GDPR Privacy and Cookie Notice
GDPR Privacy Notice
At State Street Global Advisors (“SSGA”) we are committed to handling your Personal Data (defined below) responsibly and would like to let you know that we recognise and respect your right to privacy. This notice explains how SSGA and any fund or product sponsored, managed, or otherwise affiliated with SSGA (the “Funds”) (together “we”, “our”, “us”) collect, use, share or otherwise process Personal Data in connection with your relationship with us. For a list of the SSGA entities and Funds acting as a controller for the purposes of GDPR, please see annex I.
We may provide supplemental notices from time to time, for example where we collect or use your sensitive personal data, which should be read together with this notice. We will publish the current notice on our websites (the “Sites”) which will apply each time you share Personal Data with us. We reserve the right to amend or update this notice at any time.
How we collect your Personal Data
We may collect your contact details (such as your address, email address and telephone number) or other information (such as your job title, identifying information required for anti-money laundering and related matters, your IP address, and information regarding the computer or mobile device ("Electronic Device") used to access our Sites, such as its operating system, unique identifier, and model name, as well as its user configurations and settings etc.) from which you can be identified (“Personal Data”). We may collect and use, for example, details you provide:
i. by filling in online/application/dealing forms,
ii. during our onboarding process;i
ii. during telephone calls or meetings with us or our representatives/agents,
iv. when you register to use or use our Services (including via our Sites),
v. when registering or subscribing to our newsletters or conferences,
vi. when asking us to authenticate you as an authorised user and to facilitate communications between us that you request,
vii. by completing surveys issued by SSGA (we will process information provided by you for research and monitoring purposes).
We may combine the information that we collect with personal or other information that we obtain from third parties (such as social media networks or marketing partners) or that we collect from you in other contexts (such as when you email us, call us, or attend one of our events). If the information collected is about you or relates to you, or is combined with such information, we will treat it as Personal Data.
Any Personal Data which you provide to us or our agents is at your sole discretion. However, we may not be able to engage with you (fully or at all) if you do not provide requested Personal Data. Please do let us know if your Personal Data changes during our relationship. Please note that if your Personal Data is anonymised, it is no longer Personal Data.
Basis of and Use of Personal Data
In order to effectively manage our relationship with you, we will collect, use, process, or arrange processing of this Personal Data if and to the extent that we have a lawful basis to do so; that is:
i. you have consented;
ii. we need to do so in order to perform the contract we have entered into with you/in relation to your investment in our Fund or the provision of State Street services as well as to effect administrative or operational processes by SSGA, our Funds or their service providers (“Services”);
iii. if we need to do so in order to comply with an EU legal or regulatory obligation; or
iv. if we (or a third party) have a legitimate interest which is not overridden by your interests or fundamental rights and freedoms. Such legitimate interests may include direct marketing by State Street entities or our regulatory obligation as a global financial institution. You have the right to unsubscribe from such direct marketing. See the section below entitled "Marketing Communications and Your Choices".
We will also use your Personal Data and the Funds and their service providers (or any of their affiliates, agents, employees, delegates or sub-contractors) will use your Personal Data to:
i. provide Services to you and/or the institution that you act for;
ii. to facilitate the opening of your account, the management and administration of your holdings and/or your holdings in a Fund and any related account on an on-going basis;
iii. carry out anti-money laundering checks and related actions;
iv. carry out fitness and probity checks and related actions;
v. to report tax related information to tax authorities in order to comply with a legal obligation;
vi. to monitor and record calls and electronic communications for (a) processing and verification of instructions, (b) investigation and fraud prevention purposes, (c) for crime detection, prevention, investigation and prosecution, (d) to enforce or defend SSGA, the Funds and their affiliates', directly or through third parties to whom they delegate such responsibilities or rights in order to comply with any applicable legal obligation, (e) for quality, business analysis, training and related purposes (f) to pursue our legitimate interests in relation to such matters or (g) where the processing is in the public interest;
vii. to update and maintain records and fee calculations;
viii. enhance or personalise your online experience;
ix. authenticate you as an authorised user and to facilitate communications between us that you request;
x. fulfil your requests, including sending you white papers, newsletters and other supplements;
xi. contact you for marketing purposes in-line with the applicable laws (see the section below entitled "Marketing Communications and Your Choices");
xii. operate our business in a prudent manner in accordance with industry standards and applicable law, which may include, in addition to supporting the Services; responding to inquiries and requests; preventing fraud; and monitoring and archiving communications;
xiii. to take advice from our advisors;
xiv. for governance and management reporting purposes.
We may use or disclose your Personal Data if we are required to do so by law or if we reasonably believe that we need to do so to protect our rights or to comply with a judicial or regulatory requirement or to pursue our legitimate interests. If we need to use your Personal Data for a reason which is not reasonably compatible with the original purpose, we will notify you and explain the basis on which we are permitted to so use your Personal Data.
Marketing Communications and Your Choices
SSGA uses information collected to market business services to our institutional customers. Specifically, we may collect, use, and/or share your information with our affiliates and service providers in order to provide specific information that you request, thought leadership materials, industry information, invitations to events and webinars, and other communications or solicitations that we believe will be of interest to you. We target and tailor such communications based on your interaction with us such as on our Sites and with our emails; your inquiries; your participation in events or webinars; relevant social media activity; and other third-party data. If you do not wish to receive this information from us, please manage your preferences accordingly. You can also unsubscribe by clicking on the unsubscribe link in any of our emails or by letting your SSGA contact know.
How we may share Personal Data
We may disclose or share Personal Data:
i. to our affiliates for various purposes, as permitted by law, including in order for its affiliates to provide services;
ii. with government agencies, exchanges, or other self-regulatory organisations and law enforcement authorities as required or permitted by law, rule, regulation or legal process, including, without limitation, for governmental reporting or to enforce any rights SSGA may have against you as necessary. Personal Data about you that is collected on our Sites, or in the course of the provision of Services, including any of your financial information, can become subject to the legal systems and laws in force in each state or country (a) where it is held, received or stored by you or us, (b) from where it is accessed by you or us, or (c) through which it passes. In addition, if you have an account at SSGA, because your account(s) may include information about more than one individual and about your business relations with SSGA and its affiliates, statements released to comply with legal process may contain information regarding your relationship with these individuals and with us and our affiliates.
iii. at the request of a regulatory agency or in connection with an examination of us by bank or other examiners;
iv. at the request of our internal or external auditors or attorneys;
v. when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss in connection with an investigation of suspected or actual illegal activity,
vi. if disclosure is necessary to protect the vital interests of a person;
vii. to non-affiliated third parties with whom we have contracted to perform services on its behalf. We require our third-party servicers to agree to comply with appropriate privacy and security standards or to undertake to provide similar and appropriate levels of protection as we do when processing Personal Data.
viii. with a successor entity in the event of a merger, acquisition or similar transaction.
How we Transfer and Store Personal Data
SSGA is a global organisation and part of the global State Street group; Personal Data we collect may be transferred internationally throughout the world to countries where State Street does business, which may not have the same data protection laws as the country in which you reside. We have relevant legal safeguards, internal policies and procedures in place in an effort to achieve an equivalent level of protection across our organisation. To find out more about the safeguards that SSGA has in place please contact Jill Stoller (Chief Privacy Officer) at JStoller@StateStreet.com. The transfer of Personal Data to other countries is based on a business need or to comply with applicable laws. Personal Data stored or processed in a foreign jurisdiction may be accessed under a lawful order made in that jurisdiction.
By providing your information to SSGA in the course of your access and use of our Sites or the Services, you agree that your Personal Data, for the purposes explained in this privacy notice, may be transferred to and stored in other countries where SSGA does business, which may not have the same data protection laws as the country in which you reside.
How we protect your Personal Data
We use security measures, in compliance with applicable law, to protect Personal Data from unauthorised access or use. Yet you should understand that the open nature of the Internet is such that information and Personal Data may flow, without security measures, over networks connecting you to our systems and may be accessed and used by people other than those for whom the data is intended.
To safeguard against unauthorised access to Personal Data by third parties, all electronic Personal Data held by SSGA is maintained on systems protected by secure network architectures that contain firewalls and intrusion detection devices. The servers holding Personal Data are "backed up" (i.e., recorded) on a regular basis in an effort to avoid any inadvertent erasure or destruction of such Personal Data and are stored in facilities with appropriate security and fire detection and response system.
When you contact SSGA with questions about our Sites or the Services, we must confirm your identity on the phone before discussing your information. The questions and answers you select when logging into our Sites for the first time are used for this identification process.
Our Sites may, from time to time, contain links to and from the sites of third parties. If you follow a link to any of these sites, please note that these sites have their own privacy notices or practices and that we do not accept any responsibility or liability for these notices, practices or sites. Please check these policies before you submit any Personal Data to these sites.
We will retain your Personal Data for as long as required and for as long as necessary to provide our Services, products and information or as permitted / required by applicable law. This period may extend beyond the termination of our relationship with you.
Any person who has sent us Personal Data has the right to:
- Be informed about the Personal Data
- Access to the Personal Data
- Rectification of Personal Data, where it is inaccurate or incomplete
- Erasure of Personal Data in certain circumstances (for example, where the Personal Data is no longer necessary in relation to the purposes for which it was collated).
- Obtain restriction of processing in certain circumstances (for example, where the accuracy of the Personal Data is contested, for the period enabling State Street to verify the accuracy of that Personal Data)
- Object to the processing of the Personal Data
- Receive Personal Data in a structure, commonly used and machine-readable format, and to have that Personal Data transmitted directly to another data controller (data portability)
- Lodge a complaint to the relevant local data protection authority
In the interests of security, we may request specific information from you to help us confirm your identity when you are exercising your rights.
If you have provided your consent to the collection, processing and transfer of your Personal Data, you have the right to fully or partly withdraw your consent. If you choose to withdraw your consent, we will no longer process your Personal Data for the purpose(s) to which you originally consented unless there are compelling legitimate grounds for further processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. You may also unsubscribe from any direct marketing at any time.
You will not generally have to pay a fee in relation to the exercise of the above rights but please note that a reasonable fee may be levied on excessive or manifestly unfounded requests or in such cases, we may refuse to comply with such excessive or unreasonable requests.
How to Contact Us
If you have questions or comments about this privacy notice, or about how your data is processed, please contact: Jill Stoller (Chief Privacy Officer) at JStoller@StateStreet.com
Last updated: 25 May 2018