Privacy / Confidentiality / Complaints and Other Obligations of the Contracting Parties

Principles

With the following privacy notice, we aim to provide you with an overview of how personal data maintained by our investment firm is processed, as well as the rights arising therefrom under the EU General Data Protection Regulation (GDPR) and the Liechtenstein Data Protection Act (DSG). The type and scope of personal data processed, and the manner in which it is used, depend primarily on the services and products agreed upon in each case. The investment firm is legally obliged to protect your privacy and confidentiality. For this reason, we implement a wide range of technical and organizational data protection measures for all personal data processing activities.

• Contracts between the investment firm and its clients may contain more detailed provisions on the processing of such personal data, including requirements for which data are to be made available under the contract and how that data may be processed. 

• Regardless of the contractual provisions, both parties ensure full compliance with applicable data protection regulations during the performance of their contractual obligations. The processing of personal data takes place in accordance with the applicable data protection laws of Liechtenstein, including Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

• The contracting parties are aware of their rights and obligations under the relevant data protection laws.

Confidentiality

Confidential information may only be disclosed if required by law or by order of a public authority, or with the express consent of the other party. If disclosure is required, the disclosing party must inform the other party immediately—where legally permissible—once a request for information from an authority is received or any other sovereign measures are imposed. 

Each party ensures that its employees and any third parties acting on its behalf are bound to a comparable confidentiality obligation.

This confidentiality obligation shall remain in effect for five years following the termination of this agreement.

The confidentiality obligation does not apply to information that:

• Is publicly accessible, was already known to the parties, or was later made public by the disclosing party,
• Has been lawfully received or is received from a third party not subject to a confidentiality obligation to the other party,
• Was already publicly known at the time of signing or later became known without violating the obligations of this agreement,
• Was already known to the receiving party at the time of transmission and was not directly or indirectly provided by the other party.

Collection of Personal Data

Reuss Private Access AG collects and processes personal data that we receive as part of our business relationship with our clients. Personal data may be processed at any stage of the business relationship and may vary depending on the individual or client group.

Personal data includes, in particular, the following categories:

Basic identification data

• Personal details (e.g. name, date of birth, nationality)
  • Address and contact information (e.g. physical address, telephone number, email address)
  • Identification and authentication data (e.g. passport or ID card data, signature samples)
  • Data from publicly available sources (e.g. tax identification numbers)

Extended background data

• Information on services and products used (e.g. investment experience and profile, advisory documentation, data relating to executed transactions)
  • Information on household composition and relationships (e.g. spouse or partner details, family information, authorized signatories, legal representatives)
  • Financial characteristics and situation (e.g. portfolio and account numbers, origin of wealth)
  • Professional and personal background (e.g. occupation, hobbies, preferences, goals)
  • Technical data and information relating to electronic communication with the investment firm (e.g. access logs or change history)
  • Audio and visual recordings (e.g. telephone or video recordings)

Processing of Personal Data

In principle, we process personal data that you provide to us through submitted contracts, forms, correspondence, or other documents. Where necessary for the provision of services, we may also process personal data arising from the use of products or services, data transmitted to us by third parties (e.g. fiduciary service providers), or data we lawfully obtain from public authorities (e.g. UN or EU sanctions lists). Personal data may also be obtained from publicly accessible sources, such as commercial or association registers, the press, or the internet.

In addition to client data, we may also process personal data of other individuals involved in the business relationship—for example, authorized representatives, legal successors, or beneficial owners. We kindly ask you to inform such third parties of the contents of this privacy notice.

Access to your data may be granted to entities both within and outside of the investment firm. Internally, only those departments or employees who require the data to fulfil our contractual, legal, or regulatory obligations — or to protect legitimate interests — will have access. Subject to compliance with relevant laws, other companies, service providers, or agents may also receive personal data for these purposes.

Such processors may include companies in the areas of: - Asset management services - Distribution agreements - IT services - Logistics - Print services - Consulting - Sales and marketing

it is required for the provision of services or processing of instructions (e.g. execution of securities transactions),

• you have given your consent (e.g. for client support by another entity),

• it is necessary for important reasons of public interest, or

• it is legally required (e.g. for transaction reporting obligations).

• Such transfers are only made to countries that the European Commission has deemed to have an adequate level of data protection. Where this is not the case, we implement measures to ensure adequate protection of your data, including the use of Standard Contractual Clauses (SCCs), which are available upon request.

• We process and store personal data for the duration of the business relationship, unless shorter mandatory retention periods apply. Please note that business relationships are often designed to last for several years. The duration of storage is determined by the necessity and purpose of the specific data processing. Once data is no longer required for the fulfilment of contractual or legal obligations—or to safeguard legitimate interests—it is regularly deleted, unless its continued processing is required to comply with statutory retention periods or to preserve evidence within the scope of applicable limitation periods. Under the Asset Management Act, the general retention period is five years, and may be extended to seven years upon request by the Liechtenstein Financial Market Authority (FMA). According to the Due Diligence Act, data must be retained for ten years.

Last updated: 23 September 2024

Disclaimer: This English version is a non-binding translation of the original German text. It is provided for convenience only. In the event of any discrepancies or legal interpretation, only the German version shall be legally binding and authoritative.