You or someone representing you, for example a financial advisor, an employer or the business you work for, may give us information about you by completing forms (paper versions or through a website), concluding contractual arrangements or by contacting us by phone, post, email or otherwise. We may also receive your personal information from a third party where they have obtained your consent or have another valid legal basis to share such information. Alternatively, you may have provided the information to us directly.

For the processing activities described below, the personal data that is gathered and processed may include:

• Full name
• Title
• Job role/description
• Address including post code
• Phone number
• E-mail address (personal and/or business)
• Date of birth
• Website username and password
• IP Address
• Information about your contact with us e.g. emails / letters, meetings and phone calls
• Aegon account number or other Aegon identifier, whether for internal or external use
• Cookie information collected when you visit one of our websites. Further information is available in our website Cookie Statement and SEISMIC Cookie and Tracking Statement.

Where sensitive personal data is collected and processed as part of any of the activities below, this will be stated in the relevant processing descriptions. Sensitive personal data processed may include the following:

• Copy of identification document (i.e. passport or ID card)
• Social security number

When collecting and processing personal data, we will only process the minimum amount of personal data relevant to the specific purpose it is collected for. We will only use the data for the original purpose for which it was collected (stated below) or a further purpose which you have consented to or that is compatible with the original purpose for which it was collected and that is likely to be in line with your expectations regarding the processing of that data.

If certain elements of personal data are not provided, then we may not be able to conduct all relevant processing required (including meeting regulatory requirements) and as such not be able to provide the full range of products and services.

Conducting checks and assessments prior to doing business

This includes anti-money laundering, sanctions and politically exposed persons (“PEP”) reviews. This processing is conducted to detect and prevent financial crime and help us meet our legal and regulatory obligations. In the event of other checks these will be conducted to execute an agreement. We conduct these reviews with the assistance of a third-party system provided by FinScan which compares personal data against various official sanctions and PEP lists. The results of these reviews will be considered by a member of our staff in determining whether to conduct business with or provide a service to a person or company.

This processing may include collecting (sensitive) personal data including copies of identification documents, and providing or disclosing such data to other entities within Aegon Asset Management, the Aegon group of companies and appointed suppliers and their appropriate affiliates. Personal data may also be provided or disclosed to supervisory/regulatory or other governmental authorities in certain circumstances.

The administration of the service we have agreed to provide.

This includes processing your instructions and account transactions, settling those transactions, assessing investments and markets, administering external investment managers, managing investment portfolios, monitoring investment portfolios and managing risks associated with an account or product, including areas of regulatory compliance. This processing is imperative to us providing the requested service and executing the agreement between us.

Servicing our customers and prospective customers.

This includes managing existing and prospective customer relationships, handling queries and complaints, managing any incidents/issues encountered, providing account reporting, detecting fraud, and providing online services including our websites. This processing is required for us to provide the service agreed under our agreement and ensure the integrity of any account you have with us. Some of the processing will be based on a legal obligation. Customer relationships may be maintained by phone, mail, e-mail, personal contact and fax where appropriate (see the section below titled ‘Being in contact with us’).

To develop our products and services.

This includes reviewing our existing offering of products and services, making required improvements and launching new products/services. Personal data may also be processed when we develop our appropriate business strategies and systems internally. Where these processes include personal information, they are conducted in our legitimate interest to ensure we provide the best products and services for our customers. We are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and that the least intrusive approach is followed.

The data may be provided or disclosed to entities within the Aegon group of companies. More information can be found in the section titled ’Disclosing your personal data’.

Managing third party and supplier relationships.

Personal data will be processed in order to assess and obtain services provided by a third party company, to manage the relationship between the companies (including where they act as our data processor) and reporting and performance analysis on these relationships. These processes may also require providing or disclosing personal data to other entities within the Aegon group of companies as well as consulting publicly available records. These processes are conducted to ensure appropriate execution of the agreement between the parties and between us and our customers, as well as being in our legitimate interests to be able to utilise third party services when providing its products and services to customers in the best way possible.

Where appropriate, these processes may include the use of any sensitive data provided on copies of identification documents.

More information can be found in the section titled  ‘Disclosing your personal data’.

Internal management reporting and support functions

This includes the provision of legal and regulatory support and advice (both internal and external), internal auditing, strategy development and providing and maintaining IT solutions. Also includes processing required to effectively manage data including scanning, classification and labelling. Most of these processes are conducted to execute activities vital to the internal management and improvement of our business and are imperative to the performance of our agreements with customers and suppliers, however some will be conducted to meet our legitimate interests of being an efficiently operating company. Where this is the case, we are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and the least intrusive approach is followed. Others will be conducted to fulfil a legal or regulatory obligation. Personal data may be provided or disclosed to other entities within the Aegon group of companies, including Aegon Global Technology Services who act as a data processor of any personal data handled or processed when providing IT and technology solutions. Personal data may also be provided or disclosed to third parties including external law firms, accountants, technology providers and auditors.

More information can be found in the section titled ‘Disclosing your personal data’.

Managing relationships with governments and supervisory authorities

This includes responding to requests and providing regular and ad hoc reporting. These processes are conducted to fulfil a legal and regulatory obligation of the company. Where personal data, including sensitive personal data, needs to be processed in order to fulfil these obligations it will be conducted in line with this privacy statement including when processing involves third parties and entities within Aegon Asset Management, appointed suppliers and the Aegon group of companies

More information can be found in the section titled 'Disclosing your personal data’.

Marketing to our customers and prospects

This will include the execution and analysis of marketing campaigns, surveys and strategies, promoting products and services provided by AIM and affiliated Aegon Asset Management companies, running and contributing to promotional events and the use of ad hoc competitions and promotions.

We may use the personal data we have to send you marketing information and news about our products and services that may be of interest to you, unless you have opted out of marketing.

For prospective clients linked to our Frankfurt and Madrid offices,  we will ensure that we obtain consent in order  to send you marketing information and news about our products and services that may be of interest to you or your clients, as well as invite you to relevant events. Please remember that you can withdraw your consent or opt-out of marketing communications at any time by contacting us (see section 'Your Rights'). 

We may conduct marketing with our customers (including business partners) based on our legitimate interest to share product and service information with them for them to take it into account when providing a related service. We may also conduct marketing related analytics which can include elements of profiling and automated decision making (eg. placing customers into groups with similar customers based on certain characteristics) which can affect the products, services or features we offer a customer and is conducted based on our legitimate interest to ensure we provide customers with the  appropriate marketing information that is most relevant to them. These analytics may include additional (personal) information obtained from third parties where we consider the use of this data as fair and legal.

When conducting these activities based on our legitimate interests we will ensure that the least intrusive method is used and that we feel the recipient would reasonably expect this processing to take place or to receive marketing of this type. Customers will be able to opt out of marketing from us at any point or object to certain types of marketing related processing by contacting us.

Your personal data will only be provided or disclosed to external third parties for marketing purposes where you have agreed to do so. We will not sell your personal information to other organisations for marketing purposes.

When running or contributing to promotional events we may need to collect personal information in relation dietary and access needs, but this information will only be used for the purposes confirmed at the time of collection. 

Marketing communications will be conducted using various channels such as mail, phone and email. 

The withdrawal of consent to specific processing of personal data, including for the purposes of marketing, does not affect the processing based on consent before the withdrawal. It will also not affect the provision of other products and services unrelated to the process for which you have withdrawn consent. Objecting to processing related to marketing may impact the service we are otherwise able to provide to customers.

Cookies

We also collect information using cookies and related website tracking technology. Cookies are small files which save and retrieve information about your visit to this website – for example, how you entered our site, how you navigated through the site, and what information was of interest of you.

Read more about how we use cookies in our website Cookie Statement and SEISMIC Cookie and Tracking Statement.

In order to conduct the processing activities described in this statement and allow us to verify the content of calls, telephone lines are recorded whenever you contact or are contacted by a member of our Investment and Portfolio Management team, Sales and Marketing team and Account management team. This will be conducted using the same legal basis as confirmed for the specific processing activity unless stated otherwise.

All emails or electronic communications sent to or from any member of our staff will be retained and may be monitored to complete the respective processing activities or achieve the processing purposes stated in this statement.  Only the appropriate staff members are authorised to monitor or review email or message content in line with their job role.

Disclosing your personal data within the Aegon group

As a global organization, personal data we collect will be transferred internationally throughout Aegon’s worldwide organization. Your personal data will be exchanged within the Aegon group of companies (meaning all subsidiaries and affiliates of Aegon Ltd.), including and predominantly within the Aegon Asset Management group (the entities within the Aegon group that are responsible for asset management activities) including Aegon Asset Management UK plc , Aegon Asset Management Hungary B.V., Aegon Asset Management (Asia) Limited, Aegon Privacy Fund Management (Shanghai) Co. Ltd,  Aegon USA Investment Management LLC and Aegon USA Realty Advisors LLC.

We provide or disclose your personal data to others for the purposes mentioned in this statement and to have a complete overview of our contacts and contracts within the Aegon group. We may also provide or disclose your personal data to others to offer you a complete package of services and products. This will be handled in line with the description above on how we provide marketing to customers and prospects. Providing or disclosing personal data within the Aegon group of companies is done in line with applicable regulatory requirements and we will ensure the appropriate technical and organisational measures are in place.

Our employees are authorized to access personal data only to the extent necessary to perform their job.

Disclosing your personal data to third parties

We work with carefully selected service providers that carry out certain functions on our behalf and we cooperate with relevant authorities. The following types of third parties have or could be granted access to your personal data where relevant for the processing described above.

• Governments 
• Supervisory authorities – including the Autoriteit Financiële Markten (AFM), De Nederlandsche Bank (DNB) and Autoriteit Persoonsgegevens (AP), the US Securities & Exchange Commission (SEC), Deutsche Bundesbank, Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), Der Hessische Beauftragte für Datensschutz und Informationsfreiheit, Amtsgericht Frankfurt am Main, Industrie und Handelskammer Frankfurt am Main, Finanzamt Frankfurt am Main (Tax), Bundesagentur für Arbeit, Comisión Nacional Mercados de Valores, SEPBLAC (AML), Agencia Tributaria (Tax) 
• Banks – including Citi Group 
• Affiliated and unaffiliated technology suppliers – including Aegon Global Technology Services (GTS), Microsoft and Amazon Web Services (AWS), OneTrust and SEISMIC 
• Research and consultancy intermediaries 
• Client Relationship Management (CRM) tool providers – including SalesForce 
• Accountants 
• Auditors 
• External legal counsel 
• Storage facilities – including Iron Mountain 
• Mailing houses, email providers and event organisers

When third parties are given access to your personal data, we will implement such contractual, technical and organizational measures as may be legally required to ensure that your personal data is only processed to the extent that such processing is necessary. The third parties will only process your personal data in accordance with applicable law.

In other cases, your personal data will not be supplied to third parties, except:

• to the extent that we are required to do so by law, by a government body or by a law enforcement agency, or for crime prevention purposes (including financial crime protection and credit risk reduction);
• when protecting your interests or the interests of other individuals or for reasons of substantial public interest;
• in connection with any legal proceedings (including prospective legal proceedings);
• in order to establish or defend our legal rights;
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets and for the purposes of effecting any sale or purchase; or
• if we, or substantially all of our assets, are acquired by a third party, we may disclose your personal data to that third party in connection with the acquisition.

The use of your personal data by data processors

When a third party processes your personal data solely following our instructions, it acts as a data processor. We enter into an agreement with such a data processor concerning the processing of personal data. In this agreement we include obligations to safeguard that your personal data is solely provided to the data processor to provide specific services to us and the data is afforded a sufficient level of protection.

Affiliates and third parties with which we provide or disclose personal data are situated in a variety of locations, including, most notably the UK, EU, US and India.

If your personal data is transferred to a recipient n country which the EU has not granted data protection adequacy status, we will take measures to ensure that your personal data is adequately protected in accordance with EU laws and regulations, such as entering into EU Standard Contractual Clauses with the recipient of the data.

Note that as of 10 July 2023, transfers from the EU to US companies participating in the EU-US Data Privacy Framework have adequacy status under EU law.

You can view the current EU Standard Contractual Clauses template on the European Commission website HERE and you can request to see a copy of a specific set of EU Standard Contract Clauses utilised by AIM by contacting our DPO.

Data subjects may also contact our DPO to obtain information about the categories of personal data transferred to, and the location of, a specific data recipient.

We will keep your personal information only as long as necessary to complete the processes mentioned in this privacy statement, including where data is provided or disclosed to third parties. In addition, we will keep your personal information where we have legitimate interest for marketing purposes while you are a prospective customer. We will also keep personal information following conclusion of our relationship to comply with our legal and regulatory obligations (generally for between 5-8 years after the last product/service). Where there is no legal, regulatory or business reason to keep your data it will be securely deleted, destroyed or anonymised. We regularly review the applicable retention periods to ensure regulatory compliance.

We have implemented functional, technical, physical and organizational measures to protect the personal data that we have under our control from:

• Unauthorized access and alteration;
• Improper disclosure; and
• Accidental or unlawful destruction or loss.

We implement information security policies, conduct staff training, and strive to ensure the security of our information technology and the personal data under our control. Employees and service providers who have access to personal information under our control are obliged to protect it and keep it confidential, except as otherwise agreed by us in accordance with applicable laws and regulations.

Of course, no network or system (including the internet) is entirely secure, and despite the measures described above, we cannot guarantee the security of networks and systems we operate or use, or that are operated on our behalf (including the security of email or other transmissions of data). 

In the event that a data breach results in there being a high risk to your personal rights and freedoms, we will contact you in accordance with our data breach notification procedures and applicable laws and regulations.

You, as a data subject, have a number of rights including:

• the right to request a copy of the personal data we hold on you. ( Requesting this information is known as making a Data Subject Access Request (DSAR). In most cases, this will be free of charge, however in some limited circumstances, for example, repeated requests for further copies, we may apply an administration fee);
• the right to have inaccurate personal data corrected;
• the right to have out of date personal data deleted once there is no business need or legal requirement for us to hold it;
• the right to object to or restrict some processing, in limited circumstances and only when we do not have legitimate grounds to continue processing your personal data;
• the right to object to your personal data being used to send you marketing material. As mentioned above, generally we will only send you marketing material where you have given us your consent to do so or where we believe there is a legitimate reason for doing so. You can withdraw your consent at any time;
• the right to have personal data that you provided us with transferred to another service provider in electronic form in certain scenarios; and
• the right to ask for a decision to be made manually, where a decision is made by automated means and this adversely impacts you.

To exercise any of these rights, please contact Account Management or our Data Protection Office.

When requesting to exercise your rights, we will take into account other conflicting obligations we may have as well as the rights of other data subjects. As a result, there is a chance that your request may be only partially fulfilled or in limited circumstances it may be rejected completely. If this happens, an explanation will be provided to you.

If you wish to exercise your rights in relation to the processing of your personal data conducted by one of our processors or joint controllers then please contact us in the first instance.

If you believe we have not processed your personal data in accordance with our data protection obligations, and that you have been affected by our non-compliance, you can make a complaint to us by contacting our Account Management team or our Data Protection Office. If you are not satisfied with our response, you can raise a complaint with the Autoriteit Persoonsgegevens, the independent authority set up to enforce the data protection regulations.

From time to time we may make changes to this privacy statement. If we make any changes to this privacy statement and the way in which we use your personal data we will post these changes on this page and where the changes are significant we will do our best to notify you.

_{This privacy statement was last updated in December, 2023.}