Privacy Policy Baloise Bank Ltd

Depending on which products and services you purchase from us, we process different categories of personal data, although this list provided in this document is not exhaustive.

In the event of changes to data over time (e.g. due to a change of address, a change in civil status or another modification), we will modify the data accordingly. The previous data will be stored if necessary in the context of the statutory retention periods and will then be erased.

We refer to the basic data that we require in addition to the insured person data (see below) for the processing of our pension relationships or for relationship management. Master data includes, in particular, contact information (e.g. name, address, telephone number and email address), personal details (e.g. date of birth, age, gender, nationality, data from identification documents), other identification data (e.g. AHV number, customer number, UID number or Tax Identification Number) or information about your relationship with us. Account details are also collected, including bank account details (e.g. account numbers).

Information on the persons affected by the data processing is also part of the master data, for example correspondence recipients, contact persons, family members or other beneficiaries.

We receive master data from you or from third parties, other pension funds or social insurance institutions, authorities or the persons you have appointed as beneficiaries, as well as from public registers (e.g. the Commercial Register).

Contract data is data that is collected in connection with the conclusion or processing of a contract, for example data concerning the products and services used by the customer or concerning third parties such as life partners, representatives, authorised representatives and beneficiaries who are also affected by data processing, information about the account, securities custody account or contracts concluded, as well as data in connection with services provided by or for customers.

Insured person data: Insured person data includes data from information provided by previous pension or vested benefits institutions, information on modifications (e.g. divorce), information in connection with the processing of claims to pension benefits (e.g. notification of the occurrence of the claim to pension benefits, reason for the occurrence of the claim to pension benefits, such as age, disability or death, and the event date), information about other benefit cases (e.g. withdrawal, divorce, advance withdrawal to finance home ownership), as well as information on your family situation (e.g. marital status, beneficiaries).

Contract data also includes financial data, i.e. information relating to payments and bank account details, information on assets and their origins, income, turnover and investments, as well as information on income from employment, pensions and, occasionally, payment behaviour (e.g. subsequent claims for withholding tax contributions).

We generally collect data related to contracts and insured person data directly from you, from contracting parties and from third parties involved in the processing of the insurance relationship (e.g. employers, other social insurance institutions or pension funds, authorities, courts), but also from third-party sources (e.g. pension funds, insurance companies, Land Register, Commercial Register or Debt Collection Offices), from people closely associated with you (e.g. family members, legal representatives, employers) and from publicly accessible registers (e.g. to review excerpts from the Register of Criminal Convictions when admitting new members to the supreme governing body), such as in the media or on the Internet. In doing so, we collect this data, and in some cases health data, for example from other pension funds and social insurance providers (e.g. previous insurers regarding previous pension relationships). If you enter into a pension relationship with us, you thereby release these bodies from any duty of confidentiality. If necessary, we will obtain separate consent from you.

Transaction data includes payment transaction data, payment order data, data on the payment recipient or on the beneficiary and on the reason for payment; ATM deposit and withdrawal data, as well as credit card numbers, expiry date and card verification data, data on acceptance points (e.g. merchant name or company name); payment and transaction data, including cash withdrawal data (e.g. transaction amount, date and time of transactions, currency, etc.); transaction type data or data on incorrect PIN entries; data on investigations at acceptance points in connection with a complaint or possible card misuse; information on use of the card for online payments, e.g. about the IP address of the device used or information related to additional authentication; information about your use of electronic communications (e.g. opening an email or clicking on a link).

This includes data required for compliance with legal obligations incumbent on us and the related clarification and reporting in the context of combating fraud, money laundering and terrorism. We obtain such data from publicly available sources and registers (e.g. sanctions lists) or from public authorities (e.g. information on US citizens / double citizens, economic background, beneficial owners, on the origins and beneficial ownership of assets, on controllers, politically exposed persons or for matching with sanctions lists).

When you contact us via the contact form, our Customer Service or by email, telephone, e-banking messenger or chat, by letter or via other means of communication (e.g. customer portal), we collect the data exchanged between you and us (text messages as well as audio and/or video data), including your contact details and metadata relating to the communication.

We will specifically point out to you if we record communication (e.g. telephone calls, video, chats), for example for evidence or training purposes. If you do not wish to be recorded, please let us know or end your call.

If you wish to communicate via Microsoft Teams, separate Terms of Use apply. We enlist the help of the Microsoft Group for the technical provision of Microsoft Teams. This may also involve your data being transferred to countries outside of Switzerland, in particular to France, the Netherlands and the US. Microsoft undertakes to ensure appropriate data protection by means of standard contractual clauses and supplementary contractual, technical and organisational measures. Microsoft can also use the data to optimise or improve its own services (e.g. for the technical optimisation of the conference system) and to fight cybercrime and attacks. Microsoft’s Privacy Policy can be found at privacy.microsoft.com/en/privacystatement.

In addition, when communicating with you (for example when you submit a request for information), we sometimes also collect data to establish your identity (e.g. information from official identification documents, replies to security questions) in order to prevent us providing information to unauthorised third parties.

In order to provide you with the best possible service and advice on our products and services, we would like to find out your preferences and determine your requirements. To do this, we collect and use data about your interactions with us and about the preferences you tell us or that we identify.

Behavioural data is comprised of details of certain actions, such as the use of electronic means of communication (e.g. whether and when you opened an email), your use of our web pages or customer portals, the way in which you obtain products and services, your interaction with our social media profiles and your participation in prize draws, competitions and events. Preference data tells us about your requirements and which products or services might be of interest to you. We obtain this information from the analysis of existing data, such as behavioural data, so that we can tailor our consultation and our offers more precisely to you.

Technical data includes information collected when you access our websites, apps and social media channels, i.e. data transmitted to us by your browser or end device (smartphone) and automatically collected by our server. This includes IP addresses, MAC addresses of electronic devices, information about these devices (e.g. brand, type, screen, memory) and their settings (e.g. language, keyboard), cookies, functions used, date, time and duration of access, name of the files accessed and content visited, web browser, domain requested, orders placed or attempted, referring web pages and location information, client ID and version of the app installed.

We may also collect data from you in other situations. In connection with official or judicial proceedings, for instance, data accumulates (e.g. files or evidence) that may also relate to you.

We may receive or produce photographs, videos and audio recordings in which you may be identifiable (e.g. at events, by security cameras, etc.). You will either be asked for your consent or informed accordingly in advance (e.g. when opening a digital account). For security purposes, we may also collect data on who enters certain buildings at what point in time, or who has corresponding access rights (e.g. in the case of access controls or based on registration data or visitor lists, etc.), or who participates in events or campaigns (e.g. competitions) or uses our infrastructure and systems and at what point in time.

Details on video surveillance can be found in the separate Privacy Policy on video surveillance.

We obtain the data mentioned here primarily from you, but also from third parties (e.g. authorities).

In some cases, we may collect sensitive personal data. Sensitive personal data, as defined by law, includes data on religious, ideological, political or trade union-related views or activities; data on health, private life or ethnicity; genetic data; biometric data for the unambiguous identification of a natural person; data on administrative and criminal proceedings or sanctions; and data on social security measures.

We only collect sensitive personal data, such as information on previous accidents/illnesses or disability, as well as information from relevant physicians, if we require this information for the processing of the pension relationship. This is namely the case in the event of a disbursement due to disability, although, in such cases, we only process the data from the Federal Disability Insurance (IV) ruling or if the exit statement of a pension fund contains information on the state of health or on provisos imposed for health reasons.

Prior to the establishment of a pension relationship, we process your data in order to offer you the desired consultation and to contact you in this regard. Personal details – in particular master data, insured person data and communication data – are collected from you or are derived from communication.

If a pension relationship is established, we process your data to implement the pension relationship, in particular to provide regulatory benefits and to manage the insurance relationship, for example to process modifications and to communicate with you. This also includes consultation and insured person support, the enforcement of legal claims arising from contracts (court proceedings, etc.) as well as accounting and termination of the pension relationship. In this context, we process in particular master data and insured person data (including sensitive data) as well as communication data.

In certain cases, we may be obliged to submit notifications to authorities and courts (e.g. tax notifications to the Swiss Federal Tax Administration in the case of lump-sum withdrawals or, as part of the examination of an application for lump-sum withdrawals, to the Office for Debt Collection Assistance in the event of the failure to comply with an obligation to pay maintenance, FINMA orders or orders issued by public prosecutor’s offices in connection with money laundering and terrorist financing) or disclose documents. Your personal data may also be processed in the course of internal or external investigations, for example by law enforcement or supervisory authorities or an appointed private body. In doing so, we process your master data, contract data and communication data in particular.

Data that we require for statistical evaluations and data analyses is anonymised and aggregated and no longer allow any conclusions to be drawn about your person. The aggregated data is required for the creation of statistics (e.g. for the development of new, and adjustments to existing, products) or for topic-specific evaluations and data analyses, as well as for sales reporting. We also use data concerning all existing contracts – likewise without the possibility of drawing conclusions about you personally – to analyse the entire customer base and for the fulfilment of our contractual obligations, for example for general consultation regarding a contract adjustment or contract amendment or for the provision of comprehensive information, i.e. we perform anonymised evaluation which makes use in the individual contractual relationship possible.

We may use your data to send you advertising for our products and services as well as for our Group companies and business partners, for example in the form of newsletters or other regular contacts (by email or messenger, by post, by telephone or as part of other marketing campaigns such as competitions or events). In particular, we use your communication data for this purpose.

In order to make our offers more relevant to your requirements and interests, we personalise some of our communications to allow for an individual approach. The individual approach can be made in writing or by telephone. To do this, we link data concerning you that we process – in particular master data, contract data, behavioural data, transaction data and communication data – and determine preference data as a further basis for personalisation. We can also create interest profiles about you and divide you into advertising groups (without including sensitive personal data).

In order to provide you with comprehensive advice on insurance, assets, pension and financial matters (e.g. financing, fund and other financial investments) and to make you offers for further products and services or to advertise them to you, we may process your master and contract data as well as the information disclosed on the occasion of the consultation conducted with your customer adviser.

To manage our relationships with customers and third parties, we may also invite you to our customer events and inform you about our products and services before, during or after the event.

Data can be processed for the purposes of market segment analysis. The main purpose of market segmentation is to identify differences between customers and to use this information to draw conclusions for segment-specific marketing programmes (customer structure analysis). This information is used, in particular to:

• organise prize draws and competitions in which you can participate;
• measure your satisfaction with products and services, for example via customer surveys;
• maintain and develop our brand.

You can inform us at any time if you do not wish your data to be processed for the above purposes or if you wish to withdraw your consent in this regard (see contact address in clause 10). Likewise, you can unsubscribe from newsletters and prize draws at any time using the unsubscribe button in the message concerned.

We are committed to continuously developing our products and services to meet your needs. Therefore, we also sometimes contact you for market research purposes and use the results in anonymised form for addressing various questions within the company. To determine customer satisfaction, we can ask you about your experience with us. We also use your responses to contact you personally, to actively address your concerns and to improve our internal processes. We also collect, store and process your data for the evaluation, improvement and redevelopment of our products and services. In doing so, we analyse which products are used by which groups of people and which adjustments would be necessary in the future. The results of these analyses are – as far as possible – listed in pseudonymised or anonymised form (in accordance with privacy by design principles, we use anonymisation wherever possible in principle). For this purpose, we process the previously described master data, behavioural data, preference data and transaction data as well as communication data.

We may also process your data for other purposes, for instance, as part of our internal processes and administration. This includes training, educational and administrative purposes (such as the management of master data, accounting, data archiving and the management and ongoing improvement of the IT infrastructure), the protection of our rights (e.g. to enforce claims in and out of court and before authorities in Switzerland and abroad, or to defend ourselves against claims – such as by preserving evidence, legal clarifications and participation in judicial or official proceedings), security purposes (e.g. access controls, monitoring of buildings), statistical purposes and the evaluation and improvement of internal processes. As part of the development of the company, we may also sell or acquire businesses, parts of businesses or companies to other companies or enter into partnerships, which may also lead to the exchange and processing of data. In the course of preparing, carrying out or finalising mergers, acquisitions, demergers, transfers of assets or similar transactions, we may also sell businesses, parts of operations or companies to other companies, or acquire them from such companies, which may also result in the exchange and processing of data.

Where we ask for your consent for certain forms of processing, we will inform you separately about the corresponding purposes of the processing.

For the conclusion or processing of the contract, sharing of data may also be necessary with other Group companies. If your contract was concluded by employees of other group companies, the data will be disclosed in particular for the purpose of allocating commission.

In order to provide comprehensive and efficient customer support and advisory services, and to contact you regarding the Group’s products and services, we may share your master data and contract data, as well as other information provided in the course of our customer relationship, within the Group. This includes, in particular, master data, financial data, transaction data, communication data and information on usage and payment behaviour.

Your data may also be automatically evaluated and analysed within the Group. The aim of such analyses may be to identify customer preferences, behavioural patterns or future needs, on the basis of which personalised customer profiles may be created. These profiles are used, amongst other things, to optimise customer relations, provide individual advice and furnish information tailored to individual needs, and also to enable the bank or other Group companies to develop, optimise and present bespoke offers.
We may make data available to the Group in anonymised and aggregated form for the purpose of preparing Group-wide statistical evaluations and data analyses (see clause 5.3).

For the purposes of comparing customer bases, customer master data may be compared for statistical purposes within the Group. The comparison analyses how many joint customers there are, how this proportion develops over time and how the joint customers are distributed geographically.

We may also share data within the Group in accordance with statutory, regulatory or internal compliance requirements (e.g. anti-money laundering checks), for the purposes of risk management and internal control, and for the purposes of carrying out statistical analyses, marketing activities as well as analyses of market segments and customer structures.

To conduct joint campaigns and for market segment analyses, customer structure analyses, market research and for product optimisation purposes (see clauses 5.4 and 5.5), we may disclose data to Group companies in order to improve our product and service offering in the process, manage the use of and desired access to the applications, products and information, maintain the business relationship with customers and monitor the performance of the offerings.

In order to achieve the Group-wide purposes mentioned in this clause, your data may also be processed in the future by the bank or the parent company in an automated manner or using artificial intelligence with the aim of evaluating certain personal aspects (see clause 8).

To ensure consistent and tailored support, the list of active bank customers is cross-referenced with the insurance company’s customer database once per day. This involves the use of identification data and contact details, as well as information regarding the customer relationship, in order to ensure that customers can be correctly identified and supported.

Additional information relevant to customer support may only be made available to the insurance unit that originally referred the customer in question to the bank. These notifications consist of selected event information, such as the occurrence of a significant cash transfer or the repayment in full of a mortgage. In the case of hybrid customers, the insurance company’s designated customer advisers may, where necessary for the performance of a specific service task, access further data relating to banking activities, in particular account information such as account balances, account movements, transaction data including payments, payees and transaction descriptions, and custody account information such as portfolio holdings and valuations. This information is used exclusively for the purposes set out in clause 17 of the General Terms and Conditions, in particular to provide personalised advice, tailored support, prepare for consultations, and also develop and present suitable offers within the Group.

Access to personal data is strictly governed by the need-to-know principle: Your data is only accessible to those departments that actually need it to perform their respective duties. Access is technically role-based and restricted to customers assigned to the relevant account manager. Each access is logged and regularly checked. Employees of the Group companies are obliged to treat your data as confidential and receive training in data protection and banking secrecy.

You can inform us if you do not wish your data to be shared for the above purposes or if you wish to withdraw your consent in this regard (see contact address in clause 10).

You can request a list of the Group companies via the postal address or email address stated under clause 10 below.

We may also share your data with official bodies, courts and other government authorities and supervisory authorities (e.g. child and adult protection authorities) in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This includes, in particular, compliance with statutory notification obligations, the exercise of rights, the defence against claims and compliance with legal requirements, for example within the framework of official, judicial and pre- or extra-judicial proceedings as well as within the framework of statutory duties to inform and cooperate.

Data is also disclosed if we obtain information from public bodies, for example in connection with claims settlement or when checking an address.

Some of our services and business functions (e.g. in connection with the purchase of IT services) are provided on our behalf by legally independent companies in Switzerland and, in rare cases, abroad (see clause 10). They may process data about you if this is necessary for the performance of the contract. These service providers and vicarious agents work on our behalf in particular in the areas of information technology systems and software, customer service, marketing, advertising, newsletter, distribution, printing and real estate services, securities management, payment transactions, telecommunications, fraud prevention, information security, logistics, consultation, debt collection and credit risk management. They are involved in accordance with the provisions of banking and data protection law. Service providers are, for example, obliged to protect banking secrecy and to comply with our defined data processing purposes and the applicable data protection legislation. The bank verifies that data security is guaranteed by the service providers throughout the entire processing period by performing regular checks and audits. To the extent provided for by contract or law, such service providers may, in turn, engage third parties under the same terms and conditions with the prior approval of, and subject to a prior review by, the bank.

When commissioning debt collection companies (e.g. to collect outstanding payments), we may share your data (concerning changes in payment behaviour occurring before and during the term of the contract) with these companies. These companies store your personal data and may disclose it to other contracting parties as part of their activities, provided such contracting parties have presented a credible legitimate interest in individual cases for having the data transferred to them.

Your data may also be shared for the aforementioned purposes with other recipients (e.g. parties to judicial proceedings, purchasers of assets or divisions of the bank, auditing firms, Land Registry Offices and other public registers, notaries, pension funds, independent property appraisers and banks). Other persons to whom your data may be disclosed include, in particular, recipients of a payment, authorised representatives, correspondent banks, other financial institutions and other bodies involved in a legal transaction.