Privacy statement

The Stichting Administratiekantoor Aandelen Triodos Bank ("SAAT") Privacy Statement sets out your rights and the measures SAAT will take to protect your personal data. This includes how we will use your information, what rights you have, and how the law protects you as an individual. SAAT is a Data Controller as defined under data privacy legislation.

SAAT will review and amend this privacy statement from time to time. You can always find the most up to date version on our website www.saatfoundation.com. Any terms with a specific definition used in this statement, are explained in the Glossary section.

What is personal data?

Personal data means any information relating to an individual who can be directly or indirectly identified by reference to the information.

Individuals are referred to as data subjects under data privacy legislation. A wide range of information constitutes personal data including names, contact information, fiscal identification numbers, financial information, employment details, and online identifiers often referred to as ‘cookies’ for example. This applies to both digital and paper-based information included within filing systems, or which is intended to be placed within a filing system.

What does processing mean?

The processing of personal data means any interaction with the information including viewing, collecting, sharing, storing, transferring or analysing it for instance. This can be by both a Data Controller, and a Data Processor.

Who holds your personal data?

Your personal data will be held by SAAT in The Netherlands. You can find information on how to contact us as well as further information on what SAAT does, on our website.

Why is your personal data required?

When you apply for a product or service with SAAT you will need to provide certain personal data to enable us to process your application, and to then provide the product or service you want on an on-going basis. The personal data you have provided, we have collected from you, or we have received from third parties (e.g., Triodos Bank), will be used to prevent fraud, and to verify your identity.

How will SAAT use your personal data?

The EU General Data Protection Regulation ("GDPR") legislation only allows the processing of personal data if one or more conditions are met; this is known as a lawful basis for processing.

There are six lawful bases provided in relation to the processing of personal data, which are included in the Glossary section. SAAT will only process your personal data for the reasons it was provided for, and only where there is a lawful basis for processing allowing this under current legislation.

What we use your personal data for?	Why do we need to use your personal data and which lawful basis for processing is applicable?	What are our legitimate interests in using your personal data?
To manage our relationship with you and deliver our product and services	Fulfilling a contract we have agreed between us (contract) We are legally required to complete certain activities (legal obligation, and in limited circumstances substantial public interest) Undertake activity for your and our legitimate interests (legitimate interests)	Keeping our records up to date
To run our administration properly and efficiently	We are legally required to complete certain activities (legal obligation) We have a legal duty to provide you with a fair and easy to understand service (legal obligation) Undertake activity for your and our legitimate interests (legitimate interests)	Complying with regulations that apply to us Being as efficient as we can and providing you with information you need

SAAT may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

SAAT processes your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our administrations and to comply with laws that apply to us. Such processing may also be a legal requirement or legal consequence of the services you have requested.

What personal data will SAAT use?

Details of the personal data that will be processed include, your name, contact details such as your postal or email address and phone number(s), date of birth, financial information, or device identifiers including an Internet Protocol (IP) address for example. SAAT may also hold personal data about you throughout our relationship with you. We use different types of personal data and have grouped them into the following categories:

Category of personal data	Description
Contact information	How to contact you including where you live, your telephone number and your email address (where relevant).
Personal details	Personal information such as your gender, date of birth.
Financial information	Financial information such as your bank account number and transaction history.
Contractual information	Details about the product or services we provide you.
Administrative information	Registration numbers and administrative reports.

Where will your personal data be obtained from?

SAAT collects personal data that you provide when interacting with us, from companies we use to complete financial transactions, and if you have given us consent to do so through agreeing with our cookie statement on our website, registration of your online activities.

Personal data that we have collected from you will include data you have provided when you:

Apply for our product or services;
Talk to us on the phone or in person;
Use our websites or mobile device applications;
Subscribe to a newsletter or other marketing messages;
Send us e-mails or letters; or
Take part in financial reviews, interviews, customer surveys, competitions or promotional activities.

We may also obtain your personal data from other companies we deal with if there is a lawful basis to do so, in which case you will be notified of how and why we will use them. This could include the following:

Agents working on our behalf;
Government and law enforcement agencies.

Cookies

After you have given us consent, we collect data from your personal electronic devices to register your online and mobile activities. We monitor data sessions to register your visits and use cookies to enable required functionality, increase the quality of our website or mobile services. You can read more about how we use cookies in the cookie statement included on our website and you have the option to disable cookies if required.

Who do we share your personal data with?

How will personal data be shared?

SAAT will only share your data if there is a lawful basis to do so. We will treat all your personal data as private and confidential and in accordance with data privacy legislation (even when you are no longer a customer). Information we hold about you will not be disclosed to anyone unless:

we are legally required to disclose the information. This includes sharing your information with tax authorities and law enforcement agencies;
we need to disclose the information for the purposes of or in connection with any legal proceedings, or for the purposes of obtaining legal advice, or the disclosure is otherwise necessary for the purposes of establishing, exercising or defending legal rights;
disclosure is required to protect our legitimate interests, or someone else’s legitimate interests (for example, to prevent fraud);
the disclosure is made with your consent; or
disclosure is to a third party for the purposes of providing administrative or processing services on behalf of SAAT. If this is required, we will ensure that the third party protects your personal data in the same way that we do.

Why is your personal data shared?

We may need to share your personal data with other organisations to provide you with the product or service you have chosen. For example:

Government authorities who are entitled to request your data;
Fraud prevention agencies and legal authorities;
Companies you ask us to share your data with;
If you are a depository receipt holder, we will share your information with the party responsible for managing the register of depository receipt holders. Further detail is included below.

SAAT is entitled to register the personal data of holders of depository receipts issued by SAAT. We do this under or pursuant to the terms of administration of the depository receipts. SAAT has entered into a register management agreement with Triodos Bank N.V., who in turn has entered into an agreement with Captin B.V. ("Captin") to manage the registration of the register of depository receipt holders on behalf of Triodos Bank. To enable Captin to fulfil its role as administrator of the register of depository receipt holders, Triodos Bank has shared the register with Captin.
In addition, Captin will also facilitate trading in the depository receipts through its trading platform. To enable depository receipt holders to access this platform, Captin will contact depository receipt holders on behalf of Triodos Bank.

The use of your personal data by third parties

When a third party processes your personal data on our behalf, we ensure that they follow our instructions to process and protect your personal data. Third parties are required to sign agreements in which they commit themselves to safeguard your personal data, agree to only use the data to provide services to us specifically outlined in the agreement, and follow our instructions.

Your personal data will be shared with the following categories of third parties for the purposes described:

Category of third parties	Data type	Purposes
Administrative services	Contact information, personal details, financial/contractual/transactional information	To provide you with the product or service you requested
Fraud Prevention Systems	Contact information, personal details, financial/contractual/transactional information	To help protect you from fraud
Governmental departments	Any information requested, once legal authority has been verified	To fulfil our legal and regulatory obligations

Does SAAT share your data outside of the European Economic Area?

SAAT’ default position is that we will not disclose or transfer personal data to organisations outside of the European Economic Area ("EEA"). When we do transfer personal data outside of the EEA, we will make sure that it is protected at the same level as within the EEA by using one of these safeguards:

Transfer data to organisations in non-EEA countries (or states or provinces of these countries) with privacy laws in place providing the same level of data privacy protection as within the EEA;
Put a contract in place with the recipient ensuring that they will process the data with the same level of data protection as within the EEA.

How long does SAAT keep your personal data for?

As long as you are a depository receipt holder of SAAT we will process your personal data to provide you with information and services you have asked us to provide.

If you are no longer a depository receipt holder, we may retain some or all of your personal data for up to 10 years (depending on the product or services you took out) for one or more of these reasons:

To respond to any questions or complaints;
To show that we treated you fairly; or
To meet our ongoing legal and regulatory requirements.

We may keep your personal data for longer than 10 years if we cannot delete it for legal, regulatory or technical reasons. Personal data will be retained with the utmost care and security measures will be applied to ensure your privacy and security are maintained.

What are your rights?

Your personal data is protected by legal rights. For more information or to exercise your data privacy rights, please contact us using the details included on our website.

The right to be informed

Individuals or data subjects as they are referred to under data privacy legislation, have the right to be informed about the collection, use and sharing of their personal data. Organisations must provide individuals with certain information at the time personal data is collected. This Privacy Statement provides you with the information you are entitled to, and we are required to give you.

The right to access your data

You have the right to access your data to establish what it is being used for and verify the lawfulness of any processing. Before providing access to your personal data, we will ask you to verify your identity to protect you from identity theft and financial crime. We may also need to ask you some questions to ensure we have understood your request correctly. You can request access to your personal data through our website.

The right to rectification (correcting mistakes and inaccuracies)

It is important that any personal data we use is accurate, up to date, and relevant. To ensure that your data is correct you have the right to access, correct and/or update your personal data at any time. If you think your data is incorrect or incomplete and you wish to correct your data or privacy settings, please contact us.

The right to erasure (the deletion of your personal data)

You have right to request that we delete your personal data if:

your personal data is no longer needed in relation to the purposes for which was collected;
you withdraw your consent and there are no other legal bases to process your personal data;
you object to us processing your personal data for direct marketing purposes;
you object to us processing your personal data for the legitimate interests of SAAT;
you feel that your personal data is not being processed lawfully; and
your personal data needs to be deleted to comply with legal requirements.

As an issuer of depository receipts, SAAT needs to keep your personal data for a certain period of time to remain compliant with legal and regulatory requirements.

The right to restrict processing

You have the right to request the restriction of the processing of your personal data for a limited period and under certain circumstances. For example, this could apply if you feel that your personal data held by SAAT is inaccurate, has not been processed lawfully, or is no longer needed for the purposes it was originally collected for. SAAT has the right to store your personal data while your query is investigated.

The right to data portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format. We are looking at the best way to achieve this for our customers and will provide more information when it is available.

The right to object to processing

You have the right to object to the processing of your personal data. If you decide to exercise this right, please contact us and we will consider your request.

How to Complain

Please contact SAAT in the first instance if you have any concerns with how we have processed your personal data. Details on how to do this are included in our website. You also have the right to lodge a complaint directly with the Dutch Data Protection Authority, please visit their website (https://www.autoriteitpersoonsgegevens.nl) for further details on how to do this.

Term	Definition
Cookies	A message given to an Internet Browser by a Server, which is stored in a text file; the message is then sent back to the Server each time the Browser requests a webpage to be opened. Cookies are used to identify users of webpages and to customise content where applicable.
Data Controller	An individual or organisation which determines why personal data needs to be processed, and the manner it is processed in
Dutch Data Protection Authority (Autoriteit Persoonsgegevens)	The independent Dutch authority set up to uphold data privacy rights in the public interest.
Data Processor	An individual or organisation which processes personal data on behalf of a data controller, in accordance with instructions from the data controller.
Data Subject	An individual who can be identified from the personal data i.e. the person the data is about.
European Economic Area (EEA)	The European area which provides for the free movement of persons, goods, services and capital; it is made up of EU members plus other countries within Europe which have agreements in place with the EU.
GDPR - General Data Protection Regulation	The legal framework that sets the guidelines and requirements for the collection, processing and storage of personal data of identifiable individuals within the European Union (EU). The GDPR legislation was adopted in April 2016 and came into force across the EU (including the UK) on 25 May 2018.
Lawful basis for processing	One of six allowable lawful bases for processing must be satisfied for SAAT to process your personal data. The six lawful bases are: Consent - the individual has given clear consent Contract - processing is necessary for a contract to be provided Legal obligation - processing is necessary to comply with the law Protect life - processing is necessary to protect someone’s life Public interest - processing is necessary to perform a task in the public interest Legitimate interest - processing is necessary for SAAT’ legitimate interests, or the legitimate interests of a third party, unless there is a good reason to protect the individual’s data which overrides these legitimate interests.
Personal Data	Any information relating to an identified or identifiable natural person (an individual).
Third parties	Organisations external to SAAT who undertake services and activity on our request such as our business partners, suppliers and affiliates.

Privacy Statement

SAAT

Governance

Triodos.com