Confidentiality and privacy are of the utmost importance and the protection of your personal data is a priority for us when performing our task. We commit to respect the personal information you shared with us when requesting our services, as well as any personal data which we may get knowledge of in the framework of our activities.
In this respect, this Privacy Notice (the « Notice « ) describes how we collect and process your personal data in connection with our different services. As a preliminary and general remark, it is here expressly specified that data protection law may vary depending, amongst others, on the place of residency of our clients and the entity providing services.
1. Who is the controller of your data?
Riva Capital SA, headquartered at Cours de Rive 11, 1204 Genève, Switzerland (« Riva Switzerland« ), and Riva Capital (UK) Limited, headquartered at Albermarle Street 1, London, United Kingdom, W1S 4HB (« Riva UK« , together with Riva Switzerland, « Riva Group » or « we« ), are the controllers.
2. To whom does this Notice apply?
This Notice applies to Riva Group, subject to additional specific regulations which may also apply to Riva Switzerland, respectively Riva UK.
3. Which data do we process and how do we collect it?
We process personal data, amongst others, you share with us or generate when using our services, including:
· information provided as part of any our of relationships opening and management, including in connection with « Know Your Customer » documentation, such as:
o personal data (name, address, date of birth, place of residency and nationality);
o contact details (phone, email address);
o identification data, including copies of your identification documents;
o authentication data (e.g. signature sample);
o order data (e.g. payment orders).
· information regarding your use of our services, such as financial data in relation to your bank account(s) and your assets;
· any information you decided to share with us or you provide when you voluntarily, amongst others, complete client surveys, provide feedback, etc.;
· any communication you have with us via our website, by email, telephone or otherwise;
· the list is not exhaustive and subject to frequent changes.
If you share personal data about other people with us, (e.g. when giving us access to your contact list), you confirm that you have brought this notice to their attention beforehand.
We may also receive personal data about you from third parties, such as:
· depositary banks;
· brokers and securities firms;
· the list is not exhaustive and subject to frequent changes.
Moreover, we process personal data, which come from publicly accessible sources and/or are publicly available.
4. Why do we process your data and on which legal basis?
In accordance with the relevant and applicable legislation, we process your personal data in order to:
· Enter with you into contractual relationships and provide you with first class services accordingly;
· Improve our services and offer your services that may interest you;
· Comply with our legal obligations under European law, UK law and Swiss law (including in respect of « know your customer », anti-money laundering laws and regulations, as well as rules relating to the prohibition of market abuses), market rules, or our agreements with counterparties, brokers and other intermediaries we rely on to execute transactions;
· Perform a task carried out in the public interest or in the exercise of official authority vested in the DPO (see Section 10 below for more details);
· Prevent fraud or misuse of our services and manage our risks;
· Enforce our rights or defend ourselves against legal actions or other proceedings.
5. To whom do we transfer your data?
In order to provide you with the best services, we work in close proximity with multiple trusted and qualified partners, who may be located in Switzerland, in the UK, in the European Union or in any other countries. We may share your personal data with the following recipients:
· Riva Switzerland and Riva UK;
· Third-parties involved in a transaction or service (e.g. custodian banks, financial intermediaries, counterparties, trading venues, operators of payment transaction systems, central securities depositories, collective investment companies);
· Our service providers (e.g. IT, back-office and logistics service providers, debt collection service providers);
· Tax authorities, withholding agents and custodians, or other relevant third parties;
· Courts, authorities and self-regulatory bodies;
· Other third parties with whom you allow us to share data (e.g. subcontractors).
6. Where do we process your data?
Riva Switzerland mainly processes your data in Switzerland, while Riva UK mainly processes your data in the UK.
When sharing data with the recipients listed under Section 4, we may transfer your data to other countries, including in the European Economic Area and in the UK, which are deemed to offer an adequate level of protection as regards data collection and treatment, but also to countries in the world such as the United States, which do not offer a level of protection equivalent to the Swiss data protection legislation.
In particular, data may be transferred, amongst others, to:
· The country where your counterparty is located;
· The country where a financial instrument you trade is listed or traded;
· Any country where it is necessary for the execution of your order;
· Any country where it is required by law (e.g. reporting obligations under tax law);
· the list is not exhaustive and subject to frequent changes;
Where required by law (e.g. in case of data transfer to countries which do not offer a level of protection equivalent to the Swiss and/or UE and/or UK and/or any other country data protection legislation), we put in place appropriate safeguards (such as standard contractual clauses recognized by the Swiss Federal Data Protection and Transparency Commissioner, respectively by any competent authority, such as UE and/or UK authority (i.e. European Commission and Information Commissioner’s Office) or other appropriate protection mechanisms provided by data protection legislation with the countries to whom personal data will be transferred, such as the Swiss-U.S. Data Privacy Framework)) before transferring your personal data abroad.
Once transferred outside of the country where they are mainly processed, personal data is no longer protected by this country’s relevant legislation but subject to the applicable legislation, and may be transmitted to third parties or authorities in accordance with such legislation
7. For how long do we retain your data?
We only keep your personal data for as long as is necessary in light of the purposes for which it is processed, subject to any legal, regulatory or contractual requirements, the time in which any litigations or investigations might arise and the need to answer queries or resolve issues.
In general, we keep data for as long as you maintain a contractual relationship of any kind with us and for ten years thereafter as regards Riva Switzerland.
When personal data is no longer required, we will delete it.
8. What are your rights regarding your data?
You are entitled to submit a request to us at the address set forth under Section 10, to:
· Request the completion or correction of your personal data that is incomplete or inaccurate;
· Restrict or object the processing of your personal data;
· Erase your personal data;
· Receive, or request us to transmit to another designated person or entity, your personal data that we hold about you in a structured, commonly used and machine-readable format;
· Wherever processing of your personal data by us is based on your consent, withdraw your consent to the processing of your personal data.
When you submit such a request, we may require that you provide information to confirm your identity.
The exercise of the abovementioned rights (e.g. your objection to the processing of your personal data or withdrawal of any previously given consent) may prevent us from providing you with all or part of our services. If we consider that, by agreeing to your request, we would no longer be able to provide our services to you in a manner that fulfils our quality standards, we may decide to terminate our relationship with you.
The above-mentioned rights may also be limited – for example when we are required to obtain and process your personal data to comply with applicable law and regulation, to assert or defend against legal claims, or when we have other legitimate grounds for the processing that override your interests and rights. We may therefore be entitled to continue processing your personal data even after you have chosen to withdraw your consent or objected to the processing of your personal data.
If requests are manifestly unfounded or excessive, in particular because of their repetitive character, we reserve the right to either charge a reasonable fee taking into account the request or refuse to act on the request.
9. Changes to this Notice
We keep this Notice under regular review and consequently, it may change at any time in the future. We will place any updates on a special page dedicated to this question on our website: https://www.rivacap.com/GDPR
10. How to contact us as regards data protection?
If you have any other questions about this Policy, please contact our Data Protection Officer (the « DPO« ) at email@example.com or at +41 58 255 82 82, or write to us via postal mail at Riva Capital SA, Cours de Rive 11, 1204 Genève or Riva Capital (UK) Limited, Albermarle Street 1, London, United Kingdom, W1S 4HB.
11. Applicable law and jurisdiction
a. Any disputes between Riva Switzerland and you arising out of or in connection with this Notice is exclusively governed by Swiss law, without regard to conflict of laws provisions. The exclusive place of jurisdiction for any dispute arising out of or in connection with this Notice is Geneva, Switzerland. Riva Switzerland however reserve the right to take legal action against you in a court of competent jurisdiction of your place of residence if before any other competent court or jurisdiction. In such cases too, Swiss law will apply exclusively.
b. Any disputes between Riva UK and you arising out of in connection with this Notice is exclusively governed by theInformation Commissioner’s Office (ICO) without regard to conflict of laws provisions. The exclusive place of jurisdiction for any dispute arising out of or in connection with this Notice is London,Riva UK however reserve the right to take legal action against you in a court of competent jurisdiction of your place of residence if before any other competent court or jurisdiction. In such cases too, ICO will apply exclusively.
c. For any disputes between, on one side, (i) Riva Switzerland and (ii) Riva UK, and, on the other side, you, arising out of or in connection with this Notice, the provision of Section 11/a above will apply exclusively.