You or someone representing you, for example a financial advisor, an employer or the business you work for, may give us information about you by completing forms (paper versions or through a website), concluding contractual arrangements or by contacting us by phone, post, email or otherwise. We may also receive your personal information from a third party where they have obtained your consent or have another valid legal basis to share such information. Alternatively, you may have provided the information to us directly.

For the processing activities described below, the personal data that is gathered and processed may include:

• Full name 
• Title 
• Address including post code 
• Phone number 
• E-mail address (personal and/or business) 
• Date of birth 
• Website username and password 
• IP Address 
• Information about your contact with us e.g. emails / letters, meetings and phone calls 
• Aegon account number or other identifier, whether for internal or external use 
• Login credentials for accessing your account with Aegon
• Personal investment information 
• Cookie information collected when you visit one of our websites. Further information is available in our website Cookie Statement and SEISMIC Cookie and Tracking Statement.

Where sensitive personal data is collected and processed as part of any of the activities below, this will be stated in the relevant processing descriptions. Sensitive personal data processed may include the following:

• Copy of identification document (e.g. Passport, ID card, utility bill)
• National Insurance number or social security number
• Bank account details

When collecting and processing personal data, we will only process the minimum amount of personal data relevant to the specific purpose it is collected for. We will only use the data for the original purpose for which it was collected (stated below) or a further purpose which you have consented to or that is compatible with the original purpose for which it was collected and that is likely to be in line with your expectations regarding the processing of that data.

If certain elements of personal data are not provided, then we may not be able to conduct all relevant processing required (including meeting regulatory requirements) and as such not be able to provide the full range of products and services.

Conducting checks and assessments prior to doing business

This will include Anti-Money Laundering checks as well as screening personal data against known sanctions and politically exposed persons (“PEP”) lists. This processing is conducted to detect and prevent financial crime. It is also necessary for us to meet our legal and regulatory obligations as a company. We, and / or our transfer agency, conduct the screening check automatically using third-party systems provided by FinScan,CitiScreening and WorldCheck which compares personal data against a number of official sanctions lists and PEP lists. Your details will also be checked with a credit rating company like Experian as part of the investor account opening process. The result of these checks will be considered by a member of our, or the transfer agency, staff in determining whether we can proceed with conducting business/providing a service or not. 

This processing may require the collecting and sharing of (sensitive) personal data including copies of identification documents, with other entities within Aegon Asset Management, the Aegon group of companies and appointed suppliers and their appropriate affiliates. Data may also need to be shared with supervisory authorities in certain circumstances. 

The administration of the service we have agreed to provide.

This includes processing your instructions and account transactions, settling those transactions and related distributions, reconciling accounts, assessing investments and markets, administering external investment managers, managing investment portfolios, monitoring investment portfolios and managing risks associated with an account or product, including areas of regulatory compliance. This processing is imperative to us providing the requested service and executing the agreement between us.

In order for us to process and settle any personal transactions we may need to collect your bank account details. 

Servicing our customers and prospective customers.

This includes managing existing and prospective customer relationships, handling queries and complaints, managing any incidents/issues encountered, providing account reporting, detecting fraud, and providing online services including our websites. This processing is required for us to provide the service agreed under our agreement and ensure the integrity of any account you have with us. Some of the processing will be based on a legal obligation. Customer relationships may be maintained by phone, mail, e-mail, account messages, personal contact and fax where appropriate (see the section below titled ‘Being in contact with us).

To develop our products and services.

This includes reviewing our existing offering of products and services, making required improvements and launching new products/services. Personal data may also be processed when we develop our appropriate business strategies and systems internally. Where these processes include personal information they are conducted in our legitimate interest to ensure we provide the best products and services for our customers. We are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and that the least intrusive approach is followed.

The data may be shared with other entities within Aegon Asset Management, appointed suppliers and the Aegon group of companies. More information can be found in the section titled 'Sharing your personal data’.

Managing third party and supplier relationships.

Personal data may be processed in order to assess and obtain services provided by a third party company, to manage the relationship between the companies (including where they act as our data processor) and reporting and performance analysis on these relationships. These processes may also require sharing personal information with other entities within Aegon Asset Management, appointed suppliers and the Aegon group of companies as well as consulting publicly available records. These processes are conducted to ensure appropriate execution of the agreement between the parties and between us and our customers, as well as being in our legitimate interests to be able to utilise third party services when providing its products and services to customers in the best way possible.

Where appropriate, these processes may include the use of any sensitive data provided on copies of identification documents.

More information can be found in the section titled 'Sharing your personal data’.

Internal management reporting and support functions

This includes the provision of legal and regulatory support and advice (both internal and external), internal auditing, strategy development and providing and maintaining IT solutions. Also includes processing required to effectively manage data including scanning, classification and labelling. Most of these processes are conducted to execute activities vital to the internal management and improvement of our business and are imperative to the performance of our agreements with customers and suppliers, however some will be conducted to meet our legitimate interests as a company. Where this is the case, we are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and the least intrusive approach is followed. Others will be conducted to fulfil a legal or regulatory obligation. Personal data may be shared with other entities within the Aegon group of companies, including Aegon Global Technology Services who act as a data processor of any personal data handled or processed when providing IT and technology solutions. Personal data may also be shared with third parties including external law firms, accountants, technology providers and auditors.

More information can be found in the section titled 'Sharing your personal data’.

Managing relationships with governments and supervisory authorities

This includes responding to requests and providing regular and ad hoc reporting. These processes are conducted to fulfil a legal and regulatory obligation of the company. Where personal data, including sensitive personal data, needs to be processed in order to fulfil these obligations it will be conducted in line with this privacy statement including when processing involves third parties and entities within Aegon Asset Management, appointed suppliers and the Aegon group of companies

More information can be found in the section titled 'Sharing your personal data’.

Marketing to our customers and prospects

This will include the execution and analysis of marketing campaigns, surveys and strategies, promoting products and services provided by Aegon AM UK and affiliated Aegon Asset Management companies, running and contributing to promotional events and the use of ad hoc competitions and promotions.

We may use the personal data we have to send you marketing information and news about our products and services that may be of interest to you, unless you have opted out of marketing.

We may conduct marketing with our customers (including business partners) based on our legitimate interest to share product and service information with them for them to take it into account when providing a related service. We may also conduct marketing related analytics which can include elements of profiling and automated decision making (eg. placing customers in to groups with similar customers based on certain characteristics) which can affect the products, services or features we offer a customer and is conducted based on our legitimate interest to ensure we provide customers with the  appropriate marketing information that is most relevant to them. These analytics may include additional (personal) information obtained from third parties where we consider the use of this data as fair and legal.

When conducting these activities based on our legitimate interests we will ensure that the least intrusive method is used and that we feel the recipient would reasonably expect this processing to take place or to receive marketing of this type. Customers will be able to opt out of marketing from us at any point or object to certain types of marketing related processing by contacting us.

Your personal data will only be shared with external third parties for marketing purposes where you have agreed to do so. We will not sell your personal information to other organisations for marketing purposes.

When running or contributing to promotional events we may need to collect personal information in relation to dietary and access needs, but this information will only be used for the purposes confirmed at the time of collection.  

Marketing communications will be conducted using various channels such as mail, phone and email. 

Please remember that you can withdraw your consent or opt-out of marketing at any time by contacting us (see section 'Your Rights'). The withdrawal of consent to specific processing of personal data, including for the purposes of marketing, does not affect the processing based on consent before the withdrawal. It will also not affect the provision of other products and services unrelated to the process for which you have withdrawn consent. Objecting to processing related to marketing may impact the service we are otherwise able to provide to customers.

Cookies

We also collect information using cookies and related website tracking technology. Cookies are small files which save and retrieve information about your visit to this website – for example, how you entered our site, how you navigated through the site, and what information was of interest of you.

Read more about how we use cookies in our website Cookie Statement and SEISMIC Cookie and Tracking Statement.

In order to conduct the processing activities stated in this statement and allow us to verify the content of calls, telephone lines are recorded whenever you contact or are contacted by a member of our Investment and Portfolio Management team, Client Support teams, Sales and Account management team. This will be conducted using the same legal basis as confirmed for the specific processing activity unless stated otherwise.

All emails or electronic communications sent to or from any member of our staff will be retained and may be monitored to complete the respective processing activities or achieve the processing purposes stated in this statement. Only the appropriate staff members are authorised to monitor or review email or message content in line with their job role.

Disclosing your personal data within the Aegon group

As a global organization, personal data we collect may be transferred throughout Aegon’s worldwide organization (meaning all subsidiaries and affiliates of Aegon N.V.), including the Aegon Asset Management group (the entities within the Aegon group that are responsible for asset management activities) including Aegon Investment Management B.V., Aegon Asset Management Hungary B.V., Aegon Asset Management (Asia) Limited, Aegon Privacy Fund Management (Shanghai) Co. Ltd, Aegon USA Investment Management LLC and Aegon USA Realty Advisors LLC.

We share your data for the purposes mentioned in this statement and to have a complete overview of our contacts and contracts within the Aegon group. We may also share your data to offer you a complete package of services and products. This will be handled in line with the description above on how we provide marketing to customers and prospects. When sharing data within the Aegon group of companies this will be conducted in line with applicable regulatory requirements and we will ensure the appropriate technical and organisational measures are in place.

If your personal data is transferred within the Aegon group to a country where the local regulation does not reach the UK adequate level of protection of personal data, we will take measures to ensure that your personal data is adequately protected, such as entering into international data transfer arrangements with these parties in the form approved by the UK data protection regulator. 

Our employees are authorized to access personal data only to the extent necessary to perform their job.

Disclosing your personal data to third parties

We work with carefully selected providers that carry out certain functions on our behalf and cooperate with relevant authorities. The following types of third parties have or could be granted access to your personal data where relevant for the processing described above.

• Governments
• Supervisory authorities – including the Financial Conduct Authority (FCA), Her Majesty’s Revenues and Customs (HMRC), the Financial Ombudsman Service (FOS), Information Commissioners Office (ICO), the US Securities & Exchange Commission (SEC), Autoriteit Financiële Markten (AFM) and De Nederlandsche Bank (DNB).
• Banks
• Affiliated and unaffiliated technology suppliers – including Aegon Global Technology Services (GTS), Microsoft, Amazon Web Services, Snowflake, Fishtank, OneTrust and SEISMIC
• Client Relationship Management tool providers – including Salesforce
• Accountants
• Transfer Agencies – including Citibank NA and Northern Trust
• Auditors
• External legal counsel
• Storage facilities – including Iron Mountain
• Credit Agencies and Reference Agencies
• Mailing houses, email providers and event organisers

When third parties are given access to your personal data we will do so in accordance with our obligations to keep information safe and secure, including implementing contractual, technical and organizational measures where required. In some situations, for example anti-money laundering checks, the transfer agencies may be acting as data controller. In this situation the transfer agency will determine the means for processing personal data and will provide a data privacy statement/notice.

If your personal data is transferred to a third party recipient in a country where the local regulation does not provide an adequate level of protection of personal data consistent with UK or EU law, we will take measures to help ensure that your personal data is adequately protected, such as entering into UK-compliant contractual arrangements with that party.

You can view the current international data transfer arrangement forms approved by the UK data protection regulator on its website HERE and you can request to see a copy of a specific international data transfer arrangement utilised by Aegon AM UK by contacting our DPO.

In other cases, your personal data will not be supplied to third parties, except:

• to the extent that we are required to do so by law, by a government body or by a law enforcement agency, or for crime prevention purposes (including financial crime protection and credit risk reduction).
• when protecting your interests or the interests of other individuals or for reasons of substantial public interest;
• in connection with any legal proceedings (including prospective legal proceedings);
• in order to establish or defend our legal rights;
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets and for the purposes of effecting any sale or purchase; or
• if we, or substantially all of our assets, are acquired by a third party, we may disclose your personal data to that third party in connection with the acquisition.

The use of your personal data by data processors

When a third party processes your personal data solely following our instructions, it acts as a data processor. We enter into an agreement with such a data processor concerning the processing of personal data. In this agreement we include obligations to safeguard that your personal data is solely provided to the data processor to provide specific services to us, and the data is afforded a sufficient level of protection.

We will keep your personal information only if necessary to complete the processes mentioned in this privacy statement, including where data is shared with third parties. In addition, we will keep your personal information where we have legitimate interest for marketing purposes while you are a prospective customer. We will also keep personal information following conclusion of our relationship to comply with our legal and regulatory obligations (generally for between 5-8 years after the last product/service). Where there is no legal, regulatory or business reason to keep your data it will be securely deleted, destroyed or anonymised. We regularly review the applicable retention periods to ensure regulatory compliance.

We have implemented functional, technical, physical and organizational measures to protect the personal data that we have under our control from:

• Unauthorized access and alteration.
• Improper disclosure; and
• Accidental or unlawful destruction or loss.

We have information security policies, staff training and secure servers. All our employees and service providers who have access to personal information are obliged to protect it and keep it confidential.

Of course, no network or system (including the internet) is entirely secure, and despite the measures described above, we cannot guarantee the security of networks and systems we operate or use, or that are operated on our behalf (including the security of email or other transmissions of data).

In the event that a data breach results in there being a high risk to your personal rights and freedoms we will contact you in accordance with our data breach notification procedures.

You, as a data subject, have a number of rights including:

• the right to request a copy of the personal data we hold on you. (Example; when you request this information, this is known as making a Subject Access Request (SAR). In most cases, this will be free of charge, however in some limited circumstances, for example, repeated requests for further copies, we may apply an administration fee);
• the right to have any inaccurate personal data corrected;
• the right to have any out of date personal data deleted once there is no business need or legal requirement for us to hold it;
• the right to object to or restrict some processing, in limited circumstances and only when we do not have legitimate grounds to continue processing your personal data;
• the right to object to your personal data being used to send you marketing material. As mentioned above, generally we will only send you marketing material where you have given us your consent to do so or where we believe there is a legitimate reason for doing so. You can withdraw your consent at any time;
• the right to have personal data that you provided us with transferred to another service provider in electronic form in certain scenarios; and
• the right to ask for a decision to be made manually, where a decision is made using automated means and this adversely impacts you.

To exercise any of these rights, please contact our Data Protection Office.

When requesting to exercise your rights, we will take into account other conflicting obligations we may have as well as the rights of other data subjects. As a result, there is a chance that your request may be partially fulfilled or in limited circumstances rejected. If this is the case an explanation will be provided to you.

If you wish to exercise your rights in relation to the processing of your personal data conducted by one of our processors or associated co-controllers then please contact us in the first instance.

If you are a California resident, please refer to our California Consumer Privacy Act Disclosure & Statement of Rights for more privacy-related disclosures and additional information about your privacy rights and our privacy practices.

If you believe we have not processed your personal data in accordance with our data protection obligations, and that you have been affected by our non-compliance, you can make a complaint to us by contacting our Data Protection Office. If you are not satisfied with our response, you can raise a complaint with the Information Commissioners Office, the independent authority set up to enforce the data protection regulations.

From time to time we may make changes to this privacy statement. If we make any changes to this privacy statement and the way in which we use your personal data we will post these changes on this page and where the changes are significant we will do our best to notify you.

_{This privacy statement was last updated in December 2022.}