Customer Information on Data Protection

This information on data protection (the "Information") is directed at existing and new customers of Exchange Services. This Information thus applies to recipients who are customers of one or several of the following legal entities of SIX Group Ltd ("SIX Group"):

SIX Corporate Bonds Ltd
SIX Exfeed Ltd
SIX Repo Ltd
SIX SIS Ltd
SIX Swiss Exchange Ltd
SIX Terravis Ltd
SIX Trade Repository Ltd
SIX x-clear Ltd

The legal entities of the SIX Group above will be referred to in the following individually as "SIX Company" or jointly as "SIX Companies" unless certain statements apply solely to (a) specific legal entity/ies. In such cases, the SIX Company in question will be referred to by name.

This Information is aimed to notify customers about:

which personal data ("Data") made available by customers is being processed by SIX Companies,
for what purpose and on what basis SIX Companies are doing this,
how and how long Data is processed,
what data protection rights customers have vis-à-vis SIX Companies, and

the unit responsible for the Data processing within a SIX Company and whom customers can contact in case of questions.

SIX Companies process Data that is transferred or made available to them by the customer for the purpose of contract execution within the framework of business relationships. This applies to details about contact persons such as their names, e-mail addresses or business telephone numbers.

By disclosing the above Data to the SIX Company, the customer confirms to have notified the natural persons in question (employees, agents, etc.) whose Data he/she is disclosing to the SIX Company about the transfer of Data to the SIX Company.

Yes. SIX x-clear Ltd and SIX SIS Ltd are subject to Swiss anti-money laundering legislation and are in this respect obliged by law to perform extensive investigations and to process other Data collected in this connection as part of their business activities prior to entering into and maintaining customer relationships. SIX x-clear Ltd and SIX SIS Ltd collect Data about participants, Data about the parties initiating business relationships, Data about accountholders or beneficial owners (where required) and Data about authorized signatories. This is carried out mainly by means of copies of identity cards/passports or by the completion of standard forms.

The Data is processed by SIX Companies exclusively for the purpose of executing contracts with customers. The specific use of the Data depends on the contract concluded between the customer and a SIX Company. The SIX Companies particularly require the Data for:

generally maintaining the customer relationship;
sending products and information that they are contractually obliged to provide;
billing purposes;
processing objections or complaints made by the customer;
providing the customer with information about changes and developments of products and services.

Under no circumstances do SIX Companies process the Data outside of their contractual relationships with customers.

A SIX Company processes the Data primarily in its own legitimate interests, particularly to ensure adherence to customer contracts and regulatory compliance.

All SIX Companies are directly or indirectly wholly owned subsidiaries of SIX Group. SIX Companies can outsource all or some of the processing of the Data and other services to SIX Group or other subsidiaries (incl. SIX Companies) of SIX Group and to external third parties in Switzerland and abroad.

If Data is transmitted to SIX Group, subsidiaries of SIX Group or external third parties as part of such outsourcing, the outsourcing SIX Company obligates the recipient in advance to wholly guarantee compliance with the existing confidentiality and data protection obligations of the outsourcing SIX Company.

Each SIX Company reserves the right to disclose personal Data to the authorities and/or third parties in Switzerland or abroad if the SIX Company is obliged to make such disclosure by the applicable legal provisions.

As part of the execution of their contracts with customers, SIX Companies may cooperate with third parties (e.g. suppliers) that provide some of their services or produce some of their products outside the EU, EEA or Switzerland.

If such third parties could obtain access to Data as part of the execution of the contract, a respective SIX Company and the third party provider will enter into a written agreement ensuring data protection equivalent to the data protection level required by EU and Swiss data protection regulation. Upon request, customers may view contractual arrangements (excerpts) a SIX Company has implemented with third parties that actually process such customer’s Data.

The SIX Companies in the Securities & Exchanges business unit have their registered office in Switzerland. Data is normally stored in Switzerland for ten years beyond the end of a contractual relationship with the customer.

Data Subjects are entitled to the following rights concerning Data about the Data Subject:

to receive information on whether and which Data a SIX Company may save or store (categories of Data, recipients or categories of recipients, storage duration, or criteria governing such duration);
to obtain a copy of Data processed by SIX Companies;
to request the rectification of Data if it is incorrect;
to request the deletion of Data;
to request restrictions on the processing of Data;
to receive Data in a structured, accessible and machine-readable format;
to submit an objection to processing of Data, especially for the purpose of direct advertising.

The rights specified above may be denied or restricted if the interests, rights and freedoms of third parties prevail or if processing of Data is necessary to establish, exercise or defend any legal claims of SIX Companies.

Yes. All questions relating to data protection and the rights of Data Subjects can be directed to the Data Protection Officer (DPO) of SIX Group at the following contact address:

SIX
Compliance
Hardturmstrasse 201
8005 Zurich
Switzerland

dataprotection@six-group.com

The following central unit is responsible for the processing of Data for Exchange Services:

SIX
Exchange Services
Business Management & Services – Data Protection
Pfingstweidstrasse 110
8005 Zurich
Switzerland