Your privacy
Nowadays, technology is evolving very quickly, facilitating the rapid exchange of information and data, which can affect your privacy. Your privacy is important to us, so we do everything we can to protect it.

Financial security and secrecy of transaction 
Our daily routine is to work with confidential and private information - your data, accounts, transactions, and other information. You entrust this information to us to receive quality services from us and special care for the security of your data and transactions.

Trust
Your trust is important to us, so we make sure your data is always safe.

Compliance with law and best practices
We, IPAS “CBL Asset Management”, have developed these Privacy Protection Rules to provide you with general information about what data we process, why we process it, and how we protect it. You can also find information about data processing in applications, agreements, and other documents when you apply for our products and services.

If you want to receive information about the your data processing, we will provide it in accordance with the procedure set out in these rules.

We provide this information in compliance with European Union and Latvian legislation, financial sector and supervisory authority guidelines, and best practices.

bank – AS “Citadele banka”.

Citadele Group companies – AS “Citadele banka” and all its foreign branches and subsidiaries.

consent – any freely and knowingly given confirmation by which you agree to your data processing.

data – any information relating to you or that could relate to you, such as your name, surname, personal identification number, address, phone number, email address, and your habits.

Data State Inspectorate – an institution that supervises the application of the Regulation in the Republic of Latvia.

EU/EEA – European Union / European Economic Area.

investment manager or we – IPAS “CBL Asset Management”.

processing – any actions we perform with your personal data, such as collecting, recording, storing, viewing, using, disclosing by sending, distributing or otherwise making them available, coordinating, erasing or destroying your data, and more.

profiling – an automated method of processing your data to assess your economic and financial situation, personal preferences, interests, reliability, behaviour, and more.

regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

rules – these Privacy Protection Rules.

you – the person whose data we process.

Your data is processed by IPAS “CBL Asset Management”, registration number 40003577500, address: Republikas laukums 2A, Riga, Latvia, LV-1010.

If you have any questions regarding data processing, you can contact us by calling +371 67010810, or by writing to asset@cbl.lv or to our Data Protection Officer at gdpr@citadele.lv.

We collect your data:

• when you give them to us:
  • by using our products and services, which you can apply for at our office, bank customer service centres, websites, bank`s online banking, by filling out applications and requests. We also collect information about how you use these services, as well as data from your devices (computer or mobile phone) through cookies;
  • when establishing a business relationship with the investment manager as required by law;
  • as a third party in connection with the transfer of an investment portfolio;
  • when contacting us via mail, email, mobile application, by phone, in person at our office or bank customer service centres.
• when third parties give them to us:
  • our cooperation partners who provide you with information about us, conduct market research, or deliver services;
  • companies within the Citadele Group;
  • maintainers of databases, registers established by law, and media;
  • state institutions and law enforcement authorities and their officials.

Your data is available only to our employees and those of our cooperation partners who need it to perform their work duties and provide you with the necessary services. They process your data for certain purposes, in accordance with requirements of the law and the rules of the investment manager.

We process your data by performing profiling in certain cases. We do not process your data in an automated way.

Profiling

What is it? Profiling is a data processing method where, using various personal data, we create your personal “profile,” within which we assess data such as financial situation, transaction history, interests, wishes, and more.

Why do we do it? We perform profiling:

• to assess whether the relevant product or service is suitable for your wishes and needs;
• to assess risks;
• to provide you with advice related to the investment manager’s products and services;

to offer products and services tailored to your needs.

We process your data within the European Union and the European Economic Area. However, to provide certain services, data may be transferred to countries outside these territories, for example, if it is necessary for our cooperation partners to provide certain services. If we carry out such transfers, we will inform you. In such cases, we ensure that data is processed in accordance with the requirements of the regulation and is protected at the same level as required by the regulation.

If we transfer your data outside the EU or EEA, we comply with at least one of the following conditions:

• we carry out the transfer to a country that has been recognized by the European Commission as safe for data protection;
• we transfer the data to a country or an international organization that guarantees security in accordance with specially adopted rules; 
• the transfer of data is permitted by the Data State Inspectorate based on agreements between us and third parties (cooperation partners);
• you have given your explicit consent to the transfer of data;
• the transfer of data is necessary for the performance of contract between you and the investment manager or a contract with our cooperation partner in your interest;
• the data is transferred for the purpose of defending or exercising your rights, for example in legal proceedings.

For more information on data transfers outside the EU and EEA, visit the Data State Inspectorate’s website: https://www.dvi.gov.lv. There you can also find the decision on countries that provide a level of data protection equivalent to Latvia’s data protection level.

The length of time we keep your data depends on the purpose for which it is used. When determining retention periods, we consider the following criteria:

• Performance of the contract: We retain data for as long as necessary to ensure that the product or service is available to you.
• Legal requirements: We must keep data for a period specified by law, for example, 10 years from the termination of business relations with you, or 5 years to comply with anti-money laundering regulations.
• Legitimate interests: If the deletion of data could harm our, your, or third - party interests, we will retain the data for as long as necessary.
• Preservation of evidence: We keep data to demonstrate that previous processing was lawful, for example, your consent to receive notifications and offers.

If data is processed based on your consent, we retain it for as long as the consent is valid.

We follow industry guidelines when setting retention periods. If several valid periods apply, such as those required by law and those necessary to protect our and your interests, we will keep the data for the longer period. If none of these criteria apply, we will delete or anonymize your data.

When processing data, we ensure that you have the following rights by submitting a written request to us in free form:

We process your data in accordance with the regulation, European Union and Latvian laws, best practices in the financial sector, and guidelines and recommendations issued by supervisory authorities. If you believe we have violated your privacy rights, you can submit a complaint to us using the provided contact information. If the response does not meet your expectations, you can file a complaint with the Data State Inspectorate using the contacts provided:

If the response from us or the Data State Inspectorate does not provide the desired solution, you have the right to apply to the court.

We protect your data against unlawful access, use, or disclosure by taking the following measures:

We restrict access to the premises to unauthorized persons by ensuring:

• Door locks (electronic doors): We ensure all premises are locked when employees are not present.
• Access control: We use access cards (magnetic, chip cards), identity readers, code systems to control who can access the premises.
• Selection of personnel: We carefully select reliable employees.

We limit access to technological resources, ensuring protection of:

• Technological devices: Computer devices (desktop computers, laptops, tablets, servers), mobile devices (smartphones), communication devices (routers, modems), data storage devices (external hard drives, USB drives, SD cards), and other devices (printers, scanners, monitors);
• Information systems, software, and applications;
• Communication networks and technologies enabling data transmission and information exchange (Internet, VPN, mobile networks, cloud technologies, etc.).

For the protection of technological resources, we provide:

• Prevention of environmental threats: We implement safety measures against fires, floods, large temperature changes and other conditions.
• Prevention of technical risks: We take care that there is a good power supply, uninterrupted power supplies in case of power failures and that other similar malfunctions do not occur.
• Human threats: We do not allow damage or theft.
• Secure passwords: We use secure and complex passwords for devices and accounts.
• Screen locking: When the device is not in use, we lock the screen.
• User roles: We limit access to data and systems, allowing only what is necessary for the relevant user.
• Software and security updates: We always install the latest versions to prevent vulnerabilities.
• Encryption: We encrypt data so that it cannot be accessed by third parties/unauthorized persons.
• Secure connection: We use HTTPS and VPN to ensure security when working online.
• Antivirus: We install and update antivirus programs on all devices.
• Firewalls: We use a firewall to protect the network from unwanted access.
• Attack detection systems: We install programs that monitor and warn about suspicious activity.

We carry out regular inspections and provide updates

• Device checks: We regularly check that all devices are in working order and in place.
• System updates: We install the latest software updates to mitigate security risks.

We educate employees

• Training: We regularly inform employees about safety issues and how to act in suspicious situations.
• Threat prevention: We warn you about fraudulent emails and other potential security risks.

We monitor and analyse security

• Log files (audit trails): We record access and operations in systems so that they can be monitored and reviewed.
• Regular tests: We check the safety of systems to identify and eliminate potential risks.

We are ready for emergencies

• Backups: We regularly make backups of data and store them in safe places.
• Emergency plan: We prepare a plan for responding to threats to premises or technology.

Why is this important to us and to you?

Protecting technological resources helps protect data, prevent data leaks, theft, and guarantees that we can continue to work and avoid loss of money and reputation. Safety depends on each employee, so it is important to be careful and follow the rules.

Your data can only be accessed by the investment manager’s employees and cooperation partners who need it to perform their work duties. Before starting cooperation, we carefully evaluate the cooperation partners and inform them about confidentiality and data protection. We and our cooperation partners ensure the protection and use of your data only for the intended purposes, in accordance with the requirements of the law.

To ensure that you are always informed about how your data is processed, we will regularly review and update these rules. Therefore, we encourage you to review the latest version from time to time on our website, in online banking (if you are a bank client), at our office, and in bank`s customer service centres. If there are any significant changes, we will notify you one month before they take effect.