available. If the Data Subject comes from a third country and the contract was concluded in a third country, and none of the conditions referred to in the previous sentence are fulfilled, the Broker shall apply a derogation for specific situations in accordance with Article 49(1)(b), (c) or (e) of the GDPR.

11. Categories of Processed Personal Data

The scope or list of clients’ personal data processed is stipulated by applicable legislation, arises from contractual documentation, or is specified in the consent to personal data processing. Personal data are processed to the extent necessary to fulfil the purpose of processing. These mainly include identity, transaction, demographic and financial data.

12. Cookies

Cookies are small text files sent to and stored on your device [a computer or other device with internet access] that you use when browsing websites. Cookies do not harm your device that you use when browsing websites.

The Broker only uses cookies on its website that are necessary for the proper functioning of the website. These are the so-called session cookies, which are deleted after you leave the website. These cookies do not require your consent.

The Broker only uses cookies for Online Access login, namely ASP.NET_SessionId. A cookie that allows you to save the user’s session ID and delete it when the user leaves the website.

IIP-Personal-Data-Processing-GDPR-EN-11-2021Download pdf
Scroll to Top