General privacy policy of St.Galler Kantonalbank AG

"Personal data" refers to information that relates to a specific or identifiable person, i.e. conclusions about their identity are possible on the basis of the data itself or with corresponding additional data. "Particularly sensitive personal data" is a category of personal data that is specially protected by the applicable data protection law. Personal data requiring special protection includes e.g. health data, data revealing racial or ethnic origin, data concerning religious or philosophical beliefs, biometric data for identification purposes and data concerning trade union membership. In Section 3, you will find details of the data that we process within the scope this data protection declaration. "Processing" means any handling of personal data, e.g. obtaining, storing, using, adapting, disclosing and deleting.

Our data processing operations concern the following persons in particular:

• Current and former clients and persons associated with them, such as additional account and cardholders, authorised representatives
  (e.g. authorised persons, authorised signatories, provident representatives), beneficial owners, control holders
  or heirs
• Interested parties and potential clients
• Persons to whom we provide products and services or whom we advise
• Shareholders and investors
• Participants in competitions, surveys, customer events and other events
• Users of our website and our newsletter
• Visitors to our premises
• Users of our ATMs
• Suppliers and partners and their contacts
• Representatives of authorities, agencies and other bodies

In particular, SGKB is jointly responsible with other bodies for data processing in the following case:

• SGKB is jointly responsible with the St. Galler Kantonalbank (CHE-109.509.434) for the processing of personal data in connection with services and products of the Pension Savings "Sparen 3".

We have established the following additional posts:

Master data includes identification data such as name, date of birth, gender, social security number, tax number, nationality, photographs, specimen signatures, copies of identification documents; contact data such as address, email address, telephone number; information about your relationship with us (client, supplier, etc.); tax data such as tax number, tax domicile and information in connection with the Automatic Exchange of Information (AEOI), Foreign Account Tax Compliance Act (FATCA) and Qualified Intermediary Agreement (QI Agreement); information on your personal circumstances such as marital status, family relationships, occupation, employer, qualifications, interests and hobbies; information on your financial circumstances such as income, assets and debts; furthermore, reports or official documents (e.g. extracts from the commercial register).

With respect to contact persons and representatives of our clients, suppliers and partners, we process as master data, e.g. name, address and date of birth, details of role, function in the company, qualifications and, where applicable, details of supervisors, employees and subordinates and details of interactions with these persons.

Master data is not comprehensively collected for all contacts. Which data we collect specifically will depend in particular on the purpose of the processing.

Contractual data include general data on the business relationship, such as information on the conclusion of the contract, on your contracts, e.g. the nature and date of the contract, information from the application process (such as an application for our products or services) and information about the contract in question (e.g. its duration) and the processing and administration of the contracts (e.g. information related to invoicing and the enforcement of contractual claims), information on allocations and classifications (e.g. customer segment) as well as information on complaints and customer satisfaction. Contractual data also include product and service-related data such as account and deposit numbers, information on individual orders and transactions (e.g. incoming and outgoing payments, card payments, securities information), card details (e.g. limits), information on your risk and investment profile as well as your knowledge and experience in connection with financial products, information on loans (e.g. amount, term, collateral).

Behavioural data is information about certain actions, such as your response to electronic communications (e.g. whether and when you opened an email) or your location, as well as your interaction with our social media profiles and your participation in prize draws, competitions and similar events. For example, we may collect your location data wirelessly through unique codes sent by your mobile phone or when you use our website.

Preference data tell us what your needs are, what products or services might be of interest to you, or when and how you are likely to respond to messages from us. We obtain this information from the analysis of existing data, such as behavioural data so that we can get to know you better, tailor our advice and offers more precisely to you and generally improve our offers. To improve the quality of our analyses, we may combine these data with other data that we also obtain from third parties such as address dealers, public offices and publicly accessible sources such as the Internet, e.g. with information on your household size, income class and purchasing power, shopping behaviour and contact details of relatives and anonymous information from statistical offices.

Behavioural and preference data can be evaluated on a personal basis (e.g. to show you personalised advertising), but also on a non-personal basis (e.g. for market research or product development). Behavioural and preference data can also be combined with other data.

Communication data comprise your name and contact details, the place, time and methods of communication and usually also its content (i.e. the content of emails, letters, chats, telephone conversations etc.). These data may also contain information about third parties. For identification purposes, we may also process your ID number or a password you have set or your ID card. Information about the use of an electronic infrastructure is known as metadata. Metadata provide information about who was in contact with whom, when, how and from where.

Technical data include, among other things, the IP address and information about the operating system and language of your terminal device, the date, region and time of use as well as the type of browser with which you access our electronic offers. This can help us to submit the correct formatting of the website or show you a website adapted for your region, for example. Based on the IP address, we know which provider you use to access our offers (and thus also the region), but we cannot usually deduce who you are from this. This changes when you create a user account, for example, because personal data can then be linked to technical data (e.g. we can see which browser you use to access an account via our web-site). Examples of technical data include logs generated by our systems (e.g. the log of user logins to our website).

Registration data include, but are not limited to, the information you provide when you create an account on our website (e.g. Username, password, name, email). However, the registration data also include the data that we may require from you before you can make use of certain free services. You also need to register if you want to subscribe to our newsletter. In the context of access controls, we may have to register you with your data (access codes in badges, biometric data for identification) (cf. the category "other data").

We only provide certain services to you if you provide us with registration data because we or our contractual partners want to know who is using our services or who has accepted an invitation to an event, because it is technically necessary, or because we want to communicate with you. If you or a person you represent (e.g. your employer), wants to enter into or implement a contract with us, we need to collect relevant master, contract and communication data from you, and we process technical data if you want to use our website or other electronic offers for this purpose. If you do not provide us with the data required for the conclusion and performance of the contract, we may refuse to conclude the contract, you may be in breach of contract, or we may not be able to honour the contract. Similarly, we can only send you a response to a request from you if we process the relevant communication data and where applicable, technical data, if you communicate with us online. The use of our website is also not possible without us receiving technical data.

We receive data provided to us by third parties for the purpose of executing orders, fulfilling contracts or with your consent, such as third-party banks, operators of settlement systems, pension schemes, pension and vested benefits foundations, insurance companies, land registry offices, debt enforcement and bankruptcy offices, the Central Office for Credit Information (ZEK), the Consumer Credit Information Office (IKO), power of attorney providers, representatives of heirs, card issuers, pension foundations, Swiss Post, cashgate. We also receive data from official bodies and authorities which are communicated to us on the basis of their activities, e.g. from courts, child and adult protection authorities and public prosecutors' offices.

The categories of personal data that we receive about you from third parties include, in particular, information from public registers, information that we obtain in connection with official and legal proceedings, information in connection with your professional functions and activities (so that we can, for example, conclude and process transactions with your employer with your help), information about you in correspondence and meetings with third parties, creditworthiness information (insofar as we conduct business with you personally), information about you arising from correspondence and meetings with third parties, creditworthiness information (insofar as we process transactions with you personally), information about you provided by people close to you (family, advisors, legal representatives, etc.) allowing us to conclude or process contracts with you or with the involvement of you (e.g. references, your address for deliveries, powers of attorney, details of compliance with legal requirements such as anti-fraud, anti-money laundering, anti-terrorism and export restrictions, details of banks, insurance companies and distributors and other contractual partners of ours for the use or provision of services by you (e.g. payments, purchases, etc.), personal data from the media and Internet (if this is appropriate in a specific case, e.g. in the context of an application, marketing/sales, press review, etc.), your address and, if applicable, interests and other socio-demographic data (especially for marketing and research) and data in connection with the use of third-party websites and online offers where this use can be attributed to you.

We enter into a wide variety of contracts with our clients, suppliers, subcontractors or other contractual partners, e.g. partners in projects or with parties in legal disputes. In particular, we process master data, contract data and communication data and, depending on the circumstances, also registration data of the client or the persons to whom the client provides a service.
In the course of initiating business, personal data, in particular master data, contract data and communication data, are collected from potential clients or other contractual partners (e.g. in an application form or contract) or result from a communication. In some cases, this information is checked for compliance with legal requirements.

As part of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual services (which also includes the involvement of third parties, such as logistics companies, security services, advertising service providers, banks, insurance companies or credit reference agencies, which may then in turn provide us with data), for advice and for customer care. The enforcement of legal claims arising from contracts (debt collection, court proceedings, etc.) is also part of the processing, as are accounting, termination of contracts and public communication.

Furthermore, we also process data, in particular, master and contract data, when computers are used on our website (e.g. mortgage or pension calculator) as well as in connection with the brokerage of third-party products and services, e.g. insurance, retirement accounts, personal loans, credit cards and travel funds. Such products and services may be offered via our infrastructure or by our employees, but may be executed and processed in whole or in part by third parties. In this case, the respective third party, if applicable together with SGKB, is responsible for processing the data.

These include, for example, the legally regulated fight against money laundering and the financing of terrorism. In certain cases, we may be obliged to make certain inquiries about clients ("Know Your Customer") or to report to the authorities. The fulfilment of obligations to provide information or to report, for example in connection with supervisory and tax obligations, also requires or entails data processing, e.g. the fulfilment of archiving obligations and the prevention, detection and clarification of criminal offences and other violations. This includes receiving and processing complaints and other reports, monitoring communications, conducting internal investigations or disclosing records to a government agency if we have reasonable cause or are legally required to do so. Your personal data may also be processed in the course of external investigations, e.g. by a law enforcement or supervisory authority or a mandated private body. We also process data in order to serve our shareholders and other investors and to fulfil our obligations in this regard. For all these purposes, we process in particular your master data, your contract data and communication data, but in some circumstances also behavioural data and data from the category of other data. The legal obligations may arise from Swiss law, but also foreign laws and regulations to which we are subject, as well as self-regulations, industry standards, our own "corporate governance" and official instructions and requests.

For example, we need to monitor our debtors and creditors as part of our financial management, and we need to avoid falling victim to crime and abuse, which may require us to analyse data for patterns. We may also carry out profiling and create and process profiles for these purposes and to protect you and us from tortious or abusive activities (see also section 7). In the context of planning our resources and organising our operations, we need to evaluate and process data on the use of our services and other offers or exchange information on this with others (e.g. outsourcing partners), which may include your data. The same applies to services rendered to us by third parties. As part of our business development, we may sell or acquire businesses, operations or companies to others or enter into partnerships, which may also result in the exchange and processing of data (including from you, e.g. as a client or supplier or as a supplier representative).

For example, with your consent, we may send you information, advertising and product offers from us and from third parties, in print, electronically or by telephone. Like most businesses, we personalise communications so that we can provide you with personalised information and offers that meet your needs and interests. For this purpose, we link data that we process about you and determine preference data and use these data as the basis for personalisation (see section 3). We also process data in connection with competitions, prize draws and similar events.

Relationship management also includes addressing existing clients and their contacts, possibly personalised on the basis of behavioural and preference data. As part of our relationship management, we also operate a customer relationship management system ("CRM") in which we store the data on clients, suppliers and other business partners required for the relationship management, e.g. on contact persons, relationship history (e.g. on products and services purchased or supplied, interactions, etc.), interests, wishes, marketing measures (newsletters, invitations to events, etc.) and other information.

We strive to continuously improve our products and services (incl. our website and our newsletters) and to be able to react quickly to changing needs. We therefore analyse, for example, how you navigate through our website or electronic offers (e. g. e-banking, mobile banking), when you open our newsletter and what content you click on, or which products are used by which groups of people and in what way, and how new products and services can be designed (for further details see section 12). This gives us an indication of the market acceptance of existing products and services and the market potential of new ones. As far as possible, we use pseudonymised or anonymised data for these purposes.

We continuously review and improve the appropriate security of our IT and other infrastructure (e.g. buildings). We therefore process data, for example, for monitoring, controls, analyses and tests of our networks and IT infrastructures, for system and error checks, for documentation purposes and as part of security copies. Access controls include not only the control of access to electronic systems (e.g. logging into user accounts), but also physical access control (e.g. building access). For security purposes (preventive and incident investigation), we also keep access logs or visitor lists and implement surveillance systems (e.g. security cameras). We draw your attention to surveillance systems at the relevant locations identified by appropriate signs.

This can be for any purpose where you and we communicate, whether in customer service or consultation, authentication in the event of use of the website or for training and quality assurance (e.g. in the area of customer service). We further process communication data so that we can communicate with you by email and telephone, as well as messenger services, chat, social media, letter and fax. Communication with you is usually in connection with other processing purposes, e.g. so that we can provide services or respond to a request for information. Our data processing also serves as proof of the communication and its contents.

For communication and collaboration (e.g. for meetings, counselling sessions, telephone and/or video conferences, online presentations and/or training), we also use Microsoft Teams, which is provided by the Microsoft Group. In doing so, Microsoft uses certain data, in particular technical data to optimise or improve its own services (e.g. for the technical optimisation of the conference system) and to combat cybercrime and attacks as an independent responsible party. Microsoft's privacy policy can be found at https://privacy.microsoft.com/de-de/privacystatement.

These other purposes include, e.g. training and educational purposes, administrative purposes (such as master data management, accounting and data archiving, and the testing, management and ongoing improvement of IT infrastructure), the protection of our rights (e.g. to enforce claims in or out of court and before authorities at home and abroad, or to defend ourselves against claims, for example, by preserving evidence, legal clarifications and participation in court or official proceedings) and the evaluation and improvement of internal processes. We may use recordings of (video) conferences for training and quality assurance purposes. The protection of other legitimate interests is also one of the other purposes that cannot be named exhaustively.

As a bank, we are subject to various legal, professional and supervisory requirements, in particular the Banking Act (BankG), the Financial Market Supervision Act (FinfraG), the Financial Services Act (FIDLEG), the Collective Investment Schemes Act (KAG), the Anti-Money Laundering Act (AMLA), the Automatic Exchange of Information Act (AIAG), circulars of the Swiss Financial Market Supervisory Authority (FINMA), guidelines of the Swiss Bankers Association (SBVg) and requirements of the Swiss National Bank (SNB). The obligations include, for example, credit checks, identity checks, fraud and money laundering prevention, the fulfilment of reporting obligations under tax law and the assessment and management of risks.

If you are a client of ours, we can use "profiling", for example, to determine which other products and services are likely to interest you. An automated analysis of data can also check, for your protection, the likelihood of a particular transaction being fraudulent. This allows us to stop the transaction for clarification. When using the Financial Assistant (PFM), your transactions are allocated to specific expenditure and revenue categories automatically or according to criteria you specify. A distinction must be made between these and "profiles". The latter refer to the linking of different data in order to gain clues about essential aspects of your personality (e.g. what you like or how you behave in certain situations) from the totality of these data. Profiles can also be used for marketing, for example, but also for security purposes.

We will inform you in each individual case if an automated decision leads to negative legal consequences or a comparable significant impairment for you. If you disagree with the outcome of such a decision, you will be able to communicate about it with someone who will review the decision.

We procure services from third parties in various areas so that we can deliver our products and services efficiently and concentrate on our core competencies. These services concern, for example, IT services, the mailing of information, marketing, sales, communication or printing services, building security, debt collection, credit agencies, address checkers, real estate valuations, anti-fraud measures and services provided by consulting firms and law firms. We disclose to these service providers the data required for their services, which may also concern you. In addition, we conclude contracts with these service providers that include provisions for the protection of data, insofar as such protection does not result from the law.

If we have a contract or other relationship with a company you work for, we may transfer data about you to that company in connection with your work for that company. We may also transfer data to other entities involved in legal transactions, e.g. recipients of a payment, agents, correspondent banks, other financial institutions, payment service providers (including mobile payment service providers), third-party custodians, stock exchanges and trading platforms, brokers and counterparties, pension funds, insurance companies, share registers and other entities.

Such partners include, in particular, payment card issuers (Swiss Bankers, Viseca), TWINT, providers of personal loans (cashgate), vested benefits foundations (Swisscanto), pension foundations (Pension Foundation Sparen 3 of St. Galler Kantonalbank AG), pension schemes and insurance companies (e.g. Swisscanto, Mobiliar).

Use cases include, for example, criminal investigations, police measures, supervisory requirements and investigations, judicial proceedings, reporting obligations and pre- and extra-judicial proceedings, as well as statutory obligations to provide information and to cooperate. Data may also be disclosed if we want to obtain information from public bodies, e.g. to justify an interest in information or because we need to say who we need information about (e.g. from a register). Such authorities and agencies include the Swiss Financial Market Supervisory Authority (FINMA), the Swiss National Bank (SNB), the Money Laundering Reporting Office Switzerland (MROS), courts, public prosecutors' offices, child and adult protection authorities, tax authorities, bankruptcy and debt collection offices.

Clients domiciled in Germany are advised that SGKB will also forward suspicious activity reports regarding money laundering and terrorist financing from clients domiciled in Germany to the Money Laundering Reporting Office Switzerland (MROS), which only constitute a predicate offence to money laundering under German law.

Other recipients are, for example, persons involved in official or court proceedings, as well as auditing and review companies. When publishing content (e.g. photos, interviews, quotes, etc.), for example, on the website or in other publications by us, you may also be affected by this under certain circumstances. As part of our business development, we may sell or acquire businesses, operations, assets or companies, or enter into partnerships, which may also result in the disclosure of information (including information about you, for example, as a client or supplier or as a supplier's agent) to the persons involved in these transactions. The Central Office for Credit Information (ZEK) and the Consumer Credit Information Office (IKO) are also possible recipients of the data.

In connection with the transmission of data in international payment transactions and investments in foreign securities, we also refer you to the relevant circular from the Swiss Bankers Association (SBA) of February 2016.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, IT and infrastructure security purposes and evidence of good corporate governance and compliance. For technical reasons, storage may be necessary if certain data cannot be separated from other data, and we therefore have to store them together (e.g. in the case of backups or document management systems).

Technical and organisational measures may include, for example, measures such as the encryption and pseudonymisation of data, logging, access restrictions, the storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your data transmitted via our website in transit using suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our processors to take appropriate technical and organisational measures. Security risks cannot be completely ruled out, however, and residual risks are unavoidable.

Cookies are individual codes (e.g. a serial number) which our server or a server of our service providers or advertising contractors transmits to your system when you connect to our website and which your system (browser, mobile) accepts and stores until the programmed expiry time. With every further access, your system transmits these codes to our server or the server of the third party. Therefore you will be recognised even if your identity is unknown.

Other technologies may also be used to make you more or less likely to be recognised (i.e. distinguished from other users), e.g. "fingerprinting". Fingerprinting combines your IP address, the browser you use, screen resolution, language choice and other details your system tells each server), resulting in a more or less unique fingerprint. This means that cookies can be dispensed with.

Whenever you access a server (e.g. when using a website or an app or because an image is visibly or invisibly integrated in an email), your visits can therefore be "tracked" (traced). If we integrate offers from an advertising contractor or analytics tool provider on our website, they may track you in the same way, even if you cannot be identified in individual cases.

We obtain information about you when you communicate with us through websites or view our content on the relevant platforms, visit or are active on our websites (e.g. publish content, post comments). These platforms also collect, among other things, technical data, registration data, communication data, behavioural data and preference data from you or about you (for the terms, see section 3). These platforms routinely analyse the way you interact with us, how you use our websites, our content or other parts of the platform (what you look at, comment on, "like," forward, etc.) and link these data to other information about you (e.g. information about age and gender and other demographic information). In this way, they also create profiles about you and statistics on the use of our websites. They use these data and profiles to show you our or other advertising and other content on the platform in a personalised way and to manage Platform behaviour, but also for market and user research and to provide us and other bodies with information about you and the use of our website. We can partially control the evaluations that these platforms create regarding the use of our websites.

In particular, we may need to process and store your personal data to perform a contract with you, to protect our own legitimate interests, such as the assertion, exercise or defence of legal claims, or to comply with legal obligations. To the extent permissible by law and in particular, to protect the rights and freedoms of other data subjects and to safeguard interests worthy of protection, we may therefore also reject a data subject request in whole or in part (e.g. by blacking out certain content relating to third parties or our trade secrets).

You also have these rights in relation to other bodies who work with us under their own responsibility - please contact them directly if you wish to exercise rights in relation to their processing. You will find details of our important cooperation partners and service providers in Section 8.