Privacy policy 

1. General

Zürcher Kantonalbank Savings 3 Pension Foundation (“Foundation”) has an open, transparent, client-friendly approach, and this also applies to data protection. “Personal data” is considered to mean all details that refer to a specific or identifiable person. “Processing” is considered to mean all ways of dealing with personal data, irrespective of the means and procedures used, in particular the procuring, storing, using, revising, disclosing, archiving and destroying of personal data.

Additional terms and conditions (such as the terms of use for the frankly app) exist for certain data processing steps, e.g. for the app offered by the Foundation as well as the web version. These are available on the relevant websites, in the web version or in the app.

1.1 General terms and con­di­tions of busi­ness

Section 6 of the Janury 2022 version of the General Terms and Conditions (GTC) of Business contains general information about data protection, in particular in connection with the performance of contracts.

1.2 Data security

The Foundation is particularly bound by its duty of confidentiality and data protection law to protect your privacy in line with the applicable laws. To this end, the Foundation takes numerous precautions such as the implementation of technical and organisational security measures (for example, the use of firewalls and personal passwords as well as encryption and authentication technologies, access restrictions and awareness-raising and training for employees).

2. Scope of proces­sing

2.1 Categories of per­son­al data

The Foundation can process the following categories of personal data, depending on which products and services it provides for you. In doing so, the Foundation will process the minimum amount of personal data necessary.

The Foundation processes customer data. These include the following in particular:

• Master data and inventory data such as name, address, date of birth, contract number and duration, documents confirming the customer’s identity, information relating to the account, securities account or transactions conducted or relating to third parties such as life partners, authorised agents and beneficiaries who are also affected by the data processing.
• Fiscal domicile and any other documents and information which may be relevant in terms of tax.
• Transaction and order management data such as information about beneficiaries in the event of death, information on your self-employment / employment, your risk and investment profile and the investment products you have requested as well as information about reasons for early withdrawal, changes in the designation of beneficiaries, and cases of fraud.
• Recordings of telephone conversations between you and the Foundation, if applicable.
• Marketing data, for example requirements, wishes and preferences.
• Technical data such as internal and external identifiers trade numbers, IP addresses, records of accesses or changes.
• Any particularly sensitive personal data, e.g. data on disability.

The Foundation processes data relating to potential customers and visitors (i.e. those who visit Zürcher Kantonalbank branches or the websites of Zürcher Kantonalbank or the Foundation in particular). The Foundation considers this to mean the following data in particular:

• Master data and inventory data, for example name, address and date of birth.
• Technical data such as internal and external identifiers IP addresses and records of accesses or changes.
• Marketing data, for example requirements, wishes and preferences.

2.2 Source

In order to fulfil the purposes set out in section 2.4, the Foundation can collect personal data originating from the following sources:

• Personal data communicated to the Foundation, for example in connection with the opening of a business relationship or an advisory consultation at Zürcher Kantonalbank for services provided by the Foundation or on the websites of Zürcher Kantonalbank or the Foundation.
• Personal data generated in connection with the use of products or services and communicated to the Foundation through the technical infrastructure or through collaborative processes, for example on the Foundation’s website, in the app, on the web-based platform or during the course of cooperation with other financial or IT service providers or marketplaces and exchanges.
• Personal data from third-party sources such as the authorities, companies within the Zürcher Kantonalbank Group or sanction lists maintained by UNO, SECO and the EU.

2.3 Length of stor­age

The period for which personal data is stored is determined according to statutory retention obligations and the purpose for which the data in question are processed.

As a rule, the Foundation stores personal data for the duration of the business relationship or term of the contract and then for a further ten years. This corresponds to the interval of time within which legal claims can be brought against the Foundation. Current or anticipated legal or supervisory authority proceedings can lead to data being stored beyond this period.

2.4 Purpose

The Foundation can process the personal data described under section 2.1 in connection with the provision of its own services as well as for its own purposes or those required by law. These include the following in particular:

• Customer registration procedures, the conduct, processing and administration of the business relationship and services provided by the Foundation as well as investment products requested by the customer (for example, verification of identity, evaluation of applications, financial planning, payments, invoices, accounts, investment, pensions, succession and insurance, customer service and communication).
• Statistics, planning or product development, business decisions (for example, the determination of indicators relating to the use of services, utilisation figures, transaction analyses, development of ideas for new products or the evaluation or improvement and review of existing services, investment products, processes, technology, systems and returns).
• Monitoring and management of risks, business reviews, establishment of businesses and timely processing of business (for example, combating of fraud, investment profiles market or operational risks as well as system and product training).
• Marketing, market research, comprehensive service, advice and information concerning the range of services offered, preparation and provision of tailor-made services (for example, direct marketing, print and online advertising, customer, promotional or cultural events, sponsoring, prize draws, measurement of customer satisfaction, future customer needs or behaviour or assessment of customer, market or product potential).
• Statutory or regulatory information, disclosure or reporting obligations with respect to courts and the authorities, compliance with official orders (for example, orders by FINMA or public prosecutor’s offices, in connection with money laundering or the financing of terrorism or for the purpose of recording and monitoring communications).
• Protecting the Foundation’s interests and securing its claims in cases where claims are brought against the Foundation or a pension fund member or beneficiary as well as protecting the security of pension fund members, beneficiaries and employees.
• Any other purposes about which the Foundation has informed you.

2.5 Bases for the proces­sing of per­son­al data

Depending on which services the Foundation may provide for you or the purpose for which the personal data are processed, the data processing is carried out on the following basis:

• Conclusion or performance of a contract or commencement of a business relationship with you or for the purpose of fulfilling the Foundation’s obligations arising from such a contract or business relationship.
• Where applicable, to safeguard the legitimate interests of the Foundation – for example, statistics and business decisions; monitoring and controlling risks, business audits; marketing, market research, comprehensive service, advice and information concerning the range of services offered, preparation and provision of tailor-made services – where no objection has been lodged; protection of the Foundation’s interests and securing the claims of the Foundation, its pension fund members / beneficiaries and employees.
• If necessary, in order to fulfil the Foundation’s statutory or regulatory obligations or perform duties in the public interest.
• If necessary, on the basis of your consent*.

* Consent obtained for other reasons, for example due to the provision on the duty of confidentiality according to Article 86 of the Federal Law on Occupational Retirement, Survivors‘ and Disability Pension Plans (BVG / LPP), is not affected by this section.

2.6 Are you re­quired to pro­vide per­son­al data?

If personal data processed by the Foundation are necessary in order to fulfil statutory or regulatory obligations or for the conclusion or performance of a contract or the commencement of a business relationship with you, it may be the case that the Foundation cannot accept you as a pension fund member or cannot provide you with products or services if the Foundation is unable to process this personal data. In this case, we will inform you accordingly.

2.7 Existence of au­to­ma­ted in­di­vi­du­al de­ci­si­on-ma­king in in­di­vi­du­al ca­ses, in­clu­ding pro­filing

The Foundation also reserves the right in future to analyse and evaluate pension fund members’ data (including data of affected third parties, see section 2.1) in automated form in order to recognise key personal characteristics of the pension fund member or predict developments and create customer profiles. These are particularly used for business reviews and to provide individual consultations as well as offers and information that the Foundation and the Zürcher Kantonalbank Group companies may make available to the member of the pension fund.

Customer profiles may in the future also lead to automated individual decisions, for example in order to accept and execute orders submitted by the pension fund member in eBanking by automated means.

The Foundation will ensure that a suitable contact person is available if the pension fund member wishes to discuss an individual automated decision; this opportunity of expression is provided for by law.

2.8 Categories of in­ten­ded re­ci­pi­ents, gua­ran­tees and dis­clo­sure ab­road

Within the Foundation and Zürcher Kantonalbank, which is entrusted with the management of the Foundation, access to your personal data will only be granted to those departments requiring them for the conclusion or performance of a contract or the commencement of a business relationship in order to fulfil statutory or regulatory obligations or perform duties in the public interest.

The Foundation only discloses pension fund members’ data to third parties in the following cases – depending on the nature of the products and services used:

• In order to execute orders, i.e. in relation to the use of products and services, for example to payees, beneficiaries, authorised representatives, intermediaries, correspondence banks and, if necessary, any other parties, service providers, exchanges or marketplaces involved in a trans- action.
• With the consent of the pension fund member, to companies belonging to the Zürcher Kantonalbank Group for the purpose of providing comprehensive customer services and for outsourcing.
• On the basis of statutory obligations, legal justifications or official orders, for example to courts or supervisory authorities or, where necessary, in order to protect the Foundation’s legitimate interests in Switzerland and abroad. The latter particularly applies in the event of legal steps or public statements against the Foundation being initiated or threatened by a customer, in order to secure the Foundation’s claims against the pension fund member or third parties, in connection with the collection of the Foundation’s claims against the pension fund member or beneficiary and in order to restore contact with the customer after communication with the competent Swiss authorities has ceased.

Contract processors are third parties who process personal data on behalf of and for the purposes of the Foundation, for example IT, marketing, sales or communication service providers, collection agencies, fraud prevention agencies or consulting firms. If personal data is communicated to such contract processors, they may only process the received personal data in the same way as the Foundation itself. The Foundation selects its contract processors carefully and places them under a contractual obligation to guarantee confidentiality and professional secrecy in Switzerland as well as the security of the personal data.

Depending on which product or service is being used, personal data may under certain circumstances also need to be disclosed to third parties (including contract pro- cessors) based in countries in which no adequate level of data protection prevails. For example, the United States of America does not provide for an adequate level of data protection. When communicating personal data to such a country, the Foundation requires the recipient to take appropriate measures to protect personal data (for example, by agreeing to "EU standard clauses", other precautions or on the basis of justifying grounds; the Foundation can provide you with a copy of the EU standard clauses free of charge).

3. Rights

You have the right to information, rectification erasure, restriction, objection, as well as – where applicable – the right to data portability. In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (see section 5).

The Pillar 3 pension foundation of Zürcher Kantonalbank accepts information requests in writing together with a clearly legible copy of a valid official identity document (for example, a passport, identity card or driving licence) at the following address: 

Vorsorgestiftung Sparen 3 der Zürcher Kantonalbank

Datenschutz

Postfach 

8010 Zürich

The right to erasure and the right to object are not unlimited rights. Depending on the individual case, overriding interests may necessitate further processing. The Foundation will examine each individual case and notify you of the result. If personal data are processed for the purpose of direct marketing, your right to object also extends to direct marketing, including profiling for marketing purposes. You can lodge an objection to direct marketing at any time by sending the Foundation a notification to this effect (see section 5).

You can always revoke any consent you may have given to the Foundation to process personal data. Please note that such a withdrawal of consent only has effect for the future. Processing which took place prior to withdrawal of consent is not affected.

If the Foundation fails to meet your expectations with respect to the processing of personal data, if you wish to complain about the Foundation’s data protection practices or if you wish to exercise your rights, please notify the Foundation of this (see section 5). This will give the Foundation the opportunity to address your concerns and make improvements, if need be. In order to assist the Foundation in responding to your enquiry, please provide the relevant details in your notification. The Foundation will look into your concerns and reply within an appropriate period of time.

4. Changes to per­so­nal data

The Foundation is obliged to process the personal data accurately and keep it up to date. Please notify the Foundation of any changes to your personal data.

5. Contact details and ex­er­cising your rights

The Foundation is responsible for the processing of personal data:

Vorsorgestiftung Sparen 3 der Zürcher Kantonalbank 
Bahnhofstrasse 9

8001 Zürich

You can address general questions, suggestions and comments to your account manager or customer support.

You can address your questions in connection with data protection to the address listed above for the Pillar 3 pension foundation.

If you are not satisfied with the Foundation’s response, you have the right to lodge a complaint with the data protection authority.

6. Updating of the pri­va­cy po­li­cy

This privacy policy was issued in January 2022. It provides a general explanation of how the Foundation processes personal data. This privacy policy does not constitute a part of any contract between you and the Foundation. The Foundation reserves the right to amend this privacy policy from time to time. In the event of such amendments, you will be informed in an appropriate manner depending on how we usually communicate with you, for example via the website zkb.ch.