INFORMATION NOTICE CONCERNING PERSONAL DATA

 

Voir ces informations en français

 

The BPCE Group is made up of the following Natixis legal entities and branches in Europe in relation to our corporate and institutional banking business:

 

On what basis is your Data collected and used and for what purposes?

As part of our banking relationship, Natixis needs to gather your Data for the purposes described below, on the basis described:

• Performing the contracts for the products and services you have taken out or wish to take out: 

For Natixis, this means:

• Managing the accounts, products and services (including any financial instruments) taken out by you or by our business and institutional customers (of whom you are a staff member, shareholder, beneficial owner or customer – for instance, in relation to cash management),
• Managing transactions and associated cash flows,
• Providing virtual content, information and recommendations (for instance in relation to capital markets),
• Providing assistance and handling your requests in this regard.

Unless it can gather and process your Data, Natixiswill not be able to make or perform the contracts that bind us to our customers and counterparts.

 

• Fulfilling our legal and regulatory obligations

Natixis must gather your Data in order to meet its obligations:

• In relation to banking and financial matters:
  • Putting security measures in place to prevent fraud, for instance to detect abnormal transactions, in relation to embargoes and more generally to combat financial crime both in respect of the financial sector and in respect of Natixis, its customers and its staff,
  • Monitoring and reporting on the risks that institutions may run,
  • Recording telephone conversations and written messages (electronic and instant messaging) in connection with transactions on the markets,
  • Meeting its obligations to report to any competent public or judicial authorities and to answer any official request issued by a competent public or judicial authority,
• In relation to the prevention of money laundering and terrorist financing,
• In relation to the prevention of tax evasion, including reporting obligations vis-à-vis the authorities,
• In relation to market abuse,
• In relation to transparency and the prevention of corruption,

Otherwise, Natixis will not be able to continue its business relationships with its customers or counterparts.

 

• Where Natixis SA has a legitimate interest in using your Data

Natixis may process your Data on the basis of its “legitimate interest” if it finds itself in a position that could present risks to its business or is required to defend its rights, or in order to develop its products or services. This includes: 

• Ensuring the security of its IT systems,
• Defending its rights,
• Managing relations with customers and prospective customers,
• Personalising our product and service offering by segmenting our customers and prospective customers, including by aggregating Data for analytical or anonymisation purposes,
• Improving our products and services,
• Audit and inspection activities.

 

• Purposes for which your consent is required

Natixis intends to make certain types of Data processing subject to obtaining your consent. In such cases, you will be asked to consent specifically to the collection and processing of your Data for expressly stated purposes. 

For example, in relation to any direct marketing sent to customers or prospective customers who are individuals, your consent will be required if you are not a Natixiscustomer, or if you are a Natixis customer but the sales material relates to products that are not comparable to those you have already taken out. 

For a description of the purposes for which your Data is used, please click here.
 

• Cookies and other trackers

By cookies or other trackers we mean trackers that are placed and read, for example, when you open a website, read an email or install an item of software or a mobile app.

When you visit a Natixis website, cookies and trackers may be installed on your device (your computer, smartphone, tablet, etc.). 

Natixis’s cookie policy may be consulted on any of its websites, under the heading “Cookies” in the legal notices section or at the foot of the web page.

 

Who has access to your Data?

Natixis takes all necessary steps to ensure the safety and confidentiality of the Data it collects, i.e. to ensure that only authorised persons have access to it. 

Only persons who are authorised by virtue of their activity in the competent Natixis departments that are in charge of the relevant processing have access to your Data, and only within the scope of their authorisations. 

BPCE Group companies (subsidiaries and branches), our service providers and our partners may likewise have secure access to your Data insofar as it is needed in relation to the performance of their services or our collaboration agreement. 

Your Data will also be passed to certain authorities in accordance with the applicable law and regulations. 

In the above circumstances, Natixis may transfer your Data (by communicating or making it accessible) to another country either in or outside the European Union.

To find out more about the categories of recipients of your Data and about potential transfers outside the European Union and the relevant frameworks of legal safeguards, please click here. 

 

How long will your Data be retained?

Most Data collected in relation to a specified customer are kept for the duration of the contractual relationship plus a specified number of years after the end of the contractual relationship.
Our criteria for defining our retention periods are:
 

• Meeting our operational obligations (e.g. account maintenance, facilitating customer relationship management) and
• Legal requirements (if any).

In case of regulatory requests or legal claims, our retention standards may be increased in this regard for Natixis defense.

 

What rights do you have over your Data?

Within the limits and conditions laid down by current legislation, you can:

• Obtain access to all of your Data,
• Rectify, update and delete your Data for legitimate reasons,
• Object to the processing of your Data for legitimate reasons and object to the processing of your Data for direct marketing purposes without giving any reason,
• Request the portability of your Data for processing that requires your consent or for the performance of a contract that has been or will be made,
• Demand the limitation of the processing we perform in relation to your Data,
• Withdraw your consent at any time (for processing that requires your consent),
• Lodge a complaint with a competent supervisory authority, i.e. the authority in the country of the European Economic Area of your habitual residence, your place of work, or the place of an alleged infringement: 
  • in France, this is the CNIL: www.cnil.fr
  • in the UK this is the Information Commissioner Office : www.ico.uk
  • in Germany this is der Hessische Datenschutzbeauftragte: www.datenschutz.hessen.de
  • in Italy this is Garante per la Protezione dei dati personali: www.gpdp.it
  • in Spain this is Agencia Española de Protección de Datos: www.agpd.es

 

How do you exercise your rights?

To exercise your rights, please contact our Data Protection Officer by email or by post, stating your full name and contact details, providing a copy of your identity document and specifying Natixis legal entity, branch and country you are in business relationships with.

 

Data Protection Officer
Natixis France, UK, Italy and Spain
Natixis – BP 4 – 75060 Paris Cedex 02 France	dpo@natixis.com
Natixis Germany
Natixis Pfandbriefbank AG and Natixis Zweigniederlassung Deutschland Im Trutz Frankfurt 55 – 60322 Frankfurt am Main	datenschutz-npb@natixis.com

 

In relation to electronic communications for direct marketing purposes: 

An unsubscribe link (for emails) or a unsubscribe number (for SMS/MMS messages) also appears on every electronic message sent to you by Natixis. 

 

Country specific provisions

France :
You also have the option of sending us instructions concerning the retention, deletion and communication of your Data after your death. These instructions may also be registered with a “certified digital trusted third party”. Such instructions, a kind of “digital will”, may designate a person in charge of their execution; failing this, your heirs will be designated.

Spain :
The legal heirs of a deceased person may contact us in order to request access to the personal data of that person and, where appropriate, rectification or deletion.
As an exception, the heirs may not access the data of the deceased, nor request its rectification or suppression, when the deceased had expressly prohibited it or so established by law.
The testamentary executor as well as that person or institution to which the deceased had expressly designated for this purpose may also request, in accordance with the instructions received, access to the personal data of the latter and, where appropriate, its rectification or suppression.