You or someone representing you (for example a financial advisor, an employer or the business you work for) may give us information about you by completing forms (paper versions or through a website), concluding contractual arrangements or by contacting us by phone, post, email or otherwise. We may also receive your personal information from a third party where they have obtained your consent or have another valid legal basis to share such information. 

For the processing activities described below, personal data that is collected and processed may include:

• Full name

• Title

• Job role/description

• Address including post code

• Phone number

• E-mail address (personal and/or business)

• Date of birth

• Website username and password

• IP Address

• Information about your contact with us e.g. emails / letters, meetings and phone calls

• Aegon account number or other Aegon identifier, whether for internal or external use

• Login credentials for accessing your account with Aegon
• Personal investment information

• Cookie information collected when you visit one of our websites. Further information is available in our website Cookie Statement and SEISMIC Cookie and Tracking Statement.
  
  

Where sensitive personal data is collected and processed as part of any of the activities below, this will be stated in the relevant processing descriptions. Sensitive personal data processed may include the following:

• Copy of identification document (i.e. passport or ID card)

• Social security number

• Bank account details
  
  

When collecting and processing personal data, we will only process the minimum amount of personal data relevant to the specific purpose it is collected for. We will only use the data for the original purpose for which it was collected (stated below) or a further purpose which you have consented to or that is compatible with the original purpose for which it was collected and that is likely to be in line with your expectations regarding the processing of that data.

If we do not receive all the required personal data, we might not be able to fully meet our processing needs, including regulatory requirements, and therefore may not be able to provide our full range of products and services.

Conducting due diligence reviews and assessments prior to establishing, during the course of,  business relationships

This includes anti-money laundering, sanctions and politically exposed persons (“PEP”) reviews. This processing is conducted to detect and prevent financial crime and help us meet our legal and regulatory obligations. In the event of other checks these will be conducted to execute an agreement. We conduct these reviews with the assistance of a third-party which compares personal data against various official sanctions and PEP lists. The results of these reviews will be considered by a member of our staff in determining whether to conduct business with or provide a service to a person or company.

This processing may include collecting (sensitive) personal data including copies of identification documents, and providing or disclosing such data to other entities within Aegon Asset Management, the Aegon group of companies and appointed suppliers and their appropriate affiliates. Personal data may also be provided or disclosed to supervisory/regulatory or other governmental authorities in certain circumstances.

Performing services we have agreed to provide.

This includes processing your instructions and account transactions, settling those transactions, assessing investments and markets, administering external investment managers, managing investment portfolios, monitoring investment portfolios and managing risks associated with an account or product, including areas of regulatory compliance. This processing is imperative to us providing the requested service and executing the agreement between us.

Servicing, and managing relationships with, existing and prospective,  customers, clients and investors

This includes managing and administering existing and prospective customer, client and investor relationships, handling queries and complaints, managing any incidents/issues encountered, providing account reporting, detecting fraud, and providing online services including our websites. This processing is required for us to provide the service agreed under our agreement and ensure the integrity of any account you have with us. Some of the processing will be based on a legal obligation. These relationships may be maintained by phone, mail, e-mail, personal contact and fax where appropriate (see the section below titled ‘Communicating with us’ ).

Developing and improving our products and services.

This includes reviewing our existing offering of products and services, making required improvements and launching new products/services. Personal data may also be processed when we develop our appropriate business strategies and systems internally. Where these processes include personal information, they are conducted in our legitimate interest to ensure we provide the best products and services for our customers. We are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and that the least intrusive approach is followed.

The data may be provided or disclosed to entities within the Aegon Group. More information can be found in the section titled ’Disclosing your personal data’.

Managing relationships with third-parties that support our business (e.g., vendors,  suppliers, service providers)

Personal data will be processed in order to assess,  obtain, and use services provided by third-party companies, to manage  our relationships with those companies (including where they act as our data processor) and reporting and performance analysis on these relationships. These processes may also require providing or disclosing personal data to other entities within the Aegon group of companies as well as consulting publicly available records. These processes are conducted to ensure appropriate execution of the agreement between the parties and between us and our customers, as well as being in our legitimate interests to be able to utilise third-party services when providing its products and services to customers in the best way possible.

Where appropriate, these processes may include the use of any sensitive data provided on copies of identification documents.

More information can be found in the section titled  ‘Disclosing your personal data’.

Internal management reporting and support functions

This includes the provision of legal and regulatory support and advice (both internal and external), internal auditing, strategy development, providing and maintaining IT solutions, risk control, and other operational matters. This also includes processing required to effectively manage data including scanning, classification and labelling. Most of these processes are conducted to execute activities vital to the internal management and improvement of our business and are imperative to the performance of our agreements with customers and suppliers, however some will be conducted to meet our legitimate interests of being an efficiently operating company. Where this is the case, we are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and the least intrusive approach is followed. Others will be conducted to fulfil a legal/ compliance or regulatory obligation. Personal data may be provided or disclosed to other entities within the Aegon Group, including Aegon Global Technology Services who acts as a data processor of any personal data handled or processed when providing IT and technology solutions. Personal data may also be provided or disclosed to third parties including external law firms, accountants, technology providers and auditors.

More information can be found in the section titled ‘Disclosing your personal data’

Managing relationships with governments, regulators and supervisory authorities, and complying with legal and regulatory obligations

This includes responding to requests and providing regular and ad hoc reporting. These processes are conducted to fulfil a legal and regulatory obligation of the company. Where personal data, including sensitive personal data, needs to be processed in order to fulfil these obligations it will be conducted in line with this privacy statement including when processing involves third parties and entities within Aegon Asset Management, appointed suppliers and the Aegon Group.

More information can be found in the section titled 'Disclosing your personal data’.

Marketing to existing and prospective customers, clients and investors

This includes execution and analysis of marketing campaigns, surveys and strategies, promoting products and services provided by AIM and affiliated Aegon Asset Management companies, running and contributing to promotional events and the use of ad hoc competitions and promotions.

We may use personal data to send you marketing information and news about our products and services that may be of interest to you, unless you have opted out of marketing.

For prospective clients linked to our Frankfurt and Madrid offices, we will ensure that we obtain consent in order to send you marketing information and news about our products and services that may be of interest to you or your clients, as well as invite you to relevant events. 

We may conduct marketing with our customers (including business partners) based on our legitimate interest to share product and service information with them for them to take it into account when providing a related service. We may also conduct marketing related analytics which can include elements of profiling and automated decision making (eg. placing customers into groups with similar customers based on certain characteristics) which can affect the products, services or features we offer a customer and is conducted based on our legitimate interest to ensure we provide customers with the  appropriate marketing information that is most relevant to them. These analytics may include additional (personal) information obtained from third parties where we consider the use of this data as fair and legal.

When conducting these activities based on our legitimate interests we will ensure that the least intrusive method is used and that we feel the recipient would reasonably expect this processing to take place or to receive marketing of this type. Customers will be able to opt out of marketing from us at any point or object to certain types of marketing related processing by contacting us.

Your personal data will only be provided or disclosed to external third parties for marketing purposes where you have agreed to do so. We will not sell your personal information to other organisations for marketing purposes.

When running or contributing to promotional events we may need to collect personal information in relation dietary and access needs, but this information will only be used for the purposes confirmed at the time of collection. 

Marketing communications will be conducted using various channels such as mail, phone and email. 

You can withdraw your consent or opt-out of marketing at any time by contacting us (see section ‘Your Rights’).  The withdrawal of consent to specific processing of personal data, including for the purposes of marketing, does not affect the processing based on consent before the withdrawal. It will also not affect the provision of other products and services unrelated to the process for which you have withdrawn consent. Objecting to processing related to marketing may impact the service we are otherwise able to provide to customers.

Operating and managing our channels of communication, such as our website (for example, through the use of Cookies)

We also collect information using cookies and other website tracking technologies. Cookies are small files which save and retrieve information about your visit(s) to our websites – for example, your computer and browser details, how you entered our site(s), how you navigated through the site(s), and what information you accessed.

Read more about how we use cookies in our website Cookie Statement and SEISMIC Cookie and Tracking Statement.

In order to conduct the processing activities described in this statement and allow us to verify the content of calls, telephone lines are recorded whenever you contact or are contacted by a member of our Investment and Portfolio Management team, Sales and Marketing team and Account management team. This will be conducted using the same legal basis as confirmed for the specific processing activity unless stated otherwise.

All emails, SMS/MMS, and other electronic communications sent to or from any member of our staff will be retained and may be monitored to complete the respective processing activities or achieve the processing purposes stated in this statement. Only the appropriate staff members are authorised to monitor or review such communications in line with their job role.

As a global organization, personal data we collect may be transferred internationally throughout Aegon’s worldwide organization. Your personal data will be exchanged within the Aegon Group of companies (meaning all subsidiaries and affiliates of Aegon Ltd.), including and predominantly within the Aegon Asset Management group (the entities within the Aegon group that are responsible for asset management activities) including Aegon Asset Management UK plc , Aegon Asset Management Hungary B.V., Aegon Asset Management (Asia) Limited, Aegon USA Investment Management LLC and Aegon USA Realty Advisors LLC.

We provide or disclose your personal data to others for the purposes mentioned in this statement and to have a complete overview of our contacts and contracts within the Aegon group. We may also provide or disclose your personal data to others to offer you a complete package of services and products. This will be handled in line with the description above on how we provide marketing to customers and prospects. Providing or disclosing personal data within the Aegon group of companies is done in line with applicable regulatory requirements and we will ensure the appropriate technical and organisational measures are in place.

Our employees are authorized to access personal data only to the extent necessary to perform their job.

Disclosing your personal data to third parties

In connection with the operation of our business, we work with a variety of third parties. The following types of third parties have or could be granted access to your personal data where relevant for the processing activities described in this privacy statement

• Governments
• Regulators and supervisory authorities – including, but not limited to, the Autoriteit Financiële Markten (AFM), De Nederlandsche Bank (DNB) and Autoriteit Persoonsgegevens (AP), the US Securities & Exchange Commission (SEC), Financial Intelligence Unit (FIU), Deutsche Bundesbank, Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), Der Hessische Beauftragte für Datensschutz und Informationsfreiheit, Amtsgericht Frankfurt am Main, Industrie und Handelskammer Frankfurt am Main, Finanzamt Frankfurt am Main (Tax), Bundesagentur für Arbeit, Comisión Nacional Mercados de Valores, SEPBLAC (AML), Agencia Tributaria (Tax)
• Banks
• Transfer Agencies – including Citi Group
• Affiliated and unaffiliated technology suppliers – including Aegon Global Technology Services (GTS), Microsoft and Amazon Web Services (AWS), OneTrust and SEISMIC
• Research and consultancy intermediaries
• Client Relationship Management (CRM) tool providers – including SalesForce
• Accountants
• Auditors
• External legal counsel
• Storage facilities – including Iron Mountain
• Mailing houses
• Mailing houses, email providers and event organisers,
• Third-party service providers , including fund administrators

 
When third parties are given access to your personal data, we will implement such contractual, technical and organizational measures as may be legally required to ensure that your personal data is processed by such third parties in accordance with applicable law and only to the extent necessary to achieve the purposes for which the data has been disclosed.

In some situations, for example anti-money laundering/ sanctions screenings/checks, the transfer agencies may be acting as data controller. In this situation the Transfer agency will determine the means for processing personal data and will provide a data privacy statement/notice.

In other cases, your personal data will not be supplied to third parties, except:

• to the extent that we are required to do so by law, by a government body or by a law enforcement agency, or for crime prevention purposes (including financial crime protection and credit risk reduction);
• when protecting your interests or the interests of other individuals or for reasons of substantial public interest;
• in connection with any legal proceedings (including prospective legal proceedings);
• in order to establish or defend our legal rights;
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets and for the purposes of effecting any sale or purchase; or
•  if we, or substantially all of our assets, are acquired by a third party, we may disclose your personal data to that third party in connection with the acquisition.

The use of personal data by data processors

When a third party processes your personal data solely following our instructions, it acts as a data processor. We enter into an agreement (DPA) with such a data processor concerning the processing of personal data. In this DPA we include obligations to safeguard that your personal data is solely provided to the data processor to provide specific services to us and the data is afforded a sufficient level of protection.

Affiliates and third parties with which we provide or disclose personal data are situated in a variety of locations, including, most notably the UK, EU, US and India.

If your personal data is transferred to a recipient n country which the EU has not granted data protection adequacy status, we will take measures to ensure that your personal data is adequately protected in accordance with EU laws and regulations, such as entering into EU Standard Contractual Clauses / /International Data Transfer Agreements with these parties, as appropriate, in the form approved by the NL data protection regulator.

Note that as of 10 July 2023, transfers from the EU to US companies participating in the EU-US Data Privacy Framework have adequacy status under EU law.

You can view the current EU Standard Contractual Clauses template on the European Commission website HERE and you can request to see a copy of a specific set of EU Standard Contract Clauses utilised by AIM by contacting our DPO.

Data subjects may also contact our DPO to obtain information about the categories of personal data transferred to, and the location of, a specific data recipient.

We will keep your personal information only as long as necessary to complete the processes mentioned in this privacy statement, including where data is provided or disclosed to third parties. In addition, we may keep and use your personal data for purpose compatible with the original reasons for collecting and processing it.  We will also keep personal information following conclusion of our relationship to comply with our legal and regulatory obligations (generally for between 5-8 years after the last product/service). Where there is no legal, regulatory or business reason to keep your data it will be securely deleted, destroyed or anonymised. We regularly review the applicable retention periods within our Records Retention Policy to ensure regulatory compliance.

We implement functional, technical, physical and organizational measures to protect the personal data that we have under our control from:

• Unauthorized access and alteration;

• Improper disclosure; and

• Accidental or unlawful destruction or loss.

We implement information security policies, conduct staff training, and strive to ensure the security of our information technology and the personal data under our control. Employees and service providers who have access to personal data under our control are obliged to protect it and keep it confidential, except as otherwise agreed by us in accordance with applicable laws and regulations.

Of course, no network or system (including the internet) is entirely secure, and despite the measures described above, we cannot guarantee the security of networks and systems we operate or use, that are operated on our behalf or that are used by third parties with whom we have relationships (such as clients, customers, investors, vendors, suppliers, service providers, and governmental authorities),  including the security of email and other electronic transmissions of data.  

If a data breach does happen and we determine  there isa high risk to your personal rights and freedoms, we will contact you in accordance with our data breach notification procedures and applicable laws and regulations.

You, as a data subject, have a number of rights including:

• the right to request a copy of the personal data we hold on you. ( Requesting this information is known as making a Data Subject Access Request (DSAR). In most cases, this will be free of charge, however in some limited circumstances, for example, repeated requests for further copies, we may apply an administration fee);

• the right to have inaccurate personal data corrected;

• the right to have out of date personal data deleted once there is no business need or legal requirement for us to hold it;

• the right to object to or restrict some processing, in limited circumstances and only when we do not have legitimate grounds to continue processing your personal data;

• the right to object to your personal data being used to send you marketing material. As mentioned above, generally we will only send you marketing material where you have given us your consent to do so or where we believe there is a legitimate reason for doing so. You can withdraw your consent at any time;

• the right to have personal data that you provided us with transferred to another service provider in electronic form in certain scenarios; and

• the right to ask for a decision to be made manually, where a decision is made by automated means and this adversely impacts you.

To exercise any of these rights, please contact Account Management or our Data Protection Office.

When requesting to exercise your rights, we will take into account other conflicting obligations we may have as well as the rights of other data subjects. As a result, there is a chance that your request may be only partially fulfilled or in limited circumstances it may be rejected completely. If this happens, an explanation will be provided to you.

If you wish to exercise your rights in relation to the processing of your personal data conducted by one of our processors or joint controllers then please contact us in the first instance.

If you believe we have not processed your personal data in accordance with our data protection obligations, and that you have been affected by our non-compliance, you can make a complaint to us by contacting our Data Protection Office. If you are not satisfied with our response, you can raise a complaint with the Autoriteit Persoonsgegevens, the independent authority set up to enforce the data protection regulations.

From time to time we may make changes to this privacy statement. If we make any changes to this privacy statement and the way in which we use your personal data we will post these changes on this page and where the changes are significant we will do our best to notify you.

_{This privacy statement was last updated in December, 2024.}