Uptevia attaches great importance to the protection of your personal data. This Notice aims to inform you about the personal data we collect about you, the reasons why we use and share it, how long we keep it, what your rights are (regarding the control and management of your data) and how you can exercise them.
Our personal data processing activities are subject to the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) and/or any other applicable data protection legislation.
As part of our activities, which notably include services related to capital markets and securities, we assist all our corporate Clients and Investors in their share registry management and general meeting services.
In this context, Uptevia may process your personal data either as an independent Data Controller, as a joint Data Controller, or as a Processor acting on behalf of its clients.
This notice may be clarified or supplemented, where appropriate, by other policies and procedures (such as personal data protection appendices, general terms and conditions of use, notices/posters on Uptevia’s premises), in particular in order to comply with applicable legal obligations.
You may request a copy of this notice by writing to the following address: dpo@uptevia.com
- DEFINITIONS
- Personal data: any information relating to an identified or identifiable natural person;
- Processing: any operation (or set of operations) performed on personal data, such as the collection, organisation, storage, modification, use, transmission, dissemination or erasure of personal data;
- Purpose: the objective for which personal data processing is carried out. In the context of this Charter, the purposes of personal data processing are set out in paragraph 3 below;
- Recipient: any natural or legal person, any public authority, any service or any other body to whom personal data is disclosed;
- Data Controller: the entity that defines the purpose of personal data processing and the means implemented to carry out such processing.
- TO WHOME DOES THIS NOTICE APPLY?
You are concerned by this Notice if you are (“You”):
- An employee, consultant, contractor, service provider, legal representative or beneficial owner:
- Of an Issuer client;
- Of a prospective client;
- Of a client or a counterparty of our clients; or
- A shareholder or an investor of our clients, in particular issuers of securities.
- FROM WHOM DO WE COLLECT PERSONAL DATA?
- We collect data directly from you
- And/or indirectly from the issuer or the service provider for whom you work or whom you represent, in the context of a service or partnership agreement we have entered into with them.
In certain circumstances, we collect information about you even if we do not have a direct relationship with you.
This may be the case, for example, for shareholders or investors in the context of our relationships with our clients or our counterparties.
When you provide us with personal data relating to other persons, please remember to inform them that their data has been shared and invite them to read this Notice, which provides useful information about their rights.
We also collect personal data from:
- Other entities of the BNP Paribas SA ans CACEIS SA Groups;
- Our business partners or the business partners of our clients;
- Service providers (for example, payment initiation service providers and account information service providers such as account aggregators).
- WHAT PERSONAL DATA CONCERNING YOU DO WE USE?
We collect and use your personal data, meaning any information that identifies you or makes it possible to identify you, that is necessary for Uptevia to carry out its duties.
Depending in particular on the person concerned by the processing, we collect different types of personal data about you, including:
- For Issuer Clients / Prospective Clients:
Identification Data (e.g. first name, last name, email address, telephone number, date and place of birth, gender, professional photograph);
Professional contact details (e.g. postal address, business telephone number, business email);
Data relating to education and employment (e.g. position held);
Data collected during our interactions with you (e.g. meeting minutes).
- For shareholders or investors of our clients, in particular issuers of securities:
Identification data (e.g. first name, last name, personal or professional email address, personal or professional telephone number, tax address, postal address, nationality, date and place of birth, gender);
Contractual data (e.g. reference / identifier);
Professional information (e.g. employee reference, HR contact, remuneration data);
Family-related information (e.g. closely related persons);
Economic and financial information (e.g. bank account details, data relating to the financing of the subscription (where financed by arbitrage/release of employee savings), data relating to early release transactions of employee savings (e.g. amount requested, nature of the early release case, dates and characteristics of the event giving rise to the early release); where applicable, data relating to supporting documents provided in connection with a request for early release (e.g. certificates, administrative documents, documents relating to family or personal events, which may include data belonging to special categories of data, in particular health data));
Login data (e.g. login details used to access Uptevia applications, IP address);
Data relating to transfers and estates (e.g. dismemberment of ownership, date of death, beneficiaries, share of beneficiaries, etc.).
As part of our regulatory obligations, we may collect the following special categories of personal data (“sensitive data”), only where required by law:
- Politically Exposed Person (PEP) status;
- National Identification Number (in the context of employee saving schemes);
- Information on significant religious roles ;
- People subject to monitoring (e.g. insiders, persons suspected of terrorist activity);
- Health data (only where necessary for processing requests for early release of employee savings and based on your consent).
NB : Please note that you are not obliged to provide the requested personal data. However, if you do not provide it, we may be unable to offer you our services.
- WHY AND ON WHAT LEGAL BASIS DO WE USE YOUR PERSONAL DATA?
The purpose of this section is to explain why we process your personal data and on what legal basis we rely on to justify such processing.
- Your personal data is processed to enable us to comply with our various legal obligations
Your personal data is processed where this is necessary to allow us to comply with the regulations to which we are subject, in particular banking and financial regulations.
We use your personal data to:
- Monitor operations and transactions in order to manage, prevent and detect fraud;
- Monitor and report on risks (financial, credit, legal, compliance, reputational, operational, etc.) to which we may be exposed;
- Record, in accordance with the Markets in Financial Instruments Directive (MiFID II) and the Market Abuse Regulation, communications in any form (including telephone conversations, emails, instant messaging discussions) relating at least to the provision of services connected with orders, in particular their receipt, transmission, execution and recording;
- Share, in accordance with the Shareholders’ Rights Directive (SRD II), your personal data with issuers, including information allowing your identification as a shareholder, your proxy votes and your register number;
Contribute to the fight against tax fraud and fulfil our tax reporting and monitoring obligations, including under the US Foreign Account Tax Compliance Act (FATCA) and automatic exchange of information regimes;
- Fulfil our obligations to report and record transactions with the competent authorities (tax, judicial, criminal, etc.);
- Record transactions for accounting purposes;
- Detect and prevent corruption;
- Exchange and report various operations, transactions or requests, or respond to an official request from a duly authorised local or foreign judicial, criminal, administrative, tax or financial authority, an arbitrator or mediator, law enforcement authorities, governmental bodies or public agencies.
In the context of managing employee savings schemes and requests for early release of employee savings, certain data and supporting documents may also be processed in order to comply with legal or regulatory obligations relating to employee savings, in accordance with the applicable provisions and on the basis of your explicit consent (Article 9(2)(a) GDPR), which you may withdraw at any time.
- We also process your personal data to combat money laundering and terrorist financing
We are required to have a robust anti‑money laundering and counter‑terrorist financing (AML/CTF) framework. This may involve processing your personal data mainly as part of our Know Your Customer (KYC) procedures, to identify you, verify your identity and check your information against sanctions lists before and during the provision of our services.
The processing operations carried out to meet these legal obligations are set out in Appendix A.
5.3 Your personal data is processed for the performance of a contract to which you are a party, for pre‑contractual measures taken at your request, or for the purposes of setting up the services
Your personal data is used where it is necessary for the conclusion or performance of a contract to provide our Clients with the subscribed products and services in accordance with the applicable contract.
5.4 Your personal data is processed to pursue our legitimate interests or those of a third party
Where we rely on legitimate interest as a legal basis for processing, we balance this interest against your own interests or your fundamental rights and freedoms to ensure that a fair equilibrium is maintained.
As part of our activities, we use your personal data for the following legitimate purposes:
- Managing your access to and use of our communication channels and applications in the context of our contractual and pre‑contractual relationships with our clients and shareholders;
- Communicating with you in connection with services provided to our clients and/or their counterparties;
- Managing the risks to which we are exposed:
- Keeping records and, in some cases, recording operations, transactions and communications when you interact with our employees (for example in our discussion forums, by email or during videoconferences);
- Monitoring transactions to manage, prevent and detect fraud and, where required by law, establishing a fraud list (containing the names of fraudsters);
- Managing legal actions and defending our position in the event of disputes.
- Enhancing cybersecurity and data‑loss prevention measures, managing our platforms and websites, and ensuring business continuity;
- Monitoring access to property and preventing bodily harm and damage to persons and property through video surveillance;
- Complying with applicable provisions for trust service providers issuing electronic signature certificates;
- Performing our asset servicing activities whenever you are an indirect beneficiary of these services, including for the following purposes:
- Creating and maintaining your shareholder or investor register;
- Receiving, inputting and processing voting instructions from your shareholders;
- Providing tax services on your behalf (reduced withholding tax, tax reclaims);
- Safekeeping your physical securities;
- Managing your access to and use of our internet‑based communication channels and applications.
- Conducting statistical studies and developing predictive and descriptive models for:
- Security purposes: to prevent potential incidents and improve security management;
- Compliance and risk management (such as anti‑money laundering and counter‑terrorist financing);
- Anti‑fraud purposes.
- COOKIES AND BROWSING DATA
When you use our digital services, we may use your browsing data in accordance with our Cookie Policy.
Cookies are small text, image or software files that can be placed and/or read on your device when you access our website and/or the Application. The term “device” refers to computers, smartphones, tablets and any other device used to access the internet.
As part of our activities, we only use cookies known as strictly necessary cookies. These cookies are essential to ensure the proper functioning of the Website/Application. They may include, for example, cookies that collect session identifiers and identification data, cookies that enable the interface of a Website and/or an Application to be personalised (for example, for language selection or the layout of a service), or certain audience‑measurement cookies. This category also includes cookies that enable us to comply with our legal obligations, in particular by ensuring a secure online environment (for example, by detecting repeated failed login attempts in order to prevent unauthorised persons from accessing your account).
- WITH WHOM DO WE SHARE YOUR PERSONAL DATA AND WHY?
- With our Issuer Clients
As agent of our Issuer Clients, we share your personal data with the Issuer Clients in which you are a shareholder or investor.
- With entities of the BNP Paribas and CACEIS Groups
As a company belonging to the BNP Paribas and CACEIS Groups, we work closely with these entities. Your personal data may therefore be shared within the BNP Paribas and CACEIS Groups where necessary in order to:
- Comply with our various legal and regulatory obligations described above, in particular reporting obligations;
- Fulfil our contractual obligations or pursue our legitimate interests as described above;
- Carry out statistical studies and develop predictive and descriptive models for security, compliance, risk management and anti‑fraud purposes.
Data sharing with Group companies may extend to intra‑group processors that carry out services on our behalf.
7.3 With recipients outside Uptevia and its processors
In order to achieve some of the purposes described in this Notice, we may, where necessary, share your personal data with processors that provide services on our behalf (for example IT services, logistics, printing services, telecommunications, debt collection, advisory, distribution and marketing services).
Where we consider it necessary, we may also share your personal data with other data controllers, such as:
- Our service providers and processors that supply products and services on our behalf (for example IT service providers, cloud service providers, database providers);
- Banking and business partners, independent agents, intermediaries or brokers, financial institutions, counterparties, central repositories with which we have relationships, where such transfer is necessary to provide you with services or products, to meet our contractual or legal obligations or to process transactions (for example banks, correspondent banks, custodians, issuers of securities, paying agents, trading platforms, insurance companies, payment system operators, payment card issuers or intermediaries, mutual guarantee companies or financial guarantee bodies);
- Regulators and/or independent agencies, financial, tax, administrative, criminal or judicial authorities, whether local or foreign, arbitrators or mediators, authorities or public institutions or bodies (such as Banque de France and other central banks), to whom we are required to disclose data: at their request;
- In connection with our defence, an action or legal proceedings;
- In order to comply with a regulation or recommendation issued by a competent authority in relation to us;
- Third‑party service providers or payment service providers (information concerning your bank accounts) for the provision of a payment initiation or account information service at your request;
- Certain regulated professions, such as lawyers, notaries or statutory auditors, particularly where specific circumstances require it (disputes, audits, etc.), as well as our insurers or any current or potential purchaser of Uptevia’s companies or businesses.
- INTERNATIONAL TRANSFERS OF PERSONAL DATA
In certain circumstances (for example, to provide international services or for operational efficiency), your data may be transferred to another country.
In the case of international transfers from:
- The European Economic Area (EEA) to a country outside the EEA, the transfer of your personal data may take place on the basis of a decision by the European Commission recognising that the country to which your data is transferred ensures an adequate level of protection;
- Other countries for which international transfers are subject to restrictions, we will implement appropriate safeguards to ensure the protection of your personal data.
For other transfers, we will implement an appropriate safeguard to ensure the protection of your personal data, namely:
- Standard contractual clauses approved by the European Commission; or
- Binding corporate rules.
In the absence of an adequacy decision or appropriate safeguards, we may rely on a derogation applicable to the specific situation (for example, where the transfer is necessary for the establishment, exercise or defence of legal claims).
You may obtain further information on the framework for our international transfers by sending a written request toà dpo@uptevia.com.
- HOW LONG DO WE KEEP YOUR PERSONAL DATA ?
We keep your personal data for the longer of the following periods:
- The period required under applicable law;
- The period defined in light of our operational constraints, such as proper account-keeping, effective client relationship management, and the exercise of legal rights or responses to requests from authorities and regulators.
Telephone recordings are kept for 5 years from the date of their collection.
Most of the personal data collected in relation to a client is kept for the duration of the contractual relationship with that client and for a specified number of years thereafter, or in accordance with applicable law.
For further information on the retention period of your personal data or on the criteria used to determine this period, you may contact us at the address indicated in paragraph 10.1 (“How to contact us”) below.
- WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?
In accordance with applicable personal data protection legislation, you have rights that allow you to exercise significant control over your personal data and how we use it.
10.1 How to contact us ?
If you wish to exercise the rights summarised below, or if you have any questions regarding our use of your personal data under this Notice, please contact us at dpo@uptevia.com
Depending on our role in relation to the processing of your personal data (“Data Controller”, “Joint Data Controller”, “Processor”), we will respond directly to all your requests within the time limits set by the regulations.
10.2 You may request access to your personal data
Upon request, where we act as Data Controller or Joint Data Controller, we will provide you with a copy of your personal data as soon as possible, together with information relating to its use.
Your right of access to your personal data may, in certain cases, be restricted by applicable laws and/or regulations. For example, regulations relating to anti‑money laundering and counter‑terrorist financing prevent us from giving you direct access to your personal data processed for this purpose. In such cases, you must exercise your right of access through the CNIL, which may then ask us to provide it with the relevant data.
10.3 You may request the rectification of your personal data
If you consider that your personal data is inaccurate or incomplete, you may request that it be amended or completed. In certain cases, you may be asked to provide supporting documentation.
10.4 You may request the deletion of your personal data
If you wish, you may request the deletion of your personal data, within the limits permitted by law.
10.5 You may object to the processing of your personal data based on legitimate interest
If you do not agree with processing based on legitimate interest, you may object to such processing on grounds relating to your particular situation, by specifying the processing concerned and the reasons for your objection. We will then no longer process your personal data unless there are compelling legitimate grounds for doing so, or the data is necessary for the establishment, exercise or defence of legal claims.
10.6 You may request the restriction of the use of your personal data
If you contest the accuracy of the data we use or if you object to the processing of your data, we will carry out a verification or review of your request. During the time taken to examine your request, you may ask us to suspend the use of your data.
10.7 You may withdraw your consent
If you have given your consent to the processing of your personal data, you may withdraw this consent at any time.
10.8 You may request the portability of some of your personal data
You may request a copy of the personal data you have provided to us in a structured, commonly used and machine‑readable format. Where technically feasible, you may ask us to transfer this copy to a third party.
10.9 You may file a complaint with the Personal Data Protection Authority
In addition to the rights mentioned above, you may file a complaint with the Commission nationale de l’informatique et des libertés (CNIL) at the following address:
3 Place de Fontenoy
TSA 80715
75334 PARIS CEDEX 07
FRANCE
Tel: +33 (0)153732222
Website: www.cnil.fr
Appendix A
Processing of personal data to combat money laundering and terrorist financing
We belong to the BNP Paribas and CACEIS banking Groups, which must have a robust anti‑money laundering and counter‑terrorist financing (AML/CTF) system in place at entity level, centrally managed, together with an anti‑corruption framework and a system ensuring compliance with international Sanctions (meaning all economic or trade sanctions, including any laws, regulations, restrictive measures, embargoes or asset‑freezing measures enacted, administered, imposed or enforced by the French Republic, the European Union, the US Department of the Treasury’s Office of Foreign Assets Control, and any competent authority in the territory where we are established).
In the context of this processing, we act as Data Controllers.
For AML/CTF purposes and compliance with international Sanctions, we implement the following processing operations to meet our legal obligations:
- A Know Your Customer (KYC) framework reasonably designed to identify, update and confirm the identity of our clients, including, where applicable, their beneficial owners and authorised representatives;
- Enhanced identification and verification measures for high‑risk clients, Politically Exposed Persons (“PEPs”, i.e. persons designated by regulation who, due to their functions or position – political, judicial or administrative – are more exposed to these risks) and other high‑risk situations;
- Written policies and procedures, as well as controls reasonably designed to ensure that the company does not enter into – and does not maintain – relationships with shell banks;
- A policy, based on its assessment of risks and the economic situation, under which it generally does not carry out or engage in any activity or business relationship, regardless of the currency:
- for, on behalf of, or for the benefit of any person, entity or organisation subject to Sanctions by the French Republic, the European Union, the United States, the United Nations or, in certain cases, other local sanctions in the territories in which the Group operates;
- involving, directly or indirectly, territories subject to sanctions, including Crimea/Sevastopol, Cuba, Iran, North Korea or Syria; or involving financial institutions or territories which may be linked to, or controlled by, terrorist organisations recognised as such by the competent authorities in France, within the European Union, the United States or the UN.
- Screening of our client databases and transactions, reasonably designed to ensure compliance with applicable laws;
- Systems and processes aimed at detecting suspicious transactions and making suspicious activity reports to the relevant authorities;
A compliance programme reasonably designed to prevent and detect corruption and influence‑peddling in accordance with the “Sapin II” law, the U.S. FCPA and the UK Bribery Act.
In this context, we may rely :
- on services provided by external providers who maintain updated lists of Politically Exposed Persons (PEPs);
- on publicly available information in the press on facts linked to money laundering, terrorist financing or corruption;ons publiques disponibles dans la presse sur des faits en lien avec le blanchiment d’argent, le financement du terrorisme ou des faits de corruption ;
- on knowledge of risky behaviour or situations (the existence of suspicious activity reports or equivalent) that may be identified at Uptevia level.
We carry out these checks when entering into a relationship with you and throughout the relationship, both on you and on the transactions you carry out. At the end of the relationship, if you have been subject to an alert, this information will be retained so that we can identify you and adapt our controls if you enter into a new relationship with Uptevia or in connection with a transaction to which you are a party.
To meet our legal obligations, we exchange information collected for AML/CTF, anti‑corruption and Sanctions‑compliance purposes between entities of the BNP Paribas SA and CACEIS Groups. Where your data is exchanged with countries outside the European Economic Area that do not provide an adequate level of protection, such transfers are governed by the European Commission’s standard contractual clauses. Where, in order to comply with regulations in non‑EU countries, additional data is collected and exchanged, this processing is necessary to enable the BNP Paribas and CACEIS Groups and their entities both to comply with their legal obligations and to avoid local sanctions, which constitutes our legitimate interest.
For the purposes of data sharing in the fight against money laundering and terrorist financing, entities of the BNP Paribas and CACEIS Groups have organised the sharing of personal data of natural persons linked to Uptevia’s corporate clients. When data is exchanged with another entity, we act as joint controllers together with that entity.
