VPS takes your privacy seriously. We are constantly working to ensure that your personal information is safe with us. On these pages you can find information about how we process your personal information.
VPS and account operators are jointly responsible for your personal information
Anyone who alone or together with others determines the purpose of processing personal information and the means to be used has the role of data controller. The data controller is responsible for the processing of personal data in accordance with the law.
VPS is the only company that has a license to operate securities registers in Norway. We offer registration of shares and other financial instruments, and provide infrastructure and services related to settlement and registration of securities rights. VPS supplies the directory services to investors and issuers through a network of securities companies (brokers), banks and management companies. These have the role of account operators and manage customer relations.
VPS and account operators are jointly responsible for processing your personal information in a good way and in accordance with the Personal Information Act. Accountants and others who register information in the securities register are responsible for ensuring that the information is correct and collected legally and that you are informed in accordance with the law. We in VPS are responsible for ensuring that your personal information registered in the securities register is safe and not stored longer than statutory storage duties and the purpose indicates. If you want access to your information or exercise another right, please contact your account operator.
What personal information do we process about you?
Personal information is information or assessments that can be linked to you as a person. This may for example be name, contact information, account number and securities / transactions. The personal information we process is mainly registered in the securities register by an account operator or generated from your securities market activity, but it also retrieves information from other sources such as the Population Register.
The following categories of personal data are processed:
Identity information: Information about your identity, such as name, social security number, citizenship and possibly tax country / tax rate relevant for deduction of withholding taxes. The information is registered by the account owner who receives the information from you or the information is retrieved from the Population Register operated by the Norwegian Tax Administration.
Contact Information: Information that enables us to have dialogue with you, such as address, phone number and email address. The information is registered by the account operator who receives the information from you or are retrieved from the Population Register, which is operated by the Norwegian Tax Administration.
Account Information: VPS account number and account type, bank account number for bank account associated with a VPS account. VPS account number is generated by establishing an account relationship. It is verified by posting in the Account and Address Book that a bank account associated with a VPS account belongs to the person who creates a VPS account.
Transaction Information: Information about transactions related to your customer relationship, such as the amount and time of purchase and sale of securities, dividends and other transactions. This is generated through your activity and use of our services or corporate actions.
Information about others: Information about other persons associated with a VPS account, such as disposals, pledges and other rights holders.
Web Information: Information we register for visits to www.vps.no, through cookies or scripts on the web pages as a location (using IP address, location data, or the like), information about the pages you visit, information about any products and services you order, and other technical information (such as user behavior, user equipment, browser, and operating system). Unless you sign in or otherwise enter your identity on the site, we will not be able to associate this information with you.
Camera surveillance: VPS premises are monitored to prevent and detect criminal offenses.
How do we use personal information?
The purpose of our use of information about you is primarily to fulfill the obligations we have attached to the operation of the securities register and the provision of registry services through account operators.
Customer Administration: VPS will use your personal information to fulfill the obligations we have undertaken for the implementation of securities registry services. We process, among other things, the name, birth number, address, bank account, citizenship, e-mail address, phone number, holdings and transactions, tax country / tax rate, and if a person is disqualified. It is regulated in section 6-8 of the Securities Register Act and the Securities Register Regulations Section 9 which information is to be included in the register, while information on tax country / tax rate is recorded in accordance with the Tax Payment Act.
Adaptation: We use web information to conduct analysis, personalization of our website, and providing customer service. We use Google Analytics for traffic analysis on our sites. This is based on our legitimate interest in improving and providing our services. However, Google Analytics is configured so that the data obtained from activity on our web pages can not be linked to IP addresses, and therefore, the data can not be linked to you as a person.
Security: VPS conducts continuous technical and organizational security measures to ensure that your personal information is safe with us. We ensure, among other things, that your personal information is protected from loss, destruction, unauthorized change, and unauthorized access. We have a security framework that is regularly updated in line with the threat and technological development.
Logging: Your activity is logged in order to track back what changes have been made and who, for example, if there is a security breach or if there is an error in the systems.
For how long do we store your personal information?
We store information about you only as long as we have a statutory retention obligation or it is necessary for the purpose for which the information was collected.
As a rule, we store personal information during these periods:
• Transaction information and other information deleted from the securities register shall be kept for at least ten years after the Securities Register Act section 6-6.
• The annual assignments we have sent to you show which information we have provided to the IRS are stored for five years after the Accounting Act and the Accounting Regulations.
• Change messages we have sent you are stored for two years.
• Technical logs from our systems and databases are stored for up to six years.
Who do we share your personal information with?
VPS and account operators are subject to confidentiality in the Securities Register Act when processing your personal information. VPS discloses your personal information to others only when it follows from the Securities Register Act or other legislation that we may share the information or are required to complete the agreement with you. We also use certain subcontractors that process your personal information on our behalf regulated in data processing agreements with us.
Account operator, security issuer and others: When we deliver our services and products, this may mean that we must disclose information about you. For example, it will be necessary to disclose certain information in order to transfer your securities to another person by order from you or your account owner, or if you change the account owner. A mortgagee or proprietor of another limited right registered in an account has the right to obtain all information registered in the account that may affect the right. Before we share such information, we will always ensure that we comply with the relevant provisions on confidentiality in the financial and securities sector.
Subcontractors: If VPS issues tasks that require a supplier to process personal information on behalf of VPS, VPS is responsible for our subcontractors processing your personal information in accordance with the Personal Information Act. To ensure that subcontractors process your personal information in a good way and in accordance with the Data processer agreement, we have entered into data processing agreements with our subcontractors.
The Norwegian Tax Administration: VPS is required as a securities register to provide information to the National Tax authorities for pre-completion of the tax report and for control purposes. Every year in February, we send you an annual assignment that shows what information we have sent to the The Norwegian Tax Administration.
The Financial Supervisory Authority of Norway has the right to access information in the securities register in connection with supervisory duties and responsibilities.
Police: The police have the right to access information in the securities register in connection with the prevention and combating of crime.
Enforcement Officer trustees, etc.: Enforcement Officer, trustees and some others are entitled to information
about a person’s ownership in financial instruments when relevant to their case processing.
Oslo Stock Exchange: Persons with key positions in listed companies (primary insiders) shall report their transactions in these companies to Oslo Stock Exchange so that the market is informed of their transactions. VPS delivers information to Oslo Stock Exchange on transactions undertaken by primary insiders so that Oslo Stock Exchange can check that such transactions are reported in accordance with current rules. The extradition is done by law.
Others: Everyone has access to static data on a financial instrument that is not subject to confidentiality. It may also result from special legislation that other than those in front of you are entitled to confidential information in the register.
Security of your personal data
Your personal data are dealt with in confidence and Euronext VPS has taken appropriate technical and organizational security measures to protect your personal data against loss, misuse, alteration and/or destruction. These include, but are not limited to:
• Installing a firewall to prevent unauthorized access to our systems;
• Using secure servers;
• Ensuring the Personal Data are stored in physically secure accommodation.
Please be aware that the security measures mentioned above apply to systems under the control of Euronext VPS, but that Euronext VPS cannot ensure the security nor confidentiality of any information during its transmission when transmitted via means not under its control, notably the Internet, and that you are aware that data transmitted via such means may be intercepted by third parties.
If Euronext VPS becomes aware of any security breach which results in unauthorized access of your personal data, Euronext VPS will endeavor to inform you.
Euronext VPS websites may provide hyperlinks to websites from other companies or persons. This policy does not apply to the use of such websites and we are not responsible or liable for any processing of your personal data via these third party websites.
In addition, if you share content from the Euronext VPS websites via social media, your personal data will be visible to those visiting your personal pages on these social media websites. Euronext VPS is not responsible or liable for any processing of your personal data via such media. This policy does not apply to the use of such social media.
Your rights and how to exercise them
The table below sets out the rights which you have to address any concerns or queries with us about our processing of your personal data. Please note that these rights are not absolute and are subject to certain exemptions under applicable data protection law.
Right to be informed: You have the right to know your personal data is being processed by us, how we use your personal data and your rights in relation to your personal data.
Right to access: You have the right to ascertain what type of personal data Euronext VPS holds about you and to a copy of this personal data.
Right to rectification: You have the right to have any inaccurate personal data which we hold about you updated or corrected.
Right to erasure: In certain circumstances you may request that we delete the personal data that we hold on you. You have also the right to give post-mortem instructions regarding your personal data.
Right to restriction of processing: You have the right to request that we stop using your personal data in certain circumstances including if you believe that the personal data we hold about you is inaccurate or that our use of your personal data is unlawful. If you validly exercise this right, we will store your personal data and will not carry out any other processing until the issue is resolved.
Right to object: Where we rely on our legitimate interests to process your personal data, you have a right to object to this use. We will desist from processing your personal information unless we can demonstrate an overriding legitimate interest in the continued processing.
Right to data portability: In case the processing is based on your consent or a contract conclude with you, you may request us to provide you with certain personal data which you have given us in a structured, commonly used and machine-readable format and you may request us to transmit your personal data directly to another controller where this is technically feasible.
You can exercise any of these rights in accordance with the “Data Subject Rights Request Information Procedure”
• submitting a request through the following form.
• sending a request to us at email@example.com.
• by sending a letter to the following address:
Data Protection Officer
14, place des Reflets – CS30064
92054 Paris la Défense.
Furthermore, you may also submit a complaint to the competent Data Supervisory Authority.
Changes to this statement
We may occasionally update this Privacy Statement to reflect changes in our business or to comply with applicable law and regulations. We therefore advise you to review this statement regularly to ensure that you are updated with any changes.
Questions and requests
Should you have any questions or requests about this policy, please contact us via firstname.lastname@example.org.