We always process personal data for a specific purpose and only to the extent necessary to fulfil this purpose. The main purposes of processing such data are as follows:

3.1 Purposes of processing

a. Contract negotiations and customer onboarding:

Verifying your identity and assessing your application (including assessing your creditworthiness and the need for collateral if you are applying for a loan)

Carrying out checks to ensure compliance with legal or regulatory requirements (e.g. compliance with anti-money laundering and anti-fraud regulations)

b. Fulfilment of the contract, including the provisions for banking products and services

• Data processing for the purpose of managing our business relationship with you, e.g. in relation to the products and services provided by us and our business partners, to deal with customer service queries and complaints, to facilitate debt recovery, when deciding whether to grant loans, to clarify your place of residence (e.g. if we can no longer contact you)
• Data processing for the purpose of providing banking products and services (including Cornèrtrader) and to ensure their correct implementation, e.g. through appropriate identity checks and account withdrawals or deposits in accordance with your instructions and the general terms and conditions of the product concerned. The data processing purposes are primarily dependent on the respective order. These may include, for example, demand analyses, advisory services, asset management and the execution of transactions. To measure credit risks and default risks in loan transactions (e.g. mortgage lending, trade finance), we are also authorised to consult credit agencies and exchange information with them (e.g. debt collection registers).
• In connection with payment cards, we process the data collected to fulfil the card contract and to manage the business relationship. Please note the following in this context:
  • As far as the use of the card is concerned, the transaction information is transmitted to Cornèr by the acceptance points (merchants or ATMs). Such transmissions are generally made via the global networks of the international card companies Mastercard, Visa and Diners (please refer to the data protection guidelines of the card companies concerned). We then check and authorise the transactions and charge them to the cardholder.
  • With regard to the authorisation of transactions, Cornèr checks whether a transaction is made by the authorised cardholder or whether it could be a fraudulent transaction. Cornèr is authorised to take various fraud prevention measures at its own discretion. Each transaction is automatically analysed according to predefined rules and conditions to identify signs of possible misuse. In addition, where possible, transactions are checked for significant deviations from normal card usage patterns (e.g. in terms of time or location). If Cornèr identifies indications of possible card misuse, Cornèr will, if possible, take measures to prevent misuse (e.g. by contacting the card issuer or the card issuer’s authorised representative).
  • In addition, the cardholder’s data is processed in the procedure for complaints and chargebacks of transactions, for example to clarify unknown transactions or unjustified debits. In this procedure, transactions are checked in detail. Data is also collected and processed for the settlement of insurance claims in order to clarify the insurance claims in cooperation with our insurance partner.
  • If payment cards from Cornèr’s partner companies are sold as private cards to consumers or as corporate cards to the relevant companies and their own customers, information about the use of the payment card by the cardholder (e.g. transaction data) is forwarded to the relevant partner companies.

• We process personal data in order to send information about the services and products that customers have ordered (e.g. information about changes to services or products, about new product features, about maintenance work, about temporary outages, etc.).

c. Fulfilment of compliance, risk management and crime prevention requirements

• We process data to meet our ongoing regulatory and compliance obligations (e.g. in relation to financial, money laundering and tax laws), including in relation to recording and monitoring communications, sharing data with tax authorities, financial regulators and other regulators or national authorities, detecting or preventing criminal offences and complying with disclosure requirements to authorities.
• We process data to fulfil operational requirements for credit and risk management, e.g. to determine credit and market risks in connection with the issuing of payment cards or the granting of loans. Such data processing is necessary in particular because Cornèr assumes the credit risk as part of the contractual relationship for the use of payment cards or the credit agreement relationship. In this context, Cornèr creates individual risk profiles that are used, among other things, to assess the credit risk. You are not entitled to object to our data processing for risk analysis purposes, as Cornèr needs this data to calculate and control its financial risks. You can only object to such data processing by terminating the contractual relationship with us.
• Measures to prevent and investigate criminal offences and to ensure the security of our customers, employees and third parties: In connection with payment cards, we process data, including the monitoring of transaction data, for fraud prevention.

d. Managing relationships with our business partners, including the fulfilment of contracts concluded with them

• We work with various companies and business partners, e.g. suppliers, professional purchasers of goods and services, joint venture partners and service providers (e.g. IT service providers). We process personal data about the contact persons in the companies concerned (e.g. name, position, title and communication with us) for contract preparation and execution, for planning and booking purposes and for other contract-related purposes.
• Depending on the industry, we may also be obliged to carry out more detailed checks on the companies concerned and their employees, e.g. as part of a security check. In this case, we collect and process additional information.

e. Measures to improve our products and services and the technologies we use

• This includes verifying and updating our systems and processes in general and for market research purposes to determine how we can improve our products and services or what new products and services we could sell.
• Carrying out transaction analyses, statistical analyses and similar analyses.
• We are also authorised to process personal data in order to improve customer advice, customer satisfaction and customer loyalty (customer/supplier relationship management).

f. Information and direct marketing / events and competitions for customers

• We process personal data in order to send information and advertising (including by means of push notifications) relating to our products and services that we believe may be of interest to you. This also includes products and services offered by us, by other Cornèr Bank Group companies or by our business partners. For example, if you sign up for a newsletter or SMS notification service, we will process your contact details. In the case of e-mails, we also process information about your use of the messages (e.g. whether you have opened an e-mail and downloaded the embedded graphics) in order to tailor our offers to your requirements.
• In connection with its products, Cornèr is authorised to create profiles about customers and their consumption and preferences for marketing purposes from the personal data and transaction data collected. This enables Cornèr to develop and offer attractive products and services for its customers. Cornèr is authorised to send customers such information about its own products and services or about the products and services of partner companies using the available communication channels (e.g. by post, e-mail, push notification).
• Events for customers: We also process personal data when we organise events for customers (e.g. promotional events, sponsorship events and cultural and sporting events). Such data includes, for example, the first and last name of the participants or potential new customers, their postal or e-mail address and possibly, depending on the circumstances, other information such as their date of birth. We process such information in order to organise the customer events, but also to contact you directly. For further information, please refer to the applicable conditions of participation.
• Competitions, prize draws and similar events: From time to time, we organise competitions, prize draws and similar events. We process your contact details and information about your participation in order to organise the competitions and contests, to communicate with you about such events if necessary and to use this data and information for advertising purposes. For further information, please refer to the applicable conditions of participation.
• You can object to the sending of information (advertising block) or revoke your consent to data processing for marketing purposes by sending Cornèr a written request, optionally also by e-mail (see information below on the right to object).

g. Examples of other purposes

• Legal purposes: We process personal data in various situations in order to assert our rights, e.g. to assert our claims in court or out of court and to enforce or defend ourselves against claims before foreign or domestic authorities. For example, we may investigate the prospects of success in legal disputes or submit documents to an authority. In doing so, we are authorised to process your personal data or forward it to third parties in Switzerland and abroad, insofar as this is necessary and permitted. This also includes debt collection proceedings in Switzerland or abroad. (For this purpose, we are authorised to commission third parties, such as debt collection companies).
• Measures to secure property ownership rights, including security measures for facilities and buildings (e.g. access control). This also includes video surveillance in appropriately labelled areas to protect the owner’s rights, to collect evidence in the event of robbery or fraud or to obtain proof of deposits and withdrawals (e.g. at ATMs).
• Ensuring Cornèr’s IT security and operations (including the processing of personal data in test environments where the information is generally pseudonymised in advance).
• For the operational management of Cornèr and Cornèr’s subsidiaries (‘Cornèr Bank Group’) (including credit and risk management, insurance, auditing, system and product training and similar administrative purposes), and for such other purposes as may be notified to you on a case-by-case basis.

3.2 Basis of the processing

A large part of the above-mentioned processing takes place in order to fulfil contractual obligations or, at your request, to carry out pre-contractual measures (paragraphs a), b), d)).

Processing also takes place in cases where this is required by law or is in the public interest (paragraphs a), c)). Statutory obligations of this kind may arise, for example, from the Swiss Banking Act, the Collective Investment Schemes Act, the Anti-Money Laundering Act, the Consumer Credit Act, the Mortgage Bond Act and various tax laws and ordinances of the Swiss Financial Market Supervisory Authority FINMA.

Part of the data processing serves to protect our legitimate interests or the legitimate interests of third parties as part of a balancing of interests (paragraphs e), f), g), h)). If you would like further details on the balancing of interests, you are welcome to contact us (contact details in section 12).

In certain cases, we rely on your express or implied consent for the processing of personal data for certain purposes. Such consent can be withdrawn at any time.

3.3 Obligation to provide information

In the course of our business relationship, you must provide personal data that we require for the initiation and execution of our business relationship and for the fulfilment of the associated contractual obligations. You must also provide data that we are required to collect by law. Without such data, we will not be able to enter into or fulfil the contract (in which case we will inform you of this fact).

Before we can enter into a business relationship with you, we are required by anti-money laundering legislation to verify your identity using your identification documents and to record and store your first and last name, place and date of birth, nationality, address and identification document details. In order for us to comply with this legal requirement, you must provide us with the information and documents required by the Anti-Money Laundering Act and notify us immediately of any relevant changes during the course of our business relationship. If you do not provide us with the required information and documents, we will not be able to initiate or maintain our business relationship.

4. Who receives my data?

4.1 Within the Cornèr Bank Group

At Cornèr, your data will only be made available on the basis of necessity (need-to-know principle) for the fulfilment of our contractual and legal obligations.

We are authorised to transfer personal data to other companies of the Cornèr Bank Group for internal group management purposes (including for risk management in application of legal or administrative regulations) and for the processing purposes listed above. Your personal data may be processed for the relevant purposes and linked to personal data of other Cornèr Bank Group companies.

4.2 Third parties

When we provide you with products and services, we will share your personal data with persons acting on your behalf or otherwise involved in the transaction (depending on the nature of the products or services you use). This may include the types of organisations described below.

Other credit and financial services institutions or similar institutions to whom we disclose your personal data (e.g. depending on the contract, partner banks, custodian banks, external asset managers, fund managers, brokers, stock exchanges, central counterparty clearing houses (CCPs), upstream paying agents, swap or trade repositories and clearing houses and clearing or settlement systems and specialised payment service providers or payment institutions such as SWIFT).

Parties involved in a transaction (e.g. payee, beneficiary, authorised signatory of an account, intermediary) or who assume a risk in the course of or in connection with the transaction (e.g. an insurer).

If you have a payment card with us, the relevant card company (Visa, Mastercard, Diners Club) and the acquiring companies that have entered into agreements with individual merchants to accept these cards.

Other financial institutions, credit or business rating agencies (for obtaining or providing credit reference information and credit checks).

4.3 Service providers

Your data may also be passed on to the service providers or subcontractors commissioned by us for the above-mentioned purposes if they enter into appropriate confidentiality agreements. These include providers of banking services (including investment services), IT services (including hosting service providers and providers of cloud services), logistics, printing, telecommunications, debt collection services (including the commissioning of debt collection companies based in Switzerland or abroad), payment transactions, rating agencies, advice and consulting as well as sales and marketing. In these cases, we protect your personal data in a way that ensures that the subcontractor complies with our data security standards.

4.4 Government authorities or supervisory authorities

If necessary, we also disclose personal data to government authorities, supervisory authorities or state bodies (e.g. the Swiss National Bank, FINMA, law enforcement authorities) if this is required by law, ordinances or other rules of conduct or if disclosure is requested by these authorities or bodies.

4.5 Other cases

In the event of the sale of all or part of our company to another company or in the event of a reorganisation of our company, personal data will be passed on in order to enable you to continue using the products and services concerned. As a rule, we also pass on personal data to potential buyers if we are considering the complete or partial sale or the complete or partial spin-off of a division of the company. We take appropriate precautions to ensure that such potential buyers ensure the security of the data.

We disclose personal data to the extent necessary to exercise or enforce legal rights – including our rights, the rights of our employees and the rights of other rights holders – or to respond to requests from individuals or their representatives who wish to enforce their own rights or the rights of others.

5. Will my data be transferred to third countries or to an international organisation?

The recipients mentioned in the previous section may process the personal data abroad. We transfer your personal data to other countries whose legislation guarantees an adequate level of data protection (in particular the EEA countries) or, in the absence of such legislation guaranteeing adequate protection, on the basis of appropriate safeguards (e.g. standard contractual clauses adopted by the European Commission or other legal derogations) or with your consent. If and to the extent required by applicable law, these safeguards – in particular the standard contractual clauses adopted by the European Commission – may be supplemented by appropriate legal, operational and technical measures. Please contact us if you would like to review the agreed data transfer guarantees.

Your data may also be transferred to third countries or within third countries if this is necessary for the execution of your orders (e.g. payment orders or securities trading orders), if such data transfer is required by law (e.g. tax reporting obligations) or if you have expressly consented to this purpose.

Below is a list of the countries to which we may transfer your data:

• EEA countries
• USA
• Israel
• Brazil

6. How long will my data be stored?

We store your personal data for as long as is necessary for the purpose for which we collected it or to fulfil legal or regulatory requirements, which may be specified in more detail in our internal guidelines.

In the case of contracts, we store your personal data for at least the duration of the contractual relationship. In this context, please note that our business relationship is designed to be a long-term contractual relationship over many years.

In addition, we store personal data if we have a legitimate interest in storing it. This may be the case in particular if we need personal data to enforce or defend against claims, for archiving purposes, to maintain IT security or as long as the limitation period for contractual or non-contractual claims is still running. As a rule, ten-year limitation periods are common, for example. However, there are also many cases in which five-year or even one-year limitation periods apply.

We also store your personal data for the duration of the applicable statutory retention period (e.g. to comply with retention periods under tax or commercial law or to comply with the 10-year retention period under the Anti-Money Laundering Act). Please note that we are obliged by the provisions of the financial supervisory authorities to record external and internal telephone conversations and the electronic correspondence of certain bank employees.

If necessary, we will contact you and ask for your consent if we wish to store your personal data for a longer period of time.

After these periods have expired, we will delete or anonymise your personal data.

7. What rights do I have under the Data Protection Act?

Every data subject has the right of access to their personal data, the right to rectification or erasure, the right to restriction of processing, the right to object to data processing and – where applicable – the right to data portability. You also have the right to lodge a complaint with a competent data protection supervisory authority, where applicable.

You can withdraw your consent to the processing of your personal data at any time. Please note that such a cancellation will only be effective for the future. Processing that took place before the revocation is not affected. Such a cancellation may lead to the termination of the business relationship we have with you.

To exercise your rights, please use the contact details provided in section 12.

Please help us to ensure that your personal data is accurate and up to date: If your personal data changes, please let us know as soon as possible.

Please also note that your rights of access, cancellation or objection are not absolute, as they may not apply in certain circumstances or may be subject to exceptions. We will comply with your requests in accordance with the applicable data protection regulations. If necessary, we will also ask you to provide proof of your identity when exercising your rights. We may also ask you for additional information if your request is unclear. If we are unable to fulfil your request, we will provide you with an explanation.

8. To what extent is the decision-making process automated?

As a rule, we do not use a fully automated decision-making system for the initiation and continuation of a business relationship. Should we use such methods in certain cases, we will inform you of this separately, insofar as this is required by law.

9. Is profiling used?

In certain cases, we process your data automatically for the purpose of evaluating individual aspects of your person (profiling). For example, we use profiling in the following cases:

• We are obliged by laws and regulations to combat money laundering, terrorist financing and white-collar crime. We also analyse data for this purpose (e.g. payment transactions). In addition, we may create a customer profile in order to fulfil regulatory and contractual requirements (e.g. determining the customer investment profile in the areas of private banking and online trading). Such measures also contribute to your own protection.
• We use a scoring procedure to assess your creditworthiness. This involves calculating how likely it is that a customer will not be able to fulfil their payment obligations in accordance with the contract. This calculation may include, for example, income, expenditure, existing liabilities, occupation, employer, length of employment, experience from our previous business relationships, contractual repayment of loans and information from credit agencies. The scoring is based on a scientifically recognised mathematical-statistical procedure. The score values determined help us to decide whether we should enter into contracts for certain products and are incorporated into ongoing risk management (which means that they are also used in the course of our business relationship with you).
• So that we can provide you with information and advice on products tailored to your needs, we use analytical tools that enable needs-based communication and advertising, including market and opinion research. In this context, we may create profiles, for example by analysing which types of our products and services you use, how you would like to be contacted, etc.

10. Data security

Cornèr takes appropriate technical measures (e.g. encryption, pseudonymisation, logging, access control, data backups, etc.) and organisational measures (e.g. instructions to our employees, confidentiality agreements, checks, etc.) to ensure that the information collected and processed is protected against unauthorised access, misuse, loss, falsification and destruction. Access to your personal data is only permitted on a need-to-know basis.

Nevertheless, it is generally impossible to completely rule out security risks: Certain residual risks are usually unavoidable. As complete data security cannot be guaranteed, especially when communicating by e-mail, instant messaging or similar means of communication, we recommend that you send confidential information by particularly secure means (e.g. by post).

11. Information about your right of cancellation

11.1 Right to object to the processing of your personal data for direct marketing purposes

In certain cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

11.2 Right to object on a case-by-case basis

You have the right to object at any time to the processing of personal data concerning you that is carried out in the public interest or on the basis of a balancing of interests.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Please note that in the event of such an objection on your part, we will no longer be able to provide services for you or maintain a business relationship with you.

Your objection can be made informally and should be sent to the following address if possible:

Cornèr Banca SA, Via Canova 16, 6900 Lugano, Switzerland

E-mail: [email protected]  and [email protected]

If you use several Cornèr products or services (e.g. a bank account, a payment card, a Cornèrtrader account, etc.), please indicate which types of processing you are objecting to when exercising your right to object. If you are unclear about the scope of your objection, please contact us to clarify the matter.

12. Who is responsible for data processing and who can I contact?

Cornèr Banca SA, Via Canova 16, 6900 Lugano, Switzerland

E-mail: [email protected]  and [email protected]

If you prefer a contact person in the European Union, you can send a letter to the following e-mail address [email protected]

This policy was updated in October 2022. We reserve the right to amend it if necessary. Any changes or updates we make to this policy will be made available to you here. Please visit the Cornèr website regularly to ensure that you are always fully aware of the latest version and the data protection provisions that apply to your personal data.