Privacy Notice of Saxo Bank (Switzerland) Ltd

DATA PROTECTION IN ACCORDANCE WITH THE FEDERAL ACT ON DATA PROTECTION ("FADP") and the European General Data Protection Regulation ("GDPR")

Saxo Bank takes your privacy seriously. We want to be transparent about how we process and protect your personal data.

We are required to process your personal data securely and otherwise in accordance with the Swiss Data Protection Act (FADP). If any applicable national legislation requires a higher level of protection for your personal data than the Swiss Law (e.g. GDPR), if its mandatory, such stricter requirements are also complied with.

In the course of our business, Saxo Bank (Switzerland) Ltd ("Saxo Bank/Saxo" or "we/our/us") collects and processes information about natural persons ("personal data"), including information about our current, former and potential clients ("you").

This Privacy Notice ("Privacy Notice") contains information about why we process your personal data, which types of personal data we process, who processes your personal data, what we do with that information and what rights you have.

As part of our commitment to protect your personal data, this Privacy Notice is designed to help you understand:

• Why and how Saxo Bank collects, uses and stores ("processes") your personal data within the applicable legal framework, in particular the FADP and GDPR and their principles;
• The legal basis for processing your personal data;
• Your rights in relation to such processing and how you can exercise them.

1. What is the scope of this Privacy Notice?

This Privacy Notice applies to the processing of your personal data by Saxo Bank. We always process personal data for a specific purpose and within the applicable legal framework.

2. What types of personal data do we collect?

We will only collect data about you that is relevant in the context of the relationship which we have with you.

We primarily collect information directly from you. But we will also collect personal data from other sources, which may include other Saxo Group entities, other companies and financial institutions, publicly available sources (e.g. the press, registers of companies, and the internet - including social media platforms) and from providers of business-risk screening services, anti-fraud databases, sanctions lists and databases of news articles.

For potential clients with whom we have not yet established direct contact, we collect the following personal data where relevant and permitted by law:

• Identifying information (e.g., name, address) and contact information (e.g. phone, email address);
• Professional profile information (e.g., employer, company) and financial background information (e.g. income and assets);
• Records related to our client relationship and relevant services, including data deriving from your usage of our IT platforms and, mobile apps.

For former and current clients or potential clients with whom we take steps to enter into a contractual business relationship, we collect the following personal data to the extent relevant and permitted by applicable law:

• Personal data such as your name, date of birth, compliance-relevant documents (including a copy of your identity card or passport in accordance with money laundering legislation and banking due diligence codes), telephone number, address and residence, electronic address;
• KYC (Know Your Customer) records, such as passport details, social security number, date and place of birth, source of wealth, rationale for use of corporate structures, your education and employment such as your job title and work experience, including whether you are entrusted with a prominent public function, as well as information from adverse media relevant for the relationship;
• Financial information, such as bank account details, specimen signature, income, assets, outgoings, investment objectives, marital status and where applicable, your knowledge and experience in investment matters incl. details about knowledge of financial products and services, risk appetite, capacity for loss, tax status and domicile;
• Tax residency and other tax-related documents and information;
• Details about our interactions with you and the products and services you use, including information about electronic and physical communications through various channels such as emails, mobile applications;
• Where applicable, records of telephone calls and electronic communication between you and Saxo Bank, including but not limited to telephone logs such as telephone number, caller ID, recipient ID, time and date of calls and messages, duration of calls, routing information and types of calls;
• Identifiers we assign to you, such as your client or account number, including identifiers for accounting purposes;
• Records of your engagement with our platform, apps, emails, text messages and social media;

• Data when you access our websites or website applications that is transmitted by your browser and automatically collected by our server, including the date and time of access, the name of the file accessed and the amount of data transmitted and the success of your access, your web browser, browser language and domain requested, and IP address. When you visit a Saxo Bank website, that website contains additional information about how we use your information while you are visiting that website;
• Data on geographical location for the purpose of complying with sanctions and other legal requirements;
• We may use cookies, tracking technologies and other methods (e.g. web beacons, pixels, gifs, tags) to collect and process personal data from different channels and devices. This includes devices you use to access Saxo websites, Saxo platforms, and mobile device applications to obtain information about Saxo products or services. For our use of cookies and other tracking technologies in relation to Saxo websites, please also read the Saxo website and cookie notice;
• We may also use personal data for analytics and measurement (including machine learning) to process the above information.

In some cases, we may collect personal data from publicly available registers (which may include beneficial ownership and other registers, depending on the product or service you are using and the country in which you have a business relationship with Saxo), public administration sources or other third party sources, such as service providers investigating the assets of legal entities, open source screening, fraud prevention agencies and other Saxo Group companies.

If you are a corporate or institutional client, we may also obtain information about your executive and board members. Before providing this information to Saxo Bank, you should provide them with a copy of this Privacy Notice.

3. For what purposes do we process personal data and on what legal basis?

3.1. Purposes of processing personal data

We always process your personal data for a specific purpose and only process data relevant to that purpose. In particular, we process personal data within the scope of the applicable legal provisions for the following purposes:

A) For the performance of a contract (cf. FADP article 31 (2) (a) / GDPR article 6 (1) (b) )

It may be necessary for us to process your personal data in order to perform a contract with you relating to our financial services, or to act on your instructions prior to entering into a contract.

a) Client admission procedure:

To verify your identity and evaluate your account application.

b) Client relationship management:

To manage our relationship, including communicating with you about products and services purchased from us and our business partners, handling client service-related questions and complaints, facilitating debt collection, making decisions about your identity, determining your whereabouts, and terminating your account (in accordance with the relevant legal provisions) if there are no account transactions and report your account if we cannot contact you after a period of time (“dormant assets”).

c) Product delivery and execution:

• To provide products and services to you and for their proper performance, e.g. by ensuring that we can identify you and fund and withdraw funds from your accounts in accordance with your instructions and the Product Terms;
• To provide IT solutions to you and to ensure proper execution in accordance with your instructions and our contractual arrangements with you, e.g. by providing incident management and testing directly related to the provision of the service or by supporting your duties as controller in relation to storage of personal data, compliance with legal and regulatory requirements, audit activities and investigations;
• To evaluate which products, services and events may be of interest to you and how they may be offered to you;
• To ensure personal or anonymous offers on Saxo websites, mobile device applications, Saxo platforms, multimedia portals and social networks and other Saxo products and services that may be of interest to you;
• To contact you for marketing purposes about products and services which we think may be of interest to you and to carry out promotions.

B) For compliance with legal or regulatory obligation (e.g. anti-money laundering and anti-fraud regulations) or acting in the public interest (cf. FADP article 31 (1) / GDPR article 6 (1) (c and e) )

As a licensed bank, we are subject to a number of statutory and regulatory obligations that may require us to collect, store or disclose personal data, record telephone lines or monitor electronic communications, such as for anti-money laundering purposes, sanctions or to respond to investigations or disclosure orders from the police, regulators of our group entities, and tax or other public authorities.

For further details, please refer to your contractual documentation with us.

Compliance and risk management and/or crime prevention, detection and investigation:

• To carry out legal and regulatory compliance checks, in particular as part of the client onboarding process and regular compliance checks, including compliance with anti-money laundering regulations, fraud prevention and the screening of sanctioned countries and to prevent financial crime. This includes KYC profiling based on the processing of your personal data;
• To meet our ongoing obligations under regulatory and compliance obligations (e.g. financial industry regulations and anti-money laundering and tax laws), including in relation to the recording and monitoring of communications, the application of a risk classification to ongoing business relationships, the disclosure of data to tax authorities, financial regulators and other regulatory and governmental bodies and to investigate or prevent criminal offences;
• To receive and process complaints, inquiries or reports from you or third parties;
• To respond to actual or potential proceedings, requests or investigations by competent authorities.

C) On the basis of your consent (cf. FADP article 31 (1) / GDPR article 6 (1) (a) )
If we wish to process your personal data in a way not covered by a legal justifications, we will need your consent. Where you give consent, you are entitled to withdraw it at any time. Note that withdrawing your consent does not render our prior handling of your personal data unlawful, and it might have an impact on our ability to continue to provide our services in the same way in the future. We rely on your consent for the following purposes:

• If you are part of the ‘Preferred Broker Program’, Saxo will share with the employer certain data pertaining to the client’s trading activities on Saxo’s trading platform;
• For providing marketing content;
• For sharing personal data, name, e-mail and phone number, with partners and third-party platforms for marketing purposes;
• For collection of behavioral and statistical data (cookies) from using our websites.


D) Support, improvement and maintenance of the SAXO information architecture:

• To take steps to improve our products and services and the technology we use, including reviewing and updating our systems and processes, and for market research purposes to learn how we improve our existing products and services or what other products and services we offer can;
• To analyze the results of our marketing activities in order to measure their effectiveness and the relevance of our campaigns.

 


E) Other purposes:

• For the prudent operational management of Saxo (including credit and risk management, insurance, auditing, systems and product training and similar administrative purposes);
• For recording of telephone lines and monitoring of electronic communications for training purposes;
• For transmission to prospective buyers, absorbing entities, merger partners or sellers and their advisors in connection with any actual or potential transfer or merger of all or any portion of Saxo's business or assets or any rights or interests related thereto or acquisition of any business or the merger with a company;
• To collect data to ensure security of buildings, employees, visitors and property and information located on or accessible from the premises in order to prevent and, if necessary, investigate unauthorized access to premises;
• To perform transactional and statistical analysis and similar analysis; and to exercise our obligations and/or rights to you or a third party.

 


3.2 Legal basis for processing personal data

Saxo processes your personal data within the framework of the applicable legal provisions. If necessary and depending on the purpose of the processing activity, this can be based on one of the following reasons:

• Necessary to take steps at your request prior to entering into a contract or to fulfill our contractual obligations to you;
• For prudent operational management of Saxo Bank and to comply with our global regulatory obligations;
• To receive and deal with complaints, inquiries or reports from you or any third party made to Saxo Bank;
• Necessary to safeguard Saxo Bank's legitimate interests or those of a third party. (cf. FADP article 31 (1 and 2) (a-f) / GDPR article 6 (1) (f) ) without unduly affecting your interests or fundamental rights and freedoms and only to the extent that such personal data are strictly necessary for the intended purpose. A legitimate interest of Saxo Bank will be considered in particular in the following cases.

 

Data processing is required:

• Business analysis and development of products and services, including optimization of platforms experience and customer service to manage our relationship with you and to not learn more about you as a client, the products and services you use and other products and services you may wish to use;
• For measures to improve our products and services and the technology we use;
• To deliver products and services and ensure a consistently high standard of service across Saxo Bank and to satisfy our clients, employees and other stakeholders;
• For potential clients before finalizing account opening and visitors;
• To evaluate what products, services and events might be of interest to our clients and how they might be offered;
• In certain cases and as requested by you, we have obtained your prior consent (where required by law);

• Required in certain cases for data processing in the public interest;
• To prevent and detect crime, including fraud or financial criminal activity, market abuse, misuse of our products or services, the information security of our IT systems, architectures, networks and building security, including use of recording;
• To respond to actual or potential proceedings, requests or investigations by competent authorities;
• Exercising our legal and constitutional rights and responsibilities, particularly those relating to the freedom to conduct a business and the right to property.

It may be that the collection and processing of personal data is absolutely necessary for the provision of our services and products for you, otherwise we cannot provide them.

If we process data about you that is particularly worthy of protection, we do so because:

• The processing is necessary for the establishment, exercise, evaluate, bringing or defending of legal claims;
• The processing relates to personal data which you have obviously made public;

or

• You have expressly consented to the processing of this information (where permitted by law).

4. How do we protect personal data?

Saxo Bank and the Saxo Group have also implemented appropriate technical and organizational measures to protect your personal data against unauthorized, accidental or unlawful destruction, alteration or disclosure, or unauthorized, accidental or unlawful loss, misuse or access, or any other unlawful processing. All employees who access personal data must comply with internal regulations and procedures for processing personal data in order to protect them and ensure their confidentiality.

5. Who can access personal data and to whom is it passed on?

5.1 Within Saxo Bank

We typically share personal data with the Saxo Group parent company for the purposes set out above, to ensure a consistently high standard of service within the group and to provide products and services to you. Other Saxo Group companies may process your data on behalf of Saxo.

5.2 Outside Saxo Bank

5.2.1 Third Parties

Where necessary to fulfil your instructions to us and for the other purposes outlined above, we may share information about you with a range of recipients including the following: background screening providers, financial institutions, funds, payment recipients, payment and settlement infrastructure providers, exchanges, regulators, public authorities (including tax authorities), other Saxo Group entities and service providers, professional advisers, auditors, insurers and potential purchasers of elements of our business.

We transfer personal data to other financial services and comparable companies in order to conduct business. In particular, when providing products and services to you, to persons acting on our behalf or otherwise involved, including where relevant, we transfer personal data to the following types of companies:

• A party involved in a transaction or assuming any risk under or in connection with the transaction;
• Companies in which you hold an interest in securities, provided that these securities are held by the bank on your behalf;
• Payees, beneficiaries, authorized representatives, intermediaries and correspondent banks (including custodian banks);
• Clearing houses and clearing or settlement systems as well as specialized payment companies or institutions such as e.g. SWIFT;
• Other banks, market counterparties, swap or trade repositories, exchanges;
• Other financial institutions, credit or credit reference agencies;
• Third parties acting as fund administrators and providing wealth management services to you;
• Introducing brokers to whom we provide introductions or recommendations;
• Lawyers, auditors, accountants and insurers who provide us with legal, auditing, accounting or insurance services;

and

• To contact you for marketing purposes about products and services which we think may be of interest to you, including products and services offered by us, Saxo Group companies or our business partners, and to carry out promotions.

We will only disclose information about you as permitted under the contractual terms we have in place with you, the Swiss Data Protection Act and client confidentiality obligations. Saxo do not under any circumstances sell the collected data to third parties.

Please click here to see our categories of recipients of personal data.

5.2.2 Service Providers

We may pass on personal data to external service providers who are contractually bound to confidentiality, e.g. B. IT hardware, software and outsourcing providers, service providers for logistics, shipping, printing and storage of documents, marketing and communication companies, facility service providers, providers of market data services, providers of consulting services and market information systems, providers of transport and travel management and other service providers. When Saxo Bank transfers your data to service providers who process data on behalf of Saxo, we take steps to ensure that they comply with our data security standards so that your personal data is protected. Irrespective of their location, service providers are obliged to comply with a series of technical and organizational security measures.

5.2.3 Authorities or public bodies

In certain cases we have to hand over personal data to authorities, e.g. supervisory authorities, law enforcement authorities or government agencies, courts or parties to proceedings, where disclosure is required by law or other legal provisions, by code of conduct or rules of conduct. If these authorities or bodies require such disclosure or if we need to do this to protect our legitimate interests.

5.2.4 Other Recipients

A disclosure of personal data can be used for:

• Necessary for the establishment, exercise or defense of legal claims of Saxo Bank, its employees or other stakeholders, or to respond to requests from individuals or their representatives;
• Prospective buyers, absorbing entities, merger partners or sellers and their advisers in connection with any actual or potential transfer or merger of all or any portion of Saxo's business or assets, or any rights or interests related thereto, or acquisition of any business or merger with a company, be necessary;
• Authorized Recipients of Notices where required by applicable law or regulation as required by law;
• Other third parties may be possible with your consent.

5.3 Data transfers to other countries

Some of the personal data transmitted within or outside Saxo and the Saxo Group is also processed in other countries. We only transfer your personal data to countries that ensure an adequate level of data protection or, in the absence of such legislation, which guarantee adequate protection on the basis of appropriate measures (e.g. standard data protection clauses approved by the Federal Data Protection and Information Commissioner resp. European Commission or other suitable guarantees, such as Binding Corporate Rules (BCR)). You may request additional information in this regard and obtain a copy of the safeguards put in place by Saxo Bank by contacting the Group Data Protection Officer (DPO) and/or Data Protection Advisor (DPA).

List of countries to which your data may be transferred because Saxo and the Saxo Group operate there or have your data processed there as described above:

• Switzerland, Australia, Brazil, Canada, China (incl. Hong Kong), Denmark, Dubai, European Union, India, Japan, Singapore, South Africa, United Kingdom, USA.

Exchanges as recipients of personal data in relevant markets, if required by regulation or law, see list here. 

6. How long do we store your data?

We only store personal data for as long as is necessary to fulfill the purpose for which it was collected or in accordance with legal, regulatory or internal regulations. To do this, we apply criteria to determine the appropriate periods for storing your personal data, depending on the purpose of the data.

As a rule, this is ten years after the end of the banking relationship, taking into account the statutory limitation periods, during which claims can be asserted against Saxo Bank.

There may be exceptions to this general rule (e.g. to able to deal with actual audits, tax matters or legal claims). If necessary, we will store your data in accordance with the applicable legal and regulatory requirements. In certain cases, Saxo Bank may also store and process personal data, in particular for compliance or risk management purposes, to comply with (other) legal and regulatory requirements or where this is in Saxo Bank's legitimate interests.

In cases where Saxo has collected personal data as part of an account opening application, demo account, webinar, seminar, or other type of event, but the account opening was never started or completed, we will keep the personal data for 90 days. In cases where an account opening application has been submitted, but the client relationship has not yet been established, we will keep the data for 180 days from the submission date of the account application. If you have shown interest within the last 30 days of the noted periods, we will keep the personal data for an additional 30 days. Each time interest is shown within the period, a 30-day extension for data retention will occur.

If you have consented to receive marketing from Saxo and/or consented to Saxo sharing personal data with third parties for the purpose of marketing, we will keep personal data relevant for these purposes until you withdraw the consent given to Saxo.

Due to the requirements of the Financial Markets Authority ("FINMA"), Saxo Bank is also obliged to record the external and internal telephone calls of all employees working in client services as well as the electronic correspondence (e-mail, communication via Bloomberg or Reuters, etc.) and the supporting documents of the connections made by these employees via business phones for two years and make them available to FINMA if necessary. This also affects employees who, according to the risk assessment, are particularly exposed to receiving information relevant to market surveillance.

7. Will we use your data for profiling purposes?

Profiling in the context of this Privacy Notice is the use of an automated process to analyze personal data in order to assess or predict aspect of your behavior. We may use profiling in the following circumstances:

• To help identify potential cases of financial crime;
• To provide you with information on our products and services that seem likely to be of interest.

8. What data protection rights do you have and how can you exercise them?

8.1 Your Rights

Under applicable data protection legislation, you have the following rights.

Subject to certain exceptions and limitations, by the FADP resp. GDPR you have the right to:

• Request information about the personal data that we collect and process from you. This enables you to receive a copy of the personal data we hold about you. We will comply with your request for information to the extent legally possible. In order to process a request, we will typically ask you to verify your identity and/or provide information that will help us better understand your request. If we are unable to accommodate your request, we will explain why.

• Request that this data be corrected if it is inaccurate. This enables you to have incomplete or inaccurate data that we hold about you corrected.

• Request the erasure of your personal data, if we are not allowed or required to store it. This enables you to ask us to delete your personal data where there is no good reason for continuing to process it. This is sometimes referred to as the “right to be forgotten”.
• Request the restriction of processing if you have contested the accuracy of the data stored by the bank and the bank has not yet completed the verification; or if the bank is obliged to delete it, but you object to the deletion. Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your data, such as during the period of time it might take us to respond to a claim by you that the data is inaccurate or that our legitimate interest in processing your data is outweighed by yours.
• Request us to transfer your personal data in a commonly used electronic format. This is known as the right to portability.

• Object to the processing by the Bank where the Bank is only processing the data based on its legitimate interests, in which case we will stop processing unless the legitimate interests prevail or Saxo Bank needs to process the data to exercise its rights.
• Withdraw your consent where Saxo Bank has obtained your consent to process your personal data for a specific purpose. This does not affect the lawfulness of the processing of your personal data before the revocation. If personal data is processed for direct marketing purposes, for example, your right to object extends to direct marketing. If you wish to exercise your right to opt-out of direct marketing, please click "unsubscribe" in any of our emails (if any) to you or contact us.

• In the case of an automated individual decision, require that this be checked by a natural person. You also have the right to express your point of view. Request not to be subject to automated decision making. This enables you to ask us not to make a decision about you based purely on automated processing of your data, which affects your legal position (or has some other significant effect on you). We do not as a rule make decisions of this nature based solely on automated processing and without any human assessment whatsoever. We would specifically notify you if we did.

• In addition, if applicable to you, you have the right to lodge a complaint with the competent data protection supervisory authority.

Read more about how to exercise your rights: https://www.home.saxo/en-ch/legal/privacy-policy/personal-data-requests.

8.2 Exercising Your Rights

To exercise your rights, please contact us using the following link.
https://www.home.saxo/en-ch/legal/privacy-policy/gdpr-report-request-form

If you are a former Saxo employee or applicant. If you are not satisfied with the way Saxo Bank is handling your personal data, please let us know using the link above or by email (address below) and we will look into your concerns.

9. Changes to your personal data

In order to properly keep your personal data up to date and accurate, we will periodically ask you to review and confirm your personal data and/or to promptly notify us of any changes to your personal data.

10. Are you under an obligation to provide us with your personal data?

You are not required by law to provide us with personal data. However, if you refuse to do so we may not be able to continue the collaboration with you. For example, we are required by the anti-money laundering legislation to verify your identity. This inevitably requires us to collect certain personal data from you as a client.

11. Company name – Who is legally responsible for the safeguarding of your personal data ?

Saxo Bank (Switzerland) Ltd
The Circle 38
P.O. Box
8058 Zurich

Switzerland

If you have any questions or comments about this data protection notice, please contact the data protection department (Data Protection Compliance) at:

Federal Act On Data Protection («FADP»)
Saxo Bank (Switzerland) Ltd
The Circle 38
P.O. Box
8058 Zurich
Attn: Data Protection Compliance
privacy@saxobank.com

12. Representatives in the European Union

In accordance with Article 27 GDPR, Saxo Bank has appointed the following body as data protection representative in the EU.

European General Data Protection Regulation (“GDPR”)
Saxo Bank A/S (Headquarters)
Philip Heymans Alle 15
2900 Hellerup
Denmark
Attn: Data Protection Officer Saxo Bank Group («DPO»)
privacy@saxobank.com

13. Queries or complaints

Should you have queries or complaints about the way in which we process your personal data, please see your options here: Saxo Switzerland Support.

You can also contact Saxo’s Data Protection Department in Switzerland (FADP) or in the EU (GDPR) via the contact details above.

13.1 Complaint to the authorities

If you wish to lodge a complaint about the processing of personal data by Saxo Bank, please contact the competent Swiss authority.

14. Status of this data protection notice

We reserve the right to change this Privacy Notice from time to time to make clarifications, address changes in the FADP or GDPR or address changes to our business operations. Any changes or updates to this notice will be made available to you here. Please visit the Saxo website regularly to familiarize yourself with our Privacy Notice.

This Privacy Notice was last updated in January 2025.