General Privacy Policy of Baloise Bank Ltd

Depending on the products selected and services provided by the bank, we may process the categories of data described below, although the list provided in this document is not exhaustive.

In the event of changes to data over time (e.g. due to a change of address, a change in civil status or another modification), we will modify the data accordingly. The previous data will be stored if necessary in the context of the statutory retention periods and will then be erased.

Master data includes, in particular, contact information (e.g. name, address, telephone number and email address), personal details (e.g. date of birth, age, gender, nationality, residence permit status, data from identification documents, family details, occupation, education and training, employer), other identification data (e.g. AHV number, customer number, tax identification number), information from databases (e.g. World-Check) or information about your relationship with us (e.g. partner/customer status, customer history). Account details are also collected, including bank account details (e.g. account numbers) or credit card details.

Information on the persons affected by the data processing is also part of the master data (e.g. information on housing situation, information on relationships with third parties affected by the data processing, contact details of additional cardholders, partner’s income, etc.).

We obtain master data from you directly or from third parties, such as Group companies, custodian banks and credit reference agencies, as well as from public registers (e.g. the land register). We also receive data in connection with address changes, as we are involved in an address update network which sends us and the other companies involved in the network updated address data (e.g. the new address after a move).

Contract and product data is data that is generated in connection with the conclusion of a contract or the processing or termination of a contract. Contract data includes data from applications, contracts and information from pre-contractual relationships, for example information from consultation sessions, information about the products and services you use, information about card limits and card use, information about additional cardholders or account holders, authorised representatives and agents, credit data, as well as information about your account, securities account or contracts concluded.

Contract data also includes financial data, i.e. information on assets and their origins as well as budget details (e.g. own funds, savings, pension assets, liabilities and expenditure), information on earned income, pension income and income from investments, your creditworthiness (e.g. scoring, rating and creditworthiness data in the context of lending) and your payment history (i.e. information regarding payment demands and debt collection), as well as data regarding your securities and other financial instruments, your knowledge and your experience in investment matters, as well as investment products, risk and investment profile, investment objectives, ESG sustainability criteria or information as required in foreign jurisdictions.

Depending on the product, we also collect sensitive personal data, for example information on retirement savings accounts and planned retirement age, insofar as we need this information to process the contract.

We generally collect contract data directly from you and from third parties involved in the processing of the contract (e.g. it may be collected via other Group companies which then forward the information to us), as well as from publicly accessible registers (e.g. Land Register).

Transaction data includes payment transaction data, payment order data, data on the payer, data on the payment recipient or on the beneficiary and on the reason for payment; ATM deposit and withdrawal data, credit card numbers, as well as expiry date and card verification data; data on acceptance points (e.g. merchant name or company name); payment and transaction data, including cash withdrawal data (e.g. transaction amount, date and time of transactions, currency, etc.); transaction type data or data on incorrect PIN entries; data on investigations at acceptance points in connection with a complaint or possible card misuse; information on use of the card for online payments, for example about the IP address of the device used or information related to additional authentication; information about your use of electronic communications (e.g. opening an email or clicking on a link).

This includes data required for compliance with legal obligations incumbent on us and the related clarification and reporting in the context of combating fraud, money laundering and terrorism. We obtain such data from publicly available sources and registers (e.g. sanctions lists) or from public authorities (e.g. information on US citizens/double citizens, economic background, beneficial owners, on the origins and beneficial ownership of assets, on controllers, politically exposed persons or for matching with sanctions lists).

When you contact us via the contact form, our Customer Service or by email, telephone, e-banking messenger or chat, by letter or via other means of communication (e.g. customer portal), we collect the data exchanged between you and us (text messages as well as audio and/or video data), including your contact details and metadata relating to the communication.

We will specifically point out to you if we record communication (e.g. telephone calls, video, chats), for example for evidence or training purposes. If you do not wish to be recorded, please let us know or end your call.

If you wish to communicate via Microsoft Teams, separate Terms of Use apply. We enlist the help of the Microsoft Group for the technical provision of Microsoft Teams. This may also involve your data being transferred to countries outside of Switzerland, in particular to France, the Netherlands and the US. Microsoft undertakes to ensure appropriate data protection by means of standard contractual clauses and supplementary contractual, technical and organisational measures. Microsoft can also use the data to optimise or improve its own services (e.g. for the technical optimisation of the conference system) and to fight cybercrime and attacks. Microsoft’s Privacy Policy can be found at privacy.microsoft.com/en/privacystatement.

In addition, when communicating with you (for example when you submit a request for information), we sometimes also collect data to establish your identity (e.g. information from official identification documents, replies to security questions) in order to prevent us providing information to unauthorised third parties.

In order to provide you with the best possible service and advice on our products and services, we would like to find out your preferences and determine your requirements. To do this, we collect and use data about your interactions with us and about the preferences you tell us or that we identify.

Behavioural data is comprised of details of certain actions, such as the use of electronic means of communication (e.g. whether and when you opened an email), your use of our web pages or customer portals, the way in which you obtain products and services, your interaction with our social media profiles and your participation in prize draws, competitions and events. Preference data tells us about your requirements and which products or services might be of interest to you. We obtain this information from the analysis of existing data, such as behavioural data, so that we can tailor our consultation and our offers more precisely to you.

Technical data includes information collected when you access our websites, apps and social media channels, i.e. data transmitted to us by your browser or end device (smartphone) and automatically collected by our server. This includes IP addresses, MAC addresses of electronic devices, information about these devices (e.g. brand, type, screen, memory) and their settings (e.g. language, keyboard), cookies, functions used, date, time and duration of access, name of the files accessed and content visited, web browser, domain requested, orders placed or attempted, referring web pages and location information, client ID and version of the app installed.

We may also collect data from you in other situations. In connection with official or judicial proceedings, for instance, data accumulates (e.g. files or evidence) that may also relate to you.

We may receive or produce photographs, videos and audio recordings in which you may be identifiable (e.g. at events, by security cameras, etc.). You will either be asked for your consent or informed accordingly in advance (e.g. when opening a digital account). For security purposes, we may also collect data on who enters certain buildings at what point in time, or who has corresponding access rights (e.g. in the case of access controls or based on registration data or visitor lists, etc.), or who participates in events or campaigns (e.g. competitions) or uses our infrastructure and systems and at what point in time.

Details on video surveillance can be found in the separate Privacy Policy on video surveillance.

We obtain the data mentioned here primarily from you, but also from third parties (e.g. authorities) and in some cases also from the Group companies.

In some cases, we may collect sensitive personal data. Sensitive personal data, as defined by law, includes data on religious, ideological, political or trade union-related views or activities; data on health, private life or ethnicity; genetic data; biometric data for the unambiguous identification of a natural person; data on administrative and criminal proceedings or sanctions; and data on social security measures.

Information concerning your health may be processed for financial and tax planning, administrative and criminal convictions may be processed to clarify matters related to the Anti-Money Laundering Act, information about your religious beliefs may be processed in tax-related matters, or information about social security measures may be processed to enforce contractual obligations.

Details on financial and pension planning can be found in the separate Privacy Policy.

Prior to the conclusion of a contract, we process your data in order to offer you the desired consultation and suitable products as well as to contact you in this regard.

Data is processed to provide banking and financial services. The purposes of data processing depend primarily on the specific product (e.g. account, loan, securities, deposits, payments or brokerage) and may include, but are not limited to, needs analysis, consultation, asset management and support, securities account analysis and transaction execution. Further details on the data processing purposes may also be set out in the relevant contract and product information that we will provide to you before a contract is concluded in each case.

In the course of initiating business, personal data – in particular master data, contract data and communication data – of potential customers and other contracting parties is collected or is generated in relation to communication. We also process data in connection with the conclusion of contracts in order to comply with legal requirements.

If the contractual relationship is established, we process your data to implement the contractual relationship, in particular to provide and claim contractual benefits, to manage the customer relationship, to prepare loan interest and capital certificates, as well as to communicate with you. This also includes consultation and customer support, the enforcement of legal claims arising from contracts (debt collection, court proceedings, etc.) as well as accounting or termination of contracts. In this context, we process primarily master data, contract data and communication data.

In the case of collaboration with other companies, for example within the framework of corporate partnerships or in the context of our business relationship with intermediaries (see clause 9.3), we also process master and contract data in particular for the purpose of initiating and processing contracts.

In order to comply with laws, regulatory clarification, disclosure, information, reporting and other obligations (e.g. Banking Act, Financial Services Act, Collective Investment Schemes Act, guidelines of the Swiss Bankers Association, Anti-Money Laundering Act, sanctions law, automatic exchange of information and other banking supervisory decrees and requirements), as well as court or official orders (e.g. issued by public prosecutor’s offices), we must subject your data to more detailed investigations (e.g. with regard to identity, beneficial owners of funds or shareholdings in companies) as well as an automated comparison with external watch lists. In certain cases, we may be required to report to authorities or disclose documents due to statutory requirements or court or official orders. Personal data about you may be processed in the course of internal or external investigations, for example by law enforcement or supervisory authorities or an appointed private body.

These legal obligations may arise from Swiss law, but also from foreign regulations to which we are subject. For these purposes, we process in particular your master data, contract data, claims data and communication data, but also behavioural data under certain circumstances (see clause 3.7).

Data that we require for statistical evaluations and data analyses is anonymised and aggregated and no longer allow any conclusions to be drawn about your person. The aggregated data is required for the creation of statistics (e.g. for the development of new, and adjustments to existing, products) or for topic-specific evaluations and data analyses, as well as for sales reporting. We also use data concerning all existing contracts – likewise without the possibility of drawing conclusions about you personally – to analyse the entire customer base and for the fulfilment of our contractual obligations, for example for general consultation regarding a contract adjustment or contract amendment or for the provision of comprehensive information, i.e. we perform anonymised evaluation which makes use in the individual contractual relationship possible.

We may use your data to send you advertising for our products and services as well as for our group companies and business partners, for example in the form of newsletters or other regular contacts (by email or messenger, by post, by telephone or as part of other marketing campaigns such as competitions or events). In particular, we use your communication data for this purpose.

In order to make our offers more relevant to your requirements and interests, we personalise some of our communications to allow for an individual approach. The individual approach can be made in writing or by telephone. To do this, we link data concerning you that we process – in particular master data, contract data, behavioural data, transaction data and communication data – and determine preference data as a further basis for personalisation. We can also create interest profiles about you and divide you into advertising groups (without including sensitive personal data).

In order to provide you with comprehensive advice on insurance, assets, pension and financial matters (e.g. financing, fund and other financial investments) and to make you offers for further products and services or to advertise them to you, we may process your master and contract data as well as the information disclosed on the occasion of the consultation conducted with your customer adviser.

To manage our relationships with customers and third parties, we may also invite you to our customer events and inform you about our products and services before, during or after the event.

Data can be processed for the purposes of market segment analysis. The main purpose of market segmentation is to identify differences between customers and to use this information to draw conclusions for segment-specific marketing programmes (customer structure analysis). This information is used, in particular to:

• organise prize draws and competitions in which you can participate;
• measure your satisfaction with products and services, for example via customer surveys;
• maintain and develop our brand.

You can inform us at any time if you do not wish your data to be processed for the above purposes or if you wish to withdraw your consent in this regard (see contact address in clause 10). Likewise, you can unsubscribe from newsletters and prize draws at any time using the unsubscribe button in the message concerned.

We are committed to continuously developing our products and services to meet your needs. Therefore, we also sometimes contact you for market research purposes and use the results in anonymised form for addressing various questions within the company. To determine customer satisfaction, we can ask you about your experience with us. We also use your responses to contact you personally, to actively address your concerns and to improve our internal processes. We also collect, store and process your data for the evaluation, improvement and redevelopment of our products and services. In doing so, we analyse which products are used by which groups of people and which adjustments would be necessary in the future. The results of these analyses are – as far as possible – listed in pseudonymised or anonymised form (in accordance with privacy by design principles, we use anonymisation wherever possible in principle). For this purpose, we process the previously described master data, behavioural data, preference data and transaction data as well as communication data.

We may also process your data for other purposes, for instance, as part of our internal processes and administration. This includes training, educational and administrative purposes (such as the management of master data, accounting, data archiving and the management and ongoing improvement of the IT infrastructure), the protection of our rights (e.g. to enforce claims in and out of court and before authorities in Switzerland and abroad, or to defend ourselves against claims, such as by preserving evidence, legal clarifications and participation in judicial or official proceedings), security purposes (e.g. access controls, monitoring of buildings), statistical purposes as well as the evaluation and improvement of internal processes. In the course of preparing, carrying out or finalising mergers, acquisitions, demergers, transfers of assets or similar transactions, we may also sell businesses, parts of operations or companies to other companies, or acquire them from such companies, which may also result in the exchange and processing of data.

Where we ask for your consent for certain forms of processing, we will inform you separately about the corresponding purposes of the processing.

For the conclusion or processing of the contract, sharing of data may also be necessary with other Group companies. If your contract was concluded by employees of other group companies, the data will be disclosed in particular for the purpose of allocating commission.

In order to provide comprehensive and efficient customer support and advisory services, and to contact you regarding the Group’s products and services, we may share your master data and contract data, as well as other information provided in the course of our customer relationship, within the Group. This includes, in particular, master data, financial data, transaction data, communication data and information on usage and payment behaviour.

Your data may also be automatically evaluated and analysed within the Group. The aim of such analyses may be to identify customer preferences, behavioural patterns or future needs, on the basis of which personalised customer profiles may be created. These profiles are used, amongst other things, to optimise customer relations, provide individual advice and furnish information tailored to individual needs, and also to enable the bank or other Group companies to develop, optimise and present bespoke offers.

Such processing may also be carried out automatically or using artificial intelligence (see clause 8).
We may make data available to the Group in anonymised and aggregated form for the purpose of preparing Group-wide statistical evaluations and data analyses (see clause 5.3).

For the purposes of comparing customer bases, customer master data may be compared for statistical purposes within the Group. The comparison analyses how many joint customers there are, how this proportion develops over time and how the joint customers are distributed geographically.

We may also share data within the Group in accordance with statutory, regulatory or internal compliance requirements (e.g. anti-money laundering checks), for the purposes of risk management and internal control, and for the purposes of carrying out statistical analyses, marketing activities as well as analyses of market segments and customer structures.

To conduct joint campaigns and for market segment analyses, customer structure analyses, market research and for product optimisation purposes (see clauses 5.4 and 5.5), we may disclose data to Group companies in order to improve our product and service offering in the process, manage the use of and desired access to the applications, products and information, maintain the business relationship with customers and monitor the performance of the offerings.

In order to achieve the Group-wide purposes mentioned in this clause, your data may also be processed in the future by the parent company in an automated manner or using artificial intelligence with the aim of evaluating certain personal aspects (see clause 8).

To ensure consistent and tailored support, the list of active bank customers is cross-referenced with the insurance company’s customer database once per day. This involves the use of identification data and contact details, as well as information regarding the customer relationship, in order to ensure that customers can be correctly identified and supported.

Additional information relevant to customer support may only be made available to the insurance unit that originally referred the customer in question to the bank. These notifications consist of selected event information, such as the occurrence of a significant cash transfer or the repayment in full of a mortgage. In the case of hybrid customers, the insurance company’s designated customer advisers may, where necessary for the performance of a specific service task, access further data relating to banking activities, in particular account information such as account balances, account movements, transaction data including payments, payees and transaction descriptions, and custody account information such as portfolio holdings and valuations. This information is used exclusively for the purposes set out in clause 17 of the General Terms and Conditions, in particular to provide personalised advice, tailored support, prepare for consultations, and also develop and present suitable offers within the Group.

Access to personal data is strictly governed by the need-to-know principle: Your data is only accessible to those departments that actually need it to perform their respective duties. Access is technically role-based and restricted to customers assigned to the relevant account manager. Each access is logged and regularly checked. Employees of the Group companies are obliged to treat your data as confidential and receive training in data protection and banking secrecy.

You can inform us at any time if you do not wish your data to be shared for the above purposes or if you wish to withdraw your consent in this regard (see contact address in clause 11).

You can request a list of the Group companies via the postal address or email address stated under clause 10 below.

We may also share your data with official bodies, courts and other government authorities and supervisory authorities (e.g. child and adult protection authorities) in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This includes, in particular, compliance with statutory notification obligations, the exercise of rights, the defence against claims and compliance with legal requirements, for example within the framework of official, judicial and pre- or extra-judicial proceedings as well as within the framework of statutory duties to inform and cooperate.

Within the context of our legal and regulatory obligations and based on your consent, your data will be disclosed to the Swiss Consumer Credit Information Office (IKO) or to the Swiss Central Credit Information Bureau (ZEK). Both can transmit the data to their members.

Data is also disclosed if we obtain information from public bodies, for example when checking an address.

Some of our services and business functions (e.g. in connection with the purchase of IT services) are provided on our behalf by legally independent companies in Switzerland and, in rare cases, abroad (see clause 10). They may process data about you if this is necessary for the performance of the contract. These service providers and vicarious agents work on our behalf in particular in the areas of information technology systems and software, customer service, marketing, advertising, newsletter, distribution, printing and real estate services, securities management, payment transactions, telecommunications, fraud prevention, information security, logistics, consultation, debt collection and credit risk management. They are involved in accordance with the provisions of banking and data protection law. Service providers are, for example, obliged to protect banking secrecy and to comply with our defined data processing purposes and the applicable data protection legislation. The bank verifies that data security is guaranteed by the service providers throughout the entire processing period by performing regular checks and audits. To the extent provided for by contract or law, such service providers may, in turn, engage third parties under the same terms and conditions with the prior approval of, and subject to a prior review by, the bank.

When checking your creditworthiness via credit agencies and when commissioning debt collection companies (e.g. to collect outstanding payments), we may share your data (concerning changes in payment behaviour occurring before and during the term of the contract) with the relevant companies. These companies store your personal data and may disclose it to other contracting parties as part of their activities, provided such contracting parties have presented a credible legitimate interest in individual cases for having the data transferred to them.

Your data may also be shared for the aforementioned purposes with other recipients (e.g. parties to judicial proceedings, purchasers of assets or divisions of the bank, auditing firms, Land Registry Offices and other public registers, notaries, pension funds, independent property appraisers and banks). Other persons to whom your data may be disclosed include, in particular, recipients of a payment, authorised representatives, correspondent banks, other financial institutions and other bodies involved in a legal transaction.