3.1 Legal basis for processing
Depending on the purpose of the processing activity (see section 3.2), the processing of your personal data will be one of the following:
(i) necessary for the legitimate interests of UBS, without unduly affecting your interests or fundamental rights and freedoms (see below);
(ii) necessary for taking steps to enter into or executing a contract with you for the services or products you request, or for carrying out our obligations under such a contract, such as when we use your data for some of the purposes in sections 3.2(a), (b) (c) and (j) below (as well as certain of the data disclosures described in section 4);
(iii) required to meet our legal or regulatory responsibilities, including when we conduct the checks referred to in section 3.2(a) below and make the disclosures to authorities, regulators and government bodies referred to in sections 3.2(g) and 4 below;
(iv) in some cases, necessary for the performance of a task carried out in the public interest;
(v) when we use special categories of personal data, necessary for establishing, exercising or defending legal claims or where the processing relates to personal data manifestly in the public domain; and
(vi) in limited circumstances, processed with your consent which we obtain from you from time to time (for instance where required by laws other than the EU GDPR), or processed with your explicit consent in the case of special categories of personal data such as your medical information.
Examples of the ‘legitimate interests’ referred to above are:
- pursuing certain of the purposes in sections 3.2(a) to 3.2(k) below;
- exercising our rights under Articles 16 and 17 of the Charter of Fundamental Rights, including our freedom to conduct a business and right to property;
- when we make the disclosures referred to in section 4 below, providing products and services and assuring a consistently high service standard across the UBS Group, and keeping our customers, employees and other stakeholders satisfied. More information about what this entails can be found in section 11; and
- meeting our accountability and regulatory requirements around the world,
in each case provided such interests are not overridden by your privacy interests.
To the extent UBS has obtained your consent to process ordinary personal data in the past in any product-specific terms and conditions for the purposes of data protection law only, UBS will no longer rely on such consent, but instead will rely on lawful grounds of compliance with a legal obligation, contractual necessity or legitimate interests (as specified in this notice), and UBS' ability to rely on that consent is hereby waived or extinguished. For the avoidance of doubt, any consent given for any other reason, for instance (and if applicable) e-Privacy (including direct marketing) or banking secrecy, remains unaffected by this paragraph.
Where the personal data we collect from you is needed to meet our legal or regulatory obligations or enter into an agreement with you, if we cannot collect this personal data there is a possibility we may be unable to on-board you as a client or provide products or services to you (in which case we will inform you accordingly).
3.2 Purposes of processing
We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process personal data for the following purposes:
a) client on-boarding processes, including to verify your identity and assess your application (including the need for guarantees or other securitisation tools) if you apply for credit, and to conduct legal and other regulatory compliance checks (for example, to comply with anti-money laundering regulations, and prevent fraud);
b) providing products and services to you and ensuring their proper execution, for instance by ensuring that we can identify you and make payments to and from your accounts in accordance with your instructions and the product terms;
c) managing our relationship with you, including communicating with you in relation to the products and services you obtain from us and from our business partners, handling customer service-related queries and complaints, facilitating debt recovery activities, making decisions regarding credit or your identity, tracing your whereabouts, and closing your account (in accordance with applicable law) if it remains dormant and we are unable to contact you after a period of time;
d) helping us to learn more about you as a customer, the products and services you receive, and other products and services you may be interested in receiving, including profiling based on the processing of your personal data, for instance by looking at the types of products and services that you use from us, how you like to be contacted and so on;
e) taking steps to improve our products and services and our use of technology, including testing and upgrading of systems and processes, and conducting market research to understand how to improve of our existing products and services or learn about other products and services we can provide;
f) contacting you for direct marketing purposes about products and services we think will be of interest to you, including those offered by us, UBS Group entities, and our other business partners, and facilitating competitions and promotions;
g) meeting our on-going regulatory and compliance obligations (e.g. laws of the financial sector, anti-money-laundering and tax laws), including in relation to recording and monitoring communications, disclosures to tax authorities, financial service regulators and other regulatory and governmental bodies, and investigating or preventing crime;
h) ensuring the safety of our customers, employees and other stakeholders;
i) undertaking transactional and statistical analysis, and related research;
k) for the UBS Group’s prudent operational management (including credit and risk management, insurance, audit, systems and products training and similar administrative purposes); and
l) any other purposes we notify to you from time to time.