1
0825
GOLDMAN SACHS FAIR PROCESSING NOTICE
Contents
Overview .......................................................................................................................... 2
1.
Who is responsible for your personal data?........................................................... 3
2.
What personal data do we process? ..................................................................... 3
3.
For what purposes and which legal bases do we process personal data? ............. 6
4.
Your Consent ........................................................................................................ 10
5.
Sharing personal data .......................................................................................... 11
6.
International Transfer .......................................................................................... 11
7.
Use of Artificial Intelligence .................................................................................. 12
8.
Direct Marketing................................................................................................... 12
9.
Data Subject Rights ............................................................................................. 13
10.
Retention of personal data ................................................................................... 14
11.
Is there an obligation to provide personal data? ................................................... 14
12.
Updates to this notice ...........................................................................................15
Appendix 1 GS CONTROLLER ENTITIES AND CONTACT DETAILS ........................................ 16
Appendix 2 PRINCIPALS ................................................................................................ 18
2
0825
Overview
Purpose and Application of this Notice
Goldman Sachs Group, Inc. and its subsidiaries, affiliates ("
GS
", "
we
", “
our”
or "
us
") routinely collect and use
information relating to identifiable individuals ("
personal data
"), including data relating to:
(i)
our clients and prospective clients, where these are individuals rather than legal entities ("
natural
person clients
");
(ii)
the beneficial owners, partners and directors of our legal entity, partnership or fund clients and
prospective clients;
(iii)
the settlors, trustees, beneficiaries and protectors of the trusts (or similar legal arrangements) to which
we provide services or to which we may seek to provide services;
(iv)
advisors, managers, staff, intermediaries and other representatives of our clients and prospective
clients ("representatives"); and
(v)
other persons affiliated or associated with our clients and prospective clients and their
representatives, such as guarantors and family members.
We provide this fair processing notice ("
notice
") in accordance with our obligations under applicable data
protection laws, and as part of our commitment to processing personal data transparently.
This notice provides information on:
•
the GS entity or entities responsible for processing your personal data;
•
the personal data we collect from you and from third parties about you;
•
the purposes for which personal data is processed and, insofar as required by applicable data
protection laws, our lawful basis for doing so;
•
how your personal data is shared by us; and
•
your rights in relation to our processing of your personal data, and how you can exercise these rights
.
This notice applies to you if:
•
the GS entity or entities which contract(s) (or seek(s) to contract) with you or with the entity,
partnership, trust or fund that you own, represent or are otherwise associated with is established in
the European Union, Monaco, the Kingdom of Saudi Arabia, Switzerland or the United Kingdom; or
•
you are located in the European Union, Monaco, the Kingdom of Saudi Arabia, Switzerland or the
United Kingdom and are a person with whom GS contracts or seeks to contract, or you are a
beneficial owner, partner or settlor in respect of a GS client or prospective client.
Questions and Contact Details
Please get in touch with your Goldman Sachs team to discuss any questions you have on the processing of
your personal data. If you wish to exercise any of your data subject rights, please submit your details
here
.
Alternatively, you can contact our German and UK data protection officers:
•
by email at
gs-privacy@gs.com; or
•
by post at:
o
Marienturm, Taunusanlage 9-10, 60329 Frankfurt am Main
,
Germany
(for the German data
protection officer); or
o
Plumtree Court, 25 Shoe Lane, London, EC4A 4AU
(for the UK
data protection officer).
3
0825
Important note: if you wish to contact Goldman Sachs Bank AG (“Swiss Bank”), the Goldman Sachs
Bank Europe SE, Luxembourg Branch (“GSBE Luxembourg”) or Goldman Sachs (Monaco) S.A.M.
(“GS Monaco”):
emails sent to
gs-privacy@gs.com
will be received by people and technology systems
located outside of Switzerland, Luxembourg and Monaco respectively, and in jurisdictions where Swiss,
Luxembourg and Monegasque confidentiality and/or secrecy regulations do not apply.
This means, when you contact the data protection officer by email you will release the Swiss Bank, GSBE
Luxembourg and/or GS Monaco from all legal, statutory or contractual secrecy obligations (including Swiss /
Luxembourg / Monegasque banking secrecy) to the extent required for the purposes of this notice.
Alternatively:
(i)
If you prefer that your communication be received within Switzerland, please contact
gsbankprivacy@gs.com
;
(ii)
If you are a prospective client or a representative or any other person associated with a prospective
client of GSBE Luxembourg and you prefer that your communication be received within Luxembourg
please contact:
Goldman Sachs Bank Europe SE, Luxembourg Branch, 53 Boulevard Royal, L-2449,
Luxembourg, Grand Duchy of Luxembourg
; or
(iii)
If you prefer that your communication be received within Monaco, please contact:
Goldman Sachs
(Monaco) S.A.M., One Monte-Carlo, Place du Casino, Building G, 6th Floor North, MC 98000,
Monaco
.
1.
Who is responsible for your personal data?
The GS entity which contracts (or seeks to contract) with you or with the entity, partnership, trust or fund that
you own, represent or are otherwise associated with will be a controller of your personal data.
In addition, when an entity controlled by, or under common control with GS (a "
GS affiliate
") processes
personal data for its own independent purposes, that GS affiliate may also be a controller of your personal
data.
The list of GS controllers, their contact details and (where applicable) those of their representatives are set out
in
Appendix 1
to this notice.
This notice applies in conjunction with any other notices you receive from GS affiliates in connection with the
processing of your personal data.
2.
What personal data do we process?
2.1
YOUR PERSONAL DATA
GS will process certain personal data relating to you and people connected to you, including the data listed in
the table below. The extent to which GS will process this personal data depends on the relationship we have
with you and the products and services we provide (or seek to provide) you.
If required by applicable data protection laws, we will notify you if our processing of your personal data is
mandatory. If processing your personal data is mandatory and you do not provide such mandatory personal
data to us, we may not be able to engage or respond to you or fulfil your request.
Your personal data will not be processed in a manner inconsistent with the purpose of its collection or in cases
other than those provided for in applicable laws.
When we process your personal data for a purpose other than the one for which it was originally collected, we
will, before performing the additional processing, provide you with the necessary information regarding such
4
0825
processing. Your personal data will only be processed in a manner consistent with the original purpose of its
collection or as otherwise permitted by applicable laws.
TYPE OF DATA
WHO THIS APPLIES
TO
A.
Professional and personal details
We process your name and contact information.
We may also hold details of your preferences regarding how we communicate
with you, and information we need to identify you when you contact us.
All recipients of this
notice
We process your professional contact details.
We may also process details of the client you represent, your role as client
representative and information that allows us to liaise with you in connection with
this role, such as evidence of your authority to represent our client.
Client representatives
and prospective client
representatives
B.
Financial details and investor profile, including tax-related information
We may process the following personal data:
(i)
your bank account details;
(ii)
financial standing and history;
(iii)
credit rating;
(iv)
the nature of our mandate and any discretion you permit us;
(v)
investment preferences, restrictions and objectives (including your
personal circumstances, where relevant);
(vi)
job title;
(vii)
tax-related information and codes;
(viii)
information relating to your level of experience in investment matters;
and
(ix)
if you apply for a product or service provided by us, details to enable
us to assess your application for that product or service.
Natural person clients,
beneficial owners,
partners, trustees
protectors and settlors
Details of your financial standing and the guarantee you provide to us.
Guarantors only
C.
Records connected with service provision
5
0825
We may process the following personal data:
(i)
notes from interactions, meetings and conversations that you have
with GS (including records of your instructions – whether for your
own account or on behalf of the client you represent – and, to the
extent permitted or required by law, recordings of audio calls);
(ii)
records of correspondence and use of our websites, and/or our
brokerage, financial or other services GS provide electronically to
you and/or the client you represent (including data transmitted by
your browser and automatically recorded by GS servers);
(iii)
account details, records of agreements, payments, investments,
trades and other transactions that contain your name or other
personal data, and any identifiers that GS assigns to records
associated with you; and
All recipients of this
notice
TYPE OF DATA
WHO THIS APPLIES
TO
(iv) details regarding your
health or personal circumstances
if you
provide us with this information in connection with account
management or any support needs you have.
D.
Information used for background checks, monitoring and regulatory compliance
We may process details enabling us to honour your rights (including eligibility to
payments) under the terms of the relevant trust, fund or similar arrangement.
We may also process other details enabling us to meet our regulatory obligations,
such as your date of birth, nationality and address.
Beneficiaries only
6
0825
We may process the following personal data:
(i)
your date of birth;
(ii)
nationality;
(iii)
country of residence;
(iv)
documents required for anti-money laundering checks and
monitoring (including a copy of your passport or national identity
card);
(v)
records of any required disclosures;
(vi)
details of the origin of your wealth and of restrictions on your ability
to invest (such as any insider status or political exposure); and
(vii)
other details of your affiliations and/or of our relationship with you as
necessary to enable us to satisfy applicable regulatory reporting
requirements and identify any conflicts of interest
.
We may process data relating to any
political affiliations
you may have, as well
as
criminal convictions or allegations of offences,
where required or
authorised by applicable laws.
In some cases, we may obtain your personal data from GS affiliates or from third
parties. Depending on the products and services we provide to you, this may
including, for example:
(i)
trade or transaction counterparts;
(ii)
credit reference agencies;
(iii)
public registers (such as beneficial ownership registers);
(iv)
financial crime screening databases;
(v)
fraud prevention agencies; and
(vi)
persons or entities instructed by you to provide us with your personal
data.
Principals only
(see Appendix 2 for list
of Principals).
2.2
DATA RELATING TO THIRD PARTIES – RELEVANT TO PRINCIPALS
In addition to processing data on your representatives, we may also process personal data of persons who are
connected to you but with whom GS does not directly communicate, for example, dependants and family
members.
Additional information relating to our processing of their personal data is available online here:
goldmansachs.com/privacy-and-cookies/pwm-fpn.html
.
Before you provide data relating to third parties, you should ensure you are permitted to do so and provide
them with the information contained in that notice.
3.
For what purposes and which legal bases do we process
personal data?
3.1
PURPOSES FOR PROCESSING
GS always processes your personal data for a specific purpose and processes only the personal data relevant
for achieving that purpose. In particular, depending on our relationship with you and the products and
7
0825
services that we provide to you, we may process your personal data for the following purposes and for
compatible purposes:
A.
ACCOUNT OPENING
We will process data about you that we require in connection with opening your account or our client’s
account, such as identity verification information.
This may include review and processing application and account opening documents and, if you are a
Principal
(see
Appendix 2
), conducting background prudential and regulatory compliance checks.
B.
UNDERSTANDING CLIENT NEEDS AND OFFERING PRODUCTS AND SERVICES TO
OUR CLIENTS
This includes assessing client suitability for products and services and making decisions regarding
things such as risk appetite, tolerance, credit and strategy (where relevant to the products and
services provided). If you do not contract directly with us for products and services, this may include
communicating with and through you in connection with the offer of products and services to our
client.
C.
PROVIDING PRODUCTS AND SERVICES TO CLIENTS
We will process personal data to ensure the proper provision of our products and services, and to
keep appropriate records. This includes identity verification, transaction processing and keeping
appropriate records and registers (such as documenting agreements and recording your instructions –
whether for your own account or on behalf of the client you represent).
If you are a
beneficiary
, we will process details enabling us to honour your rights (including eligibility
to payments).
D.
MANAGING OUR RELATIONSHIP WITH OUR CLIENTS AND CONNECTED PARTIES
This includes:
(i)
compiling and using internal reports and notes,
(ii)
managing the client file,
(iii)
conducting risk reviews,
(iv)
allowing you to access GS websites and secure online platform and other technological
services; and
(v)
where applicable, managing any agreement or arrangement between us.
E.
COMMUNICATING WITH YOU
We will process data required to communicate with you in person, by audio calls, mail and email
(including to issue statements and reports, where applicable), keep records of our communications
with you, and manage any complaints.
F.
CARRYING OUT OPERATIONAL AND ADMINISTRATIVE FUNCTIONS
This includes:
(i)
carrying out billing-related and payments administration;
(ii)
staff and access management;
(iii)
preparing business reports and accounts;
(iv)
operating information technology systems;
8
0825
(v)
archiving and backing up data; and (vi) transferring personal data.
G.
HELPING US TO IMPROVE OUR PRODUCTS, SERVICES AND OPERATIONS
This includes:
(i)
conducting market research;
(ii)
analysis of client and prospective client preferences;
(iii)
transactions and market trends;
(iv)
evaluating potential new products and services’
(v)
evaluating the effectiveness of our marketing, as well as testing new systems and upgrading
existing systems.
(vi)
where permitted by law, this may also include recording audio conversations, and monitoring
emails and your use of our websites and of brokerage, financial or other services which GS
makes available to you electronically to assess, maintain and improve the quality of our
services.
(vii)
using technologies, such as machine learning, artificial intelligence, and generative artificial
intelligence, to develop, build and improve our systems, better manage our risks, products
and services and
to train our business models.
H.
PRUDENTLY MANAGING OUR BUSINESS AND PROTECTING AND ENFORCING OUR
RIGHTS
This includes:
(i)
assessing, monitoring and managing financial;
(ii)
reputational and other risk;
(iii)
conducting audits of our business;
(iv)
liaising with our regulator;
(v)
protecting data used by our business and establishing; and (vi) enforcing and defending
against legal claims.
I.
MARKETING
This includes direct marketing of products and services that we think may be of interest to you or to
our client or prospective client (as applicable), including on behalf of GS affiliates and our strategic
partners. Subject to applicable laws, we will not process your sensitive data for marketing purposes.
J.
MEETING OUR REGULATORY AND COMPLIANCE OBLIGATIONS AND PREVENTING
FINANCIAL CRIME
This includes:
(i)
performing prudential and regulatory compliance checks on an ongoing basis;
(ii)
account and transaction monitoring, transaction reporting, tax reporting;
(iii)
monitoring our management of client accounts and client interactions;
(iv)
making disclosures to, and complying with requests from, public authorities, regulators, tax
authorities, governmental bodies or law enforcement agencies, and investigating and
preventing fraud and other crime;
9
0825
(v)
Where permitted or required by law, recording audio conversations and monitoring emails and
your use of our websites and of brokerage, financial or other services which GS makes
available to you electronically; and
(vi)
if you are a client of Goldman Sachs Bank AG (“
Swiss Bank
”) or Goldman Sachs Bank
Europe SE, Luxembourg Branch (“
GSBE Luxembourg
”), tracing your whereabouts where
this is required by law or where your account may be at risk of falling into dormancy.
We may also process data for other purposes we notify to you from time to time.
3.2
LEGAL BASIS FOR PROCESSING
GENERAL
In most jurisdictions, applicable data protection laws require that we have a legal basis to process your
personal data. We explain each of these legal bases below.
The personal data processing described in this notice may be:
A.
necessary in order to comply with our legal obligations under certain laws
This applies to:
(i)
regulatory compliance checks referred to in parts
A
and
J
of section
3.1
;
(ii)
assessment of client suitability referred to in part
B
of section
3.1
;
(iii)
record keeping described in part
E
of section
3.1
;
(iv)
reporting and creation of accounts referred to in part
F
of section
3.1
;
(v)
business management and regulatory liaison activities referred to in part
H
of section
3.1
; and
(vi)
the processing described in part
J
of section
3.1
, in each case where carried out in
respect of the relevant laws.
B.
necessary for entry into, or performance of, any contract(s) with you
This applies:
(i)
if you are a
natural person client
,
to the majority of the processing described in parts
A
–
F
of section
3.1
(ii)
if you act as an
intermediary
, this relates to processing to manage our agreement with you,
referred to in part
C
of section
3.1
.
C.
necessary for the legitimate interest of GS or others, where these are not overridden
by your interests or fundamental rights and freedoms;
The "legitimate interests" are:
(i)
the processing purposes described in parts
A
–
J
of section
3.1
(excluding, for the Kingdom of
Saudi Arabia, part I of section
3.1
) to the extent the processing is not necessary in order to:
o
enter into contracts with you for the provision of these products and services and fulfil
our obligations under such contracts, or
o
comply with our legal obligations under certain laws;
(ii)
satisfy our accountability requirements and regulatory obligations globally; and
(iii)
exercise our fundamental rights and freedoms, including our freedom to conduct a business
and right to property.
10
0825
D.
in limited circumstances and where the legal bases for processing set out above do
not apply, processed with your consent (which we obtain from you from time to time).
DATA RELATING TO POLITICAL OPINIONS AND HEALTH
Applicable to Principals only (see Appendix 2 for list of Principals):
Where we process data revealing your
political opinions
as part of our anti-money laundering
checks and monitoring, we process this on the basis that you have:
(i)
manifestly made such data public (to the extent this applies); or
(ii)
on the basis that this processing is necessary for reasons of the substantial public interest
in preventing financial crime.
Where we process data regarding your
health
for the purposes of:
(i)
managing your account in accordance with your wishes and interests (primarily relevant for
natural person clients);
(ii)
accommodating your support needs, including making adjustments to our services; or
(iii)
protecting your interests, including your economic well-being,
we will do so with your explicit consent (which we obtain from you from time to time) or where we are
otherwise permitted to do so on the basis that it is necessary for reasons of substantial public interest
(for example to protect clients’ economic wellbeing).
You may have a right to object to us processing information concerning your health requirements and
we will consider your request – see part
A
of section
8
for further details.
If you have provided explicit consent, you can withdraw this consent at any time – see sections
3
and
part
G
of section
8
for further details.
In limited circumstances we may process any of the personal data we hold to the extent necessary to
defend, establish and exercise legal claims
.
3.2.3 DATA RELATING TO CRIMINAL CONVICTIONS AND OFFENCES
Applicable to all recipients of this notice:
We process personal data relating to criminal convictions and offences as required or authorised by
applicable law. For example, we may process data relating to actual or alleged criminal convictions
and offences as part of checks and ongoing monitoring for anti-money laundering purposes - see
parts
A
and
J
of section
3.1
.
4.
Your Consent
When GS is relying on your consent to process your personal data, you have the right to withdraw your
consent to such processing at any time. You can do this by contacting your Goldman Sachs using the
contact
details
at the start of this notice.
Where you have withdrawn consent but GS retains the personal data, we will only continue to process that
personal data where necessary, if we have a different legal basis to do so. However, this may mean that we
cannot continue to provide you with all or some of our services, in which case we may terminate the relevant
service(s).
Please note that this notice does not apply to consents you provide for any other reason, such as in
connection with bank secrecy purposes.
11
0825
5.
Sharing personal data
Due to the size and complexity of GS’s operations it is not possible to name each of our data recipients in this
notice. However, GS only shares your personal data with the categories of data recipient listed below.
Depending on our relationship with you, we may share your personal data with:
(i)
in respect of client representatives, the GS client you represent;
(ii)
GS affiliates (including custodians), external custodians and strategic partners;
(iii)
payment providers/recipients, beneficiaries, account nominees, intermediaries, and
correspondent and agent banks;
(iv)
market counterparties, and parties interested in or assuming risk in connection with a
transaction (such as issuers of investments), shareholders selling securities in any offering,
co-managers, lead managers or any agent or advisor to any of the above;
(v)
swap or trade repositories, swap data repositories or global trade repositories (or similar
facilities or institutions), and stock exchanges;
(vi)
clearing houses, and clearing or settlement systems; and specialised payment networks,
companies or institutions such as SWIFT;
(vii)
service providers who provide a service to or operate a system on behalf of GS or the
institutions, including those providing artificial intelligence and machine learning technologies,
or entities referred to in this section 5 (including non-affiliated companies);
(viii)
GS' lawyers, auditors and accountants and others providing professional advice;
(ix)
relevant governmental, regulatory, supervisory, law enforcement, prosecuting, tax or similar
authority or industry body under applicable laws of any relevant jurisdiction;
(x)
your agents, representatives and other persons acting on your behalf or to whom you instruct
or authorise us to disclose your data;
(xi)
with prospective purchasers and assignees in the event our business, or any part thereof, is
sold or re-organised, or in the event that any product entered into with you is sold, transferred
or assigned in whole or in part;
(xii)
any other person or entity GS reasonably thinks customary, necessary or advisable for the
processing purposes described in this notice or to whom GS is obliged by applicable law or
regulation to make the disclosure; and
(xiii)
any other party where we have first obtained your prior consent.
If our relationship with you is subject to any banking secrecy rules and regulations, we only share your
information as permitted under those laws, our agreement with you and/or any waivers you provide and this
section
5
should be read accordingly.
6.
International Transfer
The data sharing listed in this notice may involve the transfer of personal data to any country in which GS
conducts business or has a service provider or to other countries for law enforcement purposes (in principle
this could be any country in the world including, without limitation, the United States of America and other
countries whose data privacy laws are not as stringent as those in effect in the European Union, the Kingdom
of Saudi Arabia, Switzerland or the United Kingdom).
We will ensure that appropriate safeguards are in place to protect your personal data where these are
required by applicable data protection laws and that transfer of your personal data is in compliance with such
laws.
Where required by applicable data protection laws, GS has ensured that:
12
0825
(i)
service providers (including other GS affiliates) sign standard contractual terms as approved
by the European Commission or other supervisory authority with jurisdiction over the relevant
data exporter;
(ii)
the recipient is subject to a legally accepted set of rules to ensure data protection; or
(iii)
the data is transferred based on an exception, such as performance of a contract, consent, or
in connection with legal proceedings abroad.
You can obtain a copy of any standard contractual terms in place which relate to transfers of your personal
data by getting in touch with us using the
contact details
at the start of this notice.
GS leverages public, private, and hybrid cloud-based solutions where appropriate for certain compute, storage,
and business purposes. GS maintains a formal governance and control framework for cloud-based applications,
which are documented in formal standards.
7.
Use of Artificial Intelligence
We may use technologies, such as machine learning, artificial intelligence, and generative artificial
intelligence, which enable computer systems to automate or perform tasks that have traditionally required
human intelligence (“
AI Systems
”) to process your Personal Data in connection with the purposes described
in section 5 of this notice, “Why we use your personal data” and section 6, “Who we share your personal data
with and why”.
Our use of AI Systems does not generally result in automated decisions with any material legal or similar
effects. Where required under applicable law, we provide a specific notice and/or obtain consent. Our
personnel involved in the development or deployment of AI Systems are trained to recognise bias and are
required to take reasonable steps to mitigate bias decisions and to help prevent bias from occurring.
How we use AI Systems
AI Systems are used to assist and enhance activities as well as to automate repetitive tasks, generate
outputs, and provide insights and analytics to support our work. For example:
•
Search:
To enhance our search capabilities. AI Systems are used to extract relevant information
using specific questions, commands, and statements (“
Prompts
”) from our databases as well as
other documents, data, and records.
•
Summarise:
To classify, summarise, and digest content. AI Systems are used to condense
documents, information, and text into summaries.
•
Analyse:
To assist with research, analysis, and problem-solving. Through techniques like natural
language processing, AI Systems interpret, evaluate, and draw conclusions from data.
•
Generate Content:
To assist with drafting and generating content based on inputs or Prompts.
Content can be reviewed and amended by an individual for accuracy and completeness.
•
Translate:
To translate text between languages.
•
Transcribe:
To create a written transcription of spoken communication, for example meeting notes,
interviews, and podcasts.
8.
Direct Marketing
You are entitled by law to object to the use of your personal data for direct marketing purposes, including
profiling to the extent that it is related to such direct marketing.
13
0825
You can opt out of receiving any marketing emails by clicking the "unsubscribe" link in any such emails, or by
getting in touch with us using the
contact details
at the start of this notice.
9.
Data Subject Rights
You are entitled by law to the following rights in respect of your personal data:
A.
RIGHT TO OBJECT TO CERTAIN DATA PROCESSING
When GS is relying upon the lawful basis of “legitimate interest” to process your personal data (see
part
C
of section
3.2
above) then you have the right to object to such processing, and GS must stop
such processing unless we can either demonstrate compelling legitimate grounds for the processing
that override your interests, rights and freedoms or where GS needs to process the data for the
establishment, exercise or defence of legal claims. Normally, where GS relies upon legitimate interest
as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but
we will consider each case on an individual basis.
B.
INFORMATION AND ACCESS
You have the right to be provided with certain information about GS's processing of your personal data
and access to that data (subject to exceptions) including being informed of the legal basis and
purpose for collection of your personal data.
C.
RECTIFICATION
If your personal data changes, we encourage you to inform us of the change. You have the right to
require inaccurate or incomplete personal data to be updated or corrected.
D.
ERASURE
You have the right to require that your data be erased in certain circumstances, including where it is
no longer necessary for us to process this data in relation to the purposes for which we collected or
processed the data, or if we processed this data on the basis of your consent and you have since
withdrawn this consent.
E.
DATA PORTABILITY
Where we process your personal data on the basis of your consent, or where such processing is
necessary for entering into or performing our obligations under a contract with you, you may have the
right to have the data transferred to you or another controller in a structured, commonly used and
machine-readable format, where this is technically feasible.
F.
RIGHT TO RESTRICTION OF PROCESSING
You have the right to restrict GS's processing of your personal data while your request for data
rectification or objection to personal data processing is being considered, if we no longer need to
process your data but you need that data in connection with a legal claim, or if our processing is
unlawful but you do not want us to erase the data. If this right applies, we will continue to store your
data but will only further process it with your consent, for the establishment, exercise or defence of
legal claims, to protect the rights of another person, or for reasons of important public interest.
G.
RIGHT TO WITHDRAW CONSENT
To the extent that GS is relying upon your consent to process personal data, you have the right to
withdraw such consent at any time. Please see section
4
above.
14
0825
H.
COMPLAINT
You also have the right to lodge a complaint with a supervisory authority.
If you wish to exercise any of these rights you may do so by getting in touch with us via the
contact
details
at the start of this notice.
You can also send a written request to the GS entity which you have a relationship with, clearly
marked "
Individual Rights – FAO Private Wealth Management Privacy Steward
", using the
address listed for that entity in in
Appendix 1
to this notice.
The letter should be accompanied, in the case of a request for further information and/or access, by a
copy of your passport or other valid means of identification.
We may provide additional ways for you to exercise your rights from time to time.
Please note the rights listed above may not be absolute rights under applicable law. Some of the rights only
apply in certain circumstances and GS may have certain rights under applicable law to refuse your request.
10.
Retention of personal data
GS retains personal data for varying time periods in order to assist us in complying with legal and regulatory
obligations, to enable compliance with any requests made by regulators or other relevant authorities and
agencies, to enable us to establish, exercise and defend legal rights and claims, and for other legitimate
business reasons.
GS retains your personal data for the period of time required for the purposes for which it was collected or to
comply with legal, regulatory and GS policy requirements.
To the extent Goldman Sachs Bank Europe SE (“
GSBE
”) is the controller of your personal data processed
within the scope of this notice, the following additional information also applies. GSBE is subject to various
retention and documentation requirements pursuant to among others, the German Commercial Code
(
Handelsgesetzbuch
- “HGB”) and the Tax Code (
Abgabenordnung
- “AO”). The retention and documentation
periods specified in these codes last up to ten years. The storage period is also governed by statute of
limitations periods, which can be up to thirty years, for example, pursuant to secs. 195 et seq. of the German
Civil Code (
Bürgerliches Gesetzbuch
- “BGB”) where the general limitations period is three years.
11.
Is there an obligation to provide personal data?
Within the scope of our business relationship you only need to provide us with those personal data that are
necessary for the establishment and execution of a business relationship or that we are legally obliged to
collect. Without this personal data, we will usually have to refuse to conclude the contract or execute the
order, or be unable to perform or execute an existing contract and may have to terminate it.
The legal obligations include our obligations under anti-money laundering laws and regulations. These laws
and regulations require us to identify you before establishing our business relationship with you, for example
by means of your identity card, and to collect certain personal data about you such as your name, place and
date of birth, nationality and residential address.
To enable us to comply with these legal obligations, you must provide us with the necessary information and
documents in accordance with applicable anti-money laundering laws and regulations. You also must notify us
immediately of any changes arising in the course of the business relationship. If you do not provide us with the
necessary information and documents, we may not enter into the business relationship you have requested.
15
0825
12.
Updates to this notice
The information in this notice may change from time to time – for example, the categories of personal data that
GS collects (outlined in section
2
), the purposes for which it is used and the ways in which it is shared may
change.
This notice may be updated from time to time.
16
0825
APPENDIX 1
GS CONTROLLER ENTITIES AND CONTACT DETAILS
GS ENTITY
HEAD OFFICE OR
BRANCH OF GS ENTITY
(IF APPLICABLE)
CONTACT DETAILS
GOLDMAN SACHS INTERNATIONAL
London (Head Office)
Plumtree Court
25 Shoe Lane
London
EC4A 4AU
England
Dubai (Branch)
GOLDMAN SACHS INTERNATIONAL BANK
GOLDMAN SACHS BANK EUROPE SE
Frankfurt (Head Office)
Marienturm
Taunusanlage 9-10
60329 Frankfurt am Main
Germany
Amsterdam (Branch)
Dublin (Branch)
London (Branch)
Madrid (Branch)
Milan (Branch)
Paris (Branch)
Stockholm (Branch)
Luxembourg (Branch)
53 Boulevard Royal
L-2449 Luxembourg,
Grand
Duchy
of
Luxembourg.
GOLDMAN SACHS BANK AG*
Claridenstrasse 25
8021 Zürich
Switzerland
GOLDMAN SACHS (MONACO) S.A.M.
One Monte-Carlo, Place du
Casino
Building G, 6th Floor North
MC 98000, Monaco
GOLDMAN SACHS & CO. LLC* – in respect of
services provided to natural person clients,
beneficial owners, partners or settlors habitually
resident in the European Union, the United
Kingdom or Switzerland
200 West Street
New York, NY 10282
United States
17
0825
GOLDMAN SACHS SAUDI ARABIA
King Abdullah Financial
District
Building 1.11, Level 4
PO Box 52969
Riyadh 13519
Kingdom of Saudi Arabia
* Local Representatives: the local representative of Goldman Sachs International, Goldman Sachs
International Bank, Goldman Sachs Bank AG and Goldman Sachs & Co. LLC within the European Union is
Goldman Sachs Bank Europe SE. The contact details of Goldman Sachs Bank Europe SE are as set out
above. The local representative of Goldman Sachs Bank AG and Goldman Sachs & Co. LLC within the UK is
Goldman Sachs International. The contact details of Goldman Sachs International are set out above.
18
0825
APPENDIX 2
PRINCIPALS
Each of the following is a ‘Principal’ for the purpose of this notice:
1.
Natural person client or prospective natural person client of GS;
2.
Director, beneficial owner or shareholder of a company that is a client or prospective client of GS;
3.
Beneficial owner or fund unit holder of a fund to which GS provides services or seeks to provide
services;
4.
Principal, protector, settlor, grantor, trustee, trust officer or current beneficiary of a trust to which GS
provides services or seeks to provide services, or a person otherwise authorised to represent such
trust;
5.
General partner or partner with management responsibilities in a partnership that is a client or
prospective client of a GS;
6.
A person authorised by a client or prospective client of GS to give instructions to GS in respect of that
client’s account (including trading instructions and asset transfer instructions) or authorised to sign
documents on behalf of such client;
7.
Executor of an estate of a deceased natural person client of GS;
8.
Guardian of a natural person client of GS, where such client is a minor;
9.
Investment advisor to a client of GS, where such advisor is a natural person (rather than a legal
entity).