Privacy Notice | Sumitomo Mitsui DS Asset Management

Privacy Notice

Introduction

This Privacy Notice (the 'Notice') is issued by Sumitomo Mitsui DS Asset Management (Deutschland) GmbH ('SMD-AM DE' or “we”) and describes how SMD-AM DE may collect, store, use and/or disclose (“process”) personal data (as defined below) related to SMD-AM DE's current and prospective investors, current and prospective clients, third party intermediaries such as distributors and placement agents, website visitors, job applicants, employees, third-party service providers and other parties whose information is provided to SMD-AM DE ('you'). This Notice describes how and why we process Personal Data and what rights you can exercise with respect to your Personal Data. This Notice is also to be read in conjunction with our Cookie Policy.

This Notice applies when SMD-AM DE acts as the data controller within the meaning of the Data Protection Legislation as defined in this Notice.

When accessing this Website, we may process certain types of your personal data as defined in the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, 'EU GDPR') and/or any local implementing legislation, as amended from time to time, such as your name and email address.

'Personal Data' has the meaning assigned to it under the GDPR , as amended from time to time, and any relevant local data protection legislation, including the German implementing legislation, which includes the German Federal Data Protection Act (Bundesdatenschutzgesetz, 'BDSG') and the German Telecommunications and Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, 'TDDDG'), as amended from time to time, collectively being referred to herein as the 'Data Protection Legislation'. This means that 'Personal Data' is any data that can be related to you personally, e.g. name, address, email addresses, user behaviour, according to Art. 4 EU GDPR. Data that cannot be linked to your person, for example through anonymisation, is not personal data.

In principle, you are not obliged to provide us with your personal data. However, if you do not do so, we will not be able to provide you with unrestricted access to our website or answer your inquiries to us.

We do not use automated decision making or profiling (an automated analysis of your personal circumstances).

This Privacy Notice applies to the processing activities described above. It does not apply to other websites to which we refer via hyperlinks. We cannot accept any responsibility for the confidential handling of your personal data on these third-party websites, as we have no influence over whether these companies comply with data protection regulations. Please refer directly to these websites for information on how they handle your personal data.

About Us

SMD-AM DE is a German limited liability company (Gesellschaft mit beschränkter Haftung, GmbH) that acts as a tied agent for the account and under the liability of an investment firm, AHP Capital Management GmbH, that has its registered office in Germany or is active in Germany pursuant to Section 73 para. 1 German Investment Firm Act (Wertpapierinstitutsgesetz, 'WpIG') SMD-AM DE is registered in Germany with the Commercial Register in Frankfurt (company registration number: HRB 141563).

Categories of Personal Data We Collect

The Personal Data SMD-AM DE collects and processes includes, but is not limited to, the following:

Identification data: name, nationality, date of birth, place of birth, passport or national identity card number, national insurance number, title, marital status, gender, and signature.
Contact data: email address, residential address, corporate contact information, and telephone number.
Financial data: account number, beneficiary designation, source of Funds, source of wealth details, and investment history.
Electronic monitoring data: to the extent permitted by law, we may record and monitor your electronic communications with us, including telephone conversations, email and other electronic communications.
Marketing and communications data: preferences in receiving marketing from us and/or our third parties and communication preferences, and information about your use of our website.
Professional information data: position/job title, business address, telephone and email address.
Building and assets security data: records of visits to our premises, and CCTV recordings.
Services and transactions data: payment and transactional data to and from you.
Tracking data: online identifiers, including cookie identifiers, user and session identifiers, and IP addresses, as well as information about your consent choices. These data may constitute Personal Data even if they are not linked to your name or a registered user profile. Further information is provided in the “Website Services” and “Cookie Policy” sections.
Website technical data: information transmitted when accessing our website, including the requested resource, the date and time of access, browser and device information, and technical information about website performance and errors.
Employment data: title, location, compensation history, employment history, qualifications/training, and information provided on your CV, cover letter or application form.

Children and Special Category Data

We do not intend to collect Personal Data in relation to children or minors.

Special categories of Personal Data, such as data concerning health, racial or ethnic origin, or sexual orientation, may be processed subject to the conditions prescribed by the Data Protection Legislation, including to carry out our employment law obligations and for the purposes of equal opportunities monitoring.

Who This Affects

The Personal Data we collect, use and process relate, but is not limited to, the following individuals:

Current and prospective clients and investors, and their relevant employees, officers, or agents.
Current and prospective third-party intermediaries such as distributors and placement agents, and their relevant employees, officers, or agents.
Visitors to our website.
Job applicants and employees.
Third-party service providers, including vendors, and their relevant employees, officers, or agents.

We collect Personal Data in a variety of ways, namely either directly from you, public sources, third parties or in the course of your visits to our website.

Purpose and Lawful Basis of Processing

Personal Data collected by SMD-AM DE is collected, used and processed for the purposes set out in this Notice, including, but not limited to, the following purposes:

To process, manage and administer your holdings in the Fund or to consider services in such respect, in accordance with Art. 6 para. 1 lit. a) and b) GDPR.
To provide the requested services, in accordance with Art. 6 para. 1 lit. a) and b) GDPR.
To communicate with you, including to send investor/client reports and information, and to perform client-related and investor-related services in accordance with Art. 6 para. 1 lit. b) and f) GDPR.
To send marketing material and communications to improve our business and products and services offered, in accordance with Art. 6 para. 1 lit. a) GDPR.
To engage with distributors and third party intermediaries for the purposes of distribution of our products and services, in accordance with Art. 6 para. 1 lit. b) and f) GDPR.
To engage with third-party service providers, including vendors, in accordance with Art. 6 para. 1 lit. b) and f) GDPR.
To receive and respond to enquiries submitted through our contact form, by email or through other communication channels. We process the contact details and information you provide for the purpose of handling your enquiry. Where the processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, the legal basis is Art. 6 para. 1 lit. b) GDPR. In other cases, including enquiries made on behalf of a company, the legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to respond to enquiries and maintain business communications.
To comply with the applicable legal and regulatory obligations, including for the purposes of complying with our anti-money laundering and terrorist financing, sanctions, and tax reporting obligations, establishing the fitness and propriety of certain individuals, completing the required pre-employment screening, and investigating fraud or any other illegal activity, in accordance with Art. 6 para. 1 lit. c) GDPR.
To detect or prevent fraud or criminal activity to protect against breaches of our policies and procedures, and to protect our employees and assets, in accordance with Art. 6 para. 1 lit. f) GDPR.
To analyse visitors’ behaviours and improve our website and the services we offer, in accordance with Art. 6 para. 1 lit. a) GDPR.
To assess your qualifications and experience in the context of a job application, in accordance with Art. 6 para. 1 lit. b) GDPR.
To transfer Personal Data as set out in the “Disclosure of Personal Data” section, in accordance with Art. 6 para. 1 lit. a) and b) GDPR.

The purposes for which we collect, use and process Personal Data as set out above satisfy one of the lawful bases prescribed in the Data Protection Legislation, see Art. 6 GDPR, namely:

Performance of a Contract: We process Personal Data for the performance of a contract to which you are party, in accordance with Art. 6 para. 1 lit. b) GDPR. The provision of Personal Data for the performance of a contract is a contractual requirement or a requirement necessary to enter into a contract and its provision to us is mandatory.
Legal or Regulatory Obligation: We process Personal Data to discharge the applicable legal and regulatory obligations to which we are subject, including, but not limited to, obligations arising from the applicable anti-money laundering, terrorism financing and tax reporting laws and regulations, including under foreign account tax compliance (“FATCA”) and the common reporting standards (“CRS”), in accordance with Art. 6 para. 1 lit. c) GDPR. The provision of Personal Data for the performance of legal and regulatory obligations is a statutory requirement and its provision to us is mandatory.
Legitimate Interest: We process Personal Data where such processing is necessary for the purposes of our legitimate interests, including operating and developing our business, managing client relationships, ensuring internal administrative efficiency within our group, and improving our products and services, provided that such interests are not overridden by your interests or fundamental rights and freedoms (Art. 6 para. 1 lit. f) GDPR). Where processing is based on legitimate interests, you have the right to object in accordance with Article 21 GDPR.
Consent: We process Personal Data where you have provided your consent to the processing in accordance with this Notice, in accordance with Art. 6 para. 1 lit. a) GDPR.

In case we intend to further process your Personal Data for a purpose other than the original purpose for which the Personal Data was collected and processed, as set out above, we will provide you with information on that other purpose. In case the processing was based on consent, we will seek fresh consent to the processing of your Personal Data.

Where Personal Data is required to enter into or perform a contract or to comply with a legal obligation, failure to provide the necessary data may prevent us from providing the relevant service. Consent to optional website analytics and marketing is voluntary. Refusing or withdrawing such consent does not affect the provision of services that do not require that processing. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Website hosting and server logs

Our website is hosted by Microsoft Azure, UK based server managed By GrowCreate. When you access the website, technical connection data, including your IP address, is processed to deliver the requested content. This includes primarily the following data categories:

IP address of the requesting computer
Date and time of access
Amount of data transferred in each instance
Browser type and version
Operating system used
Referrer URL

We process this data to operate the website, maintain its availability and security, and investigate technical faults or misuse. The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

The hosting provider processes these data on our behalf. The hosting locations and any international transfers are described in the “International Transfers” section. Retention periods are specified in the “Data Retention” section.

Cookies, Tracking and Tools

The website partly uses so-called „cookies“. Cookies are small text files that are stored on your computer and saved by your browser.

We use so-called session cookies to recognize that you have already visited individual pages of our website. Session cookies are only stored for the duration of your access to the website and are automatically deleted when you close your browser or leave the website. Cookies may store certain information such as your IP address, information about the content you view, information about the content you provide so that you do not have to re-enter it each time you visit our website, and your preferences and settings. Cookies also help us provide you with customized content, speed navigation through our website, and allow us to learn about your visit and your use of online services. Cookies may store certain information such as your IP address, information about the content you view, information about the content you provide so that you do not have to re-enter it each time you visit our website, and your preferences and settings. Cookies also help us provide you with customized content, speed navigation through our website, and allow us to learn about your visit and your use of online services.

Our cookies are primarily used to carry out an electronic communication process or to provide certain functions you have requested. The legal basis for the corresponding processing of personal data is Art. 6 (1) lit. f) GDPR (legitimate interest), as well as § 25 (2) TDDDG, insofar as the cookies concerned are technically necessary for the provision of the services you have requested. The specific legitimate interest arises from the above-mentioned purposes, in particular the optimization of website use:

If the cookies used are not to be classified as technically necessary, we will obtain your consent for this in accordance with Art. 6 (1) lit. a) GDPR in conjunction with § 25 (1) TDDDG. You always have the option of revoking your consent at any time with effect for the future, by simply adjusting your consent preferences via the icon in the bottom left corner of this website.

As a rule, you can configure your browser so that no cookies are stored or a message always appears before a new cookie is created. However, deactivating cookies may mean that you cannot (fully) use all the functions of our website. Insofar as other cookies or cookie-like tools (e.g. tools for analyzing your surfing behavior) are used on or in connection with the website, these are dealt with separately below.

In addition to cookies, this website also uses other tracking tools and third-party services to provide a secure and reliable user experience. Those tools will be explained in the following sections.

For more information and an overview of the specific cookies we use, please see our Cookie Policy.

Google Analytics

If you give your consent via our consent-tool in accordance with Art. 6 (1) lit. a) GDPR in conjunction with § 25 (1) TDDDG when visiting the website, we use Google Analytics to analyze your user behavior. Google Analytics is a web analysis service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (“Google”). Google Analytics uses cookies, which are stored on your computer and enable your use of the website to be analyzed. The information generated by the cookie about your use of the website is usually transmitted to a Google server and stored there. This server may also be located in the USA.

However, since we have activated IP anonymization on the website, your IP address will be shortened by Google within member states of the European Union or in other states of the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website in order to compile reports on website activities. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent the storage of cookies (after giving your consent) by setting your browser software accordingly. However, we would like to point out that in this case you may not be able to use all the functions of the website to their full extent. You also have the option of revoking your consent at any time with effect for the future, by simply adjusting your consent preferences via the icon in the bottom left corner of this website.

Further information on Google Analytics can be found here:

https://marketingwebsite.google.com/about/analytics/terms/us/ & https://policies.google.com/privacy

We have concluded a data processing agreement with Google. We have also concluded the European Commission’s standard data protection clauses (SCC) with Google to safeguard data protection in the event of a possible transfer to a third country (e.g. the USA). Google has also certified itself to the EU-US Data Privacy Framework and has thus undertaken to guarantee a level of data protection that is equivalent to the level of data protection in the EU.

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or perform any independent analyses. It is used solely to manage and deploy the tools integrated through it.

However, Google Tag Manager collects your IP address, which may also be transferred to Google’s parent company in the United States.

Since Google Tag Manager is necessary to perform certain actions on this website (e.g., activating the cookie consent tool), its use is based on Art. 6(1)(f) of the GDPR in conjunction with § 25 of the TDDDG. In this case, the legitimate interest arises from the activation of functions necessary for the full and legally compliant operation of the website.

Google’s U.S.-based parent company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when data is processed in the United States. Every company certified under the DPF commits to complying with these data protection standards. As a result, the transfer of data to Google is legally permissible in this case. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/list

For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider’s privacy policy. There you will also find further information about your rights in this regard and settings options for protecting your privacy: https://policies.google.com/privacy?hl=de&gl=de

Google reCAPTCHA

On this website, we use the CAPTCHA service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

The service verifies whether an entry is made by a human or is the result of abusive, machine-based, or automated processing, and blocks spam, DDoS attacks, and similar automated malicious access attempts. To ensure that an action is performed by a human and not by an automated bot, the IP address of the device used, identification data regarding the browser and operating system types used, as well as the date and duration of the visit, are collected and transmitted to the provider’s servers for evaluation.

Since the use of a CAPTCHA service is necessary to ensure the secure use and availability of the website, Google reCAPTCHA is used on the basis of Art. 6(1)(f) of the GDPR in conjunction with § 25 of the TDDDG. In this case, the legitimate interest arises from protecting the website against misuse and ensuring its ongoing availability.

Cookiebot

We use cookies and similar technologies to operate our website and, with your consent where required, for optional functions, analytics and marketing.

We use the Cookiebot Consent Management Platform, provided by Usercentrics A/S, Denmark, to obtain, record and manage your choices. To display the consent interface, Cookiebot processes technical information such as your IP address, browser information, language and the website address. Your choice and a consent identifier are recorded, and the “CookieConsent” cookie is used to remember your selection.

The processing necessary to obtain and demonstrate consent is based on Art. 6 para. 1 lit. c) GDPR in conjunction with Art. 7 para. 1 GDPR. Storage of or access to information on your device that is strictly necessary to remember and implement your selection is based on Section 25 para. 2 no. 2 TDDDG.

Other storage of or access to information on your device requiring consent takes place only with your prior consent under Section 25 para. 1 TDDDG. Where the associated processing of Personal Data is based on consent, the legal basis is Art. 6 para. 1 lit. a) GDPR.

You can reject optional services and change or withdraw your consent at any time through the consent tool. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Details of the individual cookies, their purposes, providers and lifetimes are available in our Cookie Policy.

jsDelivr-CDN

To ensure that we can deliver our individual web pages to you quickly and flawlessly across all types of devices, we use the open-source services provided by jsdelivr.com, operated by the Polish software company ProspectOne, located at Królewska 65A/1, 30-081, Kraków, Poland.

This is a Content Delivery Network (CDN)—a network of regionally distributed servers connected via the Internet. This allows content, especially large files, to be delivered quickly and efficiently, even during periods of high traffic.

Of course, we want to offer you a comprehensive and well-functioning service through our website. This includes a fast website. With the jsdelivr.com CDN, our website loads much faster for you. The use of the jsdelivr.com CDN is particularly helpful for users from abroad, as the page can be delivered from a nearby server.

What data is processed by the jsdelivr.com CDN? jsDelivr is designed to allow the download of JavaScript libraries hosted on npm and GitHub servers. However, WordPress plugins can also be loaded, provided they are hosted on WordPress.org. In order to provide this service, your browser may send personal data to jsdelivr.com. jsDelivr may therefore collect and store user data such as IP address, browser type, browser version, the website being loaded, or the time and date of the page visit. The privacy policy on jsdelivr.com explicitly states that the company does not use cookies or other tracking services.

jsDelivr has servers located in various countries, and your data may also be stored outside the European Economic Area. jsDelivr retains personal data processed on our behalf for as long as necessary to provide the services offered, to comply with legal obligations, to resolve disputes, and to enforce agreements.

If you have consented to the use of the jsdelivr.com CDN, the legal basis for the corresponding data processing is this consent. According to Article 6(1)(a) of the GDPR (Consent), this consent constitutes the legal basis for the processing of personal data as it may occur during collection by the jsdelivr.com CDN.

We also have a legitimate interest in using jsdelivr.com-CDN to optimize our online service and make it more secure. The corresponding legal basis for this is Article 6(1)(f) of the GDPR (Legitimate Interests). However, we only use the tool to the extent that you have given your consent.

For more information on data processing by the jsDelivr software service, please refer to the company’s privacy policy at https://www.jsdelivr.com/terms/privacy-policy_isdelivr-net.

Microsoft Clarity

We use Microsoft Clarity, a service provided by Microsoft Corporation, to monitor and analyze the performance, stability, and usage of our website. Clarity helps us identify technical errors, performance issues, and other problems so that we can continuously improve the functionality and reliability of our website.

In this context, Clarity may collect technical information about your use of our website, such as IP address, browser and device information, operating system, session information, page views, timestamps, performance data, and information about errors or other technical events. Depending on the configuration of the service, this information may also include pseudonymous identifiers and information about interactions with the website.

The processing of this data is carried out for the purpose of ensuring the technical operation, security, and continuous improvement of our website. The legal basis for processing is Art. 6(1)(f) GDPR, based on our legitimate interest in monitoring and improving the security, performance, and reliability of our website or Art. 6(1)(a) GDPR, where applicable and where consent is required. You can withdraw your consent at any time without reason. Withdrawing your consent will not affect any data processing based on the given consent up to that point.

Microsoft may process the collected data on our behalf as a service provider. Depending on the configuration and location of the relevant Microsoft services, data may also be processed in countries outside the European Economic Area (EEA). Microsoft’s U.S.-based parent company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when data is processed in the United States. Every company certified under the DPF commits to complying with these data protection standards. As a result, the transfer of data to Microsoft is legally permissible in this case. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/list

Disclosure of Personal Data

We may disclose Personal Data to the following recipients:

Our affiliates. Those departments (this includes our immediate parent company, Sumitomo Mitsui DS Asset Management Company, Limited, headquartered in Tokyo, Japan) will receive access to your data as needed to fulfill our contractual and legal obligations. This includes other SMD-AM DE affiliates, for example in case they provide marketing support to SMD-AM DE. Service providers and vicarious agents employed by us (e.g. technical service providers) may also receive data for these purposes. We limit the transfer of your personal data to what is necessary, taking into account the requirements of data protection law. In some cases, the recipients receive your personal data as order processors and are then strictly bound by our instructions when handling your personal data. In some cases, the recipients act independently in their own data protection responsibility and are also obliged to comply with the requirements of the GDPR and other data protection regulations.
Non-affiliated third parties. This includes third-party service providers of SMD-AM DE. This includes, but is not limited to, external legal counsel, financial advisors, auditors, IT service providers, third-party email marketers, and third parties in connection with or during negotiations of any corporate transaction, including but not limited, a merger or acquisition, business reorganisation, transfer or disposal. Further information about the providers involved in operating our website and their processing activities is set out in the “Website Services” and “Cookie Policy” sections.
Third party organisations related to advertising, analytics and marketing, including Google Analytics, Google Advertising, LinkedIn Advertising, and Microsoft Clarity, Salesforce and Account Engagement. These tools help us analyse the website usage, enhance user experience, and support our marketing and client relationship activities. The data processed by these tools may include page views, device and engaging behaviours, location data, and, in some cases, personal data such as name, email address and job title. Google Analytics and Microsoft Clarity collect only anonymised data to track user interactions without processing personal data. Google Advertising and LinkedIn Advertising may process personal data for targeted advertising and user targeted behavioral analysis. Salesforce and Account Engagement process personal data for marketing and customer relationship management purposes.
For legal and regulatory purposes to third parties such as government entities, law enforcement authorities, courts, competent regulators, tax or other competent authorities, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

Marketing and Opt-Out

Pursuant to the Data Protection Legislation (Art. 6 para. 1 lit. a), f) GDPR, Section 7 para. 2 of the Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, "UWG")), marketing, including by electronic means, may require your consent in certain circumstances. You can unsubscribe from all marketing communications at any time either by clicking on the opt-out link in the marketing communication you will receive from us or third parties or by contacting us as set out in the “How to Contact Us” section of this Notice. You will then be removed from the marketing lists.

International Transfers

To provide global services and in the course of running our business, we may transfer Personal Data outside of the EU and the EEA.
The transfer of Personal Data outside of the EEA to countries that offer an adequate level of protection is made based on the European Commission’s adequacy decision pursuant to Art. 45 para. 3 GDPR, if the country to which the Personal Data is transferred to is covered by such a decision.

We may also transfer Personal Data to countries in respect of which the European Commission has not adopted an adequacy decision. In such cases, SMD-AM DE will ensure that appropriate safeguards are in place for any such transfer such as the use of the EU Standard Contractual Clauses (SCCs) according to the GDPR adopted by the European Commission pursuant to Art. 46 para. 1, para. 2 lit. c) GDPR.
Finally, the transfer may be made based on your consent to the transfer prior to the Personal Data being transferred and after having informed you of the possible risks of such transfer for you pursuant to Art. 49 para. 1 lit. a) GDPR.

Data Retention

We will retain your Personal Data for as long as necessary to carry out the purposes of the processing as set out above, subject to legal (e.g., statute of limitations) and regulator obligations. For example the processing for a limited period is necessary for the fulfillment of statutory retention obligations, e.g., arising from Section 238, 257 of the German Commercial Code (Handelsgesetzbuch, HGB) and Section 147 of the German Fiscal Code (Abgabenordnung, AO) as well as for the preservation of evidence taking into account the statute of limitations according to Sections 194 et seq. of the German Civil Code (Bürgerliches Gesetzbuch, BGB), these limitation periods can be up to 30 years, with the regular limitation period being three years. In particular, any Personal Data collected and processed pursuant to money laundering obligations will be retained for five years following the termination of the business relationship (Section 8 para. 4 Anti Money Laundering Act (Gesetz zur Bekämpfung der Geldwäsche, GwG)).

For enquiries submitted through our contact form or by email, we retain the information for as long as necessary to resolve the enquiry and deal with reasonably foreseeable follow-up questions. Further retention may be necessary to comply with applicable legal obligations or to establish, exercise or defend legal claims.
Website server logs are retained for as long as necessary for that purpose.

Your Rights

You have various rights in connection with the processing of your Personal Data. Please note that the rights below may be subject to limitations as prescribed by the Data Protection Legislation and may not be available in certain circumstances. You have the right to:

In accordance with Art. 15 GDPR, you have the right to receive information about the personal data stored about you. You also have the right to receive a copy of your personal data processed by us and, in the event of a data transfer to a third country, the right to be informed of the appropriate safeguards implemented by us to ensure data security.

If we process incorrect personal data about you, you have the right to have this data corrected in accordance with Art. 16 GDPR. In addition, you have the right to have incomplete personal data completed by us.

If the legal requirements are met, you can also request the deletion (Art. 17 GDPR) or restriction (Art. 18 GDPR) of the processing of your personal data.

In accordance with Art. 20 GDPR, you can assert the right to data portability for data that is processed automatically on the basis of your consent or a contract with us. In this case, we are obliged to hand over the personal data concerned in a structured, commonly used and machine-readable format.

In the case of data processing that we carry out on the basis of a legitimate interest, you have the right to object to the data processing (Art. 21 GDPR). In this case, we may no longer process the data concerned unless there are compelling legitimate grounds for further processing that outweigh your interests.

If you have given your consent to the processing of personal data, you can revoke your consent at any time and without giving reasons with effect for the future. Any data processing that has already taken place up to that point on the basis of this consent remains unaffected by the revocation.

You can assert these rights against us using the contact details given above. However, you also have the right to complain about the processing of personal data by us directly to a data protection supervisory authority of your choice.

How to Contact Us

If you have any questions or comments about this Notice, you may contact us at privacy_DE@smd-am.co.jp.

You may also write us at:

Sumitomo Mitsui DS Asset Management (Deutschland) GmbH
Neue Mainzer Straße 52-58
60311 Frankfurt
Germany

Updates to our Notice

We may update this Notice from time to time. For any material changes to this Notice you will be notified either by us prominently posting a copy of the updated Notice or by communicating with us through an appropriate channel.