1. General
1.1 Introduction
Pareto Securities Group (“Pareto”) is committed to safeguarding the personal data of our clients, potential clients, suppliers, and business partners. This Global Privacy Information describes which personal data we receive and collect when you use the services of Pareto, how we treat, process and store this data as well as what we do to protect your personal data.
Personal data is information and assessments that can be linked to you as an individual, such as name, residential address, telephone number, e-mail address and IP address. Data that can (only) be linked to enterprises is not classified as personal data.
The Global Privacy Information applies to the following parties: Pareto Securities AS, Pareto Securities AB, Pareto Securities Oy, Pareto Securities Ltd, Pareto Securities Inc, Pareto Securities Pte Ltd, Pareto Securities Pty Ltd, and Pareto Securities AG, as well as Pareto’s branches in Denmark and Germany.
You should familiarise yourself thoroughly with the contents of this Global Privacy Information. “You” refers to a client, a potential client, our client’s employees, or other relevant parties, such as beneficial owners, authorised representatives and associated parties, as well as our suppliers’ and business partners’ employees.
1.2 Pareto’s responsibility as a data controller
Within the Pareto Securities Group, the data controller will be the Pareto Securities entity you have a relation to. Local regulations may apply to specific rules and adjustments.
The contact details of the respective Pareto Securities entity can be found on our website under www.paretosec.com/contact.
You can also contact us at dataprotection@paretosec.com.
The ultimate responsibility lies with the Chief Executive Officer in each entity within the Pareto Securities Group. Daily follow-up is handled by the Pareto Securities Group’s IT department in consultation with our Compliance department.
1.3 Your privacy rights
Pareto is responsible for processing your personal data in a legal, transparent, and open manner.
When we process your personal data, you have, with certain reservations, the right to:
- request confirmation whether we process personal data about you or not, and, if that is the case, to receive information about what personal data we process and how we process it;
- request that any inaccurate, misleading or incomplete personal data about you be corrected or supplemented by any additional information; request the erasure of your personal data;
- request that we restrict the way we process your personal data;
- object to the processing of your personal data;
- request access to, and a copy of, the personal data we have collected about you;
- request data portability (transfer of your personal data to another controller) if this is technically feasible;
- withdraw a given consent for the processing of your personal data, in cases where the processing is based on your consent.
Pareto is subject to strict legal requirements, and there may be exemptions to some of the rights mentioned above. For example, there may be situations where our confidentiality or other legal obligations prevent us from disclosing or deleting your personal data or otherwise prevent you from exercising your rights. Pareto is also obliged to keep client communications on tamper-proof platforms.
This obligation means we are both legally and physically prohibited from erasing personal data during the mandatory storage period.
Any requests should be sent to us in writing at the address provided in Section 1.5.
You also have the right to file a complaint with the competent Data Protection Authority, which may be the supervisory authority in your country of residence or place of work if you believe that our personal data practices violate your rights. The relevant authority for Pareto Securities Group is the Norwegian Data Protection Authority, or the competent national data protection authorities in the country where the Pareto Securities entity you have your relationship with is located.
1.4 Changes to this Global Privacy Information
Pareto reserves the right to amend this Information at any time.
1.5 Contact us
Please contact Pareto’s appointed Data Protection Officer Line Caliskaner at dataprotection@paretosec.com if you have any questions in relation to Pareto’s personal data processing.
2. Which personal data we collect
2.1 How we collect the personal data
We primarily collect personal data directly from you, such as when you communicate with us, use our websites, or enter into a client relationship or contract with us. We also collect personal data from other sources, such as:
- Information about your address from public or private registers to ensure that we have the correct contact details in our records;
- Information from PEP, sanction, and adverse media lists to prevent money laundering;
- Publicly available information obtained from searches conducted as part of our KYC-process;
- Financial information from credit-rating agencies to verify the accuracy of wealth and income details.
2.2 Upon the establishment of a client relationship and while being a client
Pareto collects various personal data when establishing a client relationship to comply with our legal obligations under securities regulations and anti-money laundering legislation.
For natural persons establishing a client relationship with Pareto, we collect the following data that can be linked to individuals:
| Type of personal data | Legal basis for processing |
|---|---|
| Name of client | GDPR Article 6 (1) (b): necessary for the performance of a contract to which the data subject is a party. |
| Contact details | GDPR Article 6 (1) (b): necessary for the performance of a contract to which the data subject is a party. |
| Social security number or corresponding tax identification number (TIN) | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
| Citizenship | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
| Tax domicile | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
| Bank account and, if applicable, securities account | GDPR Article 6 (1) (b): necessary for the performance of a contract to which the data subject is a party. |
| Political exposure details | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
| Sanction details | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject and GDPR Article 9 (2) (g) processing is necessary for reasons of substantial public interest. |
| Adverse media details | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject and GDPR Article 9 (2) (g) processing is necessary for reasons of substantial public interest. |
| Wealth and income details | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
| Securities trading knowledge and experience details | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
| Investment objective | GDPR Article 6 (1) (c): necessary for compliance with a legal obligation to which Pareto is subject. |
When the client is a legal entity, we collect the following data that can be linked to individuals:
- Name, contact details, and social security number of individuals authorised to trade on behalf of the client,
- Name, contact details, and social security number or corresponding tax identification number of beneficial owners,
- Political exposure, sanction and adverse media details on individuals authorised to trade on behalf of the client and beneficial owners.
The legal basis for collecting the mentioned data is stated in the table above.
The data we collect during the establishment of a client relationship will be entered into Pareto’s client register.
If you do not wish to provide us with client information which we are obligated to obtain to comply with statutory obligations, we will not be able to establish a client relationship with you or provide investment services to you.
2.3 Client communication and trades
As a provider of investment services, Pareto has a statutory obligation under securities legislation to record all communication between Pareto and clients.
Therefore, we record all incoming and outgoing telephone calls made through the fixed phones or mobile phones of our employees related to the performance of investment services. We also record all communications via e-mail, SMS, MS-Teams (only audio), and Bloomberg.
Additionally, we are required to keep documentation of submitted orders and executed trades, which will document the behavioral patterns of individuals.
The legal basis for the processing is GDPR Article 6 (1) (c): compliance with a legal obligation to which Pareto is subject.
Pareto Securities is further required to report transactions to the relevant financial supervisory authority (TRS-reporting) and applicable stock exchanges (order record keeping). This includes transaction details identifying the client and the decision maker.
The legal basis for the processing is GDPR Article 6 (1) (c): compliance with a legal obligation to which Pareto is subject.
2.4 Personal data obtained for potential clients
For potential clients we collect the following data that can be linked to individuals:
| Type of personal data | Legal basis for processing |
|---|---|
| Name of potential client | GDPR Article 6 (1) (a): based on consent and/or GDPR Article 6 (1) (f) Pareto’s legitimate interest to be able to market the services and products that may interest you, developing our products/services, and growing our business. |
| Contact details | GDPR Article 6 (1) (a): based on consent and/or GDPR Article 6 (1) (f) Pareto’s legitimate interest to be able to market the services and products that may interest you, developing our products/services, and growing our business. |
| E-mail correspondence and phone calls | GDPR Article 6 (1) (a): based on consent. |
2.5 Personal data obtained for contractors and business partners
For suppliers and business partners we collect the following data that can be linked to individuals:
| Type of personal data | Legal basis for processing |
|---|---|
| Name of supplier or business partner | GDPR Article 6 (1) (b): necessary for the performance of a contract to which the data subject is a party. |
| Contact details | GDPR Article 6 (1) (b): necessary for the performance of a contract to which the data subject is a party. |
| E-mail correspondence and phone calls | GDPR Article 6 (1) (b): necessary for the performance of a contract to which the data subject is a party. |
2.6 Use of client log-in pages
When using our client pages that require log-in, we process the following personal data:
- Username and password
- Your last log-in timestamp
The legal basis for the processing is GDPR Article 6 (1) (b): the performance of a contract to which the data subject is a party.
We also process the following data when you use our client log-in pages:
- Technology used (browser, operating system, network provider, entity)
- Pages visited
The legal basis for this processing is GDPR Article 6 (1) (f): Pareto’s legitimate interest in improving functionality and ensuring a seamless user experience.
If you have given consent, we also collect the following data via Google Analytics 4:
- Demographic data (age, gender),
- Geographic data (city, country, language).
The legal basis for this processing is GDPR Article 6 (1) (a): based on consent.
When you subscribe to our research, we collect the following data:
- Whether you have opened/read e-mails
- Which links you have accessed in e-mails
The legal basis for the processing is GDPR Article 6 (1) (a): based on consent.
2.7 Personal data collected from visitors of our social media accounts
For visitors of our social media pages, we may collect the following data that can be linked to individuals:
| Type of personal data | Legal basis for processing |
|---|---|
| Name, data concerning likes and clicks, messages sent to us, uploaded pictures, and comments | GDPR Article 6 (1) (f): necessary for pursuing our legitimate interest in our social media appearance. |
2.8 Video recording by closed-circuit camera surveillance
Pareto has video surveillance outside of our offices to prevent and detect any criminal activity. Such recordings are deleted on an after 90 days, or a shorter period if required by local law.
On-site signs clearly indicate where recordings are made and who is responsible for such recordings.
The legal basis for the processing is GDPR Article 6 (1) (f): Pareto’s legitimate interest in the prevention and detection of criminal activities.
2.9 Employees and recruitment
Information regarding Pareto’s handling of personal data of our employees is provided in our Privacy Information for Employees.
Information regarding Pareto’s handling of personal data in our recruitment process is provided in our Privacy Information for Recruitment.
3. The purpose of processing personal data and how we use the data
3.1 The purpose of processing personal data
The principal purposes of personal data processing are client administration, invoicing, and compliance with the obligations assumed by Pareto for the execution of assignments for, and performance of agreements with, clients, potential clients and contractors.
The basis for personal data processing is statutory obligations, as well as such processing being necessary for the performance of an agreement with, or the provision of a service to, clients. We will otherwise process personal data when Pareto has a legitimate interest in processing such data to the extent required or permitted under applicable legislation, or to the extent the client has consented to such processing.
Apart from this, personal data are processed for, inter alia, the following purposes:
- Compliance with legal obligations
- Regulatory reporting and audits, as well as requests from the authorities
- In case of disputes
- Client service development
- Marketing, product and client analysis
3.2 How we use the personal data
Pareto typically uses the personal data in the following ways:
- To offer services to you
- To perform client controls
- For transaction and stock exchange reporting
- For documentation and control actions
- For marketing our products and services
- For client service development Cookies
To offer our services to you
The data that the securities legislation requires Pareto to collect and keep in relation to clients are used as a basis for providing clients with advice that is tailored to their level of expertise, risk appetite and investment objectives. Such data is also used to ensure that clients do not trade in securities of which they have insufficient knowledge.
Pareto also uses personal data for client follow-up.
Performing client control
Pursuant to anti-money laundering legislation, Pareto is required to collect and maintain copies of documents used in connection with client control.
This also includes monitoring and reviewing transactions to prevent our business from being used for the purpose of terrorism financing or money laundering. Personal data is processed to fulfill our investigation and reporting obligations pursuant to relevant statutory obligations. This entails that Pareto may report suspicious transactions to relevant authorities if required to comply with statutory obligations.
Transaction and stock exchange reporting
The securities legislation requires Pareto to report all trades to relevant Financial Supervisory Authority (TRS reporting) and applicable Stock Exchanges (order record keeping). The details shall identify the client and the decision maker.
Documentation and control actions
As a provider of financial services, Pareto has a statutory obligation pursuant to relevant securities legislation, to record all telephone conversations and to document our communication with clients (whether by e-mail, telephone, SMS, Bloomberg or MS-Teams meetings (only audio).
The audio recording requirement applies to all telephone conversations with the Pareto’s clients and potential clients and their representatives to the extent that the telephone calls are linked to the provision of investment services.
Marketing our products and services
Pareto uses personal data to provide information on services and products that may be of interest to you. Personal data is processed in the context of marketing, product- and client analysis to improve our product range and optimize our client offerings, which may also involve profiling.
We send information to clients and other parties to inform about relevant news, our services and events. For existing clients, this is based on our legitimate interest in following up the client relationship. During the establishment of the client relationship or subsequent thereto you have consented to receiving electronic communications from us. Pareto will in such case send you communications based on the consent you gave at the time. In all other cases, we obtain your consent before we send you marketingrelated information.
In connection with registration for our events, we consider that we have a legitimate interest in processing personal data in order to manage and plan the event.
We process personal data for marketing purposes until you withdraw your consent or until the existing client relationship ends.
Client service development
We store data on the use of our client services to improve the client experience and enhance our services based on, among other things, statistical knowledge and usage trends. This enables Pareto to customize our content and features in accordance with your needs and interests.
Such data storage is also used to detect errors, test functionality and to implement and verify necessary corrections.
Cookies
When you visit one of Pareto’s webpages, we register various types of information about you in a cookie. A cookie is a small file stored locally on your device. The information includes information from your browser, such as the browser type and browser language, IP address (Internet protocol), and your actions on our website, such as the web pages you view, and the links you click on.
Cookies enables us to provide you with user-tailored content as well as to detect and prevent security threats and abuse. Additional information is available in our Cookie Statement available on www.paretosec.com.
4. Sharing of personal data with third parties and transfer of personal data
4.1 Internal procedures
Pareto is subject to a statutory duty of confidentiality. All employees of Pareto are informed of the applicable procedures and have signed comprehensive confidentiality undertakings upon employment. Pareto also has procedures in place to ensure adherence to these confidentiality undertakings.
Any violations of confidentiality have consequences for the employees involved.
4.2 Disclosure to third parties
Pareto only discloses personal data to third parties in the following cases:
- When Pareto is legally required to do so, such as for reporting of suspicious transactions or when ordered by public authorities.
- When it is considered necessary to receive and execute orders, perform settlement, and establish securities accounts on behalf of clients, such as with another investment firm or central securities depositary.
- When it is considered necessary within the Pareto Group to fulfil Pareto’s agreements, or to provide services to you.
- When it is necessary to protect Pareto’s interests in a dispute.
- When it is necessary for the operation of Pareto’s IT systems.
- When the client has given its consent.
Pareto conducts extensive business operations that rely on IT system operations procurement. The suppliers of our IT services and their sub-suppliers may access personal data if necessary to provide their services to Pareto. We have data processing agreements with these parties to ensure data is stored securely and not misused.
We do not disclose personal data in any other way unless requested by our clients or required to comply with legal obligations.
Pareto does not sell personal data.
5. Retention and deletion
Personal data will be stored for as long as Pareto has a legitimate need and lawful right to retain it, but at least as long as necessary to comply with statutory obligations.
The key storage obligations are:
- Documentation and information under Securities Trading Legislation implemented from relevant EU directives (e.g. MiFID II) are retained for a minimum period of 5 years after the discontinuation of the client relationship.
- Documentation and information required under Securities Trading Legislation implemented from relevant EU directives relating to audio recordings and other electronic communications are retained for a minimum period of 5 years from the time of the recording or communication. Personal data stored in Global Relay (e-mails and Bloomberg) and audio-recordings are automatically deleted after 7 years.
- Documentation required under Anti-Money Laundering Legislation implemented from EU directives, including data relating to client checks, are to be kept for a minimum period of 5 years after the discontinuation of the client relationship or completion of a transaction.
- Accounting materials required under bookkeeping legislation are kept for 5 years after the end of the financial year, or longer if required by national laws.
Compliance
