Privacy policy Privacy policy

1. General

 

The Pillar 3 Pension Foundation of Zürcher Kantonalbank, the Vested Benefits Foundation of Zürcher Kantonalbank and the Vested Benefits Foundation II of Zürcher Kantonalbank (hereinafter the “Foundations”) as well as Zürcher Kantonalbank are also committed to an open, transparent and customer-friendly approach when it comes to the issue of data protection. 

For the data processing activities concerned, there are joint responsibilities in accordance with data protection law: 

• The Pillar 3 Pension Foundation of Zürcher Kantonalbank and Zürcher Kantonalbank are jointly responsible for processing activities related to the services of the Pillar 3 Pension Foundation.
• The Vested Benefits Foundation of Zürcher Kantonalbank and Zürcher Kantonalbank are jointly responsible for processing activities related to the Vested Benefits Foundation.
• The Vested Benefits Foundation II of Zürcher Kantonalbank and Zürcher Kantonalbank are jointly responsible for processing activities related to the Vested Benefits Foundation II.

Agreements exist between the respective joint controllers regarding who assumes which data protection obligations (in particular, ensuring the rights of data subjects and reporting data protection breaches). Regardless of this internal allocation of responsibilities, you may exercise your rights under Section 3 with any of the joint controllers.

Where this privacy policy refers to "we" or "us," this – depending on the context – includes the respective foundation alone, the respective foundation jointly with Zürcher Kantonalbank as joint controllers, or Zürcher Kantonalbank insofar as it processes personal data in connection with the Foundations.

By “personal data”, we mean information that relates to an identified or identifiable natural person. We interpret “processing” as referring to any handling of personal data, irrespective of the means and methods used; it particularly refers to the collection, storage, use, adaptation, publication, archiving or destruction of personal data.

There are additional policies and further provisions in place governing certain data processing, such as by the app or web-based platform offered by the Foundations (e.g. General Terms and Conditions of Business or Terms of Use) or in connection with media work. These are available on the relevant webpages, in the app or on the web-based platform.

1.1 General terms and con­di­tions of busi­ness

Section 6 of the General Terms and Conditions (GTC) of Business of the respective foundation contains general information about data protection, in particular in connection with the performance of contracts.

1.2 Data security

We are particularly bound by its duty of confidentiality and data protection law to protect your privacy in line with the applicable laws. To this end, we take numerous precautions such as the implementation of technical and organisational security measures (for example, the use of firewalls and personal passwords as well as encryption and authentication technologies, access restrictions and awareness-raising and training for employees).

2. Scope of proces­sing

2.1 Categories of per­son­al data

We can process the following categories of personal data, depending on which products and services the Foundations provide for you. In doing so, we will process the minimum amount of personal data necessary.

 

2.1.1 Former, existing and potential pension fund members

We process the personal data of former, existing and potential pension fund members (or interested). These include the following in particular:

• Master data and inventory data such as name, postal address, telephone number, email address, date of birth, nationality, contract number and duration, identification and authentication data e.g. login for app and web-based platform, documents confirming the customer’s identity such as ID and passport, information relating to the account, securities account, payments for current or completed transactions, contracts, products, services, and information conducted or relating to third parties such as life partners, family members, authorised agents and beneficiaries who are also affected by the data processing.
• Fiscal domicile and any other documents and information which may be relevant in terms of tax.
• Transaction or order and risk management data such as information about beneficiaries in the event of death, counterparties and third party banks for transfers, information on your self-employment/employment, to your marital status, your risk and investment profile and the investment products you have requested as well as information about reasons for early withdrawal, changes in the designation of beneficiaries, and cases of fraud, enquiries, consultations, meetings, and physical or electronic correspondence.
• Personal data requiring special protection (sensitive personal data), such as biometric data for voice recognition during telephone calls for the identification of the caller or data on disability.
• Recordings of telephone conversations between you and us, if applicable.
• Marketing data, for example requirements, wishes, interests, preferences, information on the use of products, services or contact and communication channels.
• Technical data such as internal and external identifiers, trade numbers, IP addresses, records of accesses or changes. 

 

2.1.2 Data relating to visitors

We process data relating to visitors (i.e. those who visit Zürcher Kantonalbank branches or the websites of Zürcher Kantonalbank or the Foundations in particular). We consider this to mean the following data in particular:

• Master data and inventory data, for example name, telephone number, email address, postal address and date of birth.
• Recordings of telephone conversations between you and us, if applicable.
• Technical data such as internal and external identifiers, IP addresses and records of accesses or changes.
• Marketing data, for example requirements, wishes and preferences, interactions.
• Data which is transmitted to us when you visit our website or with which you provide us (i.e. by filling in a form).

2.2 Length of stor­age

The period for which personal data is stored is determined according to statutory retention obligations and the purpose for which the data in question are processed.

As a rule, we store personal data for the duration of the business relationship or term of the contract and then for a further ten years or more (depending on the applicable legal basis). This corresponds to the interval of time within which legal claims can be brought against the Foundations. Current or anticipated legal or supervisory authority proceedings can lead to data being stored beyond this period.

2.3 Purpose

We can process the personal data described under section 2.1 in connection with the provision of the services of the Foundations as well as for their own purposes or those required by law. These include the following in particular:

• Customer registration procedures, due diligence, financial statements, the conduct, processing and administration of the business relationship and products and services provided by the Foundations as well as investment products requested by the customer (for example, communications, verification of identity, evaluation of applications, financial planning, payments, invoices, accounts, investment, pensions, succession and insurance, eFinance, customer service and communication).
• Statistics, planning or product development, business decisions (for example, the determination of indicators relating to the use of services, utilisation figures, transaction analyses, development of ideas for new products or the evaluation or improvement and review of existing products, services, investment products, processes, technology, systems and returns).
• Monitoring and management of risks, business reviews, establishment of businesses and timely processing of business (for example, combating of fraud, investment profiles, market or operational risks as well as system and product and staff training).
• Marketing, market research, client relationship management, client recovery, comprehensive service, advice and information concerning the range of services offered, preparation and provision of tailor-made services (for example, direct marketing, print and online advertising, customer, promotional or cultural events, competition, sponsoring, prize draws, measurement of customer satisfaction, future customer needs or behaviour or assessment of customer, market or product potential).
• Statutory or regulatory information, audit, disclosure or reporting obligations with respect to courts and the authorities, compliance with official orders (for example, identifying checks, orders by FINMA or public prosecutor’s offices, in connection with fraud and money laundering prevention or the financing of terrorism or for the purpose of recording and monitoring communications).
• Protecting the Foundations’ interests and securing their claims in cases where claims are brought against the Foundations or the pension fund members or beneficiary as well as protecting the security of pension fund members, beneficiaries and employees.
• Maintaining the website (e.g. technical management and developing the websites).
• Any other purposes about which we have informed you. 

2.4 Sources

In order to fulfil the purposes set out in section 2.3, we can collect personal data originating from the following sources:

• Personal data communicated to us, for example in connection with the opening of a business relationship or an advisory consultation at Zürcher Kantonalbank, communications with Zürcher Kantonalbank or Foundations, for products and services provided by the Foundations or on the websites and apps of Zürcher Kantonalbank or the Foundations.
  Only disclose the personal data of third parties to us outside of a legal obligation if you have made the third parties concerned aware of this privacy policy in advance.
• Personal data generated in connection with the use of products or services and communicated to us through the technical infrastructure or through collaborative processes (for example on the Foundations’ website, in the app, on the web-based platform, in payment transactions, with respect to investing in or the liquidation of securities or during the course of cooperation with other financial or IT service providers or marketplaces and exchanges).
• Personal data from third-party sources such as from correspondent banks in payment transactions, database marketing, the authorities, companies within Zürcher Kantonalbank Group or sanction lists maintained by UNO, SECO and the EU.
• Personal data that is publicly accessible, e.g. on the internet, in the media, and in public registers such as land registry and commercial registry offices.

2.5 Bases for the proces­sing of per­son­al data

Depending on which products and services the Foundations may provide for you or the purpose for which the personal data are processed, the data processing is carried out on the following basis:

• Conclusion or performance of a contract or commencement of a business relationship with you or for the purpose of fulfilling the Foundations’ obligations arising from such a contract or business relationship (including necessary pre-contractual measures), e.g. for payments, invoices, accounts, investments, pension, succession and insurance, eFinance and customer service.
• Where applicable, to safeguard the legitimate interests of the Foundations – for example, statistics and business decisions; monitoring and controlling risks, business audits; marketing, market research, client relationship management, comprehensive service, advice and information concerning the range of services offered, preparation and provision of tailor-made services – where no objection has been lodged; protection of the Foundations’ interests and securing the claims of the Foundations, its pension fund members/beneficiaries and employees.
• If necessary, in order to fulfil statutory or regulatory obligations imposed on us or perform duties in the public interest, e.g. based on the Anti-Money Laundering Act, Pfandbrief Act and tax laws (see also information on tax agreements and the exchange of information with authorities).
• If necessary, on the basis of your consent¹.
  ¹ Consent obtained for other reasons, for example due to the provision on the duty of confidentiality according to Article 86 of the Federal Law on Occupational Retirement, Survivors' and Disability Pension Plans (BVG/LPP), is not affected by this section. 

2.6 Obligation to provide personal data

If personal data processed by us are necessary in order to fulfil statutory or regulatory obligations or for the conclusion or performance of a contract or the commencement of a business relationship with you, it may be the case that the Foundations cannot accept you as a pension fund member or cannot provide you with products or services if we are unable to process this personal data. In this case, we will inform you accordingly.

2.7 Existence of automated individual decision-making in individual cases, including profiling

We also reserve the right in future to analyse and evaluate pension fund members’ data (including data of affected third parties, see section 2.1) in automated form in order to recognise key personal characteristics of the pension fund member or predict developments and create customer profiles. These are particularly used for business reviews and processing reviews (e.g. when determining an investment strategy, risk profiles, combating money laundering, malpractice and fraud and IT security) and to provide individual consultations as well as offers and information (e.g. marketing, product development and improvement, so that you only receive products and services which match your interests) that the Foundations and Zürcher Kantonalbank Group companies may make available to the member of the pension fund.

Customer profiles may in the future also lead to automated individual decisions, for example in order to accept and execute orders submitted by the pension fund member in eBanking by automated means.

We will ensure that a suitable contact person is available if the pension fund member wishes to discuss an individual automated decision; this opportunity of expression is provided for by law.

2.8 Categories of in­ten­ded re­ci­pi­ents, gua­ran­tees and dis­clo­sure ab­road

2.8.1 Recipient

 

Within the Foundations and Zürcher Kantonalbank, which is entrusted with the management of the Foundations, access to your personal data will only be granted to those departments requiring them for the conclusion or performance of a contract or the commencement of a business relationship with the Foundations in order to fulfil statutory or regulatory obligations or perform duties in the public interest.

We only disclose pension fund members’ data to third parties in the following cases – depending on the nature of the products and services used:

• In order to execute orders, i.e. in relation to the use of products and services, for example to payees, beneficiaries, authorised representatives, intermediaries, correspondence banks, clearing houses and, if necessary, any other parties, service providers (e.g. Swisscom), exchanges or marketplaces involved in a transaction.
• With the consent of the pension fund member, to companies belonging to Zürcher Kantonalbank Group for the purpose of providing comprehensive customer services and for outsourcing.
• On the basis of statutory obligations, legal justifications or official orders, for example to courts, to law enforcement or supervisory authorities or, where necessary, in order to protect the Foundations’ legitimate interests in Switzerland and abroad. The latter particularly applies in the event of legal steps or public statements against the Foundations being initiated or threatened by a customer, in order to secure the Foundations' claims against the pension fund member or third parties, in connection with the collection of the Foundations' claims against the pension fund member or beneficiary and in order to restore contact with the customer after communication with the competent Swiss authorities has ceased.
  
  Contract processors are third parties who process personal data on behalf of and for the purposes of the Foundations, for example IT, marketing, market research, sales or communication service providers, logistics companies, printing services providers, financial services providers, collection agencies, fraud prevention agencies, information and cybersecurity service providers or consulting firms. If personal data is communicated to such contract processors, they may only process the received personal data in the same way as ourselves. The Foundations select their contract processors carefully and place them under a contractual obligation to guarantee confidentiality and professional secrecy in Switzerland as well as the security of the personal data.

 

2.8.2 Place of data disclosure

Where data is disclosed will depend on the type of product or service used. We issue, return and hold securities on behalf of the client. In this context, foreign law and contractual provisions may require that we disclose who we are working for. This may result in us having to disclose certain persons, information and documents to authorities and companies either abroad or in Switzerland. It should be noted here that settlement and custody may take place in third countries. Disclosure requirements vary from country to country. In addition, new disclosure requirements may arise or existing requirements may be adjusted at any time.
Further information on the place of disclosure of personal data in connection with securities has already been provided to you (cf. General Terms and Conditions).

 

2.8.3 Guarantees

If in exceptional circumstances, personal data is disclosed in countries with an insufficient level of data protection, we require the recipient to comply with an adequate level of data protection by concluding recognised standard contractual clauses or we will make use of a statutory exemption (e.g. concluding or performing a contract, safeguarding of overriding public interests, enforcing legal claims, and your consent). The Foundations can provide you with a copy of the standard contractual clauses free of charge.

3. Rights

You have the right to information, rectification, erasure, restriction, objection, as well as – where applicable – the right to data portability. In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (see section 5).

The Pillar 3 Pension Foundation of Zürcher Kantonalbank, the Vested Benefits Foundation of Zürcher Kantonalbank or the Vested Benefits Foundation II of Zürcher Kantonalbank accept information requests in writing together with a clearly legible copy of a valid official identity document (for example, a passport, identity card or driving licence). The contact details can be found in section 5.

The right to erasure and the right to object are not unlimited rights. Depending on the individual case, overriding interests may necessitate further processing. We will examine each individual case and notify you of the result. If personal data are processed for the purpose of direct marketing, your right to object also extends to direct marketing, including profiling for marketing purposes. You can lodge an objection to direct marketing at any time by sending us a notification to this effect (see section 5).

You can always revoke any consent you may have given to the Foundations to process personal data. Please note that such a withdrawal of consent only has effect for the future. Processing which took place prior to withdrawal of consent is not affected.

If we fail to meet your expectations with respect to the processing of personal data, if you wish to complain about our data protection practices or if you wish to exercise your rights, please notify the Foundations of this (see section 5). This will give us the opportunity to address your concerns and make improvements, if need be. In order to assist us in responding to your enquiry, please provide the relevant details in your notification. We will look into your concerns and reply within an appropriate period of time.

 

4. Changes to per­so­nal data

We are obliged to process the personal data accurately and keep it up to date. Please notify the Foundations of any changes to your personal data.

5. Contact details and ex­er­cising your rights 

We are headquartered at the following addresses:

Vorsorgestiftung Sparen 3    
der Zürcher Kantonalbank        
Bahnhofstrasse 9       
8001 Zürich

 

Freizügigkeitsstiftung
der Zürcher Kantonalbank        
Bahnhofstrasse 9       
8001 Zürich

 

Freizügigkeitsstiftung II 
der Zürcher Kantonalbank        
Bahnhofstrasse 9       
8001 Zürich

 

Zürcher Kantonalbank
Bahnhofstrasse 9       
8001 Zürich

You can address further questions in connection with data protection at the following addresses:

Vorsorgestiftung Sparen 3 der Zürcher Kantonalbank, Datenschutz, Postfach, 8010 Zürich or Freizügigkeitsstiftung der Zürcher Kantonalbank, Datenschutz, Postfach, 8010 Zürich or Freizügigkeitsstiftung II der Zürcher Kantonalbank, Datenschutz, Postfach, 8010 Zürich as well as

KPMG AG, Alberto Job, Badenerstrasse 172, Postfach, 8036 Zürich
(data protection advisor to the Vested Benefits Foundation and Vested Benefits Foundation II)

If you are not satisfied with the Foundations' response, you have the right to lodge a complaint with the data protection authority.

6. Updating of the privacy policy

This privacy policy was issued in November 2019 and was last updated in July 2026. It provides a general explanation of how we process personal data. This privacy policy does not constitute a part of any contract between you and the Foundations. The Foundations reserve the right to amend this privacy policy from time to time. In the event of such amendments, you will be informed in an appropriate manner depending on how we usually communicate with you, for example via the website zkb.ch.